Solved

Good Morning, Has anyone ran into issues when updating the firmware on MCLAG switches that would cause the switches to disconnect? I'm wondering if the MCLAG group of switches need to be updated to the same firmware at the same time? Topology:FW1 & FW2 (HA Active/Passive)SW1 & SW2 MCLAG Group 1 (SW1 connected to SW3)(SW2 connected to SW4)SW3 & SW4 MCLAG Group 2 (SW3 connected to SW5)(SW4 connected to SW6)SW5 & SW6 MCLAG Group 3 SW1 & SW2 are running FortiSwitchOS 7.4.1SW5 & SW6 have been updated to FortiSwitchOS 7.4.3 After updating SW4 to FortiSwitchOS 7.4.3 last night we lost access to switches 3-6. The log message that stands out is "action="unsup-cfg" status="none" msg="MCLAG: **peer software mismatch local-software(v7.4.1,build0787,230921 (GA)) peer-software(v7.4.3,build0830,240422 (GA))"" Disabling the port on SW1 that connects to SW4 gave us access back to SW3-5 but SW6 is still down. I'm assuming that updating SW3 to 7.

Hi, we are in the middle of changing a FG300 cluster to a new FG200 cluster. In the old config we didnt use SD WAN, we had like one WAN1 for the MPLS connections and WAN2 and WAN3 for Internet Access. WAN1 mainly has all VIPs and VPNs, also it is a shared Internet Access so thats why we got WAN3 for all outgoing traffic. Now we would like SD WAN for Load Balancing or primary failover reasons but I am not sure what would be the correct configuration. If I do the implicit rule with 99%  - 1% or what is the best way? Thanks for your suggestions!

Hi Team, When the user registers his account on the portal, he must select a prefix for the phone number. The question is how to set my country to be my favorite or by default will be chosen. The current default setting is +1 and I don't know how to change it. To clarify the question, how to change it so that the +48 prefix is always shown to each user. I traied change that in html code, but i failed. I searched the forum but didn't find anything. A request for help Fortiauthenticator 6.5.3  

Hello everyone, Our Firewall was configured with several virtual IPs (static NATs) to forward internet traffic do our internal services.Currently we do have three public IP adresses but I want to merge them. So I do want to use virtual IPs with FQDN.I guess I need to enter the External FQDN in the top field, and the internal fqdn in the bottom field (mapped address). We use windows DNS server for internal name resolution (so that our clients can find each other). When we do intern name resolution the public domain name gets overwritten with the internal IP address... (e.g. service.company.at gets an private IP adress in our company lan and no the public one) so traffic does not have to use the internet. So I guess I somehow need to add two different DNS to FortiGate - one for public dns name and one for the private IP adress (=mapped address). Does that even work when both names are identically? 

Hi,I can't get a reverse rule to trigger for VLAN communication. VLAN 30 is able to ping VLAN 100, but 100 can't ping 30. VLAN 30 Laptop[10.0.30.2] can ping 10.0.100.200, and 10.0.100.1, and 10.0.30.1VLAN 100 Laptop[10.0.100.200] can't ping 10.0.30.2, but can ping 10.0.100.1 and 10.0.30.1FG and Laptops are connected to 8 ports switch. FG is trunk port. Laptops are VLAN Access Ports 30 and 100 respectively.0 bytes go across 100 -> 30 rule, unless I do Policy Match, then its the 40bytes FG tests withI am going to re-start the FG after posting this...just in the event something rules wise effect its. I have about 50 rules, and nothing worked as expected, so I cut down to 3 rules and smaller test setup. The other rules not included are 30 -> Wan (working fine) and Implicit Deny. Here are screen shots from the Firewall:Reset counts to ZeroBoth Laptops doing PING to each otherPolicy MatchPolicy Match ResultPolicy After Policy MatchVLAN settings

Hi, When remote user client system trying to access the internal application via Fortisase to SDWAN SPA, it is not showing actual ip of the client system. Instead of it shows the tunnel interface ip of the Fortisase.How can we get the actual client ip details on sdwan spa.Please guide. Regards,Ganesh

Good morning,Every time our user goes to connect to the VPN to access the server, reaching 98% he disconnects or sometimes he connects and falls, only the second time it works. Is there anything I can check to see why this problem occurs?

HiHave followed this link to setup a S2S between a 60F (local location) and a Draytek Vigor (remote location)https://www.draytek.com/support/knowledge-base/5203 I have got the tunnel up successfully and can access resources to/from both locations. I want to make this 1 way now so only the local location can access resources at the remote location Is it isas  simple as only creating the local to remote Policy and not bothering with a remote to local policy? I have disabled the Remote to Local policy on the 60F after following that guide and that seems to have achieved what i want and stops communication from Remote to local whilst still allowing Local to Remote connectivity,  just checking this is all i need to do? Many Thanks Many Thanks

Good morning,We're receiving sporadic reports of users unable to launch FortiClient and being presented with the following error message. The guidance provided to the users was the following: https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-fix-the-A-JavaScript-Error-Occurred-in-the/ta-p/230823  Verification the users have uninstalled Microsoft Visual C++, FortiClient, and reinstalled both is shown below.  However the user reports the Javascript issue is still ongoing. Can Fortinet support provide next steps for the users to try, please? Users are not FortiClient EMS users. FortiClient version 7.4 is being used. Initial error was with FortiClient version 7.0.2.

hi hello allI need to replace a FGT200B v5.2.13,build762 (GA) with a FGT 400D v6.4.9 build1966 (GA) but I can't find the option to add "device"User and Device -> Device -> Device Definitionspresent on the FGT200Bis it a device or firmware version problem for the FTG400D?any suggestions about new hardware and firmware.thanks a lotMassimo

Hi All,  Customer is running non forti APs with a Wireless Controller located over an IPSec VPN from my Fortigate to their ASA.   AP's are losing their connection to the controller, and the customer is confident the Fortigate isn't sending on CAPWAP traffic.    I thought this might be an MTU issue, with ASA side set to 1500, Fortigate was set to 1420 so I've increased it to 1500 but issue is still ongoing,  Any ideas, or debugs I can run to help determine the cause?   Thanks, 

When ADOMs are activated, When ADOMs are activated, Hello, I'm a beginner and I've activated ADOM in my lab.I have 2 ADOMs:  - ADOM Si1 - ADOM Si2 And a third ADOM that was created automatically. THE ROOT ADOMThere is no policy package in this ADOM.What is it for? Thanks for your help.

I’m working on a project where a client is installing a new camera system. The vendor will provide their own router and PoE switch. We need to connect this router to the client’s existing firewall (91G), and the client has available public IP addresses. Can I configure the 91G firewall to pass-through mode, allowing the vendor’s router to use a public IP directly? Or is there a better approach to integrate the vendor’s router with the client’s firewall? BTW, the camera vendor will handle all system management independently and requires full access to their equipment, which will be completely separate from the client’s network. Thanks!

Hi all, i am trying to get a certificate for a cmp client from the FAC (6.6.0).In beforehand igenerated a .pem keypair on the cmp client. (openssl genrsa -out key.pem 2048)generated CA cert for FACgenerated server cert for cmp server on the FACThis the command:openssl cmp -cmd ir -server http://192.168.1.99/app/cert/cmp2/ -subject /C=Country/ST=State/L=City/O=Company/CN=PFC200/emailAddress=placeholder@company.com -newkey key.pem -certout cert.pem  The problem is, that the cmp client throws the following error:CMP info: sending IRCMP info: received ERRORCMP error: missing protectionI could not find any hints as to how i can resolve the error/what the reason is. Unfortunately i cannot see any log entries in the logs of the FAC to further investigate. A capture from the answer of the cmp server on the FAC in wireshark shows the following:It was not possible to enter the screenshot, but it also said "missing protection" and failinfo was "BadRequest" with the error code being 4865

Hi everyone,Fresh out of the box and upgraded, no previous Fortigate here, so I am very green to this. Anyway, I have a rule from my LAN to SD-WAN with Source and Destination "All" and I have ICMP, DNS, Web Services, UDP 443, and Speedtest.net all allowed Services. Yet it gets Zero traffic. Meanwhile below it I have specific VLAN in the interface and source and ALL /ALL Destination and Service and that is catching all my internet traffic. FG is top down correct? Any idea where to look, I thought LAN interface (all the VLANS are under the LAN Virtual Switch) and all would cover the VLANS as well....seems to work for the implicit deny.    Here is the "all" address edit screen:SD-WAN is only a single local LAN address while I set it up...and that only Static Route is 0.0.0.0/0 to the virtual-wan-link.Thanks for any help and pointers...wondering if I went to "high" on the version.

Hello fellas, I've hit a snag trying to configure ZTNA to work with FQDN and I can't really seem to understand why.Firstly I'll state that the configuration works when using IP addresses but when changing the IP address to a FQDN it just doesn't work.the FQDN are configured on both the 'ZTNA Destinations' on the EMS server and the ZTNA Server on the FW there's a FQDN entry that resolves to the internal IP, I've also tried specifying the Virtual host and directing to the IP which also didn't work, I feel like I'm missing something along the way.Thanks in advance.

Hello,When I sent an e-mail yesterday to the address where I could send e-mails before, I received a reply from @fortimailcloud.com with the error "the following addresses had permament fatal errors".I am sending a screenshot

Hi everyone,We're using Fortigate Cloud.If the log transfer is over than the transfer limit, how is it?Old logs is deleted on the cloud, isn't it?Best regards.

Hi I have some Fortigate devices. I would like to have them both in my Fortimanager and my Forticloud. The Fortimanager is managed locally via a VM. Is it possible to do so? Can you give me more information? (I tried to add a device that is already added in Forticloud to my Fortimanager, but it failed)

I'm looking to propose a FortiGate ruggedize 60F for an industrial environment, after reviewing the datasheet I notice that SSL VPN might not be supported. Extract from the DatasheetThere is nothing in the data sheet which indicates the memory of the device, for this deployment SSL VPN will be required. Can anyone provide some clarity on this?

Hi, I am trying to figure out if I can setup 2 separate SSLVPNs with 2 separate SSL certificates, but I am getting nowhere.Is this possible?

I have a problem that i can't connect to the fortiguard servers. Ping to service.fortiguard.net, update.fortiguard.net and guard.fortinet.net works. I also tryed to change the porst like some articles described me to do it. But i can't solve the problem with this guides. Can you help me?

Is it possible to have more than one switch in the 'config target-port' section of the configuration or are you limited to one switch....? Also, I'm assuming you can only have one RSPAN or ERSPAN block of config... Sorry.... still new to Fortinet CLI after working in the other networking worlds equipment whom I would rather not even mention...         

Client have loaded a faulty configuration and have lost access (cannot login). We want to factory this unit.FGT 800D does not have a RESET button, only a NMI button. The below link does not work because we do not have any consolse access.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-reset-a-FortiGate-with-the-default-factory/ta-p/196896Is there a way to factory reset the FGT 800D model as per below link?https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-To-Reset-To-Factory-Default-Configuration/ta-p/198660Appreciate Y'all. TIA :) 

Greetings all,I'm having an issue which I get the sense will be a simple fix but I'm at a bit of a loss. I'm trying to add a certificate to iOS to use for connecting to a fortigate vpn. I have no trouble getting the certificate onto the iphone and forticlient detecting it, but its asking for a passphrase. I generated a certificate key pair via Easy-RSA and was able to upload them to the Fortigate without issue. The private key has a password so I was able to enter that into Fortigate without issue. But on the iphone, my understanding is its just the one file, and it needs to be the certificate, which does not have a password. But the app will not let it be used without a password, and leaving it blank returns incorrect passphrase.  What am I doing wrong? I'd appreciate any help. Thanks!