Solved

Hi, Can we extract indicators from a password protected file (pdf, csv) ? Thanks

helloI have two FG 30eI CONNECT between fg1 and fg2 (connected by SD-wan) site to site no NAT1...when i connected site to site it is working but clients cannot open any URL by SD-wan( I put routing to SD-wan and put IP policy to allow  traffic but no work)2...i can ping from client that connected from fg1 to clients connected to fg2 but fg2 can not ping to any IP in fg2 whycan help me please

HelloI have FotrtiGate100FI have 3 building in my company each building has connection to MY FortiGate Building A - connect to port 17   ( I create VLAN 10 for LAN and  VLAN 11 for AP )Building B - connect to port 18   ( I create VLAN 12 for LAN and  VLAN 13 for AP)Building C - connect to port 19    ( I create VLAN 14 for LAN and  VLAN 15 for AP)I need All AP  in all Building to take IP Address from same range anyone can help me thanks for allbest regards.

Hi all ,Please , i have an issue with fortisiem when i generate report for last 7 days and export the result , the exported file not showing all days , its show just last 1 day .Thanks  

Hi, We are replacing a FG-80E with an FG-81F (7.2.8) and hit the following issue when changing the external IP address for our VIPs from test to live that the live DMZ machines are not contactable from the internet. We have setup the FG-81F with a temp external IP address A.A.A.100 and two VIPS A.A.A.101 and A.A.A.102, these are both mapped to 10.10.10.13 and 10.10.10.14 and a test Linux machine is sitting there and is quite happy, it can be contacted from the outside and ping to the outside world. So it seems that the firewall policies are happy. When we replace the IP addresses with the actual live ones A.A.A.50, and VIPS with A.A.A.51 and A.A.A.52 then our live Linux servers (10.10.10.13 and 10.10.10.14) can not be contacted externally and they can not ping out. They can be contacted from the LAN->DMZ though, if the machines on the LAN contact them via their external IP addressed they can, however external machines can not contact them. The only changes we mak

Hello Team I created 6 VLANs on an interface, I want to configure a rule to communicate 5 VLANs to one, but I can't find how to do it. The single way is set one by one rule. Does anyone know how I can do this? Regards

from time to time FortiManager 7.4.3 tries to "modify" my CLI template from "config system global" to "config 1 system global" when pushing to FortiGate Firewall 60F/100F/200F. I can force this error by "retrieve config" and pushing "policy package AND device settings" afterwards. Pushing ONLY device settings works and does not have this issue and once only device settings are pushed policy also works :) Does anyone else have this issue or maybe a solution?  Thanks...

Hello everyone!I was wondering why is not possible to assign named address to SD-Wan, or I'm missing some option/configuration that enables it.For example:I have this static routesAnd I want them in a single static route with named address I'm using a Fortigate 100E with FotiOS 7.0.12 Thank you for taking the time to read my question and for any help you can give me.

I have searched high and low, but cannot get a clear answer on this, created a CSR last year for a Fortigate, got it signed by ROOT CA, installed cert and used it for SSL VPN, no problem at all. Now its renewal time, got the new cert from the signing authority GODADDY, and I cant install it?  I have the ROOT CA cert on there, so I goto Certificates > import > Certificate > Local certificate, select my .cer file and I get this "Certificate file is duplicated for CA/LOCAL/REMOTE/CRL.cert"  I assumed I would delete the old one and replace with this one, same issue? any help please? the troubleshooting link for this error is not helpful, I really dont understand why it doesnt work Thanks

Hi Everyone, I'm facing a strange problem, I have 2 usernames which are working fine on different machines but on some specific machines as soon i hit connect it got stuck on connecting with no progress. I'm facing this issue on windows 10 pro machines. personally i have tested it on windows11 and it's working fine on them. I'm unable to see any logs when the user is stuck on the connecting stage.   

I have 2 standalone FGT200E firewalls running 6.1.15, for the last month Qualys has failed the PCI ASV scan with a detected vulnerability QID150004 Predictable Resource Location Via Forced Browsing, its finding an /image/ fileRESULT:url: https://x.x.x.x/images/Payload: https://x.x.x.x/images/comment:Original URL is: https://x.x.x.x/matched: HTTP/1.1 200 OK I have SSL VPN in tunnel only mode, web mode disabled I came across an article https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-prevent-the-SSL-VPN-web-login-portal-from/ta-p/215905 to stop the web login page from appearing, which i applied to no effect. I also changed all the portals to not allow forticlient download in case this was causing the problem. Nothing has changed on Qualys that i know of & as mentioned scans were fine until the start of July.I've searched forums, google etc but not coming across any similar issues. 

Is there a way to configure FortiGate to not reflect the DHCP server IP when the end user (guest) opens command prompt on the client machine and perform an "ipconfig /all"? If there is no direct configuration, any other ways for us to hide the IP of DHCP server? Thank you!

I am having a problem running an automation to backup my computer. I want to send the backup to a sftp server of a remote branch, connected to the fortigate equipment from which I make the backup, and it is as if it did not arrive. If I do a ping it arrives, but I have to specify the source. Does anyone have any idea how I can fix it?The traffic and routes are allowed on both sides. But when I launch the "execute backup" it doesn't arrive. When pinging I have to add the source option to allow the traffic. Packet Trace #7,2024/08/06 15:59:27,"vd-root:0 received a packet(proto=6, 181.14.198.42:6817->10.1.4.121:22) tun_id=0.0.0.0 from local. flag [S], seq 4203643946, ack 0, win 65535"Packet Trace #7,2024/08/06 15:59:27,"Find an existing session, id-060b7b91, original direction"Packet Trace #7,2024/08/06 15:59:27,"enter IPSec interface VPN_IPSec1, tun_id=0.0.0.0"Packet Trace #7,2024/08/06 15:59:27,output to IPSec tunnel VPN_IPSec1 vrf 0Packet Trace #7,2024/08/06 15:59:27,"No matchi

I asked this question: https://community.fortinet.com/t5/Support-Forum/Controlling-ZTNA-access-via-Active-Directory/m-p/330127#M247776 and got the answer I needed but I still have more questions around this. My setup is FortiGates in AWS controlling access to AWS resources.  99% of the resources are SSH to instances in different accounts and connecting to ALBs via HTTPs.  Right now I have VPN groups in ActiveDirectory which translate to VPN groups on the FortiGate.  Each group is assigned a VPN CIDR unique to each group.  On the AWS side I have Security Groups relating to the VPN CIDRs. Now when we move to ZTNA I will still need to give some users SSH access and HTTPs access depending on their groups.  The list of HTTPs addresses are changing all the time so the only way I could create an address book for users would be to use the FortiGate APi.  So for now I am going to skip that problem. Users who need to SSH to instances is a sm

Hello Team, Is it possible to change the echo of VPN Authentication Failed error messages? Via FortiCLient and via Web portal SSL VPNThanks for the supportBR

Hi everyoneI have a problem when pushing configuration from Fortimanager to Fortinet firewallI used Fortimanager version v7.2.5-build1574 with evaluation license and pushed the sd-wan overlay template and it noticed the error but I do not see the error on the installation logI tried to upgrade the firmware on FMG from 7.0.3 to 7.2.5 and the Fortigate from 7.0.5 to 7.2.0 but it did not resolve the problem. I also tried to install each part of the sd-wan overlay template but it had the same problem. Do you have any idea how we can fix it?Please help me! Install log: Starting log (Run on device) Start installing Site-30 $ config vpn ipsec phase1-interface Site-30 (phase1-interface) $ edit "HUB1-VPN1" Site-30 (HUB1-VPN1) $ set interface "WAN1" Site-30 (HUB1-VPN1) $ set ike-version 2 Site-30 (HUB1-VPN1) $ set comments "VPN: HUB1-VPN1 [Created by IPSEC Template]" Site-30 (HUB1-VPN1) $ set peertype any Site-30 (HUB1-VPN1) $ set mode-cfg enable Site-30 (HUB1-VPN1) $ set localid "B

Hello FCT EMS adminsFCT EMS v7.2.4.Is it recommended to install FCT (client) on FCT EMS server so it can manage itself?Does it have any negative impact?The aim is to have AV and vulnerability scan on EMS server as well.

We are a software service company and we use Fortinet for securing our machines. Recently we started working for a client that is also using Fortinet. We are required to install their Forticlient in order to connect to their VPN because of the licensing of the Zero Trust Telemetry. The only reason we need their Forticlient is to use the VPN.If we want to use their Forticlient we need to uninstall ours which might put is in a situation that we compromise with our security. Is there an option to connect to VPN network managed by FortiGate/Fortinet without using Forticlient?

Dear Concern, I need to configure an IPsec VPN between two FortiGate, in which the traffic coming from SITE-B should be NATed only. That means when I configure the IPv4 policy on SITE-B, I should enable NAT in the policy and define an IP Pool so that the traffic from SITE-B is NATed and reaches SITE-A. I need to do this configuration because there is a server located at SITE-A, and I only want to give access to this server to users at SITE-B. The reason for enabling NAT is that SITE-B is using a subnet that is also being used by SITE-C, and I want to avoid any conflicts. Can anyone to helpme for this configuration.

Hello FortiGate Community,I’m currently working on configuring two FortiGate 200E firewalls in HA(High Availability) mode and need some guidance. Specifically, I want to understand how the HA setup behaves in a situation where the WAN interface shows as up, indicating a physical connection, but traffic cannot pass through due to an issue with the ISP. Can anyone provide insight into whether the HA failover will still function properly under these conditions?Thank you for your assistance!

rebooted my switch yesterday due to having to relocate it.  It is connected to another Fortinet POE, FG-80EPOE.  when it boots up it no longer provides power to my fortinet u431F AP's.  It previously worked in the same config just fine.    Now via the cli it shows POE errors on all ports: Fault 4 Error Type 17 (Port is yet undefined). at the interface level it shows similar:Power Fault: Error Type 17 (Port is yet undefined). I have followed all of the poe related post here including the poe debug, error 36,38, 4, and 17.  None of the recommended actions seem to work.  I have upgraded this switch to the latest FortiOS code as well 7.2.2. I have also done the poe reset, switch factory reset, still nothing.  Any suggestions?

Hi there, Guys I am trying to set up a firewall into a VRRP. Currently I have only configured one firewall and given a priority of 255. When I see the status of the firewall it says it is a backup. The priority is 255 so I assume is should be a master. Am i missing anything ? FortiGate-100F # get router info vrrpInterface: x2, primary IP address: 10.108.0.2UseVMAC: 1, SoftSW: 0, EmacVlan: 0 BrPortIdx: 0, PromiscCount: 0HA mode: primary (0:0:1) VRRP primary number: 0VRID: 1 verion: 2vrip: 10.108.0.1, priority: 255 (255,20), state: BACKUPadv_interval: 5, preempt: 1, ignore_dft: 0 start_time: 10primary_adv_interval: 500, accept: 1vrmac: 00:00:5e:00:01:01vrdst: 10.50.50.109vrgrp: 100 edit "x2"set vdom "root"set ip 10.108.0.2 255.255.255.248set allowaccess ping https sshset type physicalset mediatype srset alias "Uplink to Core Switch"set vrrp-virtual-mac enableconfig vrrpedit 1set vrgrp 100set vrip 10.108.0.1set priority 255set adv-interval 5set start-time 10set vrdst 10.50.

Hello, How can I change the color scheme of the interface of my FortiMail Cloud? Under Preferences, I only have the language selection option, nothing else. Thank you for your help!

Hello All, We are working on a FortiGate upgrade for a customer and they have VDOMs configured on their current deployment. They are moving from a 1500D to 601F both running FortiOS 7.2.8. We have FortiConverter and have used the application to map all previous interfaces to new interfaces on the 601F. When attempting to restore the converted configuration onto the default configured 601Fs we receive the following errors in diagnose debug config-error-log read:>>> "config" "vdom" @ 12398:command parse error (error -61)>>> "config" "global" @ 12423:command parse error (error -61)>>> "config" "vdom" @ 23614:command parse error (error -61) These errors correspond to the places in the config where after multi-vdom mode is enabled, config vdom is used to initially create the vdoms, then config global is used to begin the global configurations as follows:config vdom edit rootnextedit vdom1nextedit vdom2nextend config globalconfig system globalet

I made a configuration to receive an e-mail message when my link goes down, but I would like to know which link went down, I'm using event 20099, I tried to configure event 20090 but I don't receive an e-mail.Is there any way to receive the name of the dropped link or interface?