Solved

I am setting up a Hub and Spoke ADVPN with BGP. The VPN tunnel itself work well. I can ping both way within the tunnel. However, a BGP routing cannot be not established unless I created a neighbor instead of a neighbor group in my Hub BGP settings. The Hub BGP settings even worked with a neighbor alone and without a neighbor group.Hub: FortiGate 60F FW: 7.2.8Spoke: FortiGate 40F FW: 7.2.8 Hub BGP (working):config router bgp    set as 65000    set ibgp-multipath enable    set additional-path enable    config neighbor        edit "10.0.61.4"            set soft-reconfiguration enable            set remote-as 65000            set route-reflector-client enable        next  &n

We are wondering if there is a way to display the Comments for a rule on the Firewall Policy screen? 

Hey All, Is it possible to update the Internet Service Database manually, without TFTP'ing or FTP'ing the file onto the Fortigate?I have the file downloaded locally on my Win11 PC and have local access to the FW etc? Thanks, 

Hello everyone, I'm facing some security alerts in the software (here I would put the site's name) flagged on the website www.virus.total.com and would like to understand better how to distinguish between legitimate 'alerts' and 'false positives'.Could someone explain to me what criteria are used to determine if an alert is genuine or if it might be a false positive?Also, what are the best practices for handling these alerts without compromising the security of my system, and what are the direct channels for contacting for clarification, alert removal, or for engaging services related to this issue?Thank you for your help!

Hi everyone, I want to set a different time server than the one provided from Fortinet. I have run diagnose sys ntp status, and have found the synchronisation status set to "no". I have read this is a common issue and want to set a different time server for my Fortigate but I still get the synchronisation status error. The NTP server I want to use uses a hostname and has no static IP address. I have tried to use the guide posted in another thread but it has not worked for me so far (https://community.fortinet.com/t5/FortiGate/Technical-Tip-An-alternate-way-to-sync-the-NTP-server-to-avoid/ta-p/280309). Does anyone know how may I fix this issue? P. S. Why is synchronisation with Fortinet NTP server set to "no" despite time being accurate in the GUI? 

Hi all, new Fortigate user here.  Looking at our Fortianalyzer we have the error You have exceeded your daily logs GB/day licensing limit within the last 7 days. I've been through this forum and done some Google-Fu, so far so normal.  However, and I only saw this just now, the dates are totally wrong. This is where Google-Fu fails me and I call upon the experts to assist.  Any ideas? Cheers, Simon.

HiI tried several times reading about how NAT works in Fortigate, but it doesnt work.FortiGate 60F, firmware 7.2.8 build 1693.I found many guides using "IPv4 policy", but this is not present in my "Policy & Objects" menu, I think maybe different firmware.So I create Virtual IPs I need, then I create firewall policies from wan to virtual ip.But it doesn'n works, i presume i made something wrong o I didn't do at all something that is necessary.I am new in FortiGate, coming from other manifacturer products, any help is welcome. Edit: I add some informations may help:System is in NAT mode.Gateway is a modem/router Fritz, and Fortigate is in DMZ on it.Activating https admin on wan interface, it is reachable from internet.   

Hello everyone,is it a solution to manage ldap servers integrated to a fortigate, but with an account in protected users group.It seems that once the account i use to connect my fortigate and my AD servers is put in the protected users group, the fortigate cannot contact ldap servers anymore, so all the SSL VPN authentication requests fail. Thanks for your help, if you have any solution.

Hello  Please can you let me know if it is possible to create multiple remote access SSL VPN Tunnels (vrf aware). I have two LAN interfaces (subnet overlap) in separate VRFs. I want 2 ssl.root interfaces so that I can add VRF information.  Is this supported ? Thanks

Dear Expert, I am searching Fortigate SD-WAN load Balancing, and I found 2 commands:1.set load-balance-mode [source-ip-based|weight-based|...]This command is under : config system sdwanAnd: 2. set load-balance [enable|disable]This command under: config service (SD-WAN rule)I don't understand what is purpose of them , and why do FortiGate SD-WAN has  these 2 commands look like same ?Because, if traffic match sdw-wan rule, the command 2 will execute, right ?, and when command 1 is executed ?Thanks !

Dear Team, We have Endpoint authenticated via FortiNAC via RADIUS Local. Endpoint has Persistent Agent installed. Our purpose is to give endpoint access when their PC is compliant but we noticed that endpoint shown OFFLINE on FortiNAC after around 30-40 minutes. This offline cause endpoint compliance being failed. During that time, FNAC also mark switchport as Link Down, Not Connected while on Actual Switch , Port is still connected, Authorized by Radius, MAC Address Table shown on the switchport. Note: Endpoint has PA installed, Switch integrated with L2 Polling SNMP, RADIUS.  Thank You FortiNAC

Hey All,I am having an issue with setting up VIPs to redirect incoming traffic on a FortiGate with Central NAT enabled to a remote public IP. A few months back, I had a need to change existing VIPs that mapped from public to private, so that the new mapped IP was another public IP that is not ours. I found this article, and it all worked nice a smooth from testing to deployment in production. This was on a 200F at 7.2.8 without Central NAT. The one strange thing is that I don't get any hits on the Policy Routes. Now, I have to configure the same thing on two more FortiGates, both also at 7.2.8 - one is a 200F without Central NAT and the other is a 100E with Central NAT enabled. I'm having an issue with the 100E. There is a Central NAT policy that says any>internet / src all | dest all / NAT as outgoing interface. There are three other policies that should not be affecting my traffic as they have defined interfaces and addresses that are not involved with this. The 100E has

Hello Dears I am trying to do internet service database group but i am not seeing anything related to create group on firewall level   any one can help ? Bests

Scan is coming back with failures on the follow, these all relate to either the Fortinet_CA or the Fortinet_Sub_CA.  I've already updated my certificate for Administration as well as my SSL VPN certificate with a valid certificate.  How can I go about updating the items below?  Being they appear to be Root CAs I don't see them "attached" anywhere.  When I look at Certificates in the unit they show up under Remote CA Certificates.  Basically it doesn't like the length of these or the fact that they are showing as self-signed.  I'm assuming if I remove these it will cause issues with other Fortinet Certificates, best option to proceed? SSL Certificate - Invalid Maximum Validity Date Detected 1003 / tcp over sslSSL Certificate - Signature Verification Failed Vulnerability1003 / tcp over sslSSL Certificate - Invalid Maximum Validity Date Detected1000 / tcp over sslSSL Certificate - Signature Verification Failed Vulnerability1000 / tcp over sslSSL Certific

I have a 40F that I've configured to allow SSL VPN connections from remote computers (work from home primarily).  I've got Forticlient to connect, and while connected can still connect to the internet (split tunneling) and ping the 40F at 192.168.2.99.  However, I can't access our server or any other devices on the office network. I've read on other responses to similar questions that I need to set up a policy to allow the SSLVPN traffic to access that same subnet.  I can't figure out for the life of me how to do that. Using ipconfig I can see the remote computer gets a correct ip pursuant to the configuration I have (192.168.2.200).  However, I also notice that the subnet mask is 255.255.255.255.  From what I understand, that's putting it on a different subnet than the rest of our office lan (192.168.2.0 255.255.255.0) What else do I need to do? Thank you.

Hello Expert, I config ssl vpn on my fortigate 400E firewall but would like to enable 2FA for my user account.I would to use the forticloud option for the 2FA.Could any one provide guidance most of the videos online are using fortitoken or email method for their demonstration because I suspect the presenters done not have a forticloud account. My organization has a forticloud account.  Thank you.

Hello Dears i am trying to configure policy route making the outgoing interface is SD-WAN interface , i am not seeing the SD-WAN interfaces on list interfaces any suggestion plz? Bests 

Greetings,My organization uses Gmail through the Mac Mail app. Incoming emails are working, but outgoing/sending is not. Below is a log of my co-worker trying to send a message. I am kind of a noob and hoping for someone who can help translate.OR maybe I am not even looking at the right log? Thanks! 

Hello, I have a use case where I'd like to take a CVE's JSON details, and convert certain fields to XML format. The reason for this would be to create custom vulnerability checks for Rapid7 InsightVM programmatically using the specified CVE. I can pull the CVE data using a connector, then I would need to convert the relevant fields to XML. I see that there is a utility to convert XML to JSON, but does the reverse exist?

Hello, I have the following problem. I have a FortiGate and a tunnel set up between two companies. I receive two IP addresses via OSPF for routing, as we use OSPF. The problem is that the other party has set up an access list and they only receive the IP 192.168.0.136/32. The issue is that this network is on my FortiGate. How can I send them this network? I tried to set up port forwarding using a blackhole; I activated a public IP and set up port forwarding from 192.168.0.136 to 10.185.195.15. They receive this IP but cannot establish a telnet connection. Can you help me with a way to make the /32 network accessible via OSPF? Below are screenshots of the configuration. Friends, I’m waiting for your help, I really need it.     

Hi, I checking on my FortiAnalyzer, seem the resource for the CPU really high. I monitored it almost 1 day and restart some of the service but still same. Based on the exe top output, some application that utilized most of the cpu are siemagentd & postgress. Its take a lot of time to generate a report when the cpu high. Anyone can assist me on this ?  

Good day team,Case: Caught a staff member, she enabled hotspot on their laptop because the staff wifi was temporarily down, found her pc name in the ssid list on my phone LOL. Many devices were connected in her dhcp client list. LOL, i mean, we IT staff doing so much stuff, we dont actively monitor this. Additionally, in all the major IT corporation that I have worked and managed, this feature was never really acted on or considered to be changed/disabled by the IT Bosses. Even my fellow sys engineers as myself did not pay this much mind. Something as simple as a hotpsot. Crazy world.Which is the best method?What did you do in your LAN?Which method worked for you? Is this possible with Forticlient? Would love some direct responses/suggestions/steps here.

This is a follow up from: https://community.fortinet.com/t5/Support-Forum/AWS-IPSEC-on-BGP-routing-how-to-control-traffic-preference-for/td-p/279609 And now my issue is that I have connected the BGP with the VPCs but the routes in between are not being accepted by AWS TGW. This is my situation, from Brazil and Virginia, I need to pass on their routes to Desarrollo. I have the prefix list, the route maps, all the jazz. But for the life of me, I cannot find WHY Desarrollo does NOT show those routes.I can see the routes that set in the "Networks" section being propagated and see them also on the TGW route table.I can see the routes from BOTH, Brazil and Virginia being propagated, but they are NOT on the TGW.I thought it was the prefix list, set it to Permit ANY, still nothing.The team I work for had the idea of enabling back the static routes on the firewall and use the Redistribute: Static. And ONLY then, the routes appeared on Desarrollo. Yes, already raised a t

Dear all, Please suggest, how to create weekly monthly wan and sdwan report in Forti analyzer .Thanks Umesh

Hi together, I have the following issue concerning the described network structure:Two main sites which are connected to our MPLS-Network. Other sites are also connected via MPLS. Each MPLS site has a MPLS-Router exchanging BGP-Routes with the Site-Firewall and redistributing it within the MPLS network. We want to throw out MPLS and replace it with IPSec tunnels. The goal is one connection from each remote site to each main site, routes also being exchanged via BGP and the two main sites also connected via IPSec to each other. From routing perspective this should not be a problem but if we now let the firewall things join we may break connections due to asynchronous routing when MPLS is still running:For example: packets entering via IPSec to main site 1 into MPLS to another location. Due to the BGP things within MPLS which we can't affect the answer packet maybe will be routed back through main site 2 as this is a "cheaper" way. Firewall on main site 2, of course, doesn't know ab