Solved

greetings, I'd like to know what is the meaning of the time duration next to the DNS server in Fortigate.When it is showing thousands ms, we can still ping it without issue.

 I need to install a few FortiSwitches (FS) as replacement for very old cisco switches in a quite remote site.I already got the switches here in my office and wanted to prepare them before I go onsite. How should or could I prepare the FortiSwitches here in my lab to reduce onsite time? The FS will be connected via FortiLink (FL)to a local Fortigate 40F with FortiOS 7.0.1440F(FL)---FS124---FS148---FS148                    |                FS148 Uplinks are FO 10GB, no reduncancy, so I need to connect the switches mostlty in serial order. See in the schema above. I should be able to connect the FS with FortiLink in parallel to the Cisco setup.The old Cisco setup is pretty straightforward. Just two VLAN's.   Actual Cisco Switch (CS) setup looks like this here:40F(LAN1)---CS24---CS48---CS48---CS48                   

hi, can someone please advise how to check the fortigate log to confirm the traffics are blocked by the ssl security profile? The policy looks allow. Thanks in advance. 

Hello all,  I found TWO VM images available from Fortinet as said Fortigate and FortiFirewall. What is the difference between them?  Thanks 

We have LDAP configured and working for VPN authentication, but need to of course have secure auth, so need to change to LDAPS. LDAP is working with a regular bind account. When I change to LDAPS, both the connectivity and the user credentials test pass successfully. However, nobody can log into the VPN; Permission denied. (-455). The documentation is pretty vague. To keep things simple for testing I haven't toggled the 'Certificate' option and assume that is not a requirement. I haven't been able to locate any logging to get more information, either. I'm puzzled as to why the LDAPS tests show success, but logins fail. I appreciate any insight.

I am attempting to open our Fortigate firewall for one specific IP to troubleshoot some issues with an external vendor. How would I go about this? Fortigate 100F v7.2.7 build1577 Any help would be greatly appreciated! 

I have 60F V.7.2.8 and I'm configuring automation to receive e-mail when the user connects to the SSL VPN and when they leave, but I'm not receiving the e-mails.

Hello, We are using FortiMail and we want to forward a copy of every incoming email to another server. Is this possible and how can we do it? I have made a diagram to explain it, can you help?

How many sections does a vdom support?

WAN1 - Spectrum COAX internetWAN2 - Spectrum eLAN to HQ. We have a problem with this location where the internet goes down more than it should. When it goes down, we're able to route internet traffic over WAN2 which is usually just for internal traffic. I'd like for this to happen automatically. I set the administrative costs on the static route to 0.0.0.0/0: 10 for WAN1 and 110 for WAN2. This works just fine if I manually disable WAN1 for testing. I think the problems lies with the Spectrum router we're forced to use in order to have a static IP address. WAN1 is connected to the Spectrum router and gets an IP address from DHCP. 192.168.0.2 or whatever. If the internet goes down, the link for WAN1 stays up, so the Fortigate doesn't realize there is a problem. Any ideas?

Hi, Our users work via Remotedesktop on Windows Server 2016 (VM-Ware ESXi VM-Version 19) with FortiClient VPN 7.2.4 (free).Their SSL-VPN with one predefined Gateway to an external Partner works fine. Some of the users now have to connect at the same time to another SSL-VPN. Can I realize this kind of "multiuserconfiguration" on this single Windows Server ?What would be the recommended Best Practice ? Thanks, Roland

I created a global variable, how can I update its value in a playbook task? I need to evaluate a variable in a playbook that will then be read in a playbook that runs an hour later. Thanks

I am trying to learn how to setup a webportal so that users can connect via the web to our Fortigate and get proxied over to a specific internal website.   What documentation should I be looking at to learn how to make this happen?  I am running Fortigate VM in AWS version 7.4.4

Hi,I am facing a strange issue regarding Tacacs setup:it works well without any problem with a specific server (which is a Cisco ISE PSN), and my login attemps seen in Cisco ISE Live logs.but when I configure another PSN , I can login to the device, but my attempts is not seen in Cisco ISE Live logs. It's also strange, when I test it by 'diagnose test authserver tacacs+...' then my login test/attempt is seen in ISE Live logs.I have captured traffic on this firewall to see what happens on packet level and found that when login attempt is not seen in Cisco ISE Live logs then firewall simply resets connection during TCP handshake right after syn+ack packet coming from PSN. So connection is not established at all.Thanks,

I have the following issue and need your help, please. I have a FortiGate device and a router with an internal network of 192.168.0.0/24. I've set up multiple branches in OSPF area 0, excluding the internal network 192.168.0.0/24 because the second branch needs to act as the main distributor. Additionally, I have two tunnels with another company, set in OSPF area 10. To ensure they see a specific IP address (e.g., 192.168.0.136) from our network, I used "redistribute static". However, enabling this causes the second branch to not see the 192.168.0.0/24 network. When I disable it, the issue reverses, and the other company cannot see the second branch. Is it possible to resolve this by creating access lists for both OSPF areas? Here's   the configuration snippet for "redistribute static":           FortiGate    

Anyone have an issue setting up an active-passive HA on FortiADC where both devices want to be Primary?Neither see any peers.Mac address spoofing is enabled on our virtual switches.The thing that's weird is a 169.x.x.x IP is being assigned.The devices cannot ping the other 169.x.x.x IP.   (P) FORTIADCP001 # get system ha mode : active-passive hbdev : port4 datadev : group-id : 14 group-name : group1 mgmt-status : disable priority : 1 config-priority : 10 override : enable hb-interval : 2 arps : 5 hb-lost-threshold : 6 arps-interval : 6 l7-persistence-pickup : enable l4-persistence-pickup : enable l4-session-pickup : enable auto-config-sync : enable monitor

Hi (New to Fortinet )I am hoping i can get some feedback regarding a project that i am currently working on, In our data center, we are replacing the switches with a managed fortiswiches 2048s. The firewall is a 3rd party appliance and will not be replaced at this moment. Proposed topology  I would like to manage the switches via the firewall as the controller. is this even possible?  Is this a best practice? are there any potential issue with routing/config that i should be aware of ? Thanks in advance!

Hi,I need same help, after system upgrade fortianalyzer to 7.4.3 gui not work.I have available disk space, the settings are all correct according to the previous version.   

Hello team We have configured the SD-WAN network, now the FGT 70 is at brach and FGT 200F at HQ, now all Underlay Network is reached through ISP means 70F at branch can ping 200F at HQ ,but LAN network is not reached trough Overlay what is the issue?

Hello  Please anyone has experience with this log, that seems that Worker is denying logs from Collector. (This is a Clickhouse environment with one Worker and one Supervisor) [root@shard1 ~]# tail -f /etc/httpd/logs/ssl_access_log ip_collec- 10001 [11/Jul/2024:09:48:46 -0500] "PUT //evthandler2?10001 HTTP/1.1" 550 527 ip_collec - 10000 [11/Jul/2024:09:48:51 -0500] "PUT //evthandler2?10000 HTTP/1.1" 550 527 ip_collec - 10001 [11/Jul/2024:09:49:47 -0500] "PUT //evthandler2?10001 HTTP/1.1" 550 527 ip_collec - 10000 [11/Jul/2024:09:49:52 -0500] "PUT //evthandler2?10000 HTTP/1.1" 550 527 ip_collec - 10001 [11/Jul/2024:09:50:48 -0500] "PUT //evthandler2?10001 HTTP/1.1" 550 527 ip_collec - 10000 [11/Jul/2024:09:50:54 -0500] "PUT //evthandler2?10000 HTTP/1.1" 550 527 ip_collec - 10001 [11/Jul/2024:09:51:49 -0500] "PUT //evthandler2?10001 HTTP/1.1" 550 527 Regards.

Hello friends, I would like to know if there is a way to set up 2FA for logging into Fortigate. I understand that it can be done for VPN-SSL and I have done it, but is it possible to set it up for Fortigate administration via email or any other method? Thanks in advance.

Does anyone have experience configuring 2 FortiADC Virtual Devices in Active-Passive HA mode within a VMware environment? We are having a problem when the 2 VM's are on different hosts.

Hi, FG-60F instead inter-vlan routing sends packet to wantraceroute 10.102.9.3traceroute to 10.102.9.3 (10.102.9.3), 30 hops max, 60 byte packets1 _gateway (192.168.1.99) 0.404 ms 0.382 ms 0.373 ms2 customer.abc.net (X.X.0.0) 83.877 ms 73.327 ms 83.850 ms...Routing table looks well:get router info routing-table allCodes: K - kernel, C - connected, S - static, R - RIP, B - BGPO - OSPF, IA - OSPF inter areaN1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2E1 - OSPF external type 1, E2 - OSPF external type 2i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter areaV - BGP VPNv4* - candidate defaultRouting table for VRF=0S* 0.0.0.0/0 [10/0] via X.X.0.1, wan2, [10/0][10/0] via X.X.0.1, wan1, [15/0]C 10.0.2.0/30 is directly connected, Wireless-BC 10.0.3.0/30 is directly connected, Wireless-CC 10.102.1.0/24 is directly connected, vlan-10C 10.102.2.0/24 is directly connected, vlan-20C 10.102.3.0/24 is directly connected, vlan-30C 10.102.6.0/24 is directly connected, v

We can manage the Forti-APs in fortigate Transparent Mode ?  @nithish.k@snsin.com,@sanjeevi.s@snsin.com

Hi guys! Like in the subject we have a Forti 40f with a static public ip over dhcp client from ISP.From the ISP we also get another public IP block/pool which is routed to our fixed IP. The goal would be that I can use my new public IP's on my 2nd Mikrotik router. Many posts about this say that VIP's should be used but as I'm not a Forti native guy can I find some GUI tutorial for that? Thanks!