Solved

Hello, I am a user of Fortigate 7.4.4. I have an architecture based on a root VDOM, where my WAN connections arrive, and then interconnection links with my child VDOMs (as shown in this diagram visible in the Fortigate documentation). My infrastructure is shared with a client. My client wants to set up an IPSEC VPN on their VDOM but is encountering problems and needs logs. The logs are not very verbose, and there are even no logs in the FortiGate GUI for their VDOM. I have to use the CLI (still within their VDOM) to provide them with traces. What can I do to give my client more visibility? Thank you for your help.

Hello everybody,I want to perform custom deep inspect, but I don't wanto to use the default FORTINET_CA_SLL certificate, so I decided to create a custom profile.(I'm working on FortiOS 7.2.8)I generated my certificates with Let's Encrypt, and I have 4 files:cert.pemchain.pemfullchain.pemprivkey.pemSome informations inside them are:1) cert.pem{ "name": "\/CN=xyz.com", "subject": { "CN": "xyz.com" }, "hash": "xyz", "issuer": { "C": "US", "O": "Let's Encrypt", "CN": "E5" }, "version": 2, "serialNumber": "xyz", "serialNumberHex": "xyz", "validFrom": "240628134133Z", "validTo": "240926134132Z", "validFrom_time_t": 1719582093, "validTo_time_t": 1727358092, "signatureTypeSN": "ecdsa-with-SHA384", "signatureTypeLN": "ecdsa-with-SHA384", "signatureTypeNID": 795, "purposes": { "1": [ true, false, "sslclient" ], "2": [ true,

Hi,i have problem with correct settings for VLAN mangment.I have two subnetsLAN (192.168.0.0/24) VLAN1 (connected to D-LINK Switch)MGM (10.10.5.1) VLAN5 (FortiSwitch) Two switches are connected to my Firewall SonicWall on separete port (PORT0 for D-LINK, PORT4 for FortiSwitch tagged 5) Fortiswitch is connect to my firewall on port 23 (native VLAN 1, Allowed VLAN 5) I Create VLAN interface on Firewall and set access rules for allow all traffic (temporary) between VLAN 1 and 5 On Fortiswitch i connect two devices on port 7,25 (Native VLAN5, Allowed VLAN 5)Communication work, i can access from LAN to MGM via ping and https and vice versa, devices inside VLAN5 also have communication beetwen each otcher. Problem is when i try connect from LAN to FortiSwitch to managment access. I can't any ping or HTTPS.In FortiSwitch i create VLAN5-MGM with ID 5 with ip 10.10.5.1/24 and access HTTPS,PING,SSH as physical interface select only one available internal (on System->

Hi all, so I've gotten a training kit from my new employer, which includes a FortiGate 60F, FortiSwitch 108FPOE and a FortiAP 231F. Setting up the basic stuff was more of less painless, but now i'm struggling with some VLAN configuration issues.  Let me start of by describing the topology. The FortiGate is connected on wan1 to the internet. Port A and B are connected to the FortiSwitch through FortiLink on ports 9 and 10 (SFP RJ45).  What i'd like to achieve is create two access ports for VLAN30 on port 2 of the FortiGate and port 8 of the FortiSwitch.  Tried a million different configurations but the one that makes sense is this one:- Get port 2 out of the internal VLAN Switch on the FortiGate.- Create a new VLAN Switch and assign it VLAN ID 30, and use port 2 as it's member. - Create address object matching subnet - enabled- DHCP server - enabled On WiFi & Switch Controller -> FortiSwitch VLANs- Create VLAN 30 - Set IP/Netmask

Hello everybody,I am facing an issue with my FortiGate firewall i have activated LDAP there is no problem the test of connectivity is successful, but whenever i tick the secure connection and activate the LDAPS the test of connectivity replies with can't contact LDAP server what is the problem ? (am not using any certificate as the option is untick)regards

Hi allHow can I create report with multiple data sources and conditions in one repportexemple: One repport with   Account Created/Deleted and Accounts Added to Windows Local Admin GroupBest regards

I am currenlty migrating from checkpoint 3200 ha with smart console to dual 200f fortigates, my questions, when applying the ip's to the interfaces on the forti, checkpoint gw 1mgmt: 192.168.x.253/24port 1: 10.76.x.148/24port 2: 4.36.x.70/29 (wan)port 3: 172.16.x.2/24port 4: 70.91.x.80/29 (secondary wan)port 5: 1.1.1.1/24 checkpoint gw 2mgmt: 192.168.x.254/24port 1: 10.76.x.149/24port 2: 4.36.x.71/29 (wan)port 3: 172.16.x.3/24port 4: 70.91.x.81/29 (secondary wan)port 5: 1.1.1.1/24 Very new to fortinet and trying to learn this instead of using forticonverter. I tried kind of setting this up on the forti but it didn't work properly, we currently have 5 static ip's on both of our isp providers, when I configure the ha on my fortigates, they both seem to be taking the same management ip and I have to manually go in and change it to gain access back to the gui. Just trying to see where I need to start, thanks in advace. 

Hello,I'd like to ask your advice. I am building policies for my FortiGate and I am creating policies for URL categorization on AD groups (students at schoolI want to ask what approach you prefer and what impact it will have on the firewall performance.1. Disallowing blocked categories (**bleep**, spam, etc) and then only allowing all HTTP and HTTPS2. Setting allowed categories on given user groups. Thank you.

Hello, Does anybody know how to get rid of this new stupidity in FMG 7.0.x, called "Change note"? Thanks

I am trying to find a generated heat value of switch models 124F-POE and 148F-POE in kW.I only seem to find the operating temperature and not the amount of heat generated by these devices.Does anyone know where I can find this?

Hi, We have a Fortigate HA Cluster that is managed in Fortimanager.When we do a failover it says in fortimanager that the cluster is down.I can ping from the fortigate: fortimanager.forticloud.com. It still uses the same source IP to communicate with Fortimanager.In the debug i can only see 2024-06-24 11:35:49 FGFMs: __session_cb,125: fgfm_fqdn_connect fail.. Do you have any idea? best regards, Michael 

Good day all, Is it safe to say tha the bad boy here is the Forticlient installed on my exchange server? Full and incremental backups started failing immediately after installing FortiClient. Before though, my buexec normally has errors during backups, hit and miss, a few days backup fails due to some weird errors or communication errors, other days successful backups with no interruption. I cannot say however that it is definitely the FortiClient causing now CONSTANT failed backups, but i think it is. Kindly see attached resources for more information let me know what you think:1. FortiClient on email server2. https://www.veritas.com/support/en_US/article.100043312 - Look on Possible Causes #43. Fortinet Community post sharing an almost similar issue - (https://community.fortinet.com/t5/Support-Forum/Backup-Exec-not-copying-servers-with-Forticlient-AV-installed-on/m-p/45350) Any possible solution?

Hello, I'm not getting traffic in an ipsec vpn tunnel (HUB-SPOKE). When running the command "diagnose debug flow filter addr 192.168.1.254 192.168.13.254 and" on my HUB I get:  id=20085 trace_id=204199 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface HUB-WAN05, tun_id=0.0.0.0" id=20085 trace_id=204199 func=_do_ipsecdev_hard_start_xmit line=229 msg="output to IPSec tunnel HUB-WAN05_0" id=20085 trace_id=204199 func=ipsec_common_output4 line=778 msg="No matching IPsec selector, drop"  HUB-WAN05 phase2-interface configuration is the same as HUB-WAN04 (HUB-WAN04 works perfectly)  edit "HUB-WAN04" set phase1name "HUB-WAN04" set proposal aes256-sha256 set dhgrp 5 set replay disable set keepalive enable next edit "HUB-WAN05" set phase1name "HUB-WAN05" set proposal aes256-sha256 set dhgrp 5 set replay disable set keepalive enable next  on both HUB-WAN04 and HUB-WAN05 the Phase 2 Selectors LOCAL ADDRESS and REMOTE ADDRESS are set to subne

Hello everyone,  the FortiManager has 2 IP addresses and the FortiGate is authorized to IP 1 in the Security Fabric/Fabric Connectors/Central Management Settings but I need to change the authorization to IP 2. How do I do this? If I use:  config sys centralset type noneendconfig sys centralset type fortimanagerset fmg x.x.x.xend I remove the FortiGate from FortiManager and i have to remap the interfaces right? Is there an easier way? Thank you 

Hi, Everyone.I have a plan to upgrade FortiGate firmware FortiOS 6.4.15 to 7.2.8.The FortiGate is models on NP6 platform.Before I'll do it, I have read the Document Library about FortiOS 7.2.8 in Fortinet official web page. and I found the Bug ID 1012518 in known issue.Here is the citation from the Document Library. https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526 ---Some FortiGate models on NP6/NP6Lite/NP6xLite platforms experience unexpected behavior due to certain traffic conditions after upgrading to 7.2.8. Traffic may be interrupted momentarily.Workaround: Users impacted by this issue can contact Fortinet Support to request a special build with a fix for this issue. Alternatively, users can disable the processing of traffic by the IPS engine’s nTurbo using the following command:config ips global set np-accel-mode none end---I'm gonna do the workaround that using the command.But When I use the workaround, I'm wonderin

 FortiGate firewall running FortiOS firmware 7.0.12I see from older previous posts control-v ? was not supported from the cli window within the GUI and was hoping this may have  been changed in newer releases.If this is still not allowed within the GUI cli window or is there an alternative way to enter the ? character as part of a username?Thank you.  

Hi, I have an HA setup, but firewalls are currently out of sync.Tried to check the configuration for both firewalls, and seeing the difference is only ENC value for the password. Is it normal to have different ENC value for password for HA configuration? I have tried to recalculate the checksums already but still getting an out of sync status. Thanks!

we have users connected FortiSASE and the traffic from a user to FortiManager Cloud & FortiAnalyzer Cloud showing Accept: session timeout on FortiSASE.any one had this issue before and what's the fix? 

Hey TEAM, I will try to be clear as I can. My manager wants personal quarantine emails (that are passed as clean) to be automatically released to recipients/staff inbox(exchange)over a particular retention period e.g. 5 days. I told him the only way that I am aware of users releasing their own mails is via quarantine reports -  https://docs.fortinet.com/document/fortimail/7.4.2/administration-guide/907026/managing-the-quarantines My inspection rules are working perfectly, spam reduced SIGNIFCANTLY in my environment, I have full control of inbound mails. I am also manually releasing quarantine mails for staff, not daily, but from time to time, this can be a bit of an overhead though. I suggested to him the quarantine report/release method, but he does not want that method lol. Can he get his wish and if yes, how can this be done? I welcome all suggestions/feedback.

HiI'm new to the board and also very new to Fortigate. Have a lot of experience using asa firewalls but now migrating to Fortigates. But I need some help. We are migrating using the forticonvertor.I’m looking for a simple solution to add the option“set logtraffic-start enable” on every ruleIt there a option to do this easilyI tried using the cli config firewall policyedit 0 - 4294967294set logtraffic-start enable But it does not accept the command “edit 0 – 4294967294”Enabling it by hand on every rule is not a option. I hope there is a global command or at least a option to edit a range of rule numbers in one go. Kind RegardsEduardThe Netherlands

Hello - does the FortiGate 121G support "hardware switch"? I searched around and found this tip, but, the 100G series is in neither of the supported, or not supported lists: Compatibilities of Hardware Switch with F... - Fortinet Community (Edit to add, I submitted feedback on that link to request the 100G series be added; here's hoping they add it for clarity)

Hello, I am a user of Fortigate 7.4.4. I have an architecture based on a root VDOM, where my WAN connections arrive, and then interconnection links with my child VDOMs (as shown in this diagram visible in the Fortigate documentation).  My infrastructure is shared with a client. My client wants to set up an IPSEC VPN on their VDOM. I followed the configuration available here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-IPSec-VPN-tunnels-on-VDOMs-that-do-not/ta-p/195596 This configuration is based on a NAT on the root VDOM. My client does not want NAT. How can I completely remove NAT? Thank you for your help.

When I try to connect FortiGate-80F and FortiClientEMSCloud (trial) with FabricConnectorsI get a message "requires FortiClient EMS Cloud entitlement" and cannot select it.Is it possible to connect with some settings? Do I have to purchase a license?Please let me know if you know anything about this.

Hi, I had upgraded my FortiGate from FortiOS 7.2.x to FortiOS 7.4.3. I am currently using deep packet inspection ssl profile. Is it expected that I also import again Fortinet_CA_SSL into my browser every time I upgrade? Is this a normal process - Upgrade of FortiOS = Import of Certificate again into the browser?I am currently having issues with SSL after the upgrade. Thank you!

I upgraded my Fortigate 61F firmware, then there is notification the device will be reboot. After that my device didnt turn on normally, it was just stuck on power LED. I have try to unplug and plug power cable, and push hard reset button Please anyone can help?