Solved

We have a WAN interface on which 6 public IPs are available.  On the WAN interface the value x.x.2.226/24 is specified for IP/Netmask. I wanted to enter the value x.x.31.227 for the source-ip of the email-server in the CLI, but I get an error message ..: config system email-serverset source-ip x.x.2.227x.x.2.227 does not match any interface ip in vdom root.node_check_object fail! for source-ip x.x.2.227 value parse error before 'x.x.2.227'Command fail. Return code -8  I need the dedicated WAN address x.x.2.227 for the forti mail-server because I have to use it for validation in an ExchangeOnline Connector. Does anyone here have an idea how I can do this or an alternative solution?Any workaround is welcomed. Thanks in advance

Hello, I want to raise an issue that someone may encountered in the past.We own 4 Fortigate (3 of the in HA-Cluster) devices which are imported as devices in Fortimanager.Fortimanager version : v7.0.12 GA build0623Fortigate version : v7.0.16 build0632 The issue is that i cannot have all of the devices Policy package status in imported state.When i import configuration for one of them this specific device change state to "imported" and the rest 3 devices changing state to "Modified". below is when i finished importing the the policy package in the 1st device below is when i finished importing the the policy package in the 2nd device  Does anyone faced this issue before? Any workaround is welcomed. 

Hello, I have two Fortigate Cluster, FortiManager and FortiAnalyzer. I have a problem with FortiAnalyzer that don't show implicit deny log. I already checked my implicit rules in my FortiManager to active logging for IPv4 and IPv6. Hit count on my implicit rules increase correctly, despite this, FortiAnalyzer don't show deny log. What have I to do ? Thanks for you help !

Hello everyone,I'm currently managing an environment with approximately 5000 EPS and encountering an issue where the PHparser crashes frequently. Our setup includes one supervisor and two workers, each running on servers equipped with a 32-core processor and 64 GB of RAM. Despite not using custom parsers, the PHparser fails every 20-25 minutes, recovers, and then continues to crash intermittently. We are seeking advice on troubleshooting this problem. Any suggestions on what might be causing these frequent downtimes or how to stabilize the parser would be greatly appreciated.Thank you! :)FortiSIEM @premchanderr @FSM_FTNT @Richie_C 

Hello everybody,I'm working on a Fortigate 60E (FortiOS 7.2.8).My pc is on an isolated network (i'm the only host) and there is only one simple rule:The dlp profile is simple and is configured to block a credit card number. I built it following the Fortinet tutorial for DLP. It's configured to work with every possibile protocol.I tested this profile on dlptest.com and everything worked fine.Now, I'm trying to understand if this profile could be able to block an email that contains a credit-card number inside the text (or an attached file that contains a credit-card number).Here is Gmail:During the upload of the attached file, Gmail correctly detects the data leak inside it and blocks the upload. But if I write the same credit-card number as plain text, the mail is blocked in a strange way...the connection collpases ("an error occured") and I have to refresh the page. I can't send the mail obviously, but this is not a good filtering. You are stucked and you have to refresh the page

Hi, I have seen a second hand Fortigate 80E.   Can the current owner still transfer ownership to another person/company?   Or can the new owner transfer it over themselves? The owner sent me: FortiGate-80E # get sys statusVersion: FortiGate-80E v7.2.4,build1396,230131 (GA.F)Virus-DB: 1.00000(2018-04-09 18:07)Extended DB: 1.00000(2018-04-09 18:07)AV AI/ML Model: 0.00000(2001-01-01 00:00)IPS-DB: 6.00741(2015-12-01 02:30)IPS-ETDB: 0.00000(2001-01-01 00:00)APP-DB: 6.00741(2015-12-01 02:30)INDUSTRIAL-DB: 6.00741(2015-12-01 02:30)IPS Malicious URL Database: 1.00001(2015-01-01 01:01)IoT-Detect: 0.00000(2022-08-17 17:31)BIOS version: 05000007System Part-Number: P18822-02Log hard disk: Not availableHostname: FortiGate-80EPrivate Encryption: DisableOperation Mode: NATCurrent virtual domain: rootMax number of virtual domains: 10Virtual domains status: 1 in NAT mode, 0 in TP modeVirtual domain configuration: disableFIPS-CC mode: disableCurrent HA mode: standalone

Hi, i try to connect my new switch F148 with my SonicWall GW.I create VLAN on my sonicwall (ID 5), connect sonicwall to switch to port 23, and connect one PC to port 21. On the switch create VLAN 5, and set native VLAN 5, Allowe VLAN 5 on port 21 and 23. But i have not communication with SonicWall.This is my first Switch from Forti and maybe i somting set wrong. Please suggest what I did wrong

I have integrated my fortigate with the Radius server and working fine,but parallely my local authentication is also working,how shall i set my radius authetication as primary and local as secondary.

Good day,Though accessible, should access to the bulk/personal quarantine folder be granted to regular staff or only to IT Admins?

Hello, I need your help. I have the following issue: I work with Fortigate Firewall, and my task is to connect my network to another Cisco router. My OSPF is working fine; it sees the internal LAN networks. However, I also need to set up NAT. I need to NAT from my other LAN, 192.168.0.5, to 10.10.10.10 (for example), and ensure they can see this route. I tried using Virtual IPs, but it didn't work out. How can I set up destination NAT and advertise the route in OSPF?FortiGate #OSPF #virtualIP 

Hi, We are using Fortigate, Fortiswitch and Fortinac.They are using static ip configuration in their client system.We wanted to push Dynamic access control lists via fortinac.Can someone please guide in this case.

 I am unable to click on Install Now button, 

Is there a way to add a link that will direct a user to request a blocked site be allowed and a email will be sent to help desk for further review? 

When enabling the Explicit Proxy feature on a FortiGate 40F(ver6.4.11) and performing several thousand Kerberos authentication tests from a test tool, 1001 users appeared in the authentication list on the web management console, but no additional users were shown beyond that. We had not considered the configuration or limitations regarding the number of concurrent authentications, so we researched the related settings and found the following website. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Limiting-concurrent-user-authentication/ta-p/199277https://community.fortinet.com/t5/FortiGate/Technical-Note-Limiting-concurrent-user-authentication/ta-p/190373   When we checked the configuration on the tested FortiGate, the value of "policy-auth-concurrent" was set to 0. So far, we have not been able to obtain information on the maximum number of concurrent authentications possible. Please tell me the maximum number of concurrent authenticated u

This may seem like a silly question... but which file should I download to update my fortimail VM in wmare? When I go to the Fortinet support site, several images appear.   

HelloI'm facing a problem regarding uninstalling FortiClient to install a different version.I'm on Linux (Kubuntu 19.10). When I try to uninstall FortiClient ( sudo apt-get purge forticlient or sudo apt-get remove forticlient ) I can't because "Unable to uninstall forticlient while connected to EMS". But when I try to disconnect from EMS ( sudo /opt/forticlient/epctrl -u ) it asks me for a "deregistration password". It's the same when I try to disconnect it from the GUI:However, I don't have this password. I found a link about a "password recovery tool", but it is for Windows, and I don't have any program like that in the /opt/forticlient folderhttps://docs.fortinet.com/document/forticlient/7.2.4/ems-administration-guide/543835/using-the-passwordrecovery-toolFor what I remember, I installed my version of FortiClient from the company I formerly worked with (to access their VPN), so maybe it was a different version than the free one where I can have full control of the pro

We recently installed an 80F and we are now having issues with our ERP being able to connect to FTP sites of our vendors to upload order data. Previously on our old network based firewall, we didn't have these issues. It appears that an active session is being created with the FTP site. I can connect to the FTP site from our ERP manually but once I'm connected and I try to run any commands, I receive a 500 illegal port message and then a 425 use PORT or PASV first message. If I enter pass then it shows passive mode as being on and I can execute commands successfully. The problem is that once this connection is ended and we try again, we are back to the same issues. Our vendor who is responsible for this firewall is running into a wall on what to do so I'm hoping someone may have some ideas on what we need to do to resolve this. This ERP server has a public IP so traffic from the internet to it comes directly to the firewall. When traffic is going out from it, it goes from the firewall

Still learning all of particulars about this product. My inquiry is about the Policy ID when viewing the log details of a message. I have had to sort through the message log chain on several occasions now and am trying to discern the Policy ID it reports and trying not to assume the logic that makes sense to me. So if my log detail reports the Policy ID of 3:1:1:SYSTEM, does this mean it processed through Access Control ID3, then IP Policy ID1, then Recipient Policy ID1 with the default system domain? Or did I completely butcher that logic...lol Thanks. 

I have a FortiGate SDWAN rule configured to select the outgoing WAN interface by Best Quality as the result of Performance SLA measurements. What happens if bandwidth of the selected outgoing WAN interface is saturated? Does excess traffic begin to use the next most preferred outgoing WAN interface from the Best Quality Performance SLA measurement results?Or will the WAN interface with Best Quality from Performance SLA measurement results continue to be used?

Hello everybody,I'm working on a Fortigate 60E (FortiOS 7.2.8).My pc is on an isolated network (i'm the only host) and there is only one simple rule: As you can see, the security profile is very simple, it has a DLP configured with a profile that only intercepts the credit cards' informations. The dictionary is the default c redit card type, while the sensor is configured to any message or file regarding every protocol:   The problem is that for some reason, sites like facebook.com are blocked by the same policy.   date=2024-06-19 time=17:57:53 id=7382244222788698112 itime="2024-06-19 17:57:54" euid=1026 epid=1030 dsteuid=3 dstepid=101 logflag=3 logver=702081639 type="traffic" subtype="forward" level="notice" action="close" utmaction="block" policyid=19 sessionid=796241 srcip=10.1.20.4 dstip=157.240.203.35 transip=192.168.1.4 srcport=64759 dstport=443 transport=64759 trandisp="snat" duration=1 proto=6 sentbyte=1886 rcvdbyte=1565 sentpkt=14 rcvdpkt=14 logid=000000001

Hello, i need your help.You have one FortiGate and two routers. You need the FortiGate to know routes but not advertise them to the routers. For example, you have Area 10 where Router1 advertises 192.168.0.0/24, and Area 20 where Router2 advertises 192.168.100.0/24. However, when you check Router1, it also knows about Router2's network 192.168.100.0/24. This should not happen. How can you separate these networks? Can route maps or ACLs help? Have you encountered such a situation before? Any information would be valuable to me.#fortigate #ospf #routemap #acl #routingtable #routes

Hi All, I got deny log from the Fortigate even I already configure to allow the connection.This application using port 1433. The details log as below : Event Action : DenyThreat Action : BlockThreat Name : Policy ViolationThreat Type : Reconnaissance Application Service : Elid06 I check on the security profile & not find any possibility that it will block by security profile. Then I change to other service TCP_1433 and the connection was success. Anyone know what is the possibility of the deny traffic. TQ    

Hi all,our current setup is FG 80f acting as a firewall and  NAT device with Layer3 switch  acting as a router for office network and intervlan routing.We would like to replace current layer3 switch with 2 switches from Forti ecosystem that can act as redundant routers.Requirements are as following:L3 switch handles intervlan routingL3 switch acts as a router for private networksL3 switch/es supports HSRP or VRRPFG80f handles NAT and traffic inspectionSwitch and future Forti AP-s are managed via FG80f   So basically i want central management for Forti network devices and L3 traffic between private networks to be handled on switches which are redundant gateway for client network devices. Is that feasible ? Regards,Drazen

Hello everyone, first of all the most important information:FortiManager Platform type: VM-64FortiManger version: v7.4.3-build2487 240514 (GA)FortiGate model: 200FFortiGate version: v7.2.8 build1639 My scenario:I want to pre-configure a FortiGate 200F for which I do not yet have a serial number. To do this, I have added the device via "Add Device" => "Add Model Device" and the settings:"Link Device By" => Pre-shared Key"Device Model" FortiGate-200F"Automatically Link to Real Device" => enabled"Provisioning Templates" => Our TemplateNow I have received the FortiGate, switched it on and brought it into the FortiManager network and followed the instructions from Fortinet on how to integrate an FG with a PSK.The CLI config was as following:config system central-managementset type fortimanagerset fmg ip addressendand thenexe central-mgmt register-device fmg-serial-number pre-shared key My problem:I assume that the device in the FortiManager is then assigned to the

hello I have FortiGate100F I applied wan failover (I have two lines from my ISP ) if wan1 disconnect all traffic going from wan2.Now I connect new subnet to port10 .. I need all traffic going from port 10 to wan2 not wan1  (i add policy to allow traffic from port 10 to wan2 ) when i connect my pc to port10 it take IP and DNS (already I enabled DHCP) but no Internet anyone help me please