Solved

Hi allI am supposed to configure OSPF peering between a Fortigate and a Meraki Hub (MX?). Unfortunately there is not much to configure on Meraki side (it has the correct ospf ID and an unique router ID and identical Hello and Dead timeouts). So I suppose I need to do that on my site on the FGT. Has someone an idea why the meraki does not show up on my neighbor list? Information I have:I made a new OSPF subarea ID (1.1.1.17) which is configured on Fortigate and MXThey are connected to the same LAN 10.x.x.x/23 and FGT can ping the MX (and vice versa)Both devices send out proto 89 packets to 224.0.0.5The LAN segment is on port1 of the FortigateI added that port1 as OSPF interface (which I guess is correct)The OSPF interface is on network-type broadcast at the momentThe OSPF interface (port1) is coming up as in area 0.0.0.0 instead of 1.1.1.17 according to "get router info ospf interface port1" (see [2])The reason might be, as the network 10.x.x.x/23 is already configured in

Hello everyone, I have 4 FortiAP 431F (FP431F) with firmware v7.0 build0134, the issue is that memory usage increases with and without connected users. I restart them and they start with 38% of the memory occupied, after 3 or 4 days the memory reaches 93% usage which makes browsing slow when users are connected. I have to restart it again to free up memory and the same thing happens again. Do I have to update its firmware to a more stable version? Thanks!

Hi Folks,I'm technical, but not an IT person.  It is less than once a year I need to do something with my Fortigate - so I always have a big knowledge refresh and ramp-up for any simple change.   I have a Fortigate 60F and two (2) Fortiswitches - a 108E and a 124D.  The 108E has servers and the 124D is family and household. My fortigate can see all of my FortiDevices no matter how I configure them ... My question is:  What is the better configuration?A) Connect 60F A -> 108E -> 124D (Daisy Chained switches)B) Connect 60F A -> 108E and 60F B -> 124D (Two switches off the firewall)C) Other? I don't care about redundancy or failover.   I was watching the guy on YouTube with the hair and it seemed like I should daisy chain, but 'm not sure.Thanks,TFPJ

Hi,Is it possible to downgrade my FGT 40F from version 7.2.6 to 6.4.6 directly and without any issues?Thanks 

3/11/2024: I've made some progress and have updated my original post below as needed. Thank you very much, @Anthony_E, for continuing to look for support! I know this topic has been covered, but I need help. I have a fortiswitch in a separate building from the main firewall and switch. I am trying to connect to that switch via fortilink, but each time I enable the fortilink-p2p on the REMOTE switch ports, my AP's go into a reboot cycle. Here's my configuration: FG100F(port12) <-> (port23 via fortilink)Fortiswitch(port 7) <-> FAP432F <-> FAP432F <-> (port2)Fortiswitch(port3) <-> clientThe VLAN for the APs is 10.The VLAN for the client is 20. Following these guides...Technical Tip: FortiLink over P2P wireless bridge/... - Fortinet CommunityFortiSwitch FortiSwitch Devices Managed by FortiOS 7.0 (fortinetweb.s3.amazonaws.com)Fortilink Managed Switches over Wireless P2P Bridge – J's Stuff (jsstuff.com)...I have done the below: Remote sw

Hi,I need to know whether iBGP routes that learnt in FortiGate can be redistributed to OSPF by default or not?Because in other router like Cisco, iBGP can't be redistributed to OSPF by default, it needs command like 'bgp redistribute-internal' Thank you

Hi TeamI have an alert and I have investigated the destination Ip of that alert and I want to update the record correlations to change the indicator descriptionthanks, on advanceFortiSOAR #Update Record Correlations

Hi,2 weeks ago I configured another syslog server from the CLI and it worked fine. Now I tried the same with the same information on another FG100F and I dont get anything at our local Greylock Server.>config log syslogd2 setting > get shows me on both sides the same information: FG_MASTER_XXX (setting) # getstatus : enableserver : XXX.X.98.58mode : udpport : 1514facility : local7source-ip :format : defaultpriority : defaultmax-log-rate : 0interface-select-method: autoThe rule on the FG in the DC is for all the same. What am I missing? Thanks 

I need to configure VXLAN in the presence of Fortinet configured with SD-WAN and multiple WANs. Resolved by following the community KB below: https://community.fortinet.com/t5/FortiGate/Technical-Tip-VXLAN-with-SD-WAN/ta-p/198690 

Hello,   I'm using FortiGate 60E, firmware v7.2.8. I have 2 internet connections in one of my locations, main and failover. I always set it up with the same distance in static routes, in this case, 10 and different priorities for each, for the main one for example 5, and the failover one 6. In this scenario usually both connections work at the same time, I can ping external IP addresses etc.The problem is when I set it up this way, the failover PPPoE connection doesn't work, it doesn't respond to pings and the failover connection doesn't even show up on the routing table despite adding it as a static route. It looks like the problem is only when it's a PPPoE connection, for others it works fine.The way to bypass it is to click the option: retrieve default gateway from server: It starts working, but you can only set here the administrative distance and it will supersede the main connection, which I don't want. But turning it on allows me to create a static route with

Hello,When I try to access the following website address https://alcservis.com/, I am blocked by Fortigate firewall because it is under the "Phishing" category. Why is this website address blocked under the Phishing category? This website belongs to a company we work with. I can access this website without any problems via mobile internet access or internet access that does not have FortiGuard service.I think the website address https://alcservis.com/ should be removed from the Fortigate Phishing category.I would like your help in accessing this address.Kind regards

Morning, I have two questions that i need help with, if anyone has an explanation please comment below. 1/ Can you know the FortiMail's mode only with a report log ? If so, what field you must check, with the explanation for each one of them ? 2/ In the access receive rule, in my knowledge the RCPT TO field has to be the protected domain to match the rule (like the Fortimail checks the RCPT TO field first then checks the MAIL FROM), my question is do you need an access receive rule for internal emails, ex : the protected domain is "Fortinet", MAIL FROM : userA@fortinet.com RCPT TO : userB@fortinet.com does this enveloppe need an access receive rule ? Thank you in advanceKind regards, FortiMail 

Hello,I create SSL VPN for specific user with tunnel-access enabled. The client can access the internal resources using forti client but the user not able reach to the internet.I already create security policy to allowing vpn client to access to the internet, the rule was hitting but the client still not able connect to internet. Anyone know why?

Dears, Can someone explain why FRANCE IP subnet denied while other country is OK. Im whitelisting geographical onfirewall policy to allowed which country can access our external MAP IP with assign port. Below logs shows for references.  regards,

 【background】　I'M TRYING TO CONNECT THE THREE LOCATIONS WITH IPSEC AND ROUTE THEM USING BGP.【Prerequisite configuration】　All locations are Fortigate 50E using OS 6.2　- FOR A DIRECT IPSEC ROUTE WITH AS65001<->AS65002, ALL SUBORDINATE SEGMENTS ARE LISTED IN THE ROUTING TABLE.　- IPSEC routes between AS65001<->AS65010 / AS65002<->AS65010 are also listed in the routing table for all subordinate segments.　- When going through a AS65010 such as AS65001<->AS65010<->AS65002, routing information should not flow to AS65001 and AS65002.【question】　- Assuming that BGP is used for routing, what kind of settings should be made to "When routing via AS65010 such as AS65001<->AS65010<->AS65002, routing information should not flow between AS65001 and AS65002."?

Hello everyone,I am currently testing FortiClient EMS with the trial license.So far I did set up everything and worked fine. I did deploy FortiClient EMS on my personal notebook.Today I was working from home and the SSL VPN worked fine. After lunch the SSL VPN didn't work any more. When trying to reconnect the SSL VPN tunnel, the connection gets established and immediately aborted again. In the forticlient logs I can find following lines (debug log): 10.06.2024 13:37:33 error sslvpn error: poll_recv_ssl -> SSL_get_error(): 610.06.2024 13:37:33 error sslvpn error: poll_recv_ssl -> WSAGetLastError():010.06.2024 13:37:33 info sslvpn error: polling recv, try:1I can't find any more informations, I did not set up Forticlient or the SSL VPN to connect with certificates, so I do not have a clue where this issue suddenly comes from.Anyone having an idea? Edit: Connecting with a non-EMS FortiClient works without any problems.

It's a pleasure to greet the Fortinet community, Can you tell me what firmware version is available for the FortiAP 431F and 231F (FP431F, PU431F, PU231F), I currently have them with the firmware (FP431F -> v7.0 build0134, PU431F -> v7.0 build0125 and PU231F -> v7 .0 build0125) Greetings

Are my FortiAP231-F UTM models or not?

Hello Days ago I received a notification of 2FA enforcing for forticloud accounts. Following the suggestions in this link, it says that starting today the 2FA option by email is enabled for all users.I enter forticloud but the only option enabled is still fortitoken. The truth is I'm confused as to how to continue, because I need 2FA to be by email because other users find it more practical.From already thank you very much Greetings from Argentina PS: sorry for my poor English language.

I did the following: - upgraded FMG to 7.0.11 while the FGT still were on 7.0.13 => everything still worked fine afterwards- upgraded the FGT to 7.0.14 during the next night (scheduled) => since then FGT keep losing the connection to FMG when I deploy policy package or device config. Results in the deployment timing out after some time. During a TAC session it helped to reboot FMG (and perform fsck on it with that) and then retrieving config of FGT and then deploy it. After this deploying of policy package worked fine until now.Now just deployed the device config only on a FGT and it got disconnected from FMG again... However they come back after some time...

Hi, I've inherited a client that has a Fortigate 61E firewall and have to set up a VPN user. I've been trying to follow the below document but get a little lost by the time it gets to the IPv4 Policy.https://blog.vpntracker.com/how-to-configure-vpn-for-a-fortinet-fortigate-firewall/ The really weird thing is, they have one VPN user already setup who can successfully dial in to the LAN using Forticlient from his home computer.. I can find no trace of a VPN, a user or any settings related to a configuration that allows this user to VPN through it. Any help appreciated.

Hi,I have 2 Fortigate setup as below, and the issue as follows.FW1 cannot ping anything on FW2. network, but FW2 can ping FW1's 10.11.30 and 10.11.40 network.BGP is setup between the 2 and is working fine, with RouteMap and Prefix List, so traffic from 10.11.30.0 flows through port1 (192.168.9.181) and 10.11.40.0 through port2 (192.168.9.182), smae configuration is on FW2 for 10.21 network. FW1 Routing table for VRF=0 C 10.11.30.0/24 is directly connected, VLAN30 C 10.11.40.0/24 is directly connected, VLAN40 B 10.21.30.0/24 [20/0] via 192.168.9.182 (recursive is directly connected, port1), 00:18:07, [1/0] B 10.21.40.0/24 [20/0] via 192.168.10.182 (recursive is directly connected, port2), 00:17:40, [1/0] C 192.168.9.0/24 is directly connected, port1 C 192.168.10.0/24 is directly connected, port2  FW2 Routing table for VRF=0 B 10.11.30.0/24 [20/0] via 192.168.9.181 (recursive is directly connected, port1), 00:18:47, [1/0] B 10.11.40.0/24 [20/0] via 192.168.10.181

I need to integrate my Forti-EMS server with cisco ISE to retrieve users and device info is that possible?note : my AD integrated with cisco ISE but EMS can't integrate with AD due to security restriction on my environment  

Hi,I am struggeling with API requests to a Fortigate (Version 7.0.15). I used instructions from FNDN and got curl requests working as expected but the same request in python just throws a 401.The python code: url = 'https://fortigate/api/v2/cmdb/firewall/policy/?vdom=vdom‘ request_headers = {'Content-Type': 'application/json', 'Authorization': 'Bearer <apikey>‘ } response = requests.get(url, headers=request_headers) The same (working) request in curl: curl -s -H "Accept: application/json" -H "Authorization: Bearer <apikey>“ https://fortigate/api/v2/cmdb/firewall/policy/?vdom=vdom  Anyone has an idea what's wrong with the python request?

Hi Everyone,I have the problem with configure SNMP. I use a pair fortigates model: 201F, version 7.2.7. I config HA mode Active-Passive. So I want to monitor 2 fortigates, I have enable snmp agent and config community snmp v2, config interface administrator access service: snmp, ping, https. Test ping from NMS to Fortigate is successful but when NMS send SNMP get but not receive response packet from Fortigate. Can you help me ? Thanks a lot.local traffic