Support Forum

Hello Community I am attempting to use the FortiOS API to apply a license. The device is a FortiWifi 80F with Firmware 7.2.6.I am attempting to apply the Advanced Malware Protection Free Trial, for testing purposes.From help with the Fortinet Developer Network I have seen this command:  curl -X 'POST' \ 'https://192.168.20.1/api/v2/monitor/registration/forticare/add-license?access_token=xp40rkkhqcbfyr8Nq96H9G7H43q0f4' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "registration_code": "STRING" }'  I am not sure what the registration_code value should be. I visited support.fortinet.com to gather the license key I wish to apply. It downloads as a .lic file. There is text in there but nothing matches the registration code. I have tried to insert the contract number as the string but this did not work.Where can I find the registration code?Am I using the wrong endpoint?Appreciate it

I'm confused how updates work for Forticlient, in order to upgrade the client I've read that I need to use the 'Deployment and Installers->Forticlient Installer' and 'Manage Deployment', the strange thing is it forces me to attach an invite when creating the forticlient installer.I've already added devices using 'Endpoints->Invites'.  I added my own email in the invite section, and now it seems to be deploying them all, but why did I need to add myself as an invite to accomplish this when I'm deploying to 10+ devices I've already added?Theres also an option 'Reboot When Needed' which is confusing.  I want it to install but to not auto-reboot, so am I disabling Reboot when needed; except if I do enable it there's an option to Notify User to let them decide, but that is only supported on older versions of Forticlient.  I'm at a loss as to what to do, I'd like a notification, but if its on a newer version of Forticlient does it then auto-reboot?

Hello, could someone help me with a question? Which license should I purchase to export logs from 40F? We need a visual presentation of the generated reports. Which solution should I purchase to do this?I found information about this license, FortiGate Cloud Management, Analysis and 1 Year Log Retention. Would this be the solution?I added some images, we need this subscription, what is the required part number?Thanks. 

We have recently migrated a number of sites away from older FortiWLC Controllers and Meru AP's to FortiGates and FortiAP's, and found we are having a number of issues with AP's not publishing SSID's on the 2.4Ghz radio when multiple SSIDs are configured. In our case there are 3 SSIDs. For example, we have a FortiAP 233G with 3 SSID's configured on the 2.4Ghz and 5Ghz radios as follows; SSID1SSID2SSID3 The SSID's are in bridged mode. 5Ghz clients can see and connect to all 3 SSID's with no issues. However 2.4Ghz clients can only see and connect to SSID1. It can happen randomly across any of the FortiAP's we have installed and is happening at multiple sites. If we enable any one of the 3 SSID's on the 2.4Ghz radio on its own, devices can see and connect to the SSID with no issues, so it seems the FortiAP 233G has an issue when the 2.4Ghz radio is configured with multiple SSID's i.e. devices can only see and connect to one of the SSID's. Has anyone else experience

In the process of renewing SSL certs, this is the first time doing ADC, staff that built is no longer here.  I created the CSR via the local servers IIS, cert was created with DigiCert and uploaded to the same IIS. I then exported the .pfx from this server getting the following errors when trying to import into ADC.type: PKCS12 Certificate it fails with the following error 'Failed to store the private key' I then used open ssl to get .crt and .key and attempted the following:type: Certificate. and applied the .crt and .key files but get the following error: 'The imported local certificate is invalid.' Not sure what I'm doing wrong here, any help will be greatly appreciated. Thank you

Hello,Is there a way to see in Fortigate how much bandwidth (Mbps)is consuming an internal user?I recall before in fortiview it showed this but now (FortiOS 7.4) I can not see it. Only shows traffic in Bytes (MB).What widget would it be if any...? thank you.Regards.

Fortigate detects teams.microsoft.com based on http, but the delay is always unstable. Is there any way to check which IP address teams.microsoft.com is detected by http? Thanks

I've been looking at how to best do geo-blocking, and my options are to set every rule I have for inbound access to only accept from specific locations, or to manually add all the ones I don't want to a rule that applies at the top of the list. With SonicWALL, WatchGuard, etc. I can select the countries I don't want and set that policy at the top, why doesn't my Fortigate have the same option? As for the meat of the question, does anyone have a curated list of countries that they use and is available without a $25/month or more subscription?

Does anyone have a good CLI script to identify and group countries for geoblocking, or I do need to use the GUI and go one-by-one?

Hello , when it is used the comfort client? ONLY when I use AntiVirus profile? Or If I use another profile like IPS it is used too?I mean if I activate comfort client in a protocol option profile and apply it to a FW policy ... this comfort client is activeonly If I apply AV to the policy? or If I apply IPS is active too? The doubt is when it is active...Thank you!Regards

Hi All, I have experience with a number of Forti roducts but Fortimail is completely new to me. I am deploying a solution replacing the embedded mail protection on some Sophos XGs. I have the Fortimail up but I am unusure how I can replicate and route traffic. The Sophos only has two policies in the mail configuration. The first is allow mail to the domain recipient and scan this mail - this is not used as mail accounts are in O365. The second is allow mail from internal servers to internal users (in O365).  Mail sent from named servers to a named relay and then on to the mail account. An exception rule was created allowing either the host source or sender address to skip AV/Spam etc checks and send through the mail and out to O365 whilst checking all other mail. I have set configured the domain for the mail FQDN in Domain User>Domain configuring relay type MX Record. I have also configured a recipient policy for recipients of the mail domain. The Forti

Hi, (Fortigate 201F, 7.4.3)I have a new SD-WAN setting, and I have an internal e-mail server. How can I limit the email server traffic (SMTP) so that traffic  only goes out through the designated SD-WAN interface. If that interfece go down, I do not want to allow to go this traffic out in other SD-WAN interface. A would like to prevent the email traffic to go out from an other public IP.  My current goal is not to configure the mail server (DNS, MX, SPF etc...)I tried to create an SD-WAN rule (Interface selection strategy = Manual) with the mail server address and SMTP traffic, where I only specify one SD-WAN interface in the interface preferences, but it seems that if I stop this interface, the traffic still starts to go out on the other interface. How can I stop this from happening? Thanks 

I have FGT3140B (v 5.0.7) in HA mode, and i am not able to add device in ADOM v. 5.0 The Add device wizard "jam" just after the wizard end to run proccess Retrieving IPS signature information.  I recieve in the status information "data not exist".  The process Creating initial configuration file are blinking, but not finishing.  I have wait over 30 mins, and nothing to do.  I can just press cancel button. If i cancel the operation, the device are not completly added. Any one have an idea?  All my fortigard services on the FGT are a green check status

Hi everyone, I need some advice regarding my FortiGate 50E.I recently purchased a FortiGate 50E device, and it seems it was previously registered using someone else's email address. I’ve already bought a new license for this device under my own account, but now I’m unable to claim ownership or re-register it because it’s still tied to the old email.I contacted the local partner for support, but they mentioned that they need a PO document from the company that originally registered it — which I don’t have.Just wondering:If I perform a factory reset on the FortiGate, will that allow me to change the registered email or re-claim ownership under my account?Any suggestions or experiences would be appreciated. Thank you!

Hello,I am starting to learn with FortiManager and when initially importing an existing FortiGate I get the following error: Retriving configuration file from FGT... Configuration file import succeeded. Reloading configuration file... Error: Configuration reload error. --------------------------------- Failure info: SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_group SELECT "##oid" FROM objcfg_fw_sched_group WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_onetime SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_group SELECT "##oid" FROM objcfg_fw_sched_group WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_onetime SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); >command(set firewall local-in-policy.1:intf SD-WAN-Inet) detail(datasr

We have received a message from our employees that the VPN client no longer works with IOS 18.3.2. It still works on older versions or Windows clients. We use the VPN with our own IDP as 2FA.As soon as the users confirm the 2FA, we get the message with URLSessionTask failed in the app. (See photo) Anyone having similar Issues?

Like a lot of you, I'm going to have to migrate a lot of users to IPSEC VPN which seems strange to me. IPSEC being so old I just assumed SSL VPN was the way to go. That aside, has anyone had experience with using different clients or the built-in windows client for connecting to a Fortigate IPSEC VPN? I have no experience with IPSEC clients beyond whatever the vendor provided (sonicwall global vpn anyone?) Would love to hear about your experience especially related to stability and ease of pushing out to users.

Hi thereThanks for your support.I'm looking for choose a fortiClient license for my FG-100F.Do you think the below SKU is ok? if NOT, can you please advise the best one? FC1-10-EMS04-428-01-12Endpoint-based Licenses - VPN/ZTNA (On Premise Deployments) 1 Year FortiClient VPN/ZTNA Agent Subscriptions for 25 endpoints, includes on-prem EMS and FortiCare Premium.) Thanks a lot 

Hi,Does FortiAuthenticator have the ability to enter a token and then a password? Can we implement such a scenario? Best Regards,İsmail Ürek FortiAuthenticator 

Client version is 7.0.2.0069. We use SSO but with or without SSO turned on we are getting: "Login Error. Connection Dropped by Remote."We have previously had this work for MacOS including MacOS 12. using DNS or IP address for the VPN address didn't help. At initial install and 1st time connection we do get prompted to sign-in with our SSO account (with 2FA on) and it looks like it should but then the connection just dies and we get the above error. Subsequent login tries just give the error right away.  Thank you for any help!  

We have been testing DPDK acceleration for ipsec tunnels on our nutanix hosts. dpdk-iperf-1 and dpdk-iperf-2 are simple 4-core 8gb RAM ubuntu VMs with minor host tuning (sysctl window sizes etc) for iperf performance testing, and can maintain about 17Gbps using iperf3 when directly connected to one another. dpdk-test-vm04-1 and dpdk-test-vm04-2 are fortigate VMs on v7.6.2 (2cpu, 16gb ram). When testing iperf performance on a basic ipsec tunnel we saw approximately 1.2Gbps between the ubuntu VMs. After enabling dpdk (see config below) we are only able to increase this performance to 1.5Gbps.test diagramI've confirmed that the dpdk engine is correctly picking up this traffic - ipsec_dec_packets and ipsec_enc_packets are incrementing, and the vnp and vnpsp engines all kick into life with `diagnose dpdk performance show` while the test is running.However we did expect to see a significantly higher performance uplift for ipsec tunnels, is there something we're missing?Current work

Just in case someone runs into this same issue. We ran into a problem where users were complaining prime video would not load on their apple devices. Turns out the "Known Exploit" signature is blocking the videos but not the app itself. Turning off the specific signature fixes the issue. Not sure if this is intended or a false positive.  Absolute Date/Time2021/07/14Time16:06:22Session ID334183039Virtual DomainrootAgentPrime%20Video/8.330.7424.12 ActionblockedPolicy ID17 Profile NameTest FilterEvent ID90300017DirectionrequestSeverity MessageKnown ExploitsLog ID1200030248TypeutmSub TypewafEvent Typewaf-signatureSource Interface RolelanDestination Interface Rolewan

Hello guys,I am labing fortigate advpn sdwan with bgp routing. I am trying to summarize the spoke's lan networks in the hub but when doing this I loose spoke-to-spoke shortcut vpn and all traffic is forced through the hub. Cisco has NHRP to solve this issue to override the bgp spoke routing so exact route can be received from the other spoke. How I can summarize of fortigate in the hub firewall so I can have on-demand shortcuts in the spokes? Thank you so much.

Hi everyone.I am just trying to find out what everyone is doing regarding moving from SSL VPN to IPSEC VPN, what are you putting in place that is potentially free as safeguards and best practice methods.Geo - location - restrict where users can SSLVPN from.SAML - with 2FA auth.Others?Thanks in advance.

Hi everyone Just installed my first ever Fortinet 30G (latest 7.2 firmware) and I am having some troubles with logging. I have created a virtual wire pair with a firewall policy attached to it (accept everything from anyone and anywhere, but apply AV, IPS, WebFilter etc. policies). Logging is set to "UTM" and should be local (no FortiAnalyzer).Now, when I try to access the EICAR test file, it successfully blocks the access - however no security logs ever show up. How can I solve this? Best regards Andreas