Support Forum

Hi Team, I have several Fortiswitches managed via Fortilink, and I need to configure snmpv3 with one Read and one Read/Write user. This configuration must be done from Fortigate? Can you provide me the steps to follow to perform this configuration. Thanks and best regards,Juanmi

Hello, We hace Ha configuration, now we monitor the cluster, And I recieve information from the master, but I dont know nothing about the slave one. What I want to do is to monitor each node instead of monitor the HA cluster. Is it Possible? ¿What is going to be the afections? 

Good day. My Fortigate 80E suddenly has no logs displayed. All logs were missing or not recorded even on my Forticloud. May I know the reason of this? This just happened today. Previous days it has logs recorded. Thank you

Hi,I am looking for some input in to what I might be doing wrong in our new Fortinet setup. We are migrating from another vendor to a full Fortinet access-network consisting of Fortigates, Fortiswitches and FortiAP:s. The config is coming along nicely and we are almost ready to start testing this new network on a larger group of users.  We have 2 VDOMs and Global, 7 VRFs and use OSPF to route traffic to the rest of the corporate network. Setting up wired access was a breeze with fortilink and the WIFI for corporate users (using Cisco ISE as Radius) is ready to be tested across the company. However I am having some issues with what I feel should be the easiest WIFI SSID to get up and running. The SSID intended for Guest. We have 4 SSID:s, one for corporate users having several VLANS attached to the SSID interface, each vlan belonging to different VRFs. One IOT SSID and one SSID for developers doing testing and lastly the SSID for Guest. They are all tunneled SSID:s.&

Hello Expert, Can anyone  provide guidance to configure stitch for the fortigate to send an email alter when HA is out of sync. Thank you Regards

Dear all. I need your support as today I have faced issue with routing. we have lower distance AD for two static route but higher distance is shwoing best route why. please have a look snapshot and provide your opinion what needs to be done. I want to make best route for two networks which are connected to ISP.192.168.99.0/28192.168.100.0/28as per lower distance above the both route should be consider as a best route. and 192.168.145.0/24 should not be considered as a best route because distance is 50.   

 You do not have sufficient privileges for this resource or its parent to perform this action.Click your browser's Back button to continue.

hi all,I have a SD-WAN performance SLA with two participant interface, I want to view the history curve in FortiAnalyzer but one of the participant interface is not there.however, another SLA with the same interface have the interface displayed in FortiAnalyzer.what could be the reason and how to fix it?1. SLA 2. SLA in fortianalyzer with all participants (OL_INET_SKO_112 and port17)3. SLA in fortianalyzer with only one participant (OL_INET_SKO_112)

Hello, When I try to install even the simplest change in a policy from FMG to FG, install sticks at 35% with no error message.Both FG and FMG are in 6.0.4. After that, the FG appears to be disconnected from FMG, although connectivity FMG to FG is OK. Any ideas what's going wrong? Thanks

I'm looking for NSE5_FMG-7.2 practice questions. Could anyone share the right study materials or insights from a recent exam pass?

Can someone explain to me the difference and application scenarios between SD-WAN DUAL HUB Primary/Secondary and SD-WAN DUAL HUB Primary/Primary?Note that I have 2 private data centers and different network spaces?

i have tunnel to connect from branch to the datacenter but the traffic seem goes to wrong path.In the BGP path i can see the next hops is right where pointed to the tunnel ip, but in the routing table traffic to datacenter forwarded to the internet gateway. Anyone why in the routing table the traffic forwarded to the internet? 

Setting up a baseline script to deploy my fortigates.And I ran into the following problem while running my script:One of the steps is to delete the Admin user, and when I go to delete it I get a warning that it is logged in because I used it for the initial configurations.I would like to know if anyone has any idea how to disconnect the user using Ansible so that I can finish applying the baseline.

I have a question about reading the firewall rules. If I have a FSSO rule with an AD "Basic" group and origin all, and BELOW I have a BYPASS rule "all all", which rule will the traffic from the user authenticated by FSSO in the "Basic" group match? Is there any documentation that explains this? Also, if I add an LDAP group to this same FSSO rule, would the behavior be the same?

Just noticed that 6.4.16 was just released - considering the age of the OS version, this usually points to some serious security flaw ... !?

Hi everyone ! I'm facing a really strange problem with IPSec VPN. I configured IPSec tunnel FortiGate to FortiGate on different models (40F - 80F and 100F) all of my VPN tunnels are slow and they not reflecting my bandwidth throughput. I'm on FortiOs 7.0.1 For exemple I have :- FortiGate-80F <-> FortiGate-80F with a bandwidth of 1Gb/1Gb on both sites. Trough my tunnel, I reach with difficulties about 200Mb/200Mb- FortiGate-100F <-> FortiGate-80F with a bandwidth of 1Gb/1Gb on 100F sites and a bandwidth of 500Mb/500mb. Trough my tunnel, I reach with difficulties about 200Mb/200Mb- FortiGate-100F - Fortigate-100F with a bandwidth of 500Mb/500Mb on both sites. Trough my tunnel, I reach with difficulties about 200Mb/200Mb I tried many options to optimise my tunnel but nothing woks. I tried :- Set correct MTU on WAN Interface and MSS on Firewall rules (for exemple MTU of 1500 and MSS of 1380) --> no change- Set different encryptions on my tunnels --> no chan

How can I solve the following: When a device is stolen, in this case an 80F, how can I block it from connecting to my networks in any way or via VPN? I understand that I could do this with FortiManager and blacklist it, but I can't find the documentation. And if possible, could we delete the information configured within the device?

We were working w/ Lumen on getting Fortinet SD Wan setup. We currently have Meraki and Firepower FIrewalls sitting behind a pass through port on versas, but when switching to the exact same setup on Fortinet, a lot of traffic was dropping. Mainly UDP because thats what meraki was complaining about. Is there something the Lumen tech was missing that would cause this to happen?    

Hi everyone, currently dealing with the following scenario: we're sending logs from a remote FortiGate to a centrally-hosted FortiAnalyzer via S2S VPN. Source interface on the FortiGate for logging is set to a loopback interface (via "set source-ip" command) - this is working perfectly fine.Now we would like to transfer that communication into a dedicated VRF on the remote FortiGate so routing and IP adressing for the management/logging tunnel is completely seperate from production routing. In order to reach that goal we have moved the tunnel interface and the loopback interface into its own VRF (7). As soon as we do that, logging to the FortiAnalyzer isn't working anymore. We also tried setting "interface-selection-method" and "interface" inside "config log fortianalyzer" config to no avail. Has anyone got this to work by chance?Best regards,Max   

Dear Team,We are experiencing an issue with SSL VPN authentication when using email-based OTP and custom realms.**Device:** FortiGate 100F**Firmware:** v7.2.8 build1639 (Mature)**Authentication type:** Local users with two-factor authentication set to email**Issue:**- When users authenticate via the **default realm** (i.e., no "set realm" in the authentication rule), the OTP email is sent, and login proceeds successfully.- When configuring a **custom realm** and associating the same users via an `authentication-rule`, the login fails with **"permission denied"** and **OTP is not triggered**.- Debug logs show: `two factor check for [user]: off`, even though user configuration includes `set two-factor email`.**Troubleshooting done:**- Verified user has `set two-factor email` and valid email address.- Tried assigning user directly in `authentication-rule` and via user group — behavior is the same.- Reset password and email OTP on the user — no change.- Verified that SSLVPN works in both r

Hi,I've created virtual servers on Fortigate (eg: mail.customer.com, phone.customer.com...) and all works on LAN, but when i connect my pc to a VLAN i can't reach no one of them, so if (for example) i want to connect to my mail server it didn't works.I'm able to ping mail.customer.com (return public IP).I've created firewall policy rule but i'm not sure how to create static route and/or policy route.Can you help me?Thanks.

Is there a way to Block all Internet traffic except Veeam Malware detection URL?The DNS is changing every time (IP's) so based on IPaddress Its not working always.And I also created a DNS filter   But I see still traffic to others based on IP (I think) Is there another way to fix this? Kind regardsDaag

I'm trying to lock down some of my web rules.  The issue is many of the server owners don't understand what web access they "need" so I resort to turning on full logging.  I put a more restrictive rule above the less restrictive rule, and check the logs on the less restrictive rule. The end goal being that eventually there will be no more traffic on the less restrictive rule and I can remove it.  I've got logging turned on, but sometimes the logs can be a bit deceiving.  For examplewdcp.microsoft.comresolves to something likewd-prod-cp-us-east-<number>-fe.<east or west>us.cloudapp.azure.comOften times I'll see in the logs that the server accessed wd-prod-cp-us-east-<number>-fe.<east or west>us.cloudapp.azure.com when, in fact, they actually accessed wdcp.microsoft.com (but I don't know that fact).  I'll put *.<east or west>us.cloudapp.azure.com in the rule that I use above the more restrictive rule, but then the next day

Hi all, the FortiGate VM appliances clearly contain binaries whose source code is licensed under the GPLv2, e.g., the Linux kernel. It is also evident that Fortinet made modifications to this source code, e.g., the rootfs decryption, and distributes these modified binaries. The GPL is pretty clear that the source code of those modifications must be made available. After some reseach I was not able to find out where to obtain this source code. Does anybody know how to get it? Best,Zhu

Hello EMS admins There was a post about EMS behind a Web proxy where @xshkurti (Fortinet staff) replied that EMS 7.2.1 doesn't support to access FortiGuard through a Web proxy.https://community.fortinet.com/t5/Support-Forum/EMS-server-through-Proxy-server/td-p/91031 Now I'm on FortiClient EMS 7.4.1 and I have the same issue.Anyone managed to get this to work?Or anyone knows if this is planed to be be fixed in a future release?