Support Forum

Hi All, Can we register fortiswitch to forticloud without internet connectivity like we do in fortigate using upload license method.

Hello colleagues! I am a bit got lost within mp-bgp and vrfs on fortigates, let me explain in a nutshell.Let's imagine the schema when we have a "core" multi role switch and several appliances connected as a star topology (or like a leafe spine , but let's skip the redundancy part for now). Links between the core and leafs all L3 and use mp-bgp with VRFs and address family ipv4 vrf plus the rt community. So nothing extra, everything works. It's not the vxlan+evpn example, just a simple campus. Then I would like to connect this core to a Fortigate by the same way for propagating the default gw route and  providing some advanced traffic inspection. The FG can be considered also as a point of route leaking. The confusion is that I couldn't find any examples of this design and how to configure the mp-bgp. It might be the limitation that we can use only an "interface" for each vrf and can use only vrf-lite connection. In some sources I found that it should be organized via vdoms , but

Hi!I'm trying to list spesific host types usig API;curl -k --location --request GET 'https://x.x.x.x:8443/api/v2/host?filter=iconType==camera' --header 'Authorization: Bearer XXXXXXX' (just using at this example icon type, that is one differentiator between host types in our case) This filter doesn't work. Am I doing something wrong? Also one interesting thing is, that only 25 hosts are shown, when no filter is used...Although the last line tells:..."filtered":4865,"total":4865} NAC version 7.4.0 BR, A 

Need to know best/efficient practice to implement HA active-active setup using 2 independent DIA links and 2 firewalls FGT61F.Also I need to use both links at the same time to share the traffic.

Hello All, I am trying to gather as much information as I can prior to making a change to my firewall. I was attempting last week to create an automation stitch. This would place IP addresses associated with SSL VPN brute force attempts, onto a blocked IP address list. I found that this apparently cant be done if your SSL VPN is bound to your WAN interface. I began researching this but cant find a clear answer as to why this is required. I would also like to make sure I understand all of the steps involved in doing this as well as any implications it might have on functionality (pro or con). From what I can tell, it is a matter of creating the interface, assigning some random IP to the interface then creating a VIP that forwards traffic incoming on the SSL VPN IP and port,  to the loopback interface. Are you required to change the actual policies that permit the traffic since the interface is addressed as sslvpnroot and not as an IP? Any information/assistance is greatly appr

Dears, Can I change the FortiVoice time format from 24hrs to 12hrs? BR,

I'm not sure why my license suddenly shows as not being validated, with the error shown below. Could you please let me know what caused this and how to resolve it?upd_fds_load_default_server6[1046]-Resolve and add fds update.fortiguard.net ipv6 address failed.upd_comm_connect_fds[457]-Trying FDS 208.184.237.66:443[116] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory.cer, root ca Fortinet_CA, idx 0 (default)[116] __ssl_cert_ctx_load: Added cert /etc/cert/factory/root_Fortinet_Factory_Backup.cer, root ca Fortinet_CA_Backup, idx 1[497] ssl_ctx_use_builtin_store: Loaded Fortinet Trusted Certs[517] ssl_ctx_use_builtin_store: Enable CRL checking.[524] ssl_ctx_use_builtin_store: Enable OCSP Stapling.[835] ssl_ctx_create_new: SSL CTX is created[862] ssl_new: SSL object is created[212] ssl_add_ftgd_hostname_check: Add hostname checking 'update.fortiguard.net'...[929] ssl_set_hostname: Set hostname 'fortinet-ca2.fortinet.com'[720] __ssl_info_callback: before SSL initializ

Hello,  I read carefully topics here, but could not find working solution. I have a FG-40F test unit, made a vlan on it (99) with pool 192.168.200.0/24 FG has 192.168.200.1 addressOn this vlan I set up captive portal like this:If I set as excempt DNS service here, it disappears on next interface openingOn this stage I use internal users, created on FG unit.DNS is set = Same as interface IP, so I assume it is 192.168.200.1I also added a policy for DNS to go outside for unauthorized users (src=vlan, dst = wan): Also I made a letsencrypt certificate for this domain and made a static dns entry:The problem is that on different types of devices it operates different way, but works only on iPhone - when I can by opening some websites trigger appearance of login window in browser to authenticate. On Mac it is also sometimes working through browser. But on Android I usually see:1) Message: ERR_NAME_NOT_RESOLVED2) In case if I disable https authentication I even see

Hello community, I am thinking about implementing a FortiGate device in my network. However, due to the topology of the network, I have questioned whether or not to replace my Core Router directly with a FortiGate. What has been your experience? Regards.

Hello there,  I try to to slim down our Stack by getting those things mentioned in the Subject directly from FortiManager instead of all the Fortigates directly. Is that possible ? - Haven't found anything in the API Docs. API or Mail Event would be prefered.  Thanks!

Hello everyone; I currently have the NSE 1 and NSE 2, but I want to take the NS4 and I have some questions: 1- Is the NS3 necessary to take the NS4, even having experience with team deployment? 2-Where can I take the NS3? I have searched and have not found it. If anyone has a direct link, I would appreciate it! 3-From what I have researched, the NS4 is presented in Person VUE. Is this correct? 4-When I pass the NSE4 exam, do I get the FCP Security Network certification or do I have to take another exam? Thank you very much for your support.

which action must be performed to return the FortiManager HA 1 manual mode to a working state?

I got a weired scenario where two post deployed fortiswitches are showing offline on my fortigate.When I run both exec switch-controller debug commands, they show me everything is OK literally. Fortilink OK, NTP OK.. but still the CAPWAP interface doesn't get an IP.The fortilink is allowing security fabric thru, but still CAPWAP ain't forming.What other troubleshooting could I perform? I've checked so many posts and the solutions rely on the diagnostic commands telling you what's wrong, in my case, nothing shows otherwise.

i have a created a new trunk group on the fortiswitcchmc-lag enabled, STP Enable , Edge portlacp active port 48,port48CiscoLACP mode activePort channel 13Cisco switch is running MST spanning tree mode (same as fortiswitch) when i try to enable to port-channel i get STP error on the cisco side and the cisco ports go into err-disabeld state  any idea what going on?does anyone have a working configuration of a similar environment?

Hello, I have integrated FSSO and there is no issue, I even installed the DC agent. However, in the SSL VPN policy, I cannot select the FSSO groups under the authentication portal mapping in the SSL VPN settings, as they are not shown, only LDAP is displayed. What could be the issue? I want to configure the SSL VPN rules with FSSO, not LDAP. Where am I making a mistake or is this possible?

Hi there, is there a way to authenticate an 831F to the switch port it connects to?We want to avoid that people connect laptops instead of the FortiAP.I haven't found any configuration guide or guide line so far, because everytime I us the keyword 802.1x I get articles related to the wireless clients. TIA, Alex

Hi Forum,I have configured "host negated" and added a group of countries (block_country) on vpn-ssl settings to avoid ssl failed login attacks but a user need to connect permanently from a country who is on the group mentioned above. Is there a trick to bypass the current config and allow a remote ip from a country forbidden ?Thank you for your help.Regards

Fortinet FGT61F has 2 IPSEC tunnels but only 1 remains up at a time I have 2 IPSEC tunnels towards a destination, one each over 2 WAN links towards same destination.But have been facing issue that only one IPSEC tunnel remains up at a time.Once I enable both the IPSEC tunnels, then they both start flapping.So I am forced to disable one IPSEC tunnel, only after which the other IPSEC tunnel remains UP and stable.Will share more details if needed.

How can i allow bitdefender from fortigate captive portal. Firmware version 7.2.6

A Win8.1 machine has a frequently reoccurring problem with connecting Forticlient to the remote endpoint. It will sit for a moment at 98%, then display the error: Unable to establish the VPN connection.(E=98,T70,M99,R-983070010)It goes away after a system reboot, but may show up again the next day and so on. I would like to find a solution to this. I see this in the debug logs:Debug    VPN    FortiSslvpn: 13308: Ras : dialing fortissl Debug    VPN    FortiSslvpn: 6952: rasfunc error: 0:633 Error    VPN    FortiSslvpn: 13308: Ras : connection to fortissl failed : 6:0:0:According to msdn docs 633 is ERROR_PORT_NOT_AVAILABLE which implies a port conflict, but the logs don't state which port.

Hello,I am currently facing an issue with my FortiAnalyzer when trying to view DNS logs from my FortiGate. Specifically, when I navigate to the FortiView > Traffic > DNS Logs section in FortiAnalyzer and search for DNS activity, the result always shows "No record found", even though DNS traffic is expected to be logged.Setup Details:Configuration:FortiGate is configured to forward logs to FortiAnalyzer.Other logs (e.g., traffic logs, event logs) are appearing correctly in FortiAnalyzer.

Hi there,I am about to implement geo blocking for SSL-VPN on our FortiGate FG 500E with FortiOS 7.4.6 under "VPN / SSL-VPN settings".The countries to be allowed access are within a group object and the rule ('Limit access to specific hosts') works fine dropping all access from all other countries. BUT - we have an employee working for us from one of the blocked countries and I do not want to 'allow' this whole country. So I tried to use the MAC address of his device and put it in the group object of allowed countries. It is then possible to select the group object but when you apply the changes, the group object disappears form the Host list!?Is there a way to solve this problem: blocking SSL-VPN for a country except defined client devices? Thanks to all of you and I whish you a happy new year :) 

Can anyone recommend me a site where I can download Fortinet stencils for Smartdraw and Visio. Thanks.

Be fair warned, I am new to FortiGate, so I may be asking some trivial question. I have been tasked with implementation of new FortiGate equipment in a remote office that will VPN back to corporate. Due to the VIP status of the location we purchase two each – ISP Circuit, FortiGate 201E and FortiSwitch 248B. For the HQ location we purchased two FortiGate 301E. I contacted support and I have read about 195 pages of the Cookbook, but am getting a little short on time and still without a solid feeling about the implementation. So I thought I would try out the Forum for support.Remote office Design 1. Stack the switches using redundant logical interface with standby enabled (Primary link to sw1 standby link to last switch sw2) shown in FortiNet Support ("HA-mode FortiGate units managing a stack of several FortiSwitch units") ? 2. Setup FortiGates in HA Active-Passive or Active-Active? Most all documentation prefers Active-Passive.ISP Redundancy 3. Can the two ISP WAN links be brought in

Hi, I have gone through the handbook and various other downloaded manuals but I can' t get this to work. Here is my current setup: x) Users are authenticated using the FSAE. x) Three AD groups have been defined; Internet_Users, Internet_Managers and Internet_IT. x) Internet_Managers have access to everything except downloading executable files 24x7. x) Internet_IT has full access 24x7. x) Internet_Users have social media, downloading and other stuff blocked. I want Internet_Users to be able to use sites such as Facebook during lunch hours only. I have created a schedule " enableSM" that recurs from 1:00 PM to 2:00 PM everyday. I have created a UTM called " Normal" that blocks social media, porn, etc. And another UTM called " Enable social media" that enables social media while blocking everything else as defined in " Normal" . How can I enable the users of AD group Internet_Users to use UTM " Enable social media" during the timing defined in " enableSM" ? I have