Support Forum

Hi Support, When migrating from 60e to 60f, do we need to change the conf ver file during backup push.#conf_file_ver=170387064977772676. Also firmware of our new fw 60f is on version 7.2.6 and old  60e is on 7.0.11.Can we directly upgrade 7.0.11 to 7.2.6 and take backup and push it to 60f?Because as per upgrade path it is showing h 7.0.11>7.0.12 >7.0.13 then all the way to 7.2.6f. It is very time consuming 10 firmware version are their between the two.  

Hi All,I currently have an estate of 100F FortiGate firewalls managed by FortiManager with a root ADOM of 7.2.The 100Fs currently run on the 7.2.x firmware.Will the 200G run the 7.2.x firmware?Or do I need to run the firmware version that is currently supported for the 200G?Can the FortiManager manage the 200G or do I have to wait until the 200G is running a 7.2.x firmware before connecting it to FortiManager?

We purchased some FortiGate 60F, some were on 6.4.6 and some were on 7.2, except for one FortiGate that was upgraded to 7.4.5. We noticed that the Fortigate on 7.4.5 has its speed LED of LAN 1-4 turned off occasionally (happened twice in 2 months of the Fortigate in use). We tried rebooting the FortiGate and factory reset, but the speed LED did not turn back on.  We shut down the Fortigate and replaced it with a spare device, and the next day when we turned on the Fortigate, the speed LED of LAN ports is on again. With the device's LAN speed ports back up when turned on, the hardware test will pass, and RMA will most likely be rejected. Anyone experienced in the same or other versions, and what are the solutions? 

The IPSec ikev2 tunnel that employees dial into will be used by the Fortigate VPN Client application. Is it possible for each of them to receive a fixed IP from a predefined pool? For examlpe:pool: 10.10.100.10-10.10.100.50person 1: 10.10.100.10person 2: 10.10.100.11etc. I tried mode-config but without success.

Is there a cisco packet tracer equivelent for fortinet (fortiswitch & fortigate) ?I am trying to learn fortiswitch (cli) and fortigate. Anyone has any idea? thank you.

HiI'm trying to figure out why my transparent proxy policies are allowing traffic when they shouldn't. I have a transparent proxy policy restricted to a single IP and FSSO group for testing, yet when I disable the policy, the test device/user still has internet access when no other transparent proxy policy should apply. Fortigate 200E running 7.4.5 I've disabled fast-matching, and enabled WAD debug: diag deb resetdiag wad debug enable category policydiag wad deb enable level verbosediag wad filter src <redacted>diag deb ena With the policy enabled, I see proxy policy 8 matching: wad_http_req_check_policy :12911 start match policy vd=0(ses_ctx:t|Phx|Me|Hh|C|A1|O) (<redacted>:57019@19-><redacted>:80@20) absUrl=0wad_fast_match_is_enable :3702 fast matching is disabledwad_http_policy_get_cate_info :212 get category right awaywad_http_policy_match_one :454 fw_pol_id=8(pol_ctx:th|Acd|7|=p) pflag:H|W|U|Ac asyn_info=1wad_vwl_has_intf :329 logic/phy

Hi all, My situation:I run SDWAN use ADVPN BGP on loopback between HQ and 4 branches, HQ is Hub and Branches is spokes.When Branch 1 talk to Branch 2. Spoke -  Spoke tunnel is established successfully, I set up tunnel idle timeout, and tunnel is down after 10 minutes, if no traffic, it's good.But, I have Br03 and Br04, they always talk each others, so Spoke-Spoke tunnel will not down after 10 minutes (it's correct). I set Lifetime phase 1 :1days and Lifetime phase 2: 12 Hours. And I saw trouble here: - After 1 days. spoke-spoke  tunnel between Br03 and Br04 is re-established but it has trouble, I saw in logs, it's stucked at action: delete_phase1_sa , around 5 minutes.  And after around 5 minutes, tunnel  spoke - spoke is not iusse, it working fine. And I saw log, after 5 minutes, Sopke-spoke only down. During 5 minutes, the trouble make loss connection between Br03-Br04. My connections: each BR has 2 ISP lines, BR03 tunnel of ISP1 conn

Hello! I've two ISP link configured on two separate SD WAN rules. When my primary ISP link is activated, the DNS and FortiGuard works only with the "source-ip" configured:  Everything OK! My problem is when the secondary ISP is activate. The DNS and Fortiguard stop to work(dns unreachable)! In this case, i needed "unset" the "source-ip" to get it working again. My question:Is there any configuration so that DNS and Fortiguard continue to work on both links? Without having to make these "source-ip" settings manually. 

I would like to forward all Google-related services to a specific IP in the internal network. Can this be implemented in the SD-WAN rules? thanks.

G'day,  This is for those working in ICS/OT: I have set up and tested alerts in FAZ. The email notifications for the alerts via handlers and notification profiles, etc... are sending BCSI information. I have tried to work with support, but they are saying that there is no way to remove the information that is sent in the emails. NERC requirements are clear about this. I can't send hostnames and IP's in the same info resource. Privacy Masking is an option, but it also disables it i FortiView and Log View. Has anyone else come across this and found a solution? Its bad that I can't send the alerts I need in FAZ without the need of another product (SIEM) to do it. If someone has a best practice comment and its condescending in nature, just I know I love you still and happy holidays. Oh... I submitted a NFR for this already.

Hi!We want to implement a monthly change of Guest SSID password change via API automatically. The environment is managed with FortiManager. What would be best practice in this case?- Change the password via CLI Script on every device from FortiManager, push the CLI script via FMG API- Change the password in SSID profile and provision via API - Anything else?With the first approach, I guess we will see conflicts and FMG tries to override the password during a following provisioning?Thanks & Happy Holidays,Tobi

We are running FortiManager 7.2 on Hyper-V. Over the weekend the host installed updates and rebooted and now on FortiManager it states the Fortigates are unauthorised. I have read that having dynamic Mac addresses could cause this issue, but I have now set to static in Hyper-V and the issue persists after reboot - the FMG asks for its hostname, then the 2 x Fortigates say unauthorised despite being authorised prior to the reboot. Any ideas?

Hi,we have two /29 IP blocks from our ISP. IPs from the first block are used for SNAT and a few VIPs. There are two default routes, one for each gateway because both subnets have different gateways. We didn't want ECMP, so we increased the distance for the default route to the gateway of block 2.We also run VIPs on IPs of the second block. I was wondering why this is even working because the default route for block 2 is not installed in the routing table because of the higher distance. Therefore, return traffic for VIPs of block 2 must flow through the gateway of block 1. Asymmetric routing is disabled, I checked it.We are also using port forwarding on the VIPs, so it shouldn't automatically use the VIP's public IP for return traffic. Edit: I checked the session table and it looks like Fortigate SNATs the reply traffic. But I don't know why, the documentation says that it sould only be doing this when One-to-One NAT is applied without port-forwarding. Or does this rule only apply

Hi,I set a wifi guest with self-registration and otp sent via sms using Fortisms license using Fortiauthenticator.There is a method to send an alert when Fortisms license is about to end? For example send an email?.Thank you all in advance. Vincenzo 

Dear AllWe have deployed FortiNAC 7.6 latest version and using it for 802.1X authentication using Cisco switches and AD authentication through WinBind, authentication was working well for some customers but its not stable , now we are facing that cisco showing authentication successful but on FortiNAC its showing "unauthenticated" and remain in Isolation/authentication VLAN means VLAN change is not happening , this product is strange sometimes becomes very slow. We are using Peap MSCHAPv2 with user authenticationplease suggest

 Problem:I have a FortiGate 90G, and I have created a cluster. The management IP for this cluster is currently set to 192.168.1.1. However, I also want to assign a secondary management IP of 192.168.1.2 to the secondary unit in the cluster, specifically for monitoring purposes.Request:How can I configure this secondary management IP for monitoring? Are there any potential issues or problems that might arise from this setup?Please provide the correct steps and guidance, as I do not have enough information about this process. 

Hello all,  I would like to change or disable VPN Idle-Timeout for only two users or, if it is not possible to change for user, can it be changed for specific profile in which certan users are added. I'm using 7.2.10 firmware version.

hi, I am checking the upgrade path of fortimail from version 7.2.2 to 7.2.7 but I check the documentation of fortimail 7.2.7 (https://docs.fortinet.com/document/fortimail/7.2.7/release-notes/569892/firmware-upgrade-and-downgrade) they inform that you have to jump directly from version 7.0.6 and it doesn't say anything about version 7.2.2 can you confirm me that the upgrade is direct from version 7.2.2 to 7.2.7 Kind regards

I'm trying to bring up a trunk over a port-channel between a pair of 1048E's and a pair of Cisco 9504's that are configured using vPC.  One fibre connects one 1048 to one 9504, and the other fibre connects the other 1048 to the other 9504.  The VPC on the Cisco side fails, saying "vpc port channel mis-config due to vpc links in the 2 switches connected to different partners".  I am working with support and Cisco support, but I wanted to ask if others have gotten this working.  We're looking at possible spanning-tree issues, but also best practice guides on the Cisco side for VPC's.  I want to trunk my Fortinet distribution switches to my Cisco infrastructure so I can leverage other vlans in my Fortinet firewalls.  Any thoughts?

Hi!KB "Keep the flash partition without it being overwritten (For rollback purposes)" seems useful, except, I think it's problematic. It basically, says, we can manipulate which into partition the new firmware image will be stored to keep (original firmware image in) the other partition from being overwritten during upgrade.However, upgrade is not only about images, it's also about FortiOS configuration migration!!As per KB, the partition into which the new firmware is one with "Active" is "No", but... (as I understand) the configuration used for FortiOS configuration migration will be sourced from partition with "Active" is "Yes".So, in KB's step "Upgrade the firmware from 7.0.13 B0566 to 7.2.6 B1575:", the FortiOS configuration will be sourced from partition with the original "6.4.6" configuration, not the upgraded "7.0.13" configuration. And since that original FortiOS configuration was not migrated as per approved "Upgrade Path", we would end up with supposedly incorrect Forti

Hi All,Recently we've been encountering an error in one of our environments where any submission to the Live URL Rating support gives the message "Thank you for your submission, your request will be reviewed in 24 hours." instead of going through the regular live rating process.  Has anyone else been experiencing this or noted similar behavior?Thanks,Mark

Hello, I have some traffic hitting Implicit Deny, even tho the Allow Policy seems to be correct:Logs:   Rule: Found this: Traffic dropped by 'implicit deny pol... - Fortinet Community, but everything shown is ok here.This might be relevant: I recently changed my FortiGate from standalone to Fabric Root. Could you please help diagnose this? Thanks in advance.

I am unable to launch Forticlient with MAC OS Monterey.  Whenever I try to connect I get the prompt, open security & privacy settings and allow system software from Fortitray.  When I go there there isn't anything for me to allow fortitray.  

Hi, Customer is having FAP231F and they are having ISP with 500mbps bandwidth.On wired network is gives speed more than 400mbps but on wifi getting speed upto 225-250mbps.For testing purpose connected AP directly on Fortigate interface with single user connected on wifi, getting speed upto 225-250mbps only.Channel width is 40mhz and client system is connected on 5ghz band.Same time TP Link wifi router is providing speed upto 400mbps.Can someone suggest to get more speed on FAP wifi.  

Hello! I installed FortiAnalyzer (Trial) on a VM, but some panels (FortiView -> Traffic Analysis or Treats, for example) return the error:Server error: DB::Exception: Table siem.fv_fgt_t_threat_5min_sp1 does not exist Already tried:#execute sql-local rebuild-db#diag test application fazcfgd 85 Did I miss some config., or any suggestions on how to fix it?Thx