Support Forum

 I need to install a few FortiSwitches (FS) as replacement for very old cisco switches in a quite remote site.I already got the switches here in my office and wanted to prepare them before I go onsite. How should or could I prepare the FortiSwitches here in my lab to reduce onsite time? The FS will be connected via FortiLink (FL)to a local Fortigate 40F with FortiOS 7.0.1440F(FL)---FS124---FS148---FS148                    |                FS148 Uplinks are FO 10GB, no reduncancy, so I need to connect the switches mostlty in serial order. See in the schema above. I should be able to connect the FS with FortiLink in parallel to the Cisco setup.The old Cisco setup is pretty straightforward. Just two VLAN's.   Actual Cisco Switch (CS) setup looks like this here:40F(LAN1)---CS24---CS48---CS48---CS48                   

Hello,I need advice on a problem, or to make sure that this is indeed the case. I have a FG VM in a cluster (FortiOS 7.0.14) and I updated the license from 2CPU to 4CPU but only on the Master (Master 4CPU, Slave 2CPU). HA worked correctly and everything worked but after 24 hours the cluster stopped working and blocked all communication with a message: VM resource exceeds license limit. Master/Slave must have the same license? (number of CPUs) Thx :) 

hi, can someone please advise how to check the fortigate log to confirm the traffics are blocked by the ssl security profile? The policy looks allow. Thanks in advance. 

Hi, How do we block FortiClient via Application Control?I tried to work on this using this KB: Block a specific VPN application by using... - Fortinet CommunityBut I am still seeing traffic from our FortiClient users, but Application is tagged as 'SSL_TLSv1.3'. I hope you can share how to block FortiClient via Application Control effectively, and why is 'SSL_TLSv1.3' reflecting in the logs? Thank you!

Hi, We have upgraded Fortigate to v7.4.4 and Fortiswitch to v7.4.3.Post that Fortiswitches are showing not register.Please guide.. 

Hello,I have installed client version 7.4.0.1636 and I can't connect. It works for my colleagues. Neither the GUI nor the CLI part works for me. Here is the output from the CLI: $ forticlient vpn connect test740 -u XXXXXConnect VPN: test740Password:Status: Connecting...Status: DisconnectedNotification: Config routing table failedDONE.On the log, I can read:20240610 20:25:02.119 TZ=+0200 [sslvpn:DEBG] route:102 route backup START20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:154 route backup DONE20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:396 begin route config20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:397 Remote IP: XXX.XXX.XXX.XXX20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:398 Local IP: 10.XX.XX.XX20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:399 Tunnel mode: Full tunnel20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:400 Exclusive routing: Disabled20240610 20:25:02.120 TZ=+0200 [sslvpn:DEBG] route:453 Can't find dev for IP 10.XX.XX.XX (tun)202406

Hi,Hope can someone assist me.How can I get the FortiAP Bridge mode work with multiple VLAN + Third-party DHCP server?I'm trying to run multiple SSIDs in different VLANs. Here's my setup:1. FortiGate 100F > FortiAP Controller2. Cisco L3 Switch > VLANs and DHCP Server are configured here3. FortiAP > Will hold multiple SSID with different VLANs Cisco L3 Switch>connected to FGT via trunk port FortiGate 100F>All VLAN interfaces are addedFortiAP>Connected to Cisco L3 Switch via port trunks with Native VLAN assigned and all other VLAN set to allow>SSID VLAN settings assigned>Management VLAN set to 0 FortiAP able to connect to FGT100F using Native VLAN IP.SSIDs are broadcasting. However, unable to get IP address from other VLANs configured.

 Recently, FortiClient has been alerting me about the following OpenSSL vulnerabilities:OpenSSL CVE-2024-0727 Denial of Service VulnerabilityOpenSSL CVE-2023-5678 Denial of Service Vulnerability        Despite updating to FortiClient version 7.0.12, these vulnerabilities are still being flagged, and I am concerned about the security implications for our systems. 

Hi everyone,A customer has two FortiGates in Azure, configured in an active-passive HA cluster with internal and external load balancers. As per template, both firewalls have a different IP on the WAN interface, being NATed by the ELB.This HA cluster should be managed by FortiManager, deployed as a VM on premises and behind NAT, so reachable directly by public IP.I configured the central-management settings as on all the other firewalls, but this weird thing happens: only one of the two is able to be correctly managed by FMG (when it becomes active, of course). While the other one is active, if I run a sniffer on FMG I see packets from/to the host, but it seems that the firewall is not able to contact FortiManager. If I run a "execute telnet x.x.x.x 541" I can connect, showing that there is reachability. Also, both firewalls are being NATed by the same public IP.Did anybody have this kind of topology and already had to deal with this problem? Is there any KB I should refer to to troubl

Hello All, After a little help from those much smarter than myself. We are looking at SSL VPN through FortiClient (There are reasons we cannot go to IPSec just yet).We have configured SSL VPN and that works fine in "web mode" can access local lan resources and internet services however when we enable just tunnel mode and use FortiClient we lose access to local lan resources , internet services are fine.The policy rule looks like  - d-fwivfo_a (d-vdom1) # show firewall policy "3"config firewall policyedit 3set name "allow SSL VPN access"set uuid d3819b0c-448c-51ef-8bfc-42a0334bb27bset srcintf "ssl.d-vdom1"set dstintf "dev-trust"set action acceptset srcaddr "SSLVPN_TUNNEL_ADDR1"set dstaddr "production servers"set schedule "always"set policy-expiry enableset policy-expiry-date 2024-08-17 10:35:00set service "ALL"set groups "LU IPSec VPN"nextendSo not completely sure what we are doing wrong ?.We are using 100F's running 7.4.4  Any help appreciated . 

Hello all,  I found TWO VM images available from Fortinet as said Fortigate and FortiFirewall. What is the difference between them?  Thanks 

Dear All,Anyone can tell me what is mean by the command set auto-asic-offload disable. In which situation we can use this command and how it can impact a production environment if we are using this command. Thanks

Hello Team,Is there any Knowledege base to restore a FortiManager VM unit operation, following an RMA replacement Method by doing via HA

Hello everyoneI want to go to FortimanagerCreate a report that outputs the firmware status and system uptime as well as the host name.Unfortunately my attempt below shows nothing. SELECThostname AS "hostname",SUM(sysuptime) AS "Total sysUptime",version AS "Firmware Version"FROM$logWHERE$filterGROUP BYhostname, versionORDER BY"Total sysUptime" DESC

We have LDAP configured and working for VPN authentication, but need to of course have secure auth, so need to change to LDAPS. LDAP is working with a regular bind account. When I change to LDAPS, both the connectivity and the user credentials test pass successfully. However, nobody can log into the VPN; Permission denied. (-455). The documentation is pretty vague. To keep things simple for testing I haven't toggled the 'Certificate' option and assume that is not a requirement. I haven't been able to locate any logging to get more information, either. I'm puzzled as to why the LDAPS tests show success, but logins fail. I appreciate any insight.

Hello, we use internal Freeradius 3.2 server to manage traffic consumption by users. Since version 7.4.4 we found that users ask for new credentials not so often as before. We implemented python3 module to see log of data server receives from FortiGate NAS FG-60F and for case of downloading 100Mb file, we can see that there is 50 times less data sent by NAS than it should be.Our log:Before downloading:2024-07-12 11:57:01,067 - Parsed packet: User: %Username%, Acct-Input-Octets: 1086186, Acct-Output-Octets: 1022799, Current Packet: 2108985 bytesAfter downloading 100Mb:2024-07-12 12:01:01,070 - Parsed packet: User: %Username%, Acct-Input-Octets: 1188278, Acct-Output-Octets: 1101556, Current Packet: 2289834 bytesTreat this message as bug report, because in case of Mikrotik router with same server it calculates correctly on test files 100Mb and 1Gb

I am attempting to open our Fortigate firewall for one specific IP to troubleshoot some issues with an external vendor. How would I go about this? Fortigate 100F v7.2.7 build1577 Any help would be greatly appreciated! 

Hi everyone, I would want any changes in configaration or whitelist to require the user to write in their password before doing making the changes. I would want secure my Fortigate-100F in this way but have not found anything in the manual which suggest this can be implemented. Please would you mind telling me if what I want can be done?

Hi!various "diagnose internet-service" commands show Country, Region and City codes in its printouts.Whilst Country codes can be translated to names using ISO 3166-2, there doesn't seem to be equivalent standard for for Region and City codes. Is there a way to translate ISDB Region and City codes into names, using CLI?R's, Alex

I have 60F V.7.2.8 and I'm configuring automation to receive e-mail when the user connects to the SSL VPN and when they leave, but I'm not receiving the e-mails.

Hi, I have a script to block IP's for a given reason for Fortigate 400f, I am able to create addresses and apply to address group. However, I want to apply a form or rotation to avoid large address group. I am able to clear up the members in the address group, however, I also want to remove the addresses. I know this can be done individually as an API call. But is there a way to bulk remove? I would likely be looking to remove 500 addresses as part of the rotation and I would not want to go down the route by removing one per API call

We geo block all inbound connections to our web servers that aren't from the United States. Our Let's Encrypt http certificate renewals are failing due to this geo block policy, as the inbound http requests from Let's Encrypt come from other counties like Sweden and the Netherlands. Unfortunately Let's Encrypt does not publish their IP ranges or FQDNs to create a geo block exception, and DNS challenges are not an option for our environment at this time. Is there a way to geo block all inbound connections EXCEPT for inbound http requests to this directory: /.well-known/acme-challenge This was listed as a potential solution in this support article, but I'm not sure how this would be accomplished on a FortiGate firewall:Whitelist LetsEncrypt Server IPs - Help - Let's Encrypt Community Support I thought it might be possible using a web filter profile, but I haven't found any FortiGate specific articles about this so I wanted to raise the question to the commun

HelloI have FortiGate 40F ,it's working fine but I have NVR Hikvision (IP : 192.168.70.5/24) I Need to login NVR From Anywhere I have Public Domain But i need Exactly when i put this URL in browser immediately open NVR in Browser best regards,

Hi everyone,  Is it possible to implement to limit resources to 50% in a Fortigate-100F? 

Hello, We are using FortiMail and we want to forward a copy of every incoming email to another server. Is this possible and how can we do it? I have made a diagram to explain it, can you help?