Support Forum

Version: 7.4.0.0427OS: CentOSI have created a CLI Configuration and would like to apply it to a network access policy, but I am not seeing any option in the Network Access view to actually apply the cli config to a specific policy.  I was able to apply the CLI within Model Configuration on a specific logical network from that view, but is there not a way to just apply it to a Network Access Policy?  I have reviewed the below documentation but not actually reading where/how to apply it to a policy. https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/926300/network-access https://docs.fortinet.com/document/fortinac-f/7.4.0/administration-guide/856626/apply-a-cli-configuration-using-a-network-access-policy Any help on this will be greatly appreciated. Thanks

I have added an automation feature to automatically back up my FortiGate firewalls every night. I would like to include a time stamp in the file name but so far I have not been able to get that to work. This is the filename I am assigning through the execute backup script: daily-backup_%%log.devname%%_%%log.date%%_%%log.time%%.conf The variable %%log.time%% does not work. If that variable is included in the script my filename looks something like this, 1WSIAF~2, with no file extension or any of the other file name elements. I have tried to use %%time%% but that does not work either. Is adding a time stamp through this script impossible?

Hi everyone, From what the manual says about the BIOS, it seems interaction with the BIOS is very limited. However is it possible to set a password to it?

Hi everyone,  I have been reading the manual for the Fortigate 100F and, as far as I know, this is not mentioned but I wanted to ask you just in case I missed how it can be done.

I have the following issue and need your help, please. I have a FortiGate device and a router with an internal network of 192.168.0.0/24. I've set up multiple branches in OSPF area 0, excluding the internal network 192.168.0.0/24 because the second branch needs to act as the main distributor. Additionally, I have two tunnels with another company, set in OSPF area 10. To ensure they see a specific IP address (e.g., 192.168.0.136) from our network, I used "redistribute static". However, enabling this causes the second branch to not see the 192.168.0.0/24 network. When I disable it, the issue reverses, and the other company cannot see the second branch. Is it possible to resolve this by creating access lists for both OSPF areas? Here's   the configuration snippet for "redistribute static":           FortiGate    

hi all,trying to create site to site ipsec vpn with the other site on Azure virtual gateway, the tunnel is down and i follow the article https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-IPsec-VPNs-tunnels/ta-p/195955 to troubleshoot, I got the log as below screenshot when doing step Confirm that IKE traffic for port 500 or 4500 is not blocked somewhere along the path. does it mean that it is so good so far to the step? what is UDP 384 there?

Hi,how is it possible to bypass the AntiSpam scanner when email subject or body contains specific keywords defined in the dictionary? Thank you

Anyone have an issue setting up an active-passive HA on FortiADC where both devices want to be Primary?Neither see any peers.Mac address spoofing is enabled on our virtual switches.The thing that's weird is a 169.x.x.x IP is being assigned.The devices cannot ping the other 169.x.x.x IP.   (P) FORTIADCP001 # get system ha mode : active-passive hbdev : port4 datadev : group-id : 14 group-name : group1 mgmt-status : disable priority : 1 config-priority : 10 override : enable hb-interval : 2 arps : 5 hb-lost-threshold : 6 arps-interval : 6 l7-persistence-pickup : enable l4-persistence-pickup : enable l4-session-pickup : enable auto-config-sync : enable monitor

Message " Error downloading licence"3 interfaces , 1 cpu, 1gig ram others seem to have this issue also, questions un-answered. 

Hi I've changed my location from Ecuador to UK and now I cant connect the VPN. The alert says  "Unable to establish the VPN connection. The VPN server may be unreachable". I've reinstalled the product but without any result. Some advice please?

Geting the below error message when using forticlient. I have confirmed the settings are correct and I checked her TLS settings for internet explorer as mentioned in a previous post but I'm still not able to connect. This user is located in London and not able to connect to the firewall in New York. However my coworker and myself are located in the states and have no issues connecting to the firewall vpn with her credentials.  any suggestions?

Please advise if the vulnerability affects forwarded traffic or only local traffic to the fortigate.Any advice on workarounds would be appreciated as well.Thank you.

Hello, I need to provide Managed Wan Connectivity + Wireless Failover to a customer who is managing their own network, their Edge device is a Meraki MX firewall. They need Public static IP addresses on the MX.  I use ISPs to provide the last mile connectivity which,  in most cases is Off-Net Braodband Cable or FTTP (this is not dedicated fibre).  I would like to use FG40Fs to terminate the WAN connectivy (so I can manage it ), then hand-off the Public IP to the MX over a switchport. Then setup GRE tunnels back to my core network so I can route and advertise the Public IPs. One Primary tunnel and one Failover tunnel.  I've been told that this has many disadvantages:  A) the GRE tunnel overhead, B) the Cable (DOCSIS) variable latency & potential packet loss, and C)  and tunneling already tunneled and encrypted traffic.  I've also been told that, despite the specs in its datasheet, a FG40F wil not be able to deliver more than 100-

Hello @All,we're using transparent proxy for some update servers.On Windows with browser, a download of files is possible.On Linux shell with curl like (curl https://the.earth.li/~sgtatham/putty/latest/putty-0.77.tar.gz) it is not possible.Message:curl: (60) SSL certificate problem: self signed certificate in certificate chainMore details here: https://curl.se/docs/sslcerts.htmlcurl failed to verify the legitimacy of the server and therefore could notestablish a secure connection to it. To learn more about this situation andhow to fix it, please visit the web page mentioned above. Also, we have one other problem on Windows also with transparent proxy to get updates from Virus scanner software over the internet. The site for updates are visible from the Browser, but not from the application. both on same machine. Many thanks for helpingTBC  

Hi (New to Fortinet )I am hoping i can get some feedback regarding a project that i am currently working on, In our data center, we are replacing the switches with a managed fortiswiches 2048s. The firewall is a 3rd party appliance and will not be replaced at this moment. Proposed topology  I would like to manage the switches via the firewall as the controller. is this even possible?  Is this a best practice? are there any potential issue with routing/config that i should be aware of ? Thanks in advance!

I would like to know the possibility of comparing multiple Fortigate configurations (branches). The objective is to identify if any of the devices are missing important configurations. Currently, the branches are not using a CLI template, so we do not know how many branches have missing any important configurations. Is there something we can do using Fortianalyzer or Fortimanager to get this data?

  our Fortigate 501E, no longer boots, the Power LED only lights up (no Status or Alarm), Serial communication is not possible (nothing comes up in putty with official ortigate 9600 8N1 cord whereas on a product similar to side communication is functional with the same parameters).   Not reset button but an NMI button. When pressing more than 60s as seen here NMI Button for Troubleshooting Kernel Iss... - Fortinet Community nothing happens.   Do you have any final ideas before resorting to Fortinet support?

hi there, i am willing to upgrade my fortigate firwall from  7.4.2 to 7.4.4 but i am confused on this known issue of 7.4.4 because i dint want to enable automatic upgrade of fortigate firmware 1) scheduled update are ips signatures and antivirus signatures or scheduled upgrades are firmware upgrade 2)If scheduled upgrades are firmware upgrades then according to this attached known issue does it can be resolved by exec federated-upgrade? kindly confirm  

HelloI have FortiGate 40F , I applied Alerts for login ,Token ,Configuration change, interface change , FortiClient VPN  connected and FortiClient VPN  disconnectedall alerts working fine except when I connect VPN by forticlient i did not receive any alerts can anyone to help me thanks

Hi,I need same help, after system upgrade fortianalyzer to 7.4.3 gui not work.I have available disk space, the settings are all correct according to the previous version.   

hello,I tried to find why my app (classic client-server SQL app, SQL Server on Server, application installed on clients) is working slow over Local network (between two VLANs). Fotigate has policy between VLAN 10(client) and VLAN 20 (server) but no security profile set, no inspection and so one.Application running directly from the server generate reports in 1:30 min, the application running on the client generate raports in ~3min. (so issue is on network side) I have checked:- ping  from client to server, mostly 1ms, no packet lost-iperf from client to server, around 850Mbps-in whireshark is saw from time to time TCP reassembed from server to client - could be a reason ???-ping -f -l 1472 from client to serve is OK Something more to check ??maybe on switch side (switches are manageg by FGT) ??  Thank You     

We will replace FAZ 400E (7.4.1) by FAZ 810G (7.4.3) What s the best way to do it, if we want to migrate logs too, as we will have to shutdown the old FAZ 400E. For sure i think i will  have to upgrade 400E to 7.4.3 as 7.4.1 is not supported on 810G. Right ? We found these topicshttps://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-How-to-migrate-a-FortiAnalyzer-log-and-config-to-a/ta-p/196888 https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Using-exec-migrate-to-migrate-to-a-new/ta-p/193414 But during the migration, both FAZ will be available and joinable. -Does Log Aggregation permit to migrate all real time and old logs ?-Does Log Fetching permit to move all type of logs ?-Should i just exe backup/restore logs ?  What is the best way to do miragte completely all logs between both FAZ ?

Anyone know what might be causing this issue and how to correct? Within the web GUI, clicking on the >_ to open a CLI Console window, the window opens but immediatelydrops the connection with this message"Connection lost.  Press Enter to start a new session."Pressing Enter, I immediately receive the same message, pressing Enter again, repeat. Last week this worked without issues.Only change I made this week was an update to an existing security policy. Fortigate 201FFortiOS 7.0.1250% memory usage - 50% usage from initial startup.CPU usage less than 1% I checked on my other Fortigate firewalls (3) that haven't had any changes in multiple months and received the same failure. 

After an update to my Windows Server 2022, Fortinet Single Sing On Agent Configutation stopped retrieving Show Logon Users information, is there any way to find out how to solve this?

Hello Derasi am setup Virvual server on Fortgate fireall 201F to working on round robin methood but it seems that it is not doing load balance the session is kpet on one server rather than the others  any feedback ? Bests