Support Forum

Dears, Kindly need your support as i have a new ZTNA deployment on Nutanix VM server. But i see no guidlines how to start my deployment. Should be KVM? OVA? or what. Thanks

After updating some firewalls to FortiOS 7.4.4 I am no longer able to log onto them using LDAP authentication. Local accounts are not affected. I have tested my credentials on the LDAP server screen and confirmed that I can authenticate, so this looks like a bug in 7.4.4. Anyone else experiencing this issue?

Hello AllWe have a new deployment and have created TACACS+ servers and Group  When I try and push, it doesnt say theres a change pending, doesnt even detect a change.  The TACACS are referenced to a group and an account too that Ive created. Is there a way to force these changes to be deployed? 

Dear forum-members, our virtual infra-structure was renewed from VMWare to Nutanix Prism. We are actually moving the machine from the old to the new environment. To migrate the Linux server my colleagues  use a migration assistant, this assistant logs on to the Linux Server with root credentials,  uninstalls the vmware-tools, adds some drivers and installs prism-tools. After that the machine is copied and can be started. This is running fine so far.  In the near future we need to migrate our Forti-Peoducts: one FortiADC-cluster (2 nodes AP), one FortiManager and one FortiAnalyzer.  I understand that is not possible to get root access to these machines for the migration assistant. Are there migration parts for the products ? Or do I need to install new machines on the Nutanix and backup and restore the data?  For vmware I installed OVAs - is there a Nutanix Prism equivalent to download for this environment? Best regards,Volker

Hello everybody!Has anyone already done this? I need to monitor the expiration date on CA and local certificates in Zabbix, but this information isn't available via SNMP. I’m trying to retrieve it through the API, but it doesn’t work either.Has anyone faced this issue?

I'm having an odd situation were we're getting DDoS'd with UDP floods, only during the school day. It hasn't been enough to take us down, but was enough to get the attention of our ISP and show up in our FortiGate. The ISP couldn't seem to provide much info about why this was happening, but they seem to think it's "excessive VPN use" by our students. I've done a lot of digging through our FortiAnalyzer and really can't see much out of the ordinary other than the incoming flood that is being dropped. Any thoughts about what might trigger this or where else to look?

Using Fortimanager, what would be the best way to replace a managed Fortigate with another model (60G to 70G) which would cause the least amount of downtime?

Hello,I am looking for FortiClient VPN version 7.0.8.0427.Can someone please help me with the information about where I can get the software.Thanks in advance  

Hi community, I am trying to figure out what is causing these weird symbols showing here. Any way to fix this?

 We are currently experiencing an “Invalid LDAP Server” error while trying to browse LDAP users on our FortiGate.Fortinet Support has confirmed that this is a known bug and the case has been escalated to the Development Team. However, there is no confirmed timeline or ETA for the fix, and no hotfix is currently available. Before waiting for the official fix, I would like to check:Has anyone else faced this issue?Were you able to find any temporary workaround?Did upgrading/downgrading firmware resolve it?Any CLI workaround or configuration adjustment that helped? Environment details:FortiGate model: 601FFirmware version: 7.4.9LDAP type: Active DirectoryError occurs while browsing users from GUIAny suggestions or shared experience would be greatly appreciated.Thanks in advance.

We have a FortiGate FGT60E 7.4.11 build2878 controlling three FortiAP’s FP221E 7.2-build 0337. Two of the three AP’s appear to be working fine. One of the AP’s seems to always have 0 Clients. This AP's Last Failure Reason is: 80211 WLAN ADD error. This AP also has other errors including:oper-txpowerconfig-txpowerPhysical AP joinPhysical AP radio operation countryI ran the following but the name is blank and no country is listed:get wireless-controller globalname :location :acd-process-count : 0wpad-process-count : 0image-download : enablerolling-wtp-upgrade : disablerolling-wtp-upgrade-threshold: -80max-retransmit : 3control-message-offload: ebp-frame aeroscout-tag ap-list sta-list sta-cap-list stats aeroscout-mu sta-health spectral-analysisdata-ethernet-II : enablelink-aggregation : disablemesh-eth-type : 8755fiapp-eth-type : 5252discovery-mc-addr : 224.0.1.140max-clients : 0rogue-scan-mac-adjacency: 7ipsec-base-ip : 169.254.0.1wtp-share : disabletunnel-mode : compatiblenac-interval :

I'm working on merging Root from my 100F firewall into a third VDOM on my 3400E firewall. That new VDOM will maintain its own peering connection that it had on the 100F. When I log into the 3400 Global, I see that the "System WAN" is X.X.X.X/31. I don't want the new VDOM routing through that due to necessary network segmentation because of contract requirements and such, so I would like some guidance on how to proceed with the configurations. 

Two to three months ago, we migrated to the EMS FortiClient VMware appliance 7.4.4.We are a Windows store, so Linux knowledge is minimal.Now we want to upgrade to EMS 7.4.5 because of some bug fixes and the database backup feature.Is the recommended upgrade method to download a new VM image and perform the necessary actions as described in the article below?https://community.fortinet.com/t5/FortiClient/Technical-Tip-Recommended-method-for-upgrading-to-FortiClient/ta-p/423615Do I have to ignore the upgrade option/alert below via the GUI?Automatically upgrading EMS to latest patch release | FortiClient 7.4.5 | Fortinet Document LibraryThanks

Hi everyone,I’m trying to configure FortiAnalyzer so that I receive instant email alerts whenever any Intrusion Prevention (IPS) log is generated from my FortiGate devices. Kindly advice how to configure   

Hi everyone,while creating a profile for a FEX device, i'm unable to add a new meber of type VAP in the Switch Interface. the VAP list is empty, even if the SSID i've created isn't in bridge mode. Accessing the web interface of the FEX it allows me to add a VAP port with the SSID, but i need a massive/remote deploy without accessing every single FEX.Someone know ho to solve this? 

Hello everyone,  I was creating MCLAG peer group with 2x FGT120G (which are in active passive HA) and 2x FSW424E. I was doing this for two different clusters. In first one everything seems to be in order but on the other one port is missing when I check the topology in Switch Controller menu on FGT. The config is identical for both. I have fortilink interface with x1 and x2 as members. FGT1 - x1 -> port25 on SW1 and x2 -> port25 on SW2FGT2 - x1 -> port26 on SW2 and x2 -> port26 on SW1As I was creating the stack i only connected ports from FGT1 which was active to switches (first SW1 then SW2), after authorization I followed the guide and made the mclag peer group between the switches with ports23 and 24. After this was established I connected ports from the passive member (x1 to port26 on SW2 and x2 to port26 on SW1) but it did not appear in the topology? Is there way I can force some sort of LACP renegotiation or something? Restart of the switches did n

Is there a way to restrict LDAP authentication to FreeIPA based on ldap user group membership? Currently configured, as suggested in forum, with set cnid uidset dn "cn=accounts,dc=<suffix>,dc=<suffix> However this setup allows ANY ldap user to be successfully authenticated. I can't figure out a way to restrict it to only a specific ldap group in FreeIPA. Suspecting it has to do with one of setting either of the config option group-member-check, group-search-base and group-filter. Any help will be greatly appreciated!

Hello everyone, While reading this article "FortiSwitch FortiLink Integration" and to be more specific, the RADIUS/syslog/L2 MAC traps config, there is always a note saying to skip the step if you configured one of the three. I do understand that L2 MAC traps is the most recommended, but I wanna know why can't we use two together, is it to optimise performances ? Thanks in advance.BR,

Hi everyone. I'm a network engineering trainee. I previously worked with Fortigate devices for about a year, but I took a break. Now I'm starting a new project and will begin working on it. I'd like to hear about your experiences. Are there any YouTube channels or resources you can recommend? My goal is to refresh my knowledge and obtain the NSE4 certification within 3-6 months.

Hello everyone,  I'm trying to integrate FortiNAC with FortiMail. I managed to get it working after making some tweaks in FortiMail policilies, but I want to confirm something. In the Authentication section, which mailbox should be used? Should I create a dedicated mailbox in FortiMail for FortiNAC and use it for authentication there?  Thanks in advance.BR,

The customer stores .sqlaudit logs on the C:\ drive of a Windows machine where the Windows Agent is installed. Multiple log files are continuously updated, and once a file reaches its size threshold, a new .sqlaudit file is created.The customer wants to collect logs from all generated files, including their contents. They attempted to use Windows Agent Template → User Log, but the logs are not being fetched.Could someone please assist with this issue?

I ran into an issue here: I have a zone with several members.Now I need multicast forwarding for airprint between two members of that zone.intra-zone-traffic is blocked (per default) which is wanted that way.So any traffic has to be explicitely allowed by a policy. Now I cannot create a multicast policy for that because of the zone. In multicast policy only the zone is available  not its members. So even mlticast policies from interfaces that are not member of the zone can only have the zone as source or destination interface. I consider this a security risk. Does anyone have some tip how one can do intra-zone multicast forwarding then?I additionaly have openend a ticket with TAC on this too

I would like to independent IP addresses on my  "mgmt" interfaces in my cluster Active-Passive. Every time I configure an IP on one cluster "mgmt" interface, then the Passive unit inherits this IP addresses which is what I do not want. My aim is to have dedicated IP addresses for "mgmt" on each cluster and use port2 (mgmt) as the mgmt interfaces with the same IP address. How can I remove/unset a vdom from "mgmt" (unset vdom root)I have  been looking for dependencies to delete and have run out of ideas! Removed dedicated mgmt cmd, under config sys global removed unset mgmt-vdom which I don't think was going to help.Deleted config firewall address dependency as well. Thanks!

Hello All!On my FG 90 strange issue - after restart on some interfaces traffic partially dropped.For example - from my computer (VLAN 10) I am trying to ping server located in VLAN 22: C:\Windows\System32>ping 192.168.22.1Pinging 192.168.22.1 with 32 bytes of data:Reply from 192.168.22.1: bytes=32 time<1ms TTL=63Reply from 192.168.22.1: bytes=32 time=1ms TTL=63Request timed out.Request timed out.Ping statistics for 192.168.22.1:Packets: Sent = 4, Received = 2, Lost = 2 (50% loss),Approximate round trip times in milli-seconds:Minimum = 0ms, Maximum = 1ms, Average = 0ms In previous firmware one more restart was solve it. But after upgrade to 7.4.11 even after restart the issue stil exists on few interfaces. Here is an output of sniffer:diag sniffer packet any 'host 192.168.22.1 and host 192.168.10.51' 1 100interfaces=[any]filters=[host 192.168.22.1 and host 192.168.10.51]6.892452 192.168.10.51 -> 192.168.22.1: icmp: echo request6.892478 192.168.10.51 -> 192.168

In Load-balancer mode deployment, what happens if primary fac goes down? for an example , I have cluster(A-P) as a primary at HQ and load-balancer at two different geo location.what happens if my primary HQ is down? can load-balancer take over authentication function.if so which will be active.