Support Forum

Hi, Is there a chance to add a button, a kind of popup that appears in the window when a wifi certificate is about to expire? We currently receive them by email, but it would be much more efficient for us to have something like this integrated directly into the application. Thanks,Michael

Hi!whilst configured parameter of "Log Storage Policy" are seen using "diagnose log device", is there a CLI command to show "Actual Logs for X Days" I see in GUI?Also.. is there a command to show values seen "Analytics Storage Statistics" (when one clicks "Analytics Policy" and graphs in "Log Storage Policy" ?R's, Alex

I would like to create a interface that is all the IPsec tunnels for site-to-site VPN.  So instead of me needing 5 different policies that allow traffic between the main site and remote sites, I could just have 1 policy and the Source/Destination interface will be the group of tunnels. I would also need to make a IP group of remote IPs to use for the source/destination traffic, .  Main firewall is a 400E, remote sites are all 60F 

Hi, I have a Fortigate 60F with FortiOS v6.4.6 and I want to distribute a different range of IP addresses based on the switch port to which the client is connected. For that, I am using a 24-port Aruba 1930 SwitI have configured the VLAN on the Fortigate and activated the DHCP server on it. The server distributes the IP addresses in two ranges: 192.168.10.1 - 192.168.10.100 and 192.168.10.101 - 192.168.10.200.The VLAN is linked to the internal interface, and I have linked port 1 of the Fortigate to a trunked port on the switch.I want switch ports 1 to 12 to receive the first DHCP range and 13 to 20 to receive the other range. Is there a way to do this?Thanks in advance.

Hello Community, Is there a way to create a stitch to perform an action if an event is preset for an ammount of time?Example:A fortiswitch port is disconnected...then I can grab that event and create a stitch to notify vía email when this happens..But what if I want to send the email if the port is disconnected for 10 mins? not before, and of course if the port is connected before 10 mins then no action....is it possible? Thanks Andres

Hi,  We have several fortigate firewalls managed by a fortimanager machine.  We would like to add "local" active directory administrators to the fortigate machines , and for that , we configured the AD details + Users on the fortimanager.  The problem is that fortimanager will not push the AD & User configuration to the fortigate firewalls , if the users are not part of the policy.  Do we really need to create a bogus policy rule that will have the admin user AD group , only so the fortimanger will push the AD & user configuration to the firewalls ? What will happen if someone will remove the policy rule by mistake, we will loose the users configuration ?   I believe this is a bad design by fortigate that require policy statement to allow AD & User configuration to be pushed to the firewalls. Any way to work around this ?  Thanks, Guy

I am working on a proposal which includes the deployment of a FortiGate 90G, but the client wants to find out the Mean Time Between Failure Rates (MTBF). I have searched online but cannot seem to find this info anywhere.

This may seem like a silly question... but which file should I download to update my fortimail VM in wmare? When I go to the Fortinet support site, several images appear.   

Hello everyone, My users are having problems with the Wi-Fi network, in some areas of the 3rd floor several laptops do not connect to the FortiAP431 that is placed near the ceiling, these laptops connect to another FortiAP that is on the floor above, each floor has 3 meters high. So at some point they disconnect from Wi-Fi and take a while to reconnect to the nearest FortiAP. In the FortiAP profile I have configured the auto transmission power mode in the 5GHz band with values ​​of 10 - 18 dBm and in the 2.4GHz band: 4 - 9 dBm. Any ideas to connect the laptops to the FortiAP on their floor so they can't connect to another AP on another floor.Thanks for your comments, John P.

HelloI'm facing a problem regarding uninstalling FortiClient to install a different version.I'm on Linux (Kubuntu 19.10). When I try to uninstall FortiClient ( sudo apt-get purge forticlient or sudo apt-get remove forticlient ) I can't because "Unable to uninstall forticlient while connected to EMS". But when I try to disconnect from EMS ( sudo /opt/forticlient/epctrl -u ) it asks me for a "deregistration password". It's the same when I try to disconnect it from the GUI:However, I don't have this password. I found a link about a "password recovery tool", but it is for Windows, and I don't have any program like that in the /opt/forticlient folderhttps://docs.fortinet.com/document/forticlient/7.2.4/ems-administration-guide/543835/using-the-passwordrecovery-toolFor what I remember, I installed my version of FortiClient from the company I formerly worked with (to access their VPN), so maybe it was a different version than the free one where I can have full control of the pro

I'm facing an issue with Fortigate receiving BGP routes from the IPVPN router but the routes are not showing in the routing table please refer to the below topology and show commands from FW-BR02 firewall and IPVPN Cisco router  IPVPN Cisco Router:IPVPN#sh run | sec bgrouter bgp 65000bgp log-neighbor-changesnetwork 10.10.59.144 mask 255.255.255.252network 10.10.63.100 mask 255.255.255.252neighbor 10.10.59.146 remote-as 65272neighbor 10.10.63.102 remote-as 65272IPVPN#show ip bgp summaryBGP router identifier 10.10.63.101, local AS number 65000BGP table version is 5, main routing table version 54 network entries using 576 bytes of memory6 path entries using 504 bytes of memory2/2 BGP path/bestpath attribute entries using 320 bytes of memory1 BGP AS-PATH entries using 24 bytes of memory0 BGP route-map cache entries using 0 bytes of memory0 BGP filter-list cache entries using 0 bytes of memoryBGP using 1424 total bytes of memoryBGP activity 4/0 prefixes, 6/0 paths, scan interval 6

We recently installed an 80F and we are now having issues with our ERP being able to connect to FTP sites of our vendors to upload order data. Previously on our old network based firewall, we didn't have these issues. It appears that an active session is being created with the FTP site. I can connect to the FTP site from our ERP manually but once I'm connected and I try to run any commands, I receive a 500 illegal port message and then a 425 use PORT or PASV first message. If I enter pass then it shows passive mode as being on and I can execute commands successfully. The problem is that once this connection is ended and we try again, we are back to the same issues. Our vendor who is responsible for this firewall is running into a wall on what to do so I'm hoping someone may have some ideas on what we need to do to resolve this. This ERP server has a public IP so traffic from the internet to it comes directly to the firewall. When traffic is going out from it, it goes from the firewall

Hi, Is there a possibility to send Forticlient logs mostly security and system events that are fetched by FortiEMS to a third party SIEM.Right now, the only option I see is to send FortiEMS Event logs to Syslog. We dont have the SIEM on a public IP and thus require FortiEMS to be the mediator as it already collects these logs for its dashboard.

Good Evening,   Currently the fortisase vpn has been implemented, however it is observed that the response times are high for both navigation and the internal network. Although the average time for browsing is 80 to 100ms, the response time for internal servers ranges between 180ms to 230ms, which generates slowness. Can these values ​​be optimized? Please note that for internal services there is a tunnel between a fortigate and the sase cloud which uses a SPA license. Thank you very much, I remain attentive.

Still learning all of particulars about this product. My inquiry is about the Policy ID when viewing the log details of a message. I have had to sort through the message log chain on several occasions now and am trying to discern the Policy ID it reports and trying not to assume the logic that makes sense to me. So if my log detail reports the Policy ID of 3:1:1:SYSTEM, does this mean it processed through Access Control ID3, then IP Policy ID1, then Recipient Policy ID1 with the default system domain? Or did I completely butcher that logic...lol Thanks. 

HI All,  Would like to help about the SDWAN interface path selection. I did some testing in the lab. I found out Tunnel traffic is not outgoing like what we set in outgoing interface selection strategy manual. From the routing table, we see the tunnel Is outgoing via VPN2, which is not match the setting in SDWAN rules outgoing interface selection strategy. In  outgoing interface selection strategy, we did select VPN1 as priority and second is VPN2, Also the SDWAN GUI is showing  VPN1 been selected is the 1st path to outgoing” However, when I run traceroute and sniffed packet, found the outgoing path is VPN2 instead. May I know would it a bug or something else cause it? In the OSPF routing, we did check the priority is same for both tunnel. So we really have no idea which part cause the wrong outgoing path. 

Hi,thanks for your consistent support.we are an international company with a site in China and another site in Sweden, now we are using fortigate SD-WAN solution. Two underlay interfaces, one is from public internet, the other one is from Orange MPLS.we created two tunnel separately from Internet and MPLS as the overlay encapluation tunnel. We use Lowest Cost(SLA) as the outgoing interface selection rule from both site A and site B as the SD-WAN rule. We trust MPLS better so we set the lowest cost for MPLS-based tunnel. What is strange:When we tracert a host IP in site A from a host in Site B, it shows 192.168.2.2, the Inernet -based tunnel interface on site A. But the SD-WAN rule is showing that MPLS-based tunnel is the selected outgoing interface on fortigate of Site B. And FortiAnalyzer is showing that MPLS-based interface is the outgoing interface for that tracert traffic.We asked Orange to check it, and they found a command "set priority-members " should execute to change the

I have a FortiGate SDWAN rule configured to select the outgoing WAN interface by Best Quality as the result of Performance SLA measurements. What happens if bandwidth of the selected outgoing WAN interface is saturated? Does excess traffic begin to use the next most preferred outgoing WAN interface from the Best Quality Performance SLA measurement results?Or will the WAN interface with Best Quality from Performance SLA measurement results continue to be used?

Hello guys, I am new to Fortinet. I downloaded a FortiGate image, version 7.4.4 for KVM and uploaded it into EVE-NG. In the WebUI, the license that comes with it allows only 3 physical interfaces to be configured. So my question is, can I use the fortilink aggregate interface and set it as a normal physical interface (LAN or WAN), in essence becoming a fourth interface? Cheers, Vladimir

Hello everybody,I'm working on a Fortigate 60E (FortiOS 7.2.8).My pc is on an isolated network (i'm the only host) and there is only one simple rule: As you can see, the security profile is very simple, it has a DLP configured with a profile that only intercepts the credit cards' informations. The dictionary is the default c redit card type, while the sensor is configured to any message or file regarding every protocol:   The problem is that for some reason, sites like facebook.com are blocked by the same policy.   date=2024-06-19 time=17:57:53 id=7382244222788698112 itime="2024-06-19 17:57:54" euid=1026 epid=1030 dsteuid=3 dstepid=101 logflag=3 logver=702081639 type="traffic" subtype="forward" level="notice" action="close" utmaction="block" policyid=19 sessionid=796241 srcip=10.1.20.4 dstip=157.240.203.35 transip=192.168.1.4 srcport=64759 dstport=443 transport=64759 trandisp="snat" duration=1 proto=6 sentbyte=1886 rcvdbyte=1565 sentpkt=14 rcvdpkt=14 logid=000000001

Hello, we have next type of configuration. A Fortigate device with two static routes, say Static_1 and Static_2 and OSPF configuration. This two routes are redistributed into OSPF process. Also we have two different vpn tunnels to our partners. These two tunnels are in different areas, say area 15 and 16.For now both redistributed routes are sent to both our partners through OSPF process.But we need to make some filtering, say Staic_1 send to Parner_1 only and Static_2 send to Partner_2 only. How could we accomplish this?

I just created my vm and I set the static port to port1, when I make these changes and save the static ip, i lose connection, I've done the following from the cli: config syst int > edit port1 > set mode static > set ip 10.76.2.21 255.255.255.0 > set allowaccess https ping ssh i can see the ip is set now but i lose internet connectivity. Any suggestions? I have a ticket open with tac but haven't got anywhere with them.

Hello everybody, I've a simple question. Recently I've been working on a Fortigate 60E. On this device, I'm trying to set DLP. My question is:Is the DLP security profile able to inspect the email from client such as Gmail, Outlook (desktop client) etc.?If I've a credit card number inside the text of the email (or inside the attached file in the mail) is the DLP able to stop the mail? Or do I need FortiMail to achieve this scope?I'm working with FortiOS 7.2.8.Thank you!

Hey all, hoping someone will be able to help with this one as I am stuck and spent ages looking around online for help and not getting anywhere.So we have a small remote office with a single FortiGate 60F and a single 231F AP, its running with all its ports in a VLAN software switch and internal port 1 goes through a POE injector to the AP, simple as it gets.The internal LAN is set as VLAN 0 and we run a Enterprise SSID with Radius etc which is all working fine (Bridge mode), now we wanted to add a Guest SSID so first of all created a Guest VLAN with VLAN ID 25 as below, its set to run a DHCP server and just use 1.1.1.1 and 8.8.8.8 for its DNS (Not using the system DNS) New Guest SSID created (also bridge mode), VLAN 25 is specified in its config and a Firewall rule created to allow it out from Source 'Guest-VLAN' to Destination 'All'Now when someone connects to this guest SSID we can see its dishing out an IP address and can see some traffic activity from users phone but users ge

After replacing our Fortigates 100E with Fortigate 60F the DNS settings on our Ubuntu/Xubuntu workplaces no longers works. Windows PC's in the same VLAN have no issues with DNS. When trying to ping form Ubuntu:ping: adc001: Temporary failure in name resolution. I have tried on multiple existing pc's but I have also installed new Ubuntu and then the same issue is there. What