Support Forum

Hi, maybe we missed something and this feature was removed but I would like to see local reports and before I had like 7 versions on the memory (in Log Settings > Local Logs it is activated) and I dont see anything else. Also on Forticloud we had like 7 days some reports. Is it possible that there is no option anymore without another licence? Thanks,Roland

I've question about FortiMail Cloud Premium license.  If I want use MIP/AIP Labeling for applying DLP policy on FortiMail. Can I use this technical for apply on FortiMail?Detecting Microsoft Information Protectio... - Fortinet Community Thanks

Hi!I'm trying to understand the relationship between periods specified in "System Settings" -> Storage Info: Data Policy : Keep Logs for Archive"... and "System Settings" -> "Advanced" -> "File Management" : Automatically Delete : "Device log files older than" because they both seem to dictate how long the Archive Logs are retained before deletion.Are they related? If so, who has higher priority; otherwise, If not related, how are they different?R's, Alex   

Hello all.Need help with broadcat to Chromecast not working correctly. It all worked well till one day, it simply stopped. I can still find those on the same VLAN so broadcast is ok on the same VLAN (with this i excluded any potential problem with my Unifi and Aruba AP structure since traffic inside them is fine). I can't find any Chromecast on different vlan but when i joint that network and do not close my Google Chrome it stays discovered and castable even when i join on other vlan. Now to the configuration, 90% off my vlans are on the same zone, intra-zone traffic is enabled, policies from and to the same zone are fully allowed (all to all). Multicast routing is enabled (with this i assume that it should route regardlles of multicast policies since even with all all on Multicast-policy there is no hit on any rule).I tried to disable multicast routing once and it started to find every chromecast anywhere but i immediately noticed DHCP problems. I don't remember if my rule was a

Hi All, I found that there is minimum privilege AD user account for MSCHAP2/PEAP authentication from Fortinet guide (Create All Child Objects, Write All Properties, and Change password under Computer Objects). But I would like to know why these permissions are needed in order to complete the authentication process? Link: LDAP | FortiAuthenticator 6.6.1 | Fortinet Document Library FortiAuthenticator 

Hi experts, I want to ask when we choose sdwan rules ->  outgoing interface -> manual : Port 1 (isp 1)Port 2 (isp 2) The port 1 will be primary right, all traffict will be through this, and port 2 will be standby/secondary.My question is what is down criteria of port 1 so the port 2 can take over?Let's say the topology is : Forti - internet switch - ISP 1 modem - hop 1- hop 2 - google dns If the google dns down on ISP 1 does the failover to ISP 2 happened? remembering port 1 is not realy down because connection between forti to internet switch not down. And if the ISP 1 modem (ISP GW) down, does the failover to ISP 2 happened? remembering port 1 is not realy down because connection between forti to internet switch not down. 

The user name (ID) is not automatically saved during VPN login after the recent Forticlient vpn application update.(The password is automatically saved.)There is a hassle of having to type your ID daily when using it in the field.Before the update, there was no problem with the auto-completion function. Please check it.

Hi Fortinet Community! I have a question that I’m having trouble answering despite going through the training, documentation, and searching online. We recently purchased a FortiSwitch 148F-FPOE with a FortiLAN Cloud management license.The switch has been adopted and deployed to the new network, it pulled an IP address from DHCP, and everything looks good connectivity-wise. I need to assign a static IP address to the switch within a management network, which does not have DHCP. Does this need to be done via the command line? I found an area to set a static IP (physical interface configuration), but I do not see any place to set the gateway. The switch will not be doing any routing, so my idea was to untag the switch uplink on the management VLAN and set a static IP/gateway (or set a static IP/GW on the VSI internal interface) and tag (allow) other VLANs.Any advice would be greatly appreciated. #FortiSwitch#FortiLAN#FortiCloud Thank you! 

HiI have a issue I hope someone here can assist me with! My customer uses FortiClientVPN on +40 Windows clients, using SSO/SAML to connect to a FortiGate 1500D through O365 Azure - and it works flawlessly. 1500D firmware is v6.4.7,build1911,210825 (GA). The customer has a number of Apple iPads, where I have been trying to get the FortiClient VPN app to work. But when connecting the logon page to O365 is just blank, it never loads the webpage. The settings are exactly the same as the Windows clients. I have tried with iOS devices that run version 15.2.1 and 12.5.5. There result is also the same if I use a trial for the "FortiClient" paid app. I thought maybe it's a browser issue, so I tried changing the default browser on the iOS devices to both Chrome and Firefox, but nothing changed. I'm not sure if the FortiVPN app even registers the change. See the screenshot below showing what I mean with the "blank page". Please advise - and thanks in advance! :)&nbsp

Hi Guys,  I am grateful for this community, some great teachers here, I am learning alot about Fortimail and have done some good work so far. I have now fully integrated my fortimail in the DMZ, the fortigate fwl, getting smtp traffic, inspection of smtp traffic actually WORKING, thank God. However, one problem lol. ALOT of false positives and people are squealing. I used the full inspection rules instructed by guide below - antispam, antivirus, content etc and I tell you mails are being inspected hard.https://ebin.pub/fortinet-fortimail-lab-guide-for-fortimail-72.html Can anyone here post me a good setup for traffic inspection (not so robust/sensitive)? I am currently using the recipient policy as that is what was selected by my team. I was the one that configured the fortimail from scratch and deployed it(with the help/knowledge of you guys of course).

I have a Fortigate 100F. I have aggregated four Physical ports, 1-4, into a VLAN Switch interface. I have set the 'Role' of the VLAN Switch interface to LAN, set the 'VLAN ID' of the VLAN Switch to 10, and I have assigned an IP address and subnet mask to the VLAN Switch interface. I then created 4 VLAN type subinterfaces on the VLAN Switch interface, VLAN ID: 20,30,40,50, all with non-overlaping IP addresses\netmask. The mental model I have in my head about how a VLAN Switch in FortiGate works is that it operates like a trunk link, transporting traffic tagged with multiple vlans, as well as untagged traffic (native vlan traffic), to other VLAN aware Layer 2 devices, such as Managed switches, with the added benefit of link redundancy because a VLAN Switch interface is formed from multiple physical ports. What I wanted to create was a "firewall-on-a-stick" setup where the end devices in the various vlans (10-50) connect to a managed Aruba 2930F switch which trunks over (via mul

Hi all! Currently I am configuring a L2TP over IPSEC through Radius with a NPS server.I've configured the L2TP on the Fortigate with the wizard, this is quite simple.For testing I created 2 L2TP configuration because of the different networks available to connect with as a user.This is a L2TP configuration for a native Windows client. Tunnel:-Remote Access - Windows Native-Incoming interface - WAN-Preshared key: ****-User Group - the VPN Radius Group that should match-Local interface - the interface that matches the destination group-Local address - the address object that matches the destination group-Client address range - a fictive range I made up 10.10.44.100-10.10.44.200 When connecting from a Windows client, it stops with error code: 691 (remote connection denied username..)But checking the NPS logs, it shows MS-CHAPv2 was successful.The logs matches the exact group that belongs to the user and I see traffic on the policies. So this should be good to go. But s

Use forticlient 7.4 ZTNA licensed via EMS cloud and 7.4 VPN free version with ssl vpnThe connection got stuck with the message connecting.In the fortigate no SSL VPN connection is incomming at that moment.Started today after running windows update last night. Solution?? 

Hi i am using the APIhttps://www.forticloud.com/forticloudapi/v1/fgt/xxxx/api/v2/log/disk/webfilterresponse like{'http_method': 'GET', 'status': 'error', 'http_status': 404, 'vdom': 'root', 'path': 'disk', 'name': 'webfilter', 'action': '', 'serial': 'xxxxx', 'version': 'v7.0.14', 'build': 601}why it happen?

Unauthenticated userHow do you display unauthenticated users in the "Forward Traffic" Logs? Set the Active Directory Connector in "External Connector" and it works perfectly. but none of the users are shown except one with pink color (un-authenticated user) how can I get the remaining users and why this user only is showing? 

I'm setting up PRTG to monitor my network, I'm looking for the OIDs for the FortiAP431F to monitor CPU load and memory util. I saw another post on which a user gave a base OID(1.3.6.1.4.1.12356.101.14.4.4.1.20 for CPU load or 1.3.6.1.4.1.12356.101.14.4.4.1.21 for memory util)  to which I should add on 1.16.(Serial Number in ASCII decimal values). This doesn't work, I was wondering if anyone else has had similar issues and figured out either how to make those work or the correct OIDs? My AP is using os version 7.2.5

if not using DDNS, how can dial up be configured to set up site to site VPN? one side is fixed IP and another side is DHCP or PPPoe how

Hi all, I am unable to activate my Forti VM: FortiFirewall-VM64 # execute vm-license-options account-id enrico.thau@siemens-energy.comFortiFirewall-VM64 # execute vm-license-options account-password xxxxFortiFirewall-VM64 # execute vm-licenseThis VM is using the evaluation license. This license does not expire.Limitations of the Evaluation VM license include:1.Support for low encryption operation only2.Maximum of 1 CPU and 2GiB of memory3.Maximum of three interfaces, firewall policies, and routes each4.No FortiCare SupportThis operation will reboot the system !Do you want to continue? (y/n)yFailed to download VM license. But Internet connections is ok:FortiFirewall-VM64 # execute ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytes64 bytes from 8.8.8.8: icmp_seq=0 ttl=128 time=47.4 ms64 bytes from 8.8.8.8: icmp_seq=1 ttl=128 time=46.8 ms^C--- 8.8.8.8 ping statistics ---2 packets transmitted, 2 packets received, 0% packet lossround-trip min/avg/max = 46.8/47.1/47.4 msFortiFi

Dear All, Does someone have any idea to transfer license in RMA device from faulty device. Since, Secondary device has been faulty during upgradation firmware upgradation, That's the reason I have to transfer license of Faulty device to new RMA  device. Thanks  

#FortiGateIf I want to perform a TCPing test on FortiGate, is there a way to do it?

Hello team, I could see that we can enable video codecs on a SIP profiles to enable the video call feature on FortiFone soft client.My question is, do this also apply to third party SIP phone that support the same video codecs supported by FortiVoice system ? Configuring FortiFone softclient settings | FortiFone 1.0.0 | Fortinet Document Library Also, I have read somewhere (I cannot recall now) that video calls are only supported between two end points (not conferencing). Does anyone confirm this info? and would for example the "unified communications" license be required for video calls/conferencing?  

Hi, I'm looking to upgrade my firewall and am considering the 60F model. Is this a good choice?Additionally, I would like to know if this firewall can perform the following tasks: Allowing or blocking specific URLs or IP addresses, is this possible with firewall. Assigning these permissions to specific LAN IP addresses to control who can and can't access certain websites. Also I'm getting a 2gig fiber and not sure if this firewall will allow me to access that type of speed. Also, I'm not looking to break the bank, but not looking to get anything that isn't worth getting. If you may have a recommendation of another firewall, please provide me that.  Thank you in advance everything that provides me any inputs.   

Dear All I have a Fortigate with around 20 interfaces. I would like to set up a live alert if more than 1GB of traffic is sent from an interface to the WAN within one hour, e.g., FTP upload, SharePoint upload, or similar. This is to detect when data is being extracted/uploaded.I have the firewall managed in Fortimanager/Fortianalyzer. However, I cannot find a suitable alert/configuration to achieve this. Does anyone have a guide or a tip? Greetings

HelloMy Product is Fortigate,   I can't access GUI management page although i have add my ip as a trusted host in Dedicated Management Port. but the point is i can ping success and can ssh with no problem. so what is going on?thanks for everyone's answers.

We upgraded our cluster from 7.0.12 to 7.0.14 due to critical vulnerability.Now we have the issue that mobile devices (Android) cannot connect to the VPN anymore. We end up getting the error: "Cloud not retrieve auth ID" and the redirect is not working properly.And it seems we are not the only one: FortiClient VPN SSLVPN on Android no longer working : r/fortinet (reddit.com) Anyone else with the same issue?Is there already a fix for this problem?