Fortinet Community

Hi all ¡¡I want to configure 2 stand alone fortiswitches, forming an MCLAG with ICL. Afther that, I want to define 3 VLANS, each one with a layer 3 address. For example: 192.168.1.1/24 Vlan 1192.168.2.1/24 Vlan 2192.168.3.1/24 Vlan 3 The fortiswitch will be configured with default route 0.0.0.0 0.0.0.0 192.168.1.2 (firewall) connected to VLAN 1. Finally, I want these 3 Vlans can route traffic (using the static route configured) but , I don't want these 3 Vlans can route traffic between them witouth previously leave Fortiswitch. For example, we have a server1 connected to VLAN 1, with IP 192.168.1.200/24 and default gateway 192.168.1.1 that wants to connect with server2 192.168.3.200/24 connected to Vlan 3 with default gateway 192.168.3.1. The flow traffic that I'm looking for Layer 3 is:  SERVER1 --> FORTISWITCH --> ROUTER -->FORTISWITCH-->SERVER2 I have read about offload IP options, but Im not sure wether enable or disable it, the layer

hello Experts', We currently using forti-os 7.2.7 firmware version, ssl vpn client certificate authentication not happening Before we used 7.0.14 version ssl vpn client certificate auth worked as expected, after upgraded to 7.2.7 its not working  Any one faced this kind of issue.? share your thoughts on this issue 

 Hello Fortinet Community, My customer is transitioning from a Palo Alto firewall to a new FortiGate 401F, which is configured in policy mode. The existing Palo Alto firewall uses rules based on App-IDs, and the following App-IDs are in use:(adobe-creative-cloud-base; adobe-update; hp-update; ms-update; ms-update-optimization-p2p; windows-push-notifications; xbox-live)I've configured the FortiGate firewall with equivalent application filters to match these App-IDs from Palo Alto. My question is: will the application filtering rules on the FortiGate function properly without enabling deep inspection (Note:- existing Palo alto firewall is not using decryption (similar to Fortinet deep inspection )).? Thanks! 

Hi All !On my FG201F device dashboard, I see the status of "System DNS Servers" has unstable latency (sometimes very high). It seems to be affecting our network performance.Note: This device is running firmware "v7.4.5 build2702 (Mature)" with 4 Internet lines (divided into 3 SD-WAN groups), the system is also divided into VLANs.Could you please assist us in diagnosing this issue? Any guidance on potential configurations or troubleshooting steps would be greatly appreciated.Thank you for support.

I was working on a Dial Up VPN setup between 2 Fortigate firewalls, I wanted to test the automatic addition of routes from the phase 2 selectors, however, I haven't been able to make it work properly.On The Server FG besides defaults I set mode-cfg enable.On the Client FG besides defaults, I eet mode-cfg enable mode-cfg-allow-client-selector enable.VPN is up, the server FG automatically created a route as per its selector, however, client FF hasn't added any route.Could anyone clarify this for me? Thank you!

What is RVPN in FortiGate and uses? Why using?  How to create a RVPN? RVPN prerequisites? How to configure RVPN in FortiGate?

Hello,by accident I formatted  the firewall FortiGate 30E, and for sorry I don't have a business account to download the firmware.i need to boot the device to work on it for studying, so please any one can help me to download the firmware ?

Hi Forum,Hoping to get some technical help please. On my FGT-40F i have quite a lot of policies configured and i want to 'Change Security Profiles' but it is greyed out so now i have to edit each Firewall Policy individually. I should be able to select multiple Firewall Policies and then click on 'Change Security Profiles ' but something is causing that option to be greyed out so hoping anyone might have any idea why?

Hi All, General question about memory optimization and firmware. I have a 60E that does a lot of work and runs quite high in memory, and has recently started hitting mem conserve mode. I'm aware there are a few ways to bring the memory down, and I am exploring those, but what about firmware? Are there any memory efficiency gains from potentially updating firmware from 7.0.11 to another version? If so, would Fortinet be able to advise which version to try upgrading to? Cheers 

Hi, We have a simple architecture :- a wan int for incoming request to our servers with static nat- several int for internal servers and users ressources- a single default route for outgoing and reverse traffic- several static routes for different ressources and sites All goes well. We recently had to manage a new public range, with new internal servers. For different internal reasons, the two public wan have to be separated and using the same vdom. We dedicated a wan int to the new range. Default route is still on the old one.When we try to reach the new public int from outside, the famous "msg="reverse path check fail, drop"" raised. Doc : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Detailed-Guide-on-dual-WAN-setup-for-targeted/ta-p/276308 was very good information, but does it apply only for egress traffic, or is it for ingress traffic too ? In other words, we want to expose services on internet on two separates wan int on the same vdom. B

 Hello,I am experiencing issues when sending logs from a FortiGate 60E device running FortiOS v5.6.4 to a Logstash server using syslog over TCP. Upon inspecting the packets reaching the log server, I can see the traffic arriving correctly, but the logs contain messages like: 2024-10-03T18:06:49.773760+00:00 169.254.106.82 <greeting />#0152024-10-03T18:06:59.924314+00:00 169.254.106.82 <greeting />#0152024-10-03T18:07:10.093023+00:00 169.254.106.82 <greeting />#015 Instead of the complete data I need (ACK, hostnames, etc.).The same setup works fine on another FortiGate device sending logs via UDP, but in this case, I do not have the option to configure the transport mode as UDP on the Caseros device. I've tried different configurations, including adjusting the log severity and filters, but the issue persists.My questions are:Is it possible to configure logs to be sent correctly over TCP in this version of FortiOS?If not, is there a way to force the use o

Does fortinet allow rapid spanning tree protocol on fortigate and fortiswitch with the switch as the route bridge?

I've been having issues getting my AP to work while building my network. I have a Fortigate 40F connected to a Fortiswitch 108F connected to a a FortiAP 221E. The Fortigate is running 6.4.15 and the AP is running 6.0. The AP shows up in the Wifi/Switch controller > Managed FortiAPs and shows that it is online. Its broadcasting the SSID I setup, but when I connect to it, it shows connected with no wifi. It also has a VLAN with a manual IP config.I'm confused and need help, would anyone know why this would be doing this?Also does anyone know how to delete VLANS, its not giving me the option to delete them. I want to try and put them on the fortigate instead of the switch

I am accessing the site when I go to generate a file to download it does not download, would there be any way I can check and the domain is blocked, I did the release of the site, it was already F12 in Sources and nothing.

Hello there, I created a CLI template to generate CSRs on Fgt units as follows: execute vpn certificate local generate rsa $(y) 4096 10.$(y).0.1 DO STI STI TEST SEG b@domain.com IP:10.$(y).0.1,DNS:s$(y).x.org,DNS:s$(y).x.org x/app/cert/scep/ password Where $(y) is a meta variable for branch ids, but the result is error: "-999 - invalid value - syntax error". If i input the same script substituting the meta variable with the branch id directly on the units console it works just fine. Appreciate any help,BoddenBF.  

Hello,I’m experiencing an issue with my FortiAP after performing a reset, changing the password, and configuring a static IP address. When I connect or add the FortiAP to the FortiGate and try to log in to the FortiAP, the password I set no longer works.Additionally, I am unable to access the FortiAP via SSH because the password is being rejected.Could you please help me resolve this issue?Thank you in advance for your assistance.

Hi,the following setup is done: Site a: Fortigate 201F, running VLAN, with a transfer netSite b: Fortigare 401 F, running the same like above, between, 10 GBit Layer2 Link (600 km range, German network provider) Running iperf (Speedtest) site to site, we have around 1.38 GBits/second, this is awful. Running a download/upload test site 2 site, ends up in 200 - 220 mb/s. Running iperf from site to site without Fortigate, speed is about 9 Gbits/second, so, it is not a fault on the Layer2 connection. We did the same setup with a second 201F we have in stock, same problem, same speed.We tried with FortiOS 7.0.15, 7.4.4 and 7.2.8, same results. Because no filters are in place, I can just imagine, NAT rules (Nat pooling) is the problem maybe, because we need this to reach the networks, and this may harm the NGFW performance, which, if I read the datasheet correctly, is max. at around 3,5 GBit. Is the performance of the Fortigate 201F really so f***** slow?I

Hello everyone, I’m back with another issue related to FortiNAC... In the client's network infrastructure where FortiNAC is deployed, there is an Explicit Proxy configured on the FortiGate.If I disable the proxy on the test machine, the FortiNAC Captive Portal appears as expected. However, when the proxy is enabled, the traffic bypasses FortiNAC entirely, and I can browse the internet without being redirected to the Captive Portal. I’ve tried creating Proxy Policies to deny traffic from the isolation VLAN subnet, but this still bypasses the FortiNAC registration portal, and I receive an error indicating that internet access is blocked. Is it possible to forward traffic from the FortiGate proxy to FortiNAC? I couldn't find any reference to "proxy" in the allowaccess settings for FortiNAC's port2 interface.Thank you very much for your help!

Does anyone know of ruggedized APs that are rated for Zone1-Zone21 Occasional Danger Zone(Gas and Dust Accidents)?We use the ruggedized 234F but I dont see any rating for ATEX zones on it. Is there another model or is the 234F rated for ATEX zone-Occasional Danger

Get error "unable to provision token" when add Mobile token to new user. I can reach fqdn fortitokenmobile.fortinet.com and there is no intercept related to SSL (FortiGate). Also get:FTM provision error: problem with SSL comm layer: failed to recv response header: SSL communication layer errorThere is more then 200 available mobile tokens and all already provisioned tokens works. All worked befor upgrade to 6.2.2.    Best regards //Goran   

Hi all. Ive been setting up brand new Fortigate 100F.There is only one cable between them: HA port 1 to HA port 1. However it keep saying out of sync because of the table  ips.sensor.I have seen this before on 70F aswell. Im running v7.2.8 build1639 (Mature) I have tried to recalculate #diagnose sys ha checksum recalculate but no result.

Hi Guys,I have a question about Fortigate 6500F Clustering. Can I add 3 Unit of FG6500 to a same HA, FGCP, Cluster and then use Virtual Clustering to distribute traffic to all 3 units?Thanks

How am I able to access switches and https (faz..) through bookmark and i cannot access through vpn ssl I checked the policy and it's fine, but could be a proxy for whatever in the middle?

Hi, i have a small/big problem. We are using Fortigate 200E with Proxy Policy (web Proxy), and we have a problem with Cisco Webex, the Stream is not working and a Networktest from Cisco says that our UDP 5004 Port is blocked. The problem is, that in Services under Explicit Proxy only TCP avaible is and not UDP and Socks-UDP not working. We tested the stream with our WLAN, whitch working whithout Proxy and there is the stream working. How it's possible to actived or open the UDP Port under explicit proxy

I have FG61F, FSWicthes, and 4 FAAP's in the office when i move in the office to another location i will still be connected to the original AP which the signal in the new spot will become very low and it will take 4-5 mints to switch my connection to the closest FAP Can i control the switch time ? is there is parameter for that ? Thanks