Fortinet Community

Hi All,             I have a question, if i create below local in policy, will it restrict our user to connect VPN from remote network or any internet impact ? this policy is only prevent internet traffic from being able to get to your management services, correct ? Thanks  > config firewall local-in-policy> edit 100> set intf “wan1”> set srcaddr “all”> set dstaddr “all”> set service “ALL”> set schedule “always”> set action deny> next> end Piaakit  

Hello, I am implementing a scenario in which I have branches connected to the headquarters through IPSec tunnels. In my environment, I need to direct all traffic originating from the branch's local network through the IPsec tunnel so that this traffic destined for the internet uses the headquarters' WAN. For other services at the branch, I need to use the local WAN link. For example, branch office ether1, network 192.168.56.0/24, all traffic must be routed through the IPsec tunnel. As for ether2, network 172.16.56.0/24, traffic must be directed through the local WAN. I already have this working environment, I am using IPsec SDWAN to close the tunnels, make them redundant across different WANs and my question/problem is the following. For traffic originating from the branch network, 192.168.56.0/24 and destined for the internet to work, I must have a static default route created in the headquarters firewall, with gateway to the WAN 10.100.100.2, withou

Hello everybodyHow can i route youtube traffic only to the backup isp via fortigate.

  Hello, I am implementing a scenario where I will have a headquarters and several branches, connected through IPSec tunnels. In the headquarters firewall I will have a fixed public IP address and in the branches I will have internet links with dynamic IP addresses (CGNAT and LTE/4G). I need to connect two IPsec tunnels per branch with the headquarters, one tunnel for each WAN and I need to use SDWAN to control this traffic and define the SLA for each tunnel. I already have this working format using IPsec SDWAN, where I create 1 tunnel for each link.However, at headquarters, I only have one WAN interface and I use it in all tunnels with branches. Could this cause me some kind of problem? I've already noticed that when I make a change on the matrix side in a tunnel, it momentarily "drops" the connection in the other tunnels.What is correct on the head office side, considering that I only have 1 WAN interface, is to have 1 tunnel for each branch? Today

Hello! I'm setting up override on my cluster and I saw this article: Primary unit selection with override enabled | FortiGate / FortiOS 6.0.0 | Fortinet Document Library It says that we lose configuration changes if the primary goes down, we do changes on secondary (that is going to be temporarily primary), primary comes back up, negociates to get his primary status back and overwrite the changes made on the secondary (who lost his temporary primary status). By using the setting that the end of the article: set override-wait-timeCan we avoid losing configuration changes if the override-wait-time is long enough?Does the secondary will have time to overwrite the primary configuration before primary negociates to get his status back? I know that setting is there to smoothen the transition, but was wondering if it could have that nice side effect. Thanks!Konnan

Is it possible to define/create DHCP6 address reservations on a Fortigate (v7.4.4)?

Hello Community, I'm reaching you for a weird issue we are experiencing at the moment. We're running a cluster of 100EF with FortiSwitches and FortiAP. Access to the Corp network has to be authenticated via Radius. I'm having an issue with some laptops (different models, OS (10/11), network card) I can't tackle the source issue. So a random group of laptops have this issue when they're connected over cable/Wifi, they have a slow speed 100kpbs worst case, 3Mbps best case. Radius authentication is ok, everything looks fine except the network speed is very low. Even on the guest Wifi, they're slow (AD login/pwd portal). But on non Corp network (home/hostspot) they're fast...Even better, I change one digit in the mac@ and they get full speed. I don't know where to look at anymore, drivers have been upgraded, similar network card are not giving this issue. Laptops connected to the same AP or cable are not giving this issue.The fact I change the m

Hi everyone,I need some help with setting up DNAT on my Fortigate. I want to create a DNAT rule for a specific IP address, let’s say 172.17.200.200. My goal is to map any requests coming to port 8080 to port 3389 on the same IP address. How to can be mapped in the same ip address Can anyone guide me on how to set this up https://vlc.onl/ ?

Hi everyone,  I had tge disabled PING in all interfaces and also created a rule to disable PING and PING6 in firewall local-in-policy. Incoming ping requests from otger devices to the Fortigate are blocked but the Fortigqte is still able to ping to other devices both in the LAN and in broader internet network (e.g. 8.8.8.8). Is it possible to disable outgoing ping requests?

I have a pppoe-interface set to use device wan2. Does the local in policy need to be applied to wan2 or the "sub interface" of pppoe-interface?In what order does the local in policy apply to interfaces that have sub interfaces?Or does it just not apply to the physical interface at all?Thanks very much!Dave

I would like to migrate a VM image (Fortigate) from an on-premises environment to an AWS environment. What method is best? Thank you.

How exactly is this code used?I want to set ondemand 10gb but it doesn't work.  filesize-limit [-h|-l|-t] -t[all|ondemand|netshare|jsonrpc|icap|device] -v[MB] -u[MB]

Hi, In the CLI manual it says very clear that in config system global, tftp can be disabled by running set tftp disable. However, it seems the command is not recognised by Fortigate as whenever I try to run tge disable command, it is not recognised. I have tried show full-config | greo ttftp whithin config system global, and have not obtained any results. Please does anyone know what could bw happening here?

Hi, I would like to know the vendor and model of integrated switch fabric are on FG-200F. https://docs.fortinet.com/document/fortigate/7.4.4/hardware-acceleration/336140/fortigate-200f-and-201f-fast-path-architecture Thanks,Jacky

Hi,We are experiencing Captive portal issue for mac os users but for others users no issue found  Current firmware version 7.2.7    

If i want to supply FortiGate-60F from 12V DC source - what is min and max input voltageis it the standard 12V ±10% ??

In the past week I have been having issues with VPN users getting access denied when trying to connect to the VPN via FortiClient, if they try enough times it will finally connect. the DUO Authentication Proxy is locally running on Windows 2016 and is the latest version I have white-listed the DUO URL, bypassed in the certificate inspection, and allowed in the local Firewall. In the logs on the DUO Proxy, I am getting the error below I have raised this with DUO support and they say it looks like a FortiGate issue, I have checked the logs on the FortiGate and can't see anything getting blocked so not sure what it can be. Has anyone seen this before? 2024-07-30T08:34:12.461578+0100 [duoauthproxy.lib.log#critical] Duo auth call failedTraceback (most recent call last):File "twisted\internet\defer.pyc", line 1075, in _runCallbacksFile "twisted\internet\defer.pyc", line 1946, in _gotResultInlineCallbacksFile "twisted\internet\defer.pyc", line 1996, in _inlineCallback

Fortitoken clock drift detected - can' t login to managment

I hope this message finds you well.We have recently experienced an increase in the number of users on ournetwork. Initially, when we purchased our FortiGate 60F, we had around27 users, and the device has been performing well for our needs.However, our user base has now grown to approximately 90 users.Given this increase, could you please advise if the FortiGate 60F canhandle this number of users effectively? If the FortiGate 60F may notbe sufficient for our current user load, could you recommend anappropriate FortiGate model that would better accommodate our needs?We would appreciate any guidance or recommendations you can provide toensure our network remains secure and performs optimally.Thank you for your assistance.Best regards,Waleed FarmanNetwork & Cyber Security EngineerPH# 0966569152794Email: alamw611@gmail.com

I have an IPsec VPN tunnel that has an address range of over 200 addresses, and currently there are 60 active dial up connections. However I'm seeing all those connections are using addresses at the upper end of the range, and some users are failing to connect (debug shows "could not allocate IPv4 address"). So even though my IKE gateway list has only 60 instances, I suspect the previously used addresses aren't being put back into the pool . Does anyone know how to see available addresses for an IPsec tunnel?

Hello! I accessed it normally until this error started appearing. What should I do? Can anyone help? Thank you!  

Hello, while trying to activate my fortigate VM license 7.2.3 that is running on Vmware I get the following Error:However when trying to execute a ping to Forticare domain I get a response. Thank you for the help !

Hi Community I have issues with member ports of an LACP on one of our managed FortiSwitcheThe setup is:SW1 and SW2 are configured with MCLAGThe LACP from SW1 and SW2 towards SW3 has MCLAG enabled set.I have verifyed MCLAG consistensy on SW1 and SW2 with:'diagnose switch-controller switch-info mclag peer-consistency-check 'Everything is fine from that point of view. The links towards SW3 is the ISL, and the LACP is auto configured when the switch joined.I use 1Gbps SFP fiber optic modules. My issue is, that one of the ports on SW3 is in suspended modePort 49 = upPort 50 = suspended I can't seem to fine any documents or articles on the web how to get closer to the root cause.I have used the 'get switch lldp neighbors-summary' on all 3 switches, and they are able to detect each other.I have tried changing the speed settings from (default) Auto-module, 1000full and 1000auto but this changes nothing. 'execute log display' on the switch doesn't give me anything, othe

Hi, I would like to know if there is a command to find the SSH version running on my Fortigate.

I have  40f. I want to connect 40f between switch1 for 40f (lan1) and switch2 for 40f(lan2). Because I allow some IP address to network switch1 and deny  unspecific IP address. How to method ? Thank you