Fortinet Community

Hi Is there a way, when i guide one of my host into VPN tunnel and it works great.Is there a way, to ping it over a WAN interface also ? 

For our edge switches we are using fortilink over Layer 3, which has been working fine. One of our deployed switches has been acting odd and I noticed that the automatically created fortilink interface on the switch is pointing to the secondary HA fortigate instead of the primary. Same goes for the trunk port. This causes a constant HA sync issue, but otherwise the switch seems to be working Ok. How do I go about correcting this? Is it as simple as modifying the auto-created fortilink interface on the switch or is there some better way? Thank you.

Hi,I'm configuring a FortiGate 400F for VPN authentication via RADIUS with RSA Authentication Manager, but I can't get access to VPN/Admins via groups to work.(If I create a Firewall group that reads all RADIUS it works, but if I create a Firewall group that matches a single  RADIUS group it doesn't work) I've configured the Firewall side:config user radiusedit "RSA-ARLUNO"set server "x.x.x.x"set secret .....set radius-coa enableset radius-port 1812nextendThe group is configured as follows:config user groupedit "Utenti_VPN_RSA"set member "RSA-ARLUNO"config matchedit 1set server-name "RSA-ARLUNO"set group-name "Utenti_VPN_RSA"nextendnextendOn the RSA Authentication Manager side, I created the Radius Client, the Radius Agents and added the Fortinet VSAs. If I create a RADIUS profile on RSA that always returns the value "Fortinet-Group-Name" - Utenti_VPN_RSA works, but it has to be a dynamic field. Can someone help me out?

Hello! We have a Fortigate 60F running latest mature (7.2.8) FortiOS. We would like to inspect (as much as possible) email traffic, ie around 10 users accessing Exchange Online via latest Outlook clients on Windows and using default protocols (MAPI over HTTPS?). We are clear on how to inspect IMAP/POP3/SMTP traffic, but not sure how to handle Exchange Online default protocol. Fortigate docs mention RPC over HTTP (should be deprecated for Exchange) as well as MAPI. Is MAPI the way to go. If so, how should we configure policies, profiles etc. to separate from the rest of HTTP/Microsoft traffic and make sure email and antivirus detections/profiles are applied. Also, while 7.2.8 still makes it possible to enable proxy-based policies and profiles (MAPI inspection not supported in flow-based), what is the way forward for M365 Excange Online inspection on < 2GB RAM devices for smaller networks? Any advice is welcome. Thanks!

Hello expert, I configured a ssl vpn remote and was successful able to establish a remote session  from my laptop.how can i view the entire logs for any attempt from my laptop to resource on the "lan" network behind the FortiGate.I search under log and report  forward traffic unsure if I  am searching the correct place but I am not seeing any  inbound traffic. I humbly request some guidance. Thanks  Regards    

hi all we have an issue with two Fortinet firewall in production mode (Fortinet A and Fortinet B). We followed these manuals: https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-high-availability/HA_VRRPFailover.htmhttps://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-high-availability/HA_VRRPEx1.htmhttps://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-high-availability/HA_VRRPEx2.htm and configuring priority 255 in both routers (Fortinet A and Fortinet B) leads into a split-brain situation. can someone please help us with this issue and explain why this behavior?

Hello,Is it possible to retrieve "All Events" from the Event Monitor in FortiAnalyzer using CLI or API? Ideally, I would like to retrieve events that are not blocked by FortiGate. 

Hi all.In the Company i am working, we are wanting a way to connect Forticlient Vpn without user intervention. We understand the risks, but it is necessary. We tried with a .bat executable file, but it is not working. It execute the forticlient, but it doesn't connect. We asked for help creating a ticket to Forti, but the Technical Support sent us a link with information we had seen previously. If somebody had a similar problem, can tell me how to resolved it? Thanks, i am reading you.

Hi, I have a FG60F with 7.4.4 and 3 Internet Accesses with a SD WAN. I have a SD WAN Implicit Rule with 40-40-20% for Volume. Checking Performance SLAs all of them seem OK but since I have the implict rule, I dont apply SLA. Now I saw that WAN1 just had like 2 sessions all the time so I checked directly on the router and I get like 1GB. Than I disconnected WAN2 and Internal5 which are in the SD WAN and I can ping from the FG but NOT from LAN. Sniffing the ping to 8.8.8-8 I see that traffic is not going out to SD WANXXX-XXX # diag sniffer packet any "host 10.10.14.25" 4interfaces=[any]filters=[host 10.10.14.25]0.131501 lan in 10.10.14.25.57343 -> 10.10.14.1.444: psh 3371949728 ack 42930140730.131567 lan out 10.10.14.1.444 -> 10.10.14.25.57343: ack 33719498140.142213 lan out 10.10.14.1.444 -> 10.10.14.25.57343: psh 4293014073 ack 33719498140.142847 lan out 10.10.14.1.444 -> 10.10.14.25.57343: psh 4293014619 ack 33719498140.142987 lan in 10.10.14.25.57343 ->

Hi.We are using Cisco ISE with the pxgrid connector to fortimanager and that works fine.but need to create fortigate policies with a user on both source and destination cause our cisco sda uses /19 subnets and seperated with sgt tags (pxgrid).But when im trying to install a policy im only able to do source user, on destination there's no user tab.Is that working as intended? cause then i need to have fortinet to make it work, out local fortinet team said it should work.thx Morten

Hello Community, i have a little problem with my wlan in the office. I manage my FortiAPs over my Fortigate 500E. All is fine, but I have a problem with my FortiAP 231F. They work fine, but I have the problem, that Clients which are connected on the same FortiAP, they cannot reach each other. Clients, who are connected on different FortiAPs, have not this problem. I have the Problem only on the FortiAPs 231F, and only, when the Clients are connected on the same AP. I can´t find the problem. I connected on the AP directly via HTTPS and checked all configurations. I created a new AP-Profile, but it´s the sa Has somebody an idea?

Hello team, We have identified a discrepancy of nearly 5 million session counts in the FortiAnalyzer session data. While the actual data from FortiGate indicates a total of 1,000,000 sessions for a specific time period, we observe only 5,000,000 sessions in FortiAnalyzer for the same period. We need to investigate the factors contributing to this discrepancy and determine whether we can trust the data. Is there real-time synchronization between the devices?

Hi, I'm wondering what is the best way to connect two Fortigates via LAN connection. both boxes are in the same buildingThe purpose is to allow access of resources for example (Printers VLAN) or any other resource I have configured a dedicated port for the link on both Fortigates and assigned an IP of 10.10.90.2 and 3 for both endsI can ping from both, I have created a static route on both to route the traffic to the gateway address on both.I can not ping the resources from workstations on both ends and I do not have internet connectivity.I tried to create policies on both ends to allow the traffic with no luckany idea how this can be accomplishedThank you

Certificate I am trying to send syslog from my Fortigate 40F firewall to a Syslog Server with SSL encryption but I get error "Unknown CA". Certificate GenerationI have generated a root certificate and a server certificate following the guide found here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Send-Syslog-over-TLS-to-a-rsyslog-server/ta-p/248101 I uploaded the certificates to Fortigate Firewall Certificates:  Then I have the following settings on my Firewall:acdc-fortigate # config log syslogd settingacdc-fortigate (setting) # showconfig log syslogd setting    set status enable    set server "34.10.1.5"    set mode reliable    set port 6514    set enc-algorithm high    set certificate "syslog-servercert"endOn my collector server where I run LimaCharlie Adapter I get the following error: Jul 09 10:57:30 dev-colle

what difference between FortiGuard updates and firmware updatesthanks

Hi everyone, I have read that in previous FortiOS versions, for fortigate devices without onboard memory, it was possible to store logs to an external memory. Is this now possible, or do you still need a Fortinet-licensed product (e.g. FortiAnalyzer or FortiCloud) to do so?

Hi Team, I am having trouble with FortiGate connection to FortiGuard server with this error reflecting in the GUI:"Unable to connect to FortiGuard servers" Current topology is:FortiGate (with Issue) ---- Router ---- Another FortiGate ---- Internet I can ping below:exec ping service.fortiguard.netexec ping update.fortiguard.netexec ping guard.fortinet.net Diag Debug Rating:2 Servers Listed and has F flags in it Already changed between protocol 8888 and 53 (no 443 available in my FG)Already enabled and disabled the anycastManagement VDOM is 'root' Config:config system fortiguardset fortiguard-anycast disableset protocol udpset port 8888set sdns-server-ip 208.91.112.220    <-end Anything else which I can try to make the server reachable?  Thanks!

Hi,Does anyone tried to pass internet traffic from a remote site that has VIP configured via IPsec =>without<= using NAT in the policy for the inbound traffic for that VIP?Basically what i am trying to do here is to pass the Public IP source info to various servers in following inbound flow: Internet -> VIP -> FTG-site1 ->IPsec->FTG-site2->ServersDue to local restrictions something like VIP -> FTG-site2->Servers won't be possible, so my only option is the one above via FTG-site1.I have no issues revealing Public IPs via VIP inbound that are connected to local LAN on FTG-site1 by having disabled the NAT on the responsible inbound policies, but when comes to IPsec, such approach does not work only with NAT enabled in the policy so now the servers on the remote site FTG-site2 only sees the IPsec interface IP for each session that is not ideal for security logging purposes.

Hi, Can we get the list of url's to connect forticlient to fortisase.

Hi, I saw many posts but no solution that worked for us. Since yesterday, after the update to 7.4.4 we cant connect via SSL VPN with LDAP and FortiToken Users. Local Users are working fine. We tried with different users (NO user can connect and we have like at least 20 per day), different PCs and different Forticlient Versions. We did not change anything from yesterday and on the other office with FG100F and 7.4.3 it still works without any problem with the same LDAP configuration. Is it possible that this is a bug in 7.4.4. Any ideas o suggestions? Thanks!

Hi community, We have configured site-to-site VPN between FTD and FGT, the VPN is up and works but suddenly after few days traffic stops from one side even tho VPN is still up,  as show0n in the screenshotThe only way to fix is to delete all the configuration from FGT and FTD and reconfigure again.I would appreciate any kind of help to fix this.I tried to upgrade FTD and FGT but no the problem  is the same.  

Hi everyone, I'm just want to block appsheet.com website on my site. I have create a security profile with Web Filter to block it and create a policy for it. But User still access. What wrong with my web filter ?. 

I'm starting my studies on the Fortigate Firewall and I'm trying to create two small networks by myself in PNET Lab. The topology consists of a Fortigate and 2 Cisco Switches. The objective is to create the VLANs, a for each port on the Fortigate, deliver IP to two PCs one on each switch and the VLANs must communicate. I've already created the VLANs, the DCHP server on them, trunk mode on the switches, but I can't receive IP via DCHP. I did a test on another port with another PC without the switch and it worked normally, but I need it to work with the switches. I decided to ask for help, as I've been looking for a solution on my own for 2 days and haven't found one

hi all,I happened to find there are compromised host under Security tab of dashboard, why are they here? Are they attacked?And the host are dynamically displayed. 2 days ago, it displays 2 host, now it displays only 1 host. What are the criteria for this?How can I remove them from here (to really solve the problem).Thanks!