Solved

Hi, I found some informacion on the community sites refering reverse proxy but I am not sure. We have a webserver behind a VIP with only 1 static IP (there are like 4 VIPs to different hosts in the DMZ). In one VIP the Dev Team would like to get the source public IP to see at the apache for a new service. With the actual NAT they get only the DMZ interface IP because of the NAT. Any good ideas? Thanks

The FGT-60D has a WAN1, WAN2, DMZ, and internal ports 1-7, all 10 of which are GigabitEthernet. Ports 1-7 form an internal switch, which by default appears as only one interface in the GUI - "internal". I want to separate the internal switch ports into different VLANs but I cannot find any way to do it. I can view each physical [eth] port individually in the CLI using "get hardware nic" and it lists dmz, wan1, wan2, internal, and eth4-eth11. Strangely, when I enter "get hardware nic internal", it shows as up, but if I enter "get hardware nic eth[4-11]" they all show as down. I am connected to port7, which I expected would be mapped to eth11. It doesn't make sense to me. There seems to be no way to access these physical port through the "config" command, only the "get" command. 1. How can I access and configure each individual eth port?2. I have created VLAN sub-interfaces attached to the "internal" interface, but how do tell the FGT-60D which physical gig ports to trunk? i.e. how

I have a Fortigate with the Mini USB console only (no serial console port), which everything I have found appears to require FortiExplorer. However, the FortiExplorer download page has versions for everything but Windows. Why?Where can I get a download of the Windows version?

ModelFortiGate 200FVersionv7.2.7 build1577 When viewing logs and system events in the UI the event timestamp is one hour behind system time.I'm suspecting some bug with DST not applying to logged events.I have attached multiple screenshots showing the diffs and settings.Current system time is correctLast Access Time should be 15:32:59These logs are current and are showing one hour wrong

Hi, We have a SD-WAN fabric with multiple FortiGate's 80F running v7.0.8.On one of the branch site FortiGate we are planning to upgrade WAN bandwidth from 100 MB to 200 MB.What changes are required from FortiGate side or this should be done only on SDWAN side?Is there any best practices for this to ensure the upgrade process goes smoothly? TIA. :) 

Hi all. There is a problem with some MX servers from which we receive letters, for example magnit.ru, their IP address is replaced with the address of our fortigate, substituting the IP it disrupts the client reputation system by IP and we stop receiving letters from outside whose IP is resolved as our internal one. And the question is not how to enable IP reputation and set its restrictions. The problem is that when redirecting with nat turned off, the letter for fortimail receives the ip address of our fortigate, and not the sender’s source. In the case of nat enabled, all letters naturally take this form, which is incorrect from the point of view of ip reputation. If nat is turned off, only some (for example, magnit.ru). We also do not find a single way to clear the ip score for our fortigate IP address; the clear option is not functional in this case. It is necessary for #FortiMail to receive letters from the sender’s IP, and not the IP of our #FortiGate.

I have the same question as KB belowTechnical Note: Policy Package gets imported incompletely into FortiManager Is there any other solution in the new version?Is it possible to make quick adjustments from FortiManager during import configuration to make it import properly? Thanks. 

Hi, I have successfully connected a main office to a branch office using a VXLAN over an IPSec tunnel. The tunnel is connected at each end to a soft switch, which also contains a physical LAN port. Everything appears to work correctly from the branch office; however, the main office is having issues accessing certain websites. These websites can be accessed from the branch office without issue. If the tunnel is removed from the soft switch in the main office there is no issue accessing the websites from the main office.I found the following article which describes the situation: VXLAN interface impact on software switch... - Fortinet Community. Based on the article I set honor-df to disable which appears to have corrected the problem but am not sure if this will have other ramifications across the network. Is this the best way to correct this problem, of is there another solution?Thanks in advance for any help.Regards Robert Andrews

I would like to create a link between a warehouse and the main office. The main office has a Fortigate 61E and the warehouse a Fortigate 40F. Essentially, I would like to bridge the warehouse and main office in a way such that one port on the 40F is the main office network. They are installing a security system in the warehouse and would like to use the controller in the main office rather than installing a separate controller in the warehouse. The requirement is that the controller and all security devices are the same subnet. There are no servers etc. in the warehouse, only two workstations which would also need to authenticate against an AD server in the main office. I have tried various combinations of site-to-site VPNS without success. Is this at all possible? Thanks for any help. Kind RegardsRobert Andrews

Hello, I have a problem with the stability of the IPsec tunnel between two Fortigate 40F, on both the system version is 7.4.3. The tunnel can work for a few days without a problem, and then it becomes very unstable, you can see large ping fluctuations, packet losses, sometimes it will return to slight stability, but you can still see that the pings are a bit higher than normal. The problem is solved by re-establishing phase 2. Both locations have fast and stable fiber optic connections from the same provider. There are no errors in the logs on both sides, for Fortigate the tunnel is stable.In the first screenshot, the red line indicates the moment when the tunnel stabilizes after the problems, and the green line indicates when I re-establish phase 2, the pings are immediately smaller and more stable. The second screenshot shows the moment of jerking and switching to the backup SD-WAN tunnel. I will add that the problem occurred even when only one IPsec tunnel was establi

Hello I want to know where can I have see a complete course of nse 4 on the site of fortinet please. the official course on fortinet. How can I Schedule my exam thanks.

Hi, I'm new to Fortigate and this week got my WF-81F-2R-A and it works great, using SSL VPN perfectly on the free FortiClient VPN on Linux. For added security I created a certificate inside my Fortigate with 'LetsEncrypt' and put it in my Fortigate's VPN Settings with no problem. Then I tried to put that certificate in the free FortiClient, and no matter what I can't see the certificates to load. Am I doing something wrong or is the software intentionally misbehaving without courtesy of an error or warning message? I looked all day online for an explanation or guide. All I ever see is "press the Import Certificate button to import a certificate" kinda stuff. Thanks for any assistance,B83

How do get the icons in Predefined Internet Services to show in color?, I have another 80Fand the Predefined Internet Services are display in color .I have include a screen shot for easily of reference. Thanks Regards 

Hello guys!I'm deploying FortiNAC and facing a problem that I want to know if this proceed or not. The Registration Interface are providing IP by DHCP to new PCs correctly, but I'm trying to do simple ping from new PC with Registration IP to the Management IP of FortiNAC and this do not reply. But if I do ping from the FortiNAC to the same PC with Registration IP it gets replies. Is this normal behavior natively on FortiNAC? Or do I need to setup something to permit this ping replies?

On the Fortigate under SSL-VPN Settings you need to specify an Address Range.  But you also need to do the same thing under SSL-VPN Portals Source IP Pools.  Presumably if you have multiple portals each one would have their own IP pool.  So why are you forced to enter in the range twice?

Good Day Guys, I am having a problem accessing the SDWAN rules on my Fortigate 200F. This happened before, restarted the device but this time round after restarting it, still not working. Any suggestions?Spinning Wheel. Nothing happens.

This is my first time using Fortimail and I have to admit, this system has a lot of bugs/issues, a bit unstable. The VM/webadmin tends to freeze at times. I once lost an entire configuration, where the vm was reset thus losing its 1 yr license/expired, I had to turn on udp to reapply 1yr license to get the VM up. Now the VM upon starting in Hyper-V is broken. I need to replicate this Fortimail VM for redundancy, but I will not replicate a broken VM. Additionally, there are other VMs on the same host comprising Fortimail and they are working fine i.e. checkpoint creation/removals, replication etc can be done.Can i get some assistance?

When I visit https://219.148.36.28, due to anti-ddos device protection, the website always responds with an incorrect syn+ack for the first time. If the client can respond with rst, it is considered normal. When I was in the company, the fortigate version was 4.0. When foritgate received the wrong syn+ack packet, fortigate would discard the packet. Now I set up an environment to test the“ anti-relay” function，Refer to the cli manual description. When anti-replay is set to strict, syn+ack packets with incorrect sequence numbers should be drop. However, when I tested, fortigate did not drop the wrong syn+ack packets，but forward this packet . Why don not drop the wrong seq packet? I debugged and saw that there was a debug saying This can be a challenge ack packet. What does this mean?1. My topology is as follows2. debug info3. fortigate sniff4. config system global ,set anti-replay strict5. firewall policy ,set anti-relay enable 6. only how one firewall policy 

I am testing out client based ssl-vpn using SAML Auth.  When I debug saml on the fortigate I see that group that comes back from SAML is correct but I am getting added to the wrong portal.  I have users group configured as per https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-administration-guide/584456/configuring-saml-sso-login-for-ssl-vpn-with-entra-id-acting-as-saml-idp with:config user groupedit FortiGateAccessset member azureconfig matchedit 1set server-name azureset group-name <object ID>nextendnextend How does the fortigate relate the group name to the portal name?

Hello community,I need help hiding the WAN IP of my FortiGate, using proxy services like Cloudflare. I have currently set up my FortiGate with a subdomain (mifirewall.mypage.com) and an SSL certificate from Let's Encrypt, which works perfectly in DNS mode with Cloudflare. However, when I switch to proxy mode to enhance security and hide the IP, the system stops functioning as expected.Additionally, this configuration with Cloudflare is used not only for managing the device but also as the address for SSL VPN clients. This makes it crucial to maintain constant functionality and accessibility through Cloudflare.Has anyone faced a similar problem when activating proxy mode in Cloudflare? How did you resolve it? I am particularly interested in knowing if there are specific configurations or adjustments I could apply to solve this issue.Thank you for your time and assistance.

Hi FortiGate adminsAny one used the "none" interface as SD-WAN member?I wonder if we can use it like a black hole, like when we don't want to route some traffic through any SD-WAN members when some SD-WAN members are down (not to fall in the implicit SD-WAN rule). I know we can do that with firewall policies but I wonder if we can do it at SD-WAN rules level.

Hi,Can anyone confirm me the SKU below support 1GB/Day of Log ? or more ?and how much Capacity ?SKU : FC-10-0081F-585-02-DDDesignation : FortiAnalyzer Cloud: cloud-Based central logging & analytics. Include All FortiGate log types, IOC Service, Security Automation Service and FortiGuard Outbreak Detection Service. Thanks

Hi,I try to implement site to site vpn between 2 Fortigate in my lab but I got this error on both side : ike Negotiate ISAKMP SA Error: ike 0:ffd4573d1a2ff133/0000000000000000:220: no SA proposal chosen Commands output :Hub # show vpn ipsec phase1-interfaceconfig vpn ipsec phase1-interfaceedit "VPN-to-spoke"set interface "port2"set peertype anyset net-device disableset proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1set comments "VPN: VPN-to-spoke (Created by VPN wizard)"set wizard-type static-fortigateset remote-gw Spoke_IPset psksecret ENC pkX9mSvmif/AZCPktG9xlCHmSNyAmQ2L3IigVETGNrOEVgH1t22s1u6cEl2aLk+V/WMJn7Qnm246 TgPqCL6nchuxAdm0bbBpKQvAODxUp72Vfror9YyanMzw2iwhFEIG2KABhJnUGGgkIWql3lxk0SUmefRrVdRahgC2HLiGJ0+TaqhF3U sjhCTKE5K6zP4ACd1yCQ==nextendHub # show vpn ipsec phase2-interfaceconfig vpn ipsec phase2-interfaceedit "VPN-to-spoke"set phase1name "VPN-to-spoke"set proposal aes128-sha1 aes256-sha1 aes128-sha256 aes256-sha256 aes128gcm aes256gcm chacha20p oly1305s

i try to login via a python script, after some struggeling with the certificates i get a return code 200.but when i try to parse the return value it's not a json object (or structure) it's html. login-request and check response: response = requests.post(loginURL, json=login_data)print(f"response status code : {response.status_code}")if response.status_code == 200:print(response.text)try: json_data = response.json() for key in json_data: print(key)except ValueError as e: print("some ERROR raised:") print(e) and the print of the response ist html:<!DOCTYPE html><html lang="en"><head><meta charset="utf-8"><title>FortiSandbox</title><base href="/ng/"><meta name="viewport" content="width=device-width, initial-scale=1"><link rel="icon" type="image/x-icon" href="favicon.ico"><style>@charset "UTF-8";body{font-family:Lato,Helvetica,Arial,sans-serif}body{font-weight:var(--nu-theme-dimension-norm

Hello,I am trying to setup a IPSec VPN tunnel between a Fortigate VM and a Cisco ASAv in GNS3. I have multiple subnets behind the Fortigate and one subnet behind the ASA. When I create a IPSec tunnel on the Fortigate, I use a group-object with all the local subnets from the Fortigate as the local-network at the phase 2 selectors.When the tunnel is configured at both ends, the fortigate lists the IPSec tunnel, but the phase 2 tunnel is not up all the way. Only one subnet is listed up and the other subnets are down. I found the following Technical Tip where they say that I need to create multiple phase 2 selectors for each local subnet from the Fortigate.How to configure VPN for multiple subnets - Fortinet CommunityWhen I do this, the VPN works as it should. But is there a way to only need one phase 2 selector for every local subnet? Or do I need to make a selector for every subnet that needs to be allowed over the VPN?Kind regards,Jeffrey