Solved

Hi Team, I have installed persistence agent on a client computer, and edited the windows registry to specify the server IP 10.0.200.247 (port1 interface of FortiNAC)Noted from capturing packets along the path, that the agent tries to imitate the tcp connection to 10.0.200.247 but no reply is coming back to any syn packet.attached also the TCP dump from the FortiNAC (attached testfile.pcap) showing syn packets from 172.16.14.27 to 10.0.200.247 but no syn-ack seen, also trying to telnet port 4568 fails from the client machine.The default route on FortNAC on port 1 is 10.0.200.1 (Fortigate) and from the same client machine I can access FortiNAC on its port1 ip for management on port 8443 and SSH . (but not port 4568) Tried to restart the service many times on both the client machine and the FortiNAC. Note, it is layer 3 deployement and the host is not in an isolation network.Also note that it is not an SSL or certificate related issue, because the TCP connection is failing

Hello everyone.Can you please explicate me what is it.In config-firewall-policy-edit:fixedport - Enable to prevent source NAT from changing a session's source port. If I understand correctly dport means destination port but explication says source port??? Is it right? Thank you.

GoodQuestion, if I have a FortiSiem FSM-2000F, is the external collector necessary? Supposed mind is all in one?If so, do I have to purchase an extra license? I have licenses for 500 devices and 5000 EPS. Thanks

HiI've recently started a new job. They have Fortinet firewalls and access points, although I don't have much experience with Fortinet. We have a Fortimanager and Fortianalyzer which manages some firewalls but we have a couple of sites where the Fortigate only connect to FortiAnalyzer but are not managed through Fortimanager. I have seen to the process to add a device to Fortimanager, which seems fairly straight forward. These sites have Fortigate HA pairs.  I have a couple of questions though:- If we add an existing standalone Fortigate cluster to Fortimanager, is there any outage for the users on those sites?- If the config is imported, what happens if there any duplicate objects? Appreciate any help provided. Many thanksRoy

I have an issue with VIPs on my FortiGate.I have a single public IP address. I need to configure two different VIPs with this one public IP address, each using different services and pointing to different internal IPs. I created the two VIPs and used them in two different firewall policies. However, the problem I'm facing is that all traffic is going through just one firewall policy (the one with the first VIP created), even though the client-initiated traffic does not match that firewall policy. Example:196.209.90.89:80 -> 172.16.0.1:80196.209.90.89:443 -> 172.16.0.1:443196.209.90.89:22 -> 192.168.1.1:22196.209.90.89:25 -> 192.168.1.1:25Can you help me resolve this issue?"

I have an FGT 60F at home and a friend has one at his home (total of 2). I want to play around and mess with SD-WAN, ADVPN, etc. between the two devices. Unfortunately, a license for FortiManager is way outside of my budget for something I'll just be using to learn with. Is there an option for someone who wants to learn the tools without having to shell out over $1k for 1 year of FMG? Are there easy eval licenses that don't require going through a major sales pitch? We both have valid support licenses, so are already paying each year to keep those updated. We just want to do some of the stuff via FMG that we would otherwise need to do manually as a way to learn (and probably start signing up for training classes, which again are a little high priced for just some home users looking to learn more).

I am setting up a firewall FG-60F in transparent mode and this is my config : Internet <-> LTE Router <-> Firewall <->  Local Switch1Upstream the firewall there is an LTE router, dowstream the firewall there is a network switch 1. I have the firewall configured in transparent mode with management IP 10.10.10.1 and the LTE router is 10.10.10.250. When I connect locally to the network, I can ping all the devices on my network and also I have internet. The problem is when I connect via the VPN. The VPN setup is as follows, the router has an OpenVPN tunnel to an external server, and I connect to this VPN server via an OpenVPN client. When I am on the VPN, I get assigned IP on the network 11.36.255.13, and at this point I can ping the firewall on 11.36.3.1 and the router on 11.36.3.250, but I cannot ping anything downstream the firewall (switch1 and other devices). If I remove the firewall from my network and I connect to via VPN, I can ping the switch1 on Ip 11.36.3.

Good day all,Does anyone know how to add like over 200 banned words to an existing antispam profile for a local protected domain and not the Fortimail system domain. I tried cli which works, but it only creates a NEW System antispam profile with the bulk banned words but not into my existing AS profile with same name. How can I edit an existing AS profile for a protected domain via CLI 

I bought a new fortiswitch 124E and now want to upgrade to the latest firmware. Seems that I don't have a license to do this. do I actually need to buy a license even to get the very first upgrade. AND does not seem to have a button to register the switch to my fortigate account.  Please advisethanksLes

I need some help with importing bulk Mac Addresses to either the Addresses under Policy&Objects/Addresses using a csv file. I have created a group where I would like the address to be imported to. It's a Fortigate 200F

Hi. I want ask about IP address policy. The situation is, there is 3 networks. Is it possible in FortiGate Firewall to be deactivate or restrict all policies for a certain time for a specific network/ IP range?

i can't  login to the device 201 F with iso 7.2.5 with Forti Hardtoken because of the time/NTP issue. and i don't have backup admin user but i have a backup configuration file before i make the 2FA . and i don't want to reset the firewall , any advice please     

Hi, I found some informacion on the community sites refering reverse proxy but I am not sure. We have a webserver behind a VIP with only 1 static IP (there are like 4 VIPs to different hosts in the DMZ). In one VIP the Dev Team would like to get the source public IP to see at the apache for a new service. With the actual NAT they get only the DMZ interface IP because of the NAT. Any good ideas? Thanks

The FGT-60D has a WAN1, WAN2, DMZ, and internal ports 1-7, all 10 of which are GigabitEthernet. Ports 1-7 form an internal switch, which by default appears as only one interface in the GUI - "internal". I want to separate the internal switch ports into different VLANs but I cannot find any way to do it. I can view each physical [eth] port individually in the CLI using "get hardware nic" and it lists dmz, wan1, wan2, internal, and eth4-eth11. Strangely, when I enter "get hardware nic internal", it shows as up, but if I enter "get hardware nic eth[4-11]" they all show as down. I am connected to port7, which I expected would be mapped to eth11. It doesn't make sense to me. There seems to be no way to access these physical port through the "config" command, only the "get" command. 1. How can I access and configure each individual eth port?2. I have created VLAN sub-interfaces attached to the "internal" interface, but how do tell the FGT-60D which physical gig ports to trunk? i.e. how

I have a Fortigate with the Mini USB console only (no serial console port), which everything I have found appears to require FortiExplorer. However, the FortiExplorer download page has versions for everything but Windows. Why?Where can I get a download of the Windows version?

ModelFortiGate 200FVersionv7.2.7 build1577 When viewing logs and system events in the UI the event timestamp is one hour behind system time.I'm suspecting some bug with DST not applying to logged events.I have attached multiple screenshots showing the diffs and settings.Current system time is correctLast Access Time should be 15:32:59These logs are current and are showing one hour wrong

Hi, We have a SD-WAN fabric with multiple FortiGate's 80F running v7.0.8.On one of the branch site FortiGate we are planning to upgrade WAN bandwidth from 100 MB to 200 MB.What changes are required from FortiGate side or this should be done only on SDWAN side?Is there any best practices for this to ensure the upgrade process goes smoothly? TIA. :) 

Hi all. There is a problem with some MX servers from which we receive letters, for example magnit.ru, their IP address is replaced with the address of our fortigate, substituting the IP it disrupts the client reputation system by IP and we stop receiving letters from outside whose IP is resolved as our internal one. And the question is not how to enable IP reputation and set its restrictions. The problem is that when redirecting with nat turned off, the letter for fortimail receives the ip address of our fortigate, and not the sender’s source. In the case of nat enabled, all letters naturally take this form, which is incorrect from the point of view of ip reputation. If nat is turned off, only some (for example, magnit.ru). We also do not find a single way to clear the ip score for our fortigate IP address; the clear option is not functional in this case. It is necessary for #FortiMail to receive letters from the sender’s IP, and not the IP of our #FortiGate.

I have the same question as KB belowTechnical Note: Policy Package gets imported incompletely into FortiManager Is there any other solution in the new version?Is it possible to make quick adjustments from FortiManager during import configuration to make it import properly? Thanks. 

Hi, I have successfully connected a main office to a branch office using a VXLAN over an IPSec tunnel. The tunnel is connected at each end to a soft switch, which also contains a physical LAN port. Everything appears to work correctly from the branch office; however, the main office is having issues accessing certain websites. These websites can be accessed from the branch office without issue. If the tunnel is removed from the soft switch in the main office there is no issue accessing the websites from the main office.I found the following article which describes the situation: VXLAN interface impact on software switch... - Fortinet Community. Based on the article I set honor-df to disable which appears to have corrected the problem but am not sure if this will have other ramifications across the network. Is this the best way to correct this problem, of is there another solution?Thanks in advance for any help.Regards Robert Andrews

I would like to create a link between a warehouse and the main office. The main office has a Fortigate 61E and the warehouse a Fortigate 40F. Essentially, I would like to bridge the warehouse and main office in a way such that one port on the 40F is the main office network. They are installing a security system in the warehouse and would like to use the controller in the main office rather than installing a separate controller in the warehouse. The requirement is that the controller and all security devices are the same subnet. There are no servers etc. in the warehouse, only two workstations which would also need to authenticate against an AD server in the main office. I have tried various combinations of site-to-site VPNS without success. Is this at all possible? Thanks for any help. Kind RegardsRobert Andrews

Hello, I have a problem with the stability of the IPsec tunnel between two Fortigate 40F, on both the system version is 7.4.3. The tunnel can work for a few days without a problem, and then it becomes very unstable, you can see large ping fluctuations, packet losses, sometimes it will return to slight stability, but you can still see that the pings are a bit higher than normal. The problem is solved by re-establishing phase 2. Both locations have fast and stable fiber optic connections from the same provider. There are no errors in the logs on both sides, for Fortigate the tunnel is stable.In the first screenshot, the red line indicates the moment when the tunnel stabilizes after the problems, and the green line indicates when I re-establish phase 2, the pings are immediately smaller and more stable. The second screenshot shows the moment of jerking and switching to the backup SD-WAN tunnel. I will add that the problem occurred even when only one IPsec tunnel was establi

Hello I want to know where can I have see a complete course of nse 4 on the site of fortinet please. the official course on fortinet. How can I Schedule my exam thanks.

Hi, I'm new to Fortigate and this week got my WF-81F-2R-A and it works great, using SSL VPN perfectly on the free FortiClient VPN on Linux. For added security I created a certificate inside my Fortigate with 'LetsEncrypt' and put it in my Fortigate's VPN Settings with no problem. Then I tried to put that certificate in the free FortiClient, and no matter what I can't see the certificates to load. Am I doing something wrong or is the software intentionally misbehaving without courtesy of an error or warning message? I looked all day online for an explanation or guide. All I ever see is "press the Import Certificate button to import a certificate" kinda stuff. Thanks for any assistance,B83

How do get the icons in Predefined Internet Services to show in color?, I have another 80Fand the Predefined Internet Services are display in color .I have include a screen shot for easily of reference. Thanks Regards