Solved

Dear teamIm having an issue with Fotigate Firewall VM64, im creating a LAN-to-all policy for internet access but cant set addresses at Source:10.10.10.0/32 for my VM computers(windows 10). i have to set it as 0.0.0.0 0.0.0.0 for it to work. any insight on the same? Regards....

Good day family, Could someone assist in telling me the actual port numbers to open on my fwl to allow management/communication between a dmz server (in front of the fwl) and forticlient ems(behind fwl). Been researching, but a bit overwhelmed.

Hi I have upgraded a cluster (which isn't in production yet) to 7.2.8. Both firewalls are now on 7.2.8 but sync is failing due to a mismatch in certificate.ca running diagnose sys ha checksum show global certificate.ca on both reveals a few differences in the hashes for example Atos_TrustedRoot_Root_CA_ECC_TLS_2021CommScope_Public_Trust_ECC_Root-01 Most are the same there's about 10 that are not was wondering the best way to resolve this  thanks 

Please guide me to block an IP 10.84.161.2 in the same vlan. I have created the rule as above but machines in the same vlan can still see each other. Please help me 

Hi youI'm using FG v7.4.3, I created a file filter to block downloading of .exe files, but users can still download the .exe file, specifically the Chrome installation file, specifically its file is ChromeSetup.exe 

We just placed an order for 10 of the FS-148E-POE switches.  We want to connect the switches together using SFP connectors and fiber patch cables.  My problem is selecting the correct SFP transceiver and the correct MM fiber patch cable.  I AM waiting for Fortigate pre-sales support to reply, but I thought I'd post here in the even that someone may have some expertise on that. So, ten FS-148E-POE and I need to know the right SFP transceiver and MM fiber patch cables to connect all of these switches together. Thank you

Hello Everybody, I have a big problem on my hands. I currently use the fortigates network with version #7.0.14M and the objective is to migrate to version 7.2.8M. However, I have a problem, because we use Hardware Switch and also software swit   My problem is when I upgrade to the desired version, the hardware switch stops working, if the sub interfaces are members of the software switch. If you remove it from the software switch, the vlan interfaces are UP. In the switch software, they are DOWNAny tips?

Hi,I'm using FotiOS 7.0.14Behind my Fortigate cluster i have running multimple web services with separate public IPs.When DOS threshlds are triggered Fortigate starts blocking source IPs including those that belongs to our Pingdom monitoring.Since quarantine is global it also influence other applications.Is there a way to configure quarantines per project or public IP? 

Hi, Assistance with a network configuration. We have two internet modems in our current setup: 1. A fiber connection linked to the Forti WAN port.2. A DIA with a static IP connected to Forti port number 4. The internet is functioning correctly from the WAN port, now we need the user login to specified sites accessed exclusively through port number 4. Modem: FortiWiFi 30EFirmware: v6.2.15 build1378 (GA)

When the Fortimanager was loaded, it was done after loading the Network, so they were left in a single address group, several mappings per device, they asked to add a new address, I wanted to know what would happen if per-mapping was disabled.

Hi,I am trying to create "Overlapping subnets for a VPN tunnel" The VPN is UP, but there is no traffic flowing through Tunnel.I have create Policies but when I checked the Route table, there was no Static Route created by the Wizard, I tried recreating the Tunnel still no Route... Created "Custom", "The remote Site behind NAT" etc. etc. Its not creating Static route.I tried manually creating static routes still no traffic flow.Remote LAN: 10.20.30.0/24Nated IP: 100.100.100.100Gateway : 70.70.70.70Local LAN, 192.168.45.0/24Any help/pointers will be appreciatedThank you

What filters need to be enabled to transfer the source IP address devname = "device_fortigate" on log forwarding? logver = 604145463 timestamp = 1705406294 devname = "device_fortigate" devid = "FG" vd = "root" date = 2024 - 01 - 16 time = 14: 58: 14 eventtime = 1705406295007253541 tz = "" logid = "15010500" type = "utm" subtype = "dns" eventtype = "dns-response" level = "warning" policyid = 459 sessionid = 1734461551 srcip = IP srcport =  srcintf = "DMZ01" srcintfrole = "dmz" dstip = IP dstport =  dstintf = "DC-Transport" dstintfrole = "lan" proto = 17 profile = "DNS-Log" xid = 25739 qname = "" qtype = "A" qtypeval = 1 qclass = "IN" ipaddr = "127.0.0.1" msg = "A rating error occurs" action = "pass" cat = 255 catdesc = "Unknown" error = "no available Fortiguard SDNS servers" 

HiWe're currently trying FortiNAC v7.2.5.0101, everything runs smoothly for most of our devices except for Meraki AP. We follow this guide for configuring/adding the AP https://docs.fortinet.com/document/fortinac-f/7.2.0/network-device-modeling/785561/cisco-meraki-ms-switch Indeed, even though SNMPv3 is enabled on our Meraki oraganization and so AP ( snmpwalk -v3 is ok) FortiNAC always throws an error while trying to add it using S/N as UserName and API Key as Password as you can see below: From a firewall perspective we got not deny or any filtering, proof is we can add the same AP using SNMPv2c for instance. From a FortiNAC perspective, there's no such log or information that may helps to troubleshoot this. Any of you guys succeed to use SNMPv3 between FortiNAC and Meraki ?Thanks a lot for your help & advices FortiNAC     

test

I want to use ADOM Global Database create firewall policy, then assigned to multiple root ADOM device's policy package.So first step, I want to normalize interface on the global database, then I create firewall policy could easily identify multiple devices physical interface name mapping.But I can't normalized interface on the ADOM global databaseOr have any suggestions? Thanks.

Hello FG adminsCould there be any kind of problem if FortiGate in NAT mode sees the same MAC addresses through two independent interfaces?This is not common at all but can happen when you have for some reason one host with one NIC connected to a L2 switch connected to 2 different interfaces on FG.

I have 3 Site A B C using FortiGate-VM (7.0 & 7.2). Three Site using 3 Ip Public for VPN gateway.IPsec Tunnel between A <-> B is Up and running.And I create another Tunnel A <-> C, But the Wizard show "Unable to setup VPN. The rollback process has encountered an error. Orphaned objects may still exist in the configuration database".

We recently acquired Next-Generation Security Licenses.  I have a couple of questions:1.  How do I assign the licenses to my endpoints2.  In the Feature Select tab, everything is grayed out and says "some features below are disabled because they are unlicensed. . . "  How will I enable these since I already have the licenses? Thanks!

Hi All,  CCTV Company is attempting to gain access to their equipment on port 10000 on a public IP on site, however they are telling me port 10000 is blocked. I have an allow any any with no services specified on the Fortigate so it should be passing through. It does work on port 554 however, and I can telnet on port 554 from the Fortigate which shows as open, but not on 10000, and the CCTV company have informed me their device is 100% listening on port 10000 etc.When I ran a debug I got the below: - Elite_Brenntag_Lutte~4JA # execute telnet 88.202.173.10 10000Trying 88.202.173.10...id=65308 trace_id=1 func=print_pkt_detail line=5868 msg="vd-root:1 received a packet(proto=6, 88.202.173.9:18559->88.202.173.10:10000) tun_id=0.0.0.0 from local. flag [S], seq 168818775, ack 0, win 65535"id=65308 trace_id=1 func=init_ip_session_common line=6049 msg="allocate a new session-017937de, tun_id=0.0.0.0"id=65308 trace_id=2 func=print_pkt_detail line=5868 msg="vd-root:1 recei

Hi there, bit of a noob here, thanks for your understanding in advance :) The hardware: Fortiwifi 60f, FS148OE Switch. The switch is connected via FortiLink and has been authorizes and is showing as online. I have the gate with a few rules, a VLAN for the switch ports on 10.2.2.0/24 I have setup a IPSEC remote vpn (split). The VPN can connect no problem and is getting IP and DNS from VPN (using Forti client).My issue is that I can access network resources - cannot ping either way.Let me know if more info is needed.... Policy as follows:config firewall policyedit 13set name "vpn_IPSEC_VPN_remote_0"set srcintf "IPSEC_VPN"set dstintf "INSIDE_FortiSwitch"   --->(10.2.2.0/24)set action acceptset srcaddr "IPSEC_VPN_range"set dstaddr "all"set schedule "always"set service "ALL"set logtraffic allset nat enableset comments "VPN: IPSEC_VPN (Created by VPN wizard)"nextend THE VPN:IP Version IP v4Incoming Interface: VOIP_HQ_WAN (WAN-UFB)Use

Hi,In our previous NG-Firewall solution we had an option to create firewall rules filtering based on a user or a group from Active Directory. We simply had an agent that transmited the user and group membership data to the firewall so the firewall could decide based on logged user from the workstation, its group membership and application proccess trying to access the destination. FortiGate has this functionality, but we are considering potencial licensing issues. I know that FortiAuthenticator provides this functionality as well as a lot more, but it is licensed per user or device on top of FortiGuard and FortiCare. Can we use menctioned functionality as its base without FortiAuthenticator and avoid aditional cost or it is required to buy FortiAuthenticator to be able to place AD user or group as source or destination firewall rule? Also, will those AD and App based rules work with Free FortiClient when a user is authenticated to the VPN?

Hey guys, so this looks like a bug but maybe someone has an idea... :)We have a FortiGate-1500D version 7.2.7 with VDOMs enabled. I created an automation task to do a backup via tftp. The backup executes the following CLI script:config globalexecute backup full-config tftp foldername/%%devname%%-%%date%%.conf 1.2.3.4The task and export itself works, however I just noticed that the content of the backup is not correct. It contains only all the interfaces from the root VDOM and their whole default config, no firewalls rules from the production vdoms, no objects etc.Now the super weird part: When I execute the CLI script manually with my hand in the CLI, it creates a correct backup full with all the necessary configurations and VDOMs etc.The exact same backup automation stitch with the same CLI script (copy+paste) also works on other Firewall, a 100F with also 7.2.7. The only visible difference for me is in the fourth line in each of the correct and incorrect backup files:Correct bac

Hello fellow Fortinet people. We have a new Fortigate Cluster (AP) with VDOMs enabled (our first Cluster with VDOM config). Now of course we want to monitore both firewalls seperately. Until now we always used the IP addresses of the dedicated management interfaces. However I just learned the following two limitations of Fortigates:«To get SNMP working with VDOM enabled: Make sure that the interface where the SNMP collector connects to is part of the management VDOM.»«Note: Dedicated management ports on a HA Cluster will not be part of any VDOM.»Now from my understanding this means we cannot use the dedicated management interfaces (which are excluded from the HA). Does anyone of you has the same config and if yes, how do you monitor both firewall seperate?

Hi All, I am trying to have Dual Hubs for my spoke. I just set up Hub A using the built-in Wizard of Fortigate.All branches and Hub A are working well on day one. We are going to have a new Firewall at DataCenter as DR second Hub now. All traffic will only go through Hub A and only use Hub B if my Hub A goes offline. To achieve this, we set up the route-map-out for both Hub A and B BGP settings. The metric for Site A is 5, and Hub B is 100. We tested the connection, Both Hubs VPN up and seem good for traffic. We tried to shut down Hub A VPN then, all traffic was routed to Hub B. When Hub A resumed, we found that the Branch learned BGP from A again and the Metric is 5. However, the route with Metric 100 from B is still the best path for the branch and does not go through the Hub A.  Please advise.

We are looking for the power draw for the 401E, for the DC.