Solved

I would like to delete some unused rules Virtual IP, before I delete this Virtual IP I Ill like to check if there is still traffic in that Virtual IP.  Im using V7.2.7  

Himy device is Fortigate 60F running 7.2.8I have defined a new hardware switch named internal0, added physical ports internal4 and internal5I have added some Vlans on internal0, let's say VLAN17, VLAN18, VLAN19 (192.168.17.0/24, 192.168.18.0/24, 192.168.19.0/24).Internal 5 is uplinked to the trunk port on my Aruba switch (setup as L2 switch) where are also defined same Vlans.Everything is fine, devices connected to Aruba are getting IP addresses from the corresponding Vlan. (DHCP is setup on Fortigate for the Vlans)Now I want to have internet access for the vlans and I am not able to do it.I have setup an allow all rule from internal0 - WAN1 but still the devices are not able to access internet.It may have to do with the fact that the internal0 switch need an IP address on order to do NATI have added an IP address (say 192.168.10.1) to the internal0 switch but still no able to access internet.What am I doing wrong? please helpNote: the reason I have created a new hardware switch and no

Hello community! I have a very complex scenario to implement, but without much information. The intended scenario is: Multiple SSIDs for the Wireless network, however, must use WPA2-Enterprise... however, I do not intend for authentication to be done with user and pass, but rather via the EAP-TLS certificate issued by fortiauthenticator, tied to the local user created. Performing EAP authentication was already successful, however, now I need to isolate the certificates so that only the certificate authorized for a given SSID can access. In testing, any certificate is capable of logging into the SSID. How to isolate?I've already tried to create the local group on Fortigate and indicate the remote group on Fortiauthenticator, but without success.I've already tried applying the radius attributes, indicating the FortiAP SSID for the created user, but it didn't work. summary: I intend for each ssid to only allow one certificate issued by fortiauthenticator&nbsp

Hello team,I have some points regarding persistence agent deployments:1- is a DNS record mandatory or there is a way to configure the agent to reach FNAC via its IP2- I understand that when registering endpoint as a host, the device is tied to a user, whereas as "device" it is not, so why we need "authentication" when choosing "register as device" under "system--persistence agent / credential management? 

Hello,I set up IPSec connections for roaming clients with split-tunneling. Although the connections succeed phase 2 and R_U_THERE packets do cross the tunnel, there is no packet flow between client and the Fortigate. Neither one can ping the other through the tunnel.Another fact which I do not understand. Although split-tunnel and mode config is selected, the Forticlient 7.2.4 alters the default route on the Windows 10 / 11 clients to the tunnel. The dial-in client´s LAN network address is 192.168.0.0/24. The HQ network is 192.168.0.0/16. This will also lead to routing problems. Is it possible to map the HQ IP-Address [192.168.0.0/16] within the tunnel to another network (e.g. 192.0.0.0/16) ?For testing purposes we altered the accessible networks into another network [10.0.0.0/8] which is also connected to the Fortigate. But that did not lead to data flow through the tunnel. gatewayname: 'EMS_Test_0'local-gateway: 123.45.678.123:4500 (static)remote-gateway: 123.46.78.123:6289

Hi guys, What is the right procedure when creating NAT to my web server. should be accessible outside using a public ip of the same subnet as my wan interface. i am using sd-wan interface. thank you in advance.

Dear EveryoneI recently bought and old fortigate 61E on ebay, i capture the serial number and the image of the product and sent to customer service to ask for device transfer, but they said that they do not support product that not bought from authorized seller, I also contact the email of the pre owner and he said that i already remove the device from his account and i have to factory reset the fortigate and register it to another account. But this does not seem to helpAnyone here who has experience with this, will i be able to register the device after the old owner removes it from his account?What is the best way to deal with this trouble?Thanks

Hi,After upgrading to FortiOS 7.2.8 we are having some issues with the WAF filter on some of our services. It seems that the filter in this version is setup harder or that the exceptions we built in the past based on event ID's are being ignored.I noticed that when an event has been blocked no Event ID is showing up. On previous versions I could use the event ID to create an exception but now I can't. Any ideas?Thank you in advance.

Hi, we Have a F600E, which is the single main router, firewall and DHCP server to a single LAN. What we want is when a group of VPN clients connect with FortiClient VPN to this device and network, they should only be able to communicate with one machine in that LAN, which is a file server. We don't want VPN connected clients to have access to any other local machines in that network. How can we achieve this ? Thanks

I have a FortiGate configured with two tunnels on two Ethernet ports with the intention to do load balancing or traffic steering on them. They go through a router to converge onto one port/IP at another FortiGate (a.k.a. server). The server is configured with one dynamic tunnel, and I left the dst-subnet in phase2 empty.I can connect to the server fine, and the server "spawns" logical tunnel interfaces _0 and _1 for each dial-up. However when I ping from client to server or initiate any TCP connections, the responses all come back on _1 even if the origin is from tunnel _0. When I look at the FortiView Sessions list in GUI it just shows the session from the parent tunnel name. The Debug Flow shows the origin point of the session was from the right tunnel but it chooses to output on the other tunnel. It is as if it is using the routing table to pick the interface, not the origin tunnel, and I don't know what makes it pick _1 all the time either.Is this a misconfiguration on my part or F

I was sent this article. It is amazing to me the amount of time that was invested in hiding the script and the related activity. Are there any tips or tricks to stopping melicious code like this? https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/ 

Hi,I've configured ipv6 for the first time on my Fortigate 50E with 6.2.16 firmware.My ISP doesn't give me the option to delegate /56 or /60 subnet but only eight /64 subnets for internal use. So I've connected the wan1 port to the ISP bridge and using link local IPV6 address of the Fortigate WAN1 port I've I've delegated one of the /64 prefix to the Fortigate.Then I've configured the WAN1 port via CLI in dhcp as follows: config system interface edit "wan1" config ipv6 set ip6-mode dhcp set ip6-allowaccess ping set dhcp6-prefix-delegation enable end next end Next I've configured my lan interface: config system interface edit "lan" config ipv6 set ip6-mode static set ip6-address xxxx:xxx:xxxx:f2f1::1/64 //the subnet is the same of the one delegated by the ISP set ip6-allowaccess ping https ssh set ip6-send-adv enable set ip6-other-flag enable config ip6-delegated-prefix-list edit 1 set upstrea

I have a company that has about 200 VPN users and we are wanting to push the IPSec configuration to them. I can deploy the Forticlient using Windows Group Policy but I also was to push the IPSEC configuration. Can that be done using Group Policy or is there another way to push it so I do not have to touch 200 machines. FortiClient 

Hi, we have a customer who has >20 FG30E and FG50E units to connect ther small branch offices. They are in the middle of a ERP change, so the trade up for new FG models was planed for the end 2024. Yesterday they told us that in 2 offices (1 x FG30 and 1 x FG50) their internet is really slow. We connected from outside and for us everything seemed normal. We sent a technician and he found out that connecting directly to a LAN port he got like 25-50% ping loss to the FG unit.  We had once a similiar case and we needed an RMA. It seems clear that this is a hardware failure but for us doing an RMA is also bad timing and bad process for the customer. Anybody else got the same issue and found a work around or is the RMA the only solution? Thanks!

I am trying to get an api call to FMG to get statistics for FortiAP from the FMG or FAZ. The document online states the use of IP addresses but we cant use that for our case. Is there anymore info on api calls for FortiAPs from FMG or FAZ

Am I the only one who is really unhappy with the 35 character limit at firewall rule names? We have different vendors and always on the FortiGates I have to think how I can shorten the rule name.... I doubt Fortinet is changing this soon?

Hi FG adminsOn my FortiGate 7.2.3, freshly transferred to another FortiCloud account successfully, when I click force update license & signatures it doesn't work and it shows the below output.Any idea on what can be the issue before I open a ticket?upd_daemon[1808]-Received update request from pid=1621upd_daemon[1628]-Found cached action=00000002do_update[665]-Starting now UPDATE (final try)__update_upd_comp_by_settings[480]-Disabling FLEN components.__update_upd_comp_by_settings[484]-Disabling NIDSDB/ISDB/MUDB components.__update_upd_comp_by_settings[488]-Disabling APPDB/IOTDB/OTDB components.__update_upd_comp_by_settings[492]-Disabling AVEN components.__update_upd_comp_by_settings[496]-Disabling AVDB/FLDB/MMDB components.upd_fds_get_next_server[609]-no route, skip addr=[[2620:101:9000:140:173:243:140:6]], weight=1073736430upd_fds_get_next_server[609]-no route, skip addr=[[2620:101:9000:140:173:243:140:6]], weight=1073736430upd_fds_get_next_server[609]-no route, skip addr=[[2620:1

Dear all, I have a problem with a FortiMail  VM. I use my Fortimail as a gateway. Unfortunately, I have a loop when sending emails, which I cannot solve. The following error scenario:When I send an email from my M365 mailbox to another M365 mailbox this email goes into a loop and rejected with this error: "Remote server returned '554 5.4.6 < #5.4.6 SMTP; 554 5.4.6 Too many hops>'". When sending from my M365 to email addresses outside the Microsoft Cloud, the sending is successful.Can you help me to solve this problem? I suspect the problem is because the 365 accounts are all accessible via the same IPv4 address? Thank you very much for your help.David

I have Custom Tunnels from B1 (1.0) to B2(2.0) that is 1ms latency.I have a custom tunnel from B1 to B3 (3.0) that is 13ms latency.I have a custom tunnel from B3 to B2 that is a 54ms latency. I want to send the connection from B3 to B2 through B1 to reduce the latency between these two buildings. I need the latency to be under 20ms.I created a route forB2 2.0 traffic going to 3.0 to use the tunnel through 1.0I created a route on B3 for 3.0 traffic going to 2.0 to use the tunnel through 1.0In the firewall policy on B1 Lan traffic from 2.0 going to 3.0 to go through the 3.0 tunnel and reversed cloned.I also created a policy on B1 Lan traffic from 3.0 going to 2.0 to go through the 2.0 tunnel and reversed cloned as well. On B2 and B3 I created the Policies for any Lan going to B2 or B3 to pass through the B1 tunnel and also reversed cloned these two policies.It didn’t work. What am I missing here?

Hello,I have a strange behavior with our FortiClient's tunnels.Created a Remote Access profile on our FortiEMS, it's a VPN Tunnel with 4 remote gateways.Created DNS records for our public IP addresses from FortiGates via Let'sEncrypt.  Now when I try to connected to that one tunnel it will prompt me the "Security Alert" on 40% before it makes the connection.But if I create 4 separate tunnels and not 1 tunnel with multiple gateways then I don't get the prompt with "Security Alert", the connection is established normally.Does anybody have a clue what this can be, probably some limitations with multiple gateways..

I have found this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-policy-routes-for-route-based-interface/ta-p/193376 But it is not 100% clear to me. Static routing is no problem. But policy based is not working for me. As I understood, in policy route, I have to select "Outgoing interface" (ipsec interface) and "Gateway address". Now, when I did not fill in the GW, the policy route was skipped and only static routes was evaluated. Than I found the article stating: "The solution is to configure an 'IP' and 'Remote IP' on the virtual tunnel interface". So I did it, only on my side of tunnel, and policy route was being hit after that and also data was flowing the correct way (so it seems at least, but it is not returning back).From the article it is not clear to me, if the IP and remote IP on interface and using gw of remote IP in policy routing is just a requirement, so the policy route is evaluated or does the remote IP have to exist in reality on

Hi, Does anyone tried to run globalprotect while connected to FortiSASE? Is it possible to run 2 VPN connections on windows simultaneously?  

Dear All. I have doubt why we configure - config firewall addressedit "test-reservedset country zzend  thank you.

How Fortinet Blocks ICMP Error Reporting Packets thanks.

Hello there, it should be possible to create this same VLAN ID and IP on both interfaces Hardware Switch and FortLink?Because I made it and not sure this is correct way and traffic between this interfaces but same VLAN will work.FortiLink:Hardware Switch:Basically I need to make connection between new network on FortiSwitches connected with Fortilink to FortiGates  and old network on different vendor switches there.VoIP phones from new network need to connect with server on with VoIP central that is located with old network. How is best to achieve this:Create new VLAN on FortiLinkAssigne to Port on FortiSwitchMake policy with NAT one to one?Normally that should be the way but I need it to work with LLDP profile with CDP (Cisco Discover Protocol) so that Phones after connecting to port will automatically connect with VoIP central and download config.