Solved

Good day, IKEv2 Dial-In Clients [198.18.25.0/24] connect successfully via FortiGate to the Intranet 192.168.0.0/16.But they cannot connect to a branch office network [172.16.0.0/16] which is also connected as a Site-2-Site VPN on that FortiGate The firewall policies are set to "allow" accordingly for these IKEv2 clients.The Intranet 192.168.0.0/16 can reach the destinations in 172.16.0.0/16 over that Site-2-Site VPN. Phase 2 is up:name=Site2Site ver=2 serial=1 XXXXXXXXXXXX:0->YYYYYYYYY:0 tun_id=YYYYYYYYYYY tun_id6=::YYYYYYYYYYY dst_mtu=1500 dpd-link=on weight=1bound_if=16 lgwy=static/1 tun=intf mode=auto/1 encap=none/552 options[0228]=npu frag-rfc run_state=0 role=primary accept_traffic=0 overlay_id=0proxyid_num=4 child_num=0 refcnt=7 ilast=1 olast=1 ad=/0stat: rxp=10256 txp=6843 rxb=12044848 txb=1178486dpd: mode=on-demand on=1 idle=30000ms retry=3 count=0 seqno=6natt: mode=none draft=0 interval=0 remote_port=0fec: egress=0 ingress=0proxyid=Site2Site proto=0 sa=1

Hi all, I'm having some issues with port forwarding. I'm running fortinet v7.0.5. I have a Windows Server running Tomcat 8.5 which is running my website. I've succesfully managed to import my SSL certificates into tomcat (on my windows server, going into https://localhost:8443/ i can see the certificate (shows as error, because the domain doesnt match, but all of the information about the CA etc is there, so its working okay). But when i go through https://domain.com:8443/ i get Unable to connect - An error occurred during a connection to domain.com. If i go to https://domain.com (without the port) i get The connection has timed out - An error occurred during a connection to  Now i have a public ip on my fortinet wan, which is used mostly just for ssl-vpn to remote into my workspace when im at home. I've added 2 VIP's one for port 80 and one for port 8443(https) - port 8443 seems to get hits, but cant load, and port 8443 reports as closed when using tools to ch

Hi, I am trying to add ips signature and I want to know rate based settings default value. Does anyone know what the default value is? 

Greetings.I have a FortiGate-80F router and a website with domain somedomain.comNow I need to set it up, so that whenever a user from WAN loads the website (port 443, https), he will be forwarded to a webserver on my internal network. Also, if the user loads some subdomain, but with same 443 port, his request will be forwarded to another webserver.In the routers UI > Policy & Objects > VIPs there is a configuration type FQDN, but setting it doesn't do anything, internal websites are still inaccessible from outside.Please, help solving this problem.

Hello  I have to change an HA password for security reasons and is it best to change from the GUI or the CLI?Is the only place that needs to be changed is on System > HA > Primary device and change it there - then that should populate it to the Secondary HA2? Thank you. I know it is kind of basic but just making sure there is no gotcha's.

Hello, is there an opportunity to bind a VLAN (subnet) to one specific physical port which is not in an SW/HW switch on a FortiGate ? My problem is, that I actually have configured a hardware switch containing one pyhsical port within the FortiGate and also have created a VLAN on that switch. So, that I would have a tagged VLAN on that port.That would have been alright, if the FortiGate would not force me to assign an IP address to that hardware switch (but not the VLAN). I also do not understand why an IP address is necessary for a L2 switch. Is there any documentation how FortiGates understand the concept of VLAN (Access, Trunk, Hybrid)? best regardsMartin Haneke

Hello, how can one aggregate many IKEv1 and IKEv2 dial-in peers in one Firewall policy ruleset? I have approx. 80 IPSec dial-in tunnels defined. Each of which would need an own firewall rule to access the IP-Pool "IPSecClient_IP-range" which is dedicated to IKE-Config mode. See sample below: config firewall policyedit NNset name "IPSec Client"set uuid 3da34a02-nnn-nnn-8f09-f6ef3d7ennnnset srcintf "IPSec Tunnel Client"set dstintf "INTRANET"set action acceptset srcaddr "IPSecClient_IP-range"set dstaddr "all"set schedule "always"set service "ALL"nextend Is there an opportunity to create such a rule for a number of IPSec clients?Or do You have an idea to bulk create the necessary rulesets? best regardsMartin Haneke   

I have a 1101e firewall. After the 7.0.14 update, ram usage increased from 41 to 70 in a meaningless way. It switches to conserve once a week. Do you have any idea? 

Hello, My Fortigate VM isn't syncing with FortiToken Cloud. When I try to synchronize using "exec fortitoken-cloud sync local," it fails :  "FGVMEV167DQDX5F5 # exec fortitoken-cloud sync localCannot retrieve user information from FortiToken Cloud!Command fail. Return code -1" After investigating, I found the issue lies in the SSL handshake not completing between the Fortigate and FortiToken Cloud. The SSL minimum protocol version is currently set to TLSv1: "FGVMEV167DQDX5F5 (global) # get | grep ssl-min-proto-versionssl-min-proto-version: TLSv1 " I need to change this to TLSv1.2, but the option isn't available : "FGVMEV167DQDX5F5 # config system globalFGVMEV167DQDX5F5 (global) # set ssl-min-proto-versionSSLv3 SSLv3.TLSv1 TLSv1.FGVMEV167DQDX5F5 (global) #"Any help or solution would be appreciated.   

Good morning friends, a question.I need to increase the disk space in the FortiAnalyzer VM, the reason is because we have 8 synchronized fortigates and the complete information is not displayed in the FAZ. Then the TAC recommended that the record disk be increased. https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Extending-disk-space-in-FortiAnalyzer-VM/ta-p/194365My problem is that I don't know how much space I should increase, is there some kind of formula? to calculate the space I need   

Fortigate is not sending icmp redirects."icmp-send-redirect" is setting enable.I would like to be able to send ICMP redirects using the case 2 pattern.If the PC is in the same segment as the FW,ICMP redirect responses are possible.However, if there is a router between the PC and the FW and they are on different segments,ICMP redirect responses will not be received. QAren't ICMP redirects sent to another segment?How does it work?Case 1In this case, the FW sent an ICMP redirect.PC①------[FW①]------PC②　　　|　　　----[FW②]------PC③settingPC①：192.168.1.1/24PC②：192.168.2.1/24PC③：192.168.3.1/24routingPC①: Default gateway is FW①FW①: Setting static route "Gateway of destination PC③ is FW②" Case 2PC①----[RT①]------[FW①]------PC②　　　　　　　　|　　　　　　　　----[FW②]------PC③settingPC①：192.168.1.1/24PC②：192.168.2.1/24PC③：192.168.3.1/24RT①：Do not use NATroutingPC①: Default gateway is RT①FW①: Setting static route "Gateway of destination PC③ is FW②"FW②: Setting static route "Gateway of destination PC① is

Hello, in a transition from another manufacturers router to Fortigate I have to transpose IKEv2 Dial-In Client configurations into FortiOS 7.2.8. Although the necessary parameters should match. The connections do not work. Therefore I tried to troubleshoot the IKE connections with the following CLI commands: diagnose debug application ike -1diagnose vpn ike log-filter src-addr4 <remote WAN-IP> alternatively: diagnose vpn ike log-filter dst-addr4 <local WAN-IP>diagnose debug console timestamp enablediagnose debug enable But there are only empty lines. I double-checked that the dial-up client could reach the Fortigate and successfully pcap´ed.Although I am new to FortiOS I would bet that there is a debug command to have a live view / monitor the setup negotiations of IKE phase 1 and IPSec phase 2 connections. But I have no clue how start these. Your hints would be appreciated. The Admin-Guide https://docs.fortinet.com/document/fortigate/7.2.8/administratio

I just got a FortiGate FG-40F-3G4G and I need to move the GSM antenna to the roof to get a proper signal (about 10 yards from where the router is located). Is there a readily available cable I can use? And if not, where can I find the specifications of the connectors I need in order to produce such a cable? Thx

I'm trying to work on some scenarios in my lab with KVM , but fortiOS 7.4.3 generates wrong serial number and i can't register virtual device on my account!does anyone have same issue o any solution to fix the problem?thanks

Hey guys, I'm starting to implement NAC-F on Google Cloud, but on the download portal, there is no ready-to-deploy template, would you have any suggestions? I found an implementation guide for GCP, which advises how to deploy using a tar.zg, but it still doesn't show objectively how to do it, if I use the .bin file to generate the tar.gz or some other procedure, follow the link below. FortiNAC Google Cloud Deployment Guide (fortinetweb.s3.amazonaws.com) FortiNAC Regards, Emerson   

I have multiple accounts with a fortigate vm in each region we use and I want to keep all us-east-1 traffic in us-east-1 unless it needs to leave the region.  I have setup a SDN Connector for the VPC where the the fortigate is.  Via that connector I can see all the instances, SGs ... in that VPC.  But do I only need the one connector for AWS or do I need multiples?  And by multiples I mean do I need a Connector for the other VPC (even if they cross accounts) in this region?

Hi, I would like to add a customer header to all mails received from Internet. Originally, I thought to add this as an action to my Content Profile. However, this does not work. I assume this is because the action does not "fire". Another approach which works is to enable domain specific disclaimers and then use "advanced options" > disclaimer on the domain configuration to set the header for all incoming mails. An ugly side effect of this approach is, that in the logs the Classifier is set to Disclaimer and the Disposition is set to Disclaimer Header. Are there other options to add a header to all incoming mail? Any advice appreciated. Thanks.

Hi Everyone. I have a Fortigate 80E on v6.0.12. I'm using 4 interfaces, interface 1 is incoming traffic going to interfaces 2, 3, and 4. If i click create new interface and put all 4 interfaces in a software/hardware switch interface, traffic flows between them automatically. When i separate them out and try to route traffic from interface 1 to interface 2 or interface 1 to interface 3 or interface 1 to interface 4 it doesn't work which is weird. They are all on the same subnet using same gateway ip, just 3 different webservers interfaces 2,3,4. I made a policy to allow all traffic between interface 1 (incoming int./source) and interface 2 (outgoing int./destination) as a test and it doesn't show any traffic going through the policy at all. I've tried creating multiple policies and none of them get used no matter what i do and the implicit deny isn't blocking any traffic, yet connection to the web server sites through interfaces 2, 3, and 4 are still happening (if i put all 4 interface

how do i go in-depth to look at the bandwidth utilization to see what traffic is occupying the bandwidth ?this is the bandwidth widget in the dashboard

Hi, I create a software-switch and enabled DHCP server on it. I spesified the address range and created ip address assigment rules. I want to block unknown mac address. I added mac address - ip address reservetion. But implict rule action is assign ip. How can i change the ubknown mac address actionb to block?    

Good day, I was wondering if the FortiLink aggregation interface could be used as a trunk with a non-Fortinet switch. By default, ports x3 and x4 of the 200F are dedicated FortiLink ports. I would like to run ports x3 and x4 to an existing Cisco switch, soon to be replaced by two aggregate FortiSwitches. I was hoping to set up all of the VLANs on the FortiLink interface to have them ready for when we move the connections over to the FortiSwitches. I'm hoping that traffic will still route out over the trunk properly when using FortiLink connections connected to a non-Fortinet switch.  Thank you,FortiBagel #FortiSwitch#FortiLink

Hello team!!! We manage many Fortigates in different sites and recently upgraded all to 7.4.3After this, we have problem accessing to some fortigates through some wan interfacesFor example I can access through wan2 but not through wan1, or in other cases, I cant access from wan1 nor wan2.  The issue started after upgrading the firmware version to 7.4.3The issue is that the page remains loading and wont load, keep trying to access but after some seconds the browser shows me that the page cannot be displayedWe use the same port to access to fortigates, different of the default 9443 * We tried to change the port but the issue persists* We disabled and re-enabled https in each interface, with the same issue* SSH works well in any interface* We cannot connect to Fortigate with telnet, using the same port. Any idea?Thanks in advance.Regards,Damián

Hi, I am currently looking for the Security POP IP Address of known locations for provisioning purposes. Thank you in advance for your attention to this matter. I eagerly anticipate your response and look forward to provide the Security POP IP Address provided below. 1. Sydney - Australia2. Vancouver - Canada3. San Jose - California Thanks and Regards,Rakesh

Hi,We are using FortiGate firerwall(v7.2.5 build1517) and the FortiClient SSL VPN(v7.0.70345) on all our laptops, the problem is that the FortiClient VPN keeps on disconnecting even though the internet connection is available on the laptops. This is happening intermediately.Can you please advise what could be the cause of this issue?Thank you in advanceKind Regards,Abel 

Hi All,I've configured a Fortigate to Fortigate VPN, created a Loopback Address and assigned a Public IP.The VPN uses BGP to advertise the Public IP and and receive the default route from the Hub. The Spoke isn't able to connect to Central Management with this config (I've got Fortiguard connected and have also changed the source IP for DNS and confirmed DNS lookups are working) I see there is supposed to be a command under config system central-management that would allow me to set a source IP, but this doesn't exist on my Firewall. Is this something that has been removed in v7.4 and is there another method I need to use for this? Or an I missing something that I need to enable for this? These are the only options that I see: (central-management) # setmode Central management mode.type Central management type.schedule-config-restore Enable/disable allowing the central management server to restore the configuration of this FortiGate.schedule-script-restore Enable/dis