Solved

Hi,         I have a question about hairpin NAT. When doing hairpin between two interfaces of FGT, do I have to create/use public VIP for the source and destination? I found out it works without NAT as well. What type of specific case do I have to use NAT? Thank you.

Might be a simple one for you. Any hint is appreciated.I have a FGT-60F cluster that has an active LDAP server pointing to an AD server that is located on a local "internal1" interface. This connection works fine. If I do "Test Connectivity", I can see in the packet capture (on internal1) some LDAP bindrequests on port 389. LDAP works perfectly. I want now to add another LDAP Server that is located behind an IPSec VPN. However, the packet capture on the VPN interface does not show any LDAP traffic at all when I do "Test Connectivity".  Routing is correct. Traffic beween local interface and remote network via VPN tunnel is working fine. I suspect a policy issue, but I have to admit I am puzzled. Since the fortigate is the originator of the LDAP requests, what do I have to choose for the originating interface in the policy setup?And why do I not have to setup a policy for the LDAP Server on the internal1 interface? In any case, how would I, step by step, troubles

We just ran into this: today our FortiMail states it has no antispam and virus outbreak license.It did have one because it also states the last update of the antispam definitions was on 2024-02-06 and it cannot do that without vallid license. If I look into support portal I can see that our License bundle includes both licenses and they are both valid until 2027.FortiMail also states that FortiGuard services are reachable. I also opened a ticket with TAC on this as this should not at all happen for security reasons! cheersSebastian

Hello, I have a mystery on a Fortigate.I have a security group that block Facebook using application control and webfilter categories.My users told by that they still can use Facebook. I checked the log and I see that most of the traffic linked to Facebook is blocked, but, I have some line with allowed traffic to facebook, using the same firewall policy. it's unbelievable, my own rules which block Facebook is also allowing it.How this is possible ?    

Hi All, We are running different tenant (Azure Intra ID), and want to integrate with FortiSIEM, we have created application and defined the credentials in FortiSIEM, and assigned in credential association tab as manage.office.com. Now the confusion is that we can not create the same entry with manage.office.com and we have assigned 2 credential at a time as it allows us to do so. But we can see logs from one of the tenant the other one is not showing any events. Any one has any experience with this scenario before ? TIA

Do the Forti syslogs also contain the DHCP logs if the Forti is responsible for DHCP?

Installed FortiClient to see if the standalone web filtering would work for a few of our mobile users; however, despite having categories enabled, it seems to lump all websites into the "unrated" category.  I can block every category available except unrated and have access to the entire web...until I block the unrated category, then I only have access to my exceptions list.  What am I doing wrong?  Is this by design on the free version?  If I click wrong category (after i've added fortinet.net to exceptions), it goes to a page on fortinet.net which displays the proper category. 

Hi, I can't ping WAN IPs from the LAN. The only IP address I can ping is the one configured on the WAN interface.   ES:WAN interface - 192.168.10.1/29LAN interface - 192.168.1.1/24 From the LAN if I ping the IP address 192.168.10.1 I will reach it. However, if I try to ping the IP addresses 192.168.10.2, 192.168.10.3, 192.168.10.4, 192.168.10.5 and 192.168.10.6, I cannot reach them   Have i nice day Andrea

Dear All   I just purchased EMS last week and setup finished, everything seems fine at EMS server. I want to use EMS ZTNA to control SSLVPN user who only match zero trust tag can access lan server. When I added the tag make my SSLVPN cannot access my Local LAN, removed it everything is fine. Any step I am missing or incorrect setup ?   Resolved Address can see my vpn ip View matched endpoint can see my laptop, but it still show 0  when I move the mouse on it.         Firewall policy added tag - cannot access lan server Removed tag everything fine Connection is ok      I can view all zero trust tag at EMS portal   Creat new tag "Test" and fortigate also can show up        

Hi,  I have a dual hub topology active-active. I configure BGP on the hub with Capability: default originate enable, to inject the default route to the branch.  In the branch i can see on the routing table 4 default route 2 for HUB1 and 2 for the HUB2..   ex: Routing table branch         0.0.0.0/0 [5/0] via 172.16.1.1, HUB-1-1_0 active   sdwan routes                  [5/0] via 172.17.1.1, HUB-1-2_0 active                  [5/0] via 172.16.2.1, HUB-2-1_0 active                  [5/0] via 172.17.2.1, HUB-2-2_0 active   The question is.It is possible or how can i do that in the branch fgt prefer o inject on the routing table the default route for HUB1 and just in case the connection for H

Hi all, I just want to confirm about the command "diagnose debug enable".If I enabled "diag debug enable" command in Fortigate it will only enabled only for 30 min or it will run as long as I don't reset or manually disable the debug?Also , after I reboot or shutdown the FortiGate , "diag debug" state will still be enable state or disabled state when it comes up? Thank you

Good afternoon,  We have a FG-60F with 2 SD-WAN zones. The first one for corporate use is connected to a single Starlink antenna. The second SD-WAN zone for client use is connected to 2 Starlink antennas. These 2 apply load balancing to maximize bandwidth. The problem is that we can't use both SD-WAN zones at the same time for their respective uses because the 2 Starlink antennas all use the same gateway IP 100.64.0.1. Whenever I set a static route 0.0.0.0 to use this IP it will only work for SD-WAN zone 1 or 2, not both Can this be fixed using policy based routing instead of static routes? Or is there another way to get this to work correctly? Unfortunately, we're unable to change the gateway address of the Starlink devices.   Thanks in advance, 

Anyone else having issues with support.fortinet.com?Connecting from Denmark, and it's now taken 1.5 hours to register 2 support contracts.. Seems like the site is having issues..

Doesn anybody know if the VPN SSL can be setup in fortigate that is runnig 7.4 with a evaluation licence ?   This is error thta I am getting unable to establish the vpn connection, The VPN server is unreachable or your identity certificat is not trusted (-5)   Thanks in advance..    

Hi,I have deployed a forticlient to a few hundred computers and recently noticed that all users are unverified, so how can I set all of these users to verified or skip user verification. Thanks in advance,

Dear Team,I currently want to fetch a log from a Supervisor/Collector in an operational environment and import this log into the Supervisor/Collector in my LAB environment. This will allow me to create a rule to trigger incidents and finally import this rule into the operational environment. Therefore, I would like to know whether there is a more convenient method to achieve this goal (fetching and importing logs), other than directly capturing the raw log through tcpdump in the CLI of the Supervisor/Collector. Best Regards,Bruce 

Hi,I went through built-in event handlers in FAZ and found some windows privilege escalation handlers. Could I use them with Windows Servers without Forticlient installed? If so, is there any cookbook or docs how to set it up? ThanksRobert

I'm migrating a voip phone system to its own (virtual) interface and subnet on a fortigate firewall.   The idea was to first configure each phone to point to what will be the PBX's new IP address (172.17.200.2). Since the current config on all the phones use the old PBX IP, the PBX's IP address (172.17.2.254) will be the last thing to change (after all the phones have been reconfigured).   So, since there won't be an actual device at 172.17.200.2 during the transition, I'm trying to figure out a way to forward traffic sent to the new IP (172.17.200.2) and forward it to the old IP (172.17.2.254).   What would be the best approach? Just a firewall rule with the old IP as the source and the new IP as the destination, enable nat, and enable preserve source port? Or is there a different approach I should use?   I'm running firmware 7.2.6.   Thanks :)

Hi Guys Scenario: FortiAnalyzer VM64 (Rel 7.4.1) in private cloud, Fortigate(s) send logs via public IP Address to FortiAnalyzer IP Address. Public IP Address listened on port TCP/UDP 514 I follow Fortinet doc's. I authorized Fortigate on Fortianalyzer. Traffic from Fortigate to FortiAnalyzer run correctly (test/sniffer packet etc)   Where is these logs???? :)   Thank you guys

Hello! I am setting up a service that will live behind the Fortigate Firewall and I have the Virtual IP setup. I have inbound and outbound rules setup that should allow traffic, however when I try to ping or anything else to the virtual IP I don't get any response. Because the Public IP will only be used for the service I don't have NAT setup. This firewall also is only connected to one line out to our ISP who also has us a block of IP addresses. Here is the rule:Incoming Interface: Virtual Wan LinkOutgoing: Internal ServiceSource: AllDestination: VIPSchedule: AlwaysService AllNAT disabled. Other rule:Incoming Interface: Internal ServiceOutgoing: Virtual Wan LinkSource: allDestination: allSchedule: alwaysService: AllNAT Disabled Is there anything I am missing?

Hi all, i'm just configured a brand new HA between two Forti 200 f FortiOS 7.0.13,but impossible to synchronize due to error message in attach. Any clue on what it could be? TIS, MG

Does anyone ever use Web Vulnerability Scan in FortiWeb? Generated repoerts looks pretty poor (user friedly about 0%). How I can customize it? For example: one of the reports has about 8000 pages and it's not good at all (test report with test web-server). It is include full html http-response, but sometimes (in some vulnerabilities or suspected vulnerabilities) i don't need it at all. Can anyone help with it? Maybe in future versions of FortiWeb reports customiztion will be improved.I can't do anything except write a some script that will be parse report and delete extra data, but this doesn't seem like a good solution.

Hello everyone We still have some FP421E active which are managed by a fortigate. We are aware that those are end of support, end of sale, end of everything... Unfortunately I have difficulties to find an official (old) compatibility list with these FortiAPs listed, to find out how far I can update the managing fortigate in order to have those FP421E (on 6.4.9) still being supported (fortios wise) so that we can prepare the fortigate for newer FortiAP models... So far in the compatibiilty lists I found the only legacy models mentioned are the FAP221 and FAP223, but no FP421E... Anyone an idea where to find something official?

Hi guys,   Could anyone explain the difference between Shared and Per-IP traffic shapers? I ask this because the Fortinet documentation is different depending on the origin.   According to the Fortinet cookbook: A Shared shaper affects upload speeds whereas Per-IP shaper affects both upload and download speeds.   According to the FortiOS Handbook and NSE4: Shared Shaper: A shared shaper applies a total bandwidth to all traffic using that shaper. The scope can be per-policy or for all policies referencing that shaper. Per-IP Shaper: A per-IP shaper allows you to apply traffic shaping to all source IP addresses in the security policy, and bandwidth is equally divided among the group.   Do you see the difference? What is correct?   Regards, Julián

Dear All,   My Fortiswitches are not listed in the Fortimanager anymore after a swap of ADOM between 6.2 to 6.4 (FMG v6.4.12 The manager notices two switches are added to the switch-controller, but does not show them at all. Looking at the CLI I do see the switches listed in the switch-controller, afterwards tried to add them manually based on SN to the manager but I do get the notification; "failed to sent to device".   Anyone experienced this before?