Solved

Good day guys.I have the following setup.200F with dual WAN4 tunnels to AWS (the usual IPSEC with 2 tunnels).Probably, next year, hopefully, I will have AWS Direct Connect.Let´s begin with the IPSEC tunnels first:I´m having issues with the ECMP on the AWS TGW, what I need is just failover between the tunnels, but I want to setup the priority in which they are used under normal conditions, like in the following graph:  I want to influence the traffic (inbound and outbound) so it has the Tunnels in this order of preference: Main_Tunnel01Main_Tunnel02Secondary_Tunnel01Secondary_Tunnel02OrMain IPSECSecondary IPSECRight now, what I´m having (with ECMP disabled) is that I´m loosing traffic partially if I lose a Tunnel. If I enable ECMP, I get traffic through all the tunnels, and I do not want that. I found the Technical Tip : Difference between asymmetric routing and auxiliary sessions., I will testing that also, but right now I´m confussed with this AWS documentatio

Hi,   i was wondering.  Is there a way to put a ha cluster in maintenance mode?  With maintenance mode i mean, there will be no response to heartbeat failures for example.  Primary member remains active.  Secondary remains not active.  This would be handy in a situation where there is maintenance on the networking infrastructure between two sites, impacting the hearbeats between the nodes.  And we want to prevent split brain scenario's...   Ofcourse, we can shutdown the secundary node.  But since the used Fortigates cannot be powered on again remotely without someone going physically onsite to press the power button...

I try to solve a (maybe) edge case for a customer:   The Customer has multiple Website behind a Fortigate which he would like to make public available: web1.domain1.tld web2.domain1.tld web3.domain2.tld There is only 1 public IP Address. All the Website should be available on Port 443 (HTTPS). The Websites should be protected by WAF.   What I have tried: I can make the first two Websites (web1, web2) available with "Virtual Servers" and by using a Wildcard (public signed) certificate. Then I used a Firewall Rule with a Web Application Firewall Profile to secure the Servers. But then web3 cannot be added because it is using a different Domain.   I also tried it with ZTNA, Proxy Policy and by disabling the Client Certificate requirement by setting "set client-cert disable". This way I was able to publish all of the 3 Domains. But that way i cannot use any protection as Web Application Firewall cannot be used together with ZTNA as far as i know. Also, i noticed, that when

how do i enable disk logging in FG100F?i dont see the option in both CLI n GUI for disk, only memory and fortianalyzer.  

i have setup STMP server under Settings -> Email Service, for sending emails alerts for our FG100F.but it does not seems to work.what else must I enabled on the firewall.firmware version is 7.2.5

Hi,         I have a question about hairpin NAT. When doing hairpin between two interfaces of FGT, do I have to create/use public VIP for the source and destination? I found out it works without NAT as well. What type of specific case do I have to use NAT? Thank you.

Might be a simple one for you. Any hint is appreciated.I have a FGT-60F cluster that has an active LDAP server pointing to an AD server that is located on a local "internal1" interface. This connection works fine. If I do "Test Connectivity", I can see in the packet capture (on internal1) some LDAP bindrequests on port 389. LDAP works perfectly. I want now to add another LDAP Server that is located behind an IPSec VPN. However, the packet capture on the VPN interface does not show any LDAP traffic at all when I do "Test Connectivity".  Routing is correct. Traffic beween local interface and remote network via VPN tunnel is working fine. I suspect a policy issue, but I have to admit I am puzzled. Since the fortigate is the originator of the LDAP requests, what do I have to choose for the originating interface in the policy setup?And why do I not have to setup a policy for the LDAP Server on the internal1 interface? In any case, how would I, step by step, troubles

We just ran into this: today our FortiMail states it has no antispam and virus outbreak license.It did have one because it also states the last update of the antispam definitions was on 2024-02-06 and it cannot do that without vallid license. If I look into support portal I can see that our License bundle includes both licenses and they are both valid until 2027.FortiMail also states that FortiGuard services are reachable. I also opened a ticket with TAC on this as this should not at all happen for security reasons! cheersSebastian

Hello, I have a mystery on a Fortigate.I have a security group that block Facebook using application control and webfilter categories.My users told by that they still can use Facebook. I checked the log and I see that most of the traffic linked to Facebook is blocked, but, I have some line with allowed traffic to facebook, using the same firewall policy. it's unbelievable, my own rules which block Facebook is also allowing it.How this is possible ?    

Hi All, We are running different tenant (Azure Intra ID), and want to integrate with FortiSIEM, we have created application and defined the credentials in FortiSIEM, and assigned in credential association tab as manage.office.com. Now the confusion is that we can not create the same entry with manage.office.com and we have assigned 2 credential at a time as it allows us to do so. But we can see logs from one of the tenant the other one is not showing any events. Any one has any experience with this scenario before ? TIA

Do the Forti syslogs also contain the DHCP logs if the Forti is responsible for DHCP?

Installed FortiClient to see if the standalone web filtering would work for a few of our mobile users; however, despite having categories enabled, it seems to lump all websites into the "unrated" category.  I can block every category available except unrated and have access to the entire web...until I block the unrated category, then I only have access to my exceptions list.  What am I doing wrong?  Is this by design on the free version?  If I click wrong category (after i've added fortinet.net to exceptions), it goes to a page on fortinet.net which displays the proper category. 

Hi, I can't ping WAN IPs from the LAN. The only IP address I can ping is the one configured on the WAN interface.   ES:WAN interface - 192.168.10.1/29LAN interface - 192.168.1.1/24 From the LAN if I ping the IP address 192.168.10.1 I will reach it. However, if I try to ping the IP addresses 192.168.10.2, 192.168.10.3, 192.168.10.4, 192.168.10.5 and 192.168.10.6, I cannot reach them   Have i nice day Andrea

Dear All   I just purchased EMS last week and setup finished, everything seems fine at EMS server. I want to use EMS ZTNA to control SSLVPN user who only match zero trust tag can access lan server. When I added the tag make my SSLVPN cannot access my Local LAN, removed it everything is fine. Any step I am missing or incorrect setup ?   Resolved Address can see my vpn ip View matched endpoint can see my laptop, but it still show 0  when I move the mouse on it.         Firewall policy added tag - cannot access lan server Removed tag everything fine Connection is ok      I can view all zero trust tag at EMS portal   Creat new tag "Test" and fortigate also can show up        

Hi,  I have a dual hub topology active-active. I configure BGP on the hub with Capability: default originate enable, to inject the default route to the branch.  In the branch i can see on the routing table 4 default route 2 for HUB1 and 2 for the HUB2..   ex: Routing table branch         0.0.0.0/0 [5/0] via 172.16.1.1, HUB-1-1_0 active   sdwan routes                  [5/0] via 172.17.1.1, HUB-1-2_0 active                  [5/0] via 172.16.2.1, HUB-2-1_0 active                  [5/0] via 172.17.2.1, HUB-2-2_0 active   The question is.It is possible or how can i do that in the branch fgt prefer o inject on the routing table the default route for HUB1 and just in case the connection for H

Hi all, I just want to confirm about the command "diagnose debug enable".If I enabled "diag debug enable" command in Fortigate it will only enabled only for 30 min or it will run as long as I don't reset or manually disable the debug?Also , after I reboot or shutdown the FortiGate , "diag debug" state will still be enable state or disabled state when it comes up? Thank you

Good afternoon,  We have a FG-60F with 2 SD-WAN zones. The first one for corporate use is connected to a single Starlink antenna. The second SD-WAN zone for client use is connected to 2 Starlink antennas. These 2 apply load balancing to maximize bandwidth. The problem is that we can't use both SD-WAN zones at the same time for their respective uses because the 2 Starlink antennas all use the same gateway IP 100.64.0.1. Whenever I set a static route 0.0.0.0 to use this IP it will only work for SD-WAN zone 1 or 2, not both Can this be fixed using policy based routing instead of static routes? Or is there another way to get this to work correctly? Unfortunately, we're unable to change the gateway address of the Starlink devices.   Thanks in advance, 

Anyone else having issues with support.fortinet.com?Connecting from Denmark, and it's now taken 1.5 hours to register 2 support contracts.. Seems like the site is having issues..

Doesn anybody know if the VPN SSL can be setup in fortigate that is runnig 7.4 with a evaluation licence ?   This is error thta I am getting unable to establish the vpn connection, The VPN server is unreachable or your identity certificat is not trusted (-5)   Thanks in advance..    

Hi,I have deployed a forticlient to a few hundred computers and recently noticed that all users are unverified, so how can I set all of these users to verified or skip user verification. Thanks in advance,

Dear Team,I currently want to fetch a log from a Supervisor/Collector in an operational environment and import this log into the Supervisor/Collector in my LAB environment. This will allow me to create a rule to trigger incidents and finally import this rule into the operational environment. Therefore, I would like to know whether there is a more convenient method to achieve this goal (fetching and importing logs), other than directly capturing the raw log through tcpdump in the CLI of the Supervisor/Collector. Best Regards,Bruce 

Hi,I went through built-in event handlers in FAZ and found some windows privilege escalation handlers. Could I use them with Windows Servers without Forticlient installed? If so, is there any cookbook or docs how to set it up? ThanksRobert

I'm migrating a voip phone system to its own (virtual) interface and subnet on a fortigate firewall.   The idea was to first configure each phone to point to what will be the PBX's new IP address (172.17.200.2). Since the current config on all the phones use the old PBX IP, the PBX's IP address (172.17.2.254) will be the last thing to change (after all the phones have been reconfigured).   So, since there won't be an actual device at 172.17.200.2 during the transition, I'm trying to figure out a way to forward traffic sent to the new IP (172.17.200.2) and forward it to the old IP (172.17.2.254).   What would be the best approach? Just a firewall rule with the old IP as the source and the new IP as the destination, enable nat, and enable preserve source port? Or is there a different approach I should use?   I'm running firmware 7.2.6.   Thanks :)

Hi Guys Scenario: FortiAnalyzer VM64 (Rel 7.4.1) in private cloud, Fortigate(s) send logs via public IP Address to FortiAnalyzer IP Address. Public IP Address listened on port TCP/UDP 514 I follow Fortinet doc's. I authorized Fortigate on Fortianalyzer. Traffic from Fortigate to FortiAnalyzer run correctly (test/sniffer packet etc)   Where is these logs???? :)   Thank you guys

Hello! I am setting up a service that will live behind the Fortigate Firewall and I have the Virtual IP setup. I have inbound and outbound rules setup that should allow traffic, however when I try to ping or anything else to the virtual IP I don't get any response. Because the Public IP will only be used for the service I don't have NAT setup. This firewall also is only connected to one line out to our ISP who also has us a block of IP addresses. Here is the rule:Incoming Interface: Virtual Wan LinkOutgoing: Internal ServiceSource: AllDestination: VIPSchedule: AlwaysService AllNAT disabled. Other rule:Incoming Interface: Internal ServiceOutgoing: Virtual Wan LinkSource: allDestination: allSchedule: alwaysService: AllNAT Disabled Is there anything I am missing?