Solved

My current ssl portal I have set up for my users doesnt have host check or split tunneling enabled.I created an ssl portal with hostcheking and split tunneling enabled, and created corresponding policies for it.Then I added the same users to the new portal. When trying to hit the policy its going over the old policy and and ssl portal. is there a way to prioritize the new portal with hostcheck/split tunneling. Or is reusing the same exact users on both portals creating an issue? Thank you.

Hello,I'm using policy-based mode on FortiGate and I have a problem with URL filtering. I have set up the rules as described here https://docs.fortinet.com/document/fortigate/7.2.0/new-features/472314/allow-web-filter-category-groups-to-be-selected-in-ngfw-policies and I have the rule targeting a user group. In the log, I see a deny rule that says the page is Unrated, but on the https://www.fortiguard.com/webfilter site, I can see that the page has a category. I am sending log: date=2023-12-16 time=16:33:02 eventtime=1702740782183012282 tz="+0100" logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="root" policyid=74 poluuid="7b975724-9285-51ee-f073-60f6db8bd24e" policytype="security-policy" sessionid=180151 user="Domain_user" authserver="FSSO_server" srcip=10.1.1.1 srcport=50104 srccountry="Reserved" srcintf="VLAN" srcintfrole="lan" srcuuid="efa45e5a-56d5-51ee-ff05-d73441199146" dstip=85.207.58.49 dstport=443 dstcountry="Czech Republic"

Hi,I just set up SSL VPN on a 60F. I know the process and have done it before, nothing new, but not today. VPN client stops at 10% with the error visible. But I see traffic when sniffing (diagnose sniffer packet wan1 none 1 100)? (Connecting to a different site is working fine!)     This is my current config. There is only one local user in vpn_grp. HTTPS port (administration) is set to 8443.Its my personal box which I am using at home. There is no license, even no FortiCare.Laptop I am trying to connect with is online via 5G internet. Any hint is highly appreciated! Desperately trying since 2 hours now. Thanks!

I have a loopback 10.222.80.1 configured (1) I have advertised the same prefix in BGP. (2) The BGP neighbor 10.4.10.1 in question is healthy with 159 routes received (3) Why is this prefix not advertised via BGP? (4)     

Hello,I'm using policy-based mode on FortiGate and I have a problem with URL filtering. I have set up the rules as described here https://docs.fortinet.com/document/fortigate/7.2.0/new-features/472314/allow-web-filter-category-gro... and I have the rule targeting a user group. In the log, I see a deny rule that says the page is Unrated, but on the https://www.fortiguard.com/webfilter site, I can see that the page has a category.I am sending log:date=2023-12-16 time=16:33:02 eventtime=1702740782183012282 tz="+0100" logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="root" policyid=74 poluuid="7b975724-9285-51ee-f073-60f6db8bd24e" policytype="security-policy" sessionid=180151 user="Domain_user" authserver="FSSO_server" srcip=10.1.1.1 srcport=50104 srccountry="Reserved" srcintf="VLAN" srcintfrole="lan" srcuuid="efa45e5a-56d5-51ee-ff05-d73441199146" dstip=85.207.58.49 dstport=443 dstcountry="Czech Republic" dstintf="wan1"

How do I schedule a reboot in FortiGate firewall at a certain time from remote ?

Hi, We have a Fortigate cluster deployed in Azure. The design includes an internal and external Azure load balancer. We cannot connect from a server behind the cluster using the FileZilla client outbound to the Internet (client > internal load balancer > fortigate > ext lb > ftp server). The external FTP server is configured to use passive mode and the client is also configured to use passive. We have tried enabling all ports outbound to the target and have deleted the FTP session helper - it doesn't help. The FTP server is configured to request a conn on 5000-5100 FileZilla responds withStatus: Connection established, waiting for welcome message...Trace: CRealControlSocket::OnSocketError(106)Trace: CRealControlSocket::DoClose(66)Trace: CControlSocket::DoClose(66)Trace: CFtpControlSocket::ResetOperation(66)Trace: CControlSocket::ResetOperation(66)Trace: CFtpLogonOpData::Reset(66) in state 1Error: Could not connect to serverTrace: CFileZillaEnginePrivate:

Hi All,I've created a VLAN for 2 IoT devices.I have not received any network requirements for them.I want to create a policy which locks them down to only the essential required outbound ports and destinations.How can I achieve this? Is it using debug flow? I find it hard to get the information I need from it?Any help will be appreciated.Many thanks,

Dear All,              I have an ugent issue, after the 2 fortigate 201F configured in HA Active Active, the secondary devices stop to have network connectivity, not even the mgmt interface, i can not ping and access to the secondary devices, i have tried to factory reset the secondary device and form the HA again, and issue still exist, and i followed below video to do the HA, any help would be appreicated  https://www.youtube.com/watch?v=j25SwFGa76M piaakit

Hi All,    FortiLink was working fine, with a FortiSwitch connected on port A of a 60f. All kit lost power, and now port A is still showing up and green but the FortiLink doesn't and is down.    If I add port B to the FortiLink it momentarily comes back up but then drops again.    Switch is up and working, uplink port is up and connected. I have checked NTP on the FortiLink but not sure what else to do from here pending a reboot etc? Any thoughts?   Thanks, 

Hi, I would like to ask where I can edit the emails that I receive thanks to the Interface status changed notification. The default email is not easy to read. date=2023-12-15 time=05:17:13 devid="XXXXXXXXXXX" devname="Device name" eventtime=1702613832734597809 tz="+0100" logid="0100020099" type="event" subtype="system" level="warning" vd="root" logdesc="Interface status changed" action="interface-stat-change" status="DOWN" msg="Link monitor: Interface internal1 was turned down" Thank you very much.

Hello,I'm trying to get started in FortiAnalyzer # and I'm running into a problem. I have added all the Fortigates that I manage to FortiAnalyzer and now when I look at the logs I only see a column with the Device ID, which is the serial number of the firewalls. However, I don't have all the serial numbers in my head, so I would have liked to have a Device Name column there. I don't see that optioCould someone please advise me?

Hi everybody,After upgrading our #FortiNAC and #Fortinac Manager fro 9.2 to 9.4 I'm not able to access some configuration such as guest and contractors and portal configuratioThe users and their privileges are the same, with the 9.2 version I was able to everything (admin profile) but after the upgrade I cannot.I created also a new user with all the privileges but when I try to access to the guest and contractor section i have the following message: You do not have the permission to access this page.How can I fix this issue??? Thaks Fabio

Hi I want give my users internet based on their AD credential. In firewall policy if i select users or users group i should choose a address or something else. If i choose all+user group is that going to give internet only to specified users or all of them?

I have been asked to explore captive portal as an option for guests wireless, I see in the docs its OPEN (ie no encryption) for the initial connection. Does it ever flip to an encrypted channel post validation?

I have a question regarding auto-negotiate and keepalive as it relates to the IPSEC configuration. I understand the functionality from reading the following article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-the-IPSec-auto-negotiate-and-keepalive/ta-p/189536. My question is fairly simple but have not been able to find a definitive answer. Do these settings get applied to both Fortigate appliances or only on one side? My end goal is to have the tunnels always up unless the circuit is down on either side.   

Hi,If i create a policy from wan to lan with security profiles enabled, is that going to protect the inbound traffic to my lan? And also do i need to enable nat for this traffic direction?

Hi, My 200F FGT does not have hard disk. So which software is best to have logs with a great user friendly interface? Free or paid ones.

Hi How can i block internet access when remote users connect to fgt with foriclient vpn app?

Dear All,                i have a question on SD WAN redundancy , if i'm gong to use SD Wan rule & performance SLA for redundancy, below are the setting i did, just wonder base on which setting to determine the failover and priorities which circuit to use first ? for instance if wan1 down it will failover to wan2, and if wan1 resume, it will failover back to wan1, and how do i set if i want use load balancing and where to determine the % to use on which circuit ? any help would be appreicated   SD Wan rule Interface selection strategyManualManually assign outgoing interfaces.Best qualityThe interface with the best measured performance is selected.Lowest cost (SLA)The interface that meets SLA targets is selected. When there is a tie, the interface with the lowest assigned cost is selected.Interface preferenceWAN1 (port1)WAN2 (port2)Zone preferenceMeasured SLADefault_Google SearchRequired SLA targetQuality criteria

Hi, Have an Issue with an IPSec Site-to-Site between set of Fortigate units:1 x 200E behind a public IP / LAN 10.184.0.0/161 x 60F behind a dynamic, natted IP. / LAN 10.151.0.0/16I'm running 7.0.2 I've established the tunnel, using dial-in from the 60F, all easy enough.Problem is that it seems no traffic is exiting the 200E, over the tunnel (outgoing data remains at 0).In the other direction It seems to work fine (so from 60F to 200E) I've checked policies, and done some packet sniffing, and all the policies are fine, the packets enter the tunnel, I can see this in a sniff capture as well as in the counters of the policies. However, when I sniff on the WAN port, no outgoing data whatsoever. It seems like the data is entering the tunnel but not encapsulated on the WAN port? This is the Sniffer on the Tunnel IF. MeetMe-FGT200E # diagnose sniffer packet VPN-TO-Koreainterfaces=[VPN-TO-Korea]filters=[none]pcap_lookupnet: VPN-TO-Korea: no IPv4 address assigned4.93274

Hi all, I am planning to conduct feasibility check on Fortigate 200F with Okta authentication for SSL VPN. So I need some clarification on configurations changes and impact to productions environment. Here are my questions: -Is it possible to integrate with Okta using specific VDOM only? does it affect global config?Is there any impacts if t testing on VDOM in production environment?Any guidance or steps that I can refer?Is it possible to test integration with Okta developer account?  Thanks,

Hello all, We are in discussion with a customer that likes to host the FortiSIEM on prem but considers moving to our multi-tenant-cloud-environment some day in future.As we are just setting up the SIEM, I would like to build the environment in a way that this migration might be possible. Most interesting thing would be the eventdb for me here (as the parsers, reports, etc. might just be ex- and imported). Has anyone done a similar thing before? Moving the eventdb to another (already running) FortiSIEM? The target system is on ClickHouse. The on-prem system can be anything as we have not set it up yet: Local, NFS, ClickHouse; we can also set it up as enterprise oder service provider mode.It would also be enough to just have the eventdb in archive-format for the transfer, since it's all just about "keeping logs for 365 days". Thanks already for any kind of input :)Best,Christian

Hi, I am looking to go for the FCP Network Security Certification. However it says the core exam is NSE 4 FortiOS but I don't see that on the website anywhere. When I look at the training material it's all in sections like FortiGate Administrator, FortiAuthenticator Administrator etc. Do I have to do all of it to prepare for the exam or only things that mention FortiGate? I am a little confused. Thanks

hi,is it possible to configure continously using CLI instead of type 'end' in each configuration section.for example, after i've configured mgmt ip i can go straight to 'config router static' and type 'end' after the mgmt and static default route are configured? or will the system reject it? edit - i just tried and indeed rejected the command when i go straight to 'config router static'is there a way to type commands continuously or is it required typing 'end' each config section? FG# config system interfaceFG(interface) # edit mgmtFG(mgmt) # set ip 192.168.200.202/24FG(mgmt) # set allowaccess ping ssh httpsFG(mgmt) # end   <<< CAN I SKIP THIS?FG # config router staticFG(static) # edit 99new entry '99' addedFG(99) # set dst 0.0.0.0/0FG(99) # set gateway 192.168.200.1FG(99) # set device mgmtFG(99) # end ----- FG(mgmt) # set allowaccess ping ssh httpsFG(mgmt) # config router staticcommand parse error before 'router'Command fail. Return code 1