Solved

Our fg100, running on 7.4.1, enters memory conserve mode every day at 4:41pm.  Support has sat with us and watched it happen for multiple days, they gather all the logs they need each time. They offer no solutions, their only response is "we need more logs".  If TAC has nothing better then I'm at a loss of what to do next.

HelloWhat are the features that are disabled when my FortiSIEM's license expires?

We have the following: we created a IPSec L2TP VPN and on de client computers we created a scheduled task so when the work from home they automatic get this VPN Connection.But when they work in the office this VPN is not nessesary but in some cases it is created anyway,I tried the following: Technical Note: Restricting IPs to connect to a VP... - Fortinet CommunityThis seems to work for one customer but another customer who is using SDWan it doesn't work. Tried to add Wan1 an Wan2 as interface but some of the clients still creates the VPN connection when they are in the officeRunning fortiOS:v6.2.15 build1378 (GA)Question is what is the best way to block VPN connections from the internal network to the Fortigate?

HiI noticed that there is no "Maximized Bandwidth" option under SD-WAN rule section on FortiOs 7.4.1. So how can I use multiple WAN link at the same time?

I have an IPsec VPN connection between FG100D and SSG. Firmware of FG100D is 6.2.10. Recently the VPN connection went down and couldn't reconnect. I capture the IKE logs as below:   ike 0:To_BYHN: schedule auto-negotiateike 0:To_BYHN:To_BYHN: IPsec SA connect 51 222.252.97.229->124.158.3.197:0ike 0:To_BYHN:To_BYHN: config foundike 0:To_BYHN: created connection: 0x149b2d00 51 222.252.97.229->124.158.3.197:500.ike 0:To_BYHN: IPsec SA connect 51 222.252.97.229->124.158.3.197:500 negotiatingike 0:To_BYHN: no suitable ISAKMP SA, queuing quick-mode request and initiating ISAKMP SA negotiationike 0:To_BYHN:745434: initiator: main mode is sending 1st message...ike 0:To_BYHN:745434: cookie 137dd2ae1f9fb3b2/0000000000000000ike 0:To_BYHN:745434: out 137DD2AE1F9FB3B200000000000000000110020000000000000001240D00003C000000010000000100000030010100010000002801010000800B0001000C00040001518080010007800E00808003000180020002800400020D0000144A131C81070358455C5728F20E95452F0D0000147D9419A65310C

HelloI have some traffic blocked with the following message. Any idea what it means?msg=" redirect mismatch, drop" Logs from GUI. Something also strange for me is that the source interface is "unknown0", and I don't have any interface of this name.Any idea? 

I am redistributing BGP into OSPF, but I would like to know if it is possible to redistribute to a specific neighbor i mean not to all ospf FGT in the same area 

Hi AllI have a ping problem in the ipsec tunnel. Vpn tunnel up. The connection is established. I can reach the other party's gateway. When I ping from the local network, it does not work, but when the other party pings me, I can reach and connect. After 10 - 15 minutes, I cannot ping again. When the other party pings me, I ping again. Meanwhile, the tunnel never goes down and is up.My Device Fortigate 60FVersion 7.4.1

Hi all, I had FAZ with last version but, cause I encountered several "cosmetic" problems, I downgraded it to previous 7.2 version. Afther that, I can't find old logs, they are all lost. I've tried to upgrade to 7.4 version  by uploading a backup but the result is the same. Could you help me to obtain access to these logs? Is it possible? Thanks ¡¡    

Hello people, I hope you are well. I come from miklrotik and now I have to check out a residential (for older people). I see that it has a mikrotik 951, in the ARP table I see 111 entries, and in the DHCP server there are 132 records. It has a 1Gb drop and a 500M rise. What Fortinet Router can you recommend?Tank You!!!

We currently have an unused Fortigate device, and would like to configure it to test how our software behaves through different types of proxies. To this end, I would need to be able to configure multiple, completely separate proxies on the device. 1 without authentication1 with (anonymous) authentication1 with Kerberos authentication1 that allows only HTTP/21 that doesn't allow HTTP/2Ideally these would be accessed on 5 different IP's, which are all on the same physical interface (which is also the outgoing interface). I've create multiple interfaces (loopback) and gave them an IP, and then enabled the explicit proxy setting. But I cannot seem to be able to create a proxy policy and specify what it applies to (the 'enabled on' section is always fixed)? If there is a way to do this, please let me know how to go about this. 

We were recently asked if our FortiAP 431's support FT over Air if necessary by a vendor and were wondering if this is possible? I checked the CLI page for FortiAP and only saw mention of FT-over-DS enable/disable.   Does anyone know if the FortiAPs support FT over Air and how it would be enabled? Also, is it a universal setting or can be defined to a specific SSID? 

Hello forum,Can somebody give me an example of using Zones if we are going to use Granular policies.We will restrict the access as much as we can with our traffic.Example would be: Clients to DC - Only LDAP, HTTPS etc Clients to Servers - Only RDP etc   I can't see any difference in managing all of them since we are going to have a lot of policies.What is different with using Zones over Interfaces. I don't see any advatages in our case.This is our current without zones:     How it can be more managable if we are using zones if we need to do a granular permissions for everything.Each VLAN, each service, ports etc

This is what I'm trying to set up on an Fortigate 60F with firmware version 7.41: Wan1 - multiple static IPssubnet 192.168.2.0/24 on vlan switch internal on internal 1 portAdministrative Distance: 10 via static routevarious inbound and outbound policies.this contains public facing servers, domain infrastructure and other servers with static ips mostly for inbound.various inbound and outbound policies.This part is working fine. What I've set up on wan 2Wan2 - DHCPSubnet 192.168.3.0/24 on vlan switch internal1 on internal2 portDistance 10 via wan2 interfaceinbound policy block all portsoutbound policy allow all ports (for now, will lock down once things are working)This would be PCs, phones and other devices for internet access, with addresses assigned by domain dhcp service. What's happening (while playing around with various settings) is that either wan2 isn't working for internet, or the internet on both interfaces is completely hosed. Also required, bidirecti

Hi people!We've recently set the anti-spam filter in FG 7.4.1 and it seems to be working well, at least the FortiGuard Spam Filtering procedures :)But we are unable to get the banned words working. It looks like to be completely ignored :(We have the bword table configured:config emailfilter bwordedit 1  set name "Our banned words"  config entries  edit 1    set pattern "Notification*budget*requested"    set where subject    set score 11  next   (some more entries here)end.....And we've also set the profile to consider the banned-word-table:config emailfilter profile  edit "SPAM filter"    set spam-filtering enable    set options bannedword spambal spamfsip spamfssubmit spamfschksum spamfsurl spamhelodns spamraddrdns spamfsphish    set spam-bword-table 1    set spam-bal-table 1  end..... We can see at the GUI that banned word are enabled and using "Our banned words" t

Hello, We have a FortiGate 200E as one of our devices.After a factory reset by using the hole pin method, we are unable to access the device anymore.The status flashed for a while, the ports flashed, then the port lights were stable, then status was normal again. Leading us to believe the factory reset was successful. The computer IP is set to 192.168.1.1, netmask 255.255.255.0, gateway 192.168.1.99Everything as instructed in the manual and online.Connected to the management port as the sticker on the device says (connect to MGMT port and access the web UI on 192.168.1.99) However, we are unable to access the device on the web and we cannot ping it.https://192.168.1.99/ We have experience with multiple other FortiGates and went through similar processes in the past year without issues. What should we try? Thank you. 

Hi people!We'd like to reject some kind of incoming emails, eg. *@*.ru We receive emails through port 25, and we've configured email filter to tag some of them as spam.But when using the "wildcard" option, it's not possible to choose "reject".We don't even want those emails to reach the user inbox.Is it possible?Thanks!

Hello, I have been tasked with getting specific users browsing sessions. I have created the following dataset, that does work.But now I am being asked to to also include browsing-time per session. and if possible to exclude all internal traffic. Is this possible? And help is greatly appreciated. FortiAnalyzer Version v7.2.3Dataset below.  Log Type: Web Filter SELECTfrom_itime(itime) AS itime,`user` AS USER,`catdesc` AS Category,`url` AS URLFROM$logWHERE$filterAND (((lower(`user`) = lower('First.Last'))))

We just purchased a Fortigate FG-40F. I have done the initial set up and only have a single test server with 3 HyperV instances and one workstation connected.  Everyhting is getting a DHCP address from the firewall and can communicate with the internet gateway. However, I can't get anything on the LAN to communicate with each other. None of the HyperV instances see each other or can ping each other, and I need all LAN workstations to be able to communicate. What setting do I need to change for this?Thank you. 

Hello, I am looking for clarification in whether I need to migrate to ZTNA for remote access to do a basic posture check? I am looking to see if we can block an incoming SSLVPN request from a user has their local antivirus not running or is not up-to-date? We are using Forticlient EMS. https://community.fortinet.com/t5/4D-Documents/SSL-VPN-to-ZTNA-Migration-Guide/ta-p/286534

Dear all,Let me ask some helps from you all, i'm facing some case that i'm trying to block vpn application at our fortigate firewall, cloudflare and psiphon vpn apps:. It does not work using p2p and proxy to deny these apps:. Cloudflare is ok to deny by blocking cloudflare used ip address and ports. But, psiphon is not ok to block by choosing psiphon at application.    Anyone have ever been? or could you pls anyone help that problem to solve?  Thanks much!

Hi I configured an Explicit Proxy on a Fortigate appliance. Fortigate use FSSO for remote users authentication and it has tree main interfaces: 1 LAN interface on which explicit proxy is configured and 2 WAN interface. My goal is that User A proxed traffic flow through WAN1 interface and User B proxed traffic flow through WAN2. I know that it's not possible use PBR and my customer doesn't want use an additional vdom to re-route traffic generated by Proxy. Is there another solution to achieve it?   

Hi, we use a FortiGate 7.4.1 with two independent ISP Connections.With hundreds of Students surfing, our bandwith runs very often into limitations. To priorize the various traffic i have tried SD-WAN Rules to one or another ISP Line.If i simply try to spread traffic between the two interfaces by "Best Quality" or "Lowest cost (SLA)" both ways work fine by directing new traffic to the interface with the best SLA. The problem is, Sessions are interrupted when a switch between the interfaces occours.I already tried the option "preserve-session-route enable" on our WAN Interfaces but this didn't change anything. Any help appreciated. 

Hello forum,I would like to know what is the best approach on restricting firewall policies as much as possible.How to plan everything, which services are needed where, how to be sure that I will not left any services, etc.Currently all services are allowed.I will do a network segmentation to create more smaller broadcast domains then to have nearly everything in one VLAN, and while I'm going to do that I want to implement most secured way for firewall policies also.Any advices are welcomed.

Hello, I would like to provide for my colleagues some restricted access on the fortigate for management. I know that I can provide read only access, but is it possible to somehow permit to just several rules in firewall policy(I mean for example add ports, sources and so on)? I mean is it possible to do flexible restriction?