Solved

Hi, Have an Issue with an IPSec Site-to-Site between set of Fortigate units:1 x 200E behind a public IP / LAN 10.184.0.0/161 x 60F behind a dynamic, natted IP. / LAN 10.151.0.0/16I'm running 7.0.2 I've established the tunnel, using dial-in from the 60F, all easy enough.Problem is that it seems no traffic is exiting the 200E, over the tunnel (outgoing data remains at 0).In the other direction It seems to work fine (so from 60F to 200E) I've checked policies, and done some packet sniffing, and all the policies are fine, the packets enter the tunnel, I can see this in a sniff capture as well as in the counters of the policies. However, when I sniff on the WAN port, no outgoing data whatsoever. It seems like the data is entering the tunnel but not encapsulated on the WAN port? This is the Sniffer on the Tunnel IF. MeetMe-FGT200E # diagnose sniffer packet VPN-TO-Koreainterfaces=[VPN-TO-Korea]filters=[none]pcap_lookupnet: VPN-TO-Korea: no IPv4 address assigned4.93274

Hi all, I am planning to conduct feasibility check on Fortigate 200F with Okta authentication for SSL VPN. So I need some clarification on configurations changes and impact to productions environment. Here are my questions: -Is it possible to integrate with Okta using specific VDOM only? does it affect global config?Is there any impacts if t testing on VDOM in production environment?Any guidance or steps that I can refer?Is it possible to test integration with Okta developer account?  Thanks,

Hello all, We are in discussion with a customer that likes to host the FortiSIEM on prem but considers moving to our multi-tenant-cloud-environment some day in future.As we are just setting up the SIEM, I would like to build the environment in a way that this migration might be possible. Most interesting thing would be the eventdb for me here (as the parsers, reports, etc. might just be ex- and imported). Has anyone done a similar thing before? Moving the eventdb to another (already running) FortiSIEM? The target system is on ClickHouse. The on-prem system can be anything as we have not set it up yet: Local, NFS, ClickHouse; we can also set it up as enterprise oder service provider mode.It would also be enough to just have the eventdb in archive-format for the transfer, since it's all just about "keeping logs for 365 days". Thanks already for any kind of input :)Best,Christian

Hi, I am looking to go for the FCP Network Security Certification. However it says the core exam is NSE 4 FortiOS but I don't see that on the website anywhere. When I look at the training material it's all in sections like FortiGate Administrator, FortiAuthenticator Administrator etc. Do I have to do all of it to prepare for the exam or only things that mention FortiGate? I am a little confused. Thanks

hi,is it possible to configure continously using CLI instead of type 'end' in each configuration section.for example, after i've configured mgmt ip i can go straight to 'config router static' and type 'end' after the mgmt and static default route are configured? or will the system reject it? edit - i just tried and indeed rejected the command when i go straight to 'config router static'is there a way to type commands continuously or is it required typing 'end' each config section? FG# config system interfaceFG(interface) # edit mgmtFG(mgmt) # set ip 192.168.200.202/24FG(mgmt) # set allowaccess ping ssh httpsFG(mgmt) # end   <<< CAN I SKIP THIS?FG # config router staticFG(static) # edit 99new entry '99' addedFG(99) # set dst 0.0.0.0/0FG(99) # set gateway 192.168.200.1FG(99) # set device mgmtFG(99) # end ----- FG(mgmt) # set allowaccess ping ssh httpsFG(mgmt) # config router staticcommand parse error before 'router'Command fail. Return code 1

Hello, it looks like I am doing something wrong and I was not able to find my answer on the internet, so please if someone could enlighten me :)I have web server, behind nat. Rule set like this:incoming: wanOutgoing: lansource: alldestination: virtual IP of the serverservice: httpssecurity profiles: ips high security (modified to quarantine most threats)    ssl inspection: specific "protecting ssl server" profile From time to time when there is IPS attack blocked, the IPS puts into quarantine the internal IP of the web server (ie. 192.168.x.x , it is visible in quarantine monitor and can be removed there manually). See below ips log - i suppose the "source" should be blocked, and not "destination" :( Do you please know what am I doing wrong?Thank youRegardsMartin

Hello, I have a Fortigate 401F that I currently have access to via the mgmt interface. This interface is connected to one of my core switches (catalyst 9300) via cat6 and I can reach it at 10.Y.X.115/25. The Fortigate and my switches are all in the same subnet 10.Y.X.0/25I can ping the Fortigate from every switch in my network, so I know that all the switches can reach the fortigate. My question comes into play because I am attempting to use the x3 interface (with an SFP transceiver from Fortinet) to connect to one of my switches (for example, SW-30). I have fiber run from SW-30 to the MDF in my primary server room, and when I plug in my NetScout, the interface on SW-30 comes up.When I insert the fiber into x3 on the Fortigate, the interface on SW-30 goes down, and x3 continues to stay down.At first I thought this was because x3 does not have an IP assigned to it, but when I attempt to put it on 10.Y.X.31 /25 it says I can have it on the same subnet as mgmt.I will admit I am

date=2023-12-13 9 time=11:56:25 devname=FGT200xxxxxxxxx=FG200xxxxxxxxx eventtime=1885229385635990681 tz="+0100" logid="0122032002" type="event" subtype="system" level="alert" vd="root" logdesc="Admin login failed" sn="0" user="admin" ui="https(89.248.192.55)" method="https" srcip=xxx.xxx.xxx.xxx. dstip=xxx.xxx.xxx.xxx action="login" status="failed" reason="passwd_invalid" msg="Administrator admin login failed from https(xxx.xxx.xxx.xxx) because of invalid password"     How can i block that IP on FORTIGATE?

Hi community,   I have a problem regarding authentication via TACACS+ on FGT units (FGT40F).I have two WAN interfaces, but their're no members of a SD-WAN.   If the primary interface goes down, the login via TACACS+ is not possible anymore.Also I configured the same lines on the secondary one. Here is the entire TACACS configuration:   config user tacacs+edit "RAGTAC1"set server <ip of primary server>set secondary-server <ip of secondary server>set key ENC vnm4VKB0FI5aNL1cBxRAngfqZtn75GS2aLWuFn7Va7KhhK0avUJGMG/JHVRyy+AGFKKvJ7xbAuDmM4+V6m4iTv76iUGgMssbNKpcBq+BLcluknE61I5r6emPmIwu6J04hP+qWiglAlc/QlA==set secondary-key ENC xBDZhp1GT9MnrQpkBHe342XbjGcb/YLoMHuXP5PmK7ALnDEvUmYcsEGy+4BJmJZdDKRX56sJWXzIbVmYEPwekPgXWlECqGWkPnMnoVyanbFrsoZG1xE0w==set authen-type asciiset authorization enableset interface-select-method specifyset interface "wan"nextedit "RAGTAC2"set server <ip of primary server>set secondary-server <ip of secondary server>set key ENC fI8pEqi

I recently acquired a Fortigate 80F firewall appliance and have been working on configuring the Librenms system to retrieve certain metrics from the 80F. I have successfully set up the SNMP protocol and can view most of the interfaces on the Librenms dashboard, but unfortunately, the WAN2 and only WAN2 interface is not appearing. The firmware version I am using is v7.2.6 build1575. here is the screenshot from librenms I would greatly appreciate any guidance on resolving this issue. Thank you!

Hello to all,I would like to secure a bit more our traffic from Clients to internal Servers.What are your recommendations with applying security profiles between clients and servers.We have restricted only certain ports etc but would like to implement Security Profiles as well.Can't seem to find something on these topics.Also topics for security profiles differences for clients and for servers specficily for outside access to internet

Dear All,          Would like to ask if i have dual internet circuits and want to enabled link redundancy and no load-sharing, and i have followed below guide and seem work as expected, but i have one question, if wan1 down, and its will failover to wan2, and if wan1 resumed, will it be able to failover back to wan1 itself ? would it be possible to achieve that ? https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/360563/dual-internet-connections#Security Piaakit 

Hi everyone,I want to create a geo-cluster.two of the FortiGate are in one location and another FortiGate is in a different location.do I need to create a specific VLAN for the ha traffic? and if I do need it, which subnet should I choose for this vlan?Thank you

Hello community,Since 2 week I  update Forticlient from version 7.2.1 to 7.2.2 but using the package with Intune all new installed computer ask Key for telemtry, and because I have a lot of computer I can do one by one, is there any way to insert Telemtry key using command line ? then I can write a script can be used with Intune for all installed machine. thanks a lot thanks 

Hello,Could you please help me if there is any possibility to copy the complete settings of one ADOM in FortiManager to a newly created ADOM? Thank you very much.

Hello guys, I played a bit around with the Split-Task VDOM Option on a new Fortigate we received. However I just read the following in another forum post: "Just a side note, not an answer to your questions, the Split Task mode was discontinued in the FortiOS 7.2, and will no longer be available"Does anyone know if this is true? Will the Split-Task VDOM Option be no longer available with 7.2?Thanks!

Why can I not see the interface config in the show or show full-configuration CLI outputs? There seems to be a relationship between the following 2 command formats:show <<pathway>>config <<pathway>>So for instanceconfig vpn ipsec phase1-interfaceshow vpn ipsec phase1-interfaceThe <<pathway>> paragraph can also (usually?/Always?) be found in the show  and/or show full-configuration CLI output.  This relationship holds for the <<system interface>> pathway but this configu is missing from from the show and show full-configuration.I am speaking of the production VDOM in this case (FG-traffic) as you can see below) but I have checked the root VDOM as well. Nothing.What am I missing?

Hello all! I'm trying to delete a Fortigate device from FortiAnalyzer in the GUI but it results in an error message: "deldeverror". Have anybody any idea why I can delete the device?  

Hi i followed this docs https://docs.fortinet.com/document/fortigate/7.0.11/administration-guide/556915/installing-firmware-from-system-reboot to installing firmware from system rebootbut it doesn't show step 10. and show Fatal error: Loading FOS fails!i'm sure the firmware was upload success from tftp serverand the firmware filename is FGT_100F-v7.0.11.M-build0489-FORTINET.out also i tried this https://community.fortinet.com/t5/FortiGate/Technical-Tip-Installing-firmware-from-system-reboot/ta-p/190793 but it doesn't have "G" optionPlease help me.

I assume that the layer3 interface is tagged with vlan 1? What happens if I put an access vlan on a another switch port that is connected to this firewall port?

Hi,If I wanted to return to NAT mode after configure the Fortigate in transparent mode with firewall policies, security policies, etc.. What are the steps?Obviously remove the commands of transparent mode and assign ip addresses on interfaces. Other things? Thanks

Hi,   I ma trying to allow inter-vlan communication in firewall policy and wrote this policy. is that correct?     config firewall policy edit 6 set status enable set name "Vlan--->Vlan" set uuid 19f0b5c8-93f3-51ee-dc48-59756c056159 set srcintf "Vlan3" "Vlan20" "Vlan30" "Vlan40" "Vlan50" "Vlan60" "Vlan70" "Vlan90" "Vlan100" "Vlan101" "Vlan110" "Vlan172" set dstintf "Vlan3" "Vlan20" "Vlan30" "Vlan40" "Vlan50" "Vlan60" "Vlan70" "Vlan90" "Vlan100" "Vlan101" "Vlan110" "Vlan172" set action accept set nat64 disable set nat46 disable set ztna-status disable set srcaddr "Vlan100 address" "Vlan101 address" "Vlan110 address" "Vlan172 address" "Vlan20 address" "Vlan3 address" "Vlan30 address" "Vlan40 address" "Vlan50 address" "Vlan60 address" "Vlan70 address" "Vlan90 address" set dstaddr "Vlan100 address" "Vlan101 address" "Vlan110 address" "Vlan172 address" "Vlan20 address" "Vlan3 addres

Hello   i want to know   what are the steps to configure reverse-proxy in fortigate ?   i wait a reply from expert fortigate   Thanks     

Hello Expert,   I have to two fortigate 400e in HA setup, but I am unable to connect to standby one when I use the Management port on the device, How can I log into the device when it is standby mode?.   Thank you   Regards

I know this in an unsupported configuration, but I have a bunch of old firewalls that are running 6.4 firmware and no matter how hard I push, I haven't been permitted to upgrade them.  We will be swapping out hardware soon to new firewalls but that is going to be a slow process.  I have a FortiManager running 7.2.2 and have tried to add FortiGates running 7.2.6 firmware, but they fail every time.  I wanted to upgrade the FortiManager to 7.4.1 but wanted to leave the 6.4 ADOM in place.  We don't use FortiManager like we should, we are using it like a backup solution and importing the policy packages from each of the old firewalls.  The new ones we are rolling out will be managed by the FortiManager, but I need to still backup the old firewall configs.  If I upgrade FortiManager to 7.4.1, can I still run imports on a 6.4 ADOM?