Solved

Hello to all,I've configured a load balancing between 2 interfaces, by setting one to 62% and the other to 38% of the internet trafic. But it does not seem to work well, indeed I notice that the traffic is not shared as configured above.I use a Fortigate 200D, Firmware version: v5.4.1, build1064 (GA).I would like to know how to fix this problem please.Your help will be very appreciated.

How can I ensure that I also see notifications in FortiAnalyzer, such as blocked websites from the FortiClient connected to a FortiEMS?

If you forget the password into the firewall.Or if you forget the ip address to go inIs there any way to retrieve the running configuration without factory resetting it?

Suppose the jitter and latency is in the red but the packet loss is 0,under what circumstances will the firewall declare the link down and remove static route from the routing table?I configured the SLA by the way. My users are video streaming and the latency and jitter of wan 1 and wan 2 is high, although the packet loss is 0.Will the links be declared dead? 

Hey, How can I upload a custom connector to the content hub? Awni

Hi All, I am planning to enable heuristic scan option in antivirus setting. I have gone through document where it says I need to enable it like,configure antivirus heuristic set mode block For higher models,config antivirus quarantineset drop heuristic  But I don't find these options in my FortiGate firewall. We have 1100E and running 7.0.12 firmware. Do I need to enable something to configure antivirus heuristic scan?  

We have a setup where we connect to our Azure resources using a Site2site IPSec VPN connection, which works as expected.  However, once my clients connects from Forticlient using SSLVPN, traffic does not get routed to Azure.I have created Firewall rules that allow traffic from SSLVPN to Azure remote IP addresses.SSLVPN splitmode is disabled, as I want all traffic over my VPN. SSLVPN Clients can connect to LAN and WAN resources.SSLVPN clients cannot connect to Azure resources.   If someone can point me into any direction, it would be very appreciated.  

I am using FortiNAC Rest APIs to fetch list of hosts using endpoint "/api/v2/host" I am following this documentation https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/b0dca655-7aec-11ec-a0d0-fa163e15d75b/FortiNAC_REST_Schema_9.2_%281%29.pdf But i am not sure about how to use filter query param or what will be its format. My intention is to bring all the NOT ROGUE devices. Can someone help me with the same?

Hi AllI have manged to setup a windows native VPN connection to my FortiGate and also gain internet access via the VPN which is all great. However I was hoping by unticking  "use default gateway on remote network" on the windows VPN interface it would then allow me to browse the internet and access local resources on the LAN I am connecting from. Unfortunately this does give me local internet and resource access back but I lose connection to the remote LAN behind the FortiGate VPN. Is it possible to have access to both via the windows VPN client? I hope that makes sense and many thanks for your help Kind Regards Speedy

According to this thread https://www.wmlcloud.com/internet-protocols/problem-can-fortigate-automatically-update-dns-records/   .....it doesn't, and explains the problems I'm having. I have a thread below in which I complain about devices not being able to resolve via hostname with a fortigate 200D handling DHCP and DNS. We were blaming it initially on the devices, but since this is the same behavior as the thread linked above.....well.... I downloaded a freeware DHCP / DNS server and had no problems resolving local DNS hostnames via DHCP. So, the problem isn't the devices.   I would appreciate some confirmation on this, because if our 200D doesn't support a basic DHCP / DNS functionality like this then we will be looking for an alternate product. Note our 200D is still on 5.4.1.....possible this issue has been patched?

Hey guys!I'm new to FortiGate with Central SNAT and I'm administering a FortiGate 500E firewall - FortiOS v6.4.13 build2092 (GA) - which today has a private network 10.xxx.0.0/22 accessing the Internet with a public IP address of 200.xxx.xxx .37 all working fine. But a new demand came up for me to create a subnet 10.xxx.3.0/24 to use as a guest network and access the internet with another public IP address like 200.xxx.xxx.38/28. I am not able to create the necessary rules in Central SNAT to allow this, at the moment all subnets are accessing the internet only with the firewall interface IP which is 200.xxx.xxx.37/28. Can anyone help me with some tips? Or would anyone know how to indicate a document that addresses a solution for this for me to study?Thank you very much in advance.

Configured IPSEc vpn on fortiagte 100(v6.0.3 build0200). When user connects using forticlient, i am able to access the lan resources behing fortigate but i am unable to use local LAN and also want local internet traffic should not go through the tunnel.

Hi:I have a Fortigate 40F setup in office  with its WAN conencted to the interent on a public IP  , LAN connect to office LAN network 10.61.x.x network I and followed this guide, https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-establish-VPN-connection-between-Windows-10/ta-p/200001 I created a VPN: dialup - Windows (Native L2TP/IPsec) using VPN wizard， which the connection is working on my laptop from home. I am able to ping LAN devices in office, however, there is no internet . I would like access internet thru office LAN network via the ipsec tunnel, is that possible ? Thanks

Hi allI have the following configuration:site A and site B, both with 2 wan connections, connected to each other via 4 ipsec tunnels (A1<->B1, A2<->B1, A1<->B2, A2<->B2)on each tunnel I have the same phases2 and the same routes, the latter with different distances.the 4 VPN interfaces are grouped in one zone on both sides.Now I need to rotate all the traffic coming from a specific IP from office B and directed towards a specific IP in office A through a specific IPsec tunnel (for example A1<->B2)in addition to the fw rules to allow traffic, I also created a route policy, but the traffic continues to pass through the tunnel with the minimum distance routeany hint to improve and/or debug the issue? is there I'd be aware of and that I'm clearly ignoring?Thank you in advance

FortiGate 200B v5.0 GA Patch 2 Previous version you could right click a policy and select move above or below and you could enter a existing policy to move it where you wanted. Any idea on how to this now in version 5 Patch 2??? Trying to get a new policy in place for our new phone system so any help with this would greatly appreciated.

After upgrading to FortiOS 7.4, I am getting a notification to migrate the configuration when logging in with GUI. Is it necessary? What does it affect?

Hi Team, We have deployed fortigate in Active/Active in GCP between 2 load balancers (external & internal).We are facing issue in ingress traffic, in External LB both Forti-VM is healthy.When user from the internet try to hit external IP of External LB, traffic is not hitting to FOrti-VMs.

hello,I have questions regarding SD-WAN Config. I have two WAN interface from two different ISP (ISP1 (as main, subnet 176.x.x.x) and ISP2 (as backup, 96.x.x.x subnet). They are combined in SDWAN, ant there is SLA which check if ISP1 is OK, if not switch to ISP2.Question 1When ISP1 is down, all incomming connections to our services will be down  quickly, or sessions must expire to allow new sessions to be  up again using ISP2 ??  If yes, how long it takes in default ?  From ISP1 we bought IP public pool (88.x.x.x), and this pool is regitered in RIPE for us, and our partners can use these IPs to access to our services in DMZ, but when ISP1 is down, no possible for our partners to connect. Question 2.If his pool is registerd for us shouldn't be possible to connect from outside by ISP2 to our resoures???  Thanks 

Hi, I have Fortigate 60F and two ISP added to SD-WAN: WAN1 WAN2     I would like always to route traffic from Interface "3" (Subnet 192.168.0.0/24) to ISP "WAN2" and never failover to ISP "WAN1". If "WAN2" is down then clients on Interface "3" will be offline (that is OK). When other interfaces can use WAN2 as primary ISP and failover to WAN1 ISP.  If I will create below SD-WAN RULE then won't Interface "3" (192.168.0.0/24) failover to WAN1 in case of WAN2 is offline? SD-WAN Rule  

Hi All,IPSec VPN is configured this way:HO: LAN [192.168.7.0/24] - WAN --- IPSEC VPN --- WAN --- DMZ Zone [10.10.10.0/24]: BOOn both ends FortiGate routers.VPN tunnel is up but traffic doesn't go to\from.Checked firewall rules - ALL allowed to\from on both endsChecked static routes - for both 192.168.7.0/24 and 10.10.10.0/24 static routes exist with VPN interfaces as destinations.Is there anything special about configuring VPN for DMZ Zone?In the HO IPSec VPN tunnels to other branches works like a charm, but IPSec VPN to the BO in question with LAN in DMZ doesn't work.I compared IPSec VPN configuration and the only difference is in other branches VPN tunnels connect LAN to LAN and in this case it is LAN to DMZ. 

Since last week we've noticed that with the latest versions of Edge (114.0.1823.41) and Chrome (114.0.5735.110), drop down menus in Fortimanager 7.2.2 (haven't tested 7.4) and Fortianalyzer 7.2.2 and 7.4 no longer work. Manager and Analyzer 7.0.7 seem unaffected. Firefox works fine too.

I newly implemented sd wan. My sdwan has only 1 WAN interface. I remove the previous static route configured on the wan interface. I put a new static route for the sdwan interface. Now i cannot ping or https from the wan interface. Why? 

I am just playing with a 40F and have only console access…I have followed various suggestions on how to configure lan2 with an ip address and mask/gateway but constantly get errors….  should I be editing lan2 or port2… any help appreciated…

I am looking to migrate from Palo Alto 3020-HA to Forti 600f-HA. we currently use Panorama and will now be using FortiManager.We only use Panorama for objects and polices, no device templates...This is my plan... remove 3020 from Panorama and import all objects and policies.(already done)export config to xml. (already done)send xml for conversion,load returned config onto 600Fcreate HA pair.join to fortimanager with required settings... also.. is this a one off..   as in if it goes a bit wrong we are scuppered...do we get more than one attempt???any advice would be greatly appreciated. 

Hello Experts, I'm interested in RFC 2544 testing as it pertains to Fortigate VMs. Specifically, I'd like to understand Fortigate's approach to throughput testing. They provide online throughput figures for their VMs and mention details like server specifications, memory, CPU, and SRIOV enablement.  My inquiry is whether Fortigate employs a tool like FortiTester to determine these throughput numbers. If they do, I'd like to know their recommendations for conducting RFC 2544 tests for throughput. For instance, should there be a delay between each iteration? For example, when testing different frame sizes like 64, 128, 512, and 1528 bytes, should there be a pause between each frame size, such as waiting for a few seconds after the 64-byte test before proceeding to the next frame size? If such delays are recommended, what is the suggested duration for these pauses?