Solved

Have a pair of 601E FortiGate units in a remote location. Connected to a cloud environment via S2S VPN.  Among other things, I need to be able to send the FortiGate logs up to the cloud, and don't want to lose them if the S2S goes down for any reason. Found the documentation to send logs via a proxy.  Would like to use the extra GE ports on the unit to directly connect a physical proxy server.  Looked through the documentation and it's not entirely clear what I need to do on the FG.  Would think the port would need a VLAN identifer, but non-taged.Seems simple, but after wading through the various posts, it seems unclear.  Perhaps I just need to read the right doc. The other related question: Is it possible to connect a "host" machine with two network interfaces to both units when the FGs are configured as Active/Passive?

friends, a question, do you know how I can create a report in the fortianalyzer where it shows me the countries that each user who connects to the VPN belongs to? I have a face 7.2.3 and it does not have a default report on what I comment.

Hi all, I've got a customer with a lot of transit circuits as well as vpn redundancy configured today, but adding prefixes is pretty painful with all the fortigates.  I'm exploring using OCVPN or ADVPN along with extending BGP to the Fortigates to ease dealing with new routes and failover paths here. I've ready everything I can find on OCVPN+BGP, there isn't a whole lot of detail how BGP works around it, other than the docs out there indicate it seems to use an IBGP mesh with the hubs being route reflectors.  ADVPN docs indicate using EBGP between sites, which is really what I'm looking for to use EBGP between sites in general internally vs IBGP and needing to use reflectors. I just don't know if I can leverage OCVPN and EBGP that every hub/spoke site would be a new private ASN. What is the preferred method of deploying BGP with OCVPN around either of these as an upgrade/replacement for traditional prefix-based tunnels?  Is there a recommendation for/against OC

Hello, I've recently deployed a FortiGate 60E at our branch office and have been experiencing intermittent VPN disconnections. These disconnections are causing disruptions for our remote workers, especially when they are accessing shared resources on our intranet.You can also check this - https://community.fortinet.com/t5/Support-Forum/Fortigate-AP-RADIUS-Authentication/m-p/19493splunkcourse Here are some details:Firmware Version: v6.4.3VPN Type: IPsecAverage Number of Concurrent Users: 15-20Disconnection Frequency: Approximately 2-3 times daily, lasting for 5-10 minutes.Initial diagnostics don't indicate any apparent issues with bandwidth or the physical network. I've also checked for IP conflicts and found none.Has anyone experienced similar issues with the FortiGate 60E or other models?Are there any specific logs or diagnostics that could shed light on the root cause?Could this be related to any known firmware bugs or configuration nuances? Thank you in advance!

How long will the EOS and EOL of the FortiGate 100F last ?Thank youFortiGate

Hello everyone, I've got following setup:- 1x Fortigate 90E (FortiOS 7.4.0 build 2360)- 1x FortiAP 222E (FortiOS 7.4.0 build 0529)- 3x FortiAP 210B (FortiOS 5.2 build 0265) The FortiAPs 210B are quite old `:], but we've still been using them successfully until now... After the FortiGate update (from 7.2.5 to 7.4.0), it doesn't detect these devices anymore. In the past, there were situations where we had to manually activate them via WiFi Controller (or something similar happened with them). Now it looks different, and we have no idea whether it's a matter of issues with the FG update or if support for these devices has been completely 'cut off' with version FortiOS 7.4. Has anyone of you encountered something like this?Sincerely,JerryN

Hi, I want to connect thru the Fortinet Client (sslvpn) on my iPhone and direct all traffic thru the Fortinet 60E to the Internet. Is this possible? If so, is there somewhere a working example? The manual is not quite clear in this. Thanks,Peter.

Hello, I have seen some Fortigates with 802.3ad Aggregate interfaces that contain multiple VLAN, L3 interfaces.This is confusing me, as I assumed that 802.3ad Aggregate interfaces were essentially bonded trunks (that would not contain multiple L3 interfaces).Therefore, if you wanted to create a router-on-a-stick interface like this, can you also use an aggregate, bonded interface instead of a regular L3 interface with multiple VLAN tagged L3 interfaces ? Is there any advantage ?Thanks for any clarifications.

Howdy,I did submit a ticket for this as well.  I upgraded my 100F form 7.2.4 to 7.4 this morning.  Now users are reporting an issue with SSO for SSL-VPN.  I am using the Azure integration.  This solution has been in place for years without issue.  When users are logging in they are getting a blank pop-up box for the SSO sign-in.  Not all users, it works fine for me.  Has anyone seen this? 

I have recently successfully set up our SSL-VPN with AzureAD SSO including MFA (conditional access) Users are able to go through the process, sign in successfully and gain access, but there is a desire to extend the Azure MFA sign in window timeout process/prompts. By default, it appears there is a 30sec timer countdown set somewhere and it starts counting down in the sign-in window title bar as soon as the Azure window pops. After doing some reading around these forums, on the FortiGate itself, i doubled the default timers for the 5 x "config sys global > set two-factor--xxxx" options but as expected, no change. I also up'ed the "config sys global > set remoteauthtimeout" to 10sec instead of the default 5.*****set remoteauthtimeout 10set switch-controller enableset timezone 71set two-factor-email-expiry 120set two-factor-fac-expiry 120set two-factor-ftk-expiry 120set two-factor-ftm-expiry 120set two-factor-sms-expiry 120***** I have loosely looked through Azure an

Hello, I configured as the manual an IPsec Tunnel to be able to connect the remote clients to the LAN. I was thinking then to restrict the firewall rules (users can access to servers, others users no). But that seems to not working when I put a user group in source of the firewall rule. Is there a way to restrict the access of the LAN for some users o it will have access of all the infrastructure ?In SSL it's possible to do it easily but don´t find a way in IPsec..Many thanks

I need to block the traffic to my FTG by geographic IP. However, the 50E models do not have this ACL option, how can I do it?

Hello, I would like to configure SSH on FortiSIEM in order to monitor any change on the configuration from the fortigate side

Hi all for testing, there was an integrated evaluation license for 15 days in each Fortigate VM. Since FortiOS 6.0.1 the evaluation license expires right from the first start of the virtual machine. In the GUI, there is the message "Expired on 1970/01/01" with the possibility to upload a license file. Until FortiOS 6.0.0 it works as before. Was the feature for evaluation license removed or is this a bug? I tested with FortiOS 6.0.1, 6.0.2 and 6.0.3 with VMware Workstation 12.5. Thanks for your help. Best regardsMarcel

Hello, We have the deep inspection activated for the outcoming connexion. Microsoft has changed their certificat for the hostname europe.cp.wd.microsoft.com resently with an another CA and now I get the error "block-cert-untrusted" from the UTM. So I think to resolve this issue I have to import manually the new chain for this CA in the fortigate ? where can I get the CA list that the fortigate already know ? Does the CA list are automatiquely updated from fortiguard ?  Before I was on checkpoin and I had to import manually the CA cert. Thank you for your answerRegards,  Regards,  

We have two SSL tunnels, one is not quite ready. Can we only present one tunnel to the clients and "hide" the other one for now? 

Hi guys,I found many articles that help geo-block IP Addresses that try to connect on SSL VPN.Now we face many attempts out of the TOR network. Fortigate has the TOR_Exit_node as an Internet Service Database, and it can also be added as external Connector, but local in Policies can't be configured with either.Is there a way I miss? Fortigate has version 7.0.12/6.4.14.

Recently we setup a DR site with a new FGT100F firewall.we configured a IPsec site-to-site tunnel from our main firewall to the new DR site.the tunnel is working and we can connect to the DR site with no issues.But when we realize that SSLVPN users cannot connect to the DR site.is there any special routing needed at both end of the firewall in order for SSLVPN users to connect to the DR site.SSLVPN have no issues connecting back to main office subnet or other remote office subnets which are connected via MPLS circuits. main office -> 172.16.0.0/24  <-----------> new DR site 172.32.0.0/24SSLVPN users -> 172.15.0.0/24 

I am trying to understand the output of "diag vpn ike gateway list name <name>". I would like to know what the line "child: <yes/no>" says. Can someone explain this to me?fortigate # diag vpn ike gateway list name <Name>vd: root/0name: <name>version: 2interface: wan1 7addr: <IP1>:500 -> <IP2>:500created: 1323297s agoPPK: noIKE SA: created 1/17 established 1/17 time 0/4/40 msIPsec SA: created 1/32 established 1/32 time 0/0/0 msid/spi: 2390 xxxdirection: responderstatus: established 23088-23088s ago = 0msproposal: aes256-sha384child: yes <--- What does this line mean?SK_ei: xxxSK_er: xxxSK_ai: xxxSK_ar: xxx57message-id sent/recv: 30/37lifetime/rekey: 86400/63041DPD sent/recv: 0000083b/0000083b

Hi All , We've FortiGate Firewalls running Active-Passive HA. We've enabled VDOMs and root VDOM is the management VDOM.We have local NTP server. But FortiGate time is not syncing with local NTP server. FGT-INR03 (global) # execute timecurrent time is: 16:08:13last ntp sync: never sys_update_timer_func:1755 synchronized=0Sorted NTP endpoints.NTP daemon uses a upper end of -2000000000.000000 and a lower end of 2000000000.000000.no server suitable for synchronization foundntp_dns_cb:1926 in_flight=0 resolved=0 ipv6=0ntp_dns_cb:1926 in_flight=0 resolved=0 ipv6=0waiting for 9 seconds . Our FortiGate has no internet access, so it's impossible to reach FortiGuard and we must sync with local NTP server.Can you please help me how can I sync with Local NTP server on VDOM enabled HA  environment? Thank you

As of yesterday, in the phase2 settings for a site-site VPN connection to Azure I had the following:set proposal aes128-sha256 aes256-sha256Last night, the connection failed.Looking at the saved config from a couple of hours before I see the "set " as it was.Now, however, I am unable to modify the phase2 settings to anything other than aes128, either through the command line or the GUI.  The drop down in the GUI will let me select AES256, and appears to save it, but if I go back, the setting reverts to AES128In the CLI, I get a parse error for aes256.Running V7.0.12 build8800The FG seems to think the Phase1 connection is OK.  Azure even still things the connection is good.  But the phase2 connection is red. As mentioned.  This behavior did not occur yesterday. and the VPN configuration has been in place since 10:40am, but failed at 7pm The only change made yesterday was enabling HA.  But the saved configs showing the aes256 setting was from over an ho

I'm trying to setup a POC to demo ZTP.....Using the Fortigate Cloud service, I was able to provision a Fortigate to it's proper On-Prem FMG. However I was unable to get the gate provisioned to the proper CLOUD FMG. (Even though it says it's supported). I then tried using FortiZTP service and was able to provision to the CLOUG FMG successfully.   Has anyone else run into this ? Should we be using the FortiZTP since it's still in beta ?   Tom

Dear Team,One of our customer is moving from FG300D firewall to 200F, however wants to know if we can re use the SFPs of 300D firewall in 200F firewall. based on Fortigate 200F data sheet, the SKU has changed from FG-TRAN-LX/SX/GC to FN-TRAN-LX/SX/GC.Could you please confirm if FG-TRAN-LX/SX/GC can be reused on 200F ?

Just looking through the 6.4.8 Known Issues and found this:721487FortiGate often enters conserve mode due to high memory usage by httpsd process. This seems to be similar to the WAD issue:712584WAD memory leak causes device to go into conserve mode. I have a (sad) workaround for the WAD issue by regularily issuing diagnose test application wad 99 with auto-script. However, there is no similar way for the httpsd.It looks like I'd need to ssh into the box and first identify the httpsd PID with diagnose system top and afterwards issue diag sys kill 11 <process-Id> Is there a better, automated way?When there is no active Web-GUI session, is httpsd restarted?In your experience, when does the httpsd high memory usage comes up? Conserve mode scares me off, since I already had twice to drive to client locations to get an FG-60 and an FG-61 working again. ThanksDaniel

Have two new 601E Fortigate units. Running identical firmware.Each think they're the only one. HA port is green on both.  If I reboot the "secondary" the "primary" sees the link drop.Primary is set to priority 200, secondary is left at default.Reset password just to be sure.  Group name is correct on both units.Secondary has been factory reset, and only the hostname and  HA config settings added.Both units have been registered, although the secondary cannot talk to FG at the moment since the public link has not been reconfigured, but is connected.The "inside" interface is not yet connected..The HA interfaces are directly connected.  No switch or hub between. They just don't seem to see each other.  Ran several of the suggested diag commands, and don't see anything obvious.