Solved

Hello guys i receive this error when i make a ping via CLI from fortigate 40F to 8.8.8.8In particular i write this command on CLI:- execute ping-option source 10.2.62.97 (ip address for internal LAN)- execute ping 8.8.8.8 after i receive this issues posted below  16:27:28 178 vd-INTERNET:0 received a packet(proto=1, 10.2.62.97:23->8.8.8.8:2048) tun_id=0.0.0.0 from local. type=8, code=0, id=23, seq=0. 16:27:28 178 allocate a new session-0003f14f, tun_id=0.0.0.0 16:27:28 178 in-[], out-[a] 16:27:28 178 len=0 16:27:28 178 result: skb_flags-00000000, vid-0, ret-no-match, act-accept, flag-00000000 16:27:28 178 gnum-100004, check-ffffffbffc041c80 16:27:28 178 checked gnum-100004 policy-1, ret-no-match, act-drop 16:27:28 178 checked gnum-100004 policy-1, ret-no-match, act-drop 16:27:28 178 checked gnum-100004 policy-2, ret-no-match, act-drop 16:27:28 178 checked gnum-100004 policy-2, ret-no-match, act-drop I understand that seems that there is no match in policy but why

Hello members,I am finally writing to this forum, since I was not able to find anything similar to this.I have a FQDN for example "web.example.com" for which a public DNS entry exists. But for clients I want to resolve this FQDN with a private IP. I am using the FortiGate as my DNS Server (recursive) and when I am inside my network this works perfectly fine. But when I am using the FortiClient to connect to my network over SSL VPN the FQDN still gets resolved with the public IP and not with the private one from the DNS Server on the FortiGate. I have split tunneling disabled so all traffic should go over the FortiGate and even if I set the IP of the FortiGate as my only DNS Server on the windows machine it still resolves the FQDN publicly. I was using FortiOS 7.4.0. I would really appreciate some hint on how I can make this work out or if there was a similar post in the past. Thank you :)

Hello, We have configured several VPN tunnels between our HQ and Branches. In configuration we see that our Branches WAN IP address is recognized be our Fortigate as a Static Route directed to IPSEC interface. Is it normal behavior and if it is possible to change it? FortiGate 

Hi all,Can anyone tell me the difference between traffic:forward and traffic:local in fortigate logs?Also, what is utm:app-ctrl event?

Hi guys, I have a FortiGate and an Asus wireless router. at present the ASUS wireless router is providing internet to our office and, now I want to connect my FortiGate between the internet and Asus wireless router to control the traffic but, when I connected my FortiGate to the wireless router both ports of two devices not up and even no detection. If test connection from pc to FortiGate and wireless to pc those ports up normal. I'm not that what I need to configure more and the FortiGate support with the third-party device or not. please, advise me to solve it.Thank you.

Hey guys!Recently, the security area of the company where I work asked me for a list with the categories of web filters in the company's internet firewalls and everything that each web filter is allowing access. In the web interface I list all this, but I can't export. Using the command line I also list everything and it's easier to export to a file, but the category names are replaced by ID numbers and the requester won't know how to deal with that. Could someone give me a tip on how we can do this?Thanks in advance, guys!

Question on the TRAP generated by Fortinet devices like “TRAP: {node} a switch controller session is down”. Is there an SNMP OIDS to Poll the switch controller data instead of using SNMP Trap that we currently have? TIAModel: Fortinet FGT_40FSoftware: FortiGate-40F v6.2.7,build1190,201216 (GA)

Hi, Looking for some guidance. We are new to Fortinet. Please forgive if I don't word this right. We have a block of external IP's. I want all devices on an internal subnet like 172.16.0.0/16 to use one of those external IP's in a NAT. I then want an internal subnet like 172.17.0.0/16 to use another external IP that we have. Is this possible?

Hello,If 2 different internet connection plug to same fortinet, can we make an failover so if ISP1 down then all traffic will be routed to ISP2 automatically?

I am trying to implement the shadow-ztna feature so I do not have to host dns entries for internal resources on the public internet. I am using the below 7.2.5 administration guide. It states that the command is hidden but on the 200F running 7.2.5 the command is missing entirely. Is there a specific feature that needs to be enabled or some pre-configuration so the command can be used. https://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/708477 

Hello Forti Communty, I need help with getting split tunneling to work on Mac OS. We have the following situation in our company:We have a firewall cluster made out of two FG 100F version 6.4.12.The IPSec VPN configuration with split tunneling we are currently using is working perfectly for all of our windows clients. Now we also have to support Mac OS but we ran into some troubles.For our clients we use the free VPN client from Forti in version 7.2.0, the Mac and Windows config is also similar.The VPN connection itself on the Mac is working great but due to the missing split tunnel feature it is only possible to connect to company internal resources when the connection is active. So for example google.com is not working because all traffic is sent to the virtual VPN gateway. As soon as VPN is disconnected all external resources are working again. Now I have the following questions: Is it possible to use split tunneling on Mac, maybe via workaround?Is there a different s

I’m having trouble with Sangoma talk app. It keeps trying to register but fails with “effective transport unspecified”. Has anyone solved this? I have a Fortinet firewall with port 5061UDP and RTP10000-20000 open, but RTP ports are closed when scanned. Any suggestions? Here are the logs:2023-07-31T20:40:08.441Z (1690836008441522)Sip::Registration::onTransportErrorCorrelation Id: SiphoneUserAgent[104865000]SipUserAgent[104866200]State: RegisteringRetry: NoError: GENERIC(3): Subcomponent FailureIn ali_net_connection2.cpp:457ALI-SOCKET(4): Cannot ConnectIn ali_net_tls_socket_impl2.cpp:802Note: Remote Address: xxxxxxxxxxxxxxTLS-ALERT(40): Handshake Failure (40)In ali_protocol_tls_client.cpp:16842023-07-31T20:40:08.441Z (1690836008441552)Sip::Registration::setStateCorrelation Id: SiphoneUserAgent[104865000]SipUserAgent[104866200]Current State: RegisteringNext State: ErrorgetCurrentState: return state: ErrorREGSTATECHANGED, current=ErrorisCommunicationAllowed: network=Cellular

I have a problem with a page that is https for example https://www.ilovepdf.com/es.When I use the webfilter profile or the appcontrol in a policy, even if it is only in a monitor way, these pages are blocked. SSL inspection only logs, doesn't block anything. Can you help me with this topic?Thanks

Hello!I'm replacing our Cisco Wi-Fi 2504 wireless controller and 2600 series APs with a Fortinet solution (431F & 433F APs paired with a FortiGate 600E internal wireless controller). I am intending to use WPA3 with our WiFi6 compatible laptops and WPA2 with our WiFi5 laptops. The SSIDs are set to WAP3 SAE Transition. The good news:-Both WiFi6 & WiFi5 laptops are connecting with the intended authentication method and speed. The question:-How can I push the passphrase for a SSID to multiple laptops so that users will not need to enter the passphrase manually? I did find an article that showed me how to use 'netsh' to export the SSID and passphrase to an XML file.  Then I created a batch file to use netsh to add the SSID to target computers.  It seemed to work, however, when the test user clicked on the SSID name in the Windows network list, the user was still asked to enter the passphrase.  Below are the basic commands.-netsh wlan export profile

what happen if I have configured the memory settings like this on Fortigate firewall?set memory-use-threshold-extreme 70set memory-use-threshold-green 75set memory-use-threshold-red 71When memory usage reaches 70% or higher, the device will enter an "extreme" condition, is it fine?

Hello,i've been asked to migrate 2x Cisco 2130 FTD to 2x Fortigate 200F.I was wondering if there is a way to export all the FTD configuration and import it in the forticonvert for the conversion.Did anyone do this type of migration?From what i know these's no way to export the entire cli config from the FTD (like is possibile for the ASA).Any tips would be appreciated. ThanksRegards

Hi all, As you all probably know, Fortinet will release a new certification program in October this year. Currently, I am studying for my first NSE6 certification (FortiNAC) since I will work with this product soon. To be NSE6 certified you need a total of 4 NSE6 product certification, and therefore I was wondering, is it still worth it now? Will this certification be of any value after October? Can I use my FNAC cert also in the new certification program? #NSE #NSE6 #NSE4

Hello everyone! Giving the following scenario:I have two policies with the same source and destination "all", but each policy has a different Webfilter profile. If a request doesn't match any url in the webfilter for the first policy, will this request be denied or the second policy will be evaluated? I ask that because we are migrating policies from another firewall vendor to Fortigate and in that other vendor, there is some similares policy rules, with exact same source and destination "any", but with distincts URL Categories and all policies are evaluated until a match or the request is denied just on the implicit deny. As I can see, the Fortigate will block the request in the first policy if no match in the Webfilter and will not evaluate the second policy, because it already have matched the first policy by source and destination address. Is that correct?

Hello all, I am a Fortigate newb.  The only documentation I can find on NAT over site to site IPSEC VPN pertains to versions before 5.6, and only to NATting entire subnets, on both ends.  I have a working IPSEC site to site VPN between my Fortigate (v.5.6) and a remote site (which is using a Cisco ASA.)  I am trying to make ONE host behind the fortigate, 10.0.100.198, appear to the remote site as 192.168.114.6.  Could someone tell me, precisely, what I'm supposed to do to make this happen?  I have experimented with Virtual IPs and IP pools, but nothing seems to work.  It's probably something simple that I'm missing.  If it helps, in Cisco language, this is what I'm trying to accomplish: object-group network external   network-object host X.X.X.X  object network internal   host 10.0.100.198 object network translated_address  host 192.168.114.6   (This is what I want the remote site to see 10.0.

hi,just started learning and managing fortigate FW so apologies for being a noob.i got a FG-40F with firmware version 6.4.6 build6083.i used the upgrade path tool and gave me this: my question is, do i strictly need to follow up this path or can i jump straight to our standard 7.2.2.note this just a lab FW. thanks in advance! 

Hi all,In scenario with two location connected via ipsec tunnel, remote office is accessing internet through wan port in main office, is it possible to capture and send traffic, remote office - internet and vice versa traffic,  to analysis sensor?Something like port mirroring in L2 world.Thank you,Drazen

Can we query to get percentage disk utilization using SNMP? What OID should be used?

I am using Fortigate-100F(Fortios 7.0.12), but appear below logs every day:Failed to connect FortiManager 173.243.132.61        Central Management connectivity is inactiveTunnel to FortiManager is down                                  Central Management connectivity is inactiveConnected to FortiManager 173.243.132.61               Central Management connectivity is active I do not use Fortimanager,  why appear those logs?  Thanks and regards,Gavin  

We want to move from IKE v1 to IKE v2 on our Fortigate 100F.  If we change the tunnel config on the firewall, and then make the Forticlient EMS tunnel match in version, will we need to reinstall Forticlients/profiles, or will this be a process transparent to end users if performed after hours? Would love to know what we're in for.  Thanks!

Hi, We just put a Fortigate in place. I have the SSL VPN working and vpn my clients can get to the 172.19.0.0/16 network that the Fortigate is also on. However, they can't get to devices that are on the 172.18.0.0/16 network.