Solved

Hello,I have a situation on a fortigate 100 E.I have two policies in place, to permit communications between two vlans:The policy wich permit communication between Production Lan to Vlan 102 is working, from 10.10.0.x i can access anything on 10.10.2.xBut the reverse policy is not working. I cannot access anything from 10.10.2.x to 10.10.0.xMy settings are in the picture belowThe working policyworking policyNot working policy not working policyWith anticipated thanks for pointing me in the right direction,Hans

Hi All, i've recently setup a New  site-to-site VPN Tunnel  Tunnel Mode on our 200D, in 5.4.Tunnel is Up and Running and i'm able to reach the remote FW  in https and remote Users are Able to reach Local resources.but, but....Here is my issue :there is an UDP traffic which not working correctly, namely SIP traffic (5060).i'm able to see the Original direction going throuh different VDOMs, but the reply direction on the last VDOM going through the bad Tunnel IPsec and the IP phoone never succeed in registration. already check diag sni pack during while pinging --> okalready check diag debug flow while pinging and it is matching the good tunnel :(already check diag debug flow to see what happens ( UDP 5060 traffic)--> some traces id=20085 trace_id=2116 func=print_pkt_detail line=4751 msg="vd-VPN received a packet(proto=17, 192.168.XXX.2:5060->192.168.200.XXX:5060) from FWA-FWB. " id=20085 trace_id=2116 func=resolve_ip_tuple_fast line=4815 msg="Find

friends good day a question:In our review of malicious connections from the internal network, we observed that there are many malicious connections from the fortigate IP. Could you help me with your comments, why is this happening?currently the fortigate has a vulnerable version and I don't know if it might be related to this.

So i have  three VLAN 1,100,1000 - i've enabled DHCP on VLAN 1000, the other VLAN's do not have DHCP Snooping turned on. When i plug my laptop into one of the ports i get no IP from the Native Vlan - 1. If i disable dhcp snooping on vlan 1000 it works fine. MY question is when you enable DHCP snooping for ANY vlan does that impact the trust/untrust setting regarding of whether other vlan's have it or not? - my assumption is yes i proved it by trusting the uplink/downlink port and reenabling DHCP Snooping on VLAN 1000 - continues to work fine. FWIW - the switch is not being managed by the FG - managed directly Just wanted to check with others. Cheers,

Unable to connect to my Radius Server . Test connectivity settings on Fortigate primary server fails

 Hello everyone ! I have a weird bug with explicit proxy . All users( with exception of 2 )  gets only domain user group .while test in cli shows 2 groups For user FortiGate-201F_Backup # diagnose test authserver ldap ldap-kerberos testuser testpassauthenticate 'testuser' against 'ldap-kerberos' succeeded!Group membership(s) - CN=PC,OU=Permissions,OU=Groups,OU=AEG,DC=domain,DC=localCN=Domainusers,OU=Permissions,OU=Groups,OU=AEG,DC=Domain,dc=local  So this user only gets one group shown in “assets & identities - firewall users “and so firewall rule does not work correctly as it shows only 1 group “domainuser”. And the main weird thing is thatthere are 2 users in domain where fortigate displays correctly in assets & identities - firewall users “ “2 or 3 or 4 whatever” groups for those users and the  firewall policy works correctly for them .  

1500D 7.2.5.I have two 1500Ds each with an EMAC interface on the same vlan.What criteria is used to generate the EMAC mac address? Is there a way to change the EMAC mac address or at least control how the address is assigned when the interface is created?

hihow can prevent start page violation with fortiweb 6.3 and above? in older versions of fortiweb like 5.x version start-page access was in UI console!thanks

My SSL VPN RDP connection bookmark closes immediately.

Hello Dears, one of our customers has a HA FGT devices and we implement new FMG 7.2.2 so i'm confused how we can add them as a single device to avoid license consumed two devices.

Dear All, just one question. Is it possible to use a Fortigate 50E without costs or contract? To get for instance "Firmware & General Updates" without a fee?RegardsHeimo

friends, could the traffic shaping configuration be considered a good practice? I've been reviewing a FG but I don't see traffic shaping policies so I plan to create a few.

Dear Forum! I have one question for you: I have one Pubilc IP which maps to several internal Servers and different Porst: 62.218.51.90 -> 192.168.15.233    Ports : TCP 1723 GRE(IP:47)62.218.51.90 -> 192.168.200.253  Ports: UDP 5083 and 10000-2000062.218.51.90 -> 192.168.15.240    Ports: TCP 432562.218.51.90 -> 192.168.15.236    Ports: TCP 25 How can i manage this because the Fortigate says to me its an conflict. 

Hello, We have 2 Fortigate with Eval license applied, is it possible to configure Active-Standby Failover and then when we will receive our licenses we just apply them to the firewalls? 

we have FSSO Agent running on member server, it pollss the AD server.when looking at Show Logn Users, most of the users show as Type DC-agent, but a few are showing as type EventLog.can someone tell me why?  my understanding of our setup is it polls the AD server, and those users in certain AD groups are allowed internet based on the group they are in.so what is EventLog type in that case?

I have created VIP objects on the Fortigate. Since I am in the process of replacing another firewall with the Fortigate. Now I have experienced the following phenomenon. Every request is sent to the Fortigate and not to the other firewall running in parallel. How can this be that the Fortigate gets these requests although I have not yet created a policy just the VIP Objects?

Hi All,Today I have configured successfully email based authentication for Forticlient VPN and when I configure using Local user that time I am getting authentication code. I want, the user type must be Radius user not Local user.User must be authenticate using Radius server.Can anyone guide how can I achieve this things.Please refer the snapshot.    

The latest build of FortiClient EMS ships apache version 2.4.54, which is vulnerable to CVE-2023-25690 and others.Is there a planned fix, or is it possible to upgrade apache independently to the rest of the application?Thanks.

Hi!. Currently we have a FortiSwitch directly connected and managed by a FortiGate. The trunk between the FortiSwitch and the FortiGate is automatically formed by fortilink (default-auto-isl), so the name of this trunk corresponds to the serial-number of the FortiGate. The FortiGate is managed by a FortiManager. In the event of a FortiGate failure, what would be the process to replace it? Is it necessary to apply some configuration in the FortiSwitch so that the trunk updates the name or does this change automatically? Thanks,

I'm a newbie regarding Fortinet products, so forgive me if I ask something silly  :) When I hit an innocuous website likewww.newsweekjapan.jpI get fortinic firewall notification that access was blocked by firewall policy 15.I then check policy ID 15It's named GEOBLOCKIt has for destinations two address groups'GEO IP FILTER'and'BLOCKED-IPs-Group'The first group does contain "Japan" (why it would is a mystery to med at the moment)The 2nd does not contain the ip address (block) of NewsweekjapanSo yeah.. Seems all Japan ip/sites are blocked right?Yet random *.jp sites I tried in chrome come up just fineI found no exceptions that would seem to allow some jp sites through but not othersConfused  

Hello TogetherFor the documantion for the Fortiswitch, Doucusnap is used by the customer.The Fortiswitches are only connected to the Fortigate via Fortilink.I can make the Fortiswitch accessible via SNMP and ping? 

Hi,I have an IPsec connection set up from AWS to Fortigate.In AWS, there's a private subnet containing various services, including EC2 instances.Within my Fortinet, there are two networks - a DMZ network and an internal network, and they can communicate with the EC2 instances without any issues.However, I'm currently facing a challenge: I want to enable internet access for the EC2 instances through the IPsec connection, following this path:EC2 ===> Fortigate 1 ===> InternetTo achieve this, I've configured the AWS route table to have a route with destination 0.0.0.0/0 pointing to the virtual private gateway (VGW) to handle internet-bound traffic.On the Fortigate side, I've implemented two policies. The first policy is to allow traffic from the WAN to AWS IPsec, and the second policy is to allow traffic from AWS IPsec to the WAN.Unfortunately, despite these configurations, the setup isn't functioning as expected. When capturing traffic on the Fortigate, the results show:1 0.000000

We are having issues with the file name(length) in our FTP server is there a way to rename or modify the config file so that we can enable auto-backups. Thank you.   

Hello,  I want to allow push updates for my Fortimail. Problem is i cannot add FortiGuard servers as a Source for incomming direction. Has anyone encountered this? Am i getting it wrong? Thank you. 

Yesterday I've updated my LAB FortiAP (W2, 223E) to Version 7.0.6.First Update to 7.0.5 -> FortiManager shows FP223E-v7.0-build0078 -> expectedSecond Update to 7.0.6 -> FortiManager shows FP223E-v7.0-build0068 -> quiet unexpected? I thought I've made a mistake during updating, downloaded Image "FAP_223E-v700-build0108-FORTINET.out" and tried to update directly by the AP GUI -> same issue? Double Check:I've edited Firmware Image by an Editor and the file header shows "FP223E-7.00-AP-build0108-230329-patch06-protver02". Anybody updated to the new Firmware and can agree with the right Build No. after updating a FAP Wave2?