Solved

Recently we setup a DR site with a new FGT100F firewall.we configured a IPsec site-to-site tunnel from our main firewall to the new DR site.the tunnel is working and we can connect to the DR site with no issues.But when we realize that SSLVPN users cannot connect to the DR site.is there any special routing needed at both end of the firewall in order for SSLVPN users to connect to the DR site.SSLVPN have no issues connecting back to main office subnet or other remote office subnets which are connected via MPLS circuits. main office -> 172.16.0.0/24  <-----------> new DR site 172.32.0.0/24SSLVPN users -> 172.15.0.0/24 

I am trying to understand the output of "diag vpn ike gateway list name <name>". I would like to know what the line "child: <yes/no>" says. Can someone explain this to me?fortigate # diag vpn ike gateway list name <Name>vd: root/0name: <name>version: 2interface: wan1 7addr: <IP1>:500 -> <IP2>:500created: 1323297s agoPPK: noIKE SA: created 1/17 established 1/17 time 0/4/40 msIPsec SA: created 1/32 established 1/32 time 0/0/0 msid/spi: 2390 xxxdirection: responderstatus: established 23088-23088s ago = 0msproposal: aes256-sha384child: yes <--- What does this line mean?SK_ei: xxxSK_er: xxxSK_ai: xxxSK_ar: xxx57message-id sent/recv: 30/37lifetime/rekey: 86400/63041DPD sent/recv: 0000083b/0000083b

Hi All , We've FortiGate Firewalls running Active-Passive HA. We've enabled VDOMs and root VDOM is the management VDOM.We have local NTP server. But FortiGate time is not syncing with local NTP server. FGT-INR03 (global) # execute timecurrent time is: 16:08:13last ntp sync: never sys_update_timer_func:1755 synchronized=0Sorted NTP endpoints.NTP daemon uses a upper end of -2000000000.000000 and a lower end of 2000000000.000000.no server suitable for synchronization foundntp_dns_cb:1926 in_flight=0 resolved=0 ipv6=0ntp_dns_cb:1926 in_flight=0 resolved=0 ipv6=0waiting for 9 seconds . Our FortiGate has no internet access, so it's impossible to reach FortiGuard and we must sync with local NTP server.Can you please help me how can I sync with Local NTP server on VDOM enabled HA  environment? Thank you

As of yesterday, in the phase2 settings for a site-site VPN connection to Azure I had the following:set proposal aes128-sha256 aes256-sha256Last night, the connection failed.Looking at the saved config from a couple of hours before I see the "set " as it was.Now, however, I am unable to modify the phase2 settings to anything other than aes128, either through the command line or the GUI.  The drop down in the GUI will let me select AES256, and appears to save it, but if I go back, the setting reverts to AES128In the CLI, I get a parse error for aes256.Running V7.0.12 build8800The FG seems to think the Phase1 connection is OK.  Azure even still things the connection is good.  But the phase2 connection is red. As mentioned.  This behavior did not occur yesterday. and the VPN configuration has been in place since 10:40am, but failed at 7pm The only change made yesterday was enabling HA.  But the saved configs showing the aes256 setting was from over an ho

Dear Team,One of our customer is moving from FG300D firewall to 200F, however wants to know if we can re use the SFPs of 300D firewall in 200F firewall. based on Fortigate 200F data sheet, the SKU has changed from FG-TRAN-LX/SX/GC to FN-TRAN-LX/SX/GC.Could you please confirm if FG-TRAN-LX/SX/GC can be reused on 200F ?

Just looking through the 6.4.8 Known Issues and found this:721487FortiGate often enters conserve mode due to high memory usage by httpsd process. This seems to be similar to the WAD issue:712584WAD memory leak causes device to go into conserve mode. I have a (sad) workaround for the WAD issue by regularily issuing diagnose test application wad 99 with auto-script. However, there is no similar way for the httpsd.It looks like I'd need to ssh into the box and first identify the httpsd PID with diagnose system top and afterwards issue diag sys kill 11 <process-Id> Is there a better, automated way?When there is no active Web-GUI session, is httpsd restarted?In your experience, when does the httpsd high memory usage comes up? Conserve mode scares me off, since I already had twice to drive to client locations to get an FG-60 and an FG-61 working again. ThanksDaniel

Have two new 601E Fortigate units. Running identical firmware.Each think they're the only one. HA port is green on both.  If I reboot the "secondary" the "primary" sees the link drop.Primary is set to priority 200, secondary is left at default.Reset password just to be sure.  Group name is correct on both units.Secondary has been factory reset, and only the hostname and  HA config settings added.Both units have been registered, although the secondary cannot talk to FG at the moment since the public link has not been reconfigured, but is connected.The "inside" interface is not yet connected..The HA interfaces are directly connected.  No switch or hub between. They just don't seem to see each other.  Ran several of the suggested diag commands, and don't see anything obvious. 

Hello guys i receive this error when i make a ping via CLI from fortigate 40F to 8.8.8.8In particular i write this command on CLI:- execute ping-option source 10.2.62.97 (ip address for internal LAN)- execute ping 8.8.8.8 after i receive this issues posted below  16:27:28 178 vd-INTERNET:0 received a packet(proto=1, 10.2.62.97:23->8.8.8.8:2048) tun_id=0.0.0.0 from local. type=8, code=0, id=23, seq=0. 16:27:28 178 allocate a new session-0003f14f, tun_id=0.0.0.0 16:27:28 178 in-[], out-[a] 16:27:28 178 len=0 16:27:28 178 result: skb_flags-00000000, vid-0, ret-no-match, act-accept, flag-00000000 16:27:28 178 gnum-100004, check-ffffffbffc041c80 16:27:28 178 checked gnum-100004 policy-1, ret-no-match, act-drop 16:27:28 178 checked gnum-100004 policy-1, ret-no-match, act-drop 16:27:28 178 checked gnum-100004 policy-2, ret-no-match, act-drop 16:27:28 178 checked gnum-100004 policy-2, ret-no-match, act-drop I understand that seems that there is no match in policy but why

Hello members,I am finally writing to this forum, since I was not able to find anything similar to this.I have a FQDN for example "web.example.com" for which a public DNS entry exists. But for clients I want to resolve this FQDN with a private IP. I am using the FortiGate as my DNS Server (recursive) and when I am inside my network this works perfectly fine. But when I am using the FortiClient to connect to my network over SSL VPN the FQDN still gets resolved with the public IP and not with the private one from the DNS Server on the FortiGate. I have split tunneling disabled so all traffic should go over the FortiGate and even if I set the IP of the FortiGate as my only DNS Server on the windows machine it still resolves the FQDN publicly. I was using FortiOS 7.4.0. I would really appreciate some hint on how I can make this work out or if there was a similar post in the past. Thank you :)

Hello, We have configured several VPN tunnels between our HQ and Branches. In configuration we see that our Branches WAN IP address is recognized be our Fortigate as a Static Route directed to IPSEC interface. Is it normal behavior and if it is possible to change it? FortiGate 

Hi all,Can anyone tell me the difference between traffic:forward and traffic:local in fortigate logs?Also, what is utm:app-ctrl event?

Hi guys, I have a FortiGate and an Asus wireless router. at present the ASUS wireless router is providing internet to our office and, now I want to connect my FortiGate between the internet and Asus wireless router to control the traffic but, when I connected my FortiGate to the wireless router both ports of two devices not up and even no detection. If test connection from pc to FortiGate and wireless to pc those ports up normal. I'm not that what I need to configure more and the FortiGate support with the third-party device or not. please, advise me to solve it.Thank you.

Hey guys!Recently, the security area of the company where I work asked me for a list with the categories of web filters in the company's internet firewalls and everything that each web filter is allowing access. In the web interface I list all this, but I can't export. Using the command line I also list everything and it's easier to export to a file, but the category names are replaced by ID numbers and the requester won't know how to deal with that. Could someone give me a tip on how we can do this?Thanks in advance, guys!

Question on the TRAP generated by Fortinet devices like “TRAP: {node} a switch controller session is down”. Is there an SNMP OIDS to Poll the switch controller data instead of using SNMP Trap that we currently have? TIAModel: Fortinet FGT_40FSoftware: FortiGate-40F v6.2.7,build1190,201216 (GA)

Hi, Looking for some guidance. We are new to Fortinet. Please forgive if I don't word this right. We have a block of external IP's. I want all devices on an internal subnet like 172.16.0.0/16 to use one of those external IP's in a NAT. I then want an internal subnet like 172.17.0.0/16 to use another external IP that we have. Is this possible?

Hello,If 2 different internet connection plug to same fortinet, can we make an failover so if ISP1 down then all traffic will be routed to ISP2 automatically?

I am trying to implement the shadow-ztna feature so I do not have to host dns entries for internal resources on the public internet. I am using the below 7.2.5 administration guide. It states that the command is hidden but on the 200F running 7.2.5 the command is missing entirely. Is there a specific feature that needs to be enabled or some pre-configuration so the command can be used. https://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/708477 

Hello Forti Communty, I need help with getting split tunneling to work on Mac OS. We have the following situation in our company:We have a firewall cluster made out of two FG 100F version 6.4.12.The IPSec VPN configuration with split tunneling we are currently using is working perfectly for all of our windows clients. Now we also have to support Mac OS but we ran into some troubles.For our clients we use the free VPN client from Forti in version 7.2.0, the Mac and Windows config is also similar.The VPN connection itself on the Mac is working great but due to the missing split tunnel feature it is only possible to connect to company internal resources when the connection is active. So for example google.com is not working because all traffic is sent to the virtual VPN gateway. As soon as VPN is disconnected all external resources are working again. Now I have the following questions: Is it possible to use split tunneling on Mac, maybe via workaround?Is there a different s

I’m having trouble with Sangoma talk app. It keeps trying to register but fails with “effective transport unspecified”. Has anyone solved this? I have a Fortinet firewall with port 5061UDP and RTP10000-20000 open, but RTP ports are closed when scanned. Any suggestions? Here are the logs:2023-07-31T20:40:08.441Z (1690836008441522)Sip::Registration::onTransportErrorCorrelation Id: SiphoneUserAgent[104865000]SipUserAgent[104866200]State: RegisteringRetry: NoError: GENERIC(3): Subcomponent FailureIn ali_net_connection2.cpp:457ALI-SOCKET(4): Cannot ConnectIn ali_net_tls_socket_impl2.cpp:802Note: Remote Address: xxxxxxxxxxxxxxTLS-ALERT(40): Handshake Failure (40)In ali_protocol_tls_client.cpp:16842023-07-31T20:40:08.441Z (1690836008441552)Sip::Registration::setStateCorrelation Id: SiphoneUserAgent[104865000]SipUserAgent[104866200]Current State: RegisteringNext State: ErrorgetCurrentState: return state: ErrorREGSTATECHANGED, current=ErrorisCommunicationAllowed: network=Cellular

I have a problem with a page that is https for example https://www.ilovepdf.com/es.When I use the webfilter profile or the appcontrol in a policy, even if it is only in a monitor way, these pages are blocked. SSL inspection only logs, doesn't block anything. Can you help me with this topic?Thanks

Hello!I'm replacing our Cisco Wi-Fi 2504 wireless controller and 2600 series APs with a Fortinet solution (431F & 433F APs paired with a FortiGate 600E internal wireless controller). I am intending to use WPA3 with our WiFi6 compatible laptops and WPA2 with our WiFi5 laptops. The SSIDs are set to WAP3 SAE Transition. The good news:-Both WiFi6 & WiFi5 laptops are connecting with the intended authentication method and speed. The question:-How can I push the passphrase for a SSID to multiple laptops so that users will not need to enter the passphrase manually? I did find an article that showed me how to use 'netsh' to export the SSID and passphrase to an XML file.  Then I created a batch file to use netsh to add the SSID to target computers.  It seemed to work, however, when the test user clicked on the SSID name in the Windows network list, the user was still asked to enter the passphrase.  Below are the basic commands.-netsh wlan export profile

what happen if I have configured the memory settings like this on Fortigate firewall?set memory-use-threshold-extreme 70set memory-use-threshold-green 75set memory-use-threshold-red 71When memory usage reaches 70% or higher, the device will enter an "extreme" condition, is it fine?

Hello,i've been asked to migrate 2x Cisco 2130 FTD to 2x Fortigate 200F.I was wondering if there is a way to export all the FTD configuration and import it in the forticonvert for the conversion.Did anyone do this type of migration?From what i know these's no way to export the entire cli config from the FTD (like is possibile for the ASA).Any tips would be appreciated. ThanksRegards

Hi all, As you all probably know, Fortinet will release a new certification program in October this year. Currently, I am studying for my first NSE6 certification (FortiNAC) since I will work with this product soon. To be NSE6 certified you need a total of 4 NSE6 product certification, and therefore I was wondering, is it still worth it now? Will this certification be of any value after October? Can I use my FNAC cert also in the new certification program? #NSE #NSE6 #NSE4

Hello everyone! Giving the following scenario:I have two policies with the same source and destination "all", but each policy has a different Webfilter profile. If a request doesn't match any url in the webfilter for the first policy, will this request be denied or the second policy will be evaluated? I ask that because we are migrating policies from another firewall vendor to Fortigate and in that other vendor, there is some similares policy rules, with exact same source and destination "any", but with distincts URL Categories and all policies are evaluated until a match or the request is denied just on the implicit deny. As I can see, the Fortigate will block the request in the first policy if no match in the Webfilter and will not evaluate the second policy, because it already have matched the first policy by source and destination address. Is that correct?