Solved

Hello all, I am a Fortigate newb.  The only documentation I can find on NAT over site to site IPSEC VPN pertains to versions before 5.6, and only to NATting entire subnets, on both ends.  I have a working IPSEC site to site VPN between my Fortigate (v.5.6) and a remote site (which is using a Cisco ASA.)  I am trying to make ONE host behind the fortigate, 10.0.100.198, appear to the remote site as 192.168.114.6.  Could someone tell me, precisely, what I'm supposed to do to make this happen?  I have experimented with Virtual IPs and IP pools, but nothing seems to work.  It's probably something simple that I'm missing.  If it helps, in Cisco language, this is what I'm trying to accomplish: object-group network external   network-object host X.X.X.X  object network internal   host 10.0.100.198 object network translated_address  host 192.168.114.6   (This is what I want the remote site to see 10.0.

hi,just started learning and managing fortigate FW so apologies for being a noob.i got a FG-40F with firmware version 6.4.6 build6083.i used the upgrade path tool and gave me this: my question is, do i strictly need to follow up this path or can i jump straight to our standard 7.2.2.note this just a lab FW. thanks in advance! 

Hi all,In scenario with two location connected via ipsec tunnel, remote office is accessing internet through wan port in main office, is it possible to capture and send traffic, remote office - internet and vice versa traffic,  to analysis sensor?Something like port mirroring in L2 world.Thank you,Drazen

Can we query to get percentage disk utilization using SNMP? What OID should be used?

I am using Fortigate-100F(Fortios 7.0.12), but appear below logs every day:Failed to connect FortiManager 173.243.132.61        Central Management connectivity is inactiveTunnel to FortiManager is down                                  Central Management connectivity is inactiveConnected to FortiManager 173.243.132.61               Central Management connectivity is active I do not use Fortimanager,  why appear those logs?  Thanks and regards,Gavin  

We want to move from IKE v1 to IKE v2 on our Fortigate 100F.  If we change the tunnel config on the firewall, and then make the Forticlient EMS tunnel match in version, will we need to reinstall Forticlients/profiles, or will this be a process transparent to end users if performed after hours? Would love to know what we're in for.  Thanks!

Hi, We just put a Fortigate in place. I have the SSL VPN working and vpn my clients can get to the 172.19.0.0/16 network that the Fortigate is also on. However, they can't get to devices that are on the 172.18.0.0/16 network. 

i am getting the following SSL error message from my fortigate firewall when i access some FTP and HTTPS sites. how can i by-pass this error message ? This Connection is Invalid. SSL certificate expired.A secure connection to ftpsin.emc.com cannot be established.When you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.Site ftpsin.xxxx.comCertificate CN ftpsin.xxxx.comCertificate Authority Entrust Certification Authority - L1KCertificate ValidityNot Before: Nov 6 22:29:54 2020 GMTNot After: Nov 6 22:29:54 2021 GMT

Hello all,I used FortiClient VPN for a while and one day, it suddenly started to pop up the following window:I checked the security & privacy settings as mentined, but couldn't find any request for approval from any app. Full disk access is allowed for "FortiClient" and "fctservctl2" so there should be no issue but still, it insists. I decided to uninstall the client and reinstall it and now there is a new problem. Second before the installation process ends, I'm getting this message:                   I clicked "Allow" and the installation finished.Now, when I open the client and add a new profile, after clicking "Connect", it's getting stuck in the status: "Connecting". The disconnect button doesn't respond, I need to force close the client completely to get out of it.Any idea what it might be? It worked perfectly for a long time and now it stopped.There were no changes in my system tha

I configured allow access from specific subnets under admin user configuration, but it still allows access from anywhere. Is there anything am I missing? 

We have a FortiAnalyzer and want to create a new dataset with bandwidth consumption for the previous month based on vlans port. The bandwidth consumption refers to traffic from/to vlan to/from wan port.E.g. vlanconsumedvlan10123vlan20456...... So query intercepts "internet usage" of vlan# for the previous month.Can someone help us? Thanks in advance.VZ   

HelloVRRP on FortiGate fails over in a minimum of 3s and I couldn't find a way to reduce it more.Tried to use VRRP v3 but I got the same.By the way VRRP v3 timers should be configurable in millisecond but on FortiGate it is still in seconds.Any idea on how to reduce failover time to 1 or 2s?

good afternoon colleagues, a question.In the morning we had some problems with access to some pages that I could access normally.In order to pass the certificate analysis I had to enter the rule and in the SSL INSPETION section change from certificate-inspection to no inspection until the page loads without problems and then return to certificate-inspection.This problem has been occurring with other pages that were previously accessed. the connection is not privateIt is possible that attackers are trying to steal your information from xxxxx.com(for example, passwords, messages or credit cards).NET::ERR_CERT_AUTHORITY_INVALIDIt is worth mentioning that when you enter through another network, for example, a cellular data network or a home network, if you can access the page and the message "it is not secure" does not appear.Do you know why this happens? It is worth mentioning that the certificate of the page expires in 2024 so there should be no problem. 

I have this log in our FortiAuthenticator. What does it mean? Failed to send notification to user[username] due to: [HTTP code 400] Cannot determine platform based on reg_id  

Is there a way to disable all accounts with out a token in bulk? 

Hello, communityI am trying to update the database ISDB through REST API FortiOS from file "ffdb_...". Which db_name should I use? The REST API Reference does not say about it? Also, when I try to update through web from file "ffdb_...": Fortiguard→ Firmware & General Updates I get the error: "Failed to upgrade database"

Hello, I run a single supervisor node in a virtual environment. Is it possible to install Windows Agent and configure it to send data directly to the supervisor, or I always need to set up a collector in order for the Agent to communicate with it? 

have you tried registering AIX server? we're able to configure syslog setting but AIX still not sending logs to Fortisiem.

Hi, I have a FortiGate 50E running v6.2.4build1112 The following issue occurs with different browers (FF, Chrome, Safari) and also on different platforms (Win,OSX,iOS,Android) For the last 24h I have suddently started receiving certifiacte errors on various websites which have worked flawlessly before. I get the typical HTTPS warning in my Browser (e.g. "Your connection is not private" in Chrome) and the exact error message is "NET::ERR_CERT_AUTHORITY_INVALID". Interestingly if I look at the certificate details it shows "Fortinet Untrusted CA" as the issuer. If I access these sites via mobile data these pages work fine and also the issuer is shown as a know institution (in all cases noticed so far it's "Sectigo"). In the SSL Logs I see "blocked" actions for the respective website: Message: Server certificate blocked Reason:    block-cert-invalid Type:    utm Sub Type:    ssl Event Type:    ssl-anomalies These actions are

Hello - We have a FortiGate 30E with 2 VLANs at a new office.  The first VLAN is for devices that just need internet access, the second is for domain connected devices that need to connect to the private LAN at our datacenter.  That connection is done through an IPsec VPN tunnel (FortiGate to FortiGate, other side is a 200E).  The 0.0.0.0/0 routing entry points to the local internet connection so that regular outbound traffic goes over that connection.  However, I'm trying to find a way to route all traffic on the 2nd VLAN over the VPN connection, including internet bound.  In other words, we want internet traffic from that subnet to be routed over our corporate internet connection in the datacenter, not the local office internet connection.  Is there a way to do this?

Hello!I hope someone can help with a boot loop issue on a 900D.Please excuse the NOOB description, as I am just coming into this job and have a non functioning device.Putty is being used for CLI serial access to the device.I have had to format the boot device, as I am starting from scratch--which appears to go fine.Then I load from TFTP (tftpd64 program) on MGT port 1 the downloaded OS version 7.0.0 (checksum verified).That goes well, no errors.Next I am prompted to choose the boot program as Default/Backup/ etc.I choose Default (I also have tried backup).The system then goes into the "Programming firewall" - again, no errors.After that the system reboots.Here is the console out put that is concerning, and I am not sure what to make of it.Sorry for the long detail, but perhaps someone can decipher it:FortiGate-900D ( 9:56-10.13.2017)Ver:05000004Serial number:123456789RAM activationCPU(00:000306c3 bfebfbff): MP initializationCPU(02:000306c3 bfebfbff): MP initializationCPU(04:000306c3 bf

Hello,I am running an AD on Windows Server 2019, and I would like Fortisiem to trigger any change or modification made on the DNS server ( adding a new record, deleting a record, etc ... ).Fortisiem now polls event information from different DCs by using OMI. 

Hi Guys, I have not configured any static route but it is showing in the routing table. Kindly suggest on the same. 

Hello Is it possible for a FortiGate to both act as the DHCP server and relay? The reason I would want this is because I have a NAC solution that would use the relay information to profiling the endpoint and the endpoint also needs to get an IP address from the FortiGate DHCP server. I have tested this in a Lab, but I am getting this error:FORTINET-FW (CISCO-CORP-LAN) # set dhcp-relay-service enableFORTINET-FW (CISCO-CORP-LAN) # set dhcp-relay-ip 10.0.1.51FORTINET-FW (CISCO-CORP-LAN) # set dhcp-relay-agent-option enableFORTINET-FW (CISCO-CORP-LAN) # showconfig system interfaceedit "CISCO-CORP-LAN"set vdom "root"set dhcp-relay-service enableset ip 10.100.100.1 255.255.255.0set allowaccess pingset device-identification enableset role lanset snmp-index 7set dhcp-relay-ip "10.0.1.51"set interface "port4"set vlanid 100nextendFORTINET-FW (CISCO-CORP-LAN) # nextdhcp server 2 of type Ethernet already exists on this interface, cannot add relay!object set operator error, -76 disca

i have deployed fortianalyser container with this command Docker run -it --restart always -p <Port Mapping>:443 -p <Port Mapping>:22 -p <Port Mapping>:541 --cap-add=ALL <image ID>:<Tag>and then i go to the browser i put localhost:39443, it says  "This site can’t be reachedThe connection was reset."is the image fortinet/fortianalyser not stable or what !!what is the solution please  !!?