Solved

Hello Fortigate Community,We are currently in the process of onboarding a new client who has a Fortigate 60D running FortiOS 5.2. Please note, this firewall will be replaced soon. The setup consists of two Internet uplinks configured once over PPP1 and once as a LAN interface.As part of the onboarding process, we have established a VPN tunnel to a Sophos firewall. The VPN tunnel is up and operational. From the Sophos side, the remote network can be accessed correctly, and the devices in the remote network can be reached without issue.However, we are experiencing problems in the opposite direction. Despite setting up a static route, the Fortigate firewall sends all the traffic to the default gateway over PPP1/Internet instead of routing it through the VPN tunnel interface.This behavior is causing us a fair amount of difficulty as it's inhibiting communication in the direction from the Fortigate firewall towards the Sophos one. It's worth noting that we haven't had any similar issues wit

Hi,I have configured a partially redundant IPsec VPN with two local links going to a single link, static IP server.The two links are seen as dial-up on the remote FG.I used the wizard to do all configs.SDWAN is used to team the two WAN links.I added via the CLI an interface monitor for the primary VPN tunnel so failover can happen. Everything works as expected except for... on the dial-up side the wizard creates a remote address group for VPN subnets.Try as I might, I cannot add another subnet as an address object into said group. The newly created address object is not shown in available addresses.On the remote end I can add a subnet into the local address group for the VPN. Why does it work this side? Because it's the server and not dial-up or possibly the interface monitor has got something to do with it? The only way for this to work on the dial-up side was to delete the config and use the wizard again and add all required subnets at config time so the group is created ac

Hi Fortigate'rs I have a (two actually in a HA config) FG101ETK Firewalls which I am very happy with. However, it constantly sends me e-mails when people are trying to "hack" our VPN. I'd like to avoid getting those errors as they clutter my inbox and may hide important messages, and there's really nothing I can about it anyway. Message meets Alert conditiondate=2023-06-19 time=04:58:21 devname=FG101ETK00000000 devid=FG101ETK00000000 eventtime=1687143501487137862 tz="+0200" logid="0106037121" type="event" subtype="vpn" level="error" vd="root" logdesc="Progress IPsec phase 1" msg="progress IPsec phase 1" action="negotiate" remip=61.66.190.98 locip=1.2.3.4 remport=8512 locport=500 outintf="wan" cookies="3e35cd0719dfedef/0000000000000000" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="N/A" status="failure" init="remote" mode="main" dir="inbound" stage=1 role="responder" result="ERROR" How do I stop the firewall from sendin

Hi,Would like to ask is there any guide to setup SMS / Whatsapp / Line incident push notification.I would like to setup push notification to my phone via SMS or Whatsapp for some serious incident. I saw a FortiSIEM Taiwan Webinars video, fortiSIEM able to send alert to SMS and Line app.Thank,John.

Hi Guru's, I'm capturing traffic using 'diagnose sniffer packet' on an Enhanced MAC VLAN-Interface. The capture contains the proper mac-address from the VDOM. However, when I capture on the client side, it seems that mac address has changed to a different address. I think it's the 'di hardware deviceinfo nic emac-vlan' -> Current_HWaddr address, probably inserted by the EMacvlan Ethernet driver. Is this correct behaviour and is it possible to retain the original VDOM mac-address? Because this breaks our source based mac forwarding on the loadbalancer. Regards!  

Hi, I'm trying to install the Fortinet VPN client on Linux but it doesn't work. The .deb package has a dependency on libappindicator1, which seems to have been deprecated quite a while ago and is thus impossible to install. Are people actually using FortiClient VPN on Linux? How do you do it?  

Hi,I am quite new to fortigate and ZTNA. But anyway I got a fortigate and a FortiEMS set up, they are connected through fabric.I have set up a ZTNA Server and have TCP forwarding to some RDP servers. It works even though only running TCP is killing the Terminal Server performance.So to the problem, I am trying to set up a reverse web proxy against an internal server where I need to pass authentication. So I tried to make create a authentication schema and I get the prompt and I am authenticated but it is never passed to the backend server. So my question is, is this at all possible?The backend server is a common IIS with Negotiate and NTLM  as authentication.my goal is to expose this server to the internet and in best case have a transparent authentication of the logged in user in the windows client all the way trough the reverse proxy into the internal server.I have done it with TCP forwarding of port 443 but a reverse web proxy is probably a better choice if possible.Any input i

Hi, I'm trying to redistribute OSPF over BGP. The Neighbors are getting the routes but the routes are using wrong recursive next hop IP on one of the sides...  When you look at the routing table on the right side it is using the WAN IP instead of the tunnel IPDEFLE-FW01 $ get router info routing-table bgpRouting table for VRF=0B 10.1.2.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.3.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.4.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.5.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.6.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.90.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.91.0/24 [200/20] via 172.21.1.6 (recursive via ADVPN tunnel "WAN IP"), 01:06:38B 10.1.91.100/32 [200/0] via 172.30.0.254 (recursive via AD

Hi.I would like to build vlan net works.And each goes different WANs.Is it possible to build?My knowledge is so poor... Could someone help me.------------------------------------------------------------------VLAN ID : 10192.168.0.0 /24 VLAN ID : 20192.168.100.0 /24 VLAN ID : 10 ===> WAN1VLAN ID : 20 ===> WAN2------------------------------------------------------------------ 

We have a list of 800 ip addresses in a spreadsheet that need to be added to the Credentials and Discovery tabs under Admin --- Setup. Currently the ip addresses are being added manually one at a time, which is very time consuming. Is there a way to import the bulk list into Fortisiem or script this process? 

friends a query.For which scenarios should the "security fabric connection" be enabled in the interfaces or what is the reason why it should be enabled?   

Can you plz any one help me to understand Fortimail "Server Mode".how its work what are the features? how its work? FortiMail   

Hi, we are trying to pilot Fortimail with only a few mailboxes from our organisation. We have Fortimail cloud setup in gateway mode. We have already done the default configuration guide on it, except changing the MX records on our DNS Zone file. Doing that would cause the whole domain's users to be routed through FortiMail, our concern on that is that we will exceed our license count. We've only bough 100 licenses to test out on a few users before onboarding our whole user base. As per TAC support, with this setup, we cannot selectively activate licenses on select users via FortiMail. So we have to send mails for only certain users to the FML unit for filtering. Currently, we have this proposed mail flow:External mail (from anywhere, e.g. user@foo.com) >> O365 MX >> Mail Flow Rule (checks recipient if part of pilot program) >> FML >> Runs filtering >> user inbox (user@bar.com) We've already setup the protected domains (bar.com) as per the initial

When FortiAuthenticator provides mobile token registration, it connects to FortiGuard to offer users the service of token registration. What data is included in the upload when FortiAuthenticator connects to FortiGuard to provide registration service? Are there any personal or privacy-related concerns?#fortiauthenticato #FAC

Hello I have a Fortigate 60B that needs to have SPI disabled as part of a test.  Are these the right commands in CLI to make that happen: config system settings set asymroute enable end Also, If you enter this command, what kind of impact would it have on current traffic?  Does the FW require a reboot? ThanksJay

I get a super weird issue with a Fortigate 40F ( version 7.2.4 ). Infrastructure:1 FG40F1 local ssh server on Windows 10 Goal: SSH server should be accessed on the Internet ( obviously with some protections ) Issue:When I do a connection via a telnet command from LAN ( with local ip address ) : $ telnet X.X.X.X 11022Trying X.X.X.X...Connected to X.X.X.X.Escape character is '^]'.                     SSH-2.0-OpenSSH_for_Windows_8.1      <---- I get a ssh identification string BUT when I do a connection via a telnet command from Internet ( with a public ip address ) : $ telnet X.X.X.X 11022Trying X.X.X.X...Connected to X.X.X.X.Escape character is '^]'.                         <----- connection to ssh server from outside but no ssh identificat

Hello all,I want to use external DHCP on my SSL VPN.I found the following on the internet:config system interface edit ssl.rootset dhcp-relay-service [enable|disable]set dhcp-relay-ip nextend Only with these settings, it's not working.I think there is also a configuration need on VPN SSL web portal or VPN SSL setting or I have to assign an IP on the interface ssl.root Does anyone here know about this? Can someone give me the winning tip?

Hello everyone,i am writing to you because we have a strange problem about the dns of the vpn ssl. In the menu SSL-vpn setting we have specified the following dns to use: 172.1.1.20 - 172.1.1.30, unfortunately we have noticed that all the clients connected through forticlient inherit completely different dns, that is: 172.1.10.50 - 172.1.10.60. is there a way to understand why they take different dns although we are configured explicitly in the portal?dns configuration in attachment, do i need to open a case or do i have do control something more specific? Regards 

Hi,previously I had fortiauthenticator which was used to manage the SSO part, currently instead it has been decommissioned and Azure AD has been implemented to do the same tasks.I have some doubts and issues that I cannot resolve.it seems that it is not possible to census the individual user but it is necessary to put them in a specific group on the azure AD side in order to manage sso?in this case i am wondering if it is possible to have a timeout for SSO disconnection. .For example, if the computer is used by multiple people and therefore the OS has multiple user profiles how does this work?If another user logs in from another profile is a second SSO authentication requested or does the session of another previously logged in user remain active (since the association is IP based only)?Regarding the captive portal for SSO authentication: is it possible to use the same endpoint to log in with SSO from different subnets/interfaces?This is to avoid having to create for each subnet an app

Hello, We configured the VPN SSL authentication  using SAML (Azure AD) successfully for some groups.To distinguish profiles, we mapped different groups with specific realm+portal. Firewall group A = default realm + portal AFirewall group B = realm B + portal BFirewall group C = realm C + portal C Both groups A & B mapping work perfectly, allowing users to connect to multiple realms depending on the device they are using (portal A for workstation, portal B for mobile device, portal C for limited users) The firewall policies work for firewall group A and group B however, users which are in group C are blocked whenever they are correctly connected to the SSL-VPN with their group.The ACL for group C is nearly the same as the groups A & B :- Source IP : Group C pool IP- Source group : Group C The result is packets are dropped because the implicit firewall rule. We found out that there is a difference when we check the group membership on VPN SSL an

Hi My setup:FortiClient VPN -> FortiGate 40F <- Site-2-Site -> Zyxel -> DCFortiClient subnet: 10.45.130.0/24 (DNS: 10.1.8.16)FortiGate subnet: 10.45.134.0/24 (DNS: 10.1.8.16)DC: 10.1.8.0/24 FortiGate firmware: 6.4.6FortiClient: 7.0.8.0427 When I'm with my client on the subnet 10.45.134.0/24, I can ping and resolve all hostnames of my domain. But when I'm connected through my FortiClient VPN, I can still ping all IP's just fine, but I can't resolve and DNS names of my internal network. It's like it's not using the DNS on 10.1.8.16. I have configured dns name for my FortiClient:config vpn ipsec phase1-interface(phase1-interface) edit <VPN TUNNEL NAME>(VPN TUNNEL NAME) set domain abcd.local(VPN TUNNEL NAME) end I have tried to disable split-tunneling on the VPN connection, but still no luck. I then tried to create a DNS Database on the FortigateType: SecondaryView: ShadowDNS Zone: abcd.localDomain Name: abcd.localIP or Primary: 10.1.8.16And

Hi In the FortiOS Release Notes for version 7.2.5 under New features or enhancements, Feature ID 894191 mentions "Improve GUI memory consumption for FortiGates with 2 GB of RAM or less". At what cost was this accomplished? Anyone have such information?Because in fact, my RAM consumption dropped by about 15-20% (FGT 60F).

Does FortiGate-80F have a protecting function against spoofing traffic such as MAC address spoofing, ARP spoofing, DHCP spoofing, and DNS spoofing?If so, how can I check the function by commands?

Can anyone explain me what can be done under:System > Network > Interface > PhysicalSystem > Network > Interface > VLANSwitch > Port > PhysicalSwitch > Interface > PhysicalSwitch > VLAN I tried to understand it, but couldn't. Thankyou for any help.

Hi, I have a problem with firmware upgrades of a FGT-Cluster.A part of the configuration gets lost after upgrading the firmware of the cluster.I don't even know the steps/update path of the last time.But this time the upgrade was from 7.2.3 to 7.2.4.A restore of the configuration helps.  I guess it has something to do with the save mode - set to manual instead of automatic.Next time I will change the save mode before the cluster gets upgraded?! But I just wanted to ask, if there is anyone else, who faced the same problem?