Solved

Hi, I'm trying to configure a LAG on a FortiGate 40F (running on version 6.4.14 at this time (if an upgrade is required that's ok)) for connection to a FortiSwitch S124FP.  I've already configured a LAG on the switch, I just need to get it on the firewall, too. I found a YouTube video showing how to configure a LAG (https://www.youtube.com/watch?v=SGCSu5iXID4), but I seem to run into the immediate problem that all of my numbered ports on the firewall are already configured into a "Hardware switch" and are not available for configuring into the LAG.  The "Hardware switch" will not allow for deletion or removal of all ports, and removing any of the ports from it results in immediate loss of internet connection through the firewall (though I remain able to connect to the web interface). The firewall has 3 normal numbered ports (1-3), a lettered port (A), and a WAN port.  I'm assuming the lettered port is not available for a normal LAG, or at the least not if I als

I added policy routing to FortiGate, but it couldn't enable sla. FortiGate couldn't sense when the network of the next hop changedPOP1 # 配置路由器策略 POP1（策略） # 编辑 1POP1 （1） # 设置输入设备 传入接口名称。输入设备否定 启用/禁用对输入设备匹配的否定。src 源 IP 和掩码 （x.x.x.x/x）。srcaddr 源地址名称。src-negate 启用/禁用否定源地址匹配。dst 目标 IP 和掩码 （x.x.x.x/x）。dstaddr 目标地址名称。dst 否定 启用/禁用否定目标地址匹配。操作 策略路由的操作。协议协议编号 （0 - 255）。网关的网关 IP 地址。输出设备 传出接口名称。tos 服务位模式的类型。tos掩码 服务类型计算位。状态 启用/禁用此策略路由。注释 可选注释。互联网服务标识 目标因特网服务 ID.因特网服务自定义目标因特网服务名称。POP1 （1） # 结束POP1 # 获取系统状态版本： FortiGate-VM64 v7.2.3，build1262，221109 （GA.F)

The client had a single IP from Google Fiber before my company took over support. We installed an 80F, and the "static" is issued by DHCP from Google Fiber on the WAN interface. We have upgraded their Google Fiber account to add 5 static IPs. The statics are in a different subnet.  I am unsure what to do. Very important - if I create VLAN(s) for the static IP(s), what will change for the static IP issued by DHCP over the WAN? All traffic is currently using that DHCP static IP, including VPN. Will that render that IP unusable since it becomes a gateway for the block of static IPs? If the statics require VLAN, what interface? the main LAN or the WAN? What is the Role that I select: LAN? WAN? DMZ? Undefined? Can this be done with VIPs or IP Pools? If IP Pools, what type do I use? One-to-One, Fixed-Port Range, or something else? Here is Google's depiction of the necessary layout for using static IPs.   

Hey guys, I'm trying to make a connection to a VPN via the forticlient CLI in Ubuntu, but I'm not able to make it work, can someone point me to the right direction. I'm running the following command:/opt/forticlient/forticlient-cli epctrl register destination_ip -p portAs stated here CLI support for FortiClient (Linux) | FortiClient 6.2.0 (fortinet.com).But it always gives me the following output in the logs: I would appreciate any help! Thanks! FortiClient

HowdyI have to deal with a very mysterious problem of FortiAP U231F. To start with, I plan to move my U221EV and U231F from WLC to FortiGate. With the U221EV it's no problem at all and with brand new U231F, that were never connected to the WLC will work like a charmBut now there is the point, I have multiple U231F that got to know WLC, when I do the same like with my U221EV, then it "should" work and welcome me in my FortiGate, but sadly it never happens. My procedure is the following:1. WLC CLI to AP2. bootimg imageid 33. When AP is rebooting and for a moment offline, I switch the VLAN (only difference is the DHCP that is linking to FortiGate and not WLC)4. AP boots up and I can authorize it at FortiGate5. Firmware update6. Profit :) This works with all U221EV perfectly, with the brand new U231F it starts from point 4. so no problem at all, too.But with U231F that were once connected to WLC I tried the bootimg, reset-default command via WLC CLI, hard reset via rese

SW INFO:-pnetlab 5.2.7-fortigate qcow eval license https://www.youtube.com/watch?v=26_2A9YOjdchttps://www.youtube.com/watch?v=ND8JTAwkoQM I am following above links to set notification in telegram if admin loginI can send manually from linux to telegram# curl --request 'POST'https://api.telegram.org/bot5962153123:AAHf7wKYu7dhheSiLc580pC4G-LUmEvOSLA/sendMessage -H 'Content-Type:application/json' -d '{"chat_id":"-759260123","text":"coba2"}'  CONFIG:config system automation-actionedit "telegram"set action-type webhookset protocol httpsset uri "api.telegram.org/bot5962153123:AAHf7wKYu7dhheSiLc580pC4G-LUmEvOSLA/sendMessage"set http-body "{\"chat_id\":\"-759260123\",\"text\":\"%%msg%%\"}"set port 443set headers "Content-Type:application/json"set verify-host-cert enablenextend STATUS:-I can see System Event shown "Automation stitch triggered" but nothing happen in my telegram ?1. can I test using fortigate 7.2 eval license in pnetlab tq UPDATE1:-wi

Hi, I have two WAN Interfaces and two DMZ Interfaces. I need my Internal LAN users to use WAN1 for Internet Access and WIFI users who are also connecting from the LAN Interface but with different IP Subnets should use WAN2 for Internet Access.Does the Firewall automatically create Static Routes for the WAN Interfaces as default routes or they must be created manually? I have created two routes like this: Route for LAN Users:Destination: 0.0.0.0/0.0.0.0Gateway: WAN1 GatewayInterface: Port2Administrative Distance: 10Priority: 1  Route for Wifi Users:Destination: 0.0.0.0/0.0.0.0Gateway: WAN2 GatewayInterface: Port3Administrative Distance: 10Priority: 1 What should be the administrative distance and the Priority for both Static Routes?Do I also have to create Policy Routes for both the WAN Interfaces to forward the traffic through different WAN Interfaces?  Secondly, I need to forward some traffic through the DMZ Interfaces. Is it possible to add a group

I changed the Password of admin and I try login to my VA on vm but it give invalid user or pass but I sure that the correct password that i write and try to access to the root user it give error login and not let me login 

Hi, What is the proper way to SNAT an IP to another IP? I don't want to use the external interface IP address but the system asks to enter the IP range when I select Dynamic IP Pool instead of a single IP Address. How to do "one-to-one" nat without using an IP Range? For Example, 192.168.1.10 should be translated to 10.10.1.10 before leaving a DMZ Interface.  Thanks.

Hello everyone,I'm using a forti #100E 7.2.5 and I'm having problems with a rule (port X to WAN)I have allowed all traffic from a specific address. In the logs I see that the traffic is authorized, I send data but I receive nothing.I haven't seen anything specific in the implicit rules and I have the impression that this problem occurred with version 7.2.5. Are you experiencing this type of problem?Could you give me some advice?Many thanksSincerelySébastien 

Hello all,I'm using the Fortigate 200F with firmware version 7.2.5.I want to enable the Cisco Anyconnect remote access VPN using my current fortigate firewall.I'm asking if there is any tutorials or KBs to help me with the steps for this project. Many thanks,

HI All, May i know Could fortiGate support configure redundant interface with LACP for full mesh HA? Thanks

what is the correct way to block malicious email in fortigate?some times we have users reporting to us that they received phishing/malicious emails and request us to block.we do it at the M365 and AV level. do i use email filter or is there another way to block such email domains?

I have a fortigate with a dedicated mgmt interface.On the lan side, I use i.e. port1 with the address 192.168.77.1/24.Is it possible to "set dedicated-to management" to the mgmt interface and give it an address like 192.168.77.200/24 ?Usually, with normal ports, this would lead to issues with routing as both interfaces would be directly connected and in the same subnet.Yet, the explanation of the "dedicated-to management" function seems to indicate that this should be possible (?). Though it seems that still both interfaces (port1, mgmt) would generate a direct connect route.So, even if it's not best practice, can I place the dedicated-to management interface into the same subnet as another port on the same fortigate?ThanksDan

Hi, Is it possible to allow only some IP Addresses and FQDNs to access the firewall WAN interface from the Internet and deny all others? Thanks.

I am making a few servers available to the public for my users and contractors when not on-premise. I have secured the servers already with a wildcard certificate and have the VIP and policy set and have tested accessibility. What I am wanting to do now is to additionally provide IPS and WAF profile inspection to those policies. The IPS and WAF part I understand, what I am a little fuzzy on is the SSL inspection requirement for these to actually do their job. In the fortiOS admin guide, there is always an example for WAF applied to a policy where they are also setting the policy to use a deep-inspection profile.I understand the need for deep-inspection, but how does that work with public access for a private cert? Will they just get certificate warnings until they themselves import and trust it on their own? I see where I can create a Protecting SSL Server profile and specify my wildcard cert I imported into my FortiGate, but is that enough comparatively to deep-inspection?

I have this constellation: FGT A (Shopsite) has static WAN IPs FGT B (on events) has dynamic WAN IP(s) and is not allways online Between FGT A and B is two IPSec Tunnels which should provide redundancy. Due to reasons (to me this is still bugs in FortiOS even if TAC still refuses to aknowledge them) the only way is to use Dial Up tunnels. That is because on S2S every side needs to know the opposite remote gateway. FortiOS does support the use of DDNS/FQDN as remote gw but without p1 autonegotation or oif the ipsec is in listening Mode on FGT A it does not update the gateway ip. So S2S will go down upon first ip change and not come up again.To workaround this I use dial up because that always is in listenig mode in FGT A and it does not need to know the remote gw.To achieve redundancy I use sdwan vpn. However with dial up tunnels on FGT A the sdwan fails to select the correct member  and route once the link status of the ipsec changes. This seems to be due to th

I will try to make this brief. We have FSSO working against our Active Directory in order to pull groups that we use to establish the level of web filtering for a particular group. An example would be where the network and firewall teams can reach site: "almost whatever we want" whereas the Warehouse and Marketing personnel can only reach sites related to their specific job function. This works great for us since the HD is responsible for the group memberships so we change nothing during the on-boarding process. The thing is tho every year the Auditors that come in here ding us because the rule has the word "ALL" in there as the source address and we have to convince them that it's not really "ALL", it's only members of that AD group (fsso.profile.branch in the example below) that will match on that policy and be granted that level of access and not ALL devices in our company.. If it were ALL then no rules below this would be processed for 80 and 443 traffic so they should know better.

Hi all, we have around 50 static routes. I just need to advertise two of them in eBGP. I managed to stop propagating static route and try to advertise only the two needed... can't get it done (is there a clear how-to I can follow?).I could re-advertise static routes and block all 48 not needed... but it feels an overkill...What should I do? Thank you.

I have a FortiGate 80F, and I've attempted to configure WAN failover. Configuration:internal1:     ip/mask: 192.168.3.99/255.255.255.0    dhcp range: 192.168.3.110-210    DNS: 8.8.8.8,8.8.4.4 wan1:    ip/mask (DHCP assigned): 192.168.1.21/255.255.255.0    dns/gateway: 192.168.1.1    distance: 10 wan2:    ip/mask (DHCP assigned): 192.168.2.110/255.255.255.0    dns/gateway: 192.168.2.254    distance: 20 Goal: All traffic should be routed through wan1 when it is up. Only while wan1 is down should traffic be routed through wan2. Issues:I can never ping the wan2 dns/gateway (regardless of wan1 being up or down) unless I'm connected directly to the wan2 router via cat45 or wifi. I also cannot ping the router on wan2 (IP address: 192.168.2.110)When wan1 goes down, I cannot get out to the internet (unless, again, I'm connected directly to the wan2 router).In ot

Hello to all, I am newbie to Fortgate 40F  (OS 6.4),  We are in the process of connecting BT leasing Line (UK). (IP addresses has been changed) BT advised us to set up as below, BT installed their own CISCO Router 41.126.33.9. Fortigate WAN  IP : 41.126.33.10Fortigate LAN IP: 192.168.50.254 I have no idea how to setup Gatway IP 41.126.33.9.  I would apprecaite any input. Thanks in advaice. ********************* IPv4 Directly Connected Section: IPV4 Network Address                             : 41.126.33.8  IPV4 Network Mask                                : 255.255.255.248  IPV4 BTnet NTE Router LAN Address  &nbsp

Good evening, Is there any way of getting the full OS version of FortiGates managed on FortiCloud? The OS version listed (FG100F-FW-7.02-1396 for example) doesn't seem particularly helpful if you can't get the build number without logging into the support portal and navigating all the way down to the individual firmware version (unless there's a list of build numbers against FortiOS version numbers somewhere I haven't seen?). The Software Lifecycle page is slightly more helpful but only lists firmware down 7.2 or 7.0 for example, not specific release.  Alternatively, how else do companies automate keeping track of firmware across many individual clients?

HelloWe have FortiClient EMS 7.0.8.We use invitations in order to integrate Windows PCs to the EMS managed hosts.However last time we discovered that when we install FortiClient (7.0.9) on any Android host and configure a connection to our FCT EMS, then the Android phone gets automatically managed by EMS without any invitation!  Is that behavior normal? Then we tried to disable this unwanted behavior by enabling "Enforce invitation-only registration for ALL", but the result is that all managed hosts were ejected from managed hosts!Is that behavior also normal? So what is the best way to disable auto Android registration without affecting the current managed hosts. 

I was trying to stop and start all processes in an attempt to get the latest content update to install. Every time we try to install it the status just sits  at "Installing" with no progress bar updates into perpetuity.   So I thought I would try restarting the processes.   When I log in as root and run phtools --stop ALL it fails. Below is a snippet of the output that contains errors. Version 6.7.0.1716Content Version Running:  407 [PH_MODULE_LOG_LEVEL_CHANGE]:[eventSeverity]=PHL_INFO,[procName]=phtools,[fileName]=phBaseProcess.cpp,[lineNumber]=682,[oldLogLevel]=424,[newLogLevel]=424,[phLogDetail]=Module received log level change[PH_UTIL_PHOENIX_CONFIG_ITEM_MISSING]:[eventSeverity]=PHL_ERROR,[procName]=phtools,[fileName]=phConfigurations.cpp,[lineNumber]=157,[propName]=phtools,[phLogDetail]=Could not find item in phoenix_config.txt[PH_MODULE_INIT_COMPLETE]:[eventSeverity]=PHL_INFO,[procName]=phtools,[fileName]=phBaseProcess.cpp,[lineNumber]=563,

This is my first foray into using BGP and I am implementing it on my FortiGates setting up a SD-WAN hub and spoke VPN setup. My existing routing protocol is OSPF with all of my L3 devices using unique router IDs, of course. My question is, is it ok to use the same router ID for BGP as well? So FortiGate would have OSPF and BGP router ID of 1.1.1.1 for example. My initial thought was yes as it's two different routing protocols; however, I know I will have to turn on redistribution between the two, and just wanted to confirm...you know what assuming will get you :)Thanks.