Solved

halllo TogetherIs on the Fortigate firmeware 7.2.3 irgende wleche performance problems regarding IPSEC tunnel known?

Hello TogetherI have the following problem:On the Fortigate, a couple of S2S VPN are made to a Vmware Edge Firewall.One S2S VPN interrupts so every 45-48min but only for 2-3 seconds.Phase 1 goes down + phase 2 goes down but comes right back up.The other VPN configured exactly the same do not have this problem.Does anyone know such problems?Thanks for your help

Hey everyone,I have two fortiswitch 224D running 7.2.2 firmware that i want to configure standalone.Switch 1 uses ports 23/24 for WAN and is connected to switch 2 with fiber.My workstation is connected to switch 1 using mgmt port.I created the vlans i need and also created a trunk using the fiber ports however, i seem not to be able to communicate with switch 2.Since i am obviously doing something wrong but don't know what, could someone point me in the right direction ?

It has come to my attention that out of the 5 users with 3000, only five are experiencing a particular issue. I am curious if anyone has any insight into why this may be happening. Any information would be greatly appreciated. (Forticlient SSL VPN with SAML error -7200 at 48%)

I need to create an IPSec tunnel from a FortiGate to an PfSense OpenVPN. Is this possible, or do I need to create an IPSec tunnel on both firewalls?Tried to google this but found nothing helpfull.Kind regards

Hi guys, a friend of me is creating a new (small) office. In the old rooms he found an old (used) FortinetAP221E.He tried to use it but he said "on adding it to FortiNet" it says "already registrered to another company". How can we solve that issue or where is that shown? I tried to register on FortiNet Asset Management now by adding the serial number, but it says "Invalid input data". Maybe someone has a hint for us? Thanks.Andy

Hello!I have three site-to-site VPNs with AWS using static route and I want to switch to BGP routing.The articles I've read only deal with BGP with just a VPN, no redundancy.How do I configure the FGT BGP routes to use the three VPNs? FortiGate 

Dear colleagues, good afternoon. In this post I seek information on how to perform a configuration in Fortigate where I can prevent the equipment from reaching 80% CPU usage. This fact has occurred with some frequency lately. I would like advice on how to proceed in this situation. Thank you very much in advance for your attention and understanding.

I removed lan2 from the CLI, and noticed that it is now greyed out and missing from Network in the GUI.  Was expecting it to become a physical interface in Network when removed from the virtual-switch.Original configuration of virtual-switchconfig system virtual-switchedit "lan"config portedit "lan2"nextedit "lan3"nextendnextendI then ran the following commands:config system virtual-switchedit "lan"config portdelete "lan2"Then I tried to added it back in with:config system virtual-switchedit "lan"config portedit lan2It gave an error: entry not found in datasourceIf I do "edit ?" it shows that lan2 is not available:*name Physical interface name.lan3 interfaceconfig system interface does show a lan2How do I get it to show up as a physical interface via CLI after removing it from the virtual-switch?How do I re-add it to the virtual-switch from the CLI?

I have a FortiGate and a bunch of FortiSwitches that are being locally managed. I want to set up admin authentication using LDAP. I successfully configured this on the FortiGate but I can't get it to work on a FortiSwitch. Is this something that is just not possible? The switches are not linked with the firewall.

Could someone be kind to explain what is the meaning of the next 2 lines that show up on a reseller quote: -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------Line   Qty          Part number                               Description                                                                     &nb

We have been using EMS previously for configure my FortiClients to autodeploy VPN connection using the classic SSLVPN with username/password options. Now we have configures our VPN connection to utilize AzureAD using SAML login.However, I dont see this option when configuring VPN settings in the EMS settings. On the client its a simple tick on/off option, but its seems like this is not possible when deploying the settings from EMS. Are there any tricks to utilize this? I have downloaded EMS 7.2, and there is not option to enable SSO, when configuring the VPN connection.  

 Dear community Hello,So i get reaaly hard stuck at joining the internal DNS servers with my fortigates.In the setup that follows i have a simple 60F, with a flat subnet behind it, no vlans,no subnets, evertyhing coming through a vswitch in FGT and the out tou the wan link.The goal is for my endpoints from the ssl vpn tunnel to be able to resolve internal devices DNS names.These endpoints are not domain joined.Neither the internal are Also ssl vpn simple set up with Domain users and local ones(not a web mode one).Split tunneling is disabled  Problem is i cant resolve DNS names neither from the clients side when connected through the ssl vpn tunnel,nor from the command line of the FGTs. Internal resolvment of FQDNs between PCs(witch are not domain joined,works fine) As you can see in the print screens provided, i have for the FGT targeted, the Fortinet DNS server as option 1 andthe internal DNS VM Server's Local IP as option 2And my local domain name. Also

Hello everyone,Thanks in advance for taking the time to read.We changed our ISP 6 months ago and I just saw an error in the "Static routes - IPv4" :    - New WAN1 as PPOE - Use fortiguard DNS servers to get a fortiDDNS domain with the correct static IP the default gateway in the Wan interface :    I am not an expert (Lets just say I know how subnet are managed but never took the time to understand since my field is geomatics) Would anyone be able to give me an advice as to :Why the gateway is not in the same subnet as WAN1, if the gateway IP is taken dynamically from the WAN1 connection ?  

Dear Community,i am having problem with logging in a fortimanagervmdoownloaded img, installed it on HyperV with 4 GB RAM 2 CPU cores1 initial nic vswitch1 initial vhdd FGMVM has a dummy policy to connect to internet through FGT.I can see the traffic logs from FGT and ping from the CLI of the VM when i try to log in with Forti cloud creds from GUI i get undefined error I tried to upload my trial license file from my assets with no avail. Any ideas?Thanks in advance

Hi All, I had try to find any CLI command everywhere for fortigate to display the status of the power supply unit when doing UAT, Power Redundancy Test. But could not be found.For this unit, Fg401E, Fw 7.0.10Example like, when 2 PSU is plug on, the status will be like Connected or Ok. When one of it is unplug off, the CLI command will display 1 PSU connected 2 PSU Not connected, etc.Attached is an example of it. 

HiiCould someone help me please to identify the problem I don't know why this traffic is blocked and it affects our ADSync Server online syncronization  

Hi, On FortiGate, an IPsec Tunnel is configured to the AWS site-to-site VPN, which is the only configuration to communicate to the outside. However, I have found some internet-service-name configs(ISDB) unintentionally rewrote like FortiGuard synchronized updates. I wonder why this FortiGate can communicate with FortiGuard under the condition that IPsec Tunnel to the AWS site-to-site VPN is the only way and. The configuration is like this:---config firewall policyedit 1set srcintf "LAN"set dstintf "AWS_Tunnel"set action acceptset srcaddr "all"set dstaddr "all"set schedule "always"set service "ALL"--- I would really appreciate if anyone gives an advice. Thank you,

I have a user that i setup for ssl vpn connection with the forticlient 7.0.8.  the device is having trouble conencting and stops at 20%  this happened after some required software was installed.  Is there anything that anyone knows of that would interfere with forticlient from connecting to a ssl vpn?   thanks

Hey FortiExperts, For FortiGate NGFW throughput e.g. 60E - 250 Mbps - NGFW60F - 1 Gbps - NGFW This NGFW would be traffic that is utilising security profiles e.g. web/application control?Say in my scenario I am allowing outbound traffic with one firewall policy with security profiles enabled. Would the max throughput be throttled to 250 Mbps if I was running a 60E? Likewise if I was running a 60F instead of a 60E would this throughput limit to 1Gbps? I would like to clarify what NGFW means on the datasheets https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiGate_FortiWiFi_60E_DSL_Series.pdfhttps://www.fortinet.com/content/dam/fortinet/assets/data-sheets/fortigate-fortiwifi-60f-series.pdf   If you can also refer me to the documentation to understand those metrics on the datasheet this would also be appreciated thanks.    

Is there a how-to on configuring yubikey 4 on a Fortiwifi 60E for a second MFA on VPN? Is it done in the CLI? I am also  using the fortinet vpn client 6.0.10.0297. Thanks for any insight.

I have upgraded kubuntu 22.10 to version 23.04 recently, and since then Forti Client refuses to connect with the error message "Config routing table failed" (was working well before).  An excerpt from the sslvpn.log: 20230424 21:10:49.713 [sslvpn:DEBG] route:380 Tunnel mode: Full tunnel20230424 21:10:49.713 [sslvpn:DEBG] route:381 Exclusive routing: Disabled20230424 21:10:49.713 [sslvpn:DEBG] route:434 Can't find dev for IP XXX.XX.XXX.XX (tun)20230424 21:10:49.713 [sslvpn:EROR] vpn_connection:1335 Config routing table failed I have already tried reinstallation, also with a different version of the Forticlient (7.0.7.0246 instead of 7.2.0.0644), and I have also tried connecting from a different network - without success. Has anybody encountered similar problems after upgrading to ubuntu 23.04? Thanks in advance,Friedrich

Currently we have 2 sites that we connect through a Site to site VPN, this is already up and running. All of our servers are on Site1. We would like to have our printers and access controllers on Site2 get an ip address (and communicate with) from the server on Site1 without adress translation or a static route. Is this possible? And what should I do for this and/or what am I doing wrong because it is not working. My apologies if this is a stupid question, if anyone feels like taking a look at this dummy problem with us, we are immensely grateful.... 

Hi Is there any option to monitor the percentage of accelerated sessions in fortigate firewalls with enabled VDOM?I've been  looking for an OID to get this parameter but I can't find it.thanks Manel

I have successfully configured a site-to-site VPN connection between 2 Fortigates.The two subnets of the locations can also reach each other with static routes.However, if I create a policy-based route instead of a static route, no data is transferred.Unfortunately I didn't find a suitable article about FortiOS 7.2.This article cannot be implemented this way under 7.2: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-policy-routes-for-route-based-interface/ta-p/193376Can someone give me a tip here?