Solved

I have the following use case with Fortigate 6.4.12: I have a DNS domain hosted with my ISP for internet facing service say myorg.com. Therein I have several hostnames for services. I need to split-brain only specific hostnames under this domain internally on my corporate LAN. For example  When www.web.myorg.com is resolved from the internet I wish to give 1.1.1.1When www.web.myorg.com I wish to return 2.2.2.2When anything underneath it (host.www.web.myorg.com etc.) is resolved I wish to forward to another set of DNS servers Internally on my corporate we use Windows DNS servers. Whilst these support conditional forwarding catering for 2 and 3 is messy and requires multiple upstream DNS servers. Can the Fortigate DNS servers setup with non-authoritative zones simply answer for specific records and forward for all others in a zone? 

Hello. we are using a 100d and the field crew is working over ssl vpn. Now we are thinking about backing up the clients over ssl vpn as well. Unfortunately it's not possible to get this running. Client update of the backup software (acronis) is not working but the client is shown as online in the managemnt console. Is there a principle thing I do not hink about? The access of c$ is not possible as well.

Hello Fortinet Community We have FortiNAC 9.4.3. All corp hosts have PA agent. We enabled PA optimization on all access switches.Without IP phone everything works fine. However when we connect a host with PA agent behind a IP phone, the PA seems not to initiate DHCP request when VLAN is changed, so the host's IP remains unchanged, until we initiate ipconfig /renew, here the IP is renewed correctly and all works fine.This issue happens every time when VLAN is switched by FortiNAC, e.g.: from isol to prod, or from prod to isol, or from prod1 to prod2, ... etc Any useful idea would be appreciated.    

Hi. I have a question regarding IPSec VPN.We have a customer that is currently in the process of switching from an ASA 5505 to a FG-40F-3G4G, both physical on-prem.They have an IPSec VPN as of right now, which we use to access thier enviroment to make regular maintenance. With this, they will also replace their physical server which they host two VM's on (App and DB) with two VM's hosted in our cloud service along with another virtual firewall (PfSense) hosted in the same cloud. My question is, they have a public ISP with a dynamic public IP address and this in turns makes it hard for us to setup IPSec VPN on the FortiGate. Is it best to make the PfSense an OpenVPN client and make a OpenVPN connection to the FortiGate, or is there a better way to do this?If more information is needed, feel free to ask and thank you for all the answers. Kind regards

We have a current SD WAN setup with LAN internet connectivity traffics load balanced to 2 ISP providers - both WAN interface IPs are used and the bandwidths are combined.192.168.0.0/24 --> ISP-A-50Mb (1.1.1.1/29) + ISP-B-50Mb (2.2.2.1/29)Both IPs are used randomly in each session even in a single deviceBandwidths are combined to 100MbpsThis time I would like to use the other available IPs from each ISP block then still have the bandwidth combined and load balance from a diff LAN subnet.192.168.10.0/24 --> ISP-A-50Mb (1.1.1.2/29) + ISP-B-50Mb (2.2.2.2/29)Attempt: Assign overload IP pool for each ISP, and setup an outbound firewall policy NAT to it.Only single IP (random) is used per deviceOnly single ISP bandwidth is utilized - 50Mbps

Good day all. The IP address assigned to one of my WAN interfaces on my Fortigate changed unexpectedly a few days ago. It is assigned by my ISP via DHCP. Is there a log I can check to determine exactly when this happened?

Hello I just want to know if it is possible to make a suggestion for NSE training institute for adding the feature of different playing speeds. As in x0.25, x0.5, x.075, x1, x1.25, x1.5, x1.75, x2 speeds. If I am supposed to make this suggestion somewhere else, please refer me.Best regards.

Morning: New to Fortigate, and am trying to setup SNATing some VMs out to the Internet from my home lab on VLANs. It's a 40F, so it doesn't have a VLAN switch. In this instance, the VM is on vlan50, using the Fortigate as a DHCP server. It receives an IP in the proper range, and I can move the VM from vlan to vlan in the lab, and it recognizes the different subnets and gets DHCP for them. So tagging seems fine. I just can't get out. My processAdded VLAN interfaces to the LAN w/DHCP, which is just ports 1-3 for now.Central SNAT is enabled. ALL/ALLFirewall policy: vlan50 > wan, ALL/ALL/ALLThe policy is getting hits, but I still can't ping out to any external IPs. I have a feeling I'm missing something simple here :) Any suggestions on what I'm missing?  id=20085 trace_id=197 func=print_pkt_detail line=5846 msg="vd-root:0 received a packet(proto=17, 10.16.50.50:57296->1.1.1.1:53) tun_id=0.0.0.0 from vlan50. " id=20085 trace_id=197 func=init_ip_session_c

Dear All,            I have a fortigate 61F, just wonder if Web filter support on only blocking specific gmail address rather than blocking the whole gmail.com ? any help would be appreicated  keith

I understand that the steps are to download the config fileChange the firmware , build, version, interfaces of the config fileUpload the edited config file into new firewall.Any other steps I need to take to ensure that the configuration port over is ok?

Hello guys! I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?

I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?Please, see the following raw log:date=2023-03-21 time=15:30:54 id=7213068811073749046 itime=2023-03-21 15:30:54 euid=12697 epid=1206 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=179721645 policyid=41 srcip=XXX.XX.XXX.XXX dstip=157.240.222.60 srcport=53029 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1679423454318969117 sentbyte=1239 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing

Hello team!!  Greetings!! We have 2 sites with a FGT60F in each site. (7.2.3 in one and 7.2.4 in the other)Each site has 2 WAN interfaces in an SD-WAN Currently we have 2 VPNs IPsec site to site:* Site 1 Wan 1 <-> Site 2 Wan 1* Site 1 Wan 2 <-> Site 2 Wan 2We are having troubles with this, sometimes one VPN stop passing traffic and users complain.  Then we change route distances to use the other VPN. I am wondering about the differences between "Aggregate" "Redundant Interface" and "SD-WAN" for IPsec site to site VPNs.Some considerations:* We dont care if the traffic is balanced, but we want the link will be working as much as it is possible* We would like to view the redundant links status, preferably in gui* It would be nice to create some email alert when some link is down.Which method do you reccomend?  Thanks in advance.Regards,Damián 

Dear guys!! I can not send my email to other via outlook when use my network (forttinet router) on both WIFI too cannot send, but I try on an andriod it's send normally, So why? can help me plz!!!!

Hi Forum I've been tasked by my company to investigate the deployment of Forticlient EMS (Enterprise Management Server). I realise that Forticlient EMS does alot of things though initially it will be used by my company to manage the Forticlient licenses.The company currently uses a SSL VPN connection directly onto a Fortigate and uses the free version of the Forticlient.They want to migrate to use the full FortiClient licenses version and then gradually rollout the appropriate functionality. I have found the QuickStart Guide here:https://docs.fortinet.com/document/forticlient/7.0.2/ems-quickstart-guide/516451/introduction I'm looking for a high level overview of how the Forticlient EMS works but can't find a resource on the Fortinet site that gives me that! I have found diagrams like the following showing the traffic flows between the Forticlient, Fortigate, Fortclient EMS and AD.https://docs.fortinet.com/document/forticlient/6.0.3/ems-administration-guide/5772

Hello,  I have a fortigate and it is registered to forticloud.  I would like to change the account it is registered to. I have done it previously  through CLI, but I cannot find the correct command.  I have found this page but I get an errorhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Logging-in-to-FortiCloud-from-FortiGate-CLI/ta-p/193664 Any help appreciated Thanks and regards, Konstantinos

I'm preparing my first 60E for deployment. This unit came with the new 5.4 firmware. Early in the process of configuring the unit I locked myself out of the firewall. I see a Reset switch on the outside of the firewall enclosure. Can this be used to reset to factory settings? I did not see any information about this switch in the manuals for the 60E. If this can be used how do you perform a reset, i.e. hold the reset switch in with a paperclip while powering up the unit? Is the use of the Reset switch documented somewhere, if so where? Thanks!

Our FTM is running 7.2.2 and our FTG's are running 7.2.4. These are relatively new installations, and we're trying to trim the amount of syslog traffic to our SIEM. On the FTM at Device Manager > [FortiGate] > Log & Report > Threat Weight, there are several security settings. I don't see where to apply these to the syslog settings, nor can I find any documentation to do so. The "Log Threat Weight" is enabled. We do not have FortiAnalyzer. Is there a way to configure syslog to send security-related info that can be ingested into our SIEM without having a bunch of extra fluff? Thanks

I have a FGT 90D and a 60D, both with FortiOS 5.0.12.The "set daily-restart enable" works just fine, but I think a weekly reboot would be more appropriate.Is there any way to achieve that in FortiOS? Thanks EDIT: Solution found on my last post... thanks!

FG 60Ev 7.2.4 I need help with the traffic shaping policy triggering and the traffic direction. When I created a VoIP traffic shaping policy based on the traffic direction from the source to the destination, which includes RTP and SIP services, I experienced some problems with the SIP DSCP marking. Applied EF but the output for the SIP packages was still CS0.The sessions output for the external inbound call for SIP session was:  session info: proto=17 proto_state=01 duration=540676 expire=179 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3 origin-shaper= reply-shaper= per_ip_shaper= state=may_dirty npu statistic(bytes/packets/allow_err): org=62869363/107131/1 reply=56299023/112453/1 tuples=2 tx speed(Bps/kbps): 135/1 rx speed(Bps/kbps): 106/0 orgin->sink: org pre->post, reply pre->post dev=46->37/37->46 gwy=10.10.5.25/10.55.100.100 hook=pre dir=org act=noop 10.55.100.100:5060->10.10.5.25:5060(0.0.0.0:0) hook=post dir=reply act=noop 10

We currently run v6.4.10 for our FMG-VM and manage bigger customer's FortiGates(FGTs) totalling about 600 (soon to be 800+).And one of them needs one VIP group (two VIPs) at all 500+ locations. We use policy packages for this customer to standardize their policies, which is almost the same at all locations. But when I looked at the VIP object config under Policy&Objects->Object Configurations->Firewall Objects->Virtual IPs then hit "Create New->Virtual IP", I don't see a way to select a dynamic address object for the External IP and Mapped IP.This means we need to create 500+ x 2 VIPs manually putting each IP, then worse, we need to create 500+ different policies and use "Installation Target" to be for one specific FGT. Is there a better way to have just one policy for one VIP group for 500+ FGTs? Or, can I use meta fields+CLI template to define those on Device DB side and somehow let the policy to refer to the VIP group name?  There should be a

Hi,we set up two separate VLANS on our Fortigate, one for the clients and one for the servers.The Fortigate acts as a DHCP server for the clients. The domain controllers in the server network, where the DNS role is implemented, are defined as DNS servers for the clients.The AD DNS servers forward all requests for non-resolvable hosts / domains to the Fortigate.As soon as the users / clients log in, they get the network drives assigned to them.Unfortunately, users will not be able to access Internet pages with this configuration.A policy allowing Internet access for users has been set up.If I add another external DNS server to the clients when they log on, the users now get to the Internet, but the network drives from AD are not automatically assigned and are not accessible. What setting is still missing so that users can get their network drives as well as access the Internet?

Hi, we purchased a renewal license to be able to upgrade our firewall (FotiOS 6.0.2 build0163 (GA)).We're certainly going to follow the upgrade path to upgrade it to the latest version but what concerns me is how this upgrade will affect the connected FortiSwitch and FortiAPs:1AP FP221E-v6.0-build00442AP FP221E-v6.0-build00443AP FP221E-v6.0-build0044FORTISWITCH FS108D-v3.6.4-build0399 May I upgrade the firewall to the latest OS without issues or I have to upgrade also all APs and the switch at same time for every firmware update? Or there's an OS version until I can upgrade without problems? Thank you Kari

Hi Everyone, I am implementing Fortimanager to simplify configuration of our firewalls.  We have (6) 70F units running 7.0.9.  I have added them all to Fortimanager, and cloned one of the configs to a policy package I want to use for all of them.  The configs are almost identical on all of them.  There are two units that do not have all of the needs that the other 4 do.  I have figured out how to prevent certain firewall policies from getting pushed to these through installation targets on the policies.  When I try to push this policy pak to the two units, I am getting the following: Vdom copy failed:error 0 - invalid valueCopy objects for vdom root"firewall ssl-ssh-profile", "certificate-inspection", id=4360, SKIP - (null)"firewall ssl-ssh-profile", "deep-inspection", id=4369, SKIP - (null)"dynamic interface", "ATM VLAN", id=5216, INVALID MAPPING - (null)"firewall central-snat-map", "3", id=8426, INVALID MAPPING - invalid value These two fi

Hi,  We have a few FortiExtenders with multiple SIM's. Have so far not found any good way of controlling which SIM that should be used.  Is there no way we can simply disable slot 1 when we want to use the SIM in slot 2 - and vice versa? I know about the swap policy by data and signal, but sometimes we need to simply disable one of the SIM's, and it would be easier for us to do this remotely without physically disconnecting them.