Solved

How to find which policy is used for a specific traffic( from a particular source to particular destination.) using cli

        I am in the process of configuring a new hub for our ADVPN-BGP environment. When I we were using FortiOS 7.0.8 it work worked with very few issues, but now in 7.0.10 I run into nothing but issues. When I run a ping from spoke to spoke, the first attempt will give me 2 successful pings and then die. If do an exec router clear bgp all and clear the table, will get successful pings for about 10 seconds and then it dies again.  So I run diagnose vpn ike log filter mdst-addr4 x.x.x.x y.y.y.y on each of the spokes and I when the pings are successful I see what I am supposed to see, but in the same ping the connection dies, I get: 2023-03-09 12:01:55 id=20085 trace_id=139 func=resolve_ip_tuple_fast line=5931 msg="Find an existing session, id-00001185, original direction"2023-03-09 12:01:55 id=20085 trace_id=139 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface EDW_ADVPN_0, tun_id=0.0.0.0"2023-03-09 12:01:55 id=20085 trace_id=139

I have a FortiWiFi 60F new out of the box. I upgraded it from 6.4.6 to 7.0.11 following the upgrade path. I have console window up and it constantly displays  unregister_vf: waiting for vsys_if#0 to become free. Usage count = 5.  I google and looked here in the forums and can find nothing about it. I see references to HA, but this gate's HA is in standalone, so HA is disabled. What is this?    

we have a user who is on a different domain and we are trying to give them access to a file server on our domain. I had tried ssl vpn through the web, but read somewhere that if we wanted to map drives would need to use forticlient.The user was able to connect to ssl vpn through the web. And they could ping IP of file server, but not dns name. If he tried to map drive, he would get an error saying "an error occurred while connecting Z: to "share path". The network path was not found. I installed forticlient ssl vpn, and configured is as well. But when users tried to login they get an error message: "failed to establish the VPN connection. This may be caused by a mismatch in the TLS versions. Please check the TLS version settings in the Advanced of the internet options. (-5029)"The fortigate is running version 7.2.x and has max tls set at tls1-3. And the users computer which is the one trying to connect to VPN is also running 1.3 and down to 1.2. Unable to test file mapping until t

Hello Everyone I recently created a ipv4 policy connecting to our partner. the policy created is inside to outside; the source ip is from our internal network but we have NAT the private ip to public via virtual address and enabled NAT. When we attempt to connect to our partner via icmp to see if they see our traffic logs, they note the public ip of the firewall but not the NAT ip associated with that public ip. I have placed the policy at the top but still they are unable to see our NAT public ip The traffic is leaving my network and hits together with active sessions are noted, but on the other end they view my firewall public ip instead of the NAT ip

Hi, trying to activate VM evaluation license (using Foricare account) but I get the error "Error downloading license: Invalid serial number". Other questions in the forum didn't help. Image downloaded: FGT_VM64-v7.2.4.F-build1396-FORTINET.out.ovfNo other evaluation license requested. The VM has ping to Internet:  FortiGate-VM64 # execute ping www.google.com PING www.google.com (172.217.20.164): 56 data bytes 64 bytes from 172.217.20.164: icmp_seq=0 ttl=115 time=26.9 ms 64 bytes from 172.217.20.164: icmp_seq=1 ttl=115 time=26.9 ms 64 bytes from 172.217.20.164: icmp_seq=2 ttl=115 time=25.7 ms  Other info: FortiGate-VM64 # get system stat Version: FortiGate-VM64 v7.2.4,build1396,230131 (GA.F) Virus-DB: 1.00000(2018-04-09 18:07) Extended DB: 1.00000(2018-04-09 18:07) Extreme DB: 1.00000(2018-04-09 18:07) AV AI/ML Model: 0.00000(2001-01-01 00:00) IPS-DB: 6.00741(2015-12-01 02:30) IPS-ETDB: 6.00741(2015-12-01 02:30) APP-DB: 6.00741(2015-12-01 02:30) IN

In a 81e fortigate firewall Nat is enabled between the policy created between port 1 and port 1 which are internal networks.Can anyone explain the working of NAT in that policy.

Hi all,   After upgrade to 5.2.4 my web admin session is disconnecting suddenly, while I'm working and before to idle timeout.  I already saw this in other versions of 5.2.X. Regards,Claudio Rezende

First timer here, so be kind :) We have two FortiSIEM environments - QA and Prod, to which we send logs from a number of sources, one being FortiMail. In our QA environment (minimal setup, hardly any resources like CPU/RAM) FortiSIEM manages fine and updates the default Fortinet Security dashboards as you'd expect. For some reason that doesn't happen in our Prod environment (BIG server, plenty of resources). Both environments are running the same versions, one collector fronting the sup, log sources as well as collectors are on the same subnets, log is coming into both QA and Prod, if I check in Analysis I see transactions in both - but the dashboard won't update in Prod. Any way we could re-initialize a dashboard? Any idea where we should look?

Hi all, I have an error while try to active FortiGate Cloud in FortiGate-VM 7.2.4. Error message as belowAnyone has been through this case? ThanksMore info: - I've been tried to active using Admin Guide, it's said I must enable Cloud-Logging in "Log & Report" first but in my version there's no Cloud-Logging option even in CLI configuration.- The account that use for Active FortiGate Cloud already active in Portal services of FortiGate Cloud.- My VM is activated with license VM02

Hi all, Need help on FG401E and Fortimanger on the address object limitation and address manage. Once the individual Fortigate firewall is integrated to FortiManager, how will the object being managed and will the limit depends on FortiManager or individual FortiGate firewall? For example, firewall A have 10k objects, firewall B have 10 k objects. Assuming that none of the objects in Firewall A and B is the same. Both firewalls are then onboarded to FortiManager. Will the object count be accumulated and now each firewall sees 20 k objects which is their limit? What is the limit of object the fortimanager can store?

Hi all, I am trying to get my FortiClient IPSec VPN working, but so far without success. I'm using FortiClient 7.0.3.0193 on Windows 10. I have configured the IPSec connection the way the firewall admin told me, but everytime I click on connect it just gets stuck forever at "Status: connecting" without establishing the connection. At the same time, the client kills almost all IPv4 and IPv6 connections from/to my laptop, so I lose all network connectivity until I click on disconnect. The only connection on my laptop that remains online and pingable during the connection phase is the link-local IPv6 address. All other outgoing and incoming pings from and to my machine fail, but as soon as I click disconnect all addresses are pingable and the system goes online again. At first I thought it was a problem with the credentials so I tested it with identical setting in a Windows 10 VM and there it works perfectly fine. VPN gets established and internet connection remains functional.&

Hello Team,I have upgraded the FortiManager to 6.4.11 and we have fortigate firewalls with version 6.2.12 and 6.4.8.After the upgrade when I go to create new rules Insert Above or Insert Below in fortigate firewall running 6.4.8 I get the below error message.firewall/policy/509: logtraffic cannot be set to utm when policy action is deny.Interestingly Policy 509 doesn't exist.But the firewall with version 6.2.12 doesn't have any issue.It seems to be a bug affecting fortios version 6.4.xAnyone can confirm if it's a bug or how do I resolve the issue. Thanks

Hi all, I wanted to know in my fortigate firewall with fortios 7.0.11, if I am using app control profile in policy then deep packet inspection is required compulsory? Issue : Actually I am having existing policy with app control with normal certificate inspection but I am getting intermittent issue in zoom meetings if I am using Dpi then too sometimes I am getting issue so if using Dpi then zoom need to be bypass from it?

Does these licenses come as default for 1 year?"forticare support""firmware & general updates"What happens if it is not renewed after a year?Is forticare support like TAC support? I realize that i cannot download firmware manually. Do i use forticloud to resolve this problem?

I use fortigate telnet server prompot: FortiGate-201F # execute telnet 192.168.20.15 5000Trying 192.168.20.15...Connected to 192.168.20.15.Connection closed by foreign host.ping is okFortiGate-201F # execute ping 192.168.20.15PING 192.168.20.15 (192.168.20.15): 56 data bytes64 bytes from 192.168.20.15: icmp_seq=0 ttl=64 time=0.2 ms64 bytes from 192.168.20.15: icmp_seq=1 ttl=64 time=0.1 msI use my pc telnet it is ok , the port of the server is open and there is no restriction

With Fortinet is it possible to see a network of an ipsec VPN configured on another fortinet??obviously between the two fortnets I have an ipsec VPN available.I would like from network x to see network y which is in VPN on the fortinet which is not my gateway but another fortinet.is it possible??

Hi All, Please forgive the fairly basic nature of this question! Our organisation is migrating away from Meraki MX Firewalls and onto Fortigate - probably 80F's or 100F's at this stage. With Meraki, only a single IPSEC VPN profile / subnet can be assigned per device. I have been asked to ensure that the below checklist is possible with Fortigate, I would really appreciate any support you are able to offer! Multiple VPN profiles / subnets - with the ability to assign different security restrictions to the various different VPN user groups / profiles?2FA / MFA support for client VPN's?The ability to integrate with AD / Radius and authenticate users via their domain credentialsFurther to this any comments on whether we should be using client SSL or traditional IPSEC VPN's would also be appreciated - huge thanks in advance! ☺

All of my sites are currently using Fortigates. My main site has a Fortigate 80F. If I look at my site to sites to my main site, I see a weird peer ID that I didn't set. I didn't define a peerID/Local ID at all on the tunnels. Has anybody ever encountered anything like this? If so, why does this happen? FortiGate 

I have a Fortinet Firewall VM running in AWS and am wanting to connect a Win Server AWS VM to an interface of the Fortinet VM. Is this possible? I cannot find anything on doing this.

We have a pair of FTG's that are using central SNAT policy that's managed by FMG. We've have several VIP entries that are working and tried to create another one today; however, when we go to install, it says there's nothing to install. We checked the source and destination IPs and intefaces, and we've even tried to clone a VIP entry that has everything identical but the last octet on the global and private NAT IPs. Still, the FMG says there is nothing to install. We have a firewall policy that's configured to use this new IP - actually, we modified the rule for the one that's working and added the new IP, which doesn't help. I'm at a loss. Can anyone think of something to try? Thank you.

To check policy compliance we need to check all users that has not been logon to fortigate VPN for a given period of time. If there are matching users, they should be disabled. However, I could not find and easy way to see this. The most related one is "diagnose user-device-store user disk query" but unfortunately I could not find related documentation to create the correct query on v6.4.8. The next best match is "diagnose user-device-store user disk list". This time logon time is given as a long number which I could not convert to date for comparison.  

Dear All, If the asymroute is enabled, is there any way to filter/list/check somehow the traffics those don't have any sessions (what is the target of the asymroute enable settings) ?I'm trying to find those and drive them in the right path. thank you

Hello,Please help,I can't ping from User A to user B in the same network/segment.The topology :User A -> Access P -> FTG - Access P -> User BUser A : 10.10.4.5User B : 10.10.4.40AP : 10.10.3.0/24I have enable PING in Interface menu.What might be cause the problem ? Please help Thanks  

For external security we have an edge fortigate firewall with sophisticated of policies in place, such as:AV, WAP, ATP, IPS, SpamFilter, Content Filtering, and much more.For internal security we have a lot of layers of defense in place, such as:FortiNAC, sophisticated Windows Domain policies, and L3 switch segmentation.What is the added value of adding an internal firewall into the LAN in my situation?Are there any other threats that cannot be addressed and mitigated by the mentioned solutions ?