Solved

Is it possible to connect a FortiAP directly to a port of a Fortigate where it has several vlans tagged? I have a FortiAP that I have to connect directly to a 40F and I have several vlans for the different SSIDs. For this type of architecture do I have to use a hardware switch or a software switch?

Hi,This might be better in a Windows group but I'll try here anyway. We're currently piloting FortiClient (EMS managed) which for the most part is going well.Split tunnel with RFC1918 destinations down the tunnel (configured simply by firewall policy) and all else direct Internet.However, some users are noticing a route to a 10.x.x.x/24 subnet that comes and goes and messes up reachability to internal resources while that specific route is in the Windows routing table.I'm 99.9% sure that it nothing to do with the config on the FortiGate/FortiClient/EMS. I think it's some group policy or InTune config or local application that is installing the route but I don't know how to prove this.I guess I need a Windows log that records a route add event and hopefully tells you what application or process triggered it.Anyone know how I can do this?Many thank in advance!

Hello!I have a Fortigate 500e that was working well until last week with two FSSO Agents installed on Windows AD Server.They just stopped to work and I observed that the FSSO Agent Status is like "not connected" when I look this on Fortigate Single Sin-on configurations.I didn't changed any configurations in this equipments and I use the FSSO Agent in version 5.0.0250. Is there anyone here who faced similar issues?Does anyone have any troubleshotting tips about this to share?Thanks!

I can't easily find this part of FGT-Managed FSW operation in the guid books or somewhere else. So I decided to post this. I was trying to figure out how to duplicate Cisco CBS switch's default QoS behaviors with FSWs and looked like I messed up config probably because I was touching both FGT and FSW config via console. So I decided to start over from scratch. Then encountered some difficulty because a simple Factory reset of those managed switches via GUI doesn't erase whatever configured under "config switch-controller". Especially under "config switch-controller managed-switch". Even when I "Delete" each FSW at WiFi&Switch Controller->Managed FortiSwitches in GUI, the config under "config switch-controller managed-switch" stays there. And maybe because of that, I don't seem to be able to re-register/re-authorize the FSWs. In this situation, do I have to go in CLI and delete all of them one by one (or just "purge")?Or, is there a simple button to erase all FSW relate

Hello everyone In Local in policy in my FG, UDP ports 500 and 4500 are active by default. I do not use IPsec and would like to disable these ports. How can I do this in CLI?

Dear All,  I would like to make different ips security policies for different services (accepted by the appropriate firewall policies), however I have a confusion with signature categories. First I thought that for the https web services it is enough to make an ips sensor that includes the https from the protocol entries when editing the signatures filter, but I found something strange.Before when I used an ips policy including every signatures I found a line in my fortianalyzer, that shows "action:dropped, service:HTTPS, attack name: Bladabindi.Botnet". Then I checked this attack name in fortigate ips signatures and in the protocol section it only shows TCP, but not HTTPS. I think this means if I only add the HTTPS protocols to my custom ips filter, this attack is not checked.My question how should I make custom ips sensors for different protocols (an ips for http, an other to all email protocols) in order to not leave out any relevant signatures? thank youchr

I want to access our backup software on port https 8015. I created virtual ip with source ip/port and dest ip/port. Created services with custom port 8015. Created policy to allow traffic on port 8015. But so far I am not able to access interface over internet. I also checked the logs and don't see any request hitting firewall. I created RDP access rule which is working fine. 

HI, May i know does it support OSPF over SDWAN IPSEC - Spoke (with two tunnel IP) to Non SDWAN - Hub (with one single IP and aggregate-member enable) . I notice the once of the ospf interface is process stuck in INIT state. it's like no way for  Remote FGT (Non SDWAN) connect Local FGT (Spoke) tunnel 2 IP.Diagram like below Local FGT (Spoke)<------> Remote FGT (Non SDWAN)Tunnel1 -------Aggregate1 port1Tunnel2 -------Aggregate1 port2 Local FGT tunnel 1 and 2 using different IPAggregate1 port1 and port 2 share single same IP Due to SDWAN migration phase timing separately deploy for 2 site, so need  any workaround or idea can be solve scenario above Please help if there is good idea. Thanks 

Hello Community. I would like to ask for your help with a Fortigate 200F (HA- A/A), with FortiOS 7.0.9.I have an IPsec VPN with a customer, who has a Fortigate 400E on the same Firmware version. Through this IPsec VPN I am extending a vlan via VXLAN (10.100.0.0/23) (Vlan ID 1). The communication between the sites is correct for the computers that are not inside the Domain. This is evidenced, when entering the Domain (It is in Site B- Fortigate 400E), a computer that is in site A (Fortigate 200F). Windows authentication takes at least 30-45 minutes, they never update the GPOs and the client machine performance is super slow. When I remove the client machine from the domain, the machine starts to perform optimally. My suspicion is, that the fortigate has problems handling traffic from Kerberos, LDAP, NetBios, Etc. over VXLAN.These are my VPN over VXLAN configurations:config vpn ipsec phase1-interfaceedit "VPN_SiteB"set interface "port14"set peertype anyset net-device disableset prop

Hi all, we have Security fabric containing 1 root fortigate and 6 downstream Fortigates and i am trying to create an automation stitch on the root Fortigate for automatic ftp backups. The problem is that after i configure CLI script , i get backup only from the root Fortigate even though the action is synchronized with other FGTs.Furthermore i can see other Fortigates CPU is almost hiting the 100% and there are many traffic logs toward the FTP server ( so obviously they are sending or trying to send). The FTP server is reachable from every of them.And also is there a way to put some variable ( for example HOSTNAME%% ) to create unique file names for every Fortigate. The syntax i am using is: execute backup full-config ftp FTP-Folder/ <my FTP IP address>:21 <my username> <my password>

Hello,  I got interested by Forti Fabric but I see that there is not a lot of data for the communication that Forti fabric uses. I know that the device discovery is based on LLDP (https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/224074/leveraging-lldp-to-simplify-security-fabric-negotiation ) but after that there is not a lot of info if the communication is encrypted by SSL/TLS or like SSH. I found the below article but it is only that the log transmission to fortianalyzer can be encrypted but I know fortianalyzer is a crucial part for Security Fabric.  https://help.fortinet.com/fortiproxy/11/Content/Admin%20Guides/FPX-AdminGuide/300_System/306_Security-Fabric-settings.htm  Also it is interesting when doing an automation on the fabric is the REST API used or the forti fabric protocol as for example I see that automation Stitches are only configured under the security fabric and from what I read an automation Stitch can invo

Hello, I'm looking for a FortiSwitch image to run in a lab environment as to prepare for the NSE8 Lab exam especially that the exam is using vSwitch. However, I'm not able to locate any image for the switch that can work in VMWare Workstation or EVE-NG.If anyone has been in similar situation, it would be great to hear how it was resolved.

So I am seeing lots of scanning and trials to connect from different countries across the globe. All has been denied by the explicit deny policy "0" on the Fortigate. however, after few searches I was recommended to create External IP threat feed and add it a deny rule to ban these IPs.  So, I am seeing the same behavior but instead of being blocked by Policy"0" it is being blocked by the new deny policy. so I don't understand what the point is of doing that instead of letting the explicit deny policy "0" handle it. Your feedback is appreciated. 

Hi all, I logged onto our Fortianalyzer a couple of days ago as i wanted to see how much data was uploaded to a certain IP and then certain country at a specific time which i managed to find but i cannot now find that same option ? This is a screenshot of the "headings" that were on this report option Anyone recognise this and where i can find it ? I've been through every option and menu so i've obviously missed it somewhere :)

Hi all  I have a hub location that got about 9 BGP peers and also I had a route map on each peer to control certain routes, but I got this new problem and still thinking of a workaround on how to do it. I am trying to advertise some specific static routes to a specific BGP neighbor let's say BGP neighbor 3 I was thinking if I am going to use the network command then I need to modify the rest of 8 route maps to deny these routes, if I am going to redistribute static route I will do the same. So is there any way to advertise specific routes to a specific BGP peer without modifying the whole other BGP peers route maps? Thanks 

Hi all, i want to setup my fg100f as fiwerall for 2 vlans.This 2 vlans are conencted via one LACP port. Vlan 7 and Vlan 8. Each are the same networks, but we want to have vlan 7 as untrusted and vlan 8 as trusted vlan.Something like 2L switch between Vlan 7 and 8 icluding firewall rules.We dont want to use L3 routing becouse there are several other subnets int his vlan. Private and public too. Is there any way to do it?Tnak youBRDave

Trying to find the correct firmware for the FortiGate 30E 3G4G GBL device and have exhausted efforts in looking through the firmware repositories. Anyone out there have any information?

Dears, Good day,  Actually, I am looking for a resource "How TO" integrate FortiSandBox and FortiClient EMS  can anyone help mention a resource talking about use cases of this type of integration Thanks in advanceFortiSandbox 

Hi all, I can find instructions to block certain IP's but is there a way to ONLY allow traffic in from any location in the UK, i.e so anything (and i mean anything) outside of the UK is blocked by default ?ThanksIan

 Hi All, FortiGate600E (HA) and FortiAnalyzer200F are connected.The FG has a 2 VDOM. (I don't use "root".)VDOM1 is the main network and is also used for management.VDOM2 has a separate network.Both are connected to the Internet by separate lines. FA is on the VDOM1 side and is logged by VDOM1.I want to get this with FA for VDOM2 logs as well.However, VDOM2 cannot access VDOM1's network. What solutions are possible?  - The way I come up with it.1. Set up connection to FA with Global, not VDOM1.2. Enable "set use-management-vdom" in "config log fortianalyzer override-setting" in VDOM2(This also sends the VDOM2 logs to the FA via the VDOM1 interface, am I correct?)3. Enable communication from VDOM2 to VDOM1 using VDOM link - Proposals claimed by others.4. Physically wire and connect from Switches connected to VDOM2 to FA(In this case, the second port of FA needs to be connected)Plan 3 has been confirmed to be doable.I think plan 2 is a reasonable one.How

Can we find who user which consume high bandwidth on fortinet?

Hello, I created customize report in FAZ (Firmware Version v7.2.1-build1215 220809 (GA))But if I change a little in query, example I change condition at WHERE statement where from_itime(timestamp) >= CURRENT_DATE - INTERVAL '14 days' and from_itime(timestamp) <= CURRENT_DATE - INTERVAL '8 days'-> where from_itime(timestamp) between CURRENT_DATE - INTERVAL '14 days' and CURRENT_DATE - INTERVAL '8 days'or reverse againTable data in report appear numberBut if I not change query, report automatic run at next week by schedule, table data in report disappear number (only 2nd and 3rd rows disappear number)Please refer query as below:select 'This week' as Types, round(avg(bandwidth)*8/60/60/1000/1000, 2) as bandwidth_Mbps, round(avg(traffic_out)*8/60/60/1000/1000,2) as traffic_out_Mbps, round(avg(traffic_in)*8/60/60/1000/1000, 2) as traffic_in_Mbps, case when round(avg(bandwidth)*8/60/60/1000/1000, 2) <= 100 then 'The bandwidth of Internet Leased Line is almost

Hi, FortiOS 7.0.x. We have defined a VIP translating address external X.X.X.X -> internal Y.Y.Y.Y, like this: config firewall vipedit "vip_server_vpn"set type static-natset extip X.X.X.Xset mappedip "Y.Y.Y.Y"set extintf "any"set portforward enableset extport 1-65535set mappedport 1-65535nextend We are using this VIP in multiple firewall policies with traffic coming in on different IPSEC tunnel interfaces. It works as expected. Now we want to initiate outgoing connections from the internal server Y.Y.Y.Y -> Internet (0.0.0.0/0), in the related firewall policy we have enabled "NAT / Use outgoing interface address". As we can see from traffic capture, the SNAT is performed using the external VIP address (X.X:X.X) and not the external interface IP. This behavior is unexpected. We would like to SNAT to the FGT external interface IP address. I had a look here in the knowledge base and in the article https://community.fortinet.com/t5/FortiGate/Technical-Tip

Hello Team, I need some guidance on FortiAuthenticator.Let's assume I want to implement FortiAuthenticator as a Radius (and Tacacs) Server only, for a small group of Network Engineers (30 Engineers) and about 3000 devices (switches and firewalls)Second assumption is to run FortiAuthenticator as a Virtual Appliance, what calculation needs to be done on the amount of users to match a certain type/size ? For example FAC-VM-BASE ( 100 users ) Thanks in advance !

Hi all! We have a Fortigate 40F that is placed on a temp location. We usually use another model for this but because of delivery issues we have to use this one. Is it possible to use a 4G USB modem in these models?  BrLars