Solved

My fortigate 90D-POE enabled SD Wan setup from different ISP, the problem is Wan1 can map port 80 & 443 to backend server(A)(DMZ-interface),while Wan2 port 80 & 443 cannot be map to backend server(B)(LAN-interface),but if I use 8080 of Wan2, I can successfully map to backend server (B); Can someone help me, if fortigate only allow inbound traffic to Wan1 port 80/443; Wan2 inbound traffic to port 80/443 is not allowed?  I checked both ISP not blocked port 80 & 443 My SD Wan setup:wan1wan2 SD Wan Rules:DMZ(server A) -> Wan1 (server A outbound traffic through Wan1)LAN(server B) -> Wan2 (server B outbound traffic through Wan2) Static Routes:Dest. 0.0.0.0 Gateway 0.0.0.0 Interface SD Wan Firewall Policy allowedSD-WAN ->DMZDMZ -> SD-WANLAN -> SD-WANSD-WAN -> LAN (server B, port 80/443) 

Hi I have 2 remote site router connected using vxlan over ipsec. I can ping, telnet and ssh between the routers. I want to do an ospf adjacency between them but even though they ping, the neighborship won't come up. When I debug ospf I see that ospf is sending hello packets on both routers but they don't receive any. I'm allowing all between the vxlan and vlan in the firewall policy. It's as if multicast traffic is being block.  And I want to know if is possible to get an adjacency between the routers using vxlan over ospf.     

We've attempted to use FQDNs for traffic such as SIP, SFTP, etc., but the rules don't receive any hits. If we include the IPs within the same rules, the traffic starts to flow. Our previous firewall would resolve the FQDNs to IPs for non-web traffic, but the FortiGates don't seem to be behaving this way. I'd like to confirm that FQDNs only work with web traffic, and if it should work with other traffic, are there any tricks to the configuration? Thanks

Using ansible galaxy fortinet.fortios when creating a vip I am trying to set the ldb_method. The only option that ever gets set is static. type: server-load-balancerserver-type: ipldb_method: round-robinif I specify an option that is not available I get an appropriate error.

I have FortiGate firewall in HA mode. I need to enable private data encryption on both the firewalls and for that I will need to break the HA and proceed further.How can I take the GUI access of the firewall incase of unable to take the console access.1) If I want to access the secondary firewall, can I access it directly with the console cable or do I have to remove the HA cable first and then take the console access.2) Any other ways to take the console access of secondary firewall other than reserve management IP process?Also let me know when to remove the HA cable to take the secondary firewall access

i have one unit of FGT100E firewall showing management connectivity is down,how do i enabled the management back again ?

Hello Dears I have two IPsec tunnels one of them is main and the second is backup sometimes when an issue on main tunnel like phyiscal interface goes down it is not update on Firewall i meant when I go to see the tunnel traffic it is show me the tunnel is up and everything is ok while it must be down because the interface is down so anyone could help me on that ? Best Regards

i need to have a remote access to my hpe 1820 switch behind 2 firewall in HA modeis it possible?

Morning everyone,I have a website that was not making it past the webfilter (well 2), cabelas.ca and cabelas.com.I was able to clear cabelas.ca by adding an exception to dns and webfilter, but same practice doesn't work with the *.comHas anyone experienced this before, the logs show it passed through without issue.

halllo TogetherIs on the Fortigate firmeware 7.2.3 irgende wleche performance problems regarding IPSEC tunnel known?

Hello TogetherI have the following problem:On the Fortigate, a couple of S2S VPN are made to a Vmware Edge Firewall.One S2S VPN interrupts so every 45-48min but only for 2-3 seconds.Phase 1 goes down + phase 2 goes down but comes right back up.The other VPN configured exactly the same do not have this problem.Does anyone know such problems?Thanks for your help

Hey everyone,I have two fortiswitch 224D running 7.2.2 firmware that i want to configure standalone.Switch 1 uses ports 23/24 for WAN and is connected to switch 2 with fiber.My workstation is connected to switch 1 using mgmt port.I created the vlans i need and also created a trunk using the fiber ports however, i seem not to be able to communicate with switch 2.Since i am obviously doing something wrong but don't know what, could someone point me in the right direction ?

It has come to my attention that out of the 5 users with 3000, only five are experiencing a particular issue. I am curious if anyone has any insight into why this may be happening. Any information would be greatly appreciated. (Forticlient SSL VPN with SAML error -7200 at 48%)

I need to create an IPSec tunnel from a FortiGate to an PfSense OpenVPN. Is this possible, or do I need to create an IPSec tunnel on both firewalls?Tried to google this but found nothing helpfull.Kind regards

Hi guys, a friend of me is creating a new (small) office. In the old rooms he found an old (used) FortinetAP221E.He tried to use it but he said "on adding it to FortiNet" it says "already registrered to another company". How can we solve that issue or where is that shown? I tried to register on FortiNet Asset Management now by adding the serial number, but it says "Invalid input data". Maybe someone has a hint for us? Thanks.Andy

Hello!I have three site-to-site VPNs with AWS using static route and I want to switch to BGP routing.The articles I've read only deal with BGP with just a VPN, no redundancy.How do I configure the FGT BGP routes to use the three VPNs? FortiGate 

Dear colleagues, good afternoon. In this post I seek information on how to perform a configuration in Fortigate where I can prevent the equipment from reaching 80% CPU usage. This fact has occurred with some frequency lately. I would like advice on how to proceed in this situation. Thank you very much in advance for your attention and understanding.

I removed lan2 from the CLI, and noticed that it is now greyed out and missing from Network in the GUI.  Was expecting it to become a physical interface in Network when removed from the virtual-switch.Original configuration of virtual-switchconfig system virtual-switchedit "lan"config portedit "lan2"nextedit "lan3"nextendnextendI then ran the following commands:config system virtual-switchedit "lan"config portdelete "lan2"Then I tried to added it back in with:config system virtual-switchedit "lan"config portedit lan2It gave an error: entry not found in datasourceIf I do "edit ?" it shows that lan2 is not available:*name Physical interface name.lan3 interfaceconfig system interface does show a lan2How do I get it to show up as a physical interface via CLI after removing it from the virtual-switch?How do I re-add it to the virtual-switch from the CLI?

I have a FortiGate and a bunch of FortiSwitches that are being locally managed. I want to set up admin authentication using LDAP. I successfully configured this on the FortiGate but I can't get it to work on a FortiSwitch. Is this something that is just not possible? The switches are not linked with the firewall.

Could someone be kind to explain what is the meaning of the next 2 lines that show up on a reseller quote: -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------Line   Qty          Part number                               Description                                                                     &nb

We have been using EMS previously for configure my FortiClients to autodeploy VPN connection using the classic SSLVPN with username/password options. Now we have configures our VPN connection to utilize AzureAD using SAML login.However, I dont see this option when configuring VPN settings in the EMS settings. On the client its a simple tick on/off option, but its seems like this is not possible when deploying the settings from EMS. Are there any tricks to utilize this? I have downloaded EMS 7.2, and there is not option to enable SSO, when configuring the VPN connection.  

 Dear community Hello,So i get reaaly hard stuck at joining the internal DNS servers with my fortigates.In the setup that follows i have a simple 60F, with a flat subnet behind it, no vlans,no subnets, evertyhing coming through a vswitch in FGT and the out tou the wan link.The goal is for my endpoints from the ssl vpn tunnel to be able to resolve internal devices DNS names.These endpoints are not domain joined.Neither the internal are Also ssl vpn simple set up with Domain users and local ones(not a web mode one).Split tunneling is disabled  Problem is i cant resolve DNS names neither from the clients side when connected through the ssl vpn tunnel,nor from the command line of the FGTs. Internal resolvment of FQDNs between PCs(witch are not domain joined,works fine) As you can see in the print screens provided, i have for the FGT targeted, the Fortinet DNS server as option 1 andthe internal DNS VM Server's Local IP as option 2And my local domain name. Also

Hello everyone,Thanks in advance for taking the time to read.We changed our ISP 6 months ago and I just saw an error in the "Static routes - IPv4" :    - New WAN1 as PPOE - Use fortiguard DNS servers to get a fortiDDNS domain with the correct static IP the default gateway in the Wan interface :    I am not an expert (Lets just say I know how subnet are managed but never took the time to understand since my field is geomatics) Would anyone be able to give me an advice as to :Why the gateway is not in the same subnet as WAN1, if the gateway IP is taken dynamically from the WAN1 connection ?  

Dear Community,i am having problem with logging in a fortimanagervmdoownloaded img, installed it on HyperV with 4 GB RAM 2 CPU cores1 initial nic vswitch1 initial vhdd FGMVM has a dummy policy to connect to internet through FGT.I can see the traffic logs from FGT and ping from the CLI of the VM when i try to log in with Forti cloud creds from GUI i get undefined error I tried to upload my trial license file from my assets with no avail. Any ideas?Thanks in advance

Hi All, I had try to find any CLI command everywhere for fortigate to display the status of the power supply unit when doing UAT, Power Redundancy Test. But could not be found.For this unit, Fg401E, Fw 7.0.10Example like, when 2 PSU is plug on, the status will be like Connected or Ok. When one of it is unplug off, the CLI command will display 1 PSU connected 2 PSU Not connected, etc.Attached is an example of it.