Solved

Hi all,We are running external DHCP server and configured Relay from FortiGate VLAN interface.DHCP is working fine even without adding any policy to allow Client subnets to DHCP server.When we checked the logs , we saw the user is getting DHCP Address assignment using Implicit Deny Rule.It's a new setup with version 7.2.2 .We still haven't done license registration yet.Traffic should be blocked and the user shouldn't get IP address if we didn't specifically allow in the policy and Implicit Deny Rule should block everything right?I'm very confused now .Even I manually added any any Deny policy, the DHCP still worked.Please help suggest me , it is a normal flow?Thank you so much.

Hi,Lets say i have wan1 and internal1 as interfaces where wan1 is connected to internet and internal1 is connected to a laptop.We have a default route because wan1 is set as DHCP client and we also have a policy to forward traffic from lan to internet (internal1 -> wan1).If i ping internet from laptop i have connectivity, but if i try to ping internet from interface internal1 on fortinet i have no reply. Why is that?I see in debug that traffic is not initiated from LAN name, but from "local". Is there a possibility to have reply even if i ping from internal1?Thank you

I have FG 81F that has an IPsec Tunnel that active and capable of routing traffic. I can route traffic through the tunnel via static routes but even though I have the default route pointed to the tunnel, it the routing table the default route shows up as leaving through the WAN. Any suggestions  RTBNRVPN01 (static) # showconfig router staticedit 1set device "BNR-PIT-1"nextedit 2set dst 164.52.235.0 255.255.255.224set device "wan1"set dynamic-gateway enablenextedit 3set dst 4.49.109.32 255.255.255.224set device "wan1"set dynamic-gateway enablenextedit 4set dst 10.0.0.0 255.0.0.0set device "BNR-PIT-1"next Routing table for VRF=0S* 0.0.0.0/0 [5/0] via 166.157.249.1, wan1S 4.49.109.32/27 [10/0] via 166.157.249.1, wan1S 10.0.0.0/8 [10/0] via 10.172.0.181, BNR-PIT-1C 10.172.0.181/32 is directly connected, BNR-PIT-1C 10.172.0.182/32 is directly connected, BNR-PIT-1C 10.172.97.0/26 is directly connected, internal1C 10.172.98.0/26 is directly connected, SecurityC 10.172.98.6

We have a pair of older FortiGate 200B firewalls that have been out of use for awhile and collecting dust as they are no longer supported by FortiNet.  Before I get rid of them, what is the process to wipe/erase/sanitize these firewalls to ensure no one can access our data/configs from these devices once they leave our possession?   Here is what I have done so far to both: Performed a "exec factoryreset" from the cli.Formatted the boot device from the cli configuration menuLoaded new firmware images via TFTP One of the units had a solid state drive that was used to store logs, I removed the drive inserted into a desktop and wiped it using our desktop sanitizing tools. Anything else I should do? Thanks!  

Forgive me if this was posted somewhere else. I did search and didn't find anything that helped. I'm showing a large amount of session clash entries in the log. I'm having troubles deciphering and trouble shooting this problem. Is there anyone who can help shed some light on the issue? Thanks in advance for any help.  diagnose sys session stat misc info:       session_count=312 setup_rate=8 exp_count=0 clash=63606         memory_tension_drop=0 ephemeral=0/327680 removeable=0 delete=0, flush=0, dev_down=0/0 TCP sessions:          165 in ESTABLISHED state          1 in SYN_SENT state          8 in TIME_WAIT state          3 in CLOSE state          4 in CLOSE_WAIT state firewall error stat: error1=00000000 error2=000

I have FG-80F (Firmware version 7.2.4 build1396) in one of the branch office which we have recently purchased and configured. I have configured DNS translation as follows and internal hosts behind this firewall is able to resolve to the Private IP 172.24.0.1 as expected. However, when I try ping or configure the hostname (testing.abc.com) in the Threatfeeds configuration, it resolves to Public IP address 181.182.183.184. I have FG-500D (Firmware version 6.4.11 build2030) and that firewall is able to resolve with the private IP. Anything that I am missing here? config firewall dnstranslationedit 1set src 181.182.183.184 --> Public IP as an example for "testing.abc.com"set dst 172.24.0.1 --> Private IP of testing.abc.comend hostname - "testing.abc.com" PS : Hostname & Public IP address are just an example and not actuals.

I have a FortiGate 201E running 6.4.11. On the dashboard page in System Information, the WAN IP address shown is wrong. The IP address is one I do not recognise, and a whois lookup shows Amazon as the ISP (we don't use Amazon). If I run "diag sys waninfo ipify", it returns the correct IP address for the WAN interface. What's going on? Is this cause for concern?

Estimados, tengo dos Firewall conectados en HA Activo Activo, en cargado todas las configuraciones necesarias, pero no logro que los firewall se sincronicen, ya he intentado de todo, ambos son identicos, si por favor alguien puede darme alguna sugerencia.

Hello, everyoneI hope someone can help me.I have the following problem.Today I deleted a Vdom on a customer Fortigate 501 E (firmware 6.4.6 in HA A-P).After I deleted the Vdom, the Forti were no longer in sync, but both were masters.After connecting to the console port, I got the following entry.unregister_vf: waiting for LIG to become free. rt_num = 183 vf_count = 431Can someone tell me what this means

I have a Fortigate 60E for our small network and created some VLANs to separate the VOIP, CCTV, Servers, Laptops, etc. The VLAN side works fine and as expected, even the routes from laptops to server DNS, DC, File Shares, etc is working. However since doing these changes, the VPN is playing up a bit. Everyone can connect to the VPN and get an internal IP, some users work fine with internet access but others cant get internet access whilst on the VPN and only an internal IP. It feels like a DNS issue to me. Initially we had the VPN give out our internal DNS server (which is on a separate vlan) but this didn't work. I have also set it to use the client's system DNS and it gives them their home router DNS but again internet doesn't work for those users. Looking for pointers, is it some additional routing I need to setup for the VPN after setting up VLANs. Below are the relevant firewall policies we have in place (appreciate they not much help as just the names, ju

Hi team, I need a support in CMMC AC.L2-3.1.13 remote session as in that link https://www.expertcmmc.com/cmmcPractices.php?viewPracticeID=31 How can I check and secure the encryption of VPN remote sessions  to meet CMMC requirement?Thanks, FortiGate FortiClient 

Hello everyone, Is there a simulation tool in FortiGate  where1) you provide a source ip/port and a destination ip/port and service (maybe more parameters)2) the tool returns you what policy, security profiles, etc and actions would be applied acoording to the current settings? Thanks for your help,  

I found the following article about ospf inter-area distribution.https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-OSPF-to-filter-Inter-Area-routes-using/ta-p/197747https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuration-of-OSPF-Stub-Totally-Stub-NSSA-and/ta-p/194927 OSPF and Fortigate are fairly new to me... I am planning to replace a Cisco Firepower with a Fortigate. Currently on the Cisco firepower there are two opsf processes configured. One has area id 0 and the other has area-id 10 and both are connected to two different cisco switches. Because of the two ospf processes the areas are separated which means cisco-sw2 doesn't receive any routes from area 10. Since Fortigate doesn't support more than one ospf process I have to find another solution. cisco-sw1---area-id 10---Fortigate(Cisco FTD)---area-id 0---cisco-sw2 How can I prevent Fortigate from distributing learned routes from area 10 to 0 (sw2)? Current Fortigat

/bin/smhealth/bin/guacd i have found 2 files as above i wondering what is that file,is it from fortigate it self or create by someone,- if it from the fortigate what was it do and is it necessary for the fortigate?- is it always on by default or we need to turn on by manually,- can it be turn off please kindly help me best thank you,

We have a large transfer that we are sending through our FortiGate but it always fails because the sessions are getting dropped on the firewall. We are using MSP360 to transfer to Backblaze (B2). The backups are broken into different jobs with the largest being ~12TB, and the smallest being ~400GB (total for all is ~40TB). The jobs are all set to manual, and never run together. No matter which one we start, it always starts just fine but eventually we will begin seeing a flood of TCP retransmits, and shortly after, the job fails. The firewall shows an implicit deny because of "no session matched". This is very strange, because on the sniffer we can see the transfer was actively going. Even in the backup logs, we can see it was in the middle of sending the multi-part upload, then suddenly it logs the error "Operation too slow. Less than 0 bytes transferred the last 60 seconds". The biggest problem trying to troubleshoot this is that it never fails at the same place. Somet

Hello, We currently have 2 VPN tunnels on our 601E : 1 IPSEC with public addresses and one SSL behind a NAT.We would like to know  :- if we can make 2 SSL tunnels (because it seems we can't as there is no possibility to create a new one in "VPN-SSL settings" If we can't its' ok, we will delete the old one.- Can we use use public IPs to create a new VPN SSL (it would be easier for us with the log files if each user had a public IP assigned on connection) and if so, where can we declare this subnet,in the WAN subnet ? Thanks a lot. darant  

Hi to everyone, I have a firewall model FortiGate 60G with firmware 6.4.6. I have configured the output to the Internet through 3 lines from 3 different providers, with 3 WAN interfaces configured in the FortiGate.I need to do some connectivity tests from a specific computer only through one of the WAN's. What do I have to do in the FortiGate configuration so that this specific device will go out through this specific WAN?

When accessing Web servers through load balancer, the URL change to Physical Server IP. How to hide the physical server IP?

Hello everyone,We are facing a weird situation.With 1500D HA cluster (active-pasive),  yesterday slave had below messages:     XT2-fs (sda3): previous I/O error to superblock detected     Cannot open /daEXT2-fs (sda3): previous I/O error to superblock detected     ta2/geodb/geoip.EXT2-fs (sda3): previous I/O error to superblock detected     4. Error=Input/oEXT2-fs (sda3): previous I/O error to superblock detected     .... Some services were afftected.Can't see any log when access to slave from GUICan't get snmp data from mgmt port of master sometimes, seem like high cpu happened.IPsec multiple sites are not connected (Ping, remote desktop, file sharing, etc.) However, SSL-VPN can be connected and operatedAfter we shutdown slave, everything went okI am wondering, a disk/partion failed on slave can affect master performance. Is there any information about this case ?  Thank you. 

Hi, i been tasked to solve the problem in Forti 60F configuration. As i never worked with VIP here, so maybe someone could point where is the problem. Here is what must be done:Controller 1 and 2 has IP addresses: 172.22.22.194 and 172.22.22.195; GW is 172.22.22.206FW configuration regarding the are like this: edit "vlan 172"set vdom "****"set ip 172.22.22.194 255.255.255.240set allowaccess pingset alias "scalit"set estimated-upstream-bandwidth 100000set estimated-downstream-bandwidth 100000set role wanset snmp-index 10set secondary-IP enableset interface "wan1"set vlanid 172config secondaryipedit 1set ip 172.22.22.195 255.255.255.240set allowaccess pingnextend  edit "172.22.22.206"set uuid 86e0d2c2-ed36-51ec-69b1-611fb6a18871set type iprangeset associated-interface "WAN_scalit"set start-ip 172.22.22.206set end-ip 172.22.22.206 config firewall ippooledit "172.22.22.194-10.89.48.1"set type fixed-port-rangeset startip 172.22.22.194set endip 172.22.22.194set

Hi, We have aprox. 80 fortigates which we have added on the fortimanager only for the upgrade purposes. We dont want to change or import configuration on the fortimanager. We have some config status issue for example, we have some with status out-of-sync (because we still do changes locally), some with status unkown and some even with status "conflict".  Now my question regarding this. Will this still affect the upgrade process?

Hey there, I just noticed that there is a new last column in the output of the CLI command "diag sys top".Does anybody nows what this this means? Thanks & cheers,Sylvia

We would like to be able to scheduled automated full-config backups to be offloaded to an FTP server. I know the fortimanager has backup capabilities of configs for its registered devices but we do not really need a full central management system (though it would be nice).I'm wondering if anyone has used other solutions/workarounds to make this happen. I believe FortiMail or FortiWeb devices have a scheduled backup that can be run, but not FortiGate. Thank you, Ian

Dear Community,We have a problem regarding user authentication with FSSO. Some users are not getting in "Currently logon users" list in FSSO even though when I try to logoff and logon again, even restarting the machine does not help, but when I check Event Viewer on DC the user is successfully logged in / Authenticated. I will describe as detailed as I can:* We have 2 Domain Controllers (Windows Server 2022 Datacenter)* We do NOT use Explicit Proxy mode. Our fortigate device is Default gateway for users. 1. I have set Firewall Inbound Rules on DC's : UDP/8002, TCP/8000-8001 (For Agent communication)2. I have set Firewall Inbound Rules for Domain Users: UDP/137-138, TCP/445, WMI (For User workstation check and logoff event).3. I have installed FSSO Collector Agent (Advanced Mode) and DC Agent on both Domain Controllers. (FSSO_Setup_5.0.0308_x64). Used Domain Admin Credentials.4. HKLM/SOFTWARE/Fortinet/FSAE/DCAgent/ca - shows both DC IP's on both Domain Controllers.5. "Show Service

I have a Fortigate and configured 2 interfaces that connect to 2 different ISPs. Interface 9 - ISP AInterface 10 - ISP B Basically, I would like all computers to use interface 9, except for a selected few that will use interface 10. Interface 10 is configured with a DHCP, and I've been told that because of this, Interface 10 becomes the default route. To fix this, I created a Policy Route so that all traffic goes to Interface 9. Then I created another  Policy Route to make the selected few computers to use Interface 10. This all works perfectly fine. My question is: If interface 9 goes down, will the computers automatically use Interface 10? I don't want it to use interface 10, I want the computers to just not have any internet access at all if interface 9 is down. (sounds odd but there's a reason for that). I am unable to test this out now, hence this question.