Solved

We have a Data center (DC) and a Central Location (HQ).For a redundancy we have 4 separate lines:- 2 are direct leased lines, which I want to use for a primary connection;- 2 are trough Internet and I would like to use them as a backup connection. I have implemented the IPSec between all points and I am using BGP.The question is how to achieve maximum bandwidth usage and redundancy in the same time?Should I:1. Use IPSec aggregate or SDWAN on the primary and secondary interfaces?2. How to make sure the secondary is used only in case secondary goes down? In my current setup I tried to use BGP with communities, but still there is traffic on all interfaces.3. I have to add move remote locations with, each with one primary and one backup line. If I put them into the same SDWAN, whenever the primary goes down the packets are sent to the other members in the same SDWAN, is this a normal behavior? 

I have two Fortigate 500E's in separate locations (primary site and failover site) that connect to each other via ISP link. I have 7 branch locations that connect to both sites (primary and failover) via the same link. Each 500E has it's own independent Internet connection and I would like to create a failover connection, so if the primary site goes down, all branch gates route to the failover site instead. Because they are all connected via the same link, I only have one WAN port. I set each WAN port to have a secondary address which matches the failover site LAN. I am looking for suggestions on how to configure the branch gates to automatically re-route to the failover site if connection to the primary site is lost.Network config:Primary gate: Primary IP 10.0.0.1 / Secondary IP 20.0.0.1Failover gate: 20.0.0.2Branch A WAN 1: Primary IP 10.0.0.4 / Secondary IP 20.0.0.4Branch B WAN 1: Primary IP 10.0.0.5 / Secondary IP 20.0.0.5Branch C WAN 1: Primary IP 10.0.0.6 / Secondary IP 20.0.0.6E

I'm using Forti Client 7.0.7.0246 on Linux Mint 21.1 (with kernel 5.15.0-60-generic #66-Ubuntu SMP  x86_64 x86_64 x86_64 GNU/Linux) and when I'm tring to configure new connection, I can select only SSL-VPN or XML. When I try to import my VPN settings from XML file, I got "Success" message, but on home screen in Forti Client, it is "Configure VPN" message only. When I did the same operation on Windows - everything works fine.  

Hello Community, I have the following (simple) setup:* Multiple Servers om Subnet 10.100.2.0/24 should be reachable via portal.mydomain.com on different Ports* SSL-Certificate provided via Let's Encrypt* One Fortigate 61F as Gateway and Reverse Proxy* Domain and Static IP to the World is working fine. I have set it up as follows:* Created Virtual Servers for Each host** Type: HTTPS** Interface: any** Virtual Server IP: (external IP Adress accociated with my domain)** Virtual Server Port: (external Port)** Load-Balancing mode: Static** Persistance: None** HTTP multiplexing and Perserve Client IP is not set** SSL Offloading Mode Client/Fortigate with the Let's Encrypt Certificated valid for my domain** Real Servers - added 1 real server with internal IP and Port. no Max Connection, Mode "Active" * Created a rule** Incoming Interface: WAN1** Outgoing Interface: Internal Port to subnet 10.100.2.0/24** Source: all** Destination: Virtual Server configured before** Schedule: al

Hello team!!! I am thinking on acquire Fortigate routers for many sites.The requirement is the following, I need to keep the same web filter and application control settings in all sites, even for "web rating overrides" (I dont want to synchronize every settings like interface addressess, etc, just web filter and application control related settings)Is there a way to accomplish this with security fabric or whatever? Thanks in advance.Regards,Damián

When you search for a certain ip block in the virustotal address, it produces a few results, but it says zero in the reputation section in soar. how can we solve this in soar?

Hello, I create a dataset in Report of FAZ with query as below:select $flex_timescale(timestamp) as hodex, sum(traffic_out) as traffic_out, sum(traffic_in) as traffic_in, sum(traffic_out)*8/60/60/1000 as traffic_out_kbps, sum(traffic_in)*8/60/60/1000 as traffic_in_kbps, 100000 as maxBWfrom ###(select timestamp, sum(bandwidth) as bandwidth, sum(traffic_out) as traffic_out, sum(traffic_in) as traffic_infrom ###base(select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(sentbyte, 0)) as traffic_out, sum(coalesce(rcvdbyte, 0)) as traffic_infrom $log-trafficwhere $filter and (logflag&1>0) and (srcintf = 'ILL_Viettel' or dstintf = 'ILL_Viettel') and devname = 'Nuiphao-TN_FG201F'group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service--order by timestamp desc/*SkipEND*/)

Hello, We have a fortigate FortiGate  v6.4.11 running in our dependencies, and we try to block any connection to botnet C&C We've got a policy with 2 Security Profiles:DNS Filter redirects botnet C&C requests to Block Portal and uses Fortiguard Based Filter, where Malicious Websites, Phishing sites, spam URLS and Newly X Domains are also redirected to Block Portal.Application Control allows DNS trafficWhen I use nslookup command to request an imaginary FQDN on a well-known malicious DNS server, Fortigate unexpectedly allows the request:Policy ID: the defined one :)Application: DNSApplication Action: detectedApplication Category: Network.serviceApplciation Risk: elevatedService: DNSOn the other hand, other fields make think the request should not reach the malicious servertdthreatname: Sinkholetdthreattype: Malwaretdtype: infected-iptdwfcate: Spyware and MalwareSo the thing is that ApplicationControl allows DNS network service, but DNS sho

Hello. I have 3 subnets /28 and 1 subnet /29 that are routed over PTP /30 link. And default route is added as static in routing table. Recently my organization acquired AS number and new /24 subnet. I made BGP with one provider that is also provider of old subnets mentioned above. They are sending me only default route. My problem is that default route learned from BGP is not injected into routing table because of static default route. So all outbound traffic with new subnet over BGP is done with policy routing and it is working but inbound traffic that comes on BGP peer interface is dropped because of RPF. It checks path and drops packet. I have to change all public addresses from old ranges to new range. It would be great if both ranges are available at the same time from outside so that I can gradually switch. My provider tried with full BGP table but behavior is the same. Is there a way to have both default routes in main table so that I don't have to

We are preparing a conversion from a Firepower to a FortiGate 2600. This will be the second attempt due to some routing issues. This is an HA pair, and we're using port15 as the management port. It's currently using the same VRF as the other ports, so we want to change this one to a different ID. I just want to make sure VRF will function as intended, that is, if we there are routes to the same network, say 10.0.0.0/8, for both the management port (VRF 1) and the inside interface (VRF 0), that packets coming into a data interface (say outside interface on VRF 0) destined to 10.1.1.1 will not go out the management interface on port15. What about if the management interface has a more specific route? I'd still expect it not to work but want to confirm. Thank you.

Looking for help in locating a power supply for the FortiSwitch 112D-POE that will allow us to plug this switch into a standard ac outlet. Anyone have links to a product online that would work? Thanks

I just saw an RSS feed announcing FAC 6.5.0 release. Since other products around FortiGate has version numbering scheme 6.4, 7.0, 7.2 so far, it's a little surprise for me to see 6.5.0 as the FAC's new version number. Then also realize the FAC generally doesn't have any direct functional connections with FortiGate features, so no reason to go to 7.0.x after 6.4.x.Is this the reason of 6.5.0 for new FAC version? And would it continue to 6.6->6.7->... consecutively without jumping these in the future? Toshi

Hi, i'm trying to create an ipsec tunnel everything it's fine.Tunnel is up correctly, both phase1 and 2 are correctly done.But from remote side, they ask me that they want that i've to translate my local IP before enter in the tunnel. So i've find that cookbook http://kb.fortinet.com/kb/viewContent.do?externalId=FD33638  So i've deleted old VPN (i've done it in interface mode) and create a new one with policy mode in order to follow that cookbook. But now with same settings (remote gw,local and remote address,ike version, encryption, auth etc etc) but in policy mode it doesn't work anymore. i've error in phase1, so there is a way to nat my local ip before entering tunnel in interface mode? Thanks 

Hi One of the feature of fortigate is it does not need controller. Without controller, how to manage a lot edge device? via fortimanager? thanks

I have set up a Fortigate VM and can access the web interface. When I execute the command "get sys int physical" in the CLI, only port 1 is displayed. In the Web GUI under Interfaces is also only port 1 to see. I would like to know how I can use all three ports in the test version.

I configured a ikev1 tunnel between Cisco IOS and Fortigate.The tunnel comes up but communication only works after a client of the remote site (cisco) initiated some traffic.As you can see in the Fortigate capture, the packet to 10.183.2.1 is sent into the tunnel IPsec tunnel-1.2.3.62 which is the correct tunnel.The capture on the cisco router shows nothing until I start a ping.The exact same configuration works with other remote router i tested like pfsense and a linux based system also using policy based vpn.----------------------------------------------------------------------Cisco configuration----------------------------------------------------------------------!crypto isakmp policy 9encryption aes 256authentication pre-sharegroup 14lifetime 28800crypto isakmp key ****** address 1.2.3.36 no-xauthcrypto isakmp keepalive 30 5crypto isakmp nat keepalive 15!crypto ipsec transform-set AES256-SHA1 esp-aes 256 esp-sha-hmacmode tunnel!crypto map IPSECMAP 9 ipsec-isakmpset peer 1.2.3.36set

Hello,I'm trying to change the logging options in my FortiClient-VPN (Version 7.0.7.0345), but I can only export the logs. Changing Log-Level and deleting Logs is greyed out: Funny thing is, yesterday I could change it on one client to "Fehlersuche". Now I can't change it on any client any more.For comparison, other client have information as standard logging-level:# The user has admin rights on his pc and is using Windows11.I already tried to start the client with administrator-privliges, which didn't help. Thanks in advance. Best regards

Hello!I'm new to FortiGate and experienced a roadblock during my setup.I was trying to reach the VM from the public IP(my PC), but there was no response from the VM. Attached are the diagram and packet capture results from FortiGate.Note:The default route is going to an ASR router, but I want all incoming and outgoing traffic to go via the same specific interface on the firewall. (highlighted orange)Static route cannot be used because the source IP can be anything.Tried the policy route, but it didn't work :( Kindly advise what could be the root cause.If you need additional information, feel free to let me know!Appreciate the comments!

I'm trying to follow the solution here: https://community.fortinet.com/t5/Support-Forum/Fortigate-Virtual-IP-One-public-IP-for-two-internal-web-servers/m-p/208937/thread-id/191897 When I change load balancing method to HTTP Host and hit OK, it just reverts back to static. No errors. It removes the http host field from all Real Servers as well.Fortigate 200D v6.05 

I have 2 Fortigate 601E. X1 has our private IP range and X2 has our public IP range.Each of these is connected to 2 separate ISPs. So I cannot run full HA. I run vrrp on X1 and X2 interfaces.I have put the vrrp of both X1 and X2 in the same group. This way if X1 fails over, X2 will fail over as well.I run full BGP with each ISP and announce my public IP.I prepend the inbound via Fortigate2 to make sure that all the internet traffic comes to fortigate1. Outbound traffic will take fortigate1 because of VRRP. Now the question, 1. When X1/X2 fails over, I want to failover the incoming traffic from the internet to ISP2 on Fortigate 2. Otherwise, the incoming traffic will hit Fortigate1 and get blackholed. Outbound traffic won't have an issue because of vrrp. 2. What is the best design to accommodate a situation where Fortigate1 reboots and comes back in 2-3 minutes? (Should I keep Fortigate2 as master even when Fortigate1 comes up? This again will cause an issue with BGP fail

Good afternoon everybody! I'm new to FortiAuthenticator and I'm having an issue related to custom fields in FortiAuthenticator. Within the company, there is an identification that is informed to the guests and they must fill in the custom field to complete the registration, however, the custom fields are not displayed in the user's registration. I renamed the fields, left them with the default name, downgraded the version but the problem persists. And this custom field is of paramount importance in the implementation, since it must be registered with a predetermined code given to the guest at the entrance of the company. If anyone has ever had a situation like this and can share how they did it so that the custom field could be shown, I would be very grateful.

Hey guyswe are looking for a VPN solution for our Azure AD joined Notebooks. We have configured Hello for Business and login with Face-ID or PIN. Is the FortiClient able to connect the VPN with SAML and without user interaction (Usertunnel)? We would have a Conditional Access Policy in AAD to make sure that only compliant devices and mfa are allowed to use SAML. Thanks for your help on this. Best regardsMarc

I have this error only for one user. VPN stops at 80% with the error. Tried another user and it works.  On the same computer tried on Windows10 and 11:  KOUser "A" : KOUser "B" : OK, works fine.User "A" password is not expired, account is working everywhere. Even tried to change password several times...Tried user "A" with both ForticlientEMS 7.0.7  and Free ForticlientVPN 7.0.7 : KOTried user "A" on another computer, still getting the same error. On the other hand user "B" can login everytime. Hostcheck is not enabled on the vpn portals.   Thank you for the help  

Hi all, I've been trying to delete an old user group in our Fortimanager install, but it won't work.When deleting through "User & Authentication" > "User Groups", the object is in use by itself. When going through CLI objects > User > Groups, I get the error:"Response with errors. (-9001) used - object is copied to VDOM GW01.root" During the last push, the group was correctly removed from the firewall. So it seems that is effectively not in use anymore. Does anyone know how this group could be deleted? Fortimanager 7.2.1 build1215Fortigate 200F - v7.2.3 Best regards,Imre

hi,i've been searching/googling for VDOM support for route-based VPN/VTI Tunnel but to no avail.is this route-based VPN/VTI tunnel interface supported in multiple VDOM? i.e. VDOM A is for our internal VPN/VTI to AWS, then VDOM B is for other customer/department.appreciate if someone can provide a fortinet link. thanks!