Solved

Hi all!I've added some FortiGates (running 7.0.9) to a FortiManager (running 7.2.2). All appears to be well apart from the IPsec VPN config.In FortiManager, when I go to VPN Manager > IPsec VPN > Monitor, I can see all the configured tunnels with the gateways and phase 2 names listed.However, I don't see where this is actually configured in FortiManager?I get that if setting up and NEW VPN I need to create a VPN community and so on, but how does it work for an existing FortiGate that had existing VPNs that has been added to FMG?Am I being blind? Sure I don't have to set up the VPNs again from scratch in FMG?Any advice is very much appreciated! Thank in advance.

Hi, We have small public IP (/29) network from our provider, but only one public IP is in use, on External (WAN1) interface. We need to use another public ip, so the only way is add it as secondary to same WAN1 interface?  Also if it's true, don't understand, how then to create a policy to allow, for example, doing NAT through new public ip to internal network ? When I create a new policy with Incoming Interface=WAN1 does it matter which public ip will be using ?  FG100F with fw 7.2.3

As the title says, I don't see the automation category in the security fabric drop down menu. Our Forti gate version is 7.0.9. Is there a CLI command to enable it or a button somewhere that I couldn't find?

 Hello team,  We get the error "Unresolved FQDN" on our firewall for the below: *.discoverysrv.windowsazure.com*.download.microsoft.com*.migration.windowsazure.com*.vault.azure.net Has anyone had similar and what should we do? Other FQDN's are fine. Regards, Forti_tude

In Firewall Policy I have configured data flow policy between two subnets. I have set a schedule for this policy when it is active (specific hours on specific days). I also have full logging enabled for this policy (All Sessions in Logging Options) and would not like to change it.Is there any way that when this policy is inactive (time outside its activity schedule), its logs are not collected as well? I want to get the effect that logs are collected only when this policy is active.

I have one fortigate 100E, one public IPI have multiple subnet for multiple servicesI done 3 Ipsec Remote acces VPN on it and each VPN reach a specific network.My issue is that only one VPN is work, the two other throught an error Thank you for your help

Hi, my firewall detected POP3 Invalid Message Number blocked by IPS. I have checked the fortiguard encyclopedia.Encyclopedia : "This indicates that a client has tried to retrieve a message from a POP server with a number higher than 65535. This is an indication of a buffer-overflow or denial-of-service attack." Does it mean someone tried retrieving a message with a port higher than 65535?Or the total number of messages retrieved is higher than 65535? Or the content of a message has a number of words higher than 65535?Or any other meaning? I am not familiar with this, please someone explain to me. FortiGate 

Hello, I have this question, can we keep the informatons of last hit et last used of rules in Fortigate and Fortimanager after an upgrade to FortiOS 6.4.11? Thank you 

Hello Everyone We have FortiEMS and we are almost always out of licenses. So I have a few questions anyone using FortiEMS: How are licenses counted?One install equals one license, or each user can install on X number of devices? Clean up Is there an automated cleanup process, where a license is released if client uninstalls or is out of contact for x number of days?Is it purely a manual process where we decide when to reclaim a license from a client?@Anonymous: If I am posting in the wrong subgroup, please move me to the correct part of the forum Best RegardsMartin

Hello, i have a problem wtih a fortigate 200F Log of the console : FortiGate-200F (11:59-01.19.2021)Ver:05000008Serial number:FG200FT921901705RAM activationCPU(00:00050665 bfebfbff): MP initializationCPU(01:00050665 bfebfbff): MP initializationCPU(02:00050665 bfebfbff): MP initializationCPU(03:00050665 bfebfbff): MP initializationCPU(04:00050665 bfebfbff): MP initializationCPU(05:00050665 bfebfbff): MP initializationCPU(06:00050665 bfebfbff): MP initializationCPU(07:00050665 bfebfbff): MP initializationTotal RAM: 8192MBEnabling cache...Done.Scanning PCI bus...Done.Allocating PCI resources...Done.Enabling PCI resources...Done.Zeroing IRQ settings...Done.Verifying PIRQ tables...Done.Boot up, boot device capacity: 28626MB.Press any key to display configuration menu................................Reading boot image 3079118 bytes.Initializing firewall...System is starting...Starting system maintenance...Scanning /dev/sda1... (100%)Scanning /dev/sda3... (100%)batch descriptor

Good morning everyone. Attached is the current scene. We have now acquired a second Fortigate 100F. The idea is to configure the two in active-passive HA (High Availability). I have some doubts. 1) Can the WAN be the same? 2) How do I connect and where do I connect the three doors of the second Fortigate? 3) The 3 ports of the first Fortigate are configured as DHCP Servers, will they continue to work?

We have a host in a VLAN that needs to be openly accessed by an outside provider through a 2nd WAN port. We've followed Fortinet documentation on port forwarding and 1:1 NAT but we aren't able to ping the host. The configuration is as follows: We have a default route to our primary WAN on port 1 with a static public IP x.x.x.200. We have a 2nd WAN connection on port 18 with a static public IP of x.x.x.199. We have an internal VLAN (DMZ) with a gateway of 10.200.80.1 and a host at 10.200.80.2. We need any traffic hitting our 2nd WAN (x.x.x.199) to be forwarded to the 10.200.80.2 host.We have a a virtual IP configured to map the 2nd WAN to 10.200.80.2 (x.x.x.199 -> 10.200.80.2). We also have firewall policy stating [ SRC INT: WAN2 - DST INT: DMZ  SRC: Any - DST: VIP (x.x.x.199 -> 10.200.80.2) SERVICE: ALL  NAT: Dynamic IP Pool (One-One, x.x.x.199) Preserve Source Port  ] We aren't able to ping the host or pass any traffic to 10.200.80.2 when we hit x.x.x.19

Hi team, I would like your help with the followingI have a company that wants to give a kick to an SSG140, and they ask me for a FortiGate hardware to be able to replace it. I don't see that Fortinet has any sizing tool for these cases, so reviewing the datashee of this SSG140, it seems that all the 60, 70 and 80 models fit perfectly, but I want your support, I don't want wrong sizing https://www.juniper.net/documentation/hardware/netscreen-systems/netscreen-systems54/GSG_SSG140.pdf http://www.nha-fl.com/files/SSG140.pdf

Hello there, I need to replace old AV software installed on Windows Servers in our organization.Because we already have about 400 Forticlients installed on users computers connected to EMS I want also make it for servers.I was thinking about making additional profile, with disabled Remote access, Web filter and Firewall and adding some exclusions for files, folders or extensions (ex. .ldf, .mdf on SQL server).I want to install it on AD, DNS, DHCP, File servers, some App servers and SQL servers.Do you have some additional suggestion I should be aware of?

We are configuring a two firewall HA pair using 2600-series and want to be able to log into each separately. This documentation appears to describe the configuration (https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/313152/out-of-band-management-with-reserved-management-interfaces), but when I go to System > HA > Primary Firewall, under the Management Interface Reservation, port17 isn't available to be selected, which is the management interface. It's on a different VRF than the other ports; however, I put another port into that particular VRF, and it shows up. I'm currently logged into the firewall using port17, so is that the problem? Could there be something else? Thank you.

Any REST API available for authentication failed wifi clients with reason..

Hello, We are dealing with  botnet CnC DNS related requests. DNS Filter is being aplied in FortiGate so DNS requests asking to resolve malicious domains are successfully redirected to Block Portal By the way, FortiAnalyzer shows corresponding events as "Unhandled". Shouldn't it be automatically  marked otherwise, such as "Mitigated" ? Thanks for your help,

Hi Why Fortigate v7.2 port 4 and 5 disappear? instaed something else appear. Please see the below output of show system interface. Thanks  ZT40 # sh system interfaceconfig system interfaceedit "port1"set vdom "root"set mode dhcpset allowaccess ping https ssh http fgfmset type physicalset snmp-index 1nextedit "port2"set vdom "root"set type physicalset snmp-index 2nextedit "port3"set vdom "root"set type physicalset snmp-index 3nextedit "naf.root"set vdom "root"set type tunnelset src-check disableset snmp-index 5nextedit "l2t.root"set vdom "root"set type tunnelset snmp-index 6nextedit "ssl.root"set vdom "root"set type tunnelset alias "SSL VPN interface"set snmp-index 7nextedit "fortilink"set vdom "root"set fortilink enableset ip 10.255.1.1 255.255.255.0set allowaccess ping fabricset type aggregateset lldp-reception enableset lldp-transmission enableset snmp-index 8nextend

Hi,Can someone help me to explain about throughput in 'Top SD-WAN Device Monitor' in FortiView?The graph shows the throughput more than 1GB/s.Meanwhile, the FortiGate only connects to LAN user switch with 100Mbps full duplex with provider uplink bandwidth 100Mbps. Why is the throughput go over 1GB/s with bandwidth 100Mbps? Thanks,Arie

Even when I am in the Vdom context, when I do "get system interfaces", it will show interfaces belonging to all VDOMs. It does not even have a column to say which vdom it belongs to. I also tried "diag ip address list" and it does not tell me that information either.Is there a better command to display and even filter the information?Thanks

Hello everyone, Outgoing Remote Desktop Protocol (RDP) are risky since it is possible for the client to share her local drives with the server (as well as network drives, usb drives, printers, ports, clipboard, etc.) Is it possible for FortiGate to inspect outgoing RDP traffic in order to block connections sharing such resources? Thank you,

HI, I'm trying to perform an ipsec between a fortigate device and a teltonika rut950, and I can't get it, I'm looking for an idea of why or if there is no compatibility   

Hi, we're using a FortiGate 100E (v6.0.2 build0163 (GA)) with SSL VPN configured. Remote clients are assigned the entire 10.0.95.0/24 subnet while LAN 192.168.1.0/24 subnet.No troubles for the remote subnet to access the internal LAN but cannot find a way to make internal LAN access SSL clients. I've tried to set a specific policy to enable traffic from LAN to SSL subnet but it seems to be ignored. Also, the route isn't correct because if I make a tracert from an internal LAN device pointing to a remote client it seems that the FortiGate sends the packet to the outside instead of redirecting them to the remote client through the tunnel interface. What I am missing?  Thank you This is the policy that I tried:

Hi, I have some experience sdwan on viptela system, which need vsmart, vbond and vmanager etc. After I review sdwan with fortigate, I feel fortigate is pretty easy. My question is,  it is possible for us to run sdwan with fortigate on lab or eve-ng? Thanks

Greetings In versions 6.0.x and previous, the maximum number of usable LDAP servers you could define was ten. You could define more than that, but the Fortigate would only check ten of the defined servers (and not in a predictable way, it appeared pseudo-random). I have a doc from 6.0.x that indicates this limit: https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/15405/user-ldap but I have not been able to find a similar one for 6.4.x. Has the limit changed? Thank you.