Solved

fortinac version:7.2.0.0035persisten agent verion: 9.4.0.93use L3 isolation model, power on a rogue pc (with PA), the fortinac put the pc into an isolation network and assign dns server ip (fortinac eth1 ip) to the rouge pc, in this senario the persisten agent on rouge pc trying to communication to nac controller, first step should send the dns request to dns server (fortinac eth1 ip) trying to get the ip of nac controller, however nac dns response it's eth1 ip to rouge pc not eth0 ip, is there any missconfiguation? 

Hi, as we know, cisco sdw viptela came into market prety early. and I just know forgate also sdw function. After I reviewed document on sdw-fortigate. I think sdw-fortigate is easy to handle and has some good features. Anyone can compare the two kinds of sdw from their features. so that we can easily know their difference. Thanks

Hi Please see the below diagram. Fortigate-port3, PC-eth0 and router-Gi0/0 (default gateway 192.168.1.1 for fortigate1 and PC to access internet) are in the same vlan. 8.8.8.8 is located at Cloud Net. Now both Fortigate1 and PC can ping gateway 192.168.1.1. but Fortigate1 cannot ping 8.8.8.8 while PC can ping 8.8.8.8. Fortigate config also is listed as below. Did I miss some step?  Thanks   FortiGate-VM64-KVM # show system interfaceedit "port3"set vdom "root"set ip 192.168.1.221 255.255.255.0set allowaccess ping https ssh httpset type physicalset snmp-index 3nextFortiGate-VM64-KVM # sh router policyconfig router policyedit 1set input-device "port1"set dst "0.0.0.0/0.0.0.0"set gateway 192.168.1.1set output-device "port3"nextend

Hi all! Can someone tell me why the ipsec tunnel itself falls everyday? maybe there is a time limit? i notice it in the morningTunnell between FortiGate 100F and Mikrotik

I am trying to determine what I am doing wrong. I' m working with a vendor who requires that they scan the external (WAN1) interface of the firewall for PCI compliance audit check process. To that effect they require a range of IP addresses to be " whitelisted" within IPS. I thought I had done that by doing the following: [ul] For the IPS profile that is assigned to the SSLVPN port, for each policy add the IP address/subnet mask to the IP exceptions list Reboot the firewall [/ul] The vendor performing the scan' s indicates that they are still being blocked. Have I " whitelisted" them wrong? Is there a better way of doing this? Thanks in advance! -Neil

Hi all,We are running external DHCP server and configured Relay from FortiGate VLAN interface.DHCP is working fine even without adding any policy to allow Client subnets to DHCP server.When we checked the logs , we saw the user is getting DHCP Address assignment using Implicit Deny Rule.It's a new setup with version 7.2.2 .We still haven't done license registration yet.Traffic should be blocked and the user shouldn't get IP address if we didn't specifically allow in the policy and Implicit Deny Rule should block everything right?I'm very confused now .Even I manually added any any Deny policy, the DHCP still worked.Please help suggest me , it is a normal flow?Thank you so much.

Hi,Lets say i have wan1 and internal1 as interfaces where wan1 is connected to internet and internal1 is connected to a laptop.We have a default route because wan1 is set as DHCP client and we also have a policy to forward traffic from lan to internet (internal1 -> wan1).If i ping internet from laptop i have connectivity, but if i try to ping internet from interface internal1 on fortinet i have no reply. Why is that?I see in debug that traffic is not initiated from LAN name, but from "local". Is there a possibility to have reply even if i ping from internal1?Thank you

I have FG 81F that has an IPsec Tunnel that active and capable of routing traffic. I can route traffic through the tunnel via static routes but even though I have the default route pointed to the tunnel, it the routing table the default route shows up as leaving through the WAN. Any suggestions  RTBNRVPN01 (static) # showconfig router staticedit 1set device "BNR-PIT-1"nextedit 2set dst 164.52.235.0 255.255.255.224set device "wan1"set dynamic-gateway enablenextedit 3set dst 4.49.109.32 255.255.255.224set device "wan1"set dynamic-gateway enablenextedit 4set dst 10.0.0.0 255.0.0.0set device "BNR-PIT-1"next Routing table for VRF=0S* 0.0.0.0/0 [5/0] via 166.157.249.1, wan1S 4.49.109.32/27 [10/0] via 166.157.249.1, wan1S 10.0.0.0/8 [10/0] via 10.172.0.181, BNR-PIT-1C 10.172.0.181/32 is directly connected, BNR-PIT-1C 10.172.0.182/32 is directly connected, BNR-PIT-1C 10.172.97.0/26 is directly connected, internal1C 10.172.98.0/26 is directly connected, SecurityC 10.172.98.6

We have a pair of older FortiGate 200B firewalls that have been out of use for awhile and collecting dust as they are no longer supported by FortiNet.  Before I get rid of them, what is the process to wipe/erase/sanitize these firewalls to ensure no one can access our data/configs from these devices once they leave our possession?   Here is what I have done so far to both: Performed a "exec factoryreset" from the cli.Formatted the boot device from the cli configuration menuLoaded new firmware images via TFTP One of the units had a solid state drive that was used to store logs, I removed the drive inserted into a desktop and wiped it using our desktop sanitizing tools. Anything else I should do? Thanks!  

Forgive me if this was posted somewhere else. I did search and didn't find anything that helped. I'm showing a large amount of session clash entries in the log. I'm having troubles deciphering and trouble shooting this problem. Is there anyone who can help shed some light on the issue? Thanks in advance for any help.  diagnose sys session stat misc info:       session_count=312 setup_rate=8 exp_count=0 clash=63606         memory_tension_drop=0 ephemeral=0/327680 removeable=0 delete=0, flush=0, dev_down=0/0 TCP sessions:          165 in ESTABLISHED state          1 in SYN_SENT state          8 in TIME_WAIT state          3 in CLOSE state          4 in CLOSE_WAIT state firewall error stat: error1=00000000 error2=000

I have FG-80F (Firmware version 7.2.4 build1396) in one of the branch office which we have recently purchased and configured. I have configured DNS translation as follows and internal hosts behind this firewall is able to resolve to the Private IP 172.24.0.1 as expected. However, when I try ping or configure the hostname (testing.abc.com) in the Threatfeeds configuration, it resolves to Public IP address 181.182.183.184. I have FG-500D (Firmware version 6.4.11 build2030) and that firewall is able to resolve with the private IP. Anything that I am missing here? config firewall dnstranslationedit 1set src 181.182.183.184 --> Public IP as an example for "testing.abc.com"set dst 172.24.0.1 --> Private IP of testing.abc.comend hostname - "testing.abc.com" PS : Hostname & Public IP address are just an example and not actuals.

I have a FortiGate 201E running 6.4.11. On the dashboard page in System Information, the WAN IP address shown is wrong. The IP address is one I do not recognise, and a whois lookup shows Amazon as the ISP (we don't use Amazon). If I run "diag sys waninfo ipify", it returns the correct IP address for the WAN interface. What's going on? Is this cause for concern?

Estimados, tengo dos Firewall conectados en HA Activo Activo, en cargado todas las configuraciones necesarias, pero no logro que los firewall se sincronicen, ya he intentado de todo, ambos son identicos, si por favor alguien puede darme alguna sugerencia.

Hello, everyoneI hope someone can help me.I have the following problem.Today I deleted a Vdom on a customer Fortigate 501 E (firmware 6.4.6 in HA A-P).After I deleted the Vdom, the Forti were no longer in sync, but both were masters.After connecting to the console port, I got the following entry.unregister_vf: waiting for LIG to become free. rt_num = 183 vf_count = 431Can someone tell me what this means

I have a Fortigate 60E for our small network and created some VLANs to separate the VOIP, CCTV, Servers, Laptops, etc. The VLAN side works fine and as expected, even the routes from laptops to server DNS, DC, File Shares, etc is working. However since doing these changes, the VPN is playing up a bit. Everyone can connect to the VPN and get an internal IP, some users work fine with internet access but others cant get internet access whilst on the VPN and only an internal IP. It feels like a DNS issue to me. Initially we had the VPN give out our internal DNS server (which is on a separate vlan) but this didn't work. I have also set it to use the client's system DNS and it gives them their home router DNS but again internet doesn't work for those users. Looking for pointers, is it some additional routing I need to setup for the VPN after setting up VLANs. Below are the relevant firewall policies we have in place (appreciate they not much help as just the names, ju

Hi team, I need a support in CMMC AC.L2-3.1.13 remote session as in that link https://www.expertcmmc.com/cmmcPractices.php?viewPracticeID=31 How can I check and secure the encryption of VPN remote sessions  to meet CMMC requirement?Thanks, FortiGate FortiClient 

Hello everyone, Is there a simulation tool in FortiGate  where1) you provide a source ip/port and a destination ip/port and service (maybe more parameters)2) the tool returns you what policy, security profiles, etc and actions would be applied acoording to the current settings? Thanks for your help,  

I found the following article about ospf inter-area distribution.https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuring-OSPF-to-filter-Inter-Area-routes-using/ta-p/197747https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuration-of-OSPF-Stub-Totally-Stub-NSSA-and/ta-p/194927 OSPF and Fortigate are fairly new to me... I am planning to replace a Cisco Firepower with a Fortigate. Currently on the Cisco firepower there are two opsf processes configured. One has area id 0 and the other has area-id 10 and both are connected to two different cisco switches. Because of the two ospf processes the areas are separated which means cisco-sw2 doesn't receive any routes from area 10. Since Fortigate doesn't support more than one ospf process I have to find another solution. cisco-sw1---area-id 10---Fortigate(Cisco FTD)---area-id 0---cisco-sw2 How can I prevent Fortigate from distributing learned routes from area 10 to 0 (sw2)? Current Fortigat

/bin/smhealth/bin/guacd i have found 2 files as above i wondering what is that file,is it from fortigate it self or create by someone,- if it from the fortigate what was it do and is it necessary for the fortigate?- is it always on by default or we need to turn on by manually,- can it be turn off please kindly help me best thank you,

We have a large transfer that we are sending through our FortiGate but it always fails because the sessions are getting dropped on the firewall. We are using MSP360 to transfer to Backblaze (B2). The backups are broken into different jobs with the largest being ~12TB, and the smallest being ~400GB (total for all is ~40TB). The jobs are all set to manual, and never run together. No matter which one we start, it always starts just fine but eventually we will begin seeing a flood of TCP retransmits, and shortly after, the job fails. The firewall shows an implicit deny because of "no session matched". This is very strange, because on the sniffer we can see the transfer was actively going. Even in the backup logs, we can see it was in the middle of sending the multi-part upload, then suddenly it logs the error "Operation too slow. Less than 0 bytes transferred the last 60 seconds". The biggest problem trying to troubleshoot this is that it never fails at the same place. Somet

Hello, We currently have 2 VPN tunnels on our 601E : 1 IPSEC with public addresses and one SSL behind a NAT.We would like to know  :- if we can make 2 SSL tunnels (because it seems we can't as there is no possibility to create a new one in "VPN-SSL settings" If we can't its' ok, we will delete the old one.- Can we use use public IPs to create a new VPN SSL (it would be easier for us with the log files if each user had a public IP assigned on connection) and if so, where can we declare this subnet,in the WAN subnet ? Thanks a lot. darant  

Hi to everyone, I have a firewall model FortiGate 60G with firmware 6.4.6. I have configured the output to the Internet through 3 lines from 3 different providers, with 3 WAN interfaces configured in the FortiGate.I need to do some connectivity tests from a specific computer only through one of the WAN's. What do I have to do in the FortiGate configuration so that this specific device will go out through this specific WAN?

When accessing Web servers through load balancer, the URL change to Physical Server IP. How to hide the physical server IP?

Hello everyone,We are facing a weird situation.With 1500D HA cluster (active-pasive),  yesterday slave had below messages:     XT2-fs (sda3): previous I/O error to superblock detected     Cannot open /daEXT2-fs (sda3): previous I/O error to superblock detected     ta2/geodb/geoip.EXT2-fs (sda3): previous I/O error to superblock detected     4. Error=Input/oEXT2-fs (sda3): previous I/O error to superblock detected     .... Some services were afftected.Can't see any log when access to slave from GUICan't get snmp data from mgmt port of master sometimes, seem like high cpu happened.IPsec multiple sites are not connected (Ping, remote desktop, file sharing, etc.) However, SSL-VPN can be connected and operatedAfter we shutdown slave, everything went okI am wondering, a disk/partion failed on slave can affect master performance. Is there any information about this case ?  Thank you. 

Hi, i been tasked to solve the problem in Forti 60F configuration. As i never worked with VIP here, so maybe someone could point where is the problem. Here is what must be done:Controller 1 and 2 has IP addresses: 172.22.22.194 and 172.22.22.195; GW is 172.22.22.206FW configuration regarding the are like this: edit "vlan 172"set vdom "****"set ip 172.22.22.194 255.255.255.240set allowaccess pingset alias "scalit"set estimated-upstream-bandwidth 100000set estimated-downstream-bandwidth 100000set role wanset snmp-index 10set secondary-IP enableset interface "wan1"set vlanid 172config secondaryipedit 1set ip 172.22.22.195 255.255.255.240set allowaccess pingnextend  edit "172.22.22.206"set uuid 86e0d2c2-ed36-51ec-69b1-611fb6a18871set type iprangeset associated-interface "WAN_scalit"set start-ip 172.22.22.206set end-ip 172.22.22.206 config firewall ippooledit "172.22.22.194-10.89.48.1"set type fixed-port-rangeset startip 172.22.22.194set endip 172.22.22.194set