Solved

Hello everyone, I have just configured FGSP beetween pairs of FGCP clusters. I have tested some work scenarios: NAT sync, assymetric sync, failover session, DNAT sync etc. All works fine, except one problem. I have some assymetric traffic and I reboot FGSP peer. After peer rebooted session not sync back to this peer therefore I have traffic loss.I have found in documentation "down-intfs-before-sess-sync" option, but it doesn't help.Should back sync session work at all? Or where I misconfigured?Session sync works over L3 link, ForiOs 7.0.3. Configuration: Peer1:config system ha  set group-id 10  set group-name "Cluster"  set mode a-p  set hbdev "port8" 0  set session-pickup enable  set session-pickup-connectionless enable  set session-pickup-expectation enable  set override disable  set priority 200endconfig system cluster-sync  edit 1     set peerip 192.168.50.200     set syncv

I want to upgrade Fortigate firmware from 6.2.5 to 6.2.6 (Same Vdom)Also, I have fortimanager in my environment... So can I upgrade Fortigate firmware directly through Fortigate firewall settings or should I upgrade firmware from Fortimanager and push it in firewall Please suggest what is the best practice for upgrade of Fortigate firmware Image1) Uploading firmware image through Fortigate!!2) Uploading fortigate firmware image through Fortimanager and push it on Fortigate!!

I have setup a Fortigate 60E previously where it allowed an interface to select Internal1,Internal2, etc which is basically port1, port 2. This allowed me to set different ports for the different networks running through the firewall. However the latest Fortigate 60E I have acquired has a Software Switch Interface and it only has the option to add internal which is all the ports. How do you split internal up so I can choose specific ports?  I know it can be done as the other firewall (same model) had this.  

Hello,Im a new user of fortigate devices and need your help.Im trying to configure external access to the web service and unfortunately Im not successful. My configuration:Web server(Apache) - 10.0.8.88/24 (site is available locally by https)Interface - 10.0.8.1/24 Virtual IP:-External IP (my public ip)-Map to Web server (10.0.8.88)-Port forwarding 8000> 443When trying to connect MyPublicIP:8000 I get message "This site is unreachable". From the logs I get the information that it cannot find the right policy, which is incomprehensible to me because I have this one. Incoming interface(WAN1(public ip)) > Outgoing Interface (10.0.8.1/24). Please help,Lukas  

Hi There, I' new with Fortinet products.I have a Firewall event alert from one computer :  I don't undestand what happen with this alert.Does this mean that OpenVPN is installed ?Thanks for you help.Kader

Hi all.I have installed a Fortiswitch over layer 3 network, my fortiswitch is already managed by a remote Fortgate. Fortiswitch is connected directly with a 3rd party firewall in a branch site. Config looks like this: config system globalset switch-mgmt-mode fortilinkconfig switch interfaceedit "internal"set native-vlan 4094set stp-state disabledset snmp-index 11nextedit "__FoRtILnk0L3__"set native-vlan 4094set allowed-vlans 1-4094set dhcp-snooping trustedset igmp-snooping-flood-reports enableset mcast-snooping-flood-traffic enableset snmp-index 13nextconfig system interfaceedit "internal"set ip 172.29.xx.xx 255.255.255.0set allowaccess ping https sshset type physicalset snmp-index 12nextconfig switch-controller globalset ac-discovery-type staticconfig ac-listedit 1set ipv4-address 172.29.8.1nextendendconfig system ntpset allow-unsync-source enableconfig ntpserveredit 1set server "172.29.8.1"nextendset ntpsync enableendconfig router staticedit 1set dst 0.0.0.0 0.0.0.0set gate

Hi, i need to configure two vpn site-to site as in the following network diagram: Fortinet1---VPN---Fortinet2---VPN---Azure I need to reach from the fortinet1 and fortinet2 the servers on CloudAzure . What is the best type of configuration for this scenario ? The fortinet2 do i have to set it up as a hub and spoke ? thanksAntonio

In environments which do not have NTP server, we usually prefer Fortigate to announce time to related interfaces. However, I recently bumped into an interesting problem. With this fortigate, time is set manually and it has never been connected to the internet. When ntp server to specific, directly connected, vlans is enabled. Even if it seems to be working none of the clients could reach out and grab time from fortigate time server.I could not find any related info at the knowledgebase and documentation. Is there anybody who has experienced such a problem?FYI: Fortigate should be kept offline and connection to the internet even for a brief second is not possible. 

Good morning. Trying to clear these input and output port stats for a FortiSwitch running v6.4.x  Any suggestions?Port(port13) is Admin up, line protocol is upInterface Type is 10 Gigabit SerDes Framer Interface (SFI)Address is 04:D5:90:E9:FB:32, None loopbackMTU 9216 bytes, Encapsulation IEEE 802.3/Ethernet-IIfull-duplex, 10000 Mb/s, link type is manualinput  : 118759473804980 bytes, 128798728685 packets, 0 errors, 520 drops, 0 oversizes         128772867347 unicasts, 3135872 multicasts, 22725466 broadcasts, 0 unknownsoutput : 134128322003035 bytes, 138778544432 packets, 0 errors, 253307 drops, 0 oversizes         138646043063 unicasts, 57748125 multicasts, 74753244 broadcasts0 fragments, 0 undersizes, 0 collisions, 0 jabbers 

Hi  Actually, I could not find a resource that mention how to add Threat Map dashboard to the Fortisoar, I've no idea if it is a dedicated connector/widget or dashboard related to a specified connector. Thanks 

I'd like to know the difference between the Fortigate Local user and the Administrator User.Is there any Topic or technical documentation that addresses this?

Hi There,  

Hi guys, just a simple question : My Fortigate 90D,  under VPN Creation Wizard, STEP 2 , when asking for IP Address, it wouldn't let me input a port as we are using xxx.xxx.xxx.xxx:444 Is there a way to add a port to this IP address  Thanks in advance 

Setup required as follows: -In office LAN- User logs into PC/ Laptop with authentication and gets access to internet.Internet usage capping is done on particular user/ group (example- 10GB daily traffic is assigned). Currently we are achieving this via web filter security profile usage capping bandwidth quota in proxy mode.  Post user/ group has consumed the 10gb daily traffic; automatically the speed should reduce as per traffic shaping applied. Query here: - How to set it to daily usage for the amount of GB traffic capped.How to configure firewall to automatically allow traffic shaping applied over users in scope once they have consumed daily traffic allowance. Is it possible even or not to achieve such use case? Kindly confirm. User are authenticated via LDAP in FortiGate. 

Hello Team, Basically, I have planned a fortisoar implementation with Rocky Linux 8.6 and Fortisoar Bin file but there is no docker step for this implementation in 7.3 documentation. I have below doubt as well : 1) If I install fortisoar with rocky linux + bin , then can I run automation scripts without docker? FortiSOAR 

Hello,We have a problem with a client to create two VPN IPSEC DialUP.  How can I get access to the following post?https://community.fortinet.com/t5/Internal-Knowledge-Base-Articles/Technical-Tip-Using-Peer-ID-to-connect-to-multiple-IPsec-DialUp/ta-p/193477?externalID=FD38084common.feature.saml.dev.post.page_title  Thank you.

We're setting up an EMS VPN Tunnel to push out a VPN profile to FortiClients. In that script, we want to execute a gpupdate when the user connects to VPN. That way their GPO mapped drives will be mapped when the tunnel comes up. The question: When exactly does this script run?  Immediately after attempting to bring up the tunnel?  Or only once the tunnel is successfully up and running?  We're debating adding a sleep timer to the script to wait before executing the gpupdate.  But we only want to do this IF it's necessary.  Otherwise, we'd rather remove any delays, so users can have their mapped drives ASAP after the tunnel is up.

You used to be able to sort columns on the web interface (pretty much any screen that has columns) by right clicking on the column and dragging the items around to the order you want.  It seems somewhere along the line they either removed it or somehow made it work differently.  Any suggestions to change the column order? https://drive.google.com/file/d/1U_J-Ezgse52-QQt8byVpSkAGxP_vhSE-/view

The default route in Fortigate device leads to the operator, which has its own additional network protection. For example, it blocks Fortigate servers! I cannot change it. But we have the other operator on second WAN port. For one of VLANs I have defined appropriate policy routing. How can I define such policy routing for traffic from the "inside" of the device (communication with Forticloud, downloading antivirus definitions, etc.)? Which port is the source port for such traffic?

Hi Team,My Forticlient EMS is behind a Fortigate NAT , port 8013. Can I connect to EMS from my client on a public IP with a port? For example: 3.3.3.3:8013 Or do I have to use fqdn?FortiClient,FortiGate, FortiClient, FortiAuthenticator, FortiDB

For a client, I am trying to setup a vpn site-to-site from a local Fortigate 200F, firmware 7.2.3, to the AWS site-to-site connectors. I succeded to make it so I could ping from AWS to a local machine, but ping from a local machine to a AWS machine would not work. How I did it and config I went in the docs of AWS and Fortinet, followed them, then downloaded the IKDv2 configuration file, followed the instructions, and it was pretty smooth for those parts.* Fortigate Network IPSEC tunnels section here:Fortigate routes here:  *In this post, I'll only talk about one tunnel, and I'll ask the community about the two tunnels failover in another post. So the route on AWS side are working and I suspect that the AWS side is not the cause here: My Firewall policies are there:   And If I DENY my AWS VPN to the local LAN, the pings from AWS to local LAN stops, so this is proof that that direction goes by the Firewall.If I reverse that by puttin

Dear All,We want to enable FIPS mode in FortiOS 7 version and above.As per details available till now, we found FIPS-CC mode which gets enabled in FortiOS 6.2 and below;post loading FIPS-CC firmware over the box and enabling it in CLI. In FortiOS 7 and above, we do see config system fips-cc but enabling the mode is disabled. Please confirm if Fortinet does not compliant now with FIPS standards or if it does, then what are the steps to enable it? 

Hello, Some of the devices in our LAN are relying on hostnames to address other devices, e.g. server-a, server-b, laptop-john.In our pfSense setup we have DHCP Static Mappings, which are binding MAC addresses to IP addresses and at the same time specifying a hostname. Is there a way to achieve the same in FortiGate or at least some alternative solution? Thanks in advance!

hi everybody,I'm testing custom IPS signatures with FortiGate 60 (firware v7.0.9 build0444 . The idea is to detect and block http responses  containing certain strings like "<?php" (php opening tag should never appear in the output html code). My web server is located in DMZ protected by Forti (of course, the right IPS profile is attached to the right firewall rule). since it doesn't work with http (80) I didn't even try with https. In order to exclude server compression I even tried talking  to my web-server using telnet client - without success. thx for any hints:I tested many combinations like this:F-SBID( --name "php_detect1"; --default_action drop_session; --service http --protocol tcp; --app_cat 25; --flow from_server ; --src_addr 86......230/32; --pattern "<?php"; --no_case; --context body; ) F-SBID( --name "php_detect2"; --default_action drop_session; --service http --protocol tcp; --app_cat 25; --flow from_server; --src_port 80 ; --pcre "/<\?p

 Hi everyone i will try to backup FortiEMS database via GUI, but error. how is the solution? have you ever experienced it? FortiClient