Solved

Hi, I had saw a quite a lot on the guide to solve. But I had tried on the method but it is still failed. I can manually add the device and I can authorize the unit, both method can work.But we try manually add, once added and it will be stuck at the section and failed (see image below).Need some advice on it. Below is the issue.FGT201F is on 6.4.9 (upgrade from 6.4.4)FMGR is on 6.4.9FGT is not an internet-facing unit. Status: reloadconffail|datasrc invalid. object: dnsfilter profile ftgd-dns filters.24:category. detail: 96. solution: datasrc invalid 

Hi,I have a question about the fortilink. I transformed port A of my fortinet into a classic lan port.And I use a DHCP on this port but it does not work, I do not get any ip address (if I fix the IP address, the network works)the DHCP does not work because it is a Fortilink port? How can I solve this problem?

Hello, I want to deploy the following very simple traffic shaping scenario:port1---WAN---> High priorityport2---WAN---> Low priorityI have set two shared shapers for that:High: Traffic priority - High, Max BW = 6000, Guaranteed BW = 2000, DSCP = OFFLow: Traffic priority = Low, all other settings are OFF With these settings, a client PC that is browsing from port2 (low priority) is taking all the BW and the high priority traffic is not served. When I set Max BW at the Low priority shaper, both shapers are served. I was assuming that when the priority is set to Low to a traffic shaper, all traffic should be put a low priority no matter the bandwidth. Therefore it shouldn't matter if you have set a Max BW or not. However I notice that the Max BW really matters at Low priority shaper. Can somebody explain to me how the traffic shaper is working at low priority in respect of the Max BW setting? How does the low priority shaper is working, when the Max BW setti

Hello, first time posting in the forum.We need some help, need step-by-step assistance adding FortiGate 80E to Cisco 3750 stack, we have multiple different subnets, would like them all to coming together, seems there is multiple ways posted online for doing this, what's the best way to do this. We have several interfaces with IP's/SVI on Cisco stack, along with several VLANS. Not sure how to configure the FortiGate for the new networks, if routing is required, Policies we should create to allow all networks to connect. Thank you all for your help 

Have to replace Fortigate-300D in challenging position in rack. Defective unit is mounted with the ear brackets. Need to verify/confirm the screw size and bracket dimensions/length. Will need to use right angle rachet screwdriver to get unit out and need to confirm bit size. And/or - anyone have mechanical drawing of Fortigate 300D that might detail screw size. Much appreciated. Did check Fortigate300D install guide but it just has generic pix of bracket and screws but no specifics. 

Hi All, Do you encounter the issue with 2 PC connect same IPsec VPN on same wifi network? Mean, 1 PC connect the VPN, another PC unable connect VPN, until the 1st pc disconnect the VPN, 2nd PC just can connect the VPN.

Hi all I am trying to use the API to create users and assign them to a specific usergroup.   I can use the POST to /api/v1/localusers/ to create a user with a relevant JSON as body. This seems to work just fine. I am a bit annoyed that I can't just add the user_groups to that request, but so be it.   Then I can find all usergroups usign this GET: /api/v1/usergroups/ - This will return all the usergroups along with their "resource_uri". This works fine.   Now, how do I add a user to the group? I don't want to use the PATCH to the /api/v1/usergroups because that would require me to include ALL the users in the PATCH-call. I just need to add a user. So I thought the best way was to use the POST to the /api/v1/localgroup-memberships/ - but it fails for me. If I provide this JSON: {"group": "/api/v1/usergroups/2/","user": "/api/v1/localusers/25/"} I get an error back: "Cannot add facgroup-user relationship "FacGroup_users object (None)" (Response: HTTP 400), Er

Hello I am trying to determine if a customer of mine has been infected by the latest vulnerability. How do you access the Linux file system to check if the files are present? Thank you

Hello everyone,  I have two different FortiGates I recently installed on my work network. Fortigate 200E Fortigate 81EThey are both on FortiOS 6.4.8 I am having an issue with one of them (the 81E) not fully populating the users/group. Are there limitations on the selected groups the Fortigate 81E can choose simultaneously? And if there is, what is the best way to specify a group. See the screenshots attached.  They are both connected to the same FSSO agent on a windows device.  Thanks in advance for your help.   

Hello, I am just creating a security fabric out of our three firewall systems - FG501E HA-Cluster (site1, fabric root, 7.0.9)- FG60E (site2, fabric member, 7.0.9)- FG61F (site3, fabric member, 7.2.3) Both the 60E and 61F are connected via site-to-site VPN created by the integrated wizard.I configured the tunnel interfaces, gave them IP addresses and created the required static routes.The 60E is joining the fabric without any issues, the 61F does not. All the traffic to the root fabric is blocked: Maybe you do have any idea or hint what I may be missing out here. I already chatted with the Forti Support to verify that the newer firmware is no problem joining the cluster as it is supported. Thank you in advance and kind regards Marius

Hi, i am using a Fortinet 60F for managing IPsec-Connections between machines outsiede the company and the central.If the tunnel is established, all traffic goes through the tunnel. The drawback is, that SSH and ping to the components goes through this tunnel, too. Components without an IPsec tunnel (e.g. a central machine) cannot access these components via ping ans SSH. How can I configure the 60F, so that alle the traffic goes through the VPN tunnel, except SSH und ICMP packets?

Hi I have a problem with dedicated management port setup with my Fortinet 201E running version 7.2.2Please can someone take a look at my problem when I am trying to setup a dedicated management port. I have an Active/ Passive setup and I would like to configure a different IP Address on each box. I would like to see on the Monitoring tool that both devices are up and not just the cluster, and also to be able to login to both Active/ Passive device.I was configuring the dedicated management port and I keep getting the error in the screen shots that I have provided.https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-dedicate-an-interface-to-management/ta-p/189625The setup is as follows;Root - is not the management VDOM, the was changed to have FIREWALL-1 context as the management VDOM.Everything is working well with the setup, except I have a reference attached to the management port, a “Sniffer” object type, I have provided screen shots,When I follow the link that I just p

Hi CommunityI'm in need for some design guides and ideas.I have a few Fortigates in different Offices. All of them have an internet connection and sometimes a backup line.All locations have a vpn tunnel to the HQ and a static 10.0.0.0/16 route which points to the vpn-interface.The HQ is doing the routing and spreads the /24 or /23 toward the branch offices vpn tunnel interface(s). So far everything is working but it's not looking niceMy Idea is to use OSPF or BGP between those locations, but i'm unsure how to set it upGeneraly I would put all those FGT into area 0. If we have a "sub-network" attached in a branch, that would get an other area.But since we don't have all those FTG in the same subnet and don't have a full-mesh...The current plan is to use HQ as area 0 and put each branch into a different area.The ipsec tunnel interfaces between HQ and branches get their own /30 subnet.HQ will announce the /16 network towards a branch and the branch announces the local /24 or /23 towa

Hi Firewall Gurus,               I'm looking for best practice for the phase 2 selector subnets in a general case. I understand in some case it requires to use 0.0.0.0/0. I'm talking about in decent network segmentation internal network that connects to outside. Is it better to have broader range of subnet or as specific as possible. For example, if I have a /16 subnets, but I only need to allow one or two /32 IP addresses from the other side of VPN tunnel. Do I create two /32 selectors or one /16? Thank you.  

Hello, i have 3 sites with fortigates (+APs, + SWs), all are connected directly to the internet. is it possible to put the im one security fabric and does it make sense to do that? In the documentation and cookbooks i can only find examples with fortigates which are on the same site. thank you in advanceFeho 

Hi, I have an active/active cluster of 2 x 3200D's. There are 2 ports dedicated to HA communication, port47 and port48. In order to see these HA port's physical and virtual MAC addresses, I do this: FGT-3200D (root) # diagnose sys ha mac[... other interfaces which have VLAN(s) attached for user data ...]prio=0, phy_index=46, itf_name=port47, mac=e8.1c.ba.x.x.x, vmac=00.09.0f.09.00.2e, linkfail=0prio=0, phy_index=47, itf_name=port48, mac=e8.1c.ba.x.x.x, vmac=00.09.0f.09.00.2f, linkfail=0[... other interfaces which have VLAN(s) attached for user data ...]Unlike the interfaces for user data, where I can see the HA VMAC on the L2 infrastructure of the network, I cannot see the HA specific VMACs (00.09.0f.09.00.2e and 00.09.0f.09.00.2f above) on the L2 infrastructure. The cables from ports47 and 48 do go into switches and are not directly connected. And I do see the physical HA MAC addresses on the switches!Can someone explain why I cannot see the VMACs of the HA interfa

Hi Guys Starting two weeks ego my FGT200E web UI stopped responding, giving ERR_CONNECTION_REFUSED nosing and  diagnosing, it appears that the HTTPS  daemon is not running did some top commands and #dia sys process pidof httpsdgives no answer, nor the top shows any httpsd daemon runs on the system I also restarted the box two days  ego, and still no HTTPS access  i run the FortiGate-200E v6.4.10,build2000,220824 (GA.M)   What would be the next step Appriciate   

Hi all A new behavior came up during a penetration testing that all published application (publishing is on a Cisco ASA) replies on the tcp ports 2000 and 5060. During the investigation we figured out that not the ASA replies on them, that this is the Fortigate firewall which is sitting in front of the ASA to route the traffic between two connected Internet providers. As we don't need these ports and we don't need SIP inspection and proxy function (in our case this vDOM on our Fortigate is "only" a router and has no policies in place), our approach is to disable this behavior. All filtering/inspection should apply on the ASA firewall which is on the LAN side of the Fortigate. Based on the article https://kb.fortinet.com/kb/documentLink.do?externalID=FD36152 we found that this behavior is a normal function of the Fortigate. The only option here would be to move the ports away from the standard ports to a higher port, but not to disable this function. Means the publis

I have noticed when calling into certain automated phone systems, the FortiFone/FortiVoice is either not sending the complete tone or the other end is not receiving it or interpreting it as some of the phone systems are not responding to the button presses. I dialed my cell phone from my FF and pressed each of the number keys and I hear a truncated tone through my cell phone, the packet capture shows the tone being sent through the FV. FortiFone 480 is using v3.0.16 build 265 connected to a FV-100E running 6.4.4 build 414. It does work with most systems, but I have encountered a couple where it consistently does not work, where my cell phone does work, and even some where my cell phone does not work and the FF does work. Does anyone have any thoughts on what could be causing these issues? Thank you.

Hello, I would like to restrict access to certain users which are assigned a custom profile, access to the configuration of all Traffic Shaper / Traffic Shaping Policy / Profile options/config and was wondering if it can be achieved somehow.The restrictions would need to be for both CLI / GUI and what I've tried is :- put System > Configuration to Read on the profile, but that would only disable Feature Visibility from the GUI for them, but they would still work from CLI- put Firewall > Others to Read, this would achieve want I want but would disable access to IP Pools / Protocol options.Any help would be appreciated. L.E. Running FortiOS 6.4.10

I know enough about FortiAuthenticator to be dangerous, so forgive me if I come across ignorant on the product. I currently have mine setup where I have a SAML connection to Azure where I can pull user and group information; however, the only login event I have been able to accomplish from my non-domain joined devices (which for me is about 90% of my devices as we are 1:1 Apple) is via Syslog from my 3rd party internal web filter appliance for Apple devices. I have a web filter agent providing login info to my filter where it matches it against AD users so that they can be put into the correct groups. Domain joined devices are handled via web filter agent on the AD server for those login events. So in a nutshell, I am able to filter all of that down to my FortiGates into FSSO groups for varied policies to match up against. So my first question is, why doesn't Fortinet have a simple multi-OS agent that would provide that info directly to the FortiAuthenticator? In my situation, I a

I'm having an issue with setting up OSPF over IPSEC tunnel.  1. IPSEC tunnel is up.2. Tunnel is up.  I can ping remote tunnel IP.3. OSPF interface doesn't show the tunnel interface when I ran "get router info ospf interface".  It's not on the list.   Any suggestions?

I've created a custom report to show user bandwidth by date but it always returns 'No matching log data for this report'I created the data set and when I run it I see the expected results.I then created the chart and if I test for real data I see the expected results. Finally I added my chart to a report and run it without any device filtering.  No data, I've tried:For past 1,2 7 and 30 days.Any help is appreciated:This is my query (based on Log Type - Event):selectmyUser,myDate--,min(s_time) as s_time--,max(e_time) as e_time,(case when min(s_time)=max(e_time) then max(max_traffic_in)+max(max_traffic_out)else max(max_traffic_in)-min(min_traffic_in)+max(max_traffic_out)-min(min_traffic_out) end) as bandwidth,(case when min(s_time)=max(e_time) then max(max_traffic_in)else max(max_traffic_in)-min(min_traffic_in) end) as traffic_in,(case when min(s_time)=max(e_time) then max(max_traffic_out)else max(max_traffic_out)-min(min_traffic_out) end) as traffic_outfrom ###(selectcoalesce(

2016-10-04T14:00:20.092804+02:00 date=2016-10-04 time=14: 00:13 devname=FG800C3913801910 devid=FG800C3913801910 logid=0100037903 type=event subtype=system level=information vd="root" msg="The sync status with the master" sync_type=configurations sync_status="in-sync" 2016-10-04T14:00:25.128612+02:00 date=2016-10-04 time=14: 00:19 devname=FG800C3913801910 devid=FG800C3913801910 logid=0100037903 type=event subtype=system level=information vd="root" msg="The sync status with the master" sync_type=configurations sync_status="out-of-sync" I have a lot of logs like the ones above. In fact it seems that master and slave are not in sync. The synchronization status of the two cluster units : FG800C3913801256 (global) # di sys ha cluster-csum ================== FG800C3913801256 ================== is_manage_master()=1, is_root_master()=1 debugzone global: 94 ff 8c be 11 c1 c0 57 4d d7 73 dd c0 f0 46 db vdc: 3e 57 22 61 f0 58 af 18 66 9c b1 c9 ae 30 ac 75 root: 74 1b f9 bd 5c 41 a4 64 4f d

Hello, What is the current status with regards the expiration of Lets Encrypt root certificate? Is there any permanent fix to this problem and where can I find updated documentation on this subject? What is the current recommendation about that issue? Thanks