Solved

FortiGate200F , firmware version 7.0.8, I need some hint. 1- So I configure an LDAP server on my Fortinet, used the "test" button with a username and password and it's working. (Edit LDAP Server image : That "test user credentials" button is working.)   2- I configure a group (GUI : User & Authentification - User Groups), named GRVPNLDAP pointing to a LDAP group on Active Directory. 3- I then configure a remote VPN with GRVPNLDAP to authenticate with the IPSec Wizard, remote - native - Windows Native. (VPN Creation Wizard image : We use this Wizard to create the new Remote VPN.) 4- I convert the new R100 IPSec Tunnel , so I can use a secondary IP address on the Wan interface. 5- When I test the VPN, In the Event VPN logs, I see : Pass1 ok Pass2 ok, then the connection closes. 6- I test/configure another Remote VPN, with the same settings, except with a local user, it works. 7- I test/configure a login for the Fortinet GUI that

Hi there, SFTP configuration backup fails if there is an @ in the username, Is this configuration not supported? execute backup config sftp <file name> <SFTP server> <username@domain.com> <password> 

Hello Team,Is that possible to configure more than one Syslog Server in a FortiSwitch? In the documentation I see just this command related to syslog configuration. The are not any information about adding another server. config log syslogd settingset status enableset server "Server_IP"end Is there something similar as Fortigate, where I can set an additional Syslog Server with the commando config log syslogd2 setting or config log syslogd3 setting? Thanks. FortiSwitch 

Hi, I am deploying Fortigate Standalone on GCP, FG deployment was successful. In GCP we have created 4 VPCs (unprotected, protected, App & DB). VPC peering is configured between protected vpc to App vpc and between protected vpc to DB vpc via versa. Between App VPC & DB VPC we are unable to communicate. Communication between APP VPC & DB VPC should happen via Fortigate.  How we can achieve the same ? 

I would like to know if i conect a fortiswitch with an interface SFP+ (10GB) to another Fortiswitch with an interface SFP (1GB), this conection will work ? can auto negotite the speed to 1GB ??? I found this on the administration guide ¨Auto-module speed detectionWhen you enable auto-module speed detection, the system reads information from the module and sets the port speed to the maximum speed that is advertised by the module. NOTE: Auto-speed detection is supported on 1/10G ports¨ But i read in a KB that no all fortiswich serie support autonegotiation. Can some have test it ? FortiSwitch  

Hello, We've configured our Fortigate firewall this afternoon and configured our SSL VPN together with MFA. Everything works fine, but it seems that we have a problem with our MFA. The Fortitoken application is configured and shows a MFA code. The Approve/Deny prompt isn't always working, it only appears to work sometimes while manually entering the 6-digit MFA code works fine in the same attempt. Did anyone ever experience something like this that managed to solve this? We've enabled FTM on our WAN interface, a valid Forti Softwaretoken license is connected to the account. It doesn't matter which account we use, ever VPN account seems to experience this problem. Thank you in advance!

FortiManager-VM64 v7.0.3 GA build0254Log View... TrafficI notice many "Policy Violations" from china.Is this just standard "door knocking" on Telnet ports that I can ignore or is it symptom of more serious problem? 

Bonjour,Je veux essayer de résoudre les conflits d'ip lorsque je suis sous vpn.Mes utilisateurs ont besoin de se connecter en rdp à un serveur qui peut avoir la même ip que celui qu'ils ont chez eux.être explicite ; L'exemple :le serveur : 192.168.0.66home ip :192.168.0.66Il m'a semblé qu'avec l'option "Enable Split Tunneling" il était possible d'éviter ce conflit. Mais j'ai fait quelques tests, ça ne marche pas.J'ai peut-être tort ?Une idée ? Merci

Anyone know does the forticonverter on the juniper conversion section is determined by the model or by the OS? Need assist. As I have a ISG1000 running on ScreenOS want to do conversion but I saw only SSG(ScreenOS), SRX(Junos OS) and MX (Junos OS).

Hi, guys, Just would like to know if any way to view the local-in-policy hit count, thx a lot ? I tried the normal method, but failed, as the following: For viewing the hit count of  a normal security policy ( working ) :Ftg100E # diag firewall iprope show 00100004 36idx=36 pkts/bytes=485923/517732782 asic_pkts/asic_bytes=474029/508168477 nturbo_pkts/nturbo_bytes=0/0 flag=0x0  hit count:207 first:2020-03-30 16:17:19 last:2020-07-22 12:46:59 established session count:0 first est:2020-03-30 16:23:14 last est:2020-07-22 12:46:59  For viewing the hit count of the local-in-policy ( not working ? :(Ftg100E # diag firewall iprope show 00100001 1 idx=1 pkts/bytes=0/0 asic_pkts/asic_bytes=0/0 nturbo_pkts/nturbo_bytes=0/0 flag=0x0 Ftg100E # diag firewall iprope show 00100001 2 idx=2 pkts/bytes=0/0 asic_pkts/asic_bytes=0/0 nturbo_pkts/nturbo_bytes=0/0 flag=0x0  Please advice. With many thanks.Benson  &nbs

hello @Alli have a problem with fg-1100E firmware v7.2.2.when i want to create a hardware or vlan switch, i get sw0 & sw1 offered. so far so good, but why are the ports greater than 28 not included?i need the QSFP+ port 34 as uplink and at the same time other ports for subordinated switches or special servers. some of them are access ports and others are trunks.so at the moment i only have the possibility to create a software switch, but unfortunately it does not allow me to differentiate different ports with the same vlan as desired.i can't even define ports 33 and 34 as dedicated ethernet trunks.why is this?thxjmc

Hi Everyone, please help me to understand this,  when I checked the Event monitor by threat (High Risk App Usage), I found out that the application: TOR is using by some computers in company, actually the tor is not installed on any computers, please let me know why Fortianalyser show that? how we can investigate? Thanks  

Hello team!!! Through the cli, I know the way to use email as second factor authentication for a user, but I wonder if there is a kind of limit for this feature.  Is there a limit for licences for local users with email as 2FA?Also, another question, I think 2FA for VPN clients is only available for FortiClient VPNs (IPsec or SSL), right? I think I can not tell Windows or any other OS to ask me the second factor of authentication.  We have here a L2TP/IPsec VPN, which works in native clients, we prefer do not use FortiClient but I think we will need this. Regards,Damián

Hi,I got a Linux box setup on a DMZ with the IP 192.168.30.2 connected to my FG 30E DMZ port. The Linux box is setup with iptables to forward all traffic from eth0 to wlan0 using these parameters:# Forward LAN packets to the WAN.iptables -A FORWARD -i eth0 -o wlan0 -j ACCEPT# Forward WAN packets to the LAN if the LAN initiated the connection.iptables -A FORWARD -i wlan0 -o eth0 -m conntrack \ — ctstate ESTABLISHED,RELATED -j ACCEPT# NAT traffic going out the WAN interface.iptables -t nat -A POSTROUTING -o wlan0 -j MASQUERADE From my PC on the LAN I can ping the DMZ Linux box. ( Ive got a rule on the FG30E allowing everything between LAN and DMZ and back again). From my PC I cant ping the "other device" (192.168.4.1) which is on the other subnet (192.168.4.0/24) which the Linux box is forwarding all traffic to. Linux box can ping the "other device" (192.168.4.1) no problems.FG20E console can also ping 192.168.4.1I have a static route setup in the FG30E:  Any ide

Hello Wondering if anyone has encountered this issue and if there was a work-around? I am assuming that it is installed...I can't seem to get HA2 working with HA1 because of this. Thank you for your assistance...  

I've inherited a fortigate 60E in a business location. The owners say every few months people can't connect to the wifi network. The business gets dozens of people a day who connect to the Wifi. So my suspicion is the Fortigate is hitting some limit of 255 192.168.1.X ip addresses? In the past I would tell them to reboot the Internet modem going into the fortigate. That would clear things up. But now looking to get to the bottom of this and solve it :) Here's what I see in the settings below. Ignore the "Guest Wifi VLAN" as nobody uses that as it does not work. Folks connect to the regular Wifi network and get a 192.168.1.x address.  

I've inherited a rack system with a Fortigate 60e that was setup by some other company. I am trying to understand how they created a static IP ( 192.168.1.51 ) for a raspberry pi video camera device sitting in the site. When I go to "Addresses" I see this for the pi:And under Addresses  I see this is where they assigned the static IP:However, the confusing part is I don't see where Camera 1 points to pi003? If I edit the Camera 1 or pi003 I see no reference to each other? 

Hello, I would like to purchase FortiManager and FortiAnalyzer physical hardware. I will be adding 4000 units of Fortigate into the FortiManager and FortiAnalyzer.  Does the Fortigate requires any license in an order for it to be managed by FortiManager and get reports from FortiAnalyzer?  Please advise. Thank you. 

I want to upgrade Forti Analyzer 400E.Current version: v6.2.3Upgrade to: 7.0.4I want to upgrade my Forti Analyzer from 6.2.3 to 7.0.4As per the upgrade guide while upgrading from 6.2.x to 6.4.x, it requires log database rebuild according to the given KB.https://docs.fortinet.com/document/fortianalyzer/7.2.1/upgrade-guide/545261/firmware-upgrade-pathsHow much time it requires to rebuild the database?

We have one static/fixed IP. We want to run both VPN and a local web server, both on port 443.Is FortiGate # able to determine which protocol is connecting on port 443 and then redirect according(It looks like I can run VPN on port 443 and also access the configuration page via 443).If so, how would I configure this?Thanks in advanceMichael

Hello Bro,                Thank you for accesting me in your family, I hope to get any of your expertise.My first Question and as I've mentioned before we are new to fortinet, we are waiting out first fortigate deployment and it supposed to be licensed as follow " Hardware plus 24x7 FortiCare and FortiGuard Unified Threat Protection (UTP)".#FG-1801what are the features included in such bundle "IPS, AV, VP, ... etc" ? TIA :)

Hi team,I am unable to solve below issue can you please help me. let me tell what I am doing - WAN IP 192.168.99.2Internal Server IP - 10.1.1.1Remote user's public IP - 99.99.99.2 which is trying to access my internal server via port 8080which is mapped on fortigate Firewallexternal IP - 192.168.99.2Internal IP - 10.1.1.1with port no - 8080,8081,8082please find the snapshots for more clarifications -

Hello everyone, I'm just making my first steps with the FortiClient EMS. I have already installed some clients on domain PCs and would now like to update them.But...1. I can assign a deployment package only to a OU. But I don't want to supply all PCs in this OU with the forticlient. I only want to update not to install.2. If I don't use the AD connection, but "only" groups, then I can deploy to the group only, but I can no longer distribute the client policy dynamically per user group. Background: There are about 1000 PCs in different OUs and the FortiClient should only be used for SSLVPN on 50 PCs, which is why I don't want to distribute the installation to all PCs. Is there a best practice how to do it?How can i keep the installed clients up to date? THXSebastian  

hello togetherIs it possible to use a Forticlient with 7.2.1 when the Fortigate has 6.4.7 in use?

Hi,I receive on event of my fortinet 600D the following message:PIM-SM no vif corresponding  to interface ...My configuration use only PIM dense mode what is the meaning? what is missing?