Solved

Hi, has anyone try before using RDP to access back into the server within a fortigate?using noip fqdn address as the RDP. while created a loopback interface for the wan port as it only had one public static IP address. Will it works? Below is the configuration set. port1 role - WAN policyincoming int- "port 1" "loop"outgoing int- "internal"source- "all"Destination- "VIP"service allnat disabled VIPint "port 1"External "public static ip"IPv4 192.168.50.222Port Forwardingexternal port 9100ipv4 port 3389

On URLScan.io, some sensitive URLs to shared documents, password reset sites etc. were leaked recently. Is there any advisory for FortiSOAR users to verify their URLScan.io integration is safeguarded from the issue?

Is it blocked or exempt? Exempt comes first then we get the ssl-anomalies We are seeing new behavior in 6.4.9, for windows updates this was resolved by importing the CA. But for push.apple.com this was not resolved by importing Apple Public EV Server RSA CA 2 - G1.crt 

Hello, I have a FGT 60F and have multiple WAN IP configured on WAN1(Network >> Interfaces >> WAN1 ; Manual settings + "Secondary IP address" configured  Is this the right way to configure it? The second thing:one internal IP should route all traffic over the second WAN IP Address and all the other internal devices should route over the "normal/default" WAN IP.   

Looking for a reference on official Fortinet /Fortigate models that offer -48V DC power options.  We are a service provider by nature and most all of our power plant is DC (-48V) sources. Thanks ahead of time, Jesse

Hello everyone,I have two FortiGates 1100E that with HA and the secondary console is acting out.Whenever I disconnect HA and make it standalone both work fine, when HA is connected the console keeps posting messages in Putty "Incorrect login" but I do not even press any key or anything it's just every 5-second posting error login.Did anyone have the same issue and have a resolution to it, I just want to have the console to secondary in case of emergency.P.S. I do know how to connect to secondary CLI via primary > exe ha manage (id of secondary)

Hello there, I'm trying to configure Explicit Proxy on my Fortigate 500E with FortiOS 6.0.5 and no luck so far.My Fortigate is linked to my fortianalyzer and I just want to log every http/https traffic without any deep inspection SSL. I followed multiple tutorials that we can found online and everything is pretty working well when we are using a PAC file (and add it to our web browsers configuration).However, I want to make my last step and make it works transparently. It seems to work well with HTTP website. When I call it, my kerberos ticket is created on my workstation and when I go on my firewall user monitor I can see my user logged with attribute Explicit + Firewall.But if I browse an HTTPS website, I always have a certificate SSL error (and I don't want to import my fortigate SSL certificat into all my workstations). I don't understand why it works well when proxy information is added to the web browser and with the same "filtering option" in transparent, it

Hi, guys, Just would like to know if any way to move the policy ID to the first left column ( or to the top order ), in order for the easy view/administration of policy by order (for all administrators), as the attached.   Thanks so much in advance.

Hello all, I have created the VPN Zone with 10 IPSec Tunnels.now I need to create a policy between 1 IPSec VPN to multiple IPSec VPNs within the same VPN Zone, But with different Sources and Destinations. Just a Query Could you please help troubleshoot this issue? Thanks in advance.  Regards,Aliz Shrestha

Hello,   I am having query on SDWAN ADVPN child tunnel interface sequence. In my LAB topology I have 1 Hub and 3 Branches with internet underlays. We have necessary ADVPN configurations available in Hub and spoke branches Scenario, We have VPN named as ADVPNBranch 1 communicating to Branch 2 - This will form ADVPN child tunnel interface ADVPN_0 at both end (Branch1 and Branch2)Branch 3 communicating to Branch 1 - This will form ADVPN child tunnel interface ADVPN_0 at Branch3 but since Branch1 already has ADVPN_0 (towards Branch2), at Branch 1 ADVPN_1 child tunnel interface will be created to Branch3.. Whether this scenario is ok ??.. I mean Branch 1 has ADVPN_1 child tunnel interface to Branch 3 while in reverse path Branch 3 has ADVPN_0 child tunnel interface towards Branch 1.. Having two different child tunnel interface at both end is ok or is it an issue?? Whether this will cause any route lookup failure in reverse path considering no interface available.. P

I am following https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-iCloud-Private-Relay-from-bypassing/ta-p/228629 to block iCloud private relay from bypassing the security inspection. My question come into the DNS filter portion of the guide. Since I do not user the DNS filter option in my FortiGates, I just create DNS policies on my internal Windows DNS servers to DENY (provides a response and not a drop) those domains. This brings up the bigger question for me of, Apple's own admission is that the only two domains needing to be set with "no error no answer" or at least some response...just not dropped, is mask.icloud.com and mask-h2.icloud.com. The linked guide however, adds several other domains to this beyond what Apple states, so just wondering about the discrepancy between Apple and Fortinet?

Hi, I used to configure 3rd party DDNS on 6.4.x using the following:Execute the following commands in a CLI session:config system ddnsedit 1    set monitor-interface "wan1"    set ddns-server ddnsservice.example    set ddns-domain "hostname"    set ddns-username "username"    set ddns-password passwordBut with 7.2.1 i could not find the option to add the username and password just the server, and domain !! Any tips To configure DDNS servers other than FortiGuard in the CLI:config system ddns edit <DDNS_ID> set monitor-interface <external_interface> set ddns-server <ddns_server_selection> set server-type {ipv4 | ipv6} set ddns-server-addr <address> set addr-type ipv6 {ipv4 | ipv6} next endhttps://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/685361/ddns  

Running on Yosemite, I have now tried both the latest(5.2) and 5.0 but for one or other reason I am connected for sometimes less than a minute. I then get above mentioned error but it connects immediately again. Please help.

We have fortianalyser but not able to get the details of the IPs banned/quarantined by Fortigate on Fortianalyser. Is there any way to get the report also?

Hi, I have an strage error with logging.I have two Test VMs (10.244.15.41 and 10.244.14.109) in AWS segmented by an Fortigate 7.2.2 First I did an SSH connection from 10.244.15.41 to 10.244.14.109As next step I ping 8.8.8.8 from 10.244.14.109But the Fortigate Logging shows the connection in an wrong order with 3 Minutes delay! Date TimeSource IPDestination IPProtocolActionRule2022/11/09 09:44:4710.244.15.4110.244.14.109SSHACCEPTAWS-Internal2022/11/09 09:41:3810.244.14.1098.8.8.8PINGACCEPTAWS-External Has anyone an explanation for this? ThX Mag

Hi,If the FortiGate has 2 default route but with different priority like below: config router staticedit 1set device wan1set gateway 192.168.208.29set priority 10nextedit 2set device wan1set gateway 192.168.208.30set priority 20nextend Without the link-monitor configuration, can FortiGate failover to static route #2 when the static route #1 is unreachable? ThanksArie

I'm in the process of reconfiguring my 1800f v7.12 to a firewall on a stick topology. The new configuration will only have 2 active physical ports that connect to CORE1 and CORE2 switches. The CORE switches have a physical connection to the Edge router. I'm using BGP for the routing and that seems to be working. Each active port have 2 sub interfaces, a trusted VLAN and an untrusted VLAN. My issue is the trying to modify my current FW policies. The inside to outside seems to be working fine. However, I do need several policies that allow for my DMZ traffic to hit certain IPs on the inside. With only a trusted and untrusted ports to choose from I'm confused as to what that policy would look like. Technically, now my inside IPs and my DMZ IPs are considered inside addresses.  BTW, the CORE switches forward all my DMZ subnet to the FW. The gateway for the DMZ subnet is the FW.  I have no static routes, its all BGP.

Hello, We are using FortiGate 61E v7.0.8 build0418.And we want start using Forti switches but fortilink error stands in our way.When i try to open default fortilink interface via GUI it gives me an error:"Failed to load data."We never used fortilink or fortiswitches so is doesn't have any references.When i try to delete it:Generic errorSwitch interfaces can only be deleted from the switch interface table.Command_cli_delete:6677 delete table entry fortilink unset oper error ret=-160. Fortlink interface via GUI looks like so: CLI:     # config system interface # edit fortilink # show config system interface edit "fortilink" set vdom "root" set ip 169.254.1.1 255.255.255.0 set allowaccess ping fabric set type hard-switch set device-identification enable set lldp-transmission enable set role lan set snmp-index 7 next end   I know a workaround is to disable fo

Hello All, Hope you are all fine. I have an issue with the FortiClient. I'm building a lab for a project that I will deploy. I tried to deploy a Remote Access VPN (SSL VPN) on a VM edition of the Fortigate, but it is not working with me. When I try to connect, I get the error below: Unable to establish the VPN connection. The VPN server may be unreachable. (-5) My Fortigate is on OS FortiGate-VM64 v6.2.3,build1066,191218 (GA)And my FortiClient version is: 6.4.2.1580 After debugging, I get the logs below: [169:root:2c]allocSSLConn:289 sconn 0x7fb37a483e00 (0:root)[169:root:2c]SSL state:before SSL initialization (192.168.187.1)[169:root:2c]SSL state:before SSL initialization:DH lib(192.168.187.1)[169:root:2c]SSL_accept failed, 5:(null)[169:root:2c]Destroy sconn 0x7fb37a483e00, connSize=0. (root)[169:root:2d]allocSSLConn:289 sconn 0x7fb37a483e00 (0:root)[169:root:2d]SSL state:before SSL initialization (192.168.187.1)[169:root:2d]SSL state:before SSL initializ

In my machine (FortiWiFi 60E FortiOS v6.4.4 build1803) I got on Route policy screen:how I can clear it, and start over? 

Currently we are using a FortiGate with explicit proxy in our environment because we have always used a proxy in the past to control which users get access to the internet and which do not. The same FortiGate is also the main firewall and default gateay. On the proxy policies, we use the following security features:- SSL Deep Inspection- Antivirus- Web Filter- Application Control- File Filter The clients get the proxy information via PAC file. However, the proxy address is the same as our default gateway, which means internet connection could be established over normal IPv4 firewall policies as well. From time to time, there is problems with websites or applications that do not go over the proxy correctly. Either there is a problem with authentication (407 Authentication Required) or the websites simply break as soon as any security profile is applied (i.e. the browser returns err_emtpy_response). That makes me wonder, aside from the user authentication part, are there any be

Hi everyone, I've just downloaded the VPN-only free version of FortiClient for MacOS. Even after successful installation and configuration I'm not able to connect. Can you help me figure out the issue please? Do you know if the downloadable file available in the website is compatible with the latest Monterey 12.6.1 MacOS version recently released? I've had a look at this article which seems helpful, but even then I cannot find all the extensions mentioned there. Thanks all for your help with this.leti

Hello Expert, I have configure  a "vpn"  tunnel between FortiGate 80F a Palto Alto device.The wan interface of the Palto Alto device is using private ip address for the wan interface because the another device on the network is use for full internet access The public ip address is 81.135.253.181        private ip addess 192.168.190.2           (remote identier)  I do not know where in fortigate I must input this ip address 

Kindly I need for your support for FortiManager Cloud. I'm asking about if FortiManager cloud can be logging to FortiGate hardware appliances GUI.

Hello, everyone Does anyone know where can I find the official documentation for FortiAuthenticator's OID lists? I am aware there are two MIB files you can download from the SNMP configuration page in FAC but for some reason it is not getting any CPU metrics while sensing via PRTG.  Thank you!