Solved

Using Fortigate 80F v6.4.10.I'm starting with an edict to "block all outgoing ports".  Obviously, that's not going to work and keep reasonable internet service.  If doing this on a port basis, it seems that one would first set up instrumentation (logging) to see what's going on before an approach for parsing into "block/allow" can be done.  I should add that I'm trying to use Policy-based NGFW mode and expect to "block/allow" Applications instead of just ports.I have a syslog server set up and am wondering what to use for search/filter in identifying outgoing application traffic.  What is typically done for this?  I only ask because I've not seen traffic in the log that I might expect.  I guess ports 80 and 443 might be a good starting point perhaps to just identify IP addresses and other pertinent appplication info for building a rule??I believe that one can come at this rather tangentially with the Fortigate by blocking all but known important "in u

Hi, I have this problem related to my Fortimail unit.I have installed the fortimail unit in front of a zimbra mail server in transparent mode, on the same DMZ subnet and obviously behind the fortigate.Incoming connections are coming from port 1 configured for smtp proxy are inbound and enabling local connectionsWhile the server is enabled on port 3 and is in pass trought both incoming and outgoing.On the fortimail unit only one domain "example.com" is configured and the relay type is set as HOST by specifying the IP address of the mail server behind the fortimail unit, making the conection rest on relay host, everything works.I can send mails and receive them without any problems, again from webmail.On the other hand, when I try to connect with a client from an external network such as a mobile device or from an internal network such as a printer that sends scans via mail.I get the error SMTP AUTH Failure.Conversely, if the relay type on the domain is set as MX record and no longer spe

I have a 48 switch. I have made 2 VLAN (Computer and Voice) I have now a new device and put it on VLAN Voice. I will get an correct ipadres and DNS but it has no internet. The other 20 phones are working correct. What is going wrong. If a put the IP Phone on the VLAN Computer it get an correct IP adres and has internet connectivity. So everything in the phone is correct. Why i cannot get internet on the device on VLAN Voice?

I have an Fortigate 60E with on port 7 with a Fortigate 48 ports switch connected trough Fortlink with IP adres 192.168.5.1 - 192.168.5.254. On my FortiSwitch a have a VLAN ID 60 for Wifi with adres 192.168.2.1/255.255.255.0. On port 40 of my switch i have an Fortigate AP (FC24JE). with adres 192.168.2.25 I have an WiFi SSID Sonos with adres 192.168.6.1/255.255.255.0. I can registrate my Iphone on it an get an ip adres 192.168.6.25. But i cannot install my Sonos with the Sonos ap. De app will not find my Sonos system. How can i fix this. With regards Dennis   

Hey guys, I've run into a couple different scenarios where the Fortigate will ignore an eBGP route (distance 20) and instead hold on to a higher distance router (e.g. static, or ospf) which it had learned about previously.  Here is an example. My Fortigate learns about routes to 10.2.137.0/24 via both BGP & OSPF. If it learns the BGP route first, and then the OSPF, it shows both in the router database, but selects the BGP route as it is lower distance: O 10.2.137.0/24 [110/2] via 10.4.3.178, port1, 00:02:31B *> 10.2.137.0/24 [20/0] via 10.4.3.181, Colo, 00:02:44 However, if for some reason the OSPF route is learned first, when the BGP route is learned, it never adds it to the routing database or routing table:O *> 10.2.137.0/24 [110/2] via 10.4.3.178, port1, 00:03:36 #get router info routing-table details 10.2.137.0/24Routing table for VRF=0 Routing entry for 10.2.137.0/24 Known via "ospf", distance 110, metric 2, best Last update 00:04:01 ago

Hi friends! How are you? We are following a tutorial:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enable-expired-password-LDAP-renewal-with-Active/ta-p/191879 But we found an issue with GCDS. We use Active Directory and Google Cloud Directory, and our LDAP syncs with Google via Google Cloud Directory Sync (GCDS). Using Remote Desktop to the Active Directory server, when we right-click an AD user and select Reset Password and change it, GCDS runs as well and change the user's password on Google Cloud Directory. But we tried using the steps described on that tutorial but Google Cloud Directory seems to not activate when the user changes It's password via FortiClient VPN GUI. FortiClient is able to detect that the password expired and must be changed on next logon, it pop's the new password window, the user applies it, the password changes at Active Directory but GCDS doesn't get activated, so the user will now have 2 passwords, 1 for AD and 1 for Goo

I have a private point to point network over IPSEC VPN.  I'm trying to allow only SMPT sendmail service from a single client on one end to a host on the Internet via the WAN interface.  I've created an outbound FW rule to allow SMTP port 25 to a FQDN (smtp.gmail.com) from the internal client with NAT enabled using the outside WAN interface IP.  I've also created an inbound rule allowing ALL traffic from smtp.gmail.com to that specific client.I can telnet from the CLI to port 25 on the smtp server but I cannot do the same from the client.I've enabled and disabled NAT on the inbound side with same results.I'm pretty new to Fortigate but have experience with other firewall and policy products.

Hi all,    Can i disable ipv6 on interface ? I have some log on the wan(PPPoE) interface. it's show descriptoin "RADVD Local AdvLinkMTU disagrees with remote site" Event message " our AdvlinkMTU on port xx doesn't agree with fe80::1".  i verify configure on the interface it's show - config ipv6 , -set ipv6-send-adv enable, - ip6-other-flage Information [FG1100E, 7.0.3] 

Good morning! Samething very strange. When I make an SSL VPN connection from my smartphone, with SSO enabled, the username changes to pinocchio, but all the logs in the fac and fortigate shows the correct user. I have tried with differents users. I think that is a forticlient issue. The linux forticlient version works ok.forticlient 7.0.6.0049 android app.Thank you!

I have configured DHCP scope in Fortinet firewall of range 10.108.120.100-10.108.122.254 /22 which can give nearly 1024 IP address.But.After DHCP scope leased 665 IP addresses,Scope is showing 100% and clients are not getting IP address. Could anyone help me out how to fix the issue.Need to get more IP addresses.Thanks

I was surprised when I noticed that there is no country connection source in the Authentication Error line! Having to wait extra time and inconvenience to connect. The Top Authentication Failure line is supposed to be the country connection column. Make it more useful to people. We are using the latest version of Fortigate 7.2.1, the Top Failed Authentication column No column Elementary, why no column?

Hi,I have a scenario and I'm looking for advice. I have 2 FortiGate configured Active-Passive FGCP.Each FortiGate has 3 active ports (e.g. port1, port2, port3). Those interfaces are monitored by HA.Let say, FortiGate-1 (priority 150) is the primary and FortiGate-2 (default priority) is the secondary. The override is enable. When port1 is disconnected in FortiGate-1, the FortiGate will failover to FortiGate-2. Now, the FortiGate-2 becomes the Primary.And then, suddenly the port2 in FortiGate-2 is also disconnected (while the port1 in FortiGate-1 still disconnected). In this situation, the FortiGate-2 doesn't failover to FortiGate-1, right?The port1 and port3 can be serving the traffic, but port2 can't because port2 is connected to FortiGate-1 (Secondary) only. Is there any suggestion for this scenario? ThanksArie

We have a problem with our LDAP connection from Fortigate to Microsoft AD.The connection was successfull, authentication against AD is still working.But on our DC's we have many Log Entries ( Microsoft Security Auditing ) that the connection from Forti were rejected.Did anyone have the same problem?

I would like to find the firmware upgrade logs of FG V6.4.10. Can anyone help me? FortiGate

Hi everybody,i tried a trial of #ForticlientEMS on premis to evaluate the product and then bought a license, but now that I really have to use it i have encountered several problems. I try to expose my questions, anyone who can help me even for just one of these I would be very grateful! :)1) Is there a way to understand from the telemetry if the Forticlient (7.0.7) is connected in VPN (IPSec or SSL) to the Fortigate? I currently use the server in standalone mode, so it doesn't interact with the Fortigate.2) I have set up a telemetry connection key on the server. I would like to create Forticlient installations that do not contain the key so that it is always to be entered manually after the first installation on the PC. When I create the installations I see the "Auto Registration" field enabled, but during the creation I am not asked if you want to enable this option or not.3) I have the server which is under NAT, so the ethernet interface has a private IP. This setting

Hi, We are currently in progress of enrolling several thousand of users to use FortiToken. Is there a way to extract a list of users with the token assigned and the status of the token? We need to be able to see user name, and if the assigned token was already activated. This is the bare minimum.  Is there a way to do this? Such built-in feature would be very useful when migrating large number of users. It would help to monitor the progress of the migration and remind the users with not activated tokens to perform actions. Thank you in advance.

Hi, everyone. I'm trying to set up RADIUS authentication for FortiClient VPN connections towards two windows domain controllers. I have two of them - the BDC is on premise and the PDC is in AWS (connected through a VPN tunnel). The connection towards the BDC is fine. This is the primary authentication server. When trying to test the connection from the Fortigate towards the AWS instance, I see that the connection is made from the tunnel interface IP. The connection fails, because I have not created any routing and security group inbound rules for the interface IPs in AWS. Is there any way to make the Fortigate make the RADIUS request from the LAN interface IP? That would make the rules much simpler. Regards,Chocolate Eater

Hello Team, Please is it possible fortimail accepts and sends mail from a sender with more than 1 SPF Record?   Regards,Firdausi Nababa

Two sites are connected to internet with Fortigate 100E. There is a vpn connection between them and the computer belongs to the same windows domain. There is a domain controller on site A and one on site B and both have FSSO Agent installed. On site A domain controller there are lots of error event related to Collector Agent checks on site B computers  . Instead of investigating the specific problem I'm wondering if I have a configuration issue. According to me collector agent on site A should check only computers on site A, not those in site B which are visible through vpn. I think that if I have 10 sites with lots of computers every agent should check only the computers in its lan, not all the remote ones. Are there some guidelines for the correct configuration in scenarios like this one ? 

Hi.  Please be gentle - just a preacher here.  We are updating our school church wifi and have FAP433s and 431s.  I need to mount one or other on a wall in the church sanctuary about 8 feet high cause it is the only space available.  I know nothing about the antenna'd 433's - how to point them or such.  Am I best going with one of them, though unsightly, to best cover the space rather than a down pointing 431.  Thanks for any guidance anyone can offer.

Hey everyone, First of all, we've search for our problem on the forum but even if there were posts about it, we couldn't find any solution. We're facing a problem right now regarding the VPN of our company. Our devices :- 2 x Fortigate 100F (HA) in HQ with 7.0.1 Firmware.- 1x FortiGate VM64-AZURE on Azure with 6.4.8 Firmware.- Forticlient VPN for remote users. At the moment we have SSL and IPSec remote connections to HQ for remote users and everything works fine.When we've added a platform on Azure Cloud as you can see on the topology below, we created an IPSec site to site VPN.  It's working fine for the users on the LAN and we've modified the firewall configuration for the SSL VPN so the remote users can access the Azure Cloud.The problem is that we don't know how to do the same with the IPSec remote users as when we configure the remote IPSec tunnel, we can't chose the VPN (Azure) interface, only local interfaces can be added.We've kind of replicated th

Hello, my friend.  We did the site to side between FG-100D(6.2.9) and FG-60F(6.2.9).The tunnel is up right now, but found lots of record about IPsec SA negotiate Events on 100D.I have disable the npu-offload on 60F, but the issues still happen, is there any other way we can do on it?Any help and advice would be much appreciated. VPN EVENT: dadate=2022-09-29 time=09:31:40 logid="0101037135" type="event" subtype="vpn" level="notice" vd="VDOM-Colo" eventtime=1664415100710345489 tz="+0800" logdesc="IPsec phase 2 SA deleted" msg="delete IPsec phase 2 SA" action="delete_ipsec_sa" remip=172.31.xx.xx locip=172.31.xx.xx remport=500 locport=500 outintf="port1" cookies="6a8ebfd24352f97c/a789ee80bedabfad" user="N/A" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="to-XXXXXXX" in_spi="14f35b6d" out_spi="ca30663d" date=2022-09-29 time=09:31:37 logid="0101037122" type="event" subtype="vpn" level="notice" vd="VDOM-Colo" eventtime=1664415097318

Could you please provide a document or some information related to the following:How does the HA traffic works when we have deploy the firewall cluster in Active/Standby mode with load balancing using Virtualized clustering in multi VDOM Environment.For Example ::Virtual Cluster 1VDOMA , VDOM B , VDOM C, rootVirtual Cluster 2VDOM D ,VDOM E , VDOM FAs the IP address is going to be the same , on what basis the traffic load balancing would take place.

 Hello, is it posible to connect Fortimail  to more than one LDAP domain?

Hello Community, I continue my research on advpn and bgp. I would like to enable ibgp multipath so I can add SDWAN rules and split traffic based on link health for branches.Before the multipath modification, the routes were well learned by my branches, when I activate either ISP on my HUB.But after applying multipath configuration in HUB and Branches. Only hub routes are visible in route table database for my branches. The route are received by the bgp protocol from neighbor. I can not use the new feature self-healing because i have 2 branches with 6.4 version. I have the same topology as multipath link, but with two tunnel for my branches.Source multipath : Multipath doc fortinet  Thanks for your help, you can found below config and info bgp. Julien>>>Config HUB bgp config router bgpset as 65505set router-id 1.1.1.1set ibgp-multipath enableset additional-path enableset additional-path-select 2config neighbor-groupedit "advpn"set capability-defaul