Solved

I'm enabling IKEv2 digital signatures with rsa-pss on a FortiGate VPN Gateway: config vpn ipsec phase1-interface    edit "xyz"        ...       set digital-signature-auth enable       set signature-hash-alg sha1 sha2-256 sha2-384       set rsa-signature-format pss    nextendWhen the peer sends an client certificate and an IKEv2 AUTH payload with an RSA-PSS SHA1 signature then everything works well: ike 0:dbmas:187: certificate validation succeededike 0:dbmas:187: signature verification succeeded using rsassa-pss-with-empty-params, oid=1.2.840.113549.1.1.10ike 0:dbmas:187: auth verify doneike 0:dbmas:187: responder AUTH continuationike 0:dbmas:187: authentication succeededWhen the IKEv2 AUTH payload contains an RSA-PSS SHA2-256 signature with a default salt size of 32 bytes then the following error occurs: ike 0:dbmas:190: certificate validation succeededike 0:dbmas:190: si

Hello there, I've got Fortigate device with following configuration:- wan1: Internet- port1: LAN (vlans) Now I'd like to connect another ISP to wan2 and new LAN (new network) to port 2.Is this should all works? I never do this so I wonder if it works in that way. Thank you in advance.AErot

Hello! I apologize if this is answered elsewhere, and would appreciate being pointed in that direction if so as I don't mean to waste anyone's time--I've spent quit a few hours now trying to figure out best practice for what I'm trying to accomplish and it seems most discussions are just a hair different that makes me go down a rabbit hole only to ultimately not make it work.  I learn a lot, but it doesn't seem to fit quite right. I would like to use a FG 81E to drop between an ISP switch and Unifi ES24 to not only handle our LAN (Unifi Wifi Campus off the ES24) but also handle fiber coming from a nearby junction box that will have a tenant on each fiber crossover (adapter) to one of the ethernet interfaces.  These tenants will potentially want their own unique public IP.  So, ideally, each interface would be configured to be it's own public IP from a /27 provided by the ISP.  The incoming ISP interface (the shared WAN1) will also be on this /27, as w

Lastest version 6.0.0.0067, win10pro PC all updated ,no antivirus , nothing special , everything works on other 100+ PCs. The screen goes blank right after starting the console with just a help option in the right corner. Tried reinsalling ,delete folder, registry entries. Anything else to try ? see pic attachment      

Currently we're having a problem on checking/monitoring specific packets from each policies. After checking out the cookbook on Fortinet, I found out that there was a application tab under FortiView. Problem is it shows that there's outgoing packets but when I click to check more details there's nothing displayed at the Application tab.Has anyone else encountered this problem or any suggestion on how to fix it or an alternative way on checking the packets from each policies.Thank you in advance.

Hi,which are the parts of the configuration that the fortigate does not synchronize in the HA Active-Passive?for example, are the ip of the interfaces synchronized? Thanks

Need help!Out of the 5 lan ports on 40C I am looking to configure  Port 1,2 and3 as a part of a Hardware Switch and also Port 4 and 5 as another Hardware Switch.Can someone guide me through this??  

This is a Fortigate 80F in mid-stages of configuration.In Network/Interfaces, I see:LAN(1) Internal Hardware Switch    Type Hardware Switch  Members Internal-1>Internal-6 Internal-1 has an IP/Netmask which I presume applies to 1-6.WAN(2) hasFGWAN1(wan1)  Physical Interface with an IP addresswan1                     Physical interface with 00.0.0./0.0.0.0 Now, I am planning to set up a 2nd WAN interface but not yet.In the meantime, I want to set up an EXTERNAL ZONE with wan1 and wan2 but only wan2 is available it seems.   <<<So that's really the issue.In the end, I should think there would be:wan1 with an IP addresswan2 with a separate IP addressand an EXTERNAL ZONE with both of them in the zone.  

Hello, I made a txt file for Threat Feed as belowI wrote '#" for commentPaloalto can ignore some characters like '#' and recognize comment.Howerver Fortinet can't ignore "#" and then recognize invalid.Can you let me know how to use comment? 

Hi guys , new here :).Hope im posting at the right place. I did some changes in my home network yesterday. Ive changed the Tplink WD9970 Router to bridge mode and setup my fortigate as PPPoe . Everything was fine , there was internet , Wifi etc. But since then my Smart tv started giving me errors when trying to open Netflix , LG AppStore etc. What is more strange is when i open the Internet explorer app i can browse it and everthing seems to be fine. At the tv Network setting everything seems to be fine also. Any help guys? ty.

Hi,I have 2 new FortiGate 100F in production. When one authorized user logs into the first FortiGate 100F i get an email notification and same when he logs out.I tried to configure same on the second unit but could not see where do do that.Any help will be much appreciated. ThanksTazio

Hi. Please help me.Fortigate 60E-POE. FortiOS 7.2.1Legacy client (802.11 g) can't connect to SSID with error: "deny assoc request, ht rate set mismatch" Debug log from AP:[32770.007364] [AUTH] cpu0 vap-00(wlan00): [dc:f5:05:89:af:53] recv auth frame with algorithm 0 seq 1[32770.007387] [469.990] cpu0 wmi_unified_cmd_send: dev=wifi0 cmd_id=0x9022(WMI_PEER_CREATE_CMDID) if_id=0 vap=wlan00 peer_macaddr=dc:f5:05:89:af:53[32770.007426] [CWD_VOICE] cpu0 vap-00(wlan00): ieee80211_admctl_init dc:f5:05:89:af:53[32770.007444] [ASSOC] cpu0 vap-00(wlan00): [dc:f5:05:89:af:53] ieee80211_alloc_node: vap=0xc7330000, nodecount=8, ni=0xc58b3000 ref=2, ni_bss_node=0xc58b3000 bss_ref=2[32770.007468] wsev: cmd=0x8C02 ev_len=28 skb_len=76 nlmsg(len=76,type=16,flags=0,seq=26647,pid=0) extra=Ьх‰ЇStЙ[32770.007486] wsev: cmd=0x8C02 ev_len=12 skb_len=60 nlmsg(len=60,type=16,flags=0,seq=26648,pid=0) extra=Ьх‰ЇStЙ[32770.007501] [AUTH] cpu0 vap-00(wlan00): [dc:f5:05:89:af:53] send auth frame seq 2 sta

Hi,This is my first post here.Just migrated from Meraki to FortiGate.In Meraki we had the option to see all users who are connected to the network, is there a way to see same here on FortiGate 100F ThanksTazio

Hi All, I have setup an IPsec VPN to Azure VWAN based on the FortiNet Cookbook article. Cookbook | FortiGate / FortiOS 6.2.11 | Fortinet Documentation Library It is working, and BGP is Advertising routes from the Internal LAN to Azure and vice versa. My problem is that, when connecting to the FortiGate using the SSL VPN, I cannot use services hosted in Azure. Azure does not have a route back to my VPN IP range. I assume this is because the VPN pool is not considered an Internal Network. I think the way to solve this is to create a new VLAN on the LAN side (which will be advertised via BGP) and use NAT from the VPN Pool to the LAN network. Is this the correct approach to solve this problem? If so, could someone point me in the correct direction as to how to do this? Regards,Rob.

Hi everyone !  I tried the last version of FortiClient (7.0.6) and it seems this version has an important bug ! I use on_os_start_connect. When my computer boots and I'm landing on login screen, I have a command window who appears for a while and execute update_task.exe :  If I rollback to version 7.0.5, all works fine. Someone knows what's that ? Is it a bug or an expected behavior ? Thanks   

I have multiple virtual machines each hosting a web service and I have only one static public IP address. My FortiGate is FG-60F. I have multiple domain names that point to one public IP address. Is it possible to route the http traffic to my virtual machines based on the domain name?

I have multiple internal subnets which are all internally routed so that each subnet can reach all the others.  There is a Fortigate 6.4.9 to be accessing public addresses as usual and is connected to one of the internal subnets: subnet 1.  It is the default gateway for all of the hosts on the multiple subnets.For example,host at subnet 2 has destination on some public address.The internal routing sends the packet sourced on subnet 2 to the Fortigate internal address on subnet 1. How are the other subnets best included in the Fortigate settings?For example: I might want to set up an Address Group called INNER.And, an Address range or Group for each of the subnets that would be included in INNER.Does that make sense?Where is the interface on the Fortigate to be entered in this case?  

It is possible to predict TCP/IP Initial Sequence Numbers for the remote host.The remote host has predictable TCP sequence numbers.An attacker may use this flaw to establish spoofed TCP connections to this host.How does fortigate mitigate this? FortiGate 

Hi I need to configure DHCP on 201F , I have more than 300 users, what is best way (range , subnet )and how to do that ? Thanks 

Hi, I noticed in the release notes new products :FortiFirewall : FFW-3980E, FFW-4200F, FFW-4400F, FFW-VM64, FFW-VM64-KVM What is the difference between FGT and FFW ? Regards Lucas

FortiGate 30D FortiOS v5.2.3, Build 670I. Some devices on the Lan were blocked by right-clicking on the specific device on the "DHCP Monitor" page. Then selecting "Block"Q. Now, Is there a way to view all the blocked devices and then unblock them?As a newbie, it doesn't seem to be that complicated request but I'm unable to find/view blocked devices.What is the best practice in blocking specific devices in the future?

Is it possible to get a device inventory of a specific subnet using FortiAnalyzer? Can it perhaps be done creating a custom report? -PM

Hi,which interface (LAN, WAN or DMZ) applies with SSL-VPN, to define in the security-fabric? Thanks. 

Hi, I am using one free syslog application , I want to forward this logs to the syslog server  how can I do that Thanks  

I have a created a Firewall Policy to block some URLs, and selected "certificate-Inspection" for SSL. When a client PC tries to access the blocked URLs, I want them to view our custom 'access denied' page but instead Edge/Chrome gives this error page instead. How do i fix this? A step by step instruction would be great.