Solved

Good morning, My question is probably more of theory nature: Our customer is using Proxy IP telephony provider. For that we had to configure Custom Service to communicate with the provider. Recently our customer started receiving multiple spam calls directly to their softphones. Together with Fortigate support we found a misconfiguration in the Custom service /firewall policy pair and spam calls have stopped.  Before that, I could see a lot of connected sessions to the ports used by telephony service providers from the attacking IP's random ports. Now, I don't see those any more. BUT when I start a sniffer, I still see packets from same IP with SIP INVITES hitting my external interface: the output looks like this:  I am not good in interpreting the sniffer data yet so I am not sure of what I am I looking at. Since the Forti View session does not show any sessions established from these IP's, and there is nothing on the external ports from the sniffer data,

Hi, I have a FortiGate 60E and created a VPN using IPSec Wizard (Remote Access, Windows Native, L2TP/IPSec with Pre-shared Key). The incoming and outgoing policies have NAT enabled (Use Outgoing Interface Address). I am able to connect to VPN from home but when I try to connect a 2nd computer to VPN, it will either fail or kick the 1st computer from VPN. However, if I try to connect the 2 computers to different VPN destinations, there is no problem. So, this only happens when connecting both computers to the same VPN destination. May I know how can I troubleshoot this? Thanks

It started 24 hrs ago - I get this critical warning every 15 minutes... It appears that all customers with 7.2.0 or 7.2.1 firmware are getting the warning. Devices model are FG60F, FG60E and FG80F. Customers with 7.0.0 and 7.0.6 are fine.  

Hello, I am new to Fortinet and setting up a Fortinet firewall VM in EVE-NG. With below setup, I am not able to ping from INSIDE_R1 to OUTSIDE_R2. Topology:INSIDE_R1 --- (port 2)-Fortinet Firewall-(port 3) --- OUTSIDE_R210.0.0.2/24     10.0.0.1/24                    20.0.0.1/24        20.0.0.2/24 Fortinet VM: Version 7.2.0 with eval license Firewall policy is to allow All source coming into Port2 toward All destination and get out of Port3, for all services, all the time. NAT is also enabled to use the outgoing interface address. INSIDE_R1 has a default route pointing to firewall inside interface IP, 10.0.0.1. INSIDE_R1 can ping firewall's inside IP 10.0.0.1 and outside IP 20.0.0.2. Firewall can ping OUTSIDE_R2's IP of 20.0.0.2. However, INSIDE_R1 cannot ping OUTSIDE_R2's IP of 20.0.0.2. OUTSIDE_R2 does not get any packets from INSIDE_R1 based on its debug output

I have a Fortigate 100e, I was looking at the VPN log and saw some odd entries: date=2022-08-24 time=15:31:23 eventtime=1661380284231585110 tz="-0700" logid="0101040019" type="event" subtype="vpn" level="information" vd="root" logdesc="L2TP client disconnected" action="disconnect" status="success" msg="Client 154.89.5.116 control connection (id 1) finished" There's a bunch of entries that show this "disconnect"  but there are no messages saying there is a connection. such as "Action=Connect" or "msg=..Started" has anyone seen this before? does anyone know what this means (in big picture).  am I in danger?

Hi, I would route internet access throug a vpn ipsec for one of my customer, but i'v figured out that if i'll do this like this: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Remote-browsing-over-IPSec-VPN-tunnel/ta-p/190719 All of internet will be route throught the VPN of this customer. I try with vrf but my version 6.0.9 only support vrf for blackhole. How can i do this ? Thank for your reply

I'm enabling IKEv2 digital signatures with rsa-pss on a FortiGate VPN Gateway: config vpn ipsec phase1-interface    edit "xyz"        ...       set digital-signature-auth enable       set signature-hash-alg sha1 sha2-256 sha2-384       set rsa-signature-format pss    nextendWhen the peer sends an client certificate and an IKEv2 AUTH payload with an RSA-PSS SHA1 signature then everything works well: ike 0:dbmas:187: certificate validation succeededike 0:dbmas:187: signature verification succeeded using rsassa-pss-with-empty-params, oid=1.2.840.113549.1.1.10ike 0:dbmas:187: auth verify doneike 0:dbmas:187: responder AUTH continuationike 0:dbmas:187: authentication succeededWhen the IKEv2 AUTH payload contains an RSA-PSS SHA2-256 signature with a default salt size of 32 bytes then the following error occurs: ike 0:dbmas:190: certificate validation succeededike 0:dbmas:190: si

Hello there, I've got Fortigate device with following configuration:- wan1: Internet- port1: LAN (vlans) Now I'd like to connect another ISP to wan2 and new LAN (new network) to port 2.Is this should all works? I never do this so I wonder if it works in that way. Thank you in advance.AErot

Hello! I apologize if this is answered elsewhere, and would appreciate being pointed in that direction if so as I don't mean to waste anyone's time--I've spent quit a few hours now trying to figure out best practice for what I'm trying to accomplish and it seems most discussions are just a hair different that makes me go down a rabbit hole only to ultimately not make it work.  I learn a lot, but it doesn't seem to fit quite right. I would like to use a FG 81E to drop between an ISP switch and Unifi ES24 to not only handle our LAN (Unifi Wifi Campus off the ES24) but also handle fiber coming from a nearby junction box that will have a tenant on each fiber crossover (adapter) to one of the ethernet interfaces.  These tenants will potentially want their own unique public IP.  So, ideally, each interface would be configured to be it's own public IP from a /27 provided by the ISP.  The incoming ISP interface (the shared WAN1) will also be on this /27, as w

Lastest version 6.0.0.0067, win10pro PC all updated ,no antivirus , nothing special , everything works on other 100+ PCs. The screen goes blank right after starting the console with just a help option in the right corner. Tried reinsalling ,delete folder, registry entries. Anything else to try ? see pic attachment      

Currently we're having a problem on checking/monitoring specific packets from each policies. After checking out the cookbook on Fortinet, I found out that there was a application tab under FortiView. Problem is it shows that there's outgoing packets but when I click to check more details there's nothing displayed at the Application tab.Has anyone else encountered this problem or any suggestion on how to fix it or an alternative way on checking the packets from each policies.Thank you in advance.

Hi,which are the parts of the configuration that the fortigate does not synchronize in the HA Active-Passive?for example, are the ip of the interfaces synchronized? Thanks

Need help!Out of the 5 lan ports on 40C I am looking to configure  Port 1,2 and3 as a part of a Hardware Switch and also Port 4 and 5 as another Hardware Switch.Can someone guide me through this??  

This is a Fortigate 80F in mid-stages of configuration.In Network/Interfaces, I see:LAN(1) Internal Hardware Switch    Type Hardware Switch  Members Internal-1>Internal-6 Internal-1 has an IP/Netmask which I presume applies to 1-6.WAN(2) hasFGWAN1(wan1)  Physical Interface with an IP addresswan1                     Physical interface with 00.0.0./0.0.0.0 Now, I am planning to set up a 2nd WAN interface but not yet.In the meantime, I want to set up an EXTERNAL ZONE with wan1 and wan2 but only wan2 is available it seems.   <<<So that's really the issue.In the end, I should think there would be:wan1 with an IP addresswan2 with a separate IP addressand an EXTERNAL ZONE with both of them in the zone.  

Hello, I made a txt file for Threat Feed as belowI wrote '#" for commentPaloalto can ignore some characters like '#' and recognize comment.Howerver Fortinet can't ignore "#" and then recognize invalid.Can you let me know how to use comment? 

Hi guys , new here :).Hope im posting at the right place. I did some changes in my home network yesterday. Ive changed the Tplink WD9970 Router to bridge mode and setup my fortigate as PPPoe . Everything was fine , there was internet , Wifi etc. But since then my Smart tv started giving me errors when trying to open Netflix , LG AppStore etc. What is more strange is when i open the Internet explorer app i can browse it and everthing seems to be fine. At the tv Network setting everything seems to be fine also. Any help guys? ty.

Hi,I have 2 new FortiGate 100F in production. When one authorized user logs into the first FortiGate 100F i get an email notification and same when he logs out.I tried to configure same on the second unit but could not see where do do that.Any help will be much appreciated. ThanksTazio

Hi. Please help me.Fortigate 60E-POE. FortiOS 7.2.1Legacy client (802.11 g) can't connect to SSID with error: "deny assoc request, ht rate set mismatch" Debug log from AP:[32770.007364] [AUTH] cpu0 vap-00(wlan00): [dc:f5:05:89:af:53] recv auth frame with algorithm 0 seq 1[32770.007387] [469.990] cpu0 wmi_unified_cmd_send: dev=wifi0 cmd_id=0x9022(WMI_PEER_CREATE_CMDID) if_id=0 vap=wlan00 peer_macaddr=dc:f5:05:89:af:53[32770.007426] [CWD_VOICE] cpu0 vap-00(wlan00): ieee80211_admctl_init dc:f5:05:89:af:53[32770.007444] [ASSOC] cpu0 vap-00(wlan00): [dc:f5:05:89:af:53] ieee80211_alloc_node: vap=0xc7330000, nodecount=8, ni=0xc58b3000 ref=2, ni_bss_node=0xc58b3000 bss_ref=2[32770.007468] wsev: cmd=0x8C02 ev_len=28 skb_len=76 nlmsg(len=76,type=16,flags=0,seq=26647,pid=0) extra=Ьх‰ЇStЙ[32770.007486] wsev: cmd=0x8C02 ev_len=12 skb_len=60 nlmsg(len=60,type=16,flags=0,seq=26648,pid=0) extra=Ьх‰ЇStЙ[32770.007501] [AUTH] cpu0 vap-00(wlan00): [dc:f5:05:89:af:53] send auth frame seq 2 sta

Hi,This is my first post here.Just migrated from Meraki to FortiGate.In Meraki we had the option to see all users who are connected to the network, is there a way to see same here on FortiGate 100F ThanksTazio

Hi All, I have setup an IPsec VPN to Azure VWAN based on the FortiNet Cookbook article. Cookbook | FortiGate / FortiOS 6.2.11 | Fortinet Documentation Library It is working, and BGP is Advertising routes from the Internal LAN to Azure and vice versa. My problem is that, when connecting to the FortiGate using the SSL VPN, I cannot use services hosted in Azure. Azure does not have a route back to my VPN IP range. I assume this is because the VPN pool is not considered an Internal Network. I think the way to solve this is to create a new VLAN on the LAN side (which will be advertised via BGP) and use NAT from the VPN Pool to the LAN network. Is this the correct approach to solve this problem? If so, could someone point me in the correct direction as to how to do this? Regards,Rob.

Hi everyone !  I tried the last version of FortiClient (7.0.6) and it seems this version has an important bug ! I use on_os_start_connect. When my computer boots and I'm landing on login screen, I have a command window who appears for a while and execute update_task.exe :  If I rollback to version 7.0.5, all works fine. Someone knows what's that ? Is it a bug or an expected behavior ? Thanks   

I have multiple virtual machines each hosting a web service and I have only one static public IP address. My FortiGate is FG-60F. I have multiple domain names that point to one public IP address. Is it possible to route the http traffic to my virtual machines based on the domain name?

I have multiple internal subnets which are all internally routed so that each subnet can reach all the others.  There is a Fortigate 6.4.9 to be accessing public addresses as usual and is connected to one of the internal subnets: subnet 1.  It is the default gateway for all of the hosts on the multiple subnets.For example,host at subnet 2 has destination on some public address.The internal routing sends the packet sourced on subnet 2 to the Fortigate internal address on subnet 1. How are the other subnets best included in the Fortigate settings?For example: I might want to set up an Address Group called INNER.And, an Address range or Group for each of the subnets that would be included in INNER.Does that make sense?Where is the interface on the Fortigate to be entered in this case?  

It is possible to predict TCP/IP Initial Sequence Numbers for the remote host.The remote host has predictable TCP sequence numbers.An attacker may use this flaw to establish spoofed TCP connections to this host.How does fortigate mitigate this? FortiGate 

Hi I need to configure DHCP on 201F , I have more than 300 users, what is best way (range , subnet )and how to do that ? Thanks