Solved

Hi,a few days before, we made the Update 6.4.8 to 6.4.9. After this, the FG can't resolve any Hostnames.Ping with FQDN on FG CLI says "unable to resolve hostname". All rules that use FQDN doesn't work anymore. If I ping the IP-Address the FG is working fine. He also can ping the DNS. We didn't change any other configuration on the FG.Only thing I did after Update was this, cause I couldn't reach the GUI: "set admin-server-cert Fortinet_Factory"FG has configured the same DNS like every client in the network and all clients working fine!It is a FG100F. There is nothing special configured: In DNS-Settings there is only our DNS-Server / DC set with it's IP. I don't know what to do anymore. I tried to contact the support but for every answer they take about 2 days. I hope the FG community can help a little faster.

Dear Team,Is it supported FSSO to poll user-id mapping to FortiGate Firewall from Horizon RDSH servers?  Multiple users will have the same IP address while using RDSH.     

Hi all, I have implement Forticlient VPN with Azure SSO, and all seems to be working well. However I cant resolve hostnames, unless I specify the full suffix i.e. http://webserver.mycompany.lan, whereas on laptops / desktops I can reach it with http://webserver.  Is there something different with how mobile devices do DNS? I found the following tech doc, which outlines updating "set dns-suffix" https://docs.fortinet.com/document/forticlient/7.0.0/ios-administration-guide/597536/features I just dont want to impact anything thats currently working. We have a lot of VPN clients. Thanks.

Hi, I am trying to enable a newly created read only IPS profile on all FW policies. Is there a simple way to do this on the GUI, or would I have to script it into the policy config file? I can also see there is a CLI command "config ips global". Would this be an option for my requirements? Are there any potential drawbacks here?  Thanks.

Hi, I’ve been trying to configure a policy in Fortimail cloud that deliver mails from specific sender’s domain or specific mail sender to a specific internal mail account but I can’t figure how :(I want, for example, that all mails from example@gmail.com be delivered to example@internal.comThanks in advance

hello, how to run a single line command?example: config sys interface | edit port1 | full show

Hello everyone, I would like to performe an authentication in wifi WPA2 Enterprise environment, not with a Radius server but directly to LDAP server ( a OPEN LDAP ). I create a local group with LDAP server but not working . In an article in the 2011 told that was impossible cause the WPA2 Enterprise protocol with Windows AD LDAP but was right for OPEN LDAP ( https://community.fortinet.com/t5/FortiAP/Technical-Tip-FortiOS-LDAP-and-WiFi-WPA-WPA2-enterprise-security/ta-p/192530?cmd=displayKC&dialogID=41242937&docType=kc&docTypeID=DT_KCARTICLE_1_1&externalId=FD33251&sliceId=1&stateId=0%200%2041244958 ) I have another SSID that works with WINDOWS AD LDAP but in a Radius Server install in a Network Policy Server on a Windows Server.I have also a FortiAuthenticator and I use it to performe an authentication trought Radius Server ( FAC ) and the LDAP but also not working.Someone have any idea? Thank you guys Fabio 

I'm testing the FortiClient VPN app V6.4.3.0462 on Android. When I login to the VPN, I get a pop-up warning that the site's certificate is untrusted. According to the FortiClient Android Administration Guide (https://docs.fortinet.com...onnecting-to-the-vpn), it should give the option to Proceed, Cancel or Import Certificate. On my Android, I only see Cancel and Proceed.  (See screenshot attached.) If I proceed, disconnect and reconnect, I get the same message. So, is there another way to import the certificate? Kind regards, Herta

Dear community, I've used FortiGate for a long time now. The newer versions don't seem to store my Firewall policy columns on the table the way I need.  I always add the ID column to the table and drag it to the first column. But every time I log out and come back in the table resets. I need to fix the columns and the positions of the Policy GUI page permanently. What are the solutions? Thanks in advance,Manul De Silva

I try to configure SNMP traps for FortiADC. I don't find "Alert" under "System" in GUI. I used "config system alert-snmp-trap" but no traps are received on FortiSIEM. Is there an extra configuration required?SNMP Community is configured and worked in the discovery of FortiSIEM. Also SNMP filter is configured.

Hello allI hope you are fine and safe . I have two different public IPs from ISP I want to setup SSL vpn on both IPs on the device the default route is now going to ISP one take in mind there is policy route for network towards ISP two for some of users so how could make the device response from ISP Two interface and ISP one interface for SSL VPN Bests

I am trying to place two FortiGate 40F (OS 6.4.8) devices in HA, but I cannot achieve synchronization between the devices, despite the fact that the modifications that I am making in one of the FGs are replicated in the other.Regarding physical connectivity, they only have the WAN connection to a switch that is connected to a router. Heartbeat port is LAN 3.Regarding the front LED witnesses, it strikes me that in one of the two devices (the secondary) the Speed LED of the Heartbeat interface does not light upWhen I configure both FGs, if I keep the Heartbeat cable connected, I am only allowed to access the configuration of the primary from its management interface, being impossible to access the configuration of the secondary from its respective management interface.In the HA menu, keep the secondary as out of sync.The configuration of the interfaces on HA FG 1 (the primary) is:And the HA configuration on the primary FG is as follows:Regarding the second, the configuration (which I can

Helo everyone,Since yesterday, I cant see any log on the Fortigate (On friday, 3-4 days ago, it was working). I tryed through CLI and GUI. When I tryed in the web interface, the firewall starts searching for logs but it shows:  The severity of the logs is set as Information: config log memory filterset severity informationset forward-traffic enableset local-traffic enableset multicast-traffic enableset sniffer-traffic enableset anomaly enableset voip enableset filter ''set filter-type includeend I read that maybe reformatting the flash disk it get solved, but I would like to confirm it and know if someone suffered this problem before. The firewall is an Fortigate 601E with v6.4.8 firmware version. I hope someone could give some advice.Thank you in advance!

Hi,  In my scenario, I have one branch and one hub. My proxy server is on the Hub side. End client in branch uses proxy server for internet access. At branch, I want to do internet application steering between two links. Since I am using proxy server for internet access, whether application sensor can detect the application and do traffic steering or this traffic cant be detected with actual application (Example - Gmail) instead it detects this as proxy.http application.  Any one has come across this situation and what is the solution to do application based steering in the proxy server scenario. (This is SDWAN Hub and spoke solution)RegardsRaja

Dear All, I would like to know if during the hello-holddown's 'hello state' there is forwarding traffic, or it only happens after this timer reaches the working state. (the name 'working' suggests there is no forwarding (only ha) before it and it measured in seconds with the lowest value of 5).So the failover switching time from the perception to the public traffic again will be something like this (in worst case the failure happens just right after a heartbeat packet):hb-interval(def 200ms) * hb-lost-threshold (def. 6) + hello-holddown( def. 20sec) = 21,2 sec And in case of a fortigate 600E changing the values to the lowest possible one, it can be decreased to 100ms*1+5 = 5,1sec ?Could you please tell me if I am right? Thank you 

I have configured in my firewall different tunnel GRE all managed by PIM dense mode. I would like to enable PIM only for some specific tunnel GRE and let the other use the normal delivery of multicast without PIM (forward enable).  I tried to do that but when enable PIM multicast also the other tunnel GRE without multicast PIM do not deliver the multicast packet.How can I create a mixed environment tunnell GRE with PIM and GRE without PIM to deliver multicast packet? Do you believe that using different VDOM this is possible? At the moment it seems that if I enable PIM multicast routing all the firewall has to be manage  with PIM, I cant use different interface for this. I have a firewall Fortigate 600e with 6.4.7 build 1911 firmware.

Hi Everyone,  We have an issue with our Forticlient SSL-VPN on LINUX (multiple flavours, redhat, centOS and Oracle) when connected to any standard WIFI, the VPN connection stops receiving packets for some time generally around 40secs to 2mins, then packets start to come through again. After about 2 or 3 time after dropping or delaying the receive packets it just disconnects from the VPN, I am saying delayed as I have a ping setup to a workstation which doesn't drop pings, the time just spans out to 10000ms for about 10-20pings then returns to normal after the packets start coming through again.So same machines connected to a mobile hotspot using the same WIFI adapter, connected to the same VPN with the same config and they connect perfectly, no drop-outs/dropped packets or delays in receiving packets. Works as it shouldLINUX Version 8Forticlient VPN - 7.0.0.0018SSL-VPN with no client certSplit tunnel ConnectionAnyone else having a similar issue, there aren't too many settings

Hi all,  i am having 2 Fortigates, FW1 and FW2 connected via IPSec VPN and on both sides i have a client network, in this client network the management web interface is activated, now i want to access from the client network on FW1 the webinterface of the FW2  on the client interface, is this possible?(The Client Networks are on both sides in the trusted hosts) best regardsfohe

Hello, I would like to have a command that can retrieve the following information: password policy, http, https, telnet, ssh, snmp v3, default account, updated, OS version, ntp, anti spoofing, syslog, statefull 

Hello!I want to implement Decrypted Traffic Mirror feature but I haven't seen a Fortinet document that would explain the Destination MAC meaning. What is it?1a. The MAC for the webserver whose decrypted traffic will be mirrored?1b. The MAC for the capturing server which captures the decrypted SSL traffic? It is more likely this case because the same GUI window also needs a port to send the decrypted traffic to.2. If the given example with ff:ff:ff:ff:ff:ff works for all cases then what is the meaning of those f's? Is it a filter or exact-match value? What changes when I replace that part with ff:ff:ff:ff:ff:f0 or any other real value? I guess that depends on the answer from the first question. Why isn't there an IP-address instead, whichever case it is (1a or 1b)? Is there anything to do with mirroring the traffic to multiple servers and all f's send this traffic to all servers behind the physical/virtual port?

Hi, I have a Fortigate firewall managed by Fortimanager, and I built a VPN directly on the firewall, rather than using the Fortimanager VPN manager tool. When I tried to import the updated FGT config into the Fortimanager, There is an issue with ADOM / FGT compatability. ADOM is version 7.0, and the FGT is 6.4.6. (Im not in a position to upgrade FGT for now). I can push a policy OK. So basically without being able to sync my changes to the FGM, any policy push, is going to overwrite and wipe the VPN. Can anyone advise if its possible to take the VPN config, routes, policy etc from FGT.. and copy them in via CLI or script on the Fortimanager? Or is it just a matter of redoing the VPN via FGM VPN manager tool? The VPN is in production now, so id prefer not impact things if at all possible.

Hi, My company is currently carrying out external pen testing on our servers and it was found out the nmap scan was blocked by FortiGate UTM. Is it possible to whitelist the IP addresses used by the pen testers? If possible, where should I whitelist those ip addresses?  Thank you.

Hi Guys , I have strange issue here. I lost all mgmt access both from WAN and LAN after changing the https and http mgmt port to 8443 and 8080. I can only ping the interfaces. So i consoled in and reverted the changes back to port 443 and 80. But still no luck of access. What do check now in CLI, i can paste cli output here if needed. Thanks Jimmy

Hi all, we have a 500e Fortigate an after the update to firmware v6.0.3 we see very high cpu usage if we click to vpn -> ipsec tunnels. We had round about 900 active vpn tunnels and before v6.0.3 there was no high cpu usage if we click.  On the left side you can see the normal usage and on the right side the usage if we click on vpn -> ipsec tunnels Is there a solution for that or a BUG? Thanks

Hi hoping someone can help me understand how to correct this issue. Replacing some Cisco routers with Fortigate firewalls and have been testing the OS in a lab environment. I have a lot of redundancy setup and everything is almost working 100% except the primary FW keeps failing back to the secondary. If I shutdown the HB link it will switch back but the second it is enable again it fails over to the secondary. If I restart the devices this does not happen until I manually trigger my link-monitor to fail in which case it switches to the secondary but from that point on is stuck. See the screen shots below for the cause of this - Not sure why the pingsvr_failure stays at 50 or if there is a way to reset it. It gets to 50 because I manually shutdown the link to test the failover - but from that point on it is always at 50 so it essentially gets stuck on the other FW no matter what until a power cycle. Thanks for the help!Ryan