Solved

We have a 3rd party who uses AWS for their VPNwe have a Fortigate 601EThe configuration we received from AWS is using BGP, I tried configuring but will not come up.I think the problem is with the provided local and remote addresses. Inside IP Addresses- Customer Gateway : 169.254.170.166/30- Virtual Private Gateway : 169.254.170.165/30In Phase 2 selectors when  I try and eter the above,it comes back with169.254.170.164/30 for bothand the tunnel will not come up.If I change the Ip addresses to normal subnets, that reside at local and remote, the tunnel comes up, but of course it wont pass any traffic 

Hello Guys, I have configured this network in my laboratory(Please see the photo) . I have two Fortigate 7.2 and both Fortigates are connected through a Site-To-Site VPN Tunnel(I created by IPSEC Wizard) and also I have configured SSL VPN Tunnel mode and my remote user is connected to Fortigate 1 with Public IP 1.1.1.1, now the problem is that Remote VPN user can only see the Client 1 and cannot see the Client 2, what can be issue? or do you have any training material for this topology? Thanks in advanced,Ali 

We created a REST API Administrator on a FortiGate 80E (6.4.6) to monitor certain access point data.  The programmer trying to make this work has requested the following: "We need the proper syntax for a remote server making a REST API call to retrieve an active list of devices (by mac address) from the Fortinet controller.  Some systems call this a “presence API” call." I hope that makes sense.  Can anyone help? Thank you!!

We are trying to add objects to backup file and import onto the firewall when ever we need make changes into the firewall config. There we see a field of UUID which was existing for all the other objects. So when ever we add a new object to config, should we need to add a random unique UUID to the object or will the firewall create the UUID for the object that we create in config file

Dear TAC,I registered the FortiManager Trial for lab demo, and I have FortiGate VM trial, so I can't add Fortigate VM into FortiManager. Please help me and give me a solution for this issue.I tried follow this guide, but still not working:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Getting-error-Probe-Failed-message-while-adding/ta-p/197318 Thank you.

Hi, I'd like to be able to inspect within normal DNS requests passing firewall and find the record they are trying to query. For instance, clients goes to query DNS record for google.com and this request passes firewall policies. I want to know which is the destination address queried (here, google.com) Is that possible with FortiOS? Regards, 

Does anyone know how I can see the last given DHCP lease? I have a device that supposedly grabs a DHCP address but the vendor says he does not know a mac address nor hostname and trying to get the user to trace the cable and give me the switch info will be a nightmare. So my question is, if I get the user to plug and unplug the device, is there a way to see the device getting a DHCP lease in the fortigate? Either Web or CLI would be fine.

Hi All,We have two Fortinet firewall currently configured HA between them. We are planning to configure VRRP in order to have L3 redundancy, My question can we have HA and VRRP together? Thank you,Sr

Hello team!!! I am just starting with automatic backups, I am looking for a way to send automatically backups to any of the following:* Cloud storage* Shared folder on the internal network (SMB)* Email* Any other suggested desination but FTP, SFTP nor TFTP The only way I found is to any kind of FTP Server, but I dont want to create a FTP Server just for a Fortigate backup.I could modify the stitch for FTP to send an email but I dont know how to attach the backup file to it. Any idea?Thanks in advance.Regards,Damián

Last night one of FWF60Es' upgrade process for 6.0.10->6.2.7->6.2.9 caused the device to be offline in the first step (judged based on saved config revisions). Likely the first reboot got stuck and can't come up with 6.2.7 since the public IP on wan1 interface is not reachable.We're hoping it would come back up after a power-cycled in Mon morning by the customer, but we don't want to get the upgrade process resumed for obvious reason. The customer would experience extended outage in busy Mon morning. I'm looking for a way to suspend the upgrade process at the point with 6.2.7. Then want to resume it at Mon night. I so far couldn't find a menu to do it in Firmware page on the FMG. Is this possible? Thanks,  Toshi

Hello,there is a need to extract the details of all configured policies with the details of when they were used.We managed via FortiGate  / FortiManager  to export the info but for all policies the fields after Hit count in the image below (first used, last used, etc...) are all emptyIs it not possible to export that information even if it is present?

Hello Everyone.   So, I'm managing a client's Azure deployed fortigate, which has some local-in policies i'd like to get rid off, so it won't accept connections on a specific interface.   The problem is that the local in policies are not editable via gui, and via cli they don't even show. I can create new ones and all but, I would really like to simply delete the ones i don't need.   Even on a show full-config output the local in policies dont appear.   Anyone know how to delete these policies?   #fortigate

Hello, I hope that someone can give some explination about my issue. some rules in the Fortimanager have 0 Hit Count but I have a date in the colum Last Used, how can to explain that? Can someone explain that to me please? or it's just a bug? Thank you 

Hi,On one of my 200E firewalls, after some time, logging to memory does not show anything but after restarting the device it comes up and working. Any way to troubleshoot and solve the problem? Regards,

Hello, I can't find an answer to this question anywhere; what exactly does FMG-Access mean? Thanks!

We have many customers who have an IPsec VPN from customer's each location with an FGT/FWFrouted all internet traffic over the VPN toward the customers centralized FW VDOM in our core network.We manage some of larger customer's CPE FGTs/FWFs by our FMG-VM so that firmware upgrade for those CPE's can be done through the FMG relatively easily. A problem with this arrangement is all firmware download for the upgrades have to come through the centralized FW VDOM so it gets congested and takes longer time due to the distance to travel when we run upgrades for many locations at the same time even if we specify FMG to let the device directly download from FortiGuard services. An obvious solution is to split the tunnel to let the CPE devices get to FortiGuard servers outside the tunnel. So I opened a TAC case to ask what FQDNs I need to set static routes to go outside the tunnel while the default route (BGP) comes over the tunnel. I initially got three FQDNs euupdate.fortinet.ne

Hi, We are switching our firewall to Fortigate and will be using SSLVPN with local users.Is there a way to mass create users or import it from a csv ? Thanks

Hello I'm a newby with Fortimanager and I'm having issues when having to make changes on managed fortiswitches.I have fortiswitch "central management tick" untiked for my ADOM.If I have to make a change on a FSW port (name it asign a vlan or change a description), I go Fortiswitch Manager / Fortigate / Fortiswitch / Ports Configuration and edit the port that I need. After I have made my changes, are those supposed to be automatically deployed to the Fortigate and so to the Fortiswtich?Do I have to run the install wizard? my point here is that install wizard could deploy several other changes + the ones that I need for my switches? Thank you very much in advance. 

Hello everyone, is there a command to manually send an ARP request for a specific IP on a local interface? What I'm looking for is a functionality much like the 'arping' tool on Linux. My usecase is determining whether there is a duplicate IP on a directly connected network. Kind regards,Lupo

Example 1 works fine.  Example 2 fails with a 403 status code.  RestAPI Admin account is a super_admin with access to Global.  debug cli on Fortigate shows no communication for 2 but full communication with 1.  Scratching my head on this for a few days now.  The "password" option seems to break it.  These command come off the Fortinet Developer Network 6.2 API page.  There is no password complexity requirements on this Fortigate. Works Ex 1: curl -k -X PUT "https://FORTIGAGE-FQDN-HERE:443/api/v2/cmdb/system/admin/USERNAME-HERE?access_token=ACCESS-TOKEN-HERE" -H  "accept: application/json" -H  "Content-Type: application/x-www-form-urlencoded" -d "{  \"name\": \"USERNAME-HERE\",   \"comments\": \"This is a comment\"}" Fails Ex 2: curl -k -X PUT "https://FORTIGAGE-FQDN-HERE:443/api/v2/cmdb/system/admin/USERNAME-HERE?access_token=ACCESS-TOKEN-HERE" -H  "accept: application/json" -H  "Content-Type: app

Dear all I am new to Firewall Technologies and I want to ask Regardless of statefull Firewall feature. A statefull firewall maintains the tcp state and knows a user session so why do we need to allow a user to allow in both direction incoming and outgoing for same traffic if the state is already known when the user requests the session is known and the firewall knows for the returning also 

Hello.We've configured a custom signature to detect Login Brute Force Attack against SMTP service:F-SBID( --attack_id 9419; --name "SMTP.Login.Brute.Force.Custom"; --protocol tcp; --flow from_server,reversed; --pattern "Authentication failed";--no_case; --context packet; --distance 4,context; --within 40,context; --rate 5,30; --track dst_ip; )It is include into our IPS profile. We're using SSL inspection profile (protection ssl server).That signature works fine for SMTP (port 25) and SMTPS (port 465), but it doesn't work for SMTP submission (port 587, encrypted of course).Anyone has configured a custom signature to protect SMTP submission?Thank you!

I know from the dashboard under license will show as below, but how do i see it from the last few month?Used GB/Day  Today(Jul 20, 2016)0.27 GBJul 19, 20160.61 GBJul 18, 20160.61 GBJul 17, 20160.25 GBJul 16, 20160.26 GBJul 15, 20160.63 GBJul 14, 20160.65 GB

i recently joined a new place and found a network is running on native vlan from fortigate hardware switch interface. i have many ports free on firewall and i want to create vlans for all services and remove the network from native vlan. Can you please guide me how to create vlans in the same hardware switch interface and allow the vlans to communicate with my cisco switch connected to Fortigate.

Hello, We are new to Fortinet products, having just purchased a Fortigate (FG-60F) and setting it up as a VPN site router/firewall, to connect back to our headquarters. We have created the VPN tunnel etc (mostly via the wizard), which sends all traffic from 0.0.0.0/0 to 0.0.0.0/0 down the tunnel. This works as expected, as we wanted all traffic, including internet, to hit our headquarters. The problem is that the Fortigate itself is unable to access any FortiGuard services. We assume this is because its own internet requests are being sent down the tunnel. We have tried to split-tunnel the VPN using policy routing but to no avail. The biggest issue we seem to have is that we are unable to specify the Fortigate itself as a source to exclude from the VPN rules. Can anyone with more experience point us in the right direction? How can we send ALL traffic down the tunnel EXCEPT FortiGate's own update/maintenance requests? Thank you