Solved

Hi, I just upgraded to Catalina on my Mac today and whilst the VPN client connects and notifies me of this I can't connect to anything on my network. No pings, SSH, RDP even HTTP work intranet. I was using the VPN this morning successfully on Mojave (10.14) and other users are connected to the VPN so that end is fine. I am using 2FA with Fortitokens and I do get challenged for the token and this appears to be accepted successfully.Forticlient VPN version is 6.2.1.654, I can't find anything newer. Any ideas?

Hello!I have FortiGate-60E Low-Encryptionhttps://kb.fortinet.com/kb/documentLink.do?externalID=FD37333 I have error:This site can’t provide a secure connectionfortigate.local uses an unsupported protocol.ERR_SSL_VERSION_OR_CIPHER_MISMATCH Hide details Unsupported protocol The client and server don't support a common SSL protocol version or cipher suite.       I saw https://forum.fortinet.com/tm.aspx?m=104586 Is FortiGate-60E Low-Encryption support https WebGUI?

In my FortiGate cloud account when choose to manage my Fortigate in Security Fabric tab I get notification: "Current Firmware Version: v6.4.9, build 1966Device config version v6.2.5, build 1142 (6.2.0 - 6.2.10 compatible) does not match device firmware version v6.4.9, build 1966.You can sync by clicking the Import button if changing device firmware version is not preferred." I make update couple of days ago from 6.4.8 to 6.4.9 but we are not on v6.2.5 for ages, so why it showing this device config version 6.2.5?Should I press IMPORT?It will update FortiGate cloud?It will not have any impact on my working production FortiGate? 

ToIP traffic that is already marked with a DSCP (EF) value will pass through my firewall. I need the firewall to keep that value and not modify it. That keep the same input value as output. On the other hand, I also need you to prioritize it internally. If I don't do any configuration and just let traffic through, I'm not sure if the firewall keeps the value or resets it to zero. Can you help me? "If the differentiated services feature is not enabled, the FortiGate unit treats traffic as if the DSCP value is set to the default (00), and will not change IP packets’ DSCP field."Thank you very much

Hi,in the config router multicast-flow source address field is mandatory? I wish to create static IGMP groups only based on destination multicast addresses and not on source addresses. 

Hello, How can I check my FortiClient version in FortiGate ? I just want to use FortiGate and nothing else. FortiGate Version : 6.5 or 7Is it possible to use FortiClient free edition ?

Hi all, I'm trying out Fortigate VM64-AZURE on Azure. My task is to have it as IPsec VPN terminator which allows authorized clients to connect to some Azure vNets that are in peering with VM64 Vnet. Fortigate is in its own Vnet (call it FwvNet), and clients connect to this vnet without problems, i.e. I've put a test vm in the internal vnet, and clients can ping it, ssh and whatever. I've put in peering FwvNet with another vNet, say AppvNet.From the test machine I can ping VMs on Appvnet, but from the IPsec clients I can't.  What am I missing? Thanks for your help

I have to create a static join to group multicast on my firewall PIM dense enabled,  independently from the  join to group requests coming from the user interface . Which instruction do I have to use ? do you believe that creating static join to multicast groups inside the firewall  interfaces can produce PIM management packets to the remote PIM enabled nodes?

 One firewall in my LAN is configured with PIM dense mode and wish to communicate  with another firewall ( same model Fortigate 600D) but configured with multicast forwarding. Can the first node PIM enabled able to transfer and receive multicast traffic with the  second one? and how? If I set the first one in PIM dense passive mode can I resolve the problem?

Hi,I've to configure an IPSec tunnel between a fortigate VM (local) and a FortiWiFi 40F (remote).Remote site have a network configuration alreday used by another IPSec tunnel so i've to add NAT on this tunnel. Tunnel is UP and configurations seems to be OK, but no packet are received on remote site. Some informations :<Local Networks> : 10.9.0.0/16 ; 10.20.0.0/16<Remote Network> : 192.168.1.0/24<Remote Network with NAT> : 192.168.10.0/24 My configuration :on VM :- IPSEC Tunnel :local address : <Local Networks>Remote Address : <Remote Network with NAT>- Static route :set dst 192.168.10.0 255.255.255.0set device "vpn"- Firewall policy :Accept ALL from <Local Networks> to <Remote Network with NAT> on FortiWiFi- IPSEC Tunnel :local address : <Remote Network with NAT>Remote Address : <Local Networks>- Static route :set dst 10.0.0.0 255.0.0.0set device "vpn"- Firewall policy :config firewall policyedit 1set srcintf "in

Which or how many ports out of the box are set to the default 192.168.1.99/24 ?Is it just the mgmt port, or port 1, or every port except for the HA port.

Hi,What I'm simply looking for is to see logs (detailed and meaningful logs) about Fortigate viruses and attacks detected by rules where IPS and AV are enabled in security profile. For now, with logs on memory (via live GUI or console CLI not using any solution like Fortianalyzer).With logging enabled on an Internet-facing firewall, I expect to see a lot of IPS logs pointing to a specific attack. Also, I expect to see files being blocked by AV engine (A simple test including downloading a sample virus file from Internet will suffice) At the time being, I cannot see any logs in GUI except rules logs. Should I configure any additional settings on logs? use 3rd party and remote logging? enable SSL inspection with custom settings for both outgoing and incoming traffic? or ...... Regards, 

Backup FortigateApós vários desafios consegui resolver o tema com backups para fortigate.Utilizei um ambiente de testes, constituído por uma máquina Linux e uma fortigate VM 7.0.5.Em primeira instância configurei um servidor Linux para correr o serviço do sftp, de seguida garantimos a conectividade entre o servidor sftp com a nossa fortigate. Script -execute backup full-config sftp /home/neto/FGTCCNAFORALL.%%date%%-%%time%%.conf 192.168.88.137:22 neto 12Estou a preparar o video e um pdf com as configurações feitas. Não te esqueças de seguir no meu channel: http://www.youtube.com/ndawedua#ccnaforall    

Hi all, we have a new FortiGate 600E with the Firmware v7.0.6. We configured the "Resolve Hostnames" setting in the Log settings.Now we saw that only the destination ips are getting resolved. Is there any option that we see the hostnames of the source addresses?We have the internal DNS server configured. any ideas?thanks a lot in forward!    

I have established an S2S VPN tunnel from my FortiGate-100F to AWS VPCI can ping from the EC2 to a local device but however, I cannot ping from a local device to my AWS EC2I have already set up a static route and even tried the policy route but still no luck...below is the config I have setMuch appreciate any helpThanks in advance!

Buen dia, tengo un FortiGate 60, quisiera saber si hay alguna version mas reciente, ya que la que tengo es muy vieja. FGT-602906537315 # obtener el estado del sistema Versión: Fortigate-60 3.00,build0754,101027 Virus-DB: 8.00631(2008-01-15 14:27) IPS-DB: 2.00461(2008-01-18 11:23) Número de serie : FGT-602906537315 Versión de BIOS: 04000000 Nombre de host: FGT-602906537315 Punto de bifurcación: 754 MR/Información de parche: MR7 Parche 10 Revise el Upgrade Path Tool Table, pero no arroja el modelo de mi Fortigate,Saludos.

Hello everyone,       I am new into working with firewalls. I took some online classes and learned to do small activities, like filtering trafic from web. But now I face a problem: I need to set-up a DMZ (on a Fortigate E-50) with a particular action - Remote Desktop Gateway.I mention from start that I know how to configure the PCs already, for RD gateway as well. However I am facing issue with the traffic between networks. The setup cannot be changed to a simpler version, you can see the layout attached to this topic.  Host PC: 50.2.2.40/16 Gateway: 50.2.2.100  DMZ PC: 50.4.1.1/24 Gateway: 50.4.1.100  Client PC: 10.10.30.1/24 Gateway 10.10.30.100   Firewall P1: 50.2.2.100/16 Internal Network - configured as Interface/hardware switch  Firewall P2: 50.4.2.100/24 DMZ Network - configured as Interface/hardware switch  Firewall P3: 10.10.30.100/24 External Network - configured as Interface/hardware switch   I am con

Hello,is there a chance to add a Host-Check for Win-Server to block them for VPN Connection? Many thanksTBC

Specific IP not getting internet through the Fortigate 200F firewall but communicating with a local gateway. We have checked the forward traffic logs and found there is send bytes but no received bytes for those IP. We have no bindings or no security profiles in the security policy but still, we are facing this issue. Mention those IPs in using printing service, when changing IP address then getting everything is okay. Those IPs are 10.10.32.94, 10.10.32.52, 10.10.33.34

I thought SSL VPN sessions were synced so I could do the swap stealthy to recover the "Error"ed tokens after a swap over when the cluster was upgraded last night to 6.4.9. I was wrong and all SSL VPN customers are complaining about the drops. All active SSL VPNs seemed to have dropped.Would you expect this, while all IPSec VPNs (I meant site-to-site. We don't have dialup IPsec VPNs) are kept up? Toshi

There are data in several places and several stages. During installation FortiSIEM settings. In Admin>Ssettings, Admin>Device Support, Admin>Setub and CMDB there are changes made. Also, hosts are added to the "hosts" file. How do whole backup FortiSIEM so that I can restore it later?For a minimum, I tried to backup the configuration of the device.I tried to back up the network device configuration and installed software versions from /data/svn. I did not find svn in /the data folder. Also, the database files are stored in"/data/cmdb/data". I did not find the folder in this place. I copied them from another place.I tried to archive the events from the web Admin>Settings>Database, but I did not know which organization should search for.Is there a built-in tool to backup FortiSIEM or do I have to use a backup system like Dell AVAMAR?

Hi, So I configured a managed Fortigate via Fortimanager, what I did was  1. add an address object2. added this address object to a dynamic group For some reason it has been a day and I still don't see the new address object on the managed Fortigate. I do see under Configurations and Installations Config Status: Auto Update checked Not sure how to troubleshoot this Thanks in advanceJeff

Hi all, got one question about downgrade and recovery after failed update in HA cluster (A-P).When update failed and need to downgrade and upload configuration once again the best way for this is to:1. disconnect slave from HA,2. downgrade firmware and config to master3. reconnect HA4. wait for slave to sync? But what when both units failed with updates and need to downgrade also Slave? Only difference is that need also to downgrade slave?In this scenario should I also upload config on slave or only on master and after connecting to HA wait for sync? When making configuration backup notice only got config from Master, is there any scenario I should have config file from Slave?

Hi all, I like to know is there possibility to keep VPN IPSec tunnels up when linked to backup interface (WAN2) and backup ISP.I got FGT60E with WAN1 (1 ISP) and WAN2 (2 ISP - backup), to WAN1 got connected IPSec Tunnel to another FGT, and on WAN2 got connected different IPSec tunnel (needed as backup) to different location.In Static Routes WAN1 has lower distance (8) than WAN2(10) tunnels linked to WAN2 are down, is there possibility to make them always up? Of course WAN2 interface is up.I got enabled Auto-negotiate and Autokey Keep Alive.When WAN1 go down and WAN2 starting to pass traffic tunnels get up and send data with no problem. 

Hi all, FortiManager: v7.2.0 b1124 220411 (GA)Fortifgate 200F (2 devices, HA Cluster Configured) - FortiOS v6.4.8 build1914 (GA) Two Fortigate devices are configured, up and running, A-P HA mode, 2 VDOM. If I add cluster devices to FortiManager using Add Model HA Cluster, devices are visible but almost all configured information are N/A Host Name FG200F*****Serial Number FG200F*****IP Address 10.73.0.1System Time - Fri Jun 17 02:01:41 2022 PDTUptime - N/AFirmware Version - FortiGate 6.4,build1950Hardware Status - N/AOperation Mode -NATVDOM - VDOM Disabled If I try to import configuration it only import default policy section. Device Interface no entry found. Additional information:    If I try to add device using Discover Device, all information are available and update. Import configuration is fine. Any additional information with adding HA devices to FortiManager and import their configuration?  Thanks.  &nbsp