Solved

Hi ¡¡¡ I have 2 doubts:  1) I have published WEB servers, which are in my DMZ. I have adjusted thresholds and protected them against TCP attacks since they only allow HTTPS traffic. I suppose there is no point in protecting them from other types of attacks DoS (UDP, ICMP etc). On the other hand, my firewall connects to an ISP and receives the public IP on one of its interfaces directly (witouth NAT). Is not the public IP (VIP) to connect to the web servers but is the same internet connection. This interface doesn't have any administrative acces enable (ICMP, HTTP etc are disable). I was wondering if I should protect the interface itself from DoS attacks, but I understand that it is not necessary since I do not have any services enabled. If there is no service enabled, they cannot do a DoS. However, I have monitored the IP of the interface with very low thresholds and if found anomaly alerts come out and I don't understand why it detects them when ports or services that a

Hello,  I have a 100D and I would like to clean installI boot it and got in the configuration menu so now I cannot upload through TFTP Is there a solution? Regards, Konstantinos

Hello,newbie using Fortigate.I created an automation sticth to upload a config backup to an SFTP server. I used the following CLI command execute backup config sftp /path/firewall_backup.cfg SFTP_IP SFTP_user SFTP-password If i run the above "CLI" command manually, file is created using the name I specify (in the example, firewall_backup.cfg) if I run the same command via an automation stitch, filename is prefixed with the fortigate serial number (i.e. it becomes FG123456789_firewall_backup.cfg) Of course such prefix doesn't disturb me, but I would like to understand WHY this prefix... Checked on documentation but since I'm a newbie on fortigate was unable to find the right point.Can someone help me understanding this  behaviour?Thanks in advance

Hi,Trying to evaluate Fortianalyzer, I created a Forticloud account, logged in and downloaded the VM image but as my lab is not able to access Internet, I cannot connect the VM in lab to get the free trial license directly from forticloud. Is there anyway I can download a free trial license file using my account and upload it to my lab VM?Regards, 

FortiNAC is not providing DHCP service for Isolated network via eth1 service interface. How can i resolve this issue?   

i Noticed that the logs on my Fortigate is stuck at 22-April.eg. web filter and email filter logs when viewed from Fortigate Logs and Report and from my FortiAnalyzer latest logs is until 22-April. I cannot see any logs from 23-April to today.How do i check whether my logs is working properly 

Hi, Long story short:I have created CSR on Fortiweb, CSR was signed and cerficate was imported on FortiWeb My question is:Is it possible to export private key and import it to the backend server?  The probilem I see here is:Private key is password encrypted (duh?), but there is no option to specify password during CSR creation, so I guess the password is automatically generated during CSR creation. I tried changing the password in CLI:conf sys cert localedit "cert1"unset passwdset passwd somepasswordendbut I get an error:Command fail. The configuration of a certificate can not be changed from CLI except the comments. Am I missing something here? Or this is just not possible? 

EnvironmentFortiGate 100FV6.2.9 Build 1234 Cloud EMSV6.4.4.1658 Has anyone upgraded from 6.x to 7.x for Cloud EMS? According to support, it just a case of converting the EMS licence.My concerns are as follows:Will this still be compatible with FortiGate (according to the compatibility chart I should be OK)?How will be affect my existing EMS 6.x VPN clients?Should I schedule the convert out of hours (even though this is a licence change)?I presume the EMS console will expose the option to create 7.x FortiClient installers alongside the existing 6.x created installers?Any advice would be welcome. 

Hi. I have fortigate 600E with 6.2.10 firmware. I have 3 DR (3 ISP internet connections) which the traffic from my servers goes to the internet. To determine which of the 3 lines the source from my server traffic leaves, I use policy routes. Now I would like to configure a SDWAN with 2 different internet lines, for other pourpuses, in addition to the 3 that I already have. When trying to create the new default route I read this message "You cannot have duplicated routes on SD-WAN and non SD-WAN interfaces." I have read about it and it seemed to me that what is usually done is to put all the lines in the SDWAN (the new and the 3 that it had) creating the default route to the SDWAN. Finally, create a DR that goes to the SDWAN (eliminating the current 3) and with SDWAN rules control what goes out through each line. I would like to know if it is correct. On the other hand, I would like to know if this would generate any problem in the servers that go out through the 3 DR that I have, for e

Hello @All, for internal testing, I have set up our fortiweb with an internal and external virtual IP.If I'm using the internal virtual IP for my profile under Policy / Server policy, I get my replacement message screen and everything is fine for internal communication.If I change the same Profile to my external virtual IP I only get a Login Prompt.After input my date the communication works fine but no replacement message at start. Has anyone an Idea what could be the Problem?Fortiweb OS: 7.0.0 Many thanksTBS

My organization is currently reviewing IOC and I been reading about it. However, I can't find answer to one thing, what if its a false positive and we know it and we want host to access the internet and remove it from 'compromised host' tag?

I see the FortiOS and Fortigate Image on Fortinet Support.I'd like to know how are there different?Note:1. Port1 is a management port (cannot use in firewall policy) I tried to change port name but it's not work.2. port 2 is a port1

Hello all,  i have here an Fortigate 60E with enterprise bundle. It is possible to combine it with an Layer3 FortiSwitch 448E without subscription? Is the Switch restricted without subscription? This time i have an HP29xx series as Layer3. However, this does not work optimally with the Fortigate. I thought a Fortiswitch would be a better choice. Especially in device detection and IOT.  Very ThanksBest regards IPranger

Hello @All, I'm looking for a configuration example how to configure a Fortigate to communicate to a Fortiweb like on this example:If a Client on the internet communicate over a public IP of Fortiweb Virtual Server, how to configure the Fortigate to send the traffic to Fortiweb.Is that just a NAT Rule? Fortigate and Fortiweb are on latest Firmware. Many thanks for helpinggreetings TBC    

Hi Guys, i need to delete an expired local certificate and upload a new one but the delete botton is grayed out and i've no access to CLI (i access directly to the public ip address), how can i replace it?if i try to import the new one i'm promped this: "Certificate file is duplicated for CA/LOCAL/REMOTE/CRL cert."hardware is FortiWiFi 60F Region-E thanksregards  

Dear Fortinet Community!FWF30E-3G4G (6.2.10)  is using onboard LTE modem with SDWAN. It works only with direct routes, and doesn't work  with static route sdwan--> 0.0.0.0. LTE gets dhcp address with /32 mask - so there is no any gateway... If I downgrade it to 6.2.9 - everything is fine, LTE gets /30 address with normal gateway. Asking here to see if anybody recently had this issue. Thanks!

Hello @All I have configured sslvpn on Fortigate OS 7.2.0.On Win10 Client Login Works, Ping IP and FQDN to system are working too.If I'm using nslookup I get DNS request Timeout.If i using ping -a I can Ping but no name resolution. My configuration:Under Network DNS Server I have configured LAN and SSL-VPN tunnel interface.DNS Database are configured our domain with both internal MS-AD-DNS Server.Under VPN sslvpn setting there are also both MS-AD-DNS Server configured. Is there anything wrong in my configuration?Also, i have no nslookup on Fortigate CLI Many thank's for helpingTBC 

Hi,I need to set a rule to deny any one RDP to a server, not just TCP 3389 but on any port.I know this can be done using IPS security profiles but there is a problem: When I set the rule to deny, no IPS profile may be selected and in the rule I can only choose RDP service which is TCP 3389. IPS profiles and exceptions within can only be selected when the rule is an Allow type. So? In short, I need a rule to deny RDP protocol with any port (default or non-default) to be blocked toward a specific destination. Regards, 

Has anyone gone thorugh the exercise of bundling the free Forticlient (6.0.x) MSI into a package for mass distribution throughout their enterprise via SCCM?  Any pointers, suggestions, gotchas that you ran into that you're willing to share? We're also trying to figure out how to bundle/pre-package our default Forticlient settings (Connection name, Remote Gateway URL, etc.) into the package - any recommendations on the good way to insert this into the package would be appreciated. Thanks, T. 

How do i enable email filter logs in Log and Report ?my FortiOS is 6.4.8. i can see web filter, Antivirus, web application firewall, but email filter is missing 

I am using the SSL-VPN tunnel interface (ssl.root) in a zone. But in the vpn ssl configuration it does not detect the policy created using the zone instead of the interface.There is a document that indicates that this configuration is possible.https://docs.fortinet.com/document/fortigate/7.0.0/new-features/538358/use-ssl-vpn-interfaces-in-zones-7-0-1But I am trying version 7.0.5 and it does not work.Here is the zone:This is the policy:But in the ssl settings apper the missing policy error:Has anyone had this problem? 

Hi Everybody,some time ago I have done a network segmentation in the headquarters based on zones (client, voip, server) and numerous policies. Now I have to do the same in a remote seat (IPSEC VPN). The remote seat  have the same logic as the main office, although not all VLANs are necessary (only client, VOIP). All routing between the VLANs is done at headquarters. I would like to avoid the following solutionUsing multiple interfaces in the policies because i lose the "Interface Pair View".Duplicate policies (this makes administration more complex)my ideaMultiple IPSec VPNs (with diffrent public IPs in the main site - parameter "set local-gw") - one VPN per VLAN, whereby its interface can then be added to the corresponding zone and the existing rules are then used automatically. Since I don't have a test environment, I wanted to ask beforehand whether this is even possible (routing..) or whether I've overlooked something here? Graphic for better understanding.Thank

HiI'm running FortiOS v7.2.0,build1157,220331 on FortiGate-200EI enabled DNS Database in Feature Visibility and configured it like this: config system dns set primary 1.1.1.1 set secondary 1.0.0.1 set protocol cleartext dot doh set server-hostname "one.one.one.one" set domain "test.local" end config system dns-server edit "port3" set mode forward-only next end config system dns-database edit "Test" set domain "test.local" set view public set authoritative enable config dns-entry edit 1 set hostname "@" set ip 192.168.5.15 next edit 2 set hostname "asd" set ip 192.168.5.15 next end set primary-name "dns1" set contact "host@test.local" next end (The IP Address of port3 is 192.168.5.1) The firewall doesn't respond to DNS for this domain and for

Hello @All, I have reed this Post: Technical-Tip-SSLVPN-Idle-timeout-not-working Is there any chance to solve the problem without changing anything on Client Side? Many thanksTBC

Hello everyone, Where i work we have a Fortigate 400E unit and I have some doubts on how to manage internet access for some of the users, we are using the profile based mode: Heres the scenario:Sales department have a firewall rule "Sales department internet access"Marketing department have a firewall rule "Marketing department internet access"General managers have another firewall rule for them aswell. Those internet access rules have different levels of access. For instance, general managers can access more websites than sales or marketing departments.  So far this is working, not issues at all. But sometimes a user from marketing or sales department gets assigned a task that in order to get it done he/she must have access to certain websites that are not allowed in the original policy. So, i need to give that user (and only that user) the permission to access the new websites he needs to access, but i dont want to give that access to the whole sales or