Solved

Hello, We are new to Fortinet products, having just purchased a Fortigate (FG-60F) and setting it up as a VPN site router/firewall, to connect back to our headquarters. We have created the VPN tunnel etc (mostly via the wizard), which sends all traffic from 0.0.0.0/0 to 0.0.0.0/0 down the tunnel. This works as expected, as we wanted all traffic, including internet, to hit our headquarters. The problem is that the Fortigate itself is unable to access any FortiGuard services. We assume this is because its own internet requests are being sent down the tunnel. We have tried to split-tunnel the VPN using policy routing but to no avail. The biggest issue we seem to have is that we are unable to specify the Fortigate itself as a source to exclude from the VPN rules. Can anyone with more experience point us in the right direction? How can we send ALL traffic down the tunnel EXCEPT FortiGate's own update/maintenance requests? Thank you

how to access from outside (my host ) with putty to internal VM ubuntu server of fortigate VM 7.2.0?my ubuntu server is inside the fortigate and i want to access it from outside(my host) with putty 

Hello everyone, I have a problem with internet blocking on production computers. If I disable Internet access for this network, I have a problem with windows / linux updates and additionally after entering my server in the local network, my site after https is dangerous because the computer cannot connect to verify the certificate. Any ideas?

I was checking the fortigate and when I entered the events tab I appeared many times the event of cmdb lock deadlock is detected and when I want to make a change in some policy it does not save anything and it gets stuck. What does this event mean, and why can't I make a configuration? 

I want to create a vlan interface by the REST API on a FortiGate. Here is a JSON code:{"name": "vl405","vdom": "prod","mode": "static","dhcp-relay-interface-select-method": "auto","dhcp-relay-interface": "","dhcp-relay-service": "enable","dhcp-relay-ip": "\"x.x.x.x\" \"y.y.y.y\" ","dhcp-relay-type": "regular","dhcp-relay-agent-option": "enable","ip": "z.z.z.z 255.255.254.0","allowaccess": "ping","speed": "auto","status": "down","type": "vlan","interface": "ag_inside","vlan-protocol": "8021q","vlanid": 405,"alias": "VDI",}When I POST it, I get this result:{"http_method": "POST","revision": ".....","revision_changed": true,"old_revision": ".....","cli_error": "current vf=root:0\nentry not found in datasource\n\nvalue parse error before 'prod'\nCommand fail. Return code -3\nCommand fail. Return code 1\n","error": -3,"status": "error","http_status": 500,"vdom": "root","path": "system","name": "interface","serial": "FGT3KDT.....","version": "v6.4.6","build": 1879}I created the interface man

Hello, On the Fortigate 80E (ver7x) we need to set up access from VLAN2 (WAN2 / ISP2) to VLAN1 (WAN1 (ISP1). On the firewall we have two Internet connections (WAN1 and WAN2) and internal networks VLAN1 and VLAN2. Under VLAN1 is an internal HTTPs server (accessible from the Internet via DNAT), assigned to WAN1. Under VLAN2 is the guest network, assigned to WAN2 (another ISP). Now we need to access this HTTPs server from guest VLAN2/WAN2 but we are not able to do it. We've tried something within the firewall and address translation, but to no avail / I'm out of ideas. Thanks for the help

Does the SD-WAN feature for FortiGate (600E for example) requires per year license?

Followed the manual from this post: https://community.fortinet.com/t5/FortiGate/Technical-Tip-ACME-certificate-showing-not-secure/ta-p/195496I Cannot find a way to forcing the letsencrypt certificate to be renewed with the correct url.The post itself is correct, but needs some more steps.. 

Hi,After upgrading from 7.0.5 to 7.0.6, I noticed all my proxy policies and any configuration related to proxy service are gone. I had backed up global configuration and tried to restore it but still those proxy configurations are not back. Any bug or me-made mistake here? 

Hello, Fortimail appliance comes with 2 disc to import in hyper-v or vmware.OS disc and logs disc. I presume you can't expand those discs in vmware for Fortimail appliance.How to expand disc if disc is full? Another question about discs.If you importing fortimail appliance disc to vmware can you choose thick or thin or only thick 

I have two Fortigate 200F I am trying to set up in an active-active HA environment to replace our current 200D firewalls.  When I engage HA I lose access to the slave firewall.  Is this normal behavior?  Our 200Ds are in an active-active environment, and I can access both firewalls together. Thanks.

Hello,I want to make a donation to a school of old firewall and I want to delete all information on the hard drive.What is the best solution?If I do a factor-reset, a simple restart on the backup partition and I retrieve the information from the firewall on the date of the last updateWhat is the best practice to really delete all data on a firewall on all partitions?best regards, Jean Sébastien # fortigate # reset-factory# remove all data

Hello all!Hope you all doing great. I have a Fortigate/Fortimanager/Fortianalyzer combo in the organization I work. My FortiManager was alerting some C&C callbacks based on webfilter logs. I do not have the SOC license, but I do have an third party SIEM. I was trying to configure some rules on my SIEM to mimic the C&C callback alerts on my FortiManager. Inspecting my FortiManager default Event Handlers it says that the alerts are generated when the log field tdtype contains the string "infected". The problem is that I cant find the tdtype field anywhere in the logs. Already tried to look at raw logs.The documentation says near to nothing related to this log field: Fortinet Documentation on event handlers I also checked the very log entry that generater the alerts but couldnt find this field. Anyone could give me a hint on this one? Best Regards!

Dear, I would like to use Opendns as a DNS in Fortigate 60F firewall. I am using PPPoE and the dns obtained from the ISP.  I would like to edit and use Opendns. I checked DNS option under the network and it is not been used when I check Ipconfig/all in client system. Kindly help. Thank you

Hi,I have two routers serving a lot of EIGRP neighbors and are neighbors together. I have to use a Fortigate device between two routers and prefer to configure it in NAT mode. Putting the Fortigate in between, the EIGRP neighborship breaks and the dynamic routing protocol fails even if I set any any allow rule between two points. As a matter of fact, somehow it is not possible to use different IP sets at both sides and fire up the routing protocol. So, what are my choices? Do static routing?configure the firewall in transparent mode?do any special config to make the EIGRP protocol work in this way? Any help is appreciated  

Hi,can I use Forti Client 7.0.2 with EMS 7.0.2 when had disabled:"Use SSL certificate for Endpoint Control" because of older FC 6.4.6 still in use.It will no generate any issues?In EMS 7.0.2 Release Notes I see:"If Use SSL certificate for Endpoint Control is enabled on EMS, EMS supports thefollowing Forti Client (Windows) versions:l 7.0.2 If Use SSL certificate for Endpoint Control is disabled on EMS, EMS supports thefollowing Forti Client (Windows) versions:l 7.0.0 and later"so if "7.0.0 and later it means it will work with no problems when accept invalid cert?

 Hello,Fortimail in gateway mode(DMZ)I want to create Fortimail personal quarantine for all users in a domain.Do I need to connect Fortimail to AD LDAP and than configure personal quarantine?I have 1000 domain(exchange) users.Any advice how to do create personal quarantineThank you

I unboxed a new Fortigate 200F. I uplifted the firmware from 6.x to 7.2 b1157I configured a WAN-interface as a VLAN-switch, and made setup: route, rule+nat, DNS and IPs.Internet-access is fine.I have allowed admin-access via icmp and https (custom port), I have defined trusted hosts.I can access the admin-center from the trusted host ok, from an untrusted host its blocked.So far everything looks as usual.In doing some tests I realised that I can't ping the WAN-interface from the outside.Its not working neither from trusted nor untrusted hosts.To my mind it should be pingable for both hostgroups if its enabled on the interface-definition.I checked on a fortigate 100F, same firmware and pretty same config, there the WAN-interface is pingable.Just wondering: is there an obscure option I'm not aware of? The forti was preregistered by the vendor, maybe he introduced an oddity....Any recommendation how to debug this?    

HiI'm trying to get more info about Fortigate performance specification.I already know about concurrent session and threat protection definitions. Also I've found out security features involved in threat protection (IPS + App Control + Malware Protection), all require CPU process but a specific model's ability to handle more concurrent session requires more memory ( RAM ).Here is specification for 900D:Here is specification for 600E: 900D has lower threat protection capability that is predictable because 900D has weaker CPU than 600E.Buy in case of firewall throughput or concurrent session, 900D is better while has almost same amount of RAM. I wonder why there is this much difference in FW throughput and concurrent session values while 900D memory is only 733MB more than 600E. Or maybe I'm wrong and there is other hardware factors for firewall throughput. 

Dear All,  I have set firewall FortiGate 60F  V7.05 from Technical Tip: How to create a VLAN tagged interface (802.1q) on a FortiGate - tagged/untagged traffic in forum There is Lan 1 only...I want to separete differnet port 1 for vlan 1, port 2 for vlan2but it show lan for total... Please advise...ThxLan1want to seprate vlan 

Hi All Is is possible to add user laptop / PC Mac address to control them allow or not to access the LAN device when they are using SSLVPN client connection ? My fortigate ver = 7.0.6, Model = FWF60 

Hi,make sense include in the configuration file a statement like this one:config system global   set reboot-upon-config-restore (enable/disable)end I noted that for particular configuration file (multicast routing) the configuration updating and automatic boot is not enough to restore a good running, and I need to reboot from dashboard the firewall. If I introduce these statement do you believe this double boot (one auto and one manual) can be resolved? 

Hi, I have a FortiGate 80F with FortiAP P433API've already successfully set up a SSID local bridge for the colleagues in the office. Right now I'd like to create a guest SSID with captive portal authentication.I've created the SSID, type tunnel, on a network that's different from lan (192.168.2.0/24) but from now on I'm lost. I've some questions: 1) Where are the menu options to set captive portal pages?2) Assuming that my fortigate il 192.168.1.254, what is the URL to access captive portal?3) I'd like to have a captive portal where the secretary creates users upon request. How do I do that?4) Are there some docs showing me how to proceed? Thanks

Hi everyone, I want to configure my fortigate to send logs to a specific dest e.g /var/log/firewall/x.x.x.xbut i don't see where can i do this is there a way to do this ? thanks

Hi, Is there a possible replacement of the FortiClient VPN with a Fortinet Router? Now we are connecting to a VPN server and every computer in the office is connecting using FortiClient VPN with user and password every time. Is it possible to put a Fortinet Router FG-30 or 40, and this one connects to the server and we can stop using the software client? Thank you!