Solved

Hi all, I like to know is there possibility to keep VPN IPSec tunnels up when linked to backup interface (WAN2) and backup ISP.I got FGT60E with WAN1 (1 ISP) and WAN2 (2 ISP - backup), to WAN1 got connected IPSec Tunnel to another FGT, and on WAN2 got connected different IPSec tunnel (needed as backup) to different location.In Static Routes WAN1 has lower distance (8) than WAN2(10) tunnels linked to WAN2 are down, is there possibility to make them always up? Of course WAN2 interface is up.I got enabled Auto-negotiate and Autokey Keep Alive.When WAN1 go down and WAN2 starting to pass traffic tunnels get up and send data with no problem. 

Hi all, FortiManager: v7.2.0 b1124 220411 (GA)Fortifgate 200F (2 devices, HA Cluster Configured) - FortiOS v6.4.8 build1914 (GA) Two Fortigate devices are configured, up and running, A-P HA mode, 2 VDOM. If I add cluster devices to FortiManager using Add Model HA Cluster, devices are visible but almost all configured information are N/A Host Name FG200F*****Serial Number FG200F*****IP Address 10.73.0.1System Time - Fri Jun 17 02:01:41 2022 PDTUptime - N/AFirmware Version - FortiGate 6.4,build1950Hardware Status - N/AOperation Mode -NATVDOM - VDOM Disabled If I try to import configuration it only import default policy section. Device Interface no entry found. Additional information:    If I try to add device using Discover Device, all information are available and update. Import configuration is fine. Any additional information with adding HA devices to FortiManager and import their configuration?  Thanks.  &nbsp

Hi all, FortiClient EMS connection status display "Unknown Errors" when I try to connect.   And, FortiClient EMS uses built-in certificate. When I try to authorize the certificate: How can I solve this?  Thank you

Dear Community, I'm nearly new to Fortinet and a bit confused.In the FortiCloud Asset Management Dashboard, I can see, that we've got 4 products - Fortigates espacially - but only 3 of them are listed in Software Lifecycle.I don't get why.As an explanation I have to mention that we have 2 devices for testpurposes only and 2 productive devices in an Active-Passive High Availabilty Cluster.The product that isn't listed in Software Lifecylce is one of the HA Cluster devices.I tried to register it with it's serial number, but it says that it is already registered.It appears in Support & Subscriptions and also in Hardware Lifecycle.What could be the reasons why this device isn't listed in Software Lifecycle.Any Ideas would be appreciated.

I would like to post a solution to the community that would of otherwise caused even further downtime. Hope this will help someone else out there. So in this particular site there is a Forigate 100F without redundancy. The HW ID is c1aj43-04aa-0000 One day out of the blue it just failed, with the error message like thisNP6XLITE: Error: xaui.usxs[0].usxs_port_sts 00000000.NP6XLITE: Error: xaui.usxs[4].usxs_port_sts 00000000.api return err code -3 opcode 5 BCM_VLAN_CREATE_SCC len 56 request 0 reply 1api return err code -3 opcode 7 BCM_VLAN_PORT_ADD len 56 request 0 reply 2api return err code -3 opcode 15 BCM_VLAN_CROSS_CONNECT_ADD len 56 request 0 rep ly 3bcm sdk 140 exit.bcm_sdk 140 is down with code 1.Kernel panic - not syncing: BUG! " The RMA unit came, with the hardware ID c1aj43-20aa-0000The system came with firmware 6.4.9 which is not something that we use nor a perfect match with our configuration file. So I was told to downgrade the firmware via format and tftp upl

I have the following configuration   10.20.x.x/16    [Cisco ASA]   <--> [FGT]     FGT-INT2 [192.168.5.1/24]   -> Downstream subnet10.20.0.0/16 I need for staff on the Cisco Side 10.20/16 network to access a server on the FGt side 10.20/16 remote subnet. The VPN is Policy based. Ideally I would like to front the server on the right side with a unique IP address (maybe VIP) - but not sure if VIP will work on the FGT side with a Policy based VPN  Ideally  10.20/16 ---> 192.168.5.5 [VIP] -- 10.20.16.1/32  I have configured, the logs show the traffic coming in and sending it to VIP but no traffic is sent to the remote network from the VIP  I am not sure a VIP will work in this scenario tbh. Any guidance would be appreciated.

Hi, I need to replace the old firewall with a new one (let's assume from a 200F (v 6.4.7) to a 400E (v7.0.5) ) and AFAIK, the backup can only be restored from devices with the same model and FortiOS. In my example, is there anyway to copy the config and correct the missing/conflicting parts?It will be outstanding if I can even clone the same rules and policies on the new firewall and do the rest of config manually (lots of objects and policies are present on the old one) Regards,

Hi,I am looking for a firewall  for 1500users, and 500  VDI access,500 camera recording  at 7 mbps , expecting approximately 1 gb  internet traffic Mostly collaboration application like teams  Please help to size,Ho much throughput I should I look for Thanks

I've been scratching my head on this for a few hours.  I've been playing with my ForitAP 223E and changed some settings to allow split tunneling.  After enabling the split tunneling on the AP my SSID's stopped broadcasting all together.  So, I disabled and tried restoring to the basic settings and the AP will no longer broadcast anything, at all.  I even tried, deleting the profile and creating a new one.  I've double checked and triple checked to ensure the SSID's broadcast button is enabled, the region is correct, the AP is authorized, and even shows connected in the dashboard... but no SSID's will broadcast and the AP shows offline.  I've even rebooted the Fortigate and did a factory reset on the FortiAP.  Am I missing something?  Do you think the antennas are defective?

Hi,Simply this is I need to do: I like to filter and decide about connections to a destination based on the port, protocol and the application if possible. Two things in my wish list which I elaborate by an example: 1- I need to disable RDP on any port not just 3389 which is the default.2- I wish to limit SSH connections to a server just to those who are established via Putty.exe file Any help would be appreciated. Regards,

Trying to find the CLI command to list the User Groups and their contents so my FIM can alert on changes. 'Show full-configuration', show running-config', and 'show firewall policy' do not include the user groups in their output.

Hi,I have configured the captive portal on two different wired interfaces and everything works fine.INT1 - 192.168.1.1 - LAN 192.168.1.0/24INT2 - 192.168.2.1 - LAN 192.168.2.0/24To eliminate the invalid certificate warning on the login page I uploaded the certificate and specified the portal-addr fqdn which is resolved with the firewal ip on INT1.auth.domain.local -> 192.168.1.1Being able to specify only one portal-addr, how can I reach it from clients that were on the other network 192.168.2.0/24?I tried to create a policy but I can't reach the local IP 192.168.1.1 from the 192.168.2.0/24 network.Can you give me a suggestion or analternative? Thank you.

Hi all I am somewhat stumped about this issue and I am not sure where to start looking. Problem:There is an app with automatic checks to the internet which also automatically repeats dns queries to our internal dns servers. Those queries come from five or six source ports from each of the two IP addresses (the app runs on two servers) and there are quite a lot of those requests.This app runs on a virtual machine which is connected to a fortigate 60F with 6.2.9.The query goes to that firewall and then trough a VPN to another fortigate and from there to the DNS. If the internet goes offline for MORE than about five minutes and then comes back again, the automatic queries don't get an answer anymore (as if the DNS server never gets the requests).If the internet goes offline for LESS than five minutes, then there is no issue.(I am not 100% sure about the exact amount of time). Some more info:Unfortunately I have no firewall logs from that time it happensThe customer is

Dear All,  Is there any way to create a script which run when there is a change in the routing table? I would like to make a mechanism that triggered by a bgp routing update. Shortly: when my fortigate get a /32 prefix via bgp (from a certain subnet), then I have to add manually a proxy-arp for that /32.Any advices or key-words are appreciated!Thank you very much

Hi! I've 2 Fortigate 40 with a IPSEC tunnel, working great.Then in each one, I've a SSL vpn for client pc's, they can access local lan in both sites.Problem is I need to allow access to Site 1 using SSL vpn on Site2.Tried to adapt this https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/45836/ssl-vpn-to-ipsec-vpn but cant get it to work.On Site2 I created a policy to allow SSLVPN traffic to access the VPN tunnel:Income - SSLVPNOutgoing - IPSEC TunnelSource - IP range for SSL and the ssl user groupDestination - The remote subnet on Site1Tried with and without NAT, but doesnt work. Don´t I need a policy to allow in Site1 also? Tried that also, but doesnt work. Can anyone help or point another example? Thansk in advanced

Hi everyone, I'm kind of very new to FortiAuthenticator. I am working on setting up one at a customer. I am having issues with the self serve portal (not the legacy one) for the password change. I have setup both LDAPS and the FortiAuthenticator is joined to the domain (although documentation said I need only one of these, issue below was not working with only LDAPS). When trying to change the password for my test user, whatever I put as new password, it doesn't want to take it. I have tried complex, short or long password or even simple ones, I always get the error message below. If anyone have any hint, that would be greatly appreciated.

Every time I try and create a cert using the Let's Encrypt service in the Fortigate it fails. I have followed the KB's I have found and also tried through the CLI. I enabled DDNS, but no matter what I do, it just fails. The Fortigate is a 300E running 7.0.5. Is there anything special that has to done. Here is what I using and doing. I have called Fortinet support, but the person I spoke to ran into the same situation. (Yellow Highlighted area: Yeah, not so much) It used to generate logs, not sure why its not now.   

Dears ,we have two ISP connections wan1 and wan2 which are configured to use SD-WAN on fortigate 100E , we have noticed that there is internet issues over some applications like anydesk connection timeout and slowness once the SD-WAN is on , how can we troubleshoot this further? everything becomes normal again once we turn off the SD-WAN . Regards , 

I am not sure if the SFP ports of the Fortiswitch fs-148e-poe work at 1000 or support 10Gb. The datasheet indicates that the ports are GE but this other document indicates that they support SFP+ FG-TRAN-SFP+SR transceivers, which are 10GB transceivers. Can someone confirm the maximum SFP port speed of the fs-148e-poe please? Thanks a lot!   

Hey there,For those who are running and managing FortiDDoS in your corporate network, what do you think about it? I don't really care if you're running SoHo, DC or carrier-class devices, just looking for feedback about the full product.I have several questions about stability and effectiveness of it, posting it just in case someone can reply his personal experience.How stable is it as a hardware appliance ?How effective is it stopping DDoS attacks ? When successful, what was the vector attack?How often does it trigger false positives ?Cheers!

Hi, guys, Another "session clashed" found in Fortigate 400E with FortiOS v6.4.2 My NAT configuration is VIP + NAT enabled: ( 111.111.11.5 :18889 --> 10.16.6.35:18889), 100.100.11.54 is the internet user: The Fortigate eventlog is below:1: date=2022-06-12 time=22:01:54 logid="0100020085" type="event" subtype="system" level="information" vd="root" eventtime=1655085714423584374 tz="-0400" logdesc="session clash" status="clash" proto=6 msg="session clash" new_status="state=00010200 tuple-num=4 policyid=69 dir=0 act=2 hook=0 100.100.11.54:58902->111.111.11.5:18889(10.16.6.35:18889) dir=0 act=1 hook=4 100.100.11.54:58902->10.16.6.35:18889(10.16.6.254:31307) dir=1 act=2 hook=0 10.16.6.35:18889->10.16.6.254:31307(100.100.11.54:58902) dir=1 act=1 hook=4 10.16.6.35:18889->100.100.11.54:58902(111.111.11.5:18889)" old_status="state=00010200 tuple-num=4 policyid=69 dir=0 act=2 hook=0 100.100.11.54:58902->210.57.60.2:18889(10.16.6.35:18889) dir=0 act=1 hook=4 100.100

Hi,is there any one who can give me some information about /bin/foritviewd process on fortiweb devices?when I run get sys top command i see /bin/fortiviewd process consuming about 30 percent cpu.is there any risk if i kill this process?Regards.

We found "session clash" in the Fortigate model 600E with FortiOS v7.0.3, the eventlog as below: 1. Fortigate eventlog (internet IP: 100.19.44.39;  Fortigate VIP (46.96.186.1 ->10.113.1.115, currently is VIP static NAT :( 1: date=2022-06-10 time=09:48:54 eventtime=1654825734757941183 tz="+0800" logid="0100020085" type="event" subtype="system" level="information" vd="root" logdesc="Session clashed" status="clash" proto=1 msg="session clash" new_status="state=00010200 tuple-num=2 policyid=258 dir=0 act=2 hook=0 100.19.44.39:28674->46.96.186.1:8(10.113.1.115:8) dir=1 act=1 hook=4 10.113.1.115:8->100.19.44.39:0(46.96.186.1:28674)" old_status="state=00010200 tuple-num=2 policyid=258 dir=0 act=2 hook=0 100.19.44.39:28618->46.96.186.1:8(10.113.1.115:8) dir=1 act=1 hook=4 10.113.1.115:8->100.19.44.39:0(46.96.186.1:28618)"2: date=2022-06-10 time=09:47:51 eventtime=1654825671783553340 tz="+0800" logid="0100020085" type="event" subtype="system" level="information" vd

Hi team, I'm trying to connect to My ssl vpn configured in FGT from external NW but I'm facing issue while connectingIt is getting stuck in 10%Please suggest

Hi everyone, I would like to remove root vdom and remain another created vdom. I did remove all the reference on root vdom but it still unable to be removed. Is it possible to remove root vdom? Thank you.