Solved

I have configured in my firewall different tunnel GRE all managed by PIM dense mode. I would like to enable PIM only for some specific tunnel GRE and let the other use the normal delivery of multicast without PIM (forward enable).  I tried to do that but when enable PIM multicast also the other tunnel GRE without multicast PIM do not deliver the multicast packet.How can I create a mixed environment tunnell GRE with PIM and GRE without PIM to deliver multicast packet? Do you believe that using different VDOM this is possible? At the moment it seems that if I enable PIM multicast routing all the firewall has to be manage  with PIM, I cant use different interface for this. I have a firewall Fortigate 600e with 6.4.7 build 1911 firmware.

Hi Everyone,  We have an issue with our Forticlient SSL-VPN on LINUX (multiple flavours, redhat, centOS and Oracle) when connected to any standard WIFI, the VPN connection stops receiving packets for some time generally around 40secs to 2mins, then packets start to come through again. After about 2 or 3 time after dropping or delaying the receive packets it just disconnects from the VPN, I am saying delayed as I have a ping setup to a workstation which doesn't drop pings, the time just spans out to 10000ms for about 10-20pings then returns to normal after the packets start coming through again.So same machines connected to a mobile hotspot using the same WIFI adapter, connected to the same VPN with the same config and they connect perfectly, no drop-outs/dropped packets or delays in receiving packets. Works as it shouldLINUX Version 8Forticlient VPN - 7.0.0.0018SSL-VPN with no client certSplit tunnel ConnectionAnyone else having a similar issue, there aren't too many settings

Hi all,  i am having 2 Fortigates, FW1 and FW2 connected via IPSec VPN and on both sides i have a client network, in this client network the management web interface is activated, now i want to access from the client network on FW1 the webinterface of the FW2  on the client interface, is this possible?(The Client Networks are on both sides in the trusted hosts) best regardsfohe

Hello, I would like to have a command that can retrieve the following information: password policy, http, https, telnet, ssh, snmp v3, default account, updated, OS version, ntp, anti spoofing, syslog, statefull 

Hello!I want to implement Decrypted Traffic Mirror feature but I haven't seen a Fortinet document that would explain the Destination MAC meaning. What is it?1a. The MAC for the webserver whose decrypted traffic will be mirrored?1b. The MAC for the capturing server which captures the decrypted SSL traffic? It is more likely this case because the same GUI window also needs a port to send the decrypted traffic to.2. If the given example with ff:ff:ff:ff:ff:ff works for all cases then what is the meaning of those f's? Is it a filter or exact-match value? What changes when I replace that part with ff:ff:ff:ff:ff:f0 or any other real value? I guess that depends on the answer from the first question. Why isn't there an IP-address instead, whichever case it is (1a or 1b)? Is there anything to do with mirroring the traffic to multiple servers and all f's send this traffic to all servers behind the physical/virtual port?

Hi, I have a Fortigate firewall managed by Fortimanager, and I built a VPN directly on the firewall, rather than using the Fortimanager VPN manager tool. When I tried to import the updated FGT config into the Fortimanager, There is an issue with ADOM / FGT compatability. ADOM is version 7.0, and the FGT is 6.4.6. (Im not in a position to upgrade FGT for now). I can push a policy OK. So basically without being able to sync my changes to the FGM, any policy push, is going to overwrite and wipe the VPN. Can anyone advise if its possible to take the VPN config, routes, policy etc from FGT.. and copy them in via CLI or script on the Fortimanager? Or is it just a matter of redoing the VPN via FGM VPN manager tool? The VPN is in production now, so id prefer not impact things if at all possible.

Hi, My company is currently carrying out external pen testing on our servers and it was found out the nmap scan was blocked by FortiGate UTM. Is it possible to whitelist the IP addresses used by the pen testers? If possible, where should I whitelist those ip addresses?  Thank you.

Hi Guys , I have strange issue here. I lost all mgmt access both from WAN and LAN after changing the https and http mgmt port to 8443 and 8080. I can only ping the interfaces. So i consoled in and reverted the changes back to port 443 and 80. But still no luck of access. What do check now in CLI, i can paste cli output here if needed. Thanks Jimmy

Hi all, we have a 500e Fortigate an after the update to firmware v6.0.3 we see very high cpu usage if we click to vpn -> ipsec tunnels. We had round about 900 active vpn tunnels and before v6.0.3 there was no high cpu usage if we click.  On the left side you can see the normal usage and on the right side the usage if we click on vpn -> ipsec tunnels Is there a solution for that or a BUG? Thanks

Hi hoping someone can help me understand how to correct this issue. Replacing some Cisco routers with Fortigate firewalls and have been testing the OS in a lab environment. I have a lot of redundancy setup and everything is almost working 100% except the primary FW keeps failing back to the secondary. If I shutdown the HB link it will switch back but the second it is enable again it fails over to the secondary. If I restart the devices this does not happen until I manually trigger my link-monitor to fail in which case it switches to the secondary but from that point on is stuck. See the screen shots below for the cause of this - Not sure why the pingsvr_failure stays at 50 or if there is a way to reset it. It gets to 50 because I manually shutdown the link to test the failover - but from that point on it is always at 50 so it essentially gets stuck on the other FW no matter what until a power cycle. Thanks for the help!Ryan  

Fortigate_80F, v6.4.9 build1966(GA)Since this is the first time setting up a Fortigate, I'm still learning unique terminology and how things work.My objective with this new machine is to have access to AD Users and AD Security Groups at least.That would lead to setting up web filters (for example) using AD Security Groups that are set up for that purpose.  With this, we could add new Users in AD and in AD Security Groups and the information would flow to the Fortigate_80F without touching it.  Does that sound reasonable?I'm afraid I may have put the cart before the horse.  "FSSO" didn't mean anything to me at first attempt.I set up LDAPS first and that seems to be working.  But, I now realize more fully that there's this thing "FSSO".....My understanding of *that* is that Users log into the domain as usual via the DCs and are automatically recognized on the Fortigate. I can read the documentation OK but knowing just *what* to read is like not seeing the fo

Dear community, I'm woking in a company where20 users use a same windows account named : "call" Is there a way to restrict internet access to this user only with fortigate?  https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/13383/creating-a-web-filter-profile I have found that but it filter for each users and I need to restrict only this Windows user named "call" KR

Hi there, we want to establish Microsoft approach of a "mikro vm" with "application guard" and edge (+chrome+firefox). So in best case we can use one proxy for all use cases, free internet through application guard and restricted internet through default browsing.Microsoft Edge and Microsoft Defender Application Guard | Microsoft Docs When we enable ApplicationGuardTrafficIdentificationEnabled ( Microsoft Edge Browser Policy Documentation | Microsoft Docs ) the browser in the sandbox sends for his requests an additional http header "X-MS-ApplicationGuard-Initiated". So if i can believe in wireshark, yes this header is send but...it seems not to have any effect on the fortigate We tried the following rule and used as "source"a proxy address (to be honest, we tried several other things but this seems to be the right way...from my understanding)Just to mention, when we set the host in gui, after we apply, and reopen it, this field is empty again...but when we

Forget password seem like no work?

Greetings,I have a fortigate 200F, in Application Control I have blocked file transfer in Whatsapp, but it doesn't work, users can download files without problem, I even have Deep inspection enabled.If by webfilter I block whatsapp.net, the block to file transfer works, but does not allow a new synchronization of whatsapp web.Fortigate Version 7.0.5Any solution?

Hi all, On a vessel I'm working on, I've got two internet connections connected to WAN1 and WAN2. I'd like to have two VPN connections, using one of the WAN connetions each. WAN1 (Production VPN, Internet access)Fixed IP: 10.241.105.192 / 255.255.255.240Gateway: 10.241.105.193 WAN2 (Development VPN)DHCP: 94.234.190.55 / 255.255.255.240Gateway: 94.234.190.49 Production VPN: Site-to-Site VPN with vessel behind NATDevelopment VPN: Remote Access using FortiClient I have configured Static Route as this:Production VPN and general internet access for from WAN1 works as expected - But how should I get the Development VPN working on WAN2? The Incoming Interface for the Development VPN is set to WAN2. I understand I need a Gateway assiociated with WAN2, so I tried to add this as a Policy Route as below, but without success.I'm not sure if I'm doing the above correct?Is there anything else I need to configure to achive functionality of Development VPN over WAN2?&nbsp

Hi - hoping someone can help me with this seemingly simple problem. Coming from the Cisco world we are replacing two of our routers with two FortiGate firewalls in HA active-passive mode.  My knowledge of the FortiGate configuration is limited (but growing). I'm currently trying a basic configuration with 1 PC connected to 1 switch which is connected to one FortiGate with two connections. Currently only one of the two networks on the Fortigate is reachable (192.168.10.1).I've setup an identical configuration but instead using our cisco router and as you can see in the routing table it is logging the 192.168.116.0 route reachable via the two routes. The Fortigate is only showing this route via port2 even though it is also technically reach able via port1. I'm assuming this is the reason I can only reach the network from the port2 link and not the port1 ip of 192.168.20.1.  If this is the reason how can I populate the route to 192.168.116.0 via either port1 or port 2

Hi all, I've followed a guideline of Sophos to configure IPSec between Fortigate and Sophos, everything working well: the VPN is up, the user from Sophos site can ping the IP of Fortigate site, but the user of Fortigate site can not ping IP of Sophos site. the longest way I can do is to tracert to the local IP of Sophos site and reached the default gateway and done, nothing else. I've tried many ways: disable Windows firewall, checking the Sophos policies...and deep dive into google and I recognize there are some people who got the same problem with me and they can fix it in some way but no one posted the solution => I have no clue. can please help me where I was wrong? Thanks a lot.    

Hi all,I have searched for this in the forum and internet without much success so just wanted to clarify that i AM doing this the right way.I've got a WAN connection (say 1.1.1.1) and i've got an internal IP of a device on 192.168.70.50. I have added a secondary IP to that WAN interface of 1.1.1.2 and i want to route the 192.168.70.50 out of that ip (1.1.1.2) so i've added a policy route with the incoming interface as the Data Internal interface (which is what the 192.168.70.50 is connected to) and a source address of 192.168.70.50/255.255.255.255, then a destination address of 0.0.0.0/0.0.0.0 and in the outgoing interface i've selected the WAN interface and then set the gateway address as 1.1.1.2 ?I've ran packet trace and i can see packets coming INTO 1.1.1.2 to 192.168.70.50 but nothing going out.Have i configured this correctly or am i missing anything ?I'm not that familiar with Fortigate products (model is a 60E on V7 software by the way)Thanks all

Hello guys,I have very strong problem with this permormance AP .In several release i have the same issue; they reload every 2 or 3 days, in particular the AP with most connection. We have in my office 23 431F and 3 223E. The second no problem..the version is : FortiAP-431F v6.4,build0185,210903 (GA)I have the KERNEL LOG HELP ME PLEASE

   Hi, there are user's unused active connection in the SSL VPN service. (Please see image atteched) We have active the option : "Limit Users to One SSL-VPN Connection at a Time" but still unsed active connection. We have 3er party and official forticlients. Any ideas where is the problem? Thanks

Hi all, Will wild card certificate works for admin login GUI ?. Please note here im not generating any CSR and will import a wildcard cert provided by customer into fortigate local certificate and then in Settings>> Administrator settings. PFA image Pls advise

Hi all,I have a number of overly permissive rules using any services. What would be the most effecient way of extracting a report in FAZ, so I can see what services are actually hitting the rule, and design a policy around that?Thanks.  

I realized that there is a custom 1 and custom 2 setting inside my DNS and Antivrus web filter.Where can I find more info about this and can I edit the settings?  

Hello Will shutting down of the Primary-FG via GUI be a graceful shutdown and immediately issue a failover to the Secondary-FG of the HA pair? This is an FG-101F and I plan to do a: system > shutdown Reason is, I need to have only the Secondary-FG up and running as the true primary for troubleshooting purposes. Pretty new to this vendor and I want to ensure that it does fail over this way. Thank you.