Solved

Q1 How do you configure a switch virtual interface anddo vlan tagging on the firewall ports using GUI? Q2 If it is possible, pls do guide me and advice if I am supposedto use a software switch or a hardware switch? Q3 How come there can be 3 ip addresses for the physicaland virtual interfaces? Ip addresses should only be on the physicalor virtual interface, not both. (there are one physical and 2 virtual interfaces) Q4 How do you configure an interface and assign sub-interfaces to itusing GUI?

Hello,i am looking for a fast and efficient way to check if 800 or so ip addresses are contained in the fortigate blacklists.Can you help me?Thank you

Hi,SetupI use a Fortigate 60E (WAN Router) to split our internet connection to a 2nd location.On the 2nd location we also have a Fortigate 60E.I used a traffic shaper on the WAN Router to limit there speed to 100Mbit.Both run FortiOS 6.2.10 The Issue:On the 2nd location for one reason or another, 1 user can use up 100% of that 100MBit during a download.Any other device at that point will not be able to internet untill the download is done.Has anyone seen this before? it feels like the 2nd Fortigate doesn't know the line speed, even though I set the Estimated Bandwidth to 100000 kbps. I don't understand why its not balancing the connection.

Hello friends.I have a fortigate 400D, receiving 100 Mbps from my ISP (UTP cable). Now I want to connect it to fiber at the same speed (100 Mbps). I saw that it has 8xGE SFP slots that I assume supports fiber.My questions is:Is it possible to connect it to a fiber working at 100 Mbps speed?If yes, what kind of module I need? Thankx. 

Hi,   I have a query.. I have few fortigate devices which are being configured directly until now. We have lot of static routes, firewall policy, SDWAN rules, interfaces etc..  Currently I want to manage these fortigate devices through Fortimanager. How can I add a preloaded config Fortigate device into Fortimanager so that Fortimanager gets policies, configs from Fortigate and continue to save it for future changes?. Any documents available on this?. RegardsRaja

Hi,I just use these firewall from some days but I'm runnig into a problem.I try to summurize- Server A (192.168.0.230) is connected to Server OUT (192.168.100.200) through a 80E vers 6.2.6 - Server A is able to ping (even reach http/https and so on) SERVER OUT - I add server B 192.168.0.231 to the lan, I add to the rule on the firewall Server B ... but I'm not able to "ping" server OUT.There are no routes on the serversthere are no rotes on the firewall (or even I'm not able to see them)no software firewll on the serverIf I "swap" ip addresses from SERVER A to SERVER B  B will be able to reach SERVER OUT and A noIf I change server B address to somethig differnet still no working (so there shuold not be dirty entries) Can some one give me an idea to what to check?Thank you in advance, hope to be understendable.Carlo

Good Day, I'm looking for a solution to implement an HA cluster between 2 Fortigates that are installed in different server racks/server rooms. Rooms are connected with Fiberlinks over a switch stack (not Fortinet Switch). To add to that, there's 2 ISPs on site and would like to have it redundant with SD-WAN and everything. I have found 2 documents stating that both solutions are possible on their own but NOT used togetherhttps://docs.fortinet.com/document/fortigate/6.4.0/new-features/297020/fortigate-ha-between-remote-sites-over-managed-fortiswitches-6-4-2https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/759633/sd-wan-with-fgcp-ha-expertIf you have any inputs or different solutions to this, let me know!

Hello Guys I am starting to study fortigate and I have simulated some labs in GNS3 with good results, but now I am trying the following configuration1 FW2 Switch core connected by LACP to the FW. The core switches are in L3.1 ToR switch1 PC connected to Tor to vlan 101From the Core I have a response from the IP 192.168.0.17 of vlan 117 and vice versa. From the PC the IP 192.168.0.17 of the FW responds, so add the segment 10.214.1.0/24 192.168.0.18 as a static route in the FW. My problem is that the PC does not have internet access, the FW only has vlan 117 because I want to test if it is possible to go to the Internet with this configuration, because in another laboratory I had no problems when I created vlan and dhcp in fortinet, they went to internet without errors, but in this case I have not been able to achieve it I have tried creating the segment 10.214.1.0/24 in fortigate, created a policy that everything that comes from vlan 117 goes out and still the same p

Our Fortimanager(FMG) is running 6.4.7. We encountered a situation we had to add one VIP policy at only one location/FGT (so far) of this customer while all other policies (60+ of them) are the same with other locations.I kind of know the answer already but I have to ask because my current option I'm thinking is to clone the current policy package and change the name then add a VIP policy with VIP objects, which is not so smart because every time we need to add/change one thing to any other policies, we have to remember to add the same change to this policy package as well.And similar cases might grow when we add more this retail-chain customer's location (so far 100+, but expected to grow much bigger) and the number of policy packages would grow. So, I want to ask if I can somehow add one policy only for one location/FGT in one policy package. Thanks,  Toshi

Hi team, We are new using fortinet firewall but our company website: Marj3y.com is being blocked without a clear reason. I can't find anything related in the logs?Also how can I check it against viruses from the firewall console? 

Forticlient blocks access to the C:\Backup directory, prevents creating it or writing to it if it already exists.We have a commercial software that requires saving files inside the C:\BACKUP directory, if the folder does not exist it creates it. We have been using it for several years without any problems.We installed Forticlient on the computers in October-November, and it is in this month of February that we need to update that software on some computers; the updater sends an error message that it does not have access to the mentioned directory.I checked then that in all the computers that use Forticlient, it is impossible to create the directory or write inside those that have it created for some other reason (a simple manual backup inside that folder made 2 years ago).In the FEMS I have already added the exclusion in all the profiles; I have searched how to "pause protection" (I have not found it), but I deactivated all the protection modules and it still blocks the directory.The o

Good afternoon community. My case is the following, I hired a block of 8 public IP's with my ISP and I have not been able to configure it properly in my FT100e. MY ISP gives me the service through an ONT which I connect to my WAN1 in PPPoE mode and assigns a local IP of the ONT to WAN1.Configure a VLAN subinterface on my WAN1 where I configure the first usable IP of the /28 block, the others I place as secondary.Create a static route pointing to the GW that is assigned to WAN1 dynamically.Create a policy to allow LAN=>WAN1 access Under this scenario, the LAN network on my port 1 navigates without problems, but the FG100e does not ping the Internet nor can I reach the IPs of the block externally. Any help or suggestion would be greatly appreciated. Greetings.

I followed the guide below to configure explicit proxy and enable Kerberos with NTLM in fallback:Administration Guide | FortiGate / FortiOS 6.4.8 | Fortinet Documentation Library Everything works correctly. The problem is that all users authenticate through NTLM and not Kerberos:# diagnose wad user list ID: 2, IP: 10.1.100.202, VDOM: vdom1 user name : TEST31@DOMAIN duration : 7 auth_type : Session auth_method : NTLM pol_id : 1 g_id : 5 user_based : 0 expire : no LAN: bytes_in=6156 bytes_out=16149 WAN: bytes_in=7618 bytes_out=1917 I have a doubt: is it all here or is some configuration missing? I found this article on TechNet:Active Directory: Using Kerberos Keytabs to integrate non-Windows systems - TechNet Articles - United States (English) - TechNet Wiki (microsoft.com) In particular it seems to be necessary to enable Kerberos for the service user used for the keytab: <After the keytab generation, t

Hi community, Can anyone help me about the procedure how to upgrade a FortiGate 60D from 5.2.3 to 6.4.8. I have taken a look at the Upgrade Path Tool, but it doesn't show either 5.2.3 nor 6.4.8. Any ideas? Regards,Julián

Hi Everyone, I would like to seek an advice if is it possible to create 2 IP Sec VPN tunnel on fortigate firewall with 1 WAN interface ? if so is there any link or documentation that I can refer how to do so ?I attached some topology for better understanding on this thing.

Hello,FortiClient 6.2.3.0912 on windows 10 computer is configured through EMS. I cannot activate Real time protection. The reason is quite clearly esxplained in log:06.02.2020 08:42:22 Information Config Third-Party AV (Trend Micro Security Agent, ) is installed. To avoid conflicts, scheduled AV scans will not be imported.06.02.2020 08:42:22 Information Config Third-Party AV (Trend Micro Security Agent, ) is installed. To avoid conflicts, real-time AV will not be enabled.06.02.2020 08:42:22 Error Config Error in importing module: xmlav06.02.2020 08:42:22 Debug Config 'scan on registration' is disabled - delete 'on registration' vulnerability scan.06.02.2020 08:42:22 Debug Config ImportConfig: tag <\forticlient_configuration\antiexploit\exclusion_applications> value is empty. The problem is that I already uninstalled the Trend Micro Security Agent. I manually checked that all TM files are deleted from the disk. I manually checked that there are no TM keys in registry. I

Hello,we have a Webserver at backend with following configuration:Ubuntu 20.04apache 2.4PHP 7.4Software GLPIKerberos SSOIf we unsing on windows pc the internal url (fqdn) from Webserver the user loged in automaticly.Parameter Satisfy Any is disbaled in that case! If we using external Fortiweb URL we enter user an password we get this Browser Message: UnauthorizedThis server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required. If we aktivate Satisfy Any in apache ssl config the login with external (over fortiweb) is woking after enter Credentials.But with this configuration, the login with internal URL require a authentcation. On Fortiweb we have as Site Publish rule this: Can someone tell me what is wrongmany thanks for helping

Dear users, Just a question. Yesterday I have set up the Fortimanager and imported some Fortigates into it. All went well except the policy packages. All of them have status modified.  I know I can push the policy back to the FortiGate to get it in sync but I'm afraid that it will broke somethingIs there a quick way to fix that? How would you fix the modified packages to get them in sync

Hi all, We have 2 (non-HA) FortiAuthenticators on prem that were configured to use DC agent with DNS IP validation, but were finding that when someone moves from a wired to a wireless connection that it would take too long for DNS to replicate and FortiAuthenticator to update the IP address of a workstation. We have therefore installed the SSOMA on a couple of devices as a PoC, which works great for the above issues, but we are seeing an issue with VPN connected and On-Prem connected clients that are on the same LAN subnets. Example:User 1 connected to Cisco AnyConnect on 10.0.0.1 with local wireless network: 192.168.0.1User 2 connected to On-Prem network on 192.168.0.1 The FortiAuthenticator sees both connections for User 1 and updates its' DB, then when User 2's SSOMA updates FortiAuth, the DB removes User 1 IP: 192.168.0.1 and adds User 2 IP: 192.168.0.1. Then User 1's SSOMA updates FortiAuth, which removes User 1's entry. We have IP Filters created, but as the b

New to FortiExtender. Trying to determine if using FortiExtenders might be a good choice for a  WAN2 connection in the event that the existing WAN1 connection goes off-line for a time. I'm curious what options exist to subscribe to the SIM cards. I know that some cellular carriers have fairly low cost data plans, but that it is easy to exceed the allowed data usage. I think that there are other plans that have high or unlimited data useage caps but that are quite expensive.  Does Fortinet offer cellular data plans? Are there some plans that are well suited for this usage? Do any plans pool data allotments such that a single SIM card in use in a month can use the pooled plan minutes of all SIM card plans? 

Hello, i have the following problem:we purchased new Hard Tokens and i wanted to activate them in the fortigate. All i get is a Invalid serial number message.I found the old problem with the Serial Number Checking Tool but this is failing too with a SN Not Found massage.The SN are all starting with "FTK200BA8" Is there a new chicking tool or do we have to contact our reseller? Thanks in advance and greeting,Dominik Gronau

Hi all. I'm hoping someone will be able to advise me on a work around, or an alternative solution, to avoid the following limitations with Microsoft NPS Extension for Azure MFA (without having to implement a completely different solution!): https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/36647266-mfa-nps-ext-support-for-network-policies-via-rad For context, our customer originally had a FortiClient to FortiGate SSL VPN that utilized LDAP authentication, allowing different levels of network access depending on AD user group membership.Our customer subsequently moved their AD into Azure cloud and introduced Azure MFA.Our customer now wants to integrate the existing SSL VPN to with their Azure MFA for 2-factor authentication. We followed the following Cookbook document to successfully implement this: https://docs.fortinet.com/document/fortigate/6.2.0/azure-cookbook/517582/configuring-forticlient-vpn-with-multifactor-authentication 

Hi,  When we have different region HUB topology in the network. Each Hub will have iBGP peer with its spoke and eBGP peer with the other region Hub. So , when we build IPSEC tunnels between the Hubs whether this should be a full mesh tunnel or a dialup tunnel?.  Should we need to add these ipsec tunnel interfaces (Between Hub to Hub) as part of SDWAN interfaces and to write SDWAN rules at hub for a spoke in one region to speak with other spoke??.. Or the other option is , without bringing HUB to HUB ipsec interfaces in SDWAN interface and just play with BGP routing ??. What is the best way to deploy and any documentation available for this. When we add it in SDWAN interface, we get benefit of running performance sla on top of it and to pick the interfaces.. RegardsRaja 

I have a second-hand FortiGate 80C and fortiap 223b,I want to upgrade them.When I downloaded it in the technical support, I found that I needed the contract number, but I didn't.Who has time to download their firmware and mail it to me,I'd really appreciate!my email 958041914@qq.com  or zlajl90712@outlook.com

Hello,Tried to make IPSEC tunnel between my fortigate and server build on OPNsense.My fortigate is 100F behind SNAT. SNAT is made by Virtual IP and forward connection form external IP to IP on loopback interface. Don't have any interface directly connected to internet so have to use Virtual IP as SNAT. Opnsense is also behind SNAT 1:1 .Something like :OPNsense 10.0.0.1/21<-->SNAT<-->95.100.100.1<-->Internet>95.100.200.1<-->SNAT on Virtual IP>10.200.0.1/32 on loopback<-->Local netIPs are for show purposes only.I've made successfully tunnel , phase1 and phase 2 is on green from both side.Problem is that  that Fortigate receives incoming packets from OPNsense but reject it as it comes from unknown SPI. In log details I have correct local IP, correct remote IP and the most important correct SPI number from both sides.I'v tried IKE v1 and v2 , with NAT nad without NAT and many other options. Nope, all the time Fortigate even if tunnel from