Solved

Hello, My question is very simple. Is it pssible to change SSL VPN Web login page portal ? As I can see it fits the FortiGate Langugate but how can I customize it without changing the FortiGate Language ? For exemple, my fortigate is in english and I need to have this page translated to another language : Thanks 

Hi!My SSL VPN always disconnects after 6 minutes.What could be the cause?Please help.

Vul of CVE-2022-0778 found at 2022-03-15 (https://www.openssl.org/news/secadv/20220315.txt), The openssl version is affects :1.0.2, 1.1.1 and 3.0 It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. OpenSSL 1.0.2 users should upgrade to 1.0.2zd (premium support customers only)OpenSSL 1.1.1 users should upgrade to 1.1.1nOpenSSL 3.0 users should upgrade to 3.0.2 Does Forti Product is affected by this Vul ?

Hi,On Fortigate FortiOS 6.4, this is I'd like to do: Limit an admin login to a single session, so if another login happened with the same admin user from another system (another PC), the current session goes off. Is that possible? Regards, 

Hello everyone, I'm new on this forum and a rookie in networking/Fortinet :) I have a question regarding my topology with Fortilink :  I have multiple VLANs across the switches and the Fortigate is managing all the switches.At this moment, all the internal traffic is going through the Fortigate and I'd like to change that.I have seen that with the "Advanced license", I could set up the SW1 as L3.My questions are :- If I put the SW1 in standalone mode to perform as L3, can I still have all the other switches managed by the Fortigate as it is right now?- If yes, all the internal traffic would be performed by the SW1 even if the other switches are managed by the Fortigate? I'm all ears if there is/are other solutions. About the config/firmware : All the links are in auto-mode / FG and FSW firmware is 7.0.1 (GA). Thanks in advance, GiGi. 

Hi Community,I have two HA Clusters that I need to connect.DC1 has 2x FG200E running active-acativeDC2 has 2x FG201F running active-passiveHow would you connect those two HA clusters? I want to be able to lose one of the Forigates on each side.Would you put a switch in between and connect to the switch using an aggregate?Or would you directly connect the Fortigates?I want to create a /30 transfer network to route traffic between the two DCs.Thanks for your suggestions. :)

Hi!I'm trying to setup an ssl vpn using LDAP on a Fortigate 40F, but using the server name fails.If I try to ping server ip from CLI it works, the server name fails.In Network / DNS the correct DNS is entered and can also ping external addresses like google.com.What other tests or configs do I need to do?Iv've been following the tutorials on https://docs.fortinet.com/document/fortigate/7.0.5/administration-guide/115783/ssl-vpn-with-ldap-user-authenticationThanks in advanced!

Hi, Please any help i want to know if the FortiSwitch 124E can work with an cisco SFP 1000BaseSX SFP.version 6.2.3 I changed an switch cisco 2960 by a new a FortiSwitch 124E standalone cabling to a switch core cisco 3750 but it didn't work, i don't know exactly the problem any suggestion please !thanks in advance.

Hi ! I have a strange behaviour with FortiAuthenticator and SSL VPN on FortiGate FortiAuthenticator is configured to sync ldap user accountFortiAuthenticator is configured to act as RADIUS with remote usersOn RADIUS policy, I used checked "User Windows AD Domain Authentication"ForiGate SSL VPN is correctly configured with RADIUSWithout 2FA enabled on FortiAuthenticator accountOn SSL VPN web interface I can connectIf I reset the password on my Active Directory (force change), on SSL VPN interface I can set a new password With 2FA enabled on FortiAuthenticator accountOn SSL VPN web interface I can connect with tokeIf I reset the password on my Active Directory (force change), on SSL VPN interface when I enter the token I'm not redirected to change password page but I have an error On Autentication > User Account Polices I haveIf I disabled "Request password reset after OTP verification". The behaviour is a bit different.I can change de password, then I recieved the

Hey, I'm new to Fortinet in general. We just got a fortiweb 400E and Im basically trying to ping through it and cannot.  Im not sure why. Basically what Im trying to do is this.....Laptop(192.168.1.1) >Cisco FW > Fortiweb400E > Cisco FW >laptop (192.168.1.10) The Ciscos are in transparent mode, I can ping through them no problem.  I'm guessing its a policy somewhere?  But I cannot see anything obvious in the logs.  I've turned on traffic logs and they tell me nothing.  I currently have it in OP mode "transparent inspection", port 1 is Mgmt on a different subnet, port 2 and 3 are plugged into each FW.  Any ideas would be great......

Hi !  I have a strange behaviour with dialup vpn. I have an HQ Fortigate with theses interfaces configured :port1 : 172.15.1.1/24dmz : 172.18.1.1/24 I have a Fortigate Client connected with dial-up vpn to this HQ. When I execute a traceroute on this Foritgate Client to reach for exemple a server behind my HQ Forigate with IP 172.15.1.218, the result is shown like that :  traceroute to 172.15.1.218 (172.15.1.218), 32 hops max, 3 probe packets per hop, 84 byte packets1 172.18.1.1 4.866 ms 5.031 ms 5.181 ms2 1172.15.1.218 5.355 ms 4.989 ms 4.527 ms Why dmz interface ip is in the path ????? Is it a normal behaviour ?  Thanks

Hello, I need help solving a routing problem. HQ and Brand Fortigate FW are connected via VPN IPsec Site to Site, everything is working fine, we can ping and have access from servers and ressources LAN to LAN from both side.  I created a static route from Brand's LAN 10.0.151.0/24 to HQ's router 10.0.78.253 on Firewall Arkoon. We host a SaaS solution with a service provider and this one to authorize the different lan to connect to the solution (France agencies + UK agency) On our Arkoon Firewall, we have authorized the different LANs that must have access to the LAN of the SaaS solution, 192.168.100.0/24. This works very well for all the agencies in France, except for the UK LAN with 10.0.151.0/24 addressing. When i do tracert cmd from a computer brand's LAN 10.0.151.109, I can ping 10.0.78.253 and 10.0.78.254.But, when I try ping or tracert with 192.168.100.20 it cannot found a route and it fails at first jump after 10.0.151.254. Thank you

Hello, Can I please get my nickname changed from MusicMaikel to SupportLibraICT? Thanks

Hi, two of our customers can't reach a website, but that webmaster says he can't remove them, because they are listed in the "Fortinet MaliciousServer list" and he can't remove them. The cause was the firewall of those two clients of ours, which they have since replaced. How do you get yourself removed from that list?Who should I ask? Thanks!

Hello everyone ! I need your help today. I have a FortiGate managed by FortiManager.I added some user in my FortiGate (User & Authentication > User Definition), I retrieved the configuration in my FortiManager. Now all is correct. But, if I push a policy package or update it, all my local users are deleted ! Why and how can I prevent this behaviour ?  Thanks

Hello. I have a FortiGate 60F and I have a layer-2 switch attached to one of the ports. On that nameless L2 switch is my WiFi WAPs (just some old Aruba's we had laying around). I want to have a guest network on those WAP's, but also want to have normal connectivity like I currently have. I'm trying to fumble my way through, but I can't seem to figure out a way to allow multiple IP/VLANs on one port. The L2 switch is on Port3, and I have that as part of the internal VLAN Switch (default setup) as pictured. Port3 > 8-port L2 switch > two Aruba WAPs with 2 VLANs (VLAN 0 and Guest VLAN)

Hi everyone, If I understand well, Web filter gives you more control over the things you can allow or block, in addition you don't need to use the FortiGuard DNS servers, so you don't have this limitation. Then, my question is, why do you need DNS filter if you can do the same or better with Web filter? Any example? Regards,Julián

Hello everybody! I encountered a problem - I cannot create a report template of youtube usage by individual users. The report has to contain: username, name of a video, a link to the viewed video, traffic, viewing start(date and time), viewing ending(date and time), view duration. Mates, please, write a solution if you are able to, thank you!

Hello @All,I have to Set up some internal DNAT and SNAT Entries and on reading some guides how to do that.I have seen that there is a feature calling Central SNAT available.I'm not really understand for what it is.Could someone explain to me what is the goal of Central SNAT and do I need that? Many thank'sTBC

Hi all, I run anomaly DoS detection between a students network and our campus lan. Thresholds are still default values. Problem is our campus dns server.I get many udp_dst_session, udp_flood, ip_dst_session just because of legitim (?) dns requests. 99% of all triggered anomalies are: clients -> dnsserver:53/udp. Sure, I could adopt thresholds but this would affect all udp traffic. Better would be to whitelist udp traffic to this dns server. Is this possible? anomaly: ip_dst_session, 7735 > threshold 5000, repeats 1312 times since last log  BTW: how are thresholds counted? udp is ip traffic, so does a 53/udp packet count for all three categories (udp_dst_session, udp_flood, ip_dst_session). And is this threshold for one client to server or all clients to server? Encylopedia says "the number of concurrent UDP sessions to an IP address is above specified threshold level", so I would assume latter.

Hi Folks! i have a special problem, we want that our user´s can use our public ip over vpn, but i don´t find any options in our fortigate FW60. has anyone the same? maybe someone can help. thanks a lot

Hi All, According to FortiGate support, I am the only person in the whole world who has had this problem. Configuration: FortiClient 7.0.2/.3 on MAC (Monterey) -> FG100/200 (6.4.8) IPsec VPN -> Cloudflare -> Secure WebsiteIPv6 is not configured on the FortiGates. Depending on the Internet provider (xFinity) and Verizon (hotspot), The user receives a block on Cloudflare because it see the xFintiy IPv6 address instead of the FG100/200 Internet IPv4 address.  Cloudflare only allows the FG100/200 IPv4 address access to the website.  If the user swaps to their hotspot, then the user can access the website. It doesn't matter what user is used to sign into the IPSec VPN. Fortinet support believe the issue is FortiClient, but since we don't have EMS, they won't provide support. I believe the issue is on the FortiGate side as the IPv4 IP address assigned to the IPSec connection should be the address that is pushed through the FortiGate and seen b

Hi all, I try to get "loadbalacing" (better call it host routing) working with virtual server and HTTP host as balancing method. I got a cert with all 3 server names as aliases, configured all 3 servers with their hostnames. Problem: What and how many firewall rules to get it working? I added two rules for each subnet, but it seems that no matter which hostname I access, only one rule is triggered. The first host (serv1) which matches the triggered rule works flawless. The other two hosts just seem to work on startpage. Any hints how to fix this? Do I need one very generic rule for both networks and why just works startpage? Is it due to persistance? config firewall vip edit "serv1-3" set comment "Server1 + Server2 + Server3" set type server-load-balance set extip 172.16.0.1 set extintf "any" set server-type https set http-ip-header enable set monitor "Check_Ping" set ldb-method http-host

Hello, I am trying to redirect the traffic coming from the WAN to a specific machine based on the domain name that a user types as a URL. This is somewhat tough to explain properly since this is my first time doing it so I will try to provide a detailed example. The FortiGate Firmware version is 6.4.7.I have 2 different servers in the same network that run as webservers, one machine has a 192.168.1.10/32 address and the other one 192.168.1.11/32. I have a DNS hosting were I can create several alias registries pointing to the public IP address that is set on the WAN. The main plan is the following.I created an entry in the DNS that points machineA.mydomain.com to the public IP address set on the WAN and I I created a Virtual IP that redirects this request directly to the webserver at 192.168.1.10/32. This one worked flawlessly since it was done directly though port forwarding.The problem comes when I try to add a second registry that points to the same public IP address on the WAN

Hi everyone, I am working on an SDWAN topology with 1 hub and 3 spokes (Spoke 1, spoke 2, spoke 3) routed via iBGP with the hub as Route reflector server. All spokes are RR clients. The actual issue is that the Hub is advertising all the best routes to the spokes but spoke 2 does not receive the route of spoke 1 and spoke 1 does not receive the route of spoke 2. Spoke 3 receives all the routes and spoke1 and spoke 2 receive the spoke 3 routes. I don't see any route-map or filter on spoke 1 or Spoke 2, I have done a soft bgp clear but still have the same issue. This make ADVPN shortcut never goes up between spoke 1 and 2. have you ever faced the same issue ? Kind regards