Solved

Hi All, According to FortiGate support, I am the only person in the whole world who has had this problem. Configuration: FortiClient 7.0.2/.3 on MAC (Monterey) -> FG100/200 (6.4.8) IPsec VPN -> Cloudflare -> Secure WebsiteIPv6 is not configured on the FortiGates. Depending on the Internet provider (xFinity) and Verizon (hotspot), The user receives a block on Cloudflare because it see the xFintiy IPv6 address instead of the FG100/200 Internet IPv4 address.  Cloudflare only allows the FG100/200 IPv4 address access to the website.  If the user swaps to their hotspot, then the user can access the website. It doesn't matter what user is used to sign into the IPSec VPN. Fortinet support believe the issue is FortiClient, but since we don't have EMS, they won't provide support. I believe the issue is on the FortiGate side as the IPv4 IP address assigned to the IPSec connection should be the address that is pushed through the FortiGate and seen b

Hi all, I try to get "loadbalacing" (better call it host routing) working with virtual server and HTTP host as balancing method. I got a cert with all 3 server names as aliases, configured all 3 servers with their hostnames. Problem: What and how many firewall rules to get it working? I added two rules for each subnet, but it seems that no matter which hostname I access, only one rule is triggered. The first host (serv1) which matches the triggered rule works flawless. The other two hosts just seem to work on startpage. Any hints how to fix this? Do I need one very generic rule for both networks and why just works startpage? Is it due to persistance? config firewall vip edit "serv1-3" set comment "Server1 + Server2 + Server3" set type server-load-balance set extip 172.16.0.1 set extintf "any" set server-type https set http-ip-header enable set monitor "Check_Ping" set ldb-method http-host

Hello, I am trying to redirect the traffic coming from the WAN to a specific machine based on the domain name that a user types as a URL. This is somewhat tough to explain properly since this is my first time doing it so I will try to provide a detailed example. The FortiGate Firmware version is 6.4.7.I have 2 different servers in the same network that run as webservers, one machine has a 192.168.1.10/32 address and the other one 192.168.1.11/32. I have a DNS hosting were I can create several alias registries pointing to the public IP address that is set on the WAN. The main plan is the following.I created an entry in the DNS that points machineA.mydomain.com to the public IP address set on the WAN and I I created a Virtual IP that redirects this request directly to the webserver at 192.168.1.10/32. This one worked flawlessly since it was done directly though port forwarding.The problem comes when I try to add a second registry that points to the same public IP address on the WAN

Hi everyone, I am working on an SDWAN topology with 1 hub and 3 spokes (Spoke 1, spoke 2, spoke 3) routed via iBGP with the hub as Route reflector server. All spokes are RR clients. The actual issue is that the Hub is advertising all the best routes to the spokes but spoke 2 does not receive the route of spoke 1 and spoke 1 does not receive the route of spoke 2. Spoke 3 receives all the routes and spoke1 and spoke 2 receive the spoke 3 routes. I don't see any route-map or filter on spoke 1 or Spoke 2, I have done a soft bgp clear but still have the same issue. This make ADVPN shortcut never goes up between spoke 1 and 2. have you ever faced the same issue ? Kind regards

I've searched this issue and seen the technical tip about the issue in which it says "FortiAnalyzer not only shows information based on FortiGate logs, but can retrieve additional information from the FortiGate directly.This is done by FortiAnalyzer triggering a login from the miglogd daemon running on FortiGate and then querying the FortiGate API." I am interested in what kind of "additional information" it tries to get from the FortiGate by logging in? 

hello good peopleis there a feature of remote interface failure detection in FortiGate firewallsI have a redundant group of two ports "port1 and port5" each one of them is connected to a different Layer 3 switch, currently, all the traffic is traveling through port1 if it fails port 5 will take charge.but what if the remote interface that port1 connected to on the l3switch failsis there any way to detect that the interface facing port1 is down and dynamically switches to port 5 to move traffic?thank you

Hi,I've to remove several object using the FortiManager (6.0.11).  May I simply remove the objects or must I clean/remove the rules before? What will be the behaviour if the rule would be empty, if I simple remove the objects only? Regards,Bernhard 

Dear people, I have in FGM a lot of CLI Scripts, I use for automated Installation of a Fortigate.One of my problem is, that I must assign step by step the scripts to a fortigate and it does need nearly 10 Steps until the fortigate are completed. If I use all cli scripts in once, so I get Error from the FGM. Thats the cause, why I splitted the CLI scripts to mutch standalone cli scripts.  My question is, gives there some possibility, install all cli steps in once? For example I can not purge the DHCP from WAN and following delete the WAN Interface. So I get a error if I will execute this script. Kind Regards

Hi all,Since few days, we have started to use FortiToken and 2FA with the Fortigate's solution. Firstly, we have users in our AD, but we couldn't add mails associate in each user automatically. For that, you have to add mails manually for each user. You have any ideas about that?In addition, we can't automate the distribution of token for users? Because with a hundred users, it's not normal to attribute tokens manually.Any help would be appreciated.Thanks,Ali

Hello friends, I need some support in the configuration of a FortiAP. I have a specific vlan (with vlan-id 99) for all FortiAPs connected to my FortiGate-firewall. This vlanis the management-VLAN for the FortiAPs. My goal is that the FortiAPs broadcast a wifi-network which is bridged to my lan-network (connected to port2 of the FortiGate-firewall). But how to configure it? If I choose "Bridge" as "Tunnel Mode" in the configuration of the SSID then the wireless-clients get an ip-address in the management-vlan of the FortiAPs. If I choose "Tunnel" as "Tunnel Mode" I get a new (wifi)-interface on the FortiGate-firewall (with the name of the SSID) and I have to define an ip-address/netmask for this wifi-interface. Would the next step be to create a software-bridge with port2 and the wifi-interface as member ports? As mentioned above my goal is to have the wifi-clients in the same network as the clients connected to my lan (which is connected to port2). Ca

Good morning,I have a MV Fortianalyzer, I saw that I can generate the report of time used by the user, but my doubt is if I can pull it retroactively. viewtopic.php?f=15&t=19269 I need to get a report of the connected time of the users per day since 01/02/2022 I saw the general option that takes the total. but I need the consumption per day. can someone help me.Regards

Hello @All, i'm on configuration of our new fortigate latest OS to allow our external companies to using the ssl-vpn client to get access to our internal systems.We have several external companies and they need to have access to different internal systems.Neither company is allowed to see the other's systems. All of them using one VPN-Pool IP-Range (exampl. 10.10.1.0/24)User Login is based on LDAP Auth.I have try this configuration:1. Setup LDAP User/Groups2. Setup ssl-vpn-portal with split tunneling "Enabled Based on Policy Destination", Source IP Pools = 10.10.1.0/24; No "Web Mode" Active.3. SSL-VPN Settings "Listen Interface = WAN"; Tunnel Mode Client Settings "10.10.1.0/24"; Authentication/Portal Mapping "I add all VPN Groups from our external Companies"4. Firewall Policy, I add for all external Companies one Rule with:   Incoming Interface = ssl-vpn tunnel interface   Outgoing Interface = Internal Port to our Systems   Source = The VPN-Pool 10.10

Hi, I have changed our core switching to a pair of ArubaOS-CX devices and wanted to move the existing Fortigate LAG on X1/X2 on a 100F (6.0.14) to go to each of the Arubas.The Aruba multi-chassis LAG can only be set up with LACP and it didn't come up so ended up creating a non-LACP LAG to just one of the switches to get us up and running. I have looked at the Fortigate and seen that the LACP type is static. My question is, can this be changed to active or passive on an already configured Fortigate LAG? Or like with everything else, do I have to remove all config and start again to create a new one?I don't want to have to travel to the site to find out it can't be changed with a CLI command. Thanks!

I edited a backup .conf file and restored it through the webGUI. This apparently crashed the firewall and powered it off. After uploading the .conf and clicking enter, the webGUI said "Rebooting system" followed by "System reboot is taking longer than expected". Now, I can no longer access the webGUI or ping the device, and a console server it's connected to says it's disconnected. I have no physical access to the device until next week. I have a rescue backup .conf file. I'm just curious what I should expect next week. Did it crash because I edited a .conf instead of doing it through the cli/gui? Will it boot to the last working config - if at all - or is it in some sort of error state?  Basically, is it recoverable?

Hi,I try to configure an automation stitch with this event:However, I can't understand why the event never gets triggered. Even on the system event logs I never find anything related to IPS db updates .. does anyone know why?Maybe because I only have the IPS license and not antivirus?Thank you

Hi, I'm still learning, wanted to get one up and runing in Hyper-V together with a Fortigate or 2.(on a local Windows 10 machine)I followed https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/9c527bde-cce0-11e8-8784-00505692583a/FortiAnalyzer-HyperV-VM-Install-Guide.pdf Dowloaded vm from https://support.fortinet.com/Download/VMImages.aspx 7.03 Reinstalled 3 times, didnt find any guide for 7.0x. Video's just show to log into gui after adding HDD and booting up. Tried a execute sql-local rebuild-db, and afterAt shutdown and the dots counting up, it always ends with Failed! =/ I guess all my questions are wrong, butAs they have 7.03 for hyper-v i guess its supported? OR should I try another version? or vm platform?Tried google the errors. reset system all-settings. How do I mount /var?

Hi all, I'm seeing every few minutes the number of sessions moving through my FortiGate spike from a few thousand, to tens of thousands, and back.How would I best identify the source of these connections?

i have seen this a couple of times and just wondering if anyone else has come across this. and can add any logic, so i can add to my notes for resolution. when the logotype has been set to CEF, via the GUI.however the format it seem to come out in the local disk value not the expected CEF e.g  expected output  CEF:0|Fortinet|Fortigate|version|etcnot the ondisk formatdate=2022-03-20 time=14:55:20 logid="1203030258" type="utm" subtype="waf" eventtype="waf-http-constraint" level="warning" 

Hi. Is it possible to view traffic log from internal device to another internal device (for example RDP connection). Currently I am not able to view any traffic from lan to lan. Appreciate your knowledge and information. Thank you.

Hi, I trying to add IPv6 to existing interfaces on my Fortigate 60E running 7.0.2 The WAN part was no problem. When adding the configuration to the LAN (internal) interface, I got an error:object check operator error, 1, discard the settingCommand fail. Return code 1 Config WAN:FTG60E (wan1) # showconfig system interfaceedit "wan1"set vdom "root"set mode dhcpset allowaccess pingset type physicalset description "WAN Ziggo"set alias "Internet Ziggo"set lldp-reception enableset monitor-bandwidth enableset role wanset snmp-index 1config ipv6set ip6-mode dhcpset ip6-allowaccess pingset dhcp6-prefix-delegation enableconfig dhcp6-iapd-listedit 1set prefix-hint ::/56nextendend Confige I try to add to LAN:config system interface edit "internal"FTG60E-BMR-001 (internal) # config ipv6FTG60E (ipv6) # set ip6-mode delegatedFTG60E (ipv6) # set ip6-send-adv enableFTG60E (ipv6) # set ip6-other-flag enableFTG60E (ipv6) # set ip6-upstream-interface "wan1"FTG60E (ipv6) # set ip6-

Dear Poeple,Nice Sunday first:-)I put a picture to explain my behaviour better.I want connect with a forticlient to FG1 to reach their network and reach the Network from FG2 too.FG1 und FG2 have side to side VPN connections.I can ping only the FG1 networks and cannot reach the FG2 networks like in picture to the network 192.168.4.0/24.Does it possibele to reach other Networks with a Forticlient over VPN Connection or not? Phase 2 all FGs and FortiClient Network are 0.0.0.0/0.0.0.0 typedIn FortiClient VPN Connections are both Network (192.168.4.0 and 192.168.5.0) typed.In FG 1 is a policyincomming: FortiClientVPNoutgoing: internal, VPN Connection to FG2incomming Network: alloutgoing Network: 192.168.4.0 and 192.168.5.0Split Tunneling ist activatedThanx in advantage 

Hi everybody, In now, I need create Policy internet access with AD account. I already Ldap with AD Server but when create policy then can not access. After that, I read document and create windows polling group, add user group with FSSO and test but user can not access internet I think, must install FSSO Agent. But I have questions below:  FSSO Agent must install on AD Server or I can install at other server with collect/polling mode ? Thanks   

Hello, I have a question about the setting of Virtual Server(loadbalance). Please see the detail as below. -There are 2 Real Servers and I want Real Server1 is Active and Real Server 2 is Standby.-If a Real Server1 fails. Real Server2 to be active instead. When Real Server1 is back. Can FortiGate automatically set Real Server 1 as Standby? I want Real Server1 is standby after coming up. I tested many settings. but when Real Server1 is back. It will always be back to active. Does anyone have a solution for this situation? Thank you.

Can someone explain to me why the answer is "client did not authenticated"? i thought it was authenticated because on the smtp session "sender ok" and "recipient ok" and also the message is delivered

Im planning to upgrade our FSSO Agent to version to 5.0.0304.But on our Citrix servers we are currently running TS Agents with version 5.0.0294. Would this cause any issues? I cannot find any information about running diffrent versions. Thanks,