Solved

Good day. I'm struggling with next problem We are using SSL VPN connection with two auth services LDAP and RADIUS (2FA thought FortiAuthenticator).And we were surprised that FortiGate sends auth queries (according to authentication rules in SSL VPN configuration) simultaneously. It's f***** ridiculous.My bosses cardinally against of using realms. They demand to use single URL.Yes usually we don't have problems because use individual groups.But we have several groups which must use 2FA but, if FAC will lay down, they have to use LDAP.And without realms it's impossible to do auth rules configuration for these groups.Is it possible to delimit users (without and with 2FA) with using single URL and without realms? For example:config authentication-ruleedit 1set groups "User_Group_1_2FA"set portal "User_Group_1"set auth radiusnextedit 2set groups "User_Group_2"set portal "User_Group_2"set auth ldapnextedit 3set groups "User_Group_1"set portal "User_Group_1"set auth l

Hi, I'm superadmin on my 60F (v7.0.3) and I want to configure the license-expiring-warning via CLI. I did this on two other 60F before but on the third one, I can not set this configuration and I can not see it via the CLI as well. Do you have a hint for me? Thanks! 

Hi,I'm using a Fortigate 1500D with VDOMs in 6.0.14.Here is my network topology :Initialy, there is only N2 and N3 communicating with a static route on my firewall by R1 and R2.My goal here is to add N1 which has to communicate with N3 using IPSEC connection over internet.To do so I first tried to use policy routing through IPSEC using this CB which didn't worked.Then I tried applying policy routing between N2 and N3 so that I could use static route for the IPSEC routing.It only worked half way.Here is my policy routing configuration :When I'm pinging from N2 to N3 it's OK but on the other half, it's impossible to ping from N3 to N2.Packets arrives to the firewall by R1 but the firewall isn't routing them. Here is a packet capture from the interface between the firewall and R1 :Nothing is comming on the packet capture on N2.What am I missing here ?

HI THERE ,i have really big problem , im doing  Outbound SSL decryption  with deep packet inspection on my fortigate , i have 10G connection , but when i use deep packet inspection my download speed limits to 200kbs or something near that, my upload is just work fine , and when ever i put SSL Profile to no inspection it gets fixed . i dont have any overhead on my device. what the problem could be ? Thanks in advanced.

Dear community  I want to execute the following: -> execute backup config tftp backup-stitch.conf 100.100.100.100 But I need to change the source-ip of the firewall from were the backup script is triggered. Is there a way to change the source-ip in this script?  Thank you,Laura

Hello friends, I am having a problem with a "FortiGate 40F"-firewall. Is it possible to delete a SD-WAN-Zone without loosing the connection to the Web-GUI? I only have access to this firewall over the internet... no physical/local access to it. Will I loose access to the firewall over the internet when I try to remove the member ports of the SD-WAN-Zone and subsequently delete the SD-WAN-Zone? The connection to the Web-GUI of this firewall is establised through one of the SD-WAN-member-ports. Would be nice of you to help me whith this question.

How do the VIP address are source natted and the purpose to bind a VIP to an InterfaceHere to clarify the way a VIP address can be source natted on an external interface. A Vip address could need to exit WAN1 using the same its IP address or using a dedicated ip pool, but the way to do it is not so obvious.In some configuration the behavior of the VIP in SNAT, sometimes, could seems to work badly, for example the address could be source natted every time with its vip address also for internal traffic or not natted with its vip address but with the ip pools used by the policy. Following all the different cases and the results shown Initial configuration:WAN1 Interface ip           : 172.16.100.200/24DMZ  Interface Ip             : 192.168.3.1/24LAN  Interface Ip              : 192.168.2.1/24 VIP with

Hi, Is it possible to change Fortiauthenticator management access port from 443 to other? Farooq

Hi, everyoneHow can I change the value of Default Distances I would have to change the DHCP value, which is moderately default to 5 and static to 10. I would like to set DHCP to 40 or higher. Anyone know how I can change that? many thanks for your help.

HeyHow can i add admins account on FORTISWITCH through CLI? what is the commands? Thanks

Hi guys,I hope you can help me as I am just too dumb right now. My setup looks like the following:2 sites, both with a Fortigate for WAN connectivity and between the sites are 2 L3 devices connecting the sites with eachother. Site1 has Area 0 and other areas directly connected to the L3 switch and area 0 is also used for OSPF connection to the Fortigate. The L3 switch inject default route to the other site - connected by OSPF stub area.The second site has a L3 switch as well, connected with the same stub area to the firewall there.The plan is to use the default route from site 2 fortigate for all site a connected devices (so Fortigate Site 2 needs to inject its default route into the stub and overrule default route from Site 1). In case of failure or health links jitter is too high, the default route should be discarded and now Site 2 should take the default route injected from Site 1.For testing purposes I even disconnected Site 1 from Site 2 but still on my L3 switch I cannot get the

i have some local VPN users in my fortigate firewall.We need to change them to radius authentication, is there any way to change in CLI instead of re-creating them in GUI ? edit "user"set type passwordset two-factor fortitokenset fortitoken "FTKM9E3E"set email-to "email-address"set passwd-time 2021-09-21 11:18:52set passwd ENC password 

Hi , i have turn on Deep_Packet_Inspection on my lan to outside , i havent  moved my whole network behind firewall so some part of network is behind firewall some isnt , for example my vCenter is not behind firewall yet , i have put Deep packet inspection on my lan to all outside traffic, and i have imported the firewall certificate, i dont have CA server .  the problem is when i log into my vcenter, i cannot use VMRC consol, it says SSL negotiation failed , i have imported firewall Certificate onto vcenter, but still same thing , any idea or solution ?   i have also added Vcenter in the exempt addresse it only helped me to open the vcenter it self, thanks in advance

Hello,I currently use an analog PBX. I have a PSTN connection to the router, and from the router the PBX is connected to the phone port. I currently have 6 VoIP lines for my PBX and all of them go through this route to the analog PBX. I want to transition to Fortivoice, and I am thinking of getting the Fortivoice 100E. The thing is that this model does not have any FXO ports to connect the analog line to it. Since the lines are VoIP, will it be possible to connect through ethernet from my router to the Fortivoice and have telephony like this? Thanks a lot in advance.

I' m trying to figure out how to backup over SCP. I' ve enabled ' admin-scp' in config sys global, but am now trying to actually figure out how to use it. Anyone able to get me started? Thanks.

After deployment Win10 x64 (with preinstalled FortiClient 6) I have in FortiClient Enterprise Management Server console all my computers with one serial number and UID2.How I can change this (SN or UID2) to split my computers in FC EMS?

Good day, I'm setting up a Tacacs.net server to authenticate all our FGTs and it's working fine.But, when a diferent (TacacsUserGroup) tries to log in a FGT which doesn't have configured it's (TacacsAdmin_profile), it logs in as a super_admin instead of denying access. Tacacs.net config for that group: <Service><Set>service=fortigate</Set><Set>memberof=FGT_access</Set><Set>admin_prof=csu</Set></Service> debug fnmbad [705] parse_author_reply-Authorization arg0: memberof=FGT_access[705] parse_author_reply-Authorization arg1: admin_prof=csu // This profile doesn't exist in the FGT.[709] parse_author_reply-Authorization result=2[788] auth_tac_plus_result-Passed group matching[1059] find_matched_usr_grps-Group 'tacacs_access' passed group matching[1060] find_matched_usr_grps-Add matched group 'tacacs_access'(2)[217] fnbamd_comm_send_result-Sending result 0 (nid 0) for req 637653419, len=2000[747] destroy_auth_session-d

I have Fortigate 200b unit. I want to give an access to my internal web server to users outside. I read documentation about a port forwarding. But I have a small question. The VIP address can be the same as the external address of the interface ( the interface that connects your FortiGate unit to the Internet)? Thanks in advance for your reply

hello Two questions please: 1- What does it means the default action in the antivirus profile ? what if I select "none" ?"see screenshot" 2- What is the recommended version and is there any path to upgrade from 5.3.3 to the recommended version ?  

Hello all, I've had a look through the documentation, but can't find any information about what URL access forti sandbox needs to function properly. We'd like to lock down the internet access the devices have, but need to make sure we don't cause any problems. Can anyone point me in the right direction?

Hi there, i got a problem with a Fortinet FortiGate 60C. I saved my configuration and after that i restarted the fortigate, using the console port (and putty with an opened COM connection) i managed to format the boot.After that i'm unable to connect to a TFTP server because it seems that NO port are working (WAN1, WAN2, DMZ, 1to5)Now i'm unable to boot and unable to connect to a TFTP server to flash the firmware again. Is there any solution?Thanks

Hi,I have a 40F and want to use it for websecurity. At the moment I use a PfSense firewall with 2 internet connections and a 4G backup. Because I don't want to configure everything new at this time (homeoffices, second branch connected via Wifi, Vlans etc...) I only want to secure the traffic to our terminal server as everybody uses this server for webbrowsing.TerminalServer is 192.168.100.2PfSense is 192.168.100.169.I set the Lan address of the FG to 192.168.100.168, set a route 0.0.0.0 to pfsense (192.168.100.169) and changed the gateway on the server to .168. This works for outgoing traffic, but not for incoming traffic. I also created on the pfSense a default route for 192.168.100.2 -> 192.168.100.168. But this did not help.I think segmenting the subnet would be an option, but .1 is taken and connot be changed, alsochangeing   the address of the TS would be a lot of work.  Can anybody tell me if it is possible what I want to do and how? I know this is not bes

HelloCan i configure FORTIGATE in order that internal LAN interface on PORT1 (VLAN30) of the FORTIGATE can comunicate to the builtin DMZ interface (no VLAN)?I setuped IP 172.16.30.1 on LAN (port1) and 20.20.20.1 on DMZ Interface but im not abble to ping from LAN to DMZ (i have INTERNET on both interfaces)....what could be the reason?thanks

Probably a dumb question... I only want to access my fortigate through VPN. I am using the forticlient to establish a SSL-VPN connection. How can I then access the Fortigate web admin Gui? What IP do I have to enter in the browser. Do I have to configure other setting? Thanks. 

Hello All, I was looking for a little clarity on the behavior of using a deny policy. The goal is to deny a subnets outbound traffic to a specific service, for example http. When you set the action to deny http does that same policy implicitly "allow" all other services?