Solved

Why is this so hard? I have a 60e 6.4.8 FileZilla keeps coming back with Port command tainted by router or firewall.Machine is in a firewall rule that allows ALL.Deep packet inspection on all ports. Also tried it with no packet inspection and no security profiles at all, just for giggles.I was reading online about a service FTPoverTLS. I don't even have that service. But again, ALL is allowed.I'd hate to open a ticket on this, it seems like it should be easy enough.Any help would be appreciated.

Hi All, Can the Let's Encrypt Certificate (using ACME) be used for SSL deep packet inspection.  As of now, we are using Fortigate Self Signed certificate for SSL Inspection. But it is difficult to manage certificate installation for the guest users. 

I try so much times and always display error. Could anyone help me to solve this problem, or provide some document to reference? Thanks a lots!  FortiAuthenticator 

Hi, I'm trying to add some local and remote addresses on my VPN Tunnel Phase 2 Selectors and after I added all of them, I've encountered a red box when saving it. Is there any limitation or any incorrect configuration happened?

Dear people can somebody explain me the marked bold places: 2021-12-22 11:44:37.472461 VPN-TU -- 10.99.19.12 -> 10.15.12.1: icmp: echo request2021-12-22 11:44:37.504576 VPN-TU -- 10.15.12.1 -> 10.99.19.12: icmp: echo reply2021-12-22 11:44:37.508988 VPN-TU -- 10.15.12.83.40820 -> 192.168.40.53: udp 292021-12-22 08:53:50.466435 VPN-TU -- 10.15.12.83.52751 -> 10.15.12.109.9100: syn 638097597I will analyze the traffic over the Tunnel to reduce the traffic to the necessary ports on policys.So I am not sure, what does it mean exactly, and wich policy are necessary to get a hit on the right policy.Thanx a lot! 

Is there any fortiswitch OS image available for the EVE-NG lab?

HI guys , I Have FG200F   , after turning IPS on  our LAN ,Anydesk has become very slow , it takes ages to connect , but after when i turn IPS off , it works correctly ? does anyone have any idea to use IPS and still be fast

HelloI have two fortigate devices 500E and 600E ... I know in this case that I can't benefit from HA..So right now I'm just using 600E in my production network.Is there any way that I can get the most of these devices together ? Thanks

I have multiple FortiGate running v6.4.8 with FortiAnalyzer (VM) v6.4.7 for logs. I am planning to upgrade the FortiAnalyzer (VM) to v7.0.2. Wanted to know if there will be any logs that may discard on the FortiAnalyzer when FortiGate running v6.4.8 FortiOS? Due to the existing FortiGate model that does not support  to v7.0.x wanted to check on this.

Authenticate with user/pass vs access_token. I have succeeded to authenticate with a user/pass against the Rest API where i put the username/secretkey as the payload in the body with a POST method. Have also succeeded to authenticate with the access_token with a GET method by appending the access_token in the URL (with ?access_token=<token>).I would like to authenticate with the access_token, but put it in the payload as a POST-method. Because when authenticating with the access_token in the url it will not be encrypted over the https tls channel. So, my question is.. how do i authenticate like the above username/secretkey but with the generated access_token (Rest API key) instead?I have tried to replace the password with the access_token, but do not work. Thanks in advanced 

Hello...I used to have one WAN line that handles all the traffic to outside... Recently I added another 2 lines which I combined as an SD-wan interface, and when trying to configure static route I got the message:"you cannot have duplicate routes on SD-wan and non SD-wan interfaces" I need to keep the first WAN interface separated and don't combine it with the other two inside the SD-wan interface... What should I do to accomplish this ?? Thank you

Has anyone else seen this?I am running a regex match against the word Fortinet, the OID response to .1.3.6.1.2.1.1.1.0 comes back with the Description entered, which is against most of the SNMP standards I have ever seen.I am running 6.0.9 on the hardware in question.   Models tested:500D, 2201E, 60F, 100FCan anyone confirm this?It would appear to be a bug?Thanks for the assist

Hello, I am new to fortigate.  For model numbers such as Fortigate-60, Fortigate-80, Fortigate 100, does BGP come with these devices?  The spec sheets do not have routing protocols. thank you,

Hi all, I have problem with several objects on FortiManager:These objects I used for SSL-VPN and I decide that remove that option.So I remove SSL-VPN settings, and also all settings in policy package but when I trayremove users, user groups and LDAP Server, I receive information that objects is used somewhere. When I click to see where is object used, I get No record found and I cant remove that object.How can I delete these objects at all? Thanks        

I saw several similar problems on this forum, but not exactly like this.So, I have: ISP1, ISP2 ,ISP3 links. First two are in sd-wan mode. And I used it for surfing. ISP3 used for business network. My branch office used vpn site to site, and connect over ISP3. My static route is:0.0.0.0 -> sd-wan x.x.x.x -> ISP3... other routesx.x.x.x is branch office ip but dynamic change every 24h. So tha vpn to work I have to manually change the address. And this is a problems.1.  I try replace 0.0.0.0 -> sd-wan with 0.0.0.0 -> ISP3 and set SD-WAN in Policy Routes. But I cant add SD-WAN interface in Policy Routing Rules. Only per interface. So that is not solution.2. I try add ISP3 to member sd-wan, and used sd-wan rules. But If I make this, I cant use independent interface ISP3 to Firewall Policy. Also not solution. Before Fortigate I used Checkpoint, and that vendor have option to set outgoing interface for vpn, independently of static routes. Is there anyt

Hey guys,I'm trying to create a new IPsec tunnel from my FortiGate using a costume selections.For some reason I cannot create the tunnel itself and I'm getting a red box over my phase 2 selectors.I tried using the specific addresses I wanted and also 0.0.0.0 as local and remote addresses but still getting the same red box with no error.What could be the issue here?Thanks!

Hello,   I have recently taken over a site that has a Pair of FortiGate 100F's (6.4.8). Looking at the GUI I see VDOMs are not enabled. When I query the Sys Global Full Config VDOM-MODE is set to NO-VDOM.  However when I query the System Interfaces I see that the MGMT Port is not on the Root VDOM. I believe the prior person manually set this and setup IPs so he could manage each unit separately via the MGMT Port as each has it's own IP and HTTPS and Management enabled.  Is there some documentation on setting this up or did he just do this himself. Is this a viable config or will there be possible issues to look for?

Hi, relatively new to the world of PCI compliance as well as certificates and need some advice. A PCI scan continues to fail with the certificate connected with port 8013 being the issue. I cannot for the life of me find the service that runs on that port to either shut it off or correct the certificate issue. Any help is greatly appreciated.

Hi Experts,I am new to this community and would like to ask for help and advice from all the experts out there.Has anyone here already encountered an unexpected power-off and when you check the event logs it the power-off shows 15 minutes late. I have a Firewall that suddenly went down at 2:15 PM then went UP again at 2:30 PM. When I check the event logs it shows that the Fortigate had experienced an unexpected power off at 2:30 PM which is 15 minutes late.Best Regards,

Hi, recently I made update of my FortiGate's 60E working in HA.I notice after update has changed MAC address of Hardware switch, Internal1 where got connected all VLANs, from something like xx:xx:xx:09:00:12 to xx:xx:xx:09:00:03.Is it normal, or I missing something. In cluster, Primary Fortigate after update is this same Fortigate.I'm curios because we had also EMS, and configured On-Fabric Role Sets with Local IP/Subnet and MAC, and after update and MAC change some FortiClients think are off fabric because of MAC not right.

Hi! We use Fortigate 6.4.6 and we didn't upgrade to 6.4.7 and 6.4.8 because we use a collector fsso agent in ldaps.  It seem strange to me that it cannot work for the last 4-5 month, and I see almost nothing on internet around this problem.  Is it under other specific condition? Thanks

I am having a weird problem with a testing FAC instance. It's a VM with private IP 192.168.1.109. It's in a isolated environment and I am using a jumpbox machine 192.168.1.100 to access it.  The issue is if I access it by https://192.168.1.109/ , it's fast ( will show me a certificate warning as expected ); if I access it by https://fac.mydomain.local/ ( no certificate warning because the certificate is generated by a Windows CA and the root CA is trusted on the jumpbox),  it's very slow. The VM is configured as Host Name: "fac", Device FQDN: "fac.mydomain.local" . fac.mydomain.local is added into Windows hosts file map to 192.168.1.109.  Chrome Browser dev tool shows lots of requests took 5S~10S to load :same "dashboard/" request only take 200ms if I use IP to access it. I can refresh the UI and got same result.   

Hi everyone, I’m faceing a strange issue on a FortiGate. I have two 100F running in an A-P HA Cluster. I have an aggregater interface connected to a Cisco Nexus 9K. The LACP between the Cisco switch and the 100F FortiGate is up and running. I’ve created serveral VLANs on the aggregated interface. They are working perfekt. Today I added another VLAN interface to the aggregated link on the FortiGate. I’ve confirmation that the MAC andres of the VLAN interface is pressent and detected on the Cisco Switch. However… The L3 IP that I have configured is up/up on the FortiGate, but I’m unable to ping the interface from the FortiGate itself. After some basic troubleshooting, I came across that the IP/network of the VLAN interface doesn’t show up under the locally connected part of the routing table. I’ve been unable to solve the issue so far. By the way, I’m running FortiOS 6.2.9.

I have 2 FortiGate 51E's that are at remote sites but connected together using a LAN port on each firewall, connected over an ISP provided LAN Extension. Both of these FortiGate's are on the same private subnet and talk directly to each other. Is there a functionality available where I can let each device discover each other? Connectivity and traffic routing is working fine, I was just wondering if there was a similar functionality like the Managed FortiSwitch interface where I can see each hardware device connected to each other and was wondering if that was a thing, and if so, what other additional functionality would that provide? Both FortiGate's are running FortiOS v6.0.12 build0419 (GA)

We have a splitted subnet: LAN2: (physical interface)172.29.6.1/255.255.255.128 for FortiAP's Wi-Fi SSID:172.29.6.129/255.255.255.128 I have connected a cabled physical device and given static ip details:ip:  172.29.6.201gw: 172.29.6.129sub: 255.255.255.128  Was hoping I could reach this device from the Wi-Fi clients, but no good. All good when connected to cable though. Where am I going wrong here? -PM *edited LAN1 to LAN2