Solved

Hi,  When we have different region HUB topology in the network. Each Hub will have iBGP peer with its spoke and eBGP peer with the other region Hub. So , when we build IPSEC tunnels between the Hubs whether this should be a full mesh tunnel or a dialup tunnel?.  Should we need to add these ipsec tunnel interfaces (Between Hub to Hub) as part of SDWAN interfaces and to write SDWAN rules at hub for a spoke in one region to speak with other spoke??.. Or the other option is , without bringing HUB to HUB ipsec interfaces in SDWAN interface and just play with BGP routing ??. What is the best way to deploy and any documentation available for this. When we add it in SDWAN interface, we get benefit of running performance sla on top of it and to pick the interfaces.. RegardsRaja 

I have a second-hand FortiGate 80C and fortiap 223b,I want to upgrade them.When I downloaded it in the technical support, I found that I needed the contract number, but I didn't.Who has time to download their firmware and mail it to me,I'd really appreciate!my email 958041914@qq.com  or zlajl90712@outlook.com

Hello,Tried to make IPSEC tunnel between my fortigate and server build on OPNsense.My fortigate is 100F behind SNAT. SNAT is made by Virtual IP and forward connection form external IP to IP on loopback interface. Don't have any interface directly connected to internet so have to use Virtual IP as SNAT. Opnsense is also behind SNAT 1:1 .Something like :OPNsense 10.0.0.1/21<-->SNAT<-->95.100.100.1<-->Internet>95.100.200.1<-->SNAT on Virtual IP>10.200.0.1/32 on loopback<-->Local netIPs are for show purposes only.I've made successfully tunnel , phase1 and phase 2 is on green from both side.Problem is that  that Fortigate receives incoming packets from OPNsense but reject it as it comes from unknown SPI. In log details I have correct local IP, correct remote IP and the most important correct SPI number from both sides.I'v tried IKE v1 and v2 , with NAT nad without NAT and many other options. Nope, all the time Fortigate even if tunnel from

I can create a GeoIP and select a country to distribute the rules to the region at once. But what if I want to add or exclude some addresses in this list? I have Fortigate-600D-LENC (that is, it is not connected to cloud services and auto-updates) and I have not found a way to view the database of addresses included in the GeoIP of a particular country.

Hello, I have Fortinet Firewall 200E with SDWAN configured and I need to configure a VPN ipsec Client to site  I create the tunnel, I added the policy I can connect but I cant reach the local subnet  is there any think specific with sdwan  just for information it works within SDWAN thx for help  

Dear FortiMail Expert,Pls bear with me, not so technical questions. I just want to hear how others may address such questions.I bumped to one of my client and asked me the ff entries in FML Datasheet. Is anyone willing to share his/her tought on below items?1. Recipient-Based Policies (per Domain / per System) —Incoming or Outgoing800 / 3,0002. Antispam, Antivirus, Authentication, and Content Profiles(per Domain / per System)50 / 403. Email Routing (per hour)**1.5M3.a FortiGuard Antispam + Virus Outbreak (per hour)** 1.0 Million-->these numbers are bidirectional or intended for inbound only?  thank you in advamce

 Hi, Did someone face a block on all in the last 2 hours google.com and www.google.com starting to automatic block duo to sandbox block?Fortigate version 6.4.6 - 6.4.8

Hi,I use the below query to provide a summary of every user that hits the categories identified in the list. I would be very grateful if anyone knows of a way to include the Source IP address as one of the returned columns. Given that lots of our users have more than one device, it would mean I wouldn't have to go back to the Analyzer for confirmation.Kind regards,NetMan_Bath selectfrom_dtime(dtime) as timestamp, user_src, catdesc, hostname as website,action as status, sum(bandwidth) as bandwidthfrom###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src,dtime, catdesc, hostname, utmaction as action,sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidthfrom $log-trafficwhere $filter andhostname is not null andlogid_to_int(logid) not in (4, 7, 14) and ((logver>=52 and countweb>0)or((logver is null) and utmevent in ('webfilter', 'banned-word', 'web-content','command-block', 'script-filter'))) and (catdesc='Child Abuse' or catdesc='Child **bleep**ual Abuse' or

Hi all, I setup user auth with FSSO DC agent mode, and as there is many entries I would like to filter a bit.The filter criteria I would like to setup is based on the workload IP addresses.I have many users, connecting from home, that have FSSO entries with their own private home IPs.For example. user lamdba is seen with its VPN tunnel IP to Office and its private IP (so 2 FSSO entries).As the last ones are useless for filtering, I would like to know if it is possible to filter on DC agent or Collector Agent ?Thanks a lotFB

Good evening,  Experiencing an issue with FG Routing can anyonn assist,  I have the following setup on a Proxmox node: 1. Ubuntu (Client) 2. Foritgate Firewall  The Client has two interfaces attached with the following networks: 1. 192.168.61.X for management 2. 192.168.10.x (shared network to reach the Fortigate) LAN The Fortigate has three interfaces attached with the following networks: 1. 192.168.61.X for management 2. 192.168.10.x (shared network to reach the client ) LAN3. 192.168.100.x (WAN Interface to reach wan router) I cannot get internet on the client through the FG.  I can ping between both the client and the FG on the  192.168.10.0 network but if i try to ping an external network from the client with the FG as the gateway there is no reply.  After running sniffers and debug flow i can see the packet reaching the Fortigate with the following output:    FortiOS

Hello,Looking for best way to configure one of multiple wireless 223E repeaters so it broadcasts on a dedicated 2.4 GHz SSID.  Is this configured at the switch MGMT port or on the repeater itself?  There are multiple units all with the same SSID and password and both frequencies active, so there's no control over 5GHz or 2.4GHz connection.  My device does not work with 5 GHz.  Thank you.

Hi all! I'm looking for a model of P2P Wifi antennas that would work to pass the Fortilink P2PL2 over it to extend some networks over 800 meters and some close to 2KM. I can't find any model that are certified to work with the Fortilink.  If you have experienced it successfully, I'd be very happy to hear from you.  Thanks !

Hello all Is it possible to add (external/thirdparty) lists of BotNet IP addresses in the AMP/AV profile or the IPS sensor? As far as I can see it is possible to add thirdparty/external AV-Lists, however, I am not sure if AMP/AV does check IP addresses or if those thirdparty/external AV-Lists need to be AV signatures.As far as I can see there is no option in the IPS profile/sensor to add external lists. So my best guess at the moment is, that it this is no possible - did someone do this by any chance and can confirm that it indeed might be possible? Thanks a lot, much appreciated

Hello Team, We’d like to acquire an SSL certificate to use in the Guest Portal of FortiAuthenticator, but I have some doubts: - The certificate needs to be issued to a public domain (public dns resolvable) or could I use a local domain (mycompany.local)? Example, issuing the certificate to the CN fac.mycompany.local would work? I ask it, because the company doesn’t have a public domain (mycompany.com, for example). The second and last doubt is if I can use a certificate with wildcard, for example issued to *.mycompany.local, is that possible in the FortiAuthenticator? And in the FortiGate, is that possible to use certificate with wildcard too? Cheers,Gui  

Hello guysI'm Facing a problem with the log's in the forti-cloud option meanwhile it's displaying in memory but not displaying in the forti-cloud option. it was able to show 3 days ago but not showing now. so logs not reflecting in reports also In log settings,1) Memory = enabled2) send logs to Forticloud = enable (added my email and tested connectivity)upload option set to every 5 min.3) Log setting Event logging & Local Log Traffic set to all4) GUI preference Resolve Hostnames & Resolve Unknown Application is enabled please help me to resolve this issue 

I am trying to configure the file filter to block ".scr" file extension which I see is missing on my FortiGate. Is there an alternate and/or customization to block .scr file extensions?  Firmware - v6.4.8

Hello We have an environment with two sites: Site A and site B. Both sites have a Fortigate in the edge.There is a Site-to-Site VPN between this two sites. We'd like to configure in the Fortigate from site B a NPS Server that is in the site A (through VPN). Is that possible? I have tried to do that, but the NPS Server is showed as offline in the Site's B Fortigate and never goes up to online. In the site A, the NPS Server is showed online and is working fine. Is there any configuration that I have to set to the Site's B Fortigate communicate with the NPS Server in the other side of the VPN? The subnet where the NPS is placed is in the "crypto map" of the VPN and there is a policy allowing the communication. Thanks in advanced.

Hi, I am new to FortiGate Firewall. I created a VIP with port forwarding to one of our internal servers. Do I need to enable NAT in the firewall policy? If no, may I know why?  

Hello all I have an odd issue:I have TWO different cluster of fortigates (four fortigate 1100E altogether, two active/passive cluster). On each of those cluster the port 25 and port 26 are aggregated to one interface.Now it turns out that the MAC address of this aggregated interface has the SAME MAC address on EACH of the clusters.Unfortunately those two clusters have this interface in the same network - so that poses an issue. Any one an idea why this happend and how I can actually change the MAC of an aggregated interface? Thanks a lot

I am using the free version with FortiGateCloud.The free version can save logs for 7 days.Please tell me how to extract the memory conserve mode log from the system log for 7 days.-In FortiCloud, it was not possible to filter by message.-When I downloaded and checked the log (.gz), there was a period when there was no record.Download on 2/22 → Logs can only be downloaded from 2/10 to 2/18Thank you.

Hi,I would need to include only F5 signatures in an IPS policy.Of course, I know that they can be added individually, only then if new ones come out they won't be added automatically or am I wrong?Is there a simple and effective way to include only F5 signatures and all new ones in case they come out?Thank you

Hi!I want to sort the column "last used" in "Authentication -> User Management -> FortiTokens" but it does not work.I can sort "Token Type" and "Status" for example, but not "last used"Also exporting the list does not seem to be possible.(I tried in Chrome and Firefox) Am I doing something wrong or is it a bug?  

Hi, What are the benefits of having Fortimanager to act as Fortiguard server for all the Fortigates which are in SDWAN fabric? . Fortimanager will be one of the DC LAN IP which has reachablity to all the branch Fortigate over SDWAN Fabric. My observation1 This will ensure that all database updates will happen locally within the fabric from Fortimanager to all Fortigates.2 Not each fortigate needed internet connectivity..3 Just ensure Fortimanager alone can speak with Fortiguard to get all the signature, database updates. Once this is done, it can push to rest of the device4 It can also avoid impact to Webfiltering/Email filtering service, since any high latency from Fortigate to Fortigaurd webfilter service can cause "A rating error occured" These are my observations, whether I am correct or any other benefits I have missed. Or anyother caveats in this setup.

Hello, I'm using FortiClient (7.0.2.0069) on macOS Monterey and I'm having a problem connecting to SSL VPN. Sometimes it connects, however, most of the time it does not, and when it doesn't the output says that I'm connected but "Bytes Received" does not move from 0.13 KB and "Bytes Sent" does not move from 0.5KB.  I've talked to our company's tech team as well as others, but we can't seem to find the problem. Does anyone know what could be wrong or have had similar experiences? Thank you for your time!  FortiClient  

Hi, I have a scenario..I have sdwan rule with source as 10.50.10.0/24 , destination as 10.90.10.0/24. Source is Spoke1 network. Destination is spoke2 network.. These networks interfaces are configured as vlan interface in the respective Fortigate devices. When I check the session for the source user PC (Took an ip as 10.50.10.11), it was hitting in the correct Service ID (Service ID 10) and end to end ping is happening.. But when I check the ping session with source as firewall Vlan interface (10.50.10.1) then I could see this session is through SDWAN default rule (SDWAN service 0). Since my vlan interface also falls under 10.50.10.0/24 my ping from vlan interface to other spoke IP should go through service ID 10 only but not sure why it is hitting default SDWAN rule (Service ID - 0). IS this an expected behaviour or I should raise a TAC case for this issue??