Solved

HiI've just update firmware from 6.0.14 to 6.2.0 and I found that 10 free VPN license on previous release is deleted.Now, if I need to enable 10 VPN SSL connection on new release, what do I do? What is EMS? ThanksMarco 

Hi Everyone,I'm facing an issue where on my FortiGate 100F (v6.2.3 build6188 (GA)) unable to create Virtual Server IP due to there is no Virtual Server tab under the Policy & Objects. I have multiple of servers and trying to create Virtual IP for those servers and load balance it. Anyone have idea what might be the cause of this ? 

On Fortigate firewall do we need to take any actions against LOG4J ?

Hello, We recently set up a Fortigate 6.2.5 device and set up IPsec VPN for external access for our co-workers. Now, I would like to block all incoming external traffic (or at least restrict ports and so on), but I could not figure out what interface should I add the rules to. I have tried adding some restrictions to WAN1 (incoming interface) > Internal (outgoing interface) but it does not seem to work, blocking rules are ignored, and no traffic goes through in the new rules. In our previous router (from a different brand), I could simply apply a rule to the WAN1 interface, and that's all. What incoming/outgoing interface should be set to restrict the incoming external traffic? Thank you for any help!

Hi,Im running 600e appliance in my main branch.All branches connected with MPLS and doing NAT to the internet from the main branch.Last week I configured BGP with my ISP and advertised all the local subnets in my MPLS topology, and so far everything works fine. The ISP just installed a secondary backup link for the BGP and another pair of IP addresses (customer IP, and ISP neighbour IP for me to set) I'd like to know how should I configure the backup BGP link, I want to make sure the Fortigate uses only the primary link when they are both available.I'm supposed I have to change costs or something ? Very much appreciate,Thanks.

Hi, we have deployed a Fortigate cluster on AWS cloud, mostly used as a VPN/NAT-Gateway. Now as you usually have no network layer 2 on AWS, there is no ip/mac failover. As the cluster members are deployed in multiple subnets/availability zones, the interface config on each cluster member is unique, with different ip addresses and subnets. Failover is done by Fortigate using the AWS api and modifying route tables and elastic/public ip assignment. So far so good. As a consequence of the above, you have to exclude some configuration items from the configuration sync with the ha peer, namely the interface config and router static config (by default also vip configuration is excluded). As we will do definitely DNAT in our VPNs, I have removed the exclusion of the vip already. But interface config and static routes must kept excluded. Now to the issue with this: For each VPN you have to configure some static routes pointing to the tunnel interface. But now with stati

I have a pair of 200e that I'd like to get into an HA pair. My issue is that I will not be able to cable the passive one the same as the primary for a few months because reasons. I want to link them via the HA port so that the primary unit automatically sends the config to the 2nd and in case of complete hardware failure, anyone on the team can just move the cables over and the unit is ready to go. Is this possible?  Is there another solution to have the configs mirrored to each other?   

Hello, the following feed is discontinued.Anyone can help me? thank you   

Dear community My question is:Does a VRRP-IP (the "gateway") generally answer to ping/icmp requests (or not)? We have four fortigates in two datacenters (in each datacenter is an active/passive cluster). On each of those clusters are the same vlans configured and we spanned vrrp over these vlans.The goal is, that everything does to one datacenter, until both fortigates in that datacenter (or the whole datacenters) goes down...and then the vrrp-ip should go to the second cluster in the other datacenter.The ip addresses of the fortigate clusters temselves in those vlans are answering to ping/icmp as expected (because it is configured accordingly). However, the customer claims that the vrrp ip in the vlan is not responding to IP.We still are investigating, but I just want to ask whether the vrrp ip in general is supposed to answer to pings or not (to make sure we are not chasing ghosts here :)). Thanks for your helpscheuri FortiGate 

Hello, I don't understand  when to set or unset the NAT button. I have two servers on my LAN that are reachable on the same WAN with port mapping from WAN adress IP: port_to_translate to  LAN IP: port_translated.On the first server I have a SSH server without the NAT button set on the Policy  and it works.I can access the server from WAN.On the second server I have a web server ( node.js) but I have to  have the NAT switch set on.If the switch is off , I can't access the server web. In which case in port translate I need to turn the switch on or off in the policy?Thank you. Félix 34           

Hi Teams, Is there a way to show ip address on spoke tunnel interface when enable "mode-cfg" on hub and spoke site?  The Spoke has assigned a ip address from hub but no command to show.

Hi everyone!I have FG300 and FMG version 6.2.7Such a problem has recently emerged:I change the interface settings on the device, in particular, add networks to the exceptions on the captive portal. Apply this.      config user security-exempt-list     edit "DMZ-exempt-list"     config rule     edit 1     set srcaddr "DMZ Subnet" "gatchina" "IPsec subnet" "main" "medical equipment" "mgmt" "phone" "printers" "Remote access" "servers" "other devices network"     next     endEverything passes correctly. Next, I change any policy (only policy, not device settings) I apply changes and eventually get that the interface settings are returned to their original position!config user security-exempt-list2: edit "DMZ-exempt-list"3: config rule4: edit 15: set srcaddr "DMZ Subnet" "gatchina" "IPsec subnet" "main" "medical equipment" "mgmt" "phone" "printers" "Remote access" "servers"6: next7:

I am trying to upgrade my Forti Analyzer 200D appliance box firmware from 6.0.11 but i cannot seems to find the firmware from fortinet support download site ?does it means the  Analyzer 200D is EOL ? 

I have the following setup: FortiGate > FortiSwitch > FortiAP. So far I have been managing FortiAP through FortiCloud just fine. I now want to transition to managing it from the FortiGate. First of all, will the FortiSwitch that is in-between create any problems? But most importantly, when I add the FortiAP to the FortiGate, will the settings (SSIDs etc.) of the FortiAP stay? Or will the FortiGate enforce some default AP Profile, potentially removing the configuration of the FortiAP?  Thanks a lot in advance!

Hi, I'm running a FortiManager in v7.0.2, we have preconfigured "Firmware Templates" to centrally schedule Firmware Upgrades on the managed devices. Now that the new FortiOS 6.4.8 has been released, we would like to upgrade to this version.Unfortunately, I have no way to select this FortiGuard image in my corresponding firmware template.My databases on the Manager look current. Do you have any tip for me? Thanks!

I'm new to Fortinet/Fortigate and am using a 40F as a lab learning device. I have just a few configs that is causing the push install to fail. All it is :config system interface2: delete "lan3"3: delete "lan2"4: delete "lan1"5:endAll three error out with message: "The entry is used by other 1 entries.  Command fail. Return code -23" So how do I undo these commands?  I can't figure it out.

Hi all, We need dual access to a subnet: LAN (MPLS) and IPSEC VPN (Fortigate v6.0.7)If LAN (MPLS) fail, IPSEC VPN get UP as fail-over. Example in route:  S 192.168.1.0/24 [10/0] via 10.10.10.5, LAN (MPLS)  [10/0] is directly connected, VPNtunnel (IpsecVPN), [50/0] Exmple Link_monitor:  config system link-monitor  edit "Monitor_subnet_1"    set srcintf "LAN"    set server "192.168.1.x"    set gateway-ip 10.10.10.5    set source-ip 10.x.x.x    set update-cascade-interface disable  next That work fine, but when we add another subnet:   S 192.168.44.0/24 [10/0] via 10.10.10.5, LAN (MPLS)  [10/0] is directly connected, VPNtunnel (IpsecVPN), [50/0]  edit "Monitor_subnet_44"    set srcintf "LAN" *****    set server "192.168.44.x"    set gateway-ip 10.10.10.5    set source-ip 10.x.x.x  &

With AnyConnect it is possible to authenticate to RADIUS and let NPS handle which group-policy/tunnel-group the user should receive based on their rights in NPS. Is this possible with Fortigate SSL-VPN and is there anything special needed to configure this besides the NPS itself? I can't seem to find any documentation about this type of implementation.

Hi Team,  i am trying to configure the fsso with agent collector.Infrastructure:- 2 sites with 1 FGT40F (v6.4.7) per site- 2 AD with DC Agent- 1 Collector Agent per site (advanced mode) For some workstations, authentication is random.I am thinking of the laptop that opens the session before being connected to the company network? So I wanted to possibly do a redirect to the authentication portal if the user is not authenticated.I tried to apply the method with set auth-method always and 2 rules.But I don't get the portal. I also need to check that ports 139 and 445 are open as well. Do you have any suggestions or recommendations? Thanks for your help Julien

Hi all, I struggle through every step with these routers, very sorry for the noob questions but please be gentle, I don't really know what I'm doing here. So we were quickly exhausting our single class C network and I decided to run another line from the Fortigate 60E (is that a vlan or a subnet, not sure) to a new switch and give myself another 200+ addresses.  Main net is 192.168.1.0, and I made the new lan 192.168.3.0  I have the fortigate set as the DHCP server for this new segment and so far I've fought my way through to a point where clients pull an ip and can communicate internally and externally. I can ping from a 192.168.1 machine to a 192.168.3 machine, but if I try to remote in by machine name, it fails, so I have a dns issue for sure.  I have the new LAN dns set to our DC at 1.10 I'm also a little worried about security, as I basically just added policies to open everything up between the two LANs and between the wan and new LAN. I'll

Hi there, We're seeing a strange issue with the SNMP data from our FortiGate 1500D firewall.We're running version 6.4.4 and using SNMP V3. Basically it seems that the Octet data isn't being captured on our 10Gbps WAN link when under load.We have a 1Gbps WAN link and that graph is consistent and accurate. We also have some 100Gb switch links being monitored by our SNMP data gathering server, and those are all true as well - so I don't think it has anything to do with the link speed or throughput. When we load up the 10G link you can see the graph information is missing from our SNMP data gathering server, but not from the dashboard in the web interface of the FortiGate. Please see attached example photos.Disregard the Units on the 10Gbps link, just a formatting error from the graphing system. Here is the 1Gbps WAN link with no issues of missing or incorrect data. Here is the 10Gbps link that while under load is missing information and incorrect data rates.2

I am diving off the deep end going to TCL scripting for handling the provisioning of a series of remote FortiGates.  I've been working on the script in parts and while I was trying to figure out some of my input logic, I kept on getting script failures.  Unable to figure out the problem, I put up a very, very simple script: #!puts "Testing ..." I expect that this should just do a simple output of the one line and be done with it.  However, this does not happen: The log is here:  -------Executing time: Thu Nov 15 09:53:02 2018----------- Starting log (Run on device) ----------------End of Log-------------------------  The task history is here:NamePercentDescriptionEVO-0002-RT1(TCL-Test)0%2018-11-15 09:53:02:start installing script TCL-Test to EVO-0002-RT1EVO-0002-RT1(TCL-Test)5%2018-11-15 09:53:04:init state: start to get checksumEVO-0002-RT1(TCL-Test)30%2018-11-15 09:53:08:premagic state: start TCL script fileEVO-0002-RT1(TCL-Test)70%2018-11-15

I can't seem to block users from downloading .ZIP files in my environment. I configured the file filter, and the logs show that it works well with detecting and blocking .ZIP files over HTTP, such as some antivirus definition updates.This can't work for me as most online traffic is HTTPS and the file filter seems unable to detect when a .ZIP file is being downloaded over HTTPS.Am I missing something with configuring the file filter to detect and block when a user is downloading a .ZIP file using HTTPS?Is there another feature that I am supposed to use that I am missing? 

Hello, I have a single public IP address on my Fortigate.If I configured an IPSec tunnel using this address, will this interfere with my regular Internet bound traffic and incoming VIPs that also share this same public IP address ?Or should I ask the ISP for an additional public IP address for my IPSEC tunnel ?Thank you.

Dear community,  Trying to integrate FortiGate with Zabbix, so I can monitor the Firewall, however, not being able to find instructions on how to do it.  Can someone please provide information in regards this integration? Thank you,Laura