Solved

Hi , I'm not familiar with Fortinet at all.  I would like to understand what is the best practice when we need to enable a connection to a site like Github and such .Since the certificate copy  produced by Fortinet replacing the original Github  certificate isn't valid by the client and we get a SSL error. So how do we deal with such a situation ? i.e allowing SSL connection to Github ( as an example ). I would be much obliged if you could answer me as to a completely noob.Thanks  

When creating a backup config file from a ipsec connected Forticlient and using that file to create a new Forticlient only the username shows up when installing the custom Fortlclient on a new PC.How to modify the config file that also the password is transferred to the new PC.We using Forticlient 6.0.10.0297.

Hi I  Have maybe a bug in my 6.0.14 OS   httpsd 18282 R 98.9 0.0dnsproxy 439 S 17.7 0.5ipsengine 598 S < 11.4 0.3updated 2059 S 11.4 0.2ipsengine 579 S < 10.4 0.3ipsengine 606 S < 10.4 0.3ipsengine 591 S < 10.4 0.3ipsengine 580 S < 10.4 0.3ipsengine 588 S < 10.4 0.3ipsengine 603 S < 10.4 0.3ipsengine 602 S < 10.4 0.3ipsengine 583 S < 9.3 0.3ipsengine 597 S < 9.3 0.3wad 526 S 8.3 0.4ipsengine 582 S < 8.3 0.3ipsengine 610 S < 8.3 0.3ipsengine 589 S < 8.3 0.3ipsengine 604 S < 8.3 0.3ipsengine 605 S < 8.3 0.3ipsengine 586 R < 8.3 0.3 This causes excessive slowness in the GUI - it happened only after i upgrade from 6.0.10 to 6.0.14 i tried this :fnsysctl killall httpsddiag sys kill 11 172  but it didn't help  What can i do more ?

Hello, I am wanting a layer 2 trunk (supporting 5 VLANs) across a dialup IPSEC tunnel.I will have two Fortigate 60Es on each end for the L3 IPSEC tunnel, then will use VXLAN for the layer 2 trunking.In theory this should be possible with FortiOS, correct ? Thank you.

Hi,I wanted to figure out the best way to add signatures to protect a particular service, and make sure I have everything included.For example how could I filter or IPS signatures to properly secure OWA? Or to protect web servers? Thanks

Hello Experts,  I would like to access one of local address in another local network but still no news. On Fortigate 80F(FortiOS v7.0.2)  I set something that  you can see below: Firewall address:edit "LAN-CUP-10.2.x.x/24"set uuid e1e4a43a-4234-51ec-1d33-78ef82b1ea54set subnet 10.2.x.x 255.255.255.0 config firewall policyedit 17set name "Any to CUP"set uuid cc69133e-6340-51ec-a051-06a9cb3d812bset srcintf "any"set dstintf "any"set action acceptset srcaddr "all"set dstaddr "CUP-Portal" "LAN-CUP-10.2.x.x/24" "Portal"set schedule "always"set service "ALL"set ssl-ssh-profile "Test for Portal CUP"set logtraffic allThere is also static route for destination network.  Inside the Firewall  I can ping 10.2.x.x/24 but from source network (192.168.10.x ) can not ping 10.2.x.x/24. Do you have any ideas? Thank you so much  Best,Ghasem  

Hi,I'm trying to figure out what could be the best solution to block access attempts to our SFTP server on a specific port (type 2222). The Dos policy seems to me a valid option, except that it presents some problems: putting a high enough threshold does not mean that all attacks are correctly intercepted.Conversely, putting a threshold too low can lead to false negatives.Could it be a solution to create a custom signature? In case I should somehow decrypt the traffic or am I wrong? How could this be done in your opinion?Thank you very much

Hello Experts, I have a one Fortigate ( 80F) with last version of firmware(FortiOS v7.0.3 build0237). I added some policies on it and installed it for our client. Our client claim that he can not access to their local server which is in same IP range, I mean for example from 192.168.1.2 can not access to 192.168.1.250. He claim that when restarting the Fortigate its working fine but after for example 5 hours again Forigate  dropping all connection and as result again he can not access to their server.  Have you ever seen this kind of issue? Could you please give me some advice?  Thank you, Ghasem  

Hi all, Base my need, I use reset button behind firewall to reset mine 90D.I can not login web UI (https://192.168.1.99) using default admin and without password after I reset it.It always show me password incorrect. Is there any good solutions to resolve my question?grateful thanksPoter

Hi,I have a problem with a job backup by the Automation Stitch.When i execute the backup by automation stitch i see this error: "Connect to ftp server 192.168.50.50...Error code 1: File not foundSend config file to tftp server via vdom root failed.Command fail. Return code -1" But if i copy and paste the command in the cli console, the backup work correctly.Any idea? Thanks  

HeyI want to control the access to the WI-FI network by MAC-ADDRESS but i cant seem to find the place how to configure; i'm managing FORTIAP by the the fortigate.Is it possible to control devices by MAC-ADRESS on the WI-FI network?

HeyIs it possible configure DHCP Snooping by the GUI? i'm managing the FORTISWITCH using the FORTIGATE but i cant seem to find the place to configure DHCP Snooping..

I am playing around with a GNS3 setup with two Fortigates in a cluster.  Is there a CLI command that would similar to diag sys topshow me similar output  likeget syst ha status...but in a "live" view?  On linux, I would dowatch "get syst ha status"... Is there something that would show me the cluster status in a live view? The HA Status widget in the GUI does not help much because I loose the session as soon as the Fortigate Cluster switches... Dan

Ubuntu Linux computer has two network interfaces:wlx1cbfce8bd2bd:  inet 10.1.1.129 netmask 255.255.255.0on this network, there is a device:  10.1.1.10 - with a UDP port 10000 that I wish to make accessible from the internet. the second interface is....(this is connected to Fortigate)enp4s0: inet 192.168.1.80 netmask 255.255.255.0 Fortigate LAN IP is:  192.168.1.1  I wish to enable somebody to connect to the UDP port 10000 of the 10.1.1.10 device from the internet. I do know how to set up NAT(Virtual IP) and IP4Policy to forward traffic to 192.168.1.80  - but I do not know how to do it to 10.1.1.10   I assume I need route(s) on Fortigate, as well as on my PC (192.168.1.80) and som eiptables?  to achieve that. 

Hello, I want to identify all BGP learned routes on a Fortigate and then apply a BGP Community attribute to them.I am using an inbound route-map on the BGP peer for this purpose, however it does seem to work. Is this the correct way to do this ? config router route-mapedit "HG_CORP_ROUTE_MAP_IN"config ruleedit 10set match-origin egp***matching all learned incoming BGP routesset set-community "7714:65100"***setting the community

Hi Folks, This question is super easy.  Sadly, I've used a few $ervice provider$ and I have to learn this stuff on my own. I have two devices - a Fortigate 60F and now a Fortiswitch 108E.   On the Fortigate, I've configured port 'b' to 10.30.10.0/255.255.255.0 for example.  On port 'b' of the Fortigate, I have a cheap managed switch that works.  My computers all have manually configured IPs and they are working.   The problem is that traffic is not being managed by my cheap switch, and the solution is a better switch. The problem: How do I change the IP/Netmask from port 'b' to the Fortiswitch on port 'a'?So far, I have the Fortiswitch registered in Forticloud, the Fortigate recognizes the switch and I have configured a 'FortiLink Interface' with an IP/Netmask of 10.31.10.1.255.255.255.0 on port 'a'. The problem is that i don't know how to make the switch 10.30.10.0.  I understandably get the error Conflicts with '10.30.1

Does fortigate or fortianalyzer has option to search traffic logs for IP that contains a certain value.For eg am trying to find destined to all IPs starting with 10.20.30.x

Does anyone know if one FortiToken Mobile app with two or more FortiGates for SSL VPN is possible? I mean WITHOUT FortiAuthenticator.We have mulitiple SSL VPN entry points in our nation-wide network. But now we want to use FortiToken Mobile. The gotcha is we don't have FortiAuthenticator for remote authentication. So we need to buy multiple tokens for all FortiGates. But I'm not sure if this even works with one smartphone per user. Toshi

Hi,I'm trying to figure out how to send an alert when an ip address is quarantined by the dos policy...Does anyone know how to do this through automation stitches? Thanks

hi all i know there is a number of configured dhcp servers per VDOM.Does anyone know if this limitation is applied for DHCP relay agents as well? thanks  

Hi,I don't understand what is and the meaning of the "status" button when I create the Intrusione Prevention policy.Anyone can help me? Thanks

Issue: We enter in our username and password for SSL, we receive the Duo push, duo push stays for a few seconds, then passes/approves the connection without user intervention. This doesn't allow the user to allow or deny the connection thus rendering Duo useless. Fortinet Users,We currently are using LDAP to sync our FortiGate 400E. We then create a local firewall group on our 400E and tie the remote server (LDAP) to this group. Typically this is a group we have in AD already to match.From here we tie this same group into the Authentication portal for SSL VPN connection.Next, we set up the firewall policies to also use this group. This process works without issues but now that we are trying to layer Cisco Duo on it we are having problems. What we did was add a radius to the firewall and then add an additional user to the remote group. We also had to make a NPS policy on our domain controller.We then make sure the NPS policy is in place. Conditions include the windows gro

I have a FortiVoice 20E4 and I want to do the following: When an external caller is calling to my number, an IVR will play that mentions some numbers, and, for example, when the caller presses the number 6, then a PIN (6-digit) will be requested. If the caller types the correct 6-digit PIN then it will connect to the corresponding internal extension.For example, the external caller presses 6, then 123456 (the PIN), and that connects them to the internal extension 111. If the external caller inserts the PIN 654321, then that connects them to the internal extension 222, etc.So practically when an external caller is calling, there will be a matching of PINs to internal extensions.How can this be done in FortiVoice? I was thinking as a band-aid solution to put 6 fake IVRs and connect from the 1st number to the 2nd, etc., essentially making the PIN with 5 connections. Is there a better way to do this?Thank you.

Hi all, I'm trying to advertise some prefixes to my ISP using BGP but don't see any messages originating from the Fortigate to the ISP. The ranges are in my routing table either as a static route or connected range. I've been following a few examples from the documentation but always end up with:  fg01 (root) # get router info bgp neighbors 162.57.210.17 advertised-routes % No prefix for neighbor 162.57.210.17  Current configuration is as follows:  config router prefix-list edit "all_prefixes" config rule edit 1 set prefix 78.121.89.0 255.255.255.0 unset ge unset le next edit 2 set prefix 78.121.88.128 255.255.255.192 unset ge unset le next end next end config router route-map edit "Filter_route" config rule edit 1 set match-ip-address "all_prefi

Is it possible in the CLI to append an address to an existing group without overwriting all the current addresses in the group? A have about 100 Fortigates for which I need to edit an address group, but just to add a new address.  The group has been manually edited at various locations to meet business needs, so I can't predict what addresses are already in the group. For those that are curious, we use FortiGate Cloud to manage all our devices and we can run scripts to push out edits to them all.