Solved

Hi , I have read the new feature in 6.4 release note, for advpn and shortcup behind NAT.  UDP Hole Punching. But i have not look if this parameters is by defaut in 6.4 or if it' a parameter in fortigate? I don't have found this information in forum or cookbook.  Anyone have  some information for that? I try to use with advpn and OSPF routing. https://community.fortinet.com/t5/FortiGate/Technical-Tip-UDP-hole-punching-for-spokes-behind-NAT/ta-p/192762  Thanks,  

Hi Guys, I am using Fortigate 60D v6.0.12. recently I deployed the SD wan, in our network. When I see the performance SLA in GUI it shows more than %. it's totally wrong. Is anyone facing the same issue. please help me.       

Hi, Currently having some concerns as I'm adding a /22 on my policy. I have a working configuration for /24 and the new one cant push the internet connection even that policy setup is working before.

Here's a scenario, I have a branch fortigate using a base configuration which uses two ISPs for the virtual link. In this case we do not yet have the link for WAN2 (Waiting on the carrier to install) So in the SDwan we see WAN1 up and WAN2 down. When hitting an SLA on wan1, does the fortigate bring wan1 down until it it meets SLA? Even if WAN2 is hard down? Or is there some sort of safety built into this since WAN2 is hard

To check the 7.0.5 release in a test environment, I downloaded the imageFGT_VM64_KVM-v7.0.5-build0304-FORTINET.out.kvmand added it to GNS3. I've done this plenty of times. The image will run a couple of days in eval mode and I can then exec factoryreset to reset the eval timer. Works fine in a simulation environment like GNS3. However, I seem to have an issue, as the eval license is not working anymore.  Each time I spin up the image, I am greeted with the following after a few seconds :"*ATTENTION*: Admin sessions removed because license registration status changed to 'INVALID'" and, surely it shows:FortiGate-VM64-KVM # diag debug vm-print-licenseSerialNumber: FGVMEVX0OGFYAC9ACreateDate: Thu Feb 10 08:20:15 2022Evaluation license expires: Wed Dec 31 16:00:01 1969Model: EVAL (1)CPU: 1MEM: 2048VDOM license:permanent: 1subscription: 0  usually exec factoryreset or exec factoryreset2 would to the job.Or downloading a new copy of the image. But this time

In Log > Log Settings is... Logs older than 7 day(s) are deleted from the disk Can I extend it to 10 days? 15 days? A month?

Hi , I'm not familiar with Fortinet at all.  I would like to understand what is the best practice when we need to enable a connection to a site like Github and such .Since the certificate copy  produced by Fortinet replacing the original Github  certificate isn't valid by the client and we get a SSL error. So how do we deal with such a situation ? i.e allowing SSL connection to Github ( as an example ). I would be much obliged if you could answer me as to a completely noob.Thanks  

When creating a backup config file from a ipsec connected Forticlient and using that file to create a new Forticlient only the username shows up when installing the custom Fortlclient on a new PC.How to modify the config file that also the password is transferred to the new PC.We using Forticlient 6.0.10.0297.

Hi I  Have maybe a bug in my 6.0.14 OS   httpsd 18282 R 98.9 0.0dnsproxy 439 S 17.7 0.5ipsengine 598 S < 11.4 0.3updated 2059 S 11.4 0.2ipsengine 579 S < 10.4 0.3ipsengine 606 S < 10.4 0.3ipsengine 591 S < 10.4 0.3ipsengine 580 S < 10.4 0.3ipsengine 588 S < 10.4 0.3ipsengine 603 S < 10.4 0.3ipsengine 602 S < 10.4 0.3ipsengine 583 S < 9.3 0.3ipsengine 597 S < 9.3 0.3wad 526 S 8.3 0.4ipsengine 582 S < 8.3 0.3ipsengine 610 S < 8.3 0.3ipsengine 589 S < 8.3 0.3ipsengine 604 S < 8.3 0.3ipsengine 605 S < 8.3 0.3ipsengine 586 R < 8.3 0.3 This causes excessive slowness in the GUI - it happened only after i upgrade from 6.0.10 to 6.0.14 i tried this :fnsysctl killall httpsddiag sys kill 11 172  but it didn't help  What can i do more ?

Hello, I am wanting a layer 2 trunk (supporting 5 VLANs) across a dialup IPSEC tunnel.I will have two Fortigate 60Es on each end for the L3 IPSEC tunnel, then will use VXLAN for the layer 2 trunking.In theory this should be possible with FortiOS, correct ? Thank you.

Hi,I wanted to figure out the best way to add signatures to protect a particular service, and make sure I have everything included.For example how could I filter or IPS signatures to properly secure OWA? Or to protect web servers? Thanks

Hello Experts,  I would like to access one of local address in another local network but still no news. On Fortigate 80F(FortiOS v7.0.2)  I set something that  you can see below: Firewall address:edit "LAN-CUP-10.2.x.x/24"set uuid e1e4a43a-4234-51ec-1d33-78ef82b1ea54set subnet 10.2.x.x 255.255.255.0 config firewall policyedit 17set name "Any to CUP"set uuid cc69133e-6340-51ec-a051-06a9cb3d812bset srcintf "any"set dstintf "any"set action acceptset srcaddr "all"set dstaddr "CUP-Portal" "LAN-CUP-10.2.x.x/24" "Portal"set schedule "always"set service "ALL"set ssl-ssh-profile "Test for Portal CUP"set logtraffic allThere is also static route for destination network.  Inside the Firewall  I can ping 10.2.x.x/24 but from source network (192.168.10.x ) can not ping 10.2.x.x/24. Do you have any ideas? Thank you so much  Best,Ghasem  

Hi,I'm trying to figure out what could be the best solution to block access attempts to our SFTP server on a specific port (type 2222). The Dos policy seems to me a valid option, except that it presents some problems: putting a high enough threshold does not mean that all attacks are correctly intercepted.Conversely, putting a threshold too low can lead to false negatives.Could it be a solution to create a custom signature? In case I should somehow decrypt the traffic or am I wrong? How could this be done in your opinion?Thank you very much

Hello Experts, I have a one Fortigate ( 80F) with last version of firmware(FortiOS v7.0.3 build0237). I added some policies on it and installed it for our client. Our client claim that he can not access to their local server which is in same IP range, I mean for example from 192.168.1.2 can not access to 192.168.1.250. He claim that when restarting the Fortigate its working fine but after for example 5 hours again Forigate  dropping all connection and as result again he can not access to their server.  Have you ever seen this kind of issue? Could you please give me some advice?  Thank you, Ghasem  

Hi all, Base my need, I use reset button behind firewall to reset mine 90D.I can not login web UI (https://192.168.1.99) using default admin and without password after I reset it.It always show me password incorrect. Is there any good solutions to resolve my question?grateful thanksPoter

Hi,I have a problem with a job backup by the Automation Stitch.When i execute the backup by automation stitch i see this error: "Connect to ftp server 192.168.50.50...Error code 1: File not foundSend config file to tftp server via vdom root failed.Command fail. Return code -1" But if i copy and paste the command in the cli console, the backup work correctly.Any idea? Thanks  

HeyI want to control the access to the WI-FI network by MAC-ADDRESS but i cant seem to find the place how to configure; i'm managing FORTIAP by the the fortigate.Is it possible to control devices by MAC-ADRESS on the WI-FI network?

HeyIs it possible configure DHCP Snooping by the GUI? i'm managing the FORTISWITCH using the FORTIGATE but i cant seem to find the place to configure DHCP Snooping..

I am playing around with a GNS3 setup with two Fortigates in a cluster.  Is there a CLI command that would similar to diag sys topshow me similar output  likeget syst ha status...but in a "live" view?  On linux, I would dowatch "get syst ha status"... Is there something that would show me the cluster status in a live view? The HA Status widget in the GUI does not help much because I loose the session as soon as the Fortigate Cluster switches... Dan

Ubuntu Linux computer has two network interfaces:wlx1cbfce8bd2bd:  inet 10.1.1.129 netmask 255.255.255.0on this network, there is a device:  10.1.1.10 - with a UDP port 10000 that I wish to make accessible from the internet. the second interface is....(this is connected to Fortigate)enp4s0: inet 192.168.1.80 netmask 255.255.255.0 Fortigate LAN IP is:  192.168.1.1  I wish to enable somebody to connect to the UDP port 10000 of the 10.1.1.10 device from the internet. I do know how to set up NAT(Virtual IP) and IP4Policy to forward traffic to 192.168.1.80  - but I do not know how to do it to 10.1.1.10   I assume I need route(s) on Fortigate, as well as on my PC (192.168.1.80) and som eiptables?  to achieve that. 

Hello, I want to identify all BGP learned routes on a Fortigate and then apply a BGP Community attribute to them.I am using an inbound route-map on the BGP peer for this purpose, however it does seem to work. Is this the correct way to do this ? config router route-mapedit "HG_CORP_ROUTE_MAP_IN"config ruleedit 10set match-origin egp***matching all learned incoming BGP routesset set-community "7714:65100"***setting the community

Hi Folks, This question is super easy.  Sadly, I've used a few $ervice provider$ and I have to learn this stuff on my own. I have two devices - a Fortigate 60F and now a Fortiswitch 108E.   On the Fortigate, I've configured port 'b' to 10.30.10.0/255.255.255.0 for example.  On port 'b' of the Fortigate, I have a cheap managed switch that works.  My computers all have manually configured IPs and they are working.   The problem is that traffic is not being managed by my cheap switch, and the solution is a better switch. The problem: How do I change the IP/Netmask from port 'b' to the Fortiswitch on port 'a'?So far, I have the Fortiswitch registered in Forticloud, the Fortigate recognizes the switch and I have configured a 'FortiLink Interface' with an IP/Netmask of 10.31.10.1.255.255.255.0 on port 'a'. The problem is that i don't know how to make the switch 10.30.10.0.  I understandably get the error Conflicts with '10.30.1

Does fortigate or fortianalyzer has option to search traffic logs for IP that contains a certain value.For eg am trying to find destined to all IPs starting with 10.20.30.x

Does anyone know if one FortiToken Mobile app with two or more FortiGates for SSL VPN is possible? I mean WITHOUT FortiAuthenticator.We have mulitiple SSL VPN entry points in our nation-wide network. But now we want to use FortiToken Mobile. The gotcha is we don't have FortiAuthenticator for remote authentication. So we need to buy multiple tokens for all FortiGates. But I'm not sure if this even works with one smartphone per user. Toshi

Hi,I'm trying to figure out how to send an alert when an ip address is quarantined by the dos policy...Does anyone know how to do this through automation stitches? Thanks