Solved

hi all i know there is a number of configured dhcp servers per VDOM.Does anyone know if this limitation is applied for DHCP relay agents as well? thanks  

Hi,I don't understand what is and the meaning of the "status" button when I create the Intrusione Prevention policy.Anyone can help me? Thanks

Issue: We enter in our username and password for SSL, we receive the Duo push, duo push stays for a few seconds, then passes/approves the connection without user intervention. This doesn't allow the user to allow or deny the connection thus rendering Duo useless. Fortinet Users,We currently are using LDAP to sync our FortiGate 400E. We then create a local firewall group on our 400E and tie the remote server (LDAP) to this group. Typically this is a group we have in AD already to match.From here we tie this same group into the Authentication portal for SSL VPN connection.Next, we set up the firewall policies to also use this group. This process works without issues but now that we are trying to layer Cisco Duo on it we are having problems. What we did was add a radius to the firewall and then add an additional user to the remote group. We also had to make a NPS policy on our domain controller.We then make sure the NPS policy is in place. Conditions include the windows gro

I have a FortiVoice 20E4 and I want to do the following: When an external caller is calling to my number, an IVR will play that mentions some numbers, and, for example, when the caller presses the number 6, then a PIN (6-digit) will be requested. If the caller types the correct 6-digit PIN then it will connect to the corresponding internal extension.For example, the external caller presses 6, then 123456 (the PIN), and that connects them to the internal extension 111. If the external caller inserts the PIN 654321, then that connects them to the internal extension 222, etc.So practically when an external caller is calling, there will be a matching of PINs to internal extensions.How can this be done in FortiVoice? I was thinking as a band-aid solution to put 6 fake IVRs and connect from the 1st number to the 2nd, etc., essentially making the PIN with 5 connections. Is there a better way to do this?Thank you.

Hi all, I'm trying to advertise some prefixes to my ISP using BGP but don't see any messages originating from the Fortigate to the ISP. The ranges are in my routing table either as a static route or connected range. I've been following a few examples from the documentation but always end up with:  fg01 (root) # get router info bgp neighbors 162.57.210.17 advertised-routes % No prefix for neighbor 162.57.210.17  Current configuration is as follows:  config router prefix-list edit "all_prefixes" config rule edit 1 set prefix 78.121.89.0 255.255.255.0 unset ge unset le next edit 2 set prefix 78.121.88.128 255.255.255.192 unset ge unset le next end next end config router route-map edit "Filter_route" config rule edit 1 set match-ip-address "all_prefi

Is it possible in the CLI to append an address to an existing group without overwriting all the current addresses in the group? A have about 100 Fortigates for which I need to edit an address group, but just to add a new address.  The group has been manually edited at various locations to meet business needs, so I can't predict what addresses are already in the group. For those that are curious, we use FortiGate Cloud to manage all our devices and we can run scripts to push out edits to them all.

Was wondering if anyone had specs for this model.  Cant find anything on it.We have come into possession of this unit but trying to find a use for it as it probably is too much tech for us. Any help is appreciated.

Hello Fellas, I have my own lab wherein FG, FToken and FAC takes placed. In my own experience, fortitoken and fac are commonly used for the ff areas; ssl/ipsec vpn, wireless internet acces, and FG administration. Is anyone here able to explore other functions aside I mentioned above? Or can I use my Ftoken and FAC for RDP access, Applications access and etc? appreciate if anyone could share their experience with those products.

Hello, I'm having some difficulties understanding the route lookup process when SD-WAN is enabled.  According to Fortinet, SD-WAN rules (which are policy routes) are checked prior to FIB lookup. But, knowing there is always an implicit SD-WAN rule which catches all, will FIB lookup ever be performed for outbound traffic? While researching, i came upon this article which confused me even more :)https://docs.fortinet.com/document/fortigate/6.2.3/technical-tip-multiple-default-routes-where-sdwan-rules-are-not-preferred/20/fd47747 Thanks, Radu

Good day. I'm struggling with next problem We are using SSL VPN connection with two auth services LDAP and RADIUS (2FA thought FortiAuthenticator).And we were surprised that FortiGate sends auth queries (according to authentication rules in SSL VPN configuration) simultaneously. It's f***** ridiculous.My bosses cardinally against of using realms. They demand to use single URL.Yes usually we don't have problems because use individual groups.But we have several groups which must use 2FA but, if FAC will lay down, they have to use LDAP.And without realms it's impossible to do auth rules configuration for these groups.Is it possible to delimit users (without and with 2FA) with using single URL and without realms? For example:config authentication-ruleedit 1set groups "User_Group_1_2FA"set portal "User_Group_1"set auth radiusnextedit 2set groups "User_Group_2"set portal "User_Group_2"set auth ldapnextedit 3set groups "User_Group_1"set portal "User_Group_1"set auth l

Hi, I'm superadmin on my 60F (v7.0.3) and I want to configure the license-expiring-warning via CLI. I did this on two other 60F before but on the third one, I can not set this configuration and I can not see it via the CLI as well. Do you have a hint for me? Thanks! 

Hi,I'm using a Fortigate 1500D with VDOMs in 6.0.14.Here is my network topology :Initialy, there is only N2 and N3 communicating with a static route on my firewall by R1 and R2.My goal here is to add N1 which has to communicate with N3 using IPSEC connection over internet.To do so I first tried to use policy routing through IPSEC using this CB which didn't worked.Then I tried applying policy routing between N2 and N3 so that I could use static route for the IPSEC routing.It only worked half way.Here is my policy routing configuration :When I'm pinging from N2 to N3 it's OK but on the other half, it's impossible to ping from N3 to N2.Packets arrives to the firewall by R1 but the firewall isn't routing them. Here is a packet capture from the interface between the firewall and R1 :Nothing is comming on the packet capture on N2.What am I missing here ?

HI THERE ,i have really big problem , im doing  Outbound SSL decryption  with deep packet inspection on my fortigate , i have 10G connection , but when i use deep packet inspection my download speed limits to 200kbs or something near that, my upload is just work fine , and when ever i put SSL Profile to no inspection it gets fixed . i dont have any overhead on my device. what the problem could be ? Thanks in advanced.

Dear community  I want to execute the following: -> execute backup config tftp backup-stitch.conf 100.100.100.100 But I need to change the source-ip of the firewall from were the backup script is triggered. Is there a way to change the source-ip in this script?  Thank you,Laura

Hello friends, I am having a problem with a "FortiGate 40F"-firewall. Is it possible to delete a SD-WAN-Zone without loosing the connection to the Web-GUI? I only have access to this firewall over the internet... no physical/local access to it. Will I loose access to the firewall over the internet when I try to remove the member ports of the SD-WAN-Zone and subsequently delete the SD-WAN-Zone? The connection to the Web-GUI of this firewall is establised through one of the SD-WAN-member-ports. Would be nice of you to help me whith this question.

How do the VIP address are source natted and the purpose to bind a VIP to an InterfaceHere to clarify the way a VIP address can be source natted on an external interface. A Vip address could need to exit WAN1 using the same its IP address or using a dedicated ip pool, but the way to do it is not so obvious.In some configuration the behavior of the VIP in SNAT, sometimes, could seems to work badly, for example the address could be source natted every time with its vip address also for internal traffic or not natted with its vip address but with the ip pools used by the policy. Following all the different cases and the results shown Initial configuration:WAN1 Interface ip           : 172.16.100.200/24DMZ  Interface Ip             : 192.168.3.1/24LAN  Interface Ip              : 192.168.2.1/24 VIP with

Hi, Is it possible to change Fortiauthenticator management access port from 443 to other? Farooq

Hi, everyoneHow can I change the value of Default Distances I would have to change the DHCP value, which is moderately default to 5 and static to 10. I would like to set DHCP to 40 or higher. Anyone know how I can change that? many thanks for your help.

HeyHow can i add admins account on FORTISWITCH through CLI? what is the commands? Thanks

Hi guys,I hope you can help me as I am just too dumb right now. My setup looks like the following:2 sites, both with a Fortigate for WAN connectivity and between the sites are 2 L3 devices connecting the sites with eachother. Site1 has Area 0 and other areas directly connected to the L3 switch and area 0 is also used for OSPF connection to the Fortigate. The L3 switch inject default route to the other site - connected by OSPF stub area.The second site has a L3 switch as well, connected with the same stub area to the firewall there.The plan is to use the default route from site 2 fortigate for all site a connected devices (so Fortigate Site 2 needs to inject its default route into the stub and overrule default route from Site 1). In case of failure or health links jitter is too high, the default route should be discarded and now Site 2 should take the default route injected from Site 1.For testing purposes I even disconnected Site 1 from Site 2 but still on my L3 switch I cannot get the

i have some local VPN users in my fortigate firewall.We need to change them to radius authentication, is there any way to change in CLI instead of re-creating them in GUI ? edit "user"set type passwordset two-factor fortitokenset fortitoken "FTKM9E3E"set email-to "email-address"set passwd-time 2021-09-21 11:18:52set passwd ENC password 

Hi , i have turn on Deep_Packet_Inspection on my lan to outside , i havent  moved my whole network behind firewall so some part of network is behind firewall some isnt , for example my vCenter is not behind firewall yet , i have put Deep packet inspection on my lan to all outside traffic, and i have imported the firewall certificate, i dont have CA server .  the problem is when i log into my vcenter, i cannot use VMRC consol, it says SSL negotiation failed , i have imported firewall Certificate onto vcenter, but still same thing , any idea or solution ?   i have also added Vcenter in the exempt addresse it only helped me to open the vcenter it self, thanks in advance

Hello,I currently use an analog PBX. I have a PSTN connection to the router, and from the router the PBX is connected to the phone port. I currently have 6 VoIP lines for my PBX and all of them go through this route to the analog PBX. I want to transition to Fortivoice, and I am thinking of getting the Fortivoice 100E. The thing is that this model does not have any FXO ports to connect the analog line to it. Since the lines are VoIP, will it be possible to connect through ethernet from my router to the Fortivoice and have telephony like this? Thanks a lot in advance.

I' m trying to figure out how to backup over SCP. I' ve enabled ' admin-scp' in config sys global, but am now trying to actually figure out how to use it. Anyone able to get me started? Thanks.

After deployment Win10 x64 (with preinstalled FortiClient 6) I have in FortiClient Enterprise Management Server console all my computers with one serial number and UID2.How I can change this (SN or UID2) to split my computers in FC EMS?