Solved

Hi everyone, I’m faceing a strange issue on a FortiGate. I have two 100F running in an A-P HA Cluster. I have an aggregater interface connected to a Cisco Nexus 9K. The LACP between the Cisco switch and the 100F FortiGate is up and running. I’ve created serveral VLANs on the aggregated interface. They are working perfekt. Today I added another VLAN interface to the aggregated link on the FortiGate. I’ve confirmation that the MAC andres of the VLAN interface is pressent and detected on the Cisco Switch. However… The L3 IP that I have configured is up/up on the FortiGate, but I’m unable to ping the interface from the FortiGate itself. After some basic troubleshooting, I came across that the IP/network of the VLAN interface doesn’t show up under the locally connected part of the routing table. I’ve been unable to solve the issue so far. By the way, I’m running FortiOS 6.2.9.

I have 2 FortiGate 51E's that are at remote sites but connected together using a LAN port on each firewall, connected over an ISP provided LAN Extension. Both of these FortiGate's are on the same private subnet and talk directly to each other. Is there a functionality available where I can let each device discover each other? Connectivity and traffic routing is working fine, I was just wondering if there was a similar functionality like the Managed FortiSwitch interface where I can see each hardware device connected to each other and was wondering if that was a thing, and if so, what other additional functionality would that provide? Both FortiGate's are running FortiOS v6.0.12 build0419 (GA)

We have a splitted subnet: LAN2: (physical interface)172.29.6.1/255.255.255.128 for FortiAP's Wi-Fi SSID:172.29.6.129/255.255.255.128 I have connected a cabled physical device and given static ip details:ip:  172.29.6.201gw: 172.29.6.129sub: 255.255.255.128  Was hoping I could reach this device from the Wi-Fi clients, but no good. All good when connected to cable though. Where am I going wrong here? -PM *edited LAN1 to LAN2

Hello, I'm attempting to access an old FortiGate 90E that I had setup. I hooked up the console cable and was able to access it via putty using my old credentials. I attempted to use the command found in some documentation.  CLI Commandshttps://help.fortinet.com/fauth/5-3/Content/Admin%20Guides/5_3%20Admin%20Guide/200/204_CLI_commands.htm  It seems like this command wasn't recognized.  Here is the version of the firewall. I'm pretty certain the firewall used to be configured so that someone could access the GUI through one of the ports on the firewall, but I cannot remember which port it could be. Is there a way for me to list the IPs each port is assigned to? What is the best way for me to access this firewall without messing up the configuration to much?  Thank you! 

Hello!Happy new year! We have many fortigate devices and I was wondering if there is a way to generate an alert email when a hardware or software event appears.For example:- CPU utilization above a threshold- Memory utilization above a threshold- A service is stopped anormally If I set "Severity based" alerts, with "Critical" we get a lot of messages, many unnecesary for usIf I set "Event based" alerts, I dont have an option for this kind of event. If not, probably, is there a way to change level for some event types?I have seen a previous post similar to this but without a solution. Thanks in advance.Regards,Damián

Hi, I just upgraded my 100E to 7.0.3 OS release. What I see is that the dial up IPSec created with wizard for native win client doesnt work anymore?I can connect but can not reach anything on the other side. When I roll back to 6.4.8 everything is working fine again.Any idea what has changed and how to resolve it? I have all policies set

Running the latest firmware on a 80f and when I try and generate a cert using let's encrypt it works but give me a STAGING cert. I have another Fortigate (60f) that I setup like 2 weeks ago and it generates a normal one. I tried downloading the CA cert from that one and importing it in  on the one that is STAGING and removing the STAGING ACME certs and it doesn't work. I still generates a STAGING cert. I know that you can specify the STAGING Cert to verify everything works before you setup a geniune one but I don't need that. Does anyone know the command to specify the cert?

Since some days there is a "Fortinet Webfilter".And it is blockinig pages, I want to go. I get the message:FORTINET WebfilterThis Connection is Invalid. SSL certificate expired.A secure connection to pincoya.de cannot be established.When you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.Sitepincoya.deCertificate CN*.pincoya.deCertificate AuthorityR3Certificate ValidityNot Before: Dec 6 18:17:34 2021 GMTNot After: Mar 6 18:17:33 2022 GMTCertificate Chain-----BEGIN CERTIFICATE----- I dont know, where this "Fortinet" comes from. I dont know, how to operate this "Fortinet".And I dont want it! So - how get I rid of it?Please answers for dummies! 

Hi All,Is there a way to remove a firewall from the FortiManager through CLI or any other way? Currently our FMG is bugged, see the picture below.  

Hi All, Can someone tell me how can we block personal Zoho mail login via web filtering policy. 

We deploy the FortiGate 400E as IDS to port mirror FortiGate FW.- ips license is enable on this 400E, but without web filtering license.To get http header raw data(request url, request method, user agent, x-forwarded-for,referer) from ips log.Am I able to get http header data if just enable extended-log in ips profile setting ?"set extended-log enable" Thanks in advance.Henry Xu

Hey guys, Can anyone please confirm if using VIP objects set with interface "any" is the issue? I talked to TAC and they are not sure, though fortinet guru site shows it should be fine. Any feedback is appreciated.

We've been using a FMG-VM about 7 months in production, which is now 6.4.8 running. But still see Auto-update happens to a few managed FGTs without any local config changes.Mostly seems to be harmless when I diff config revisions before and after, which makes me more specious "why needs to happen???". But when I upgraded those FGTs last time, about 30 of them at a time, 2-3 of them got an IPS sensor's content removed 5 - 60 minutes later after the maintenance was completed. TAC said that particular one was probably a bug but closed the case since I already re-installed the policy package and nothing to look at. And no explanation about the random auto-updates. Does anyone know the conditions an auto-update might happen? Toshi

Hello everyone,I have a design plan on my mind with one FortiGate 200F (or 100F) that will have the WAN from ISP Router. Then I will have 2  (can be 4 or more) FortiSwitch 248E. I am planning to buy these and make network infrastructure with. Our office has 300 employees, no VoIP phone (only Windows based VoIP). I don't want to chuck the firewall by using only Tier 2.Fortigate will all the routing to internet and the clients \ APs will be connected to switches. Is it helpful to connect every switches to the fortigate's interfaces (nt1.png) or should I put two switches as Distribution LAyer between fortigate and access switches (other switches) (nt2.png)?   I tried to draw diagram on Cisco Packet Tracer just to draw. disregard the switch models 2960 :)Every solution , suggestions will be much appreciated :)Merry Christmas and stay nerdy

Hi all,got configured IPSec tunnel it is up (phase 1 and 2) but no Outgoing Data.Policy from Zone (with vlan10 in it) to VPN tunnel configured, Static Route (with subnet I try to reach, and VPN interface configured) also.When Ping from computer with vlan10 I see deny and hit policy 0 in FAZ. What is the best practice to check why traffic is not hitting this tunnel or policy?P.S I have access only to my side of tunnel.P.S II. Is is possible that when my part of the tunnel is configured ok, policy and route also but on the other side of the tunnel something is missing tunnel will show up on 2 phases but will send no data to the tunnel?What's bother me is that there is O B in Outgoing data.FGT OS. 6.4.6

We upgraded to 6.2.10 after being on 6.0.13.  Previously you could disable and re-enable a policy without it clearing the traffic counters but now it clears the counters, bytes, first used, last used dates on a policy - why has this been changed? Is this the same in later firmwares? This was useful information and you may just be disabling a policy temporarily but now you lose the information if the policy has ever had traffic on the fortigate without searching logs and you logs may not be able to go back far enough in the logs.  Especially if you are considering deleting a policy it is good to know if it was last used 3 months/6months/1 year ago etc.  You could manually clear them right clicking and clearing counters if you wanted to.  Why is fortigate resetting this information now?  This was really good for providing information on the policy usage without looking at the logs. 

Hello, I just bought a Fortigate to migrate our entire Mikrotik network to Forigate and the following question arises:How can you have 4 Subnets on a single LAN port?Example:192.168.1.1/24172.16.50.1/24192.168.1.1/24

Hello we have a BGP WAN connection with two interfaces - primary and secondary. We use weighting and prepending on these to prioritise the primary interface over the secondary. See below config. We have just tried to advertise a statically configured default route out this pair of WAN interfaces by simply adding the command 'set-capability-default-originate enable' on each one (see attached screenshot). The default route was advertised. However this seemed to result in default route flapping i.e. BGP neighbours were sending default route traffic in to us via both our primary and secondary WAN interfaces (inconsistent behaviour). I do not understand how this could happen as we are using prepending on our secondary interface to force inbound traffic to only use the primary interface. Are there some commands we were missing on our WAN interfaces ? To clarify, we are advertising a default route on both our primary and backup WAN connections from this Fortigate because this particular Fort

 I cannot seem to figure out how to see the other Windows devices on my network if the device that I am on is connected to the firewall.  How to I enable NetBios broadcasts?

Hello All, I have strange issue with with Fortigate 40F using 7.0.3 (lastest version), the same was for 7.0.2.I have dual stack network on my home. Using IPv6 and IPv4 in paraller.Most of the Firewall rules are exact the same for two protocol versions. But funny thing is, whatever I'll change on my Fortigate, even description of the rule (even for IPv4), IPv6  traffic is freezing for 5-10sec and back to normal. The issue is even between LAN interfaces (on trunk, one VLAN to second VLAN).So we can skip WAN issues there. I have no clue how to document it (I have valid support), I can only record video when host using IPv6 are freezing, getting lags (IO timeout) when using NFS/iSCSI over IPv6. This situation as mentioned is for 5-10 and then back to normal without any action from my side. I wondering maybe this is related to ASIC offloading for IPv6, that there is a bug/issue with that? The IPv4 protocol is working fine, only IPv6 got freezee. It's hard

Hello, I am having some problems configuring IPv6 on FortiGate.My ISP provides me a /48 but wants me to use a static IP on a transport network (/126) on WAN, where my router is ::2 and their router is ::1. Can someone help me on this? I tried setting the ::2/126 on WAN interface, creating a static route to ::/0 from ::1 and manually setting a  /64 subnet on a interface but the interface is not pingable and I can't ping outsite from this interface aswell.

I would like to setup FortiAuthenticator and Fortigate to provide McDonald like WIFI access, when you connect, it pop up a disclaim page, and once user clicked "I accept", it grant the user access directly. Is this doable ? I have tried to use Portal policy with MAC authentication ( but doesn't really restrict any MAC ), it looks like FortiAuthenticator does send Access-Accept  to Fortigate, but there is no Fortinet-Group-Name radius attributes.  If I don't enable "Account registration" in Guest portal, there are new "social login users" created, but they can't be automatically added into a user group. Tried MAC group with device tracking enabled on guest portal, also no luck ( turn on device tracking doesn't add new social login user's MAC into the chosen MAC group. ).     

There is a way to upload a script via GUI: That script ends up here:  Is it possible to execute that script via the CLI?  ThanksDan

Would appreciate a response from Fortinet regarding the Apache log4 vulnerability if any Fortinet productis affected. Any information regarding updated IPS signature for CVE-2021-44228?

We have a Raspberry PI at one of our locations that I think is having an issue with VLANS and our Fortigate, I am not totally sure about this just suspecting.Here is the setupCampus 1 has a Fortigate 400E, switches are Extreme x440 with VLANS in place, the Fortigate does all the routing between VLANs and other campuses. The Raspberry Pi is on a VLAN that has rights to all other VLANS and campuses. The Raspberry Pi is located at Campus 1.Campus 2 has a Fortigate 600CSo here is what I have discovered thus far.If I connect the Raspberry Pi directly to the FortiGate 400E I can ping the FortiGate at Campus 2.If I connect the Raspberry Pi to a switch and put it on the correct VLAN I can ping the Fortigate 400E at campus 1 but I can not ping the Fortigate 600C at campus 2.We have gone through the steps to make the Raspberry Pi VLAN aware.Does anyone have any ideas about what might be causing this?