Solved

Good day, I'm setting up a Tacacs.net server to authenticate all our FGTs and it's working fine.But, when a diferent (TacacsUserGroup) tries to log in a FGT which doesn't have configured it's (TacacsAdmin_profile), it logs in as a super_admin instead of denying access. Tacacs.net config for that group: <Service><Set>service=fortigate</Set><Set>memberof=FGT_access</Set><Set>admin_prof=csu</Set></Service> debug fnmbad [705] parse_author_reply-Authorization arg0: memberof=FGT_access[705] parse_author_reply-Authorization arg1: admin_prof=csu // This profile doesn't exist in the FGT.[709] parse_author_reply-Authorization result=2[788] auth_tac_plus_result-Passed group matching[1059] find_matched_usr_grps-Group 'tacacs_access' passed group matching[1060] find_matched_usr_grps-Add matched group 'tacacs_access'(2)[217] fnbamd_comm_send_result-Sending result 0 (nid 0) for req 637653419, len=2000[747] destroy_auth_session-d

I have Fortigate 200b unit. I want to give an access to my internal web server to users outside. I read documentation about a port forwarding. But I have a small question. The VIP address can be the same as the external address of the interface ( the interface that connects your FortiGate unit to the Internet)? Thanks in advance for your reply

hello Two questions please: 1- What does it means the default action in the antivirus profile ? what if I select "none" ?"see screenshot" 2- What is the recommended version and is there any path to upgrade from 5.3.3 to the recommended version ?  

Hello all, I've had a look through the documentation, but can't find any information about what URL access forti sandbox needs to function properly. We'd like to lock down the internet access the devices have, but need to make sure we don't cause any problems. Can anyone point me in the right direction?

Hi there, i got a problem with a Fortinet FortiGate 60C. I saved my configuration and after that i restarted the fortigate, using the console port (and putty with an opened COM connection) i managed to format the boot.After that i'm unable to connect to a TFTP server because it seems that NO port are working (WAN1, WAN2, DMZ, 1to5)Now i'm unable to boot and unable to connect to a TFTP server to flash the firmware again. Is there any solution?Thanks

Hi,I have a 40F and want to use it for websecurity. At the moment I use a PfSense firewall with 2 internet connections and a 4G backup. Because I don't want to configure everything new at this time (homeoffices, second branch connected via Wifi, Vlans etc...) I only want to secure the traffic to our terminal server as everybody uses this server for webbrowsing.TerminalServer is 192.168.100.2PfSense is 192.168.100.169.I set the Lan address of the FG to 192.168.100.168, set a route 0.0.0.0 to pfsense (192.168.100.169) and changed the gateway on the server to .168. This works for outgoing traffic, but not for incoming traffic. I also created on the pfSense a default route for 192.168.100.2 -> 192.168.100.168. But this did not help.I think segmenting the subnet would be an option, but .1 is taken and connot be changed, alsochangeing   the address of the TS would be a lot of work.  Can anybody tell me if it is possible what I want to do and how? I know this is not bes

HelloCan i configure FORTIGATE in order that internal LAN interface on PORT1 (VLAN30) of the FORTIGATE can comunicate to the builtin DMZ interface (no VLAN)?I setuped IP 172.16.30.1 on LAN (port1) and 20.20.20.1 on DMZ Interface but im not abble to ping from LAN to DMZ (i have INTERNET on both interfaces)....what could be the reason?thanks

Probably a dumb question... I only want to access my fortigate through VPN. I am using the forticlient to establish a SSL-VPN connection. How can I then access the Fortigate web admin Gui? What IP do I have to enter in the browser. Do I have to configure other setting? Thanks. 

Hello All, I was looking for a little clarity on the behavior of using a deny policy. The goal is to deny a subnets outbound traffic to a specific service, for example http. When you set the action to deny http does that same policy implicitly "allow" all other services? 

Why is this so hard? I have a 60e 6.4.8 FileZilla keeps coming back with Port command tainted by router or firewall.Machine is in a firewall rule that allows ALL.Deep packet inspection on all ports. Also tried it with no packet inspection and no security profiles at all, just for giggles.I was reading online about a service FTPoverTLS. I don't even have that service. But again, ALL is allowed.I'd hate to open a ticket on this, it seems like it should be easy enough.Any help would be appreciated.

Hi All, Can the Let's Encrypt Certificate (using ACME) be used for SSL deep packet inspection.  As of now, we are using Fortigate Self Signed certificate for SSL Inspection. But it is difficult to manage certificate installation for the guest users. 

I try so much times and always display error. Could anyone help me to solve this problem, or provide some document to reference? Thanks a lots!  FortiAuthenticator 

Hi, I'm trying to add some local and remote addresses on my VPN Tunnel Phase 2 Selectors and after I added all of them, I've encountered a red box when saving it. Is there any limitation or any incorrect configuration happened?

Dear people can somebody explain me the marked bold places: 2021-12-22 11:44:37.472461 VPN-TU -- 10.99.19.12 -> 10.15.12.1: icmp: echo request2021-12-22 11:44:37.504576 VPN-TU -- 10.15.12.1 -> 10.99.19.12: icmp: echo reply2021-12-22 11:44:37.508988 VPN-TU -- 10.15.12.83.40820 -> 192.168.40.53: udp 292021-12-22 08:53:50.466435 VPN-TU -- 10.15.12.83.52751 -> 10.15.12.109.9100: syn 638097597I will analyze the traffic over the Tunnel to reduce the traffic to the necessary ports on policys.So I am not sure, what does it mean exactly, and wich policy are necessary to get a hit on the right policy.Thanx a lot! 

Is there any fortiswitch OS image available for the EVE-NG lab?

HI guys , I Have FG200F   , after turning IPS on  our LAN ,Anydesk has become very slow , it takes ages to connect , but after when i turn IPS off , it works correctly ? does anyone have any idea to use IPS and still be fast

HelloI have two fortigate devices 500E and 600E ... I know in this case that I can't benefit from HA..So right now I'm just using 600E in my production network.Is there any way that I can get the most of these devices together ? Thanks

I have multiple FortiGate running v6.4.8 with FortiAnalyzer (VM) v6.4.7 for logs. I am planning to upgrade the FortiAnalyzer (VM) to v7.0.2. Wanted to know if there will be any logs that may discard on the FortiAnalyzer when FortiGate running v6.4.8 FortiOS? Due to the existing FortiGate model that does not support  to v7.0.x wanted to check on this.

Authenticate with user/pass vs access_token. I have succeeded to authenticate with a user/pass against the Rest API where i put the username/secretkey as the payload in the body with a POST method. Have also succeeded to authenticate with the access_token with a GET method by appending the access_token in the URL (with ?access_token=<token>).I would like to authenticate with the access_token, but put it in the payload as a POST-method. Because when authenticating with the access_token in the url it will not be encrypted over the https tls channel. So, my question is.. how do i authenticate like the above username/secretkey but with the generated access_token (Rest API key) instead?I have tried to replace the password with the access_token, but do not work. Thanks in advanced 

Hello...I used to have one WAN line that handles all the traffic to outside... Recently I added another 2 lines which I combined as an SD-wan interface, and when trying to configure static route I got the message:"you cannot have duplicate routes on SD-wan and non SD-wan interfaces" I need to keep the first WAN interface separated and don't combine it with the other two inside the SD-wan interface... What should I do to accomplish this ?? Thank you

Has anyone else seen this?I am running a regex match against the word Fortinet, the OID response to .1.3.6.1.2.1.1.1.0 comes back with the Description entered, which is against most of the SNMP standards I have ever seen.I am running 6.0.9 on the hardware in question.   Models tested:500D, 2201E, 60F, 100FCan anyone confirm this?It would appear to be a bug?Thanks for the assist

Hello, I am new to fortigate.  For model numbers such as Fortigate-60, Fortigate-80, Fortigate 100, does BGP come with these devices?  The spec sheets do not have routing protocols. thank you,

Hi all, I have problem with several objects on FortiManager:These objects I used for SSL-VPN and I decide that remove that option.So I remove SSL-VPN settings, and also all settings in policy package but when I trayremove users, user groups and LDAP Server, I receive information that objects is used somewhere. When I click to see where is object used, I get No record found and I cant remove that object.How can I delete these objects at all? Thanks        

I saw several similar problems on this forum, but not exactly like this.So, I have: ISP1, ISP2 ,ISP3 links. First two are in sd-wan mode. And I used it for surfing. ISP3 used for business network. My branch office used vpn site to site, and connect over ISP3. My static route is:0.0.0.0 -> sd-wan x.x.x.x -> ISP3... other routesx.x.x.x is branch office ip but dynamic change every 24h. So tha vpn to work I have to manually change the address. And this is a problems.1.  I try replace 0.0.0.0 -> sd-wan with 0.0.0.0 -> ISP3 and set SD-WAN in Policy Routes. But I cant add SD-WAN interface in Policy Routing Rules. Only per interface. So that is not solution.2. I try add ISP3 to member sd-wan, and used sd-wan rules. But If I make this, I cant use independent interface ISP3 to Firewall Policy. Also not solution. Before Fortigate I used Checkpoint, and that vendor have option to set outgoing interface for vpn, independently of static routes. Is there anyt

Hey guys,I'm trying to create a new IPsec tunnel from my FortiGate using a costume selections.For some reason I cannot create the tunnel itself and I'm getting a red box over my phase 2 selectors.I tried using the specific addresses I wanted and also 0.0.0.0 as local and remote addresses but still getting the same red box with no error.What could be the issue here?Thanks!