Solved

When we get a page browser blocked by our Fortiguard we get the following page returned (example browsing google.ie):    Is it possible to customize this page with:[ul]some corporate branding i.e. custom HTML/ImagesRule specific info that would help support tickets i.e. which rule blocked the request and what the requesting IP was?[/ul] 

HiI am planning an upgrade of two (HA Pair) of 600E firewalls.  They are currently 6.08 and I will need to go through several steps to get them to required version 6.4.5.My question is- would it be safer to shut down the switch ports on the secondary firewall and just upgrade one of the firewalls (and then upgrade the secondary firewall in a different change window) ?  If there were any unexpected issues this would enable me to fail back to the secondary firewall safely.I have done a similar process with other vendor's firewalls but am not sure if this method is supported or advisable with Fortigate firewalls.Many thanks

Hello fellow Fortinet users, I have a Cisco 55xx WLC that's currently using Cisco ISE for AAA.Considering the fact that the ISE and fortigate are incompatible when it comes to accounting my only choice was to configure the WLC to send accounting messages directly to the fortigate.While I can see all the different types of accounting messages from the WLC  on the fortigate, it's unable to fingerprint users in the logs.I went through support and they kinda gave up on me and said that the logs HAVE to come from a  RADIUS server.Has anyone  got this working or can suggest a way for me to overcome this problem? Cheers,Vignesh

Hello.Is there an easy way to promote or change HA roles from SLAVE to MASTER in Fortigate (800c) 2 nodes HA failover cluster, within Fortigate gui or cmd commands/configuration?  

Hi everybody,is there a tool Fortinet to configure offline any model of FortiGate? thanksac

Good day all, I will appreciate some feedback on how the application controls on fortigate work for traffic that is coming into the organization.we have app control , filtering used for user traffic that gets to outside world. if we want to prevent attacks from outside into our organization how should app control features be used? Thanks in advance.

We have a really good small biz product around here by ATT here that's a shared fiber offering.  1Gb up and down for less than $135 a month and they guarantee to add additional circuits if the original reaches 70% saturation. This product is so poorly marketed that nobody uses it, thus I've never installed it and had to share with anyone (that i can tell anyway).   Anyhoo, they came out yesterday to install it at one of our branches with 10 people.  They sent out the same Router with built in ONT as they use in NEW ATT Fiber\Uverse residential installs. It's even got wifi6.  Perfectly fine for this office's purposes. So I simply wired WAN2 into the back of the router to grab a 192 address from the router so i could configure it later to run pass thru and SD-WAN, then ultimately get rid of the cable broadband on WAN1.  But as soon as i plugged it in, it killed internet access on my WAN1-INTERNAL interface/subnet/setup...which is in NO way connecte

We have two devices thing1 and thing2 on the dmz interface of a 60E. The devices are on different subnets. VIP access to thing1 is working fine, but thing2 fails with what looks like a routing issue that I can't sort out.Relevant config:config system interface    edit "dmz"        set vdom "root"        set ip 10.6.6.1 255.255.255.248        set secondary-IP enable        config secondaryip            edit 1                set ip 192.168.91.2 255.255.255.224            next        end    nextendconfig firewall vip    edit "vip-thing1"

I' d like to generate a alertmail, to see whether it is working. I created an smtp server configured an alert mail. In the past i could test-connectivity in release 5 i can' t find a gui option and also could not figure out a cli command. any hints?

Hi - trying to get identical policies on 2 Fortigate 1801F firewalls to the purpose of high availability. The manual says that it is possible to copy the policies. but fails to mention how to do that. So, how do I copy fw policies to it peer? Can someone point me in the right direction? Thank you

Hi, We're planing on puting Forti EMS in DMZ, so clients can pick up telemetry from public.Does Forti EMS server needs to be domain joined machine or we can just connect it via LDAP(S) with AD?Forti EMS will also comunicate with Fortigates for ZTNA tag collectionI was looking official docs, all I can find is that EMS cant be installed on DC Thanks

Hi Guys,My company bought a Fortigate 80F a few months back. At that time we had around 85 users and Fortigate technical person suggested that it will handle up to 100 users in our environment. Now, we have around 70 more people who joined our company, so total employees will be around 160. Now I have few questions - 1) If we buy one more 80F firewall and use it in Active-Active HA mode, will it be able to handle the extra employees we have now? Meaning, (one firewall can handle 100 users), if we have two firewalls, will 200 users will be able to work? 2) Will the VPN users connecting to the firewall will also increase after adding the second firewall? 3) In the future if we get more employees (eg. 500), what is the best practice to handle the load? 

Hi,I have vms in a vlan and I am trying to support tls 1.3 load balancer with full offloading, but I can't get it to work (curl stuck then server no response). Things I tested with same config:- Virtual IP with tls 1.3 works.- half offloading with tls1.3 works.- if I change  the config below to support tls 1.2 it works. On the server side I have nginx with basic tls1.3 config (ssl_protocols       TLSv1.3; + certificates setup) In fortigate I've the certificates setup, and here's the load balancer config: edit "MY_TLS_LOADBALANCER" set type server-load-balance set extip ------.12 set extintf "port1" set arp-reply enable set server-type https set nat-source-vip disable set gratuitous-arp-interval 0 set http-ip-header enable set http-ip-header-name '' set ssl-client-rekey-count 0 set ssl-hpkp disable set ssl-hsts disable set ldb-method static set persistence none set extport 443 config realservers edit 1 set ip 192.168.20

Hello everyone,We have FG300 with FortiOS 6.2.3 and Freeradius. Use RSSO to authorize WIFI users. The user falls into the group on FG, but it is not defined in the policy and, accordingly, the policy does not work. We need help, which may be the reason. FortiGate # dia test app radiusd 3 RADIUS server database [vd root]: "index","time left","ip","endpoint","block status","log status","profile group","ref count","use default profile" 1,07:58:42,"192.168.51.10""host/ARM0796.lokb.spb.ru","allow","no log","<default profile>",1,Yes 2,07:59:57,"192.168.57.4""ushakov","allow","no log","usersLOKB",1,No FortiGate # sh user radius RSSO\ Agent config user radius edit "RSSO Agent" set rsso enable set rsso-radius-response enable set rsso-validate-request-secret enable set rsso-secret "secret" set rsso-endpoint-attribute User-Name set rsso-flush-ip-session enable set rsso-ep-one-ip-only enable next end FortiGate # sh user group RADIUS\ users config user group edit

Hi, we´re switching from MS FTMG to FortiGate with Explicit Web Proxy and a "Web Proxy Forwarding Server". The MS FTMG sends all DNS-Request to the configured 'Upstream Proxy'. How can i configure this Option on a FortiGate? Opening a Website results in '504 DNS look up failed'. Using a local DNS-Server is not an Option. There is no Webfilter configured.

Hello everyone, Someone asked me and I realized that I never knew it. On which port does fortigate start the usage for SNAT ports? I mean, what is the first and last ports usued by fortios on snat port translation?  Thank you all in advance. tioeudes 

Hi,I am having trouble setting up IPv6 on Windows 10 SSL tunnel with FortiClient VPN app. I have configured IPv6 address group to be assigned to users, enabled IPv6 on SSL-VPN portal, checked that IPv6 is enabled on Windows PPP interface, ... but my computer still get only IPv4 address. Have anybody successfuly configured and used IPv6 on SSL VPN through Forticlient VPN app? So far I have found this post http://socpuppet.blogspot.com/2013/09/sslvpn-forticlient-ipv6.html which has not been resolved and some known issues with IPv6 on full Forticlient https://docs.fortinet.com/document/forticlient/6.2.0/windows-release-notes/991883/known-issues. Thanks

Hi all TL;DRDoes anyone know if the Fortigate trial licence limitations on encryption/decryption (which for example prevent the use of HTTPS) also prevent the SSL connections from Fortigate to FortiAnalyzer for the purposes of sending logs (via oftpd)? I was trying to test sending logs from a Fortigate VM (firmware 6.4) to FortiAnalyzer VM (firmware 6.4) but I just get "No connection" and if you hover the cursor over that you get "Error occurred:{0}".  The goal is to test forwarding logs from the FortiAnalyzer to a third device but I can't get this far as the Fortigate won't send the logs to the FortiAnalyzer.  A reddit post (www.reddit.com/r/...er_trial_ssl_error_3/) suggested this is probably a trial licence limitation but it would be good to confirm it here if possible. If anyone has found something similar please let me know. Thanks  Testing steps:I've made sure to check the compatibility matrix and the FGT and FAZ are compatible.  The F

I am coming from the Cisco world, and in that world Cisco Policy Base Routing (PBR) is processed outside of the route table, so PBR will get processed before static routes or any route currently in the table. Is this is the same behavior on Fortigate firewalls? What is the order of routing on the Fortigate firewalls? Thank you

i have around 100 FGT's configured under Fortimanager and I thought it would be better to have a backup config for all the FGT's wondering if there is an option to do that at once using FMG?

Hi! I'm working on a lab with a Windows 2012R2 and a Fortigate VM64-KVM (trial version) running version 6 (tried 5.6 as well).When adding the LDAP server to the Fortigate, I always get error LDAP_-5 in red. And I can't get to query against it. When I debug, I can authenticate against it: FortiGate-VM64-KVM # diagnose test authserver ldap "LDAP DC-01" user1 testpassword authenticate 'user1' against 'LDAP DC-01' succeeded! Group membership(s) - CN=Domain Admins,CN=Users,DC=fgtad,DC=local CN=Domain Users,CN=Users,DC=fgtad,DC=local Config:  config user ldap edit "LDAP DC-01" set server "10.10.10.11" set cnid "cn" set dn "dc=fgtad,dc=local" set type regular set username "LDAPconnect" set password ENC ceUtrzALEk7sWZhJjrw1JElXiACZiRxwHScw9Spf2i2Fmr/FGSis8dpC0JyAuuAya/kZ91ECVenukLlLy8xfFyfJZ6hGqheLG5PCIhjVF8aLQxaeWlb8XnPJvR/ZBSIArzHDq+bD34X9fuUO0oraXOJbhOZfshPzCpZzvgJT04fVKhvWtZ3A56yCmgS2VjSVmMh45g== next end Any ideas? Thanks! 

Hi all, you can see the network diagram. I found out that active failover is not working when I do VRRP with a FortiGate appliance (60F) and a H3C router. On the FortiGate (Master): config system interfaceedit port1config vrrpedit 1set vrip 192.168.1.1set priority 255set vrdst 8.8.8.8set vrdst-priority 10 [ul]when the monitoring target specified in vrdst (i.e. the 8.8.8.8) is down (in my case it is because the upstream host having issue), the VRRP priority of it has not changed to the value specified in the "set vrdst-priority"[ul]FGT[WAN1] --[ISP1]- x -Internet H3C[WAN2] --[ISP2] --Internet[/ul]therefore, the end user will keep going to the FortiGate instead of the H3C router.[/ul]I heard this feature only works on 2 FortiGate forming VRRP, but I proved it fails too in my lab with 2 FortiGate appliance. SO, have everyone tried the active failover and succeeded before? Please help.

Hello, I am new in your community and I would like to know how to block a https site because in http it works I have the fortigate 200A thanks in advance Sincerely

So, kinda new here.  I wanted to block traffic inbound from, say, russia, china and korea.  I set up a firewall rule as wan/lan/GEO/all (where GEO was the geographic list).  No traffic.  So I added another entry as a whitelist from any US traffic, as a positive test.  Still nothing.  Tried changing the dstinf from LAN to any (since I thought maybe the new rule - at the top of the rules list - didn't have a destination, so maybe LAN was wrong.)  Still nothing.  Finally, out of desperation, I created a VIP group, and added the various VIP entries (for my mail server, PBX server, etc...)  Lo and behold, the whitelist entry worked.  So I did the same thing for the GEO-IP blocklist, and that is also now working.  My question: is this really necessary, or am I missing something crucial here?  I've gone through the fortios 6.4.6 manual and saw nothing that spoke to this.  FWIW, I am set in profile mode, not policy mode... 

I added a VLAN to an SSID and relaized it was in error, as i attempted to remove the VLAN from the SSID its returns and error "Input not as expected". I have removed any policies, addresses and interfaces using the vlan, with the same result. Any help to find other reference points i may not have thought of would be a great help to remove this, thank you. -Bry