Solved

Hello Experts, Can someone please confirm that if we have a regular VIP with an Public IP address, other than the Firewall external interface IP, will return traffic from the exposed server will use the same Public IP from the VIP? If not, do I need to create an IP pool with the same Public IP and then use that to NAT Internet bound traffic from server? Also what IP will be used by server if it initiates the traffic out to Internet in case of exposed server with VIP setup? Thanks

HiWe have a Venezuela CANTV Metro Ethernet link and we need to connect to Fortigate 60E in port 7 (WAN1 & 2 are in use in a SD-WAN and we need to include this link) We received from CANTV the follow parametersVLAN:                   118CANTV WAN IP:     190.202.4.9Customer WAN IP: 190.202.4.10WAN Mask:            255.255.255.252LAN IP:                 201.249.206.128 IP Available:          201.249.206.129 to 134 (135 is for broadcast)LAN Mask:            255.255.255.248 Someone can help us? We will appreciate a lot... Regard

Hello to all! I am new to forum and and FortiGate devices and I need some help. I just bought second hand Forti 100D, but it has old FortiOS (5.2) and form what I see there is no way to update it's firmware without subscription? Since I have bought this for HomeLab I don't need cloud/extended features and I must say I was shocked when I saw that I cannot event update firmware? Is this true? If it is really true, what is the lowest subscription to get access to firmware(since this is the only thing I need), as I said I don't need 24x7 support or others since this is for HomeLab purposes and learning.   

hello everybody, I recently updated an ha cluster of 100E from 6.2.2 to 6.4.5 following the suggested upgrade pathafter the update the HA cluster status is out-of-sync, I checked using diag sys ha checksum and I found a firewall address named FCTEMS_ALL_FORTICLOUD_SERVERS created on both master and slave but with different UUID I tried to set the UUID manually but I get the error "UUID attribute cannot be set directly", I tried to delete the object, it was deleted on both master and slave and the conf appeared in-sync but after a few minutes the address is automatically re-created with different UUID on the two firewalls and the HA status is out-of-sync  did anybody face this issue and found a solution?thanks!

Hello everyoneI'm facing a quite strange problem on my FG-60F wit FW v6.4.5 build1828 (GA)Either I do not understand the sense of a firewall or I'm not experienced enough. I'm using an IP block list connected via an external connector. The connector shows 1259 valid IP addressesI added a new deny policy on the very top of the chain to block all traffic from WAN1 to any where the source address is in the block list. Whatever I'm trying, this policy just does not work. I added also the current IP from my smartphone provider to the list for testing.  The IP is listed in the block list, but even so I'm still able to connect to everything which shouldn't be possible at all. If I block myself via a normal static address then is works as expected. The IP was found in the block list I'm still able to connect even so the bad guys  I really wonder if someone else has the same issue and how this could be fixed. Thank you very much! 

Hello, I have a server in my DMZ which must communicate with my antivirus manager server in my LAN.Ports used are 80 and 443IP v4 rules are ok. I encounter an issue when I try to access to the url [link]https://antivirusserver.domain.local[/link] from my DMZ serverI get the following messageWeb Page Blocked!You have tried to access a web page which is in violation of your internet usage policy.URL: [link]https://F-Secure[/link] Policy Manager automatically generated self-signed certificate/ Category: Unrated User name: Group name: To have the rating of this web page re-evaluated please click here. If I disable the web filter in my rule I can browse the URL.I tried to add antivirusserver.domain.local as a wildcard and allow it to static url filter but it doesn't work.Allow tried to add the url to my white list in web rating overrides but it doesn't work. Do you have an idea ? Regards,

Hi all, While I'm waiting on my first FortiGate's, I would like to prepare some things. We will have 11 BO which will connect to the HQ. At HQ we will have two 200F in HA, all BO will have 80F.HQ will have one Win 2019 Server (DHCP, DNS, etc).HQ will have FortiManagerI would like to make VLAN's and Subnets as next:VLAN 2 - Workstations (each site with their subnet ex. 10.10.10.0/24; 10.10.11.0/24, 10.10.13.0/24, etc over the same VLAN)VLAN 3 - ServersVLAN 4 - Management (switches, FG)VLAN 5 - WiFi - EmplyeeVLAN 6 - WiFi - GuestsVLAN 7 - Other (UPS)VLAN 8 - Trunk HQ - 100 Mbps InternetBO - most of them 50 Mbps and some 80 MbpsObviously need to split the tunnel  My questions: - What kind of VPN connection would you recommend? Routing?- Would it be better if I split VLAN so for each subnet different VLAN (each BO with their VLAN)? I'm not sure if this would make more trouble for the administration. VLANs 2, 3, 4, 7 and 8 need to talk to each other. VLAN 5 and VLAN

My FortiAP-112D has two holes at the bottom of the housing for Ethernet cables, each about 11/16" or 18mm.  These were supposed to have weather seals, judging from the image on the cover of the QuickStart Guide.  Due to the way the bottom cover slides into place, a standard cable gland out not work.  Maybe some molded rubber piece was used. Can anyone advise what sort of seal to use and/or where to find it? Thanks,billvo

Hello Everyone,I don't know if what i want is even possible but here it is. I have a client site with two vpns tunnel to two remote locations. What i want is if the ping to an internal ip address in one of the remote locations is fail i want the vpn interface toward that location to be disable.Thanks in advance.

friends to update the version of fortimail, I click on "UPDATE". I ask this because I read a kb about updating the fortimail but it does it in another way, this is the kb: https://kb.fortinet.com/kb/documentLink.do?externalID=FD45326 according to this document you click on "Restore Firmware" but why? if it is a version update and NOT restore. Could you help me clear this doubt?

Hi all!I have a simple questoin about HA-cluster settings.We have 2 Fortigate 92D in active-passive mode (Master=№1, Slave=№2)The FortiOS version is v6.0.11 build0387 (GA) on both devices.Recently, I have found that my Fortigate 92D №1 didn't become a Master after rebooting or restoring connections.I had to return the Master role to first Fortigate 92D manually.As I understand it, by default, elections inside the HA cluster are launched every 5 minutes.Is that something wrong with my configuration? That's is a Master(№1) config: config system ha    set group-id 10    set group-name "HAGroup1"    set mode a-p    set password ENC *****************************    set hbdev "internal13" 50 "internal14" 50     set session-pickup enable    set override disable    set priority 150end The Slave(№2) config: config sys

Hi, I have a fortigate 30E (6.2.4 firmware version) and I am experiencing problem with internet speed on it. The wan led is constantly blinking amber (speed) and blinking green for LINK/ACT.  I´ve been looking on the internet for any explanation but I cant find any. FGT#diagnose hardware deviceinfo nic wan Description Marvell NETA Gigabit Ethernet driver 00000010 System_Device_Name wan Current_HWaddr 90:6c:ac:63:1b:29 Permanent_HWaddr 90:6c:ac:63:1b:29 State up Link up Speed 100 Duplex full Rx_Packets 2679 Tx_Packets 3737 Rx_Bytes 720292 Tx_Bytes 3840955  Can someone tell me what can this be or help me troubleshoot this issue!

Hello, I created a new interface in Firewall. Although ICMP is allowaccess at Interface; clients cannot ping the gateway address.  When I create debug in Firewall; I see it was dropped because it didn't match the rule. Normally there is no need to have a rule for the client to ping the gateway address. Where could the problem be? id=20085 trace_id=1155 func=print_pkt_detail line=4915 msg="vd-LOCAL received a packet(proto=1, 10.100.17.11:19760->10.100.17.1:2048) from Server-MNG. type=8, code=0, id=19760, seq=486." id=20085 trace_id=1155 func=init_ip_session_common line=5062 msg="allocate a new session-0f73a6b8" id=20085 trace_id=1155 func=fw_local_in_handler line=392 msg="iprope_in_check() check failed on policy 0, drop" 

Hello,Having a new Fortinet network, we are seeing some very strange issues on the network. It is very sporadic, which is hard to pinpoint the issue, as network performance works great and the next minute it fluctuates. First we started seeing that a file copy to our file server (1 GB connection) was occasionally fluctuating fast and slow. When copying files it would burst up to 108 MB/s, then drop down to 10 MB/s or below (sometimes pause for a couple seconds), then increase up to 50 - 80 MB/s, and would form this wave. The second file copy we tried, it would copy around 100 MB/s all the way across (2 GB file copy). So then we try it again a minute later, and the performance is horrible. I noticed a couple things when I started a wireshark capture: Occasionally I will see TCP Spurious Retransmission, TCP ACKed unseen segment, TCP Out-Of-Order, TCP Dup ACK (even when I'm not really actively doing anything on the network). Now here is the strange thing, if

I did a full reset via the CLI with the command: exec factoryreset I looked at the instructions: https://kb.fortinet.com/k....do?externalID=FD37052 Access through the WEB did not work connected via SSH as user: admin set a new password enabled access through the internal interface with the command: CLI commands:     # config system interface        edit <interface name>            set allowaccess ping http https    end I looked at the instructions: https://kb.fortinet.com/k....do?externalID=FD34688 Logged in as a browser at http://192.168.1.99 (port 1) When I go through the settings wizard, I can't go through the registration stage (I registered on the site beforehand) Register with FortiCare This step is required to activate threat protection services and receive firmware & package updates. I enter login (email) and password Country Can't choose a Resell

Hi, Guys, We found some strange syslog as the following, we have not configured or defined these policies ?Any recommendation to fix these problems: uID : 5025117 Date : Today 03:46:51 Host : 10.16.9.6 Messagetype : Syslog Facility : LOCAL7 Severity : ERR Syslogtag : date=2020-12-23 Checksum : 0 Message time=03:46:50 devname="Forti400e_Fw02" devid="FG4H000000000004" logid="1501054200" type="utm" subtype="dns" eventtype="dns-response" level="error" vd="root" eventtime=1608709611360453548 tz="-0400" policyid=0 sessionid=0 srcport=0 srcintf="unknown0" srcintfrole="undefined" dstip=169.254.0.2 dstport=53 dstintf="unknown0" dstintfrole="undefined" proto=17 xid=47105 qname="login.microsoft.com " qtype="A" qtypeval=1 qclass="IN" msg="A DNS resolution error occurs" action="pass" error="DNS query timeout"   Details for the syslog messages with id '5032066' uID : 5032066 Date : Today 04:03:27 Host : 10.16.9.6 Messagetype : Syslog Facility : LOCAL7 Severity : WARNING Sy

Hi Forti People, I am a new member of Fortinet Family and it is great device Fortiwifi 60D, but I need your help. I created my WIFI SSID and computer and for example Apple TV are just coming fine in the Internet but my iPhone does not. Interesting is when I use default "fortinet" connection iPhone can access the Internet. All other LAN connected devices have their own subnet and works just fine. Only iPhone 7 connects but no access to the Internet. I read many posts but I still haven't figured it out how to solve this problem. Please help. Thanks!

On Cisco I can set interface speed label with the 'bandwidth' command. Does Fortigate have an equivalent to set the speed, so bandwidth usage will be correctly assigned a percentage based on the interface speed/bandwidth label?

Hello, I am interested in bridging multicast traffic across a Fortigate. It appears to be either very simple, or very complicated. I have reviewed the technote on Multicast, and I am unsure if I need to worry about configuring PIM routing. If not, then I believe I would have to configure the join-group on the interface that is on the same VLAN as the multicast traffic/group. Here is a diagram for reference. Has anyone configured multicast " bridging?" Am I missing anything? Thanks, Matt

Hello All,I Created a Virtual IP and Group for RDP access, then created the Firewall policy. I am unable to move the Virtual IP Group Policy to the top in Interface Pair View but I can in By Sequence. is that the way its supposed to be done? The external connection using RDP does work.

Hello all,  I hope you can help me, I have 2 different networks at my office, they do not have any interconnection betweem them, please see the diagram, now I need host A to reach host B locally, and to reach host C through the MPLS circuit. since at my coreswitch 1 I have 5 different vlans, and just one of them needs to reach the two remote hosts, I belive that the best and secure way to do this is to interconnecting the 2 fortigates. What do you think? I am not sure how to do this, any help is very appreciated. Thank you all  

We are preparing to implement Split Tunneling for our SSL -VPN users, specifically to include split-tunneling-routing-negate to hopefully exclude Microsoft 365 services from traversing the SSLVPN tunnel and instead go out the local internet connection. We have two (2) Fortigate 101Fs in a HA configuration.  Current firmware is 6.2.4 FortiClient versions 6.4.0.1464 We will be upgrading our firmware from 6.2.4 to 6.4.3, then from 6.4.3 to 6.4.4 as 6.2.4 does not have the split-tunneling-routing-negate option in the next 7-10 days.  Following the firmware upgrade, we want to implement the split tunnel with routing negate and have found only this Fortinet article documenting basic use. and unfortunately does not include a very detailed example. We plan to implement the following commands:config vpn ssl web portal       edit SSLVPN-AllUsers           set tunnel-mode enable   &n

Hello Community, I've to set two different PSK at a site-to-site vpn ikev2 tunnel. The gui or cli will only set one key for psk. I've to set up a tunnel to a lancom firewall, there is a psk configured for local and one for remote.How to set two different psk to one ikev2 tunnel configuration? Thanks Markus

Please see attached screenshot of an auto-discovered device.Device discovery, even if the IP is provided by the FG's DHCP  - may fail to collect the IP addresses of devices.(firmware 6.0.12)What am I missing? it is hard to believe that one is supposed to make IP objects manually for the use in FW rules. Even  some devices are populated with IP address, they can't be used anyway (as source or destination in a rule) due to the message "One address, address group, or Internet service is required" 

Hi I'm trying to set up SSL offloading, but I can't see the Virtual server in the list of address to assign to the destination in the policy.What am I doing wrong? I don't have central NAT enabled.