Solved

Hi, My area of technology is not security, but I have a project that I'm working on at home and I purchased a used Fortigate 60D which I have registered.  On Port 7, I have a WAP with DHCP serving my basic household needs and that is great.   I would like to ask for general guidance on designing a specific, but common, setup.  I have three (3) computers that I want to use.  Computers 1 and 2 are Internet facing specifically using ports 443, 6000, 3001.  The third (3) data server needs to be shielded from external access by the web, but communicate on the subnet via port 3000 to Computers 1 & 2. The first question I have is: Do I use the DMZ with port forwarding for Computers 1 & 2?  Can you suggest a general plan of attack for this design? The second question I have is: Prior to my own hardware, I use AWS with private and public IPs.  I was successful with AW$, but I don't know how to mimic this.  I've just starte

Hi all,I have a FortiGate firewall that reduces my 250MBps Internet to about 22Mbps. I have tested the network without the firewall and i get a speed of about 240 Upload and Download.PLease help out! My device is a Fortigate 60E and possibly have Features turned-on i.e Application Control, Web Filter, SSL Protection.  Kindly advise the best Fortigate Firewall Model that Give me a good ThroughPut Bandwith nearly to 250Mbps with all the Important Features turned on. I heard about FortiGate 80F. 

System link-monitor is not working as expected. When the gateway ping comes back up, the routes remains down anyway. I have to disable and re-enable link-monitor for that interface.I have an open case with Fortinet

I want to create a VPN ipsec with forticlient  with the firewall "fortigate 90D" for my company. My problem is that I don't know the remote gateway of my firewall. Where is it? Thank's (Sorry for my english)

Hi, I have a IPSec VPN setup with our FGT 60 device. It works fine for one country and doesn't connect from other. I haven't applied any geo restrictions on the device and wondering what could be the reason for such behavior. Attached is VPN setup config and interface settings. There no address object setting for the interface. Note:1.I am able to ping public IP successfully from both locations.2.I am using public IP directly as gateway and there is no name resolution involved. Any suggestions and advice is appreciated! Thanks,Mirza 

We need the ability to see the external IP address of clients that are browsing sites that we are hosting behind the Fortigate firewall.   Here is a brief overview of our setup    [image][/image]   What we need to be able to do is see the actual external IP address (1.2.3.4) of customers that are browsing web sites that we are hosting internally.    As of right now, if a customer is browsing a site that is internet facing, if we view the logs on our load balancer, all external traffic looks like it is coming from the Fortigate firewall (10.50.1.1).  Here is an example log output from our HAProxy load balancer    Mar 10 00:04:03 haproxy2 haproxy[2166293]: 10.50.1.1:62232 [10/Mar/2021:00:04:03.640] localhost~ titu_cluster/titu11 0/0/0/2/3 200 64577 - - ---- 28/28/3/63/0 0/0 "GET /images/base_models/18865.jpg HTTP/1.1" Mar 10 00:04:03 haproxy2 haproxy[2166293]: 10.50.1.1:62235 [10/Mar/2021:00:04:03.639] localhost~ titu_cluster/titu12

Hi, We have FortiMail in our setup which was installed by a 3rd party. In the message logs, the Client IP is showing our Router's private IP. Is there a setting in FortiMail to use the originating IP of the email? Below are screenshots of the logs and a sample of one of the spam message headers. Thank you,    

Dear All, I try to make a policy in which one of the interface is a zone member, but I can not choose that from the interface list. It seems the zone members can not be used separately. Some interface has common rules, while in addition to those there are rules that specific only for one interface. Is there any hack for this? Thank you

attached a screenshot. I cant find the "CAPWAP" option in the Administrative Access. any global option to be enabled for this? 

Howdy all, Just got two Fortigate 1500D boxes. Running v5.2.2,build0642,141118 (GA). We configured the management interfaces on them and starting going through the web interface. However it suddenly seemed to stall/halt. Port 443 did accept connections but I was unable to retrieve anything (all existing sessions just seem to "hang"). The SSH interface was available and everything seemed to be functioning as expected except for the web interface. We did reboot the boxes and regained access to the interface but I was just wondering if there was some way to restart the web interface without restarting the whole box ;-)? Bgrds,Finnur

When we get a page browser blocked by our Fortiguard we get the following page returned (example browsing google.ie):    Is it possible to customize this page with:[ul]some corporate branding i.e. custom HTML/ImagesRule specific info that would help support tickets i.e. which rule blocked the request and what the requesting IP was?[/ul] 

HiI am planning an upgrade of two (HA Pair) of 600E firewalls.  They are currently 6.08 and I will need to go through several steps to get them to required version 6.4.5.My question is- would it be safer to shut down the switch ports on the secondary firewall and just upgrade one of the firewalls (and then upgrade the secondary firewall in a different change window) ?  If there were any unexpected issues this would enable me to fail back to the secondary firewall safely.I have done a similar process with other vendor's firewalls but am not sure if this method is supported or advisable with Fortigate firewalls.Many thanks

Hello fellow Fortinet users, I have a Cisco 55xx WLC that's currently using Cisco ISE for AAA.Considering the fact that the ISE and fortigate are incompatible when it comes to accounting my only choice was to configure the WLC to send accounting messages directly to the fortigate.While I can see all the different types of accounting messages from the WLC  on the fortigate, it's unable to fingerprint users in the logs.I went through support and they kinda gave up on me and said that the logs HAVE to come from a  RADIUS server.Has anyone  got this working or can suggest a way for me to overcome this problem? Cheers,Vignesh

Hello.Is there an easy way to promote or change HA roles from SLAVE to MASTER in Fortigate (800c) 2 nodes HA failover cluster, within Fortigate gui or cmd commands/configuration?  

Hi everybody,is there a tool Fortinet to configure offline any model of FortiGate? thanksac

Good day all, I will appreciate some feedback on how the application controls on fortigate work for traffic that is coming into the organization.we have app control , filtering used for user traffic that gets to outside world. if we want to prevent attacks from outside into our organization how should app control features be used? Thanks in advance.

We have a really good small biz product around here by ATT here that's a shared fiber offering.  1Gb up and down for less than $135 a month and they guarantee to add additional circuits if the original reaches 70% saturation. This product is so poorly marketed that nobody uses it, thus I've never installed it and had to share with anyone (that i can tell anyway).   Anyhoo, they came out yesterday to install it at one of our branches with 10 people.  They sent out the same Router with built in ONT as they use in NEW ATT Fiber\Uverse residential installs. It's even got wifi6.  Perfectly fine for this office's purposes. So I simply wired WAN2 into the back of the router to grab a 192 address from the router so i could configure it later to run pass thru and SD-WAN, then ultimately get rid of the cable broadband on WAN1.  But as soon as i plugged it in, it killed internet access on my WAN1-INTERNAL interface/subnet/setup...which is in NO way connecte

We have two devices thing1 and thing2 on the dmz interface of a 60E. The devices are on different subnets. VIP access to thing1 is working fine, but thing2 fails with what looks like a routing issue that I can't sort out.Relevant config:config system interface    edit "dmz"        set vdom "root"        set ip 10.6.6.1 255.255.255.248        set secondary-IP enable        config secondaryip            edit 1                set ip 192.168.91.2 255.255.255.224            next        end    nextendconfig firewall vip    edit "vip-thing1"

I' d like to generate a alertmail, to see whether it is working. I created an smtp server configured an alert mail. In the past i could test-connectivity in release 5 i can' t find a gui option and also could not figure out a cli command. any hints?

Hi - trying to get identical policies on 2 Fortigate 1801F firewalls to the purpose of high availability. The manual says that it is possible to copy the policies. but fails to mention how to do that. So, how do I copy fw policies to it peer? Can someone point me in the right direction? Thank you

Hi, We're planing on puting Forti EMS in DMZ, so clients can pick up telemetry from public.Does Forti EMS server needs to be domain joined machine or we can just connect it via LDAP(S) with AD?Forti EMS will also comunicate with Fortigates for ZTNA tag collectionI was looking official docs, all I can find is that EMS cant be installed on DC Thanks

Hi Guys,My company bought a Fortigate 80F a few months back. At that time we had around 85 users and Fortigate technical person suggested that it will handle up to 100 users in our environment. Now, we have around 70 more people who joined our company, so total employees will be around 160. Now I have few questions - 1) If we buy one more 80F firewall and use it in Active-Active HA mode, will it be able to handle the extra employees we have now? Meaning, (one firewall can handle 100 users), if we have two firewalls, will 200 users will be able to work? 2) Will the VPN users connecting to the firewall will also increase after adding the second firewall? 3) In the future if we get more employees (eg. 500), what is the best practice to handle the load? 

Hi,I have vms in a vlan and I am trying to support tls 1.3 load balancer with full offloading, but I can't get it to work (curl stuck then server no response). Things I tested with same config:- Virtual IP with tls 1.3 works.- half offloading with tls1.3 works.- if I change  the config below to support tls 1.2 it works. On the server side I have nginx with basic tls1.3 config (ssl_protocols       TLSv1.3; + certificates setup) In fortigate I've the certificates setup, and here's the load balancer config: edit "MY_TLS_LOADBALANCER" set type server-load-balance set extip ------.12 set extintf "port1" set arp-reply enable set server-type https set nat-source-vip disable set gratuitous-arp-interval 0 set http-ip-header enable set http-ip-header-name '' set ssl-client-rekey-count 0 set ssl-hpkp disable set ssl-hsts disable set ldb-method static set persistence none set extport 443 config realservers edit 1 set ip 192.168.20

Hello everyone,We have FG300 with FortiOS 6.2.3 and Freeradius. Use RSSO to authorize WIFI users. The user falls into the group on FG, but it is not defined in the policy and, accordingly, the policy does not work. We need help, which may be the reason. FortiGate # dia test app radiusd 3 RADIUS server database [vd root]: "index","time left","ip","endpoint","block status","log status","profile group","ref count","use default profile" 1,07:58:42,"192.168.51.10""host/ARM0796.lokb.spb.ru","allow","no log","<default profile>",1,Yes 2,07:59:57,"192.168.57.4""ushakov","allow","no log","usersLOKB",1,No FortiGate # sh user radius RSSO\ Agent config user radius edit "RSSO Agent" set rsso enable set rsso-radius-response enable set rsso-validate-request-secret enable set rsso-secret "secret" set rsso-endpoint-attribute User-Name set rsso-flush-ip-session enable set rsso-ep-one-ip-only enable next end FortiGate # sh user group RADIUS\ users config user group edit

Hi, we´re switching from MS FTMG to FortiGate with Explicit Web Proxy and a "Web Proxy Forwarding Server". The MS FTMG sends all DNS-Request to the configured 'Upstream Proxy'. How can i configure this Option on a FortiGate? Opening a Website results in '504 DNS look up failed'. Using a local DNS-Server is not an Option. There is no Webfilter configured.