Solved

Hello, i try to ping between 2 ipsec tunnel IPs, but it does not work.I have a FGT 101-E with these config:config system interfaceedit "VPN_W" set vdom "root" set ip 10.102.0.6 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.102.0.5 255.255.255.255 set snmp-index 42 set interface "wan2" next end and a FGT 60-D with these config:config system interfaceedit "VPN_N" set vdom "root" set ip 10.102.0.5 255.255.255.255 set allowaccess ping https http set type tunnel set remote-ip 10.102.0.6 255.255.255.255 set alias "VPN-Verbindung zur N" set snmp-index 15 set interface "wan1" next end If i try to execute ping 10.102.0.6 an FGT 60-D or execute ping 10.102.0.5 on FGT 101-E, it does not work.Am i correct in the assumption, that i do not need any policy, because ping is enabled at the interface? Thanks Markus

Dear Fortinet Team, We had problem that our Routing didn't work (Please see attachment). When we tried to disable 0.0.0.0/0 then enable specified static routing, the packet didnt pass to network. The routing that we made same like Monitor --> Routing monitor. Any advice for us? Thank you.

Hi,I'd like to forward whole NTP traffic to my NTP server.I'd like to use VIP where source IP is in range from 0.0.0.0-239.255.255.255 and do portmapping 123-123 (use service NTP).        set type load-balance         set service "NTP"         set extip 0.0.0.0-239.255.255.255         set mappedip "10.20.68.192-20.121.12.194"         set arp-reply disable         set portforward enable         set mappedport 123And the problem is if any other VIP exists. For example:        set extip 10.100.200.3         set mappedip "10.20.3.35"         set extintf "any"I receive information that NTP is overlapping another VIP but if i use extip from 0.0.0.0

Hello all, Many years ago, someone set my company up on a local 132.147.xxx.xxx subnet that is currently configured in our FortiGate (running 6.2). I would like to gradually migrate us off of this. My question has to do with the best path to do it. We currently have FortiSwitches that are in standalone mode. With a LAN interface built for this current addressing scheme. I would like to move us to a new addressing scheme with a 10.16.xxx.xxx VLAN for data and a 10.17.xxx.xxx for Voice as we would like to eventually add VOIP. Would it be best for me to build this through FortiLink? I have two switches that are not currently being used, that I could start this on. Also, how would I build a path between the old network (132.147) and the new network (10.16) so that I could gradually migrate devices over to the new network, could I just do a policy for both directions? Thanks in advance.

We have +700 Firewalls Fortigate managed with the Fortimanager and the FWs are configured with DNS and now we want to change the DNS IP adress in all the FWs Hwo to change the configuration of the DNS in devices (Firewalls) from the fortimanager?

Hi All, We want to configure SNMP monitoring using PRTG trial version for short time later planning to go with Licensed PRTG. As I am new to this monitoring Application and SNMP in the FortiGate I have below concern 1) Can we enable the SNMP on LAN port at Production time?2) Will FortiGate Support Trial version of PRTG?Kindly suggest on this. Soon I need to enable monitoring our WAN links.  Thank you,Regards,Srini

Hi,After upgrade Fortigate 100E to new firmware v7.0.0-build0066 all 221E APs have Offline status and do not registering. They get the address via dhcp and ssh is work. After downgrade firmware to v6-build1803 its works correctly.  There is no word in the compatibility documentation about version 7. Do I understand correctly that they are incompatible? https://docs.fortinet.com...trix/209640/fortiap-w2

Greetings, I'm attempting to get OSPF working between my 100F and Edgerouter Infinity, I'm brand new to fortinet so I'm guessing its something very silly that I'm over looking, but my google-fo appears to be failing me.  The problem boils down to the Fortinet side is not getting the routes from the edgerouter# get router info ospf routeOSPF process 0:Codes: C - connected, D - Discard, O - OSPF, IA - OSPF inter area       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2       E1 - OSPF external type 1, E2 - OSPF external type 2C 172.16.1.0/24 [1] is directly connected, TransitLink, Area 0.0.0.0So I'm never seeing area 1 on the fortinet side, but both routers are Full adjacent neighbors  get router info ospf neighborOSPF process 0, VRF 0:Neighbor ID Pri State Dead Time Address Interface0.0.0.1 1 Full/Backup 00:00:32 172.16.1.2 TransitLink # run show ip ospf neighbor Total number of full ne

My situation is this: I have 3 different ISPs: VIVO, TIM, and NET here in Brazil (1 Static IP and 2 Dynamic). I need to do 3 things:   1) Connect my 3 ISPs on one device.   2) I need to use only one public IP to connect to the internet. Every single workstation needs to connect through this IP as if there is only one ISP connected.   3) If the main link goes down, another link could assume its place but the same old public IP still must be used.  Is there a way to do that? Any appliance, proxy, or DDNS?  Thanks in advance.    

On this page: https://docs.fortinet.com/document/fortigate/6.2.0/best-practices/262994/performing-a-configuration-backupit says to backup from GUI, Go to Dashboard > On the System Information widget, select Backup next to System Configuration.But my System widget doesn't have such options, see attached. 

Hey everyone!We are trying to limit distributed BGP routes to neighbors using "set match-interface" for the source of the route. The issue we are having is that this does not seem to work together with neighbor route-map-out. As a work around, we are using set match-interface on redistribute connected and redistribute static and setting tags to later filter on the neighbor route-map-out. The question is how does "set match interface" actually work on a route-map-out. Documentation seemed very scarce on this topic. I am guessing it is matching the interface the neighbor is on, and not actually the source of the route? Any ideas?  Thanks in advance,RK

Good day to everyone! I faced a real problem with publishing sites with my Fortigate 100D. I have a web-server that published with http port 80. I need to redirect all http trafic to https. We are migrating from Forefront TMG and there I could do this by adding aditional listener on the 443 port and redirecting whole traffic to it. Can I do this with Fortigate 100D? Well actually there is no problem with publishing 80 port by VIPs but I have no idea how to redirect it.. I' ve tried everything but it doesn' t works... Please, help me!

Hello, Our customer complains of recurring ssl vpn outage, this impacts several users. I enclose the forticlient logs sent by the user, the day the cut occurred (03/30/2021). For information, the users of this customer connect with AD authentication in vpn ssl.Do you have any troubleshoot ideas? Because these are random cuts, and it does not happen at the same time for everyone. Thank you for your help.Best RegardsHanane

Dear all, How can I add a traffic shaper to a single policy as attached screen capture? Is it need to edit in CLI?Leo

Hi all, I've been running a Fortigate 61E in LAG mode (ie: static) on an Edgeswitch for some months now and it has worked well. I never managed to make it work in LACP. Now I'm moving to a Unifi Switch, which only supports LACP, and ... they don't negotiate. Wether I use passive or active, they just won't talk to each other. Any clue ?

I have one GNS3 lab environment for the testing purpose. I have one interface "LAN2" on fortigate which ip is 10.10.10.1 and one loopback interface ip is 20.20.20.1. I connect with router interface. When i configure OSPF on my fortigate LAn2 interface i got the faild dependeny Error.Please my attachement.

Hello all,  Time has a question on my mind, "What consumes less battery, SSL VPN or IPSEC?" Because I want a permanent VPN connection for Android devices. We use here EMS Server and FortiOS 7.0 Very thanks and best Regards :)

Installed FortiWiFi 50E , firmware 6.2.7 build 1190 Issue: VOIP phones are working except for park function. When receptionist parks a call, the next user cannot hear the call if the pick up the parks call. Weird thing is that if the pick up the parked call, place it on hold and then resume the call, the call will then proceed as normal. So: can't pickup parked calls unless you press hold twice. What we've tried:1. disable sip ALG helpers through CLI2. Created a few services to allow traffic on ports: 53 UDP 5060-5062 UDP 20000-40000 UDP and allowed these services to talk from LAN to WAN and from WAN to LAN3. rebooted phones, switches, firewall etc.4. Created a ticket with Fortinet, currently they are researching the issue...but my client is a Karen and is breathing down my back. Thank you for any help!

My first post, so firstly.... Hi. I've read a lot on this forum but never actually created an account to post anything, now that i have, I'm sure this is going to be the first of many. I'm creating a static URL whitelist with whole load of URLs. I'm trying to make sure I get the rules right first time as I've been given an output from another appliance that was doing their web filtering for them and don't want to have to go through it again. So i just wanted to know.... if i want to allow (everything is blocked by default) xxx.yyy.zzz.com/abc would a 'simple' rule with that exact URL suffice? Or should i do a 'wildcard' rule with xxx.yyy.zzz.com/abc*?  Is there a difference? I've read the guide for 5.6(the version I'm on) but all of the examples do not include subdomains nor do they say much about the wildcard option. 

Hey guys, How you doing? Well, I will migrate from DHCP on Windows Server to DHCP on fortigate. I have lot of resevations on the server, is there a way i can make this reservations on Fortigate without doing it one by one. Like a scrip or something?  For example on Windows server i can do it through PowerShell, with something like this:  Add-DhcpServerv4Reservation -ScopeId 192.168.0.0 -IPAddress 192.168.0.XX -ClientId "XXXXXXXXXXXX" -Description "Reservation for XXX" And I just replicate for every reservation I want.  Appreciate your help,  Thank you  

Lately, I've been seeing various cert issues while browsing various sites. Even Outlook seems to be having problems with the FortiGate. You can see from the image below that outlook is having problems accepting the cert from the Fortigate. Is the configuration wrong? Is there a step missed in the process? Is there a cookbook on SSL inspection? [image][/image]

This post is not maintained anymore. Post your updates to this thread and rwpatterson will update his list: https://forum.fortinet.com/FindPost/100451 Building a Hardware CPU/Memory list. Disclaimer: This is a user contributed list. No liability assumed for accuracy and completeness. Fortigate: Model | Memory | CPU (Family, Mode) FGT 20C | ????? FGT 40C | 512MB ?Mhz | 1 FA526id(wb) rev 1 (v4l) FortiSOC FGT 50B | 256MB ?Mhz | 1 Geode Integrated Processor by AMD PCS @431Mhz (5,10) FGT 60 | 128 MB| CentaurHauls VIA Samuel 2 400Mhz FWF 60A | 128MB ?MHz | 1 CPU - CentaurHauls VIA Samuel 2 @ 400MHz (6,7) FWF 60B | 256MB ?MHz | 1 CPU - VIA Samuel 2 @ 400MHz (6,7) FGT 60C | 440 MB | FortiSOC (FA526id(wb) rev 1 (v4l), BogoMIPS: 524.28) FWF 60C | 440 MB | FortiSOC (FA526id(wb) rev 1 (v4l), BogoMIPS: 524.28) FGT 80C | 512MB ?Mhz | 1 CPU - Celeron (Covington) @ 600MHz (6,5) FGT 80C Rev2| 1024MB ?Mhz | ? CPU | 8GB Flash for logging etc. FWF 80CM | 512MB ?Mhz | 1 CPU -

I have about 40 LDAP and 10 Local user on a fortigate 30e added.If I want to add more user the output is as follow: reached the maximum number of entries On the data sheet are no restrictions as i can see.https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiGate_FortiWiFi_30E.pdf If somebody know something would be great. Thanks in advance

Running a FortiWiFi 60D with FortiOS 6.0.9 located at a remote data center. We have the firewall Hardware Switch with ports 1 through 7 as members. One dual NIC server plus 4 PC's are connected to the ports 1 through 6. One PC, PC-Red, needs to be put on its own subnet. To do this I assume that we need to take its Internal Port out of the Hardware Switch, and assign it's port to a subnet, different from the subnet used by the Hardware Switch. We know the IP address, MAC address, and hostname. Is there a way to determine which port PC-Red is connected to so that we only remove PC-Red and not the server or other PC's from the Hardware Switch?

Hello forum members, Load balancing to https servers is bit new for me. I have done in the past regular http load balancing. I was under the impression that with certificates on the servers and incoming https requests being sent to one or the other real server should have nothing to do with FortiGate needing certs on it as we are not really terminating https on firewall, but simply relaying the requests over to two inside servers. But when I tried to configure virtual server, it requires SSL offloading and that of course will require certificate on FortiGate. So why is it mandatory for FortiGate to do SSL offloading for load balancing? The two inside servers are windows IIS with few websites that are duplicated on them. I assume, worst case, I need to have customer export already installed certs on these two boxes as PFX bundle and then split those into their constituent private key and public (cert) and then import into FortiGate and then use those certs (or rather