Solved

My first post, so firstly.... Hi. I've read a lot on this forum but never actually created an account to post anything, now that i have, I'm sure this is going to be the first of many. I'm creating a static URL whitelist with whole load of URLs. I'm trying to make sure I get the rules right first time as I've been given an output from another appliance that was doing their web filtering for them and don't want to have to go through it again. So i just wanted to know.... if i want to allow (everything is blocked by default) xxx.yyy.zzz.com/abc would a 'simple' rule with that exact URL suffice? Or should i do a 'wildcard' rule with xxx.yyy.zzz.com/abc*?  Is there a difference? I've read the guide for 5.6(the version I'm on) but all of the examples do not include subdomains nor do they say much about the wildcard option. 

Hey guys, How you doing? Well, I will migrate from DHCP on Windows Server to DHCP on fortigate. I have lot of resevations on the server, is there a way i can make this reservations on Fortigate without doing it one by one. Like a scrip or something?  For example on Windows server i can do it through PowerShell, with something like this:  Add-DhcpServerv4Reservation -ScopeId 192.168.0.0 -IPAddress 192.168.0.XX -ClientId "XXXXXXXXXXXX" -Description "Reservation for XXX" And I just replicate for every reservation I want.  Appreciate your help,  Thank you  

Lately, I've been seeing various cert issues while browsing various sites. Even Outlook seems to be having problems with the FortiGate. You can see from the image below that outlook is having problems accepting the cert from the Fortigate. Is the configuration wrong? Is there a step missed in the process? Is there a cookbook on SSL inspection? [image][/image]

This post is not maintained anymore. Post your updates to this thread and rwpatterson will update his list: https://forum.fortinet.com/FindPost/100451 Building a Hardware CPU/Memory list. Disclaimer: This is a user contributed list. No liability assumed for accuracy and completeness. Fortigate: Model | Memory | CPU (Family, Mode) FGT 20C | ????? FGT 40C | 512MB ?Mhz | 1 FA526id(wb) rev 1 (v4l) FortiSOC FGT 50B | 256MB ?Mhz | 1 Geode Integrated Processor by AMD PCS @431Mhz (5,10) FGT 60 | 128 MB| CentaurHauls VIA Samuel 2 400Mhz FWF 60A | 128MB ?MHz | 1 CPU - CentaurHauls VIA Samuel 2 @ 400MHz (6,7) FWF 60B | 256MB ?MHz | 1 CPU - VIA Samuel 2 @ 400MHz (6,7) FGT 60C | 440 MB | FortiSOC (FA526id(wb) rev 1 (v4l), BogoMIPS: 524.28) FWF 60C | 440 MB | FortiSOC (FA526id(wb) rev 1 (v4l), BogoMIPS: 524.28) FGT 80C | 512MB ?Mhz | 1 CPU - Celeron (Covington) @ 600MHz (6,5) FGT 80C Rev2| 1024MB ?Mhz | ? CPU | 8GB Flash for logging etc. FWF 80CM | 512MB ?Mhz | 1 CPU -

I have about 40 LDAP and 10 Local user on a fortigate 30e added.If I want to add more user the output is as follow: reached the maximum number of entries On the data sheet are no restrictions as i can see.https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiGate_FortiWiFi_30E.pdf If somebody know something would be great. Thanks in advance

Running a FortiWiFi 60D with FortiOS 6.0.9 located at a remote data center. We have the firewall Hardware Switch with ports 1 through 7 as members. One dual NIC server plus 4 PC's are connected to the ports 1 through 6. One PC, PC-Red, needs to be put on its own subnet. To do this I assume that we need to take its Internal Port out of the Hardware Switch, and assign it's port to a subnet, different from the subnet used by the Hardware Switch. We know the IP address, MAC address, and hostname. Is there a way to determine which port PC-Red is connected to so that we only remove PC-Red and not the server or other PC's from the Hardware Switch?

Hello forum members, Load balancing to https servers is bit new for me. I have done in the past regular http load balancing. I was under the impression that with certificates on the servers and incoming https requests being sent to one or the other real server should have nothing to do with FortiGate needing certs on it as we are not really terminating https on firewall, but simply relaying the requests over to two inside servers. But when I tried to configure virtual server, it requires SSL offloading and that of course will require certificate on FortiGate. So why is it mandatory for FortiGate to do SSL offloading for load balancing? The two inside servers are windows IIS with few websites that are duplicated on them. I assume, worst case, I need to have customer export already installed certs on these two boxes as PFX bundle and then split those into their constituent private key and public (cert) and then import into FortiGate and then use those certs (or rather

Hi! I have a working ipsec VPN so that people can access our entire internal LAN when outside the office.My question is - Is it possible to block specific internal IPs when using this VPN? So that everyone can access our internal LAN except one specific server for example.

Hello, I would like to buy a 30E or 40F Fortigate for my private use.When I read documentation, I don't find the way to limit the upload speed for Microsoft onedrive only on my connection. Is it possible to do this ? Because, when my son (or me) does a synchronisation of ours photos, the uplink of my adsl is completely satureted Thank a lot

Hello Experts, Can someone please confirm that if we have a regular VIP with an Public IP address, other than the Firewall external interface IP, will return traffic from the exposed server will use the same Public IP from the VIP? If not, do I need to create an IP pool with the same Public IP and then use that to NAT Internet bound traffic from server? Also what IP will be used by server if it initiates the traffic out to Internet in case of exposed server with VIP setup? Thanks

HiWe have a Venezuela CANTV Metro Ethernet link and we need to connect to Fortigate 60E in port 7 (WAN1 & 2 are in use in a SD-WAN and we need to include this link) We received from CANTV the follow parametersVLAN:                   118CANTV WAN IP:     190.202.4.9Customer WAN IP: 190.202.4.10WAN Mask:            255.255.255.252LAN IP:                 201.249.206.128 IP Available:          201.249.206.129 to 134 (135 is for broadcast)LAN Mask:            255.255.255.248 Someone can help us? We will appreciate a lot... Regard

Hello to all! I am new to forum and and FortiGate devices and I need some help. I just bought second hand Forti 100D, but it has old FortiOS (5.2) and form what I see there is no way to update it's firmware without subscription? Since I have bought this for HomeLab I don't need cloud/extended features and I must say I was shocked when I saw that I cannot event update firmware? Is this true? If it is really true, what is the lowest subscription to get access to firmware(since this is the only thing I need), as I said I don't need 24x7 support or others since this is for HomeLab purposes and learning.   

hello everybody, I recently updated an ha cluster of 100E from 6.2.2 to 6.4.5 following the suggested upgrade pathafter the update the HA cluster status is out-of-sync, I checked using diag sys ha checksum and I found a firewall address named FCTEMS_ALL_FORTICLOUD_SERVERS created on both master and slave but with different UUID I tried to set the UUID manually but I get the error "UUID attribute cannot be set directly", I tried to delete the object, it was deleted on both master and slave and the conf appeared in-sync but after a few minutes the address is automatically re-created with different UUID on the two firewalls and the HA status is out-of-sync  did anybody face this issue and found a solution?thanks!

Hello everyoneI'm facing a quite strange problem on my FG-60F wit FW v6.4.5 build1828 (GA)Either I do not understand the sense of a firewall or I'm not experienced enough. I'm using an IP block list connected via an external connector. The connector shows 1259 valid IP addressesI added a new deny policy on the very top of the chain to block all traffic from WAN1 to any where the source address is in the block list. Whatever I'm trying, this policy just does not work. I added also the current IP from my smartphone provider to the list for testing.  The IP is listed in the block list, but even so I'm still able to connect to everything which shouldn't be possible at all. If I block myself via a normal static address then is works as expected. The IP was found in the block list I'm still able to connect even so the bad guys  I really wonder if someone else has the same issue and how this could be fixed. Thank you very much! 

Hello, I have a server in my DMZ which must communicate with my antivirus manager server in my LAN.Ports used are 80 and 443IP v4 rules are ok. I encounter an issue when I try to access to the url [link]https://antivirusserver.domain.local[/link] from my DMZ serverI get the following messageWeb Page Blocked!You have tried to access a web page which is in violation of your internet usage policy.URL: [link]https://F-Secure[/link] Policy Manager automatically generated self-signed certificate/ Category: Unrated User name: Group name: To have the rating of this web page re-evaluated please click here. If I disable the web filter in my rule I can browse the URL.I tried to add antivirusserver.domain.local as a wildcard and allow it to static url filter but it doesn't work.Allow tried to add the url to my white list in web rating overrides but it doesn't work. Do you have an idea ? Regards,

Hi all, While I'm waiting on my first FortiGate's, I would like to prepare some things. We will have 11 BO which will connect to the HQ. At HQ we will have two 200F in HA, all BO will have 80F.HQ will have one Win 2019 Server (DHCP, DNS, etc).HQ will have FortiManagerI would like to make VLAN's and Subnets as next:VLAN 2 - Workstations (each site with their subnet ex. 10.10.10.0/24; 10.10.11.0/24, 10.10.13.0/24, etc over the same VLAN)VLAN 3 - ServersVLAN 4 - Management (switches, FG)VLAN 5 - WiFi - EmplyeeVLAN 6 - WiFi - GuestsVLAN 7 - Other (UPS)VLAN 8 - Trunk HQ - 100 Mbps InternetBO - most of them 50 Mbps and some 80 MbpsObviously need to split the tunnel  My questions: - What kind of VPN connection would you recommend? Routing?- Would it be better if I split VLAN so for each subnet different VLAN (each BO with their VLAN)? I'm not sure if this would make more trouble for the administration. VLANs 2, 3, 4, 7 and 8 need to talk to each other. VLAN 5 and VLAN

My FortiAP-112D has two holes at the bottom of the housing for Ethernet cables, each about 11/16" or 18mm.  These were supposed to have weather seals, judging from the image on the cover of the QuickStart Guide.  Due to the way the bottom cover slides into place, a standard cable gland out not work.  Maybe some molded rubber piece was used. Can anyone advise what sort of seal to use and/or where to find it? Thanks,billvo

Hello Everyone,I don't know if what i want is even possible but here it is. I have a client site with two vpns tunnel to two remote locations. What i want is if the ping to an internal ip address in one of the remote locations is fail i want the vpn interface toward that location to be disable.Thanks in advance.

friends to update the version of fortimail, I click on "UPDATE". I ask this because I read a kb about updating the fortimail but it does it in another way, this is the kb: https://kb.fortinet.com/kb/documentLink.do?externalID=FD45326 according to this document you click on "Restore Firmware" but why? if it is a version update and NOT restore. Could you help me clear this doubt?

Hi all!I have a simple questoin about HA-cluster settings.We have 2 Fortigate 92D in active-passive mode (Master=№1, Slave=№2)The FortiOS version is v6.0.11 build0387 (GA) on both devices.Recently, I have found that my Fortigate 92D №1 didn't become a Master after rebooting or restoring connections.I had to return the Master role to first Fortigate 92D manually.As I understand it, by default, elections inside the HA cluster are launched every 5 minutes.Is that something wrong with my configuration? That's is a Master(№1) config: config system ha    set group-id 10    set group-name "HAGroup1"    set mode a-p    set password ENC *****************************    set hbdev "internal13" 50 "internal14" 50     set session-pickup enable    set override disable    set priority 150end The Slave(№2) config: config sys

Hi, I have a fortigate 30E (6.2.4 firmware version) and I am experiencing problem with internet speed on it. The wan led is constantly blinking amber (speed) and blinking green for LINK/ACT.  I´ve been looking on the internet for any explanation but I cant find any. FGT#diagnose hardware deviceinfo nic wan Description Marvell NETA Gigabit Ethernet driver 00000010 System_Device_Name wan Current_HWaddr 90:6c:ac:63:1b:29 Permanent_HWaddr 90:6c:ac:63:1b:29 State up Link up Speed 100 Duplex full Rx_Packets 2679 Tx_Packets 3737 Rx_Bytes 720292 Tx_Bytes 3840955  Can someone tell me what can this be or help me troubleshoot this issue!

Hello, I created a new interface in Firewall. Although ICMP is allowaccess at Interface; clients cannot ping the gateway address.  When I create debug in Firewall; I see it was dropped because it didn't match the rule. Normally there is no need to have a rule for the client to ping the gateway address. Where could the problem be? id=20085 trace_id=1155 func=print_pkt_detail line=4915 msg="vd-LOCAL received a packet(proto=1, 10.100.17.11:19760->10.100.17.1:2048) from Server-MNG. type=8, code=0, id=19760, seq=486." id=20085 trace_id=1155 func=init_ip_session_common line=5062 msg="allocate a new session-0f73a6b8" id=20085 trace_id=1155 func=fw_local_in_handler line=392 msg="iprope_in_check() check failed on policy 0, drop" 

Hello,Having a new Fortinet network, we are seeing some very strange issues on the network. It is very sporadic, which is hard to pinpoint the issue, as network performance works great and the next minute it fluctuates. First we started seeing that a file copy to our file server (1 GB connection) was occasionally fluctuating fast and slow. When copying files it would burst up to 108 MB/s, then drop down to 10 MB/s or below (sometimes pause for a couple seconds), then increase up to 50 - 80 MB/s, and would form this wave. The second file copy we tried, it would copy around 100 MB/s all the way across (2 GB file copy). So then we try it again a minute later, and the performance is horrible. I noticed a couple things when I started a wireshark capture: Occasionally I will see TCP Spurious Retransmission, TCP ACKed unseen segment, TCP Out-Of-Order, TCP Dup ACK (even when I'm not really actively doing anything on the network). Now here is the strange thing, if

I did a full reset via the CLI with the command: exec factoryreset I looked at the instructions: https://kb.fortinet.com/k....do?externalID=FD37052 Access through the WEB did not work connected via SSH as user: admin set a new password enabled access through the internal interface with the command: CLI commands:     # config system interface        edit <interface name>            set allowaccess ping http https    end I looked at the instructions: https://kb.fortinet.com/k....do?externalID=FD34688 Logged in as a browser at http://192.168.1.99 (port 1) When I go through the settings wizard, I can't go through the registration stage (I registered on the site beforehand) Register with FortiCare This step is required to activate threat protection services and receive firmware & package updates. I enter login (email) and password Country Can't choose a Resell

Hi, Guys, We found some strange syslog as the following, we have not configured or defined these policies ?Any recommendation to fix these problems: uID : 5025117 Date : Today 03:46:51 Host : 10.16.9.6 Messagetype : Syslog Facility : LOCAL7 Severity : ERR Syslogtag : date=2020-12-23 Checksum : 0 Message time=03:46:50 devname="Forti400e_Fw02" devid="FG4H000000000004" logid="1501054200" type="utm" subtype="dns" eventtype="dns-response" level="error" vd="root" eventtime=1608709611360453548 tz="-0400" policyid=0 sessionid=0 srcport=0 srcintf="unknown0" srcintfrole="undefined" dstip=169.254.0.2 dstport=53 dstintf="unknown0" dstintfrole="undefined" proto=17 xid=47105 qname="login.microsoft.com " qtype="A" qtypeval=1 qclass="IN" msg="A DNS resolution error occurs" action="pass" error="DNS query timeout"   Details for the syslog messages with id '5032066' uID : 5032066 Date : Today 04:03:27 Host : 10.16.9.6 Messagetype : Syslog Facility : LOCAL7 Severity : WARNING Sy