Solved

Please see attached screenshot of an auto-discovered device.Device discovery, even if the IP is provided by the FG's DHCP  - may fail to collect the IP addresses of devices.(firmware 6.0.12)What am I missing? it is hard to believe that one is supposed to make IP objects manually for the use in FW rules. Even  some devices are populated with IP address, they can't be used anyway (as source or destination in a rule) due to the message "One address, address group, or Internet service is required" 

Hi I'm trying to set up SSL offloading, but I can't see the Virtual server in the list of address to assign to the destination in the policy.What am I doing wrong? I don't have central NAT enabled.

Everything is works fantastic with the DMZ setup. DMZ => WAN (works) DMZ => DMZ (works) LAN => DMZ (works) DMZ ╪> LAN (DMZ can not see the internal network)   I'm wondering if there is a way to disable a DMZ from pinging another DMZ device. So far, they can ping each other.   I've so far disabled the administrative ping in the Fortigate. I've created the following: DMZ to DMZ DENY - From DMZ - To DMZ - Source all - Destination all - Service ALL - Action DENY  They can still ping each other.   Any help would appreciated.   Thanks

Hello,Can somebody remind me the CLI to set the log severity level in a FG unit? The handbook clearly states that:"The log severity level is defined by you when configuring the logging location", but it doesn't say how (not the first time, actually...)Thanks

Hi everyone.I am new to Fortigate firewall,  coming from Juniper SRX back ground.This is what I am trying to accomplish: End hosts--SW--trunk----Port2-Fortigate FW Port 2 should be layer 2 trunk port, accept tagged traffic for vlan 20Vlan 20 should be defined and have IP 2.2.2.2/24 How do I proceed? Additional info:Platform: VM (Fortigate-VM64, version v6.2.0 ,build 0866) Thanks and have a nice weekend!!  

Hello! I would like to access the following url: www.heise.de But I would like to block all subfolders/subdirectories, like www.heise.de/forum, www.heise.de/forum/startseite etc. The site is https, I have a Fortigate 30d with latest 5.8 fw, webfilters working. I tried everything with filters, at least that I know of. I can block of course the whole domain, but not the subdirectories to their forum. I suspect, it has something to do with the https. Reason: I want myself being blocked from posting in their forum, but still, I want to consume the news=) Any help? Thx.

Hi, guys,I am confused to Fortigate HA cluster mgmt interface.I have two Fortigate 600E devices and form a HA-pair; an IP address for their OOB mgmt interface individually, as the following requirement (no mgmt VDOM, and the following configuration through root VDOM) :1. 192.168.100.10 ( for the OOB "mgmt" interface of the primary Fortigate) 2. 192.168.100.20 ( for the OOB "mgmt" interface of the secondary Fortigate) 3. 192.168.100.100 (for the cluster IP = always towards the master unit) 4. How I can configure the above requirement5. The above IP addresses should not be overlapped any advice and recommendation, many many thanks.  

Beyond the ability to manage the FortiSwitch via the FortiGate console, what other advantages or disadvantages are there to using the FortiSwitch vs. other third party switches such as Cisco, HP, Dell, Meraki, Aruba, etc.?

Hello, We are buying Fortigate firewalls and now senior management is investigating replacing our Cisco core with Fortinet switches.  This would be for the HQ of my organization, about 700 users overall spread across 5 buildings.  We also have about 550 remote sites, we are looking at the 40F and SD-WAN for those, but that's for a different thread. The Cisco switches are 6509E models, large chassis switches that have been workhorses for a number of years but are now approaching end of life.  We are currently running a 3 tier architecture with the 6509s at the core and also a distribution layer of Cisco 3850s and then access switches of various generations at the access layer. I was looking at maybe doing a stack of Fortinet 1048E models and then collapsing the campus network from a 3 tier to a 2 tier.  We have lots of fiber so getting 10G from the core to the access switches should not be an issue, other than, we're going to have to buy a lot more GBI

We have SSL Certificate Inspection enabled (we are NOT using DPI-SSL, so we don't have the MITM invalid certificate problem).  Certain services such as Amazon Echo, credit card POS devices, and PRTG application updates error out on connection with this enabled.  If I simply remove the certificate inspection from the IP4 rules everything works.  Are there any tweaks that will make just the services we're having trouble with connect?  I know with DPI-SSL you can set exclusions, but that option doesn't seem to be available for the certificate inspection option.  As a secondary question, what exactly is the Fortigate doing during certificate inspection that breaks these services?

Hi All, I'm a new Fortigate user.I just deployed a Fortigate 40F and 60F on two different sites today. I created a site-to-site IPSec VPN connection between the 2 sites. I also create a dialup (remote) VPN connection for the FortiClient on the Fortigate 40F.All these things work perfectly, however I would also like the remote users to be able to use the site-to-site VPN connection. The subnets in question are 192.168.49.0/24 on the 40F and 192.168.48.0/24 on the 60F. I would like to be able to access the 192.168.48.0/24 subnet when connecting to the 40F using the FortiClient VPN. I configured the dialup connection to use split-tunneling so only traffic to those 2 subnets go over the VPN connection. This works as expected, I see the routes in the Windows routing table: 192.168.48.0 255.255.255.0 10.10.2.3 10.10.2.2 1 192.168.49.0 255.255.255.0 10.10.2.3 10.10.2.2 1 I can access 192.168.49.0/24 just fine, but I cannot access anything on 192.168.48.0/24. I create a pol

Hi guys, I have a 60D fortigate that i'm using for VPN and firewalling.In the address list of the User Interface, there are many default addresses related to google, microsoft, citrix, apple and so on ...(see attached file).If I remove all these addresses and only keep the one i'm creating, will I have any issues ? 

Hi forum members,I am pretty new in forinet hardware. So I bought a used fortigate 100D and fist of all, I made a hard reset with the resetbutton on the front. Unfortunately bevor I read the manuals. So it sees, that now I have to log in with putty to manage the fortigate with a consol cable. I did so with putty and now ist says "open boot device failied" (see attached picture). As far as I know, I now have to flash it right? Therefore I need the flash firmware, but I can´t find it. To be honest, it is the first time that I work with putty, so I have to learn it now. I am really thankfull for help.Alexander 

Hi Guys,  I am having an issue whereby I am unable to delete an interface in the root VDOM, it has a TACACS+ reference on the interface and under the TACACS+ settings there is zero references.  The interface reference using TACACS+. Not sure what the (6 References) mean but I can't seem to trace it. I have tried using the CLI to remove the interface, however I get a return code of -23. Does anyone perhaps know what else I can do to get this removed? Thank you

Hello,I'm looking for solution that we have a s2s VPN connection between site A to our DCWe want to add a DR on OCI ( oracle cloud) and want to connect it also by s2s VPN and to make this connection as backup.If the connection/FW on DC side will go down the VPN will change to the DR and if the connection will go up again in the DC it will go back.Adding a visio What is the best way to make it happened? 

Hi all We have a 1000D device from our provider, how is this done with the air flow on this device? Is this something which comes "out-of-the-box" or can this be changed? E.g. another fan module which changes the direction? Does someone has a link to the hardware guide which describes this behavior and what needs to be ordered? Thank youMarkus

Hi, Maybe I missed this somewhere but I can't seem to find any information about this, so I decided to ask here. I have been told that it is possible to add custom replacement messages for blocked web pages using FortiManager. I can see the option to toggle https-replacemsg under the Policies & Objects > Security Profiles > Web Filter > profile > Advanced section, but I don't see where I can edit the replacement message. So far, users are able to see the default replacement message when trying to access blocked web pages, but I would like to edit the replacement message to better suit my organization. If anybody can guide me in the right direction that would help me a ton. I'm using a FortiGate-1500D 6.2 with FortiManager 300E v6.2.7 Regards- K.

Is there any news on a forthcoming Forticlient endpoint or EMS build that's compatible for Intel-based macOS Big Sur? Many thanks, Martyn

When you've activated certificate inspection or deep SSL inspection, the acceptance of the external certificate is up to the FG. When it rejects the external certificate it the page with the warning:"This Connection is Untrusted ..." You can check this e.g. on https://self-signed.badssl.com/ However, for this page's certificate the FG always uses a certificate signed by the factory "Fortinet Untrusted CA", regardless of what you've set up for HTTPS or SSL inspection. According to support (ticket #2289811), this is not configurable. In my humble opinion, this function is broken since it urges the user to (permanently) accept a root certificate which is present - and extractable - on every Fortigate on the planet, leaving a critical vulnerability for man-in-the-middle attacks. Are there any ways around this? Is this issue addressed in 5.6?

Business has a FortiGate running 6.0.10 and a few FortiAP's. Is it possible to set up a SSID for guest internet access only that does not require a password from the guest user? No LAN access is needed or wanted via the guest SSID. When creating a new SSID it looks from the GUI that a Pre-shared Key is required. Is there a way to set up an SSID without a required password?

What would be the benefit of the DNS database set as slave? Thanks in advance.

Has anyone integrated LDAP with Fortimail for admin login?

Hi lovely guys, Can you point me to how can i create a policy to allow an external IP to SSH to a specific internal server? I have tried the below but server still can't be reached. I've tried to add the external in Policy & Object>Addresses: Name: External_SSH_Access Type: Subnet IP: xxx.xxx.xxx.xx Interface: Any And added a policy in Policy & Object>IPv4 PolicyName: SSH_Access Incoming: Wan1 (My wan port)Outgoing: Prod Network (network where Server is)Source: External_SSH_AccessDestination: Server_to_SSH (via VIP that points to WAN IP to LAN IP with port 22)Schedule: AlwaysServer: SSHAction: AcceptNAT:OffEnable this policy: On Done all these, but i the person in this External IP can't reach the server. Any ideas on what am i missing, please. You help is much appreciated.

After upgrading to version 6.4.4 of Fortigate.There are a lot of policy that are missing in the Web Interface.There are at the CLI. Is there a bug, or is it something that i missed? Example this rules is not shown in the Web Interface:config firewall policy edit 2 set status enable set name "Allow DNS against Dalbjerg-DC01" set uuid adde7da6-38de-51eb-5b56-126ab8c13002 set srcintf "ITALink" set dstintf "DAL-INSIDE" set srcaddr6 "ITALink IPv6 networks" set dstaddr6 "Host6_dalbjerg-dc01_2a05:f6c7:4296:1::10" set internet-service disable set internet-service-src disable unset reputation-minimum set rtp-nat disable set action accept set schedule "always" set schedule-timeout disable set service "DNS" set tos-mask 0x00 set anti-replay enable set utm-status disable set inspection-mode flow set profile-protocol-options "default" set ssl-ssh-profile "no-inspection" set logtraffic disable set logtraffic-start disable set auto-asic-offload enable set np-a

Hi everyone, FG61E active-active HA Since v.6.2.3 we have very high memory usage. The Fortigates go into  conserve mode all the time and i can't get the memory any lower than 77%. I disabled unrequiered features, switched some policies from proxy-based to flow-based, reduced the session timers, logging etc. Nothing helps. The memory overflows while the CPU runs on <5% most of the time. I have a customer with about 20x FG 30E. Some of these do nothing but IP-Sec VPN and nothing else yet but the memory there is also on 68% while the CPU is <5%.  What can I do to reduce my memory usage? Or is it a firmware issue? There were problems with the memory management in v6.2.0 and 6.2.2 in the past.  Also I noticed that the FortiGuard DNS Filter Server is unreachable in v6.2.3. I configured the DNS Filter IP from v.6.2.2 (on which it works) and it doesn't work on v6.2.3 either. I already have a case open with fortinet about the DNS Filter issue. &nbsp