Solved

helloi have a only one subnet that don't much with any ipv4 policy, when i check the router loockup i find the route to this subnet but when i use loockup policy to this subnet they much with poiciy id=0  knowing that i have policy from my vlan to wan with source set to any and destination set to any and all service are accepted

Good Morning Everyone, My 2 questions are hopefully very simple and probably a duplication of questions previously asked... 1. Are the FortiTokens still the valid way to handle Two-Factor Authentication with FortiGate products for SSL VPN2. I'm testing with the 2 free tokens. If access to the VPN is granted through an Active Directory group, the VPN does not ask for the FortiToken. If a user is granted access to the VPN using only their users, the FortiToken is required. Any ideas? All the best, Dan

Hi ,When you set a traffic shaper to be per policy, the FortiGate applies the traffic shaping rules defined to each security policy individually. For example, if a traffic shaper is set to per policy, with a maximum bandwidth of 1000 Kbps, any security policies that have that traffic shaper enabled get 1000 Kbps of bandwidth each. For example, if a traffic shaper is set to per policy with a maximum bandwidth of 1000 Kbps and applied to four security policies, each policy has the same maximum bandwidth of 1000 Kbps. I really got confused about the security policy mentioned here . I can see  tarffic shaping policy The same rule is apply for traffic shaping policy also ? Please help Thanks

Hi, guys, We have Fortigate 400e HA pairs, and the HA cables (two cables for HA ) are connected directly (i.e Forti400e -UTP cable- Forti400e). May I know if these two cables could be Lacp ? Also what are optimal values of the configurable setup for HA synchronization ?  Many thanks

Hi,I want to limit bandwidth  for windows update which is initiated by local LAN computers  The question is the below policy is ok ?  (source will be all and destination will be all )  Q2. If I want to use  "shared shaper"  instead of  "reverse shaper" ,What need to be done ,(Just for learning )  Q3 .  In shaper "windowsupdate"  I have  set 10Mbps .In my question If I use the same shaper  in multiple policies (for example in policy 1 and 2 ) , the 10Mbps will be divided  between policies ?  Thanks 

i am using ssl vpn with untrusted certificate, i wonder is this connection secure?can someone give me an advice?

hello allwe have 2 wan links peered with ISP for internet redundencywe are able to recive the 0.0.0.0 defult route from ISP Via BGPmy question regards a third wan link we own for CAM use , it uses a static route to the internet aswellbut i cant seem to have both 0.0.0.0 routes in the routing table in the same timeso we cannot acsess the CAM from outsidehow can i resolve this ? i have tried to put same distance and diffrent priority but the BGP route disapeers . .anyone came accross this issue ? Routing table for VRF=0 S       0.0.0.0/0 [30/0] via 192.117.0.*, port3 B    *> 0.0.0.0/0 [20/0] via 192.117.9.*, wan1, 03:22:58    

https://docs.fortinet.com/document/fortigate/6.4.1/fortios-release-notes/760203/introduction-and-supported-models Has someone tried this version already?

Hello!I'm running into a problem with our Fortigate 100E running 6.0.7. The crux of the matter is that the firewall policy contains these two entries (among others):edit 55     set srcintf "wan1"     set dstintf "any"     set srcaddr "BLOCKLIST"     set dstaddr "all"     set schedule "always"     set service "ALL"     set logtraffic all     set fsso disable next edit 46     set srcintf "wan1"     set dstintf "port1"     set srcaddr "all"     set dstaddr "DNAT_TCP_22" "DNAT_TCP_443" "DNAT_UDP_53"     set action accept     set schedule "always"     set service "PORT_TCP_22" "PORT_TCP_443" "PORT_UDP_53"     set logtraffic all     set fsso disable next&nbs

hi. i've read this articlehttps://docs.fortinet.com/document/fortigate/6.0.0/handbook/964247/dual-homed-bgp-example and at some point, there is an instruction to do an inbound policy from the isp back to the company lan. isn't that dangerous? why is it needed? isn't the only important port from the isp back to the internal network is the bgp port?

Hello, wondering if FQDN would be supported as a real server's address in a load balancing config? It seems that just IP addresses are supported but not using a FQDN? Thanks,Holger

Hi all, i have 2 FGT 800C running in HA mode Active-Active before 3 days ago i have upgraded the firmware from 5.2.4 to 5.4.2 using proper upgrade path which provided by fortinet 5.2.4 > 5.2.6 > 5.2.9 > 5.4.2, after upgrading the firmware i noticed that FGT GUI is very very slow especially when i navigate to polices page took like 3 to 5 mints to open. i have opened ticket with foritnet support and waiting for their reply, did anyone faced this issue? Note: i changed the HA mode to Active-Passive, matched HA Hash, and restarted the both units. Thank you.

i want to use a 100F in HA mode but the 2 devices will at opposite ends of a long building so i was going to run the HA over fibre but the HA ports are RJ45 (ethernet) can i use any port for HA or will i have to run Cat5/6 for the HA? 

Hi, Interface1 interface2I have created the policy source is interface 1 and destination is interface 2Why do I have to create a policy in reverse direction ( I mean source is interface 2 and destination is interface 1)Thanks 

Hello i have a problem about reset AP222E  so i try more time but i can't reset !!  So what's the problem exact and how i can resolve !!! Also this AP222E can't receive any DHCP !!! Please someone expert can reply me and help me Thanks in advance

90D has high CPU utilization almost all the time, using dia sys top, netscan runs at 95% almost all the time. Any ideas?

Good day all, we have some interface & zone that are not in use.What is the best method to delete these & also checking on if it affects anything else.  

https://docs.fortinet.com/document/fortigate/6.2.4/fortios-release-notes/760203/introduction-and-supported-models 

I've tried many times in the past to try and block IPs in our FortiGate 60E (firmware v5.6.3 build1547 (GA)) and I must say it's the most convoluted and confusing UI I've used to date. Which is why I'm here asking what I'm doing wrong. What I've typically done is create a new address and then set it to deny in the IPv4 Policy. (step1.png)Policy & Objects -> Addresses Create New -> Address Name: "45.141.84.162/32 20200805" Type: Subnet Subnet/IP Range: 45.141.84.162/32 Interface: wan1 (or all) (step2.png) Policy & Objects -> IPv4 Policy Create New Name: "Block 45.141.84.162" Incoming Interface: wan1 Outgoing Interface: internal Source: "45.141.84.162/32 20200805" Destination: all Schedule: always Service: ALL Action: DENY Enable this policy: Checked But i then still see traffic coming through as if it did nothing. I've also tried using IP ranges of 45.141.84.162-45.141.84.162 and that has done nothing as well. So far the only way I've seen to actua

Good day all, Using zones in our fortigate firewall. Is traffic within the same source & same destination zone allowed by default or it needs a rule in place? 

Fortigate 100E 6.4.1Hello guys, I am new at forum as well at Fortinet Firewall. I am working in a company at Greece. We have Fortigate 100E with 6.4.1. Before i mention my problem let me explain you my topology. We have 2 ISP on WAN 1 and WAN 2. On WAN 1 which connected to ISP1 we have a block of 16 static IPS and on WAN 2 he have ISP 2 with DSL connection, ISP modem/router in Bridge Mode and in WAN 2 on Fortigate PPPOE ( Username and password) with static IP. On my Local Network i have my LOCAL LAN ( 192.168.230.0/24) and i have created 2 VLANS ( VLAN 100, 192.168.5.1/24 and VLAN 200, 192.168.8.1/24) under my LOCAL LAN. In the VLANS i have Servers ( Mail Server, FTP Server, Web Server, Web app Server etc) My Goal is to achieve traffic from LOCAL LAN and VLAN 100 go through WAN1 ( I have setup in my WAN 1 secondary IPs so i can bind every server with one static IP ( one to one NAT) ) and i havee setup firewall policies. And VLAN 200 traffic go through WAN 2 ( PPPOE with Static) an

Hi,scenario is, we have MPLS p2p VPN and internet DSL link and DIA link. our server is on another site where we have MPLS connectivity. currently internet traffic is going through DIA link this subnet 192.168.4.0. rest of the traffic is going through MPLS which is correct. but i want to make DSL primary internet. i can do this by changing ADMINISTRATIVE DISTANCE but the problem is from outside those who are connecting through SSL vpn cannot login in. what is the solution?

All,Successfully upgrading a FortiGate 200F results in a broken FortiDDNS application.  The FortiDDNS server list no longer populates with a list of available domains which breaks the service.  Rebooting the firewall does not solve the problem.  Further, the maintenance tunnel through FortiCloud will not connect to the system.  Has anyone else experienced this issue?  Is there a solution to this? If the FortiDDNS service is important to you, then I recommend against upgrading to FortiOS 6.4.2 until this is addressed.

Hi, guys, I am rather new to Fortigate devices, after a pair of Forti400e have formed HA structure, I found them not synchronized due to the following message:login: slave's configuration is not in sync with master's, sequence:0 slave's external files are not in sync with master, sequence:1. (type APPDB) slave's external files are not in sync with master, sequence:3. (type CERT_CA) slave's external files are not in sync with master, sequence:4. (type CERT_CA) slave succeeded to sync external files with master slave's external files are not in sync with master, sequence:0. (type APPDB) slave's external files are not in sync with master, sequence:1. (type APPDB) slave's external files are not in sync with master, sequence:3. (type APN_CERT) slave's external files are not in sync with master, sequence:4. (type APN_CERT) slave succeeded to sync external files with master slave's external files are not in sync with master, sequence:0. (type APN_CERT) slave's external files are not in s

Hi, Guys, I created two SD-WAN rules as the following:------------------------------------------------------config service   edit 1       set name "Access_to_Internet"       set dst "all"       set src "all"       set priority-members 1 2 3    next    edit 2       set name "LL_Line-to-16HK-DC"       set dst "16HK_V167_10.16.7.0"       set src "VLAN329_10.32.9.0"       set priority-members 5 4 6    next    end   How can I prioritize the "ëdit 2"  for routing decision, thx a lot ? Many thanks