Solved

Hello,Our security auditor has asked that I generate screen shots proving that these firewalls use stateful inspection. They also want something showing uses anti-spoofing I have a fortigate 500d v.5.6, how do I know that it has ANTI SPOOFING and STATEFUL INSPECTION enabled? Will there be any command to see it?  

Hello, Has anyone been able to implement multiple VXLANs over virtual wire pair as described in the Fortigate link below? I have tried this in the lab and the IPSec tunnel does not come up and it does not work. Has anyone made this work?  https://kb.fortinet.com/kb/documentLink.do?externalID=FD47557 I setup this in the lab and when I debug ike I get below policy errors. But I am not sure what policy I should be adding, since it is not clear what should be interface other than ipsec in the policy.  ike 0:ipsec: ignoring request to establish IPsec SA, no policy configured ike 0:ipsec:ipsec: IPsec SA connect 3 10.10.10.1->10.10.10.2:0 ike 0:ipsec: ignoring request to establish IPsec SA, no policy configured ike 0:ipsec:ipsec: IPsec SA connect 3 10.10.10.1->10.10.10.2:0 Following is my configuration------------------------------- FGT-1 --------config system interface edit "port1" set vdom "root" set ip 10.10.10.1 255.255.255.0 set allowacce

Hi everyone, May I know how can i get the Fortigate 500E to list out the disk utilization status? Can anyone help me out? tried to check in the knowledge base but couldnt find any.. Thanks. Regards,C

Did anyone make below set up work successfully with 6.2.3? I'm just testing with relatively simple set up: FG50E -- FG30E direct connection and trying to connect vlan 100 network on both ends. Likely my test environment is causing some issues. But once I drop the vlan subinterface and use it's parent interface without vlan tag, it just works end to end. Sniffing shows ARP requests arrive at local vlan100 subinterface, but never goes over to the other side.https://docs.fortinet.com...4150/vlan-inside-vxlan   

I'm hoping someone will be able to offer me some advice please, I have an issue configuring VLAN trunking, which when I enable the config I think should work, the CPU runs up to 100% on my Fortigate 60E and the device becomes unresponsive. Very Basic topology looks like this:Wired Users --> Zyxel GS1900-48HP --> Fortigate 60E --> InternetWireless Users connect first to a Cisco WAP121, which is connected to the Zyxel switch above. Current setup (Fortigate 60E):I have created a Hardware Switch called 'Inter-VLAN' in the Network | Interfaces section, and added interfaces 2 to 7 as members. I then created six VLAN sub-interfaces under the 'Inter-VLAN' switch, with VLAN IDs 20, 30, 40, 50, 60, and 70.  Each with it's own subnet, DHCP server, and DNS server. Current setup (Zyxel GS1900-48HP):Access ports are configured with the appropriate PVIDs, and are marked as 'un-tagged' on the appropriate VLAN ID.Port 11 is configured as a Trunk, has a PVID of 1, is un

I try to understand the Inter-VDOM routing example at https://docs.fortinet.com/document/fortigate/6.2.4/cookbook/335646/inter-vdom-routing In the example VDOM "Sales" connects to VDOM "root" via vdom-link "SalesVlnk".The two interfaces are "SalesVlnk0" (on VDOM "Sales" side) and "SalesVlnk1" (on VDOM "root" side).Nothing fancy here and I understand all of it (perhaps except the p2 and p3 IP addresses as they to not correspond with the picture in the example), until it comes to the policies. The firewall policies in that example puzzle me. I believe those are wrong. But I might be mistaken? Please help me understand. It seems to me that the policies are completely garbled, though. For example the Sales VDOM related ones (this is from the content of above link):To configure the firewall policies from SalesLocal to the Internet:config vdom    edit root <<< should that not be "Sales"?         con

Hello everyone - Happy New Year !!! I'm new to Fortinet/Fortigate and I might be doing something wrong - so I’m calling for your help and advices.   I'm trying to replace my Internet FAI BBox by my Fortigate 60F. The Fortigate will be plugged in ethernet directly to the FAI Fiber GPON. This is feasible with some Network and DHCP tweaks and used to worked with an OpenWRT. So my issue here is more about how to set these options up on my Fortigate rather than improving the tweaks.   Net and DHCP required tweaks are : Set 801.q VLAN 100 ; the interface mac address set to the one from the FAI BBox (MAC Spoofing) ; DHCP client must use Vendor Class identifier (option 60) set to BYGTELIAD ; the DHCP Client identifier (option 61) set to the BBox mac ;   Here are my settings (I simplified the code here, removing the next and end...)   I have an interface wan2 plugged to my FAI GPON: set macaddr xx:xx:xx:xx:xx:xx (whatever my BBox MAC is) Then I add a

HI ALl, I am new to Forticlient VPN ..we have installed Forticlient VPN verison 6.0.10 in our windows 10 machine . After entering credentials VPN trying to connect till 10% and then stops & throws unable to reach vpn. However my credentails are wroking in another laptop with same os ..dont know whats need to rectify .  could you please help on this 

Hello,sometimes I can't connect with Fortnet SSL-VPN. What means the error ras_loop(), waitResult=1 or 258?  Information    VPN    FortiSslvpn: 15884: fortissl_connect: device=ftvnic  Error    VPN    FortiSslvpn: 14652: error: ras_loop(), waitResult=1.  Information    VPN    FortiSslvpn: 13316: fortissl_connect: device=ftvnic  Error    VPN    FortiSslvpn: 12232: error: ras_loop(), waitResult=1.  Information    VPN    FortiSslvpn: 12824: fortissl_connect: device=ftvnic  Error    VPN    FortiSslvpn: 12492: error: ras_loop(), waitResult=1.  Information    VPN    FortiSslvpn: 6500: fortissl_connect: device=ftvnic  Error    VPN    FortiSslvpn: 8496: error: ras_loop(), waitResult=258.

Hi Guys, I am new to FortiNet family and trying to learn things. I am trying on a FortiGate 300D factory reset box with version 6.2.1. The configuration is simple where I have a VLAN interface which communicates to a Cisco 7201 over private IP address. Since Cisco 7201 does not support NAT, I have to SNAT my source IP to the default gateway (Router). The problem I am facing is that if I try to use FortiGate as a default gateway for internal LAN, everything works fine and I am able to do SNAT just fine. I am just not able to SNAT from the firewall itself. Have tried all sort of possible in/out interface, source/destination addresses. But my trace goes to my default gateway with private IP address without source nat. FortiGate-300D # diag sniffer packet any 'host 1.1.1.1 and icmp' 4interfaces=[any]filters=[host 1.1.1.1 and icmp]7.084324 wan out 10.99.99.39 -> 1.1.1.1: icmp: echo request7.084326 port2 out 10.99.99.39 -> 1.1.1.1: icmp: echo requestWhere as if I try to ping publi

Network with a FortiGate 60F running 6.4.4. with FortiSwitch 224E. Created a VLAN 20. Was able to browse the internet but could not access a file server on the default LAN not part of a VLAN. Pinging by IP address worked fine but I could not ping via hostname. Appeared to be a DNS issue. I found that if I set the VLAN DNS Server to Specify and listed the IP addresses of the Windows Server DNS servers, that the DNS issue was resolved. Should it be necessary in this situation to set the DNS Server to Specify and list the IP addresses of the local DNS or do I have a setting wrong under Network / DNS or elsewhere?

Hello All. Did anyone ever measured the max thoughput on the inter vdom links?Looking for this information online, but wasn't able to find it. 

hi . i have a fortigate 100e . i have a problem i add a vlan in port 2 and make a policy for that and when i connet port 2 direct to a laptop i can not get ping or see my laptop in fortigate and when i set that config direct in port 2 without vlan i can see laptop or ping that. whats problem ?? i dont know !!!!!

Hello there, im fairly new to Fortinet hardware so i figured i could ask this question in here: I've setup a site-to-site IPSEC tunnel, my problem is that one of the sites has DHCP on the WAN port. Meaning that if the FortiGate resets, it will get a new ip address and then the tunnel will go down. How do i configure an IPSEC tunnel where one of the sites gets its WAN IP via DHCP? Thanks in advance :)

Hi everyone,I'm using Fortigate 301E with os 6.4.3, I have a very strange problem, the default NPU_vdom_link didn't work at all. The traffic was ended by the NPU vdom interface, and it didn't forward to another one. I try to create two vlans attached to both NPU-vdom-link, but without luck. So I try to use traditional vdom link instead, by creating a new vdom link interface, everything works fine!!! But the traditional vdom link can't use as a SD-WAN member. Is this the bug in FortiOS 6.4.3?

HI, Why i cant change and modify the SSL/SSH Inspection part from the security prifileits says the default profile is read only?I cant do the cloud backup for Veeam software and i was trying to add the cloud site to an exception list something like that But cant modify anything on this policy ?Any idea?  

I ordered an SFP module that should be compatible with my 200D.  However,  I cannot get the interface up. Note that this is my first time ever working with fiber.  Most recently, I have tried setting the speed manually to 1000full, however this isn't working.  Is there some way to "test" this SFP module? Or anything else I should try? # config system interface # edit dmz1 # show    "set speed 1000full" # diag hardware deviceinfo nic dmz1   "status :down"   "Speed :10"   "Duplex  :half" # set speed 1000full # show   "set speed 1000full" # diag hardware deviceinfo nic dmz1   "status :down"   "Speed  :10"   "Duplex :half"  p.s. This editor is frustrating.

Hi all, First time Fortinet (30E to start with) user, and I've booted it and set it up basic, installed the license, and went to test web filtering and it's letting me through to any website on any device I try. It seems to be on:  License is until 2025:  What am I missing here?

What does enabling/disabling the NAT option in a Policy exactly do?

Hi, I need to install FortiClient to access a clients network. I have downloaded the newest version of the client but every time I try to install it gets to the point of " Starting services" then fails and rolls back the installation. The installer gives no indication of any error. The windows event log contains " Windows Installer installed the product. Product Name: FortiClient. Product Version: 5.0.1.0194. Product Language: 1033. Manufacturer: Fortinet Inc. Installation success or error status: 1603." I have full admin on my machine and I am trying to install into the standard program files folder. Anyone any ideas?

hello, we have a fgt-40f. we also use voip and it looks like that SIP ALG blocks it. on web GUI i couldn't find anywhere to disable it. tried several forum but most of them are for old firmware current firmware is v6.2.5  can anyone send a configuration how to disable it ?

Is anyone using FortiCloud Multi Tenancy service for a Managed Service Provider (MSP) to be able to create and manage multiple SubAccounts? I would like to use a FortiManager for customers FortiGate and FortiAP units but the cost is fairly high. I was told that the FortiCloud – MultiTenancy Account might be useful in lieu of the FortiManager. Are others using this? How effective is it?

Hi!   I configured a automation action on my Fortigate (6.2). The automation was configure to send a e-mail when a interface status change. The notifications is work well, but a questions is that on email not inform whic interface had the status change. Below the mensage that I recived from fortigate.   "FGT[FG200ETK189xxxxx] Automation Stitch:Interface_Status_Change is triggered. %%Interface JGS Status Change%%"   Is possible recive the interface name information?

I have a user where this file has grown to over 200GB. Is there a way to compress or delete the file to free this ungodly amount of used space for a data file?

Can someone tell me what information I can check to see if there is no compatibility problem between an FG 600D that I want to update to version 6.4.3 and my FortiAPs that are in a version v6.0 build0037?