Solved

Hi,  I was trying to set an exception to one of the FortiGuard category based filters, some of the options that show up in the cookbook are not on my page. specifically under Status URL filter the URL Filter and Content Filter Options are missing. They show up in this document, https://docs.fortinet.com/document/fortigate/6.2.4/cookbook/725397/web-content-filter, but all I see is "Block invalid URLs" and "Block Malicious URLs discovered by ForiSandbox". Anyone have any idea why?  I'm on FOrtiOS version 6.2.4 Thanks. 

I have a FGT 200D running 6.0 and have used the 'set management-ip' command there to specify a local (non-syncd) IP address so that each unit in the cluster can be directly managed/monitored. Just got a new FGT 600E and am unable to apply the same command. It's not showing up in full output as an option, or using command completion. Checking the CLI reference log it shows as valid command for 6.2. https://docs.fortinet.com/document/fortigate/6.2.6/cli-reference/10620/system-interface Is there a pre-req before I can apply this command 6.2?

I want to create a VLAN.  I do not want to create a VLAN Interface.  I do not want routing/gateway capability.  I do not want the FortiSwitch/FortiGate to take an IP address on this VLAN. Is this possible?  I'm beginning to think that in the FortiWorld it is impossible to create a Layer2-only entity. Thank you, Chris

Hi, Has anyone worked through a similar problem on SD-WAN where the self-originated traffic isn't smart enough to pick the correct interface to get out ( internet ). I know this because running diagnose sniffer packet any "port 8888" 4 0 l we can see the device is trying to use the wrong port / sdwan member to talk to forticloud on port 8888. That's whats tricky with the self originated traffic when it doesn't work. In this case we have wan1, port1 and port2 as member interfaces for sd-wan. port1 and port2 are private circuits and wan1 is the internet gateway. Looking at its very obvious which interface has the internet gateway but the device wants to use every port except the correct one for the self traffic. :( All the user / client traffic is operating as it should.

Dear expertsCould anyone tell me why I can't see any entries in the fgHwSensors table for some devices? I can see it in our 1500d and 300d but not in an 100F.  They're running the same version. 1500D and 300D: 100F: In case the images above are blocked for CORS/throttle reasons, here's a link to all three:[link]https://imgur.com/a/ud7JIDv[/link] Any ideas? Kind regards,Patrik

Hi guys So my FG-60D running 5.2.3 has been at 100% CPU and about 90% memory recently so I thought I would run the diag sys top command as shown below.  From this command I can see that the scanunitd and IPS engine it taking most of my CPU usage. I don't have vulnerability scanner but I have AV enabled on 17 different policies. I think the box is being overworked, but can I restart any processes or do you guys have any other advice? Run Time: 42 days, 19 hours and 54 minutes 62U, 0N, 37S, 1I; 439T, 40F, 189KF scanunitd 7079 R < 68.4 3.7 ipsengine 602 S < 19.2 13.1 httpsd 7717 S 2.3 4.2 httpsd 7718 S 1.9 4.2 httpsd 7737 S 1.7 4.2 I also ran get sys performance - Output below CPU states: 75% user 25% system 0% nice 0% idle CPU0 states: 75% user 25% system 0% nice 0% idle Memory states: 93% used Average network usage: 6282 kbps in 1 minute, 2754 kbps in 10 minutes, 2200 kbps in 30 minutes Average sessions: 1995 sessions in 1 minute, 2178 sessi

HiWe are running version 6.2.3 on a fortigate 301EI want to use a different SSL certificate on an existing SSL inspection policy to only inspect the headers , not full inspection.I have created the csr on the FG,  got it signed by our trusted subca and imported it back into the FG as a local certificate successfully. It is now sitting in the FG cert store under local certificates. When i select security profilesSSH / SSL Inspection and select an existing profile , the settings are Multiple clients connecting to multiple serversSSL Certificate InspectionIn the CA certificate dropdown my new certificate does not appear in the list.  When i try and create a new one then upload it states the certificate already exists which it does. Does anybody have an idea why the new certificate is not showing in the drop down many thanks in advance mac

I have a FortiGate 61E at a remote site with a VPN tunnel back to my main site. I have had a problem where my Windows clients will detect a new network, and will identify it as "Network 3". That is, when you choose a type of Network in Windows 7, you choose from Home, Public, or Work, and then it gives the network a name. So it's almost as if the Windows machine thinks that the network has changed. This happens rather randomly throughout the day, several times a week, with different computers. Yesterday I was doing some troubleshooting and I discovered that it's selectively unable to reach *certain* networks through the VPN tunnel. If I do a traceroute, it's picking up an address of 192.168.0.1 between the local gateway (the FortiGate) and the remote end of the VPN tunnel. The packets are dropping at 192.168.0.1. I do not use this IP address anywhere in my network! Oddly enough, I can browse to this IP address, and it loads a Ubee Modem DOCSIS page. I called my ISP, Spectrum (formerly

Hello.  Can FortiNAC require that a computer be domain joined before getting an IP address or being allowed network access?  If it isn't, like a contractor or a visitor, I'd like the machine placed in a locked down guest vlan with only Internet access.  Thanks everyone!

Hi, i'm using this commanddiag sniffer packet any "host x.x.x.x" 6 0 ato capture some traffic, then convert the text file using the tool fgt2eth.exe to convert it to pcap.https://kb.fortinet.com/kb/documentLink.do?externalID=FD30877 Then... when I'm going to view it in wireshark, it shows TCP-out-of-order in all the capture.I try a lot of captures with different destination and in different firewalls (models 100d, 300d, 500d) same result. A lot of TCP Out-of-Order I'm doing something wrong? is not possible that in all my tests was errors in comunication.  Same result in all my captures from CLI.

Hello, I have an internal IIS server with one site configured with the following address (for example) : https://toto.test.frThe IP server is for example : 10.0.10.1The public ip address is for example : 1.1.1.1 I created the following virtual IPname : test external ip : 1.1.1.1internal ip : 10.0.10.1Port forwarding TCP : 443 to 443 Then I created my policy enabling all from external to access to test on service HTTPS. It's working but I would like to know how to enable the ping to toto.test.fr because currently it's not working.I tried to add a new virtual ip by selecting port forwarding ICMP and added ICMP+Ping  to my policy but it doesn't work. Regards,

We're using a few FortiGate 50E with FortiOS 5.6.2 and DNS filtering, which works great (properly enforces SafeSearch over SSL/TLS without requiring a local certificate to be installed). However, when Safe search is enforced, YouTube restrictions must be set to "strict" or "moderate". Even moderate YouTube restriction blocks LOTS of videos that aren't in any way problematic for a school. Is there a way to have Safe search enabled for search engines (Google, Bing, etc.) but not restrict YouTube?

Can not access Fortiguard seversHi, guys,   My Forti600E can not access Fortiguard servers ( for device registration, any Fortinet services), network infrastructure is:   The Forti600E has few network links : 1. The device is using Fortinet DNS services : 208.91.112.53 & 208.91.112.52 2. The default route (0.0.0.0/0.0.0.0) can point to internal network. 3. The route table to Fortinet DNS services are implicitly defined, as the following route table:   Forti600E-01 # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP            O - OSPF, IA - OSPF inter area            N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2            E1 - OSPF external type 1, E2 - OSPF external type 2            i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area     &nbsp

Hi, just after some help from anyone who has had some experience with VXLAN.I setup a VXLAN a while ago which worked fine but now has stopped passing traffic?  the ipsec tunnel is up but can only see traffic either side, ie not traversing the L2 VXLAN, it's a fairly simple setup, diag attachedAny help/suggestions appreciated.Dave

Several of our SSL-VPN Portals have been defined in the default realm (/). The title of the login page there is an inviting 'Please Login'.  For legal reasons, we want it to read 'unauthorized access is prohibited'. Is there a way to change this? Kind regards, Herta

Dear forum, I have a FortiGate 300E and a Fortimail 200E, love them both very much - great products! However I have an IPS Sensor issue regarding the signature "SMTP.Login.Brute.Force". On the FortiGate we have the IPv4 policy that controls smtp traffic to our spamfilter:Source: ALLDestination: SMTP VIP (External IP: X.X.X.X to Mapped IP 10.100.10.9, External Port 25 to Map port 25).Service: SMTP, SMTPSAction: AcceptSecurity Profiles: IPS (with IPS Signature SMTP.Login.Brute.Force, Quarantine 15 Minutes). On the FortiMail I see around 6000-7000 SMTP Auth Failed attempts every day, some are legit email addresses, but most are random names, which probably is someone trying to brute force login. Why does the IPS Sensor not stop this? I have tried custom signatures I found on these forums and put those into the IPS Sensor, with no luck : F-SBID( --attack_id 6228; --name POP3.Brute.Force; --protocol tcp; --service POP3; --flow from_server,reversed; --patte

The Fortinet Discussion Forums hold a wealth of information that has been helpful to users of Fortinet products.  We would be interested to know which of the posts, both old and new, you feel should be added into the Fortinet Knowledge Base. Regards,Admin.

Hi, I want to remove an IP Address from a Group and them delete that IP via CLI command, I try with the command exclude member but after exclude the member does not permit to delete the IP via CLI. There is a way to do that via CLI?. Regards,

hi guys according to  FortiOS-administrarion guide ver6.4.2 when using FQDN in firewall policy, the OS will gather and match related IP address to that FQDN and use them as a certain destination/source.photo #1,2here is my scenario : photo 3as i understand, according to my firewall rule ( photo 4) all client request (req1,2,3  ) to destination 5.5.5.5,4.4.4.4,6.6.66 will be blocked, even the request would be http://news.msn.comam i right ?

Hey Comm, my problem is, that on windows i can configure the forticlient very good, but on mac i can't configure the vpn connection correctly, because i don't have the advanced settings for IPsec, Phase1 and Phase2. So the client can't connect to our firewall. Is there any trick to get these settings? I have tried many other forticlient versions but in no version the advanced settings are displayed.  thanks!    

Hi, I was trying to find information about MAC address table size for some FortiGates (more specifically 100F, 200F, 500E and 600E). This information is not available on the datasheet and I'm wondering if there any other source available that could have this?

Hi! I already have a working setup where i have 2 WAN, one LAN and one DMZ set up. I have a VPN SSL Tunnel set up on WAN1. My situation is that my WAN1 is a 6mb connection and my WAN2 is a 50mb connection. VPN gets in via WAN1 connection. Users can login and work ok. So policy are set up ok. Now with new COVID protocols and many users working from home that 6mb connection isnt enougth. Trying to set up the VPN to listen on WAN2 but i cant get it to the Fortinet login (portmapping the public WAN2 ip and nothing listening on port 443). Got one default route for WAN1. No default route for WAN2. Some computers gets internet from WAN1 and other computers get internet from WAN2 (through a proxy). Both cases have internet and can reach the internet with the correct configuration. Is there a way to troubleshoot why i am not getting the login screen even if fortigate is teeling me that is listening on the interface?

[style="vertical-align: inherit;"][style="vertical-align: inherit;"]Caro, [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]tenho o seguinte problema. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Configure a conexão VPN site a site com dois fortigate HQ FG 80E e Branch 60E. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]A VPN funciona perfeitamente, as máquinas de ambos os lados se comunicam com sucesso. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Porém, as caixas Fortigate não respondem ao ping em si no modo CLI, eu executo o comando em ambas as caixas com "execute ping + ip".[/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Mostra a mensagem[/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]FILIAL # executa ping 192.168.254.99 <- IP HQ FG 80E [/style]

Hi, I am deciding to buy a Fortigate 60F or 80F for my network.My ISP has 2 separated network(from the same fibre) like most dedicated internet. The dedicated one is 1 gbps, the dhcp one is like 300 or sth. I think the best solution for it would be buying two separated firewall for each room but I kind of want to know that if I could simply plug both cable from the modem into the same firewall and have them running as two separated network. Does it require a Vlan setup to separate them? How does the failover gonna works in above case? Thank you very much.

Hi, I am deciding to buy a Fortigate 60E or a 80F for my network.My ISP has 2 separated network(from the same fibre) like most dedicated internet. The dedicated one is 1 gbps, the dhcp one is like 300 mbps. I think the best solution for it would be buying two separated firewall for each room but I kind of want to know that if I could simply plug both cable from the modem into the same firewall and have them running as two separated network. Does it require a Vlan setup to separate them? How does the failover gonna works in above case? Thank you very much.