Solved

Hi, experts, I found internet access issue from the Fortigate, as the attached Dashboard (WAN IP can not be detected, and ... ), Due to the internet line is configured as below(the primary IP is private):the primary IP is : 10.10.10.2/30 (peered to the upper Layer3 device )the secondary IP is : 100.100.100.100 ( for internet access ).  any advice in order for the Fortigate being able to access the internet, thx a lot ? 

Whats the procedure like for changing a Fortiswitch from a standalone to one that's managed by a Fortigate?  I have 3 Fortiswitches in production that are working as expected and would like to have them managed by our Fortigate cluster however I don't want to lose the configurations on any of the switches. Any advice would be appreciated.  Thanks in advance!

Hi,I have read many times about emac-vlan and how it is supposed to be implemented. But finally when I tried to do it, it doesnt work like expected.Topology is like this: TRUNKundo port trunk vlan 1 (no default/untagged vlan)(vlan 10) [L3SW | 10.1.10.254] <---> [10.1.10.1 | Forti vdom root]     <- this is main connection to ROOT.Vdom, with internet, MGMT int. and all(vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.1 | Forti Vdom1](vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.2 | Forti Vdom2](vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.3 | Forti Vdom2] The goal was to implement emac-vlan interfaces on vdoms1-3, but after setting vdom1 (with vlan tag 11), i cant do it on Vdom2 - getting info that vlan is used by another software switch.I have similar setup on the WAN side, difference is that I want to use two different ports for one vlan 13 - one for root, one for vdoms. And its the same story, after setting vdom1 with emac in vlan 1

Hello, folks. I'm fairly new to FortiGate and I'm in the process of configuring an 80F to replace a Cisco RV320 router. The RV320 has 4 sub-interfaces tagged with their respective VLANs:- x.x.0.1 (default), x.x.10.1 (vlan10), x.x.20.1 (vlan 20), x.x.30.1 (vlan 30) The Cisco core switch has virtual interfaces for each VLAN:- x.x.0.2 (default), x.x.10.2 (vlan10), etc.- Each VLAN interface points to a Windows server for a DHCP-helper address- The DHCP scopes for each VLAN subnet points to the respective switch virtual interface (x.x.x.2) for its gateway- The core switch has a single default route pointing to x.x.0.1 on the RV320- The core switch is connected to the RV320 by single trunk port that carries all VLANs As I'm setting up the 80F I thought it would be nice for each VLAN to have a dedicated physical port on the FortiGate to avoid having congestion on a single shared trunk port:- I removed 3 ports from "internal" and configured them as standard ports (not VLAN) each

I am running a 500D HA setup at my production site and a single 500D at my backup site. All 3 devices are running 5.6.3 build 1547. Questions: Do people upgrade just because a newer version is available or do you only upgrade for vulnerabilities or needed features? Has anyone upgraded from  from 5.6.3 -> 6.2.3 using the Fortinet upgrade path and experienced problems outside of those in the release notes?    

Hi,Firewall is in   flow mode .If I change the antivirus inspection mode to proxy mode what is pros and cons Thanks  

Hi,Can I configure EMS via my fortigate (300D) or do I need to install the EMS server software?  I am trying to avoid installing the server software. Thanks 

Hi, Experts, Any document or configuration for Fortigate firewalls ? If an Internet line has only 100Mbps, how could I tell/configure the link bandwidth to Fortigate, in order to control the bandwidth allocation for different usage, for example:1. 30Mbps for voice2. 40Mbps for SAP application3. 30Mbps for user web surfing Many thanks for your information in advance.

Traffic ShaperI have traffic shaper policy . even if i reduce the download speed speedtest shows the maximum bandwidthfor example if I change to 10 Mbps ,it shows 100 MbpsThanks 

https://docs.fortinet.com...n-and-supported-models

I'm having trouble applying a route map to stop a FortiGate 201E from advertising certain connected subnets via BGP. In my examples below I've only shown one prefix. I actually have 6 I want to stop advertising. I also want this FGT to continue advertising the default route. I've tried a prefix list with the deny action set on the rules, and applying the route map to the neighbor, like this config router prefix-list edit "ISP_allowed_eBGP" config rule edit 1 set action deny set prefix 10.10.10.184 255.255.255.248unset geunset lenext   edit 2set prefix 0.0.0.0 0.0.0.0 unset ge set le 32next end end   config router route-map edit "ISP_allowed_eBGP_route_map" config rule edit 1 set match-ip-address "ISP_allowed_eBGP" next end next end   conf router bgpconfig neighbor edit "10.10.10.189" set route-map-out "ISP_allowed_eBGP_route_map" next end end I also tried 2 cresting separate prefix lists and setting the deny action on the rules within the route map, l

hi,i have a fiber link from ISP which is connected to router or modem provided by ISP. from that 1 link is directly connected to firewall with an ip 172.x.x.x. when i select the interface in SSL VPN config i get 172.x.x.x IP. how can i config interface so ddns can work with sslvpn.i have contacted support and he said you need to config 0.0.0.0/0.0.0.0 but it doesn't work because from modem private IP is config. i cannot connect directly because its fiber link and our firewall 101F doesn't have fiber port.kindly assist.

We work with a number of offices that use some version of the 50 to 100 series FortiGate firewall. One worry I have is a hardware failure. Though I have only seen 1 failure ever of an in-production firewall, the risk is still a factor. Waiting 1 or 2 days to receive a replacement unit could be costly to the users. I realize that we could run with High Availability (HA) but this would amount to a 2x the firewall purchase and support bundle cost. Is there a way to keep a spare firewall in house and to replace a failed firewall with the spare in the event of a failure? If this is done I presume that the configuration could be imported from the last backup of the failed firewall. Could the support bundle be transferred to the replacement firewall? If not I presume that the replacement firewall could run temporarily without these services. Are there any other considerations that I am overlooking?

Hello all, Is there any way to forward select login events from the DC to the Collector Agent similar to syslog style? 

I had 3 WAN connection (ADSL modems) providing internet access to my company. I brought 4th connection which has a fiber metro connection by the switch and connected to my 4th port.1 - First set the new interface (named as metro_port). I selected role as WAN, Addressing mode as manual and IP/Netmask as ISP provided.2 - At Second step i defined Static Route. I gave destination to 0.0.0.0/0.0.0.0, interface as set up in the first step(metro_port) and gateway as ISP provided.3 - At third step i have insterted a new Policy Route in order to set my computer go out to internet over metro_port.4 - I set up a new Firewall Policy, incoming as Lan, Outgoing as metro_port, source as my computer's IP address. Selected NAT enabled. To maximize priority of this policy i dragged it to the first in list. Now unless unplugging or disabling my old WAN connections (ADLS modem connections), i cannot use new WAN connection to use internet access. I checked log tables, it doesn' even use to this policy

Hi, We are builting a virtual lab with the wonderful "Eve-ng", and for being able to restore quickly a configuration, we would like to use the "USB Device" via "execute restore config usb <file>". But we have to simulate the USB device through QEMU option. Could someone help us on this topic ? Thx.

Dear all, We are currently trying to split our compagny, and as well the network/security infrastructure. To do so, we set up VDOM on a Fortigate - FortiOS 5.6.4 (current VDOM root = the old "global" before VDOM enable, and VDOM NEW-CORE = the VDOM added to design a new infrastructure). Initially, the VDOM root has an OSPF area 0 and is peer with another Fortinet (working fine today) with the same area 0. When we tried to add the router ospf area 0 in the VDOM NEW-CORE, there was an incident : lost of the production flows on the VDOM root, as if routing was NOK after the change on the VDOM NEW-CORE. A rollback solved the issue. In summary, my question is : can we have OSPF area 0 running on multiple VDOM ? PS: Due to another CPU issue, we recently updated on FortiOS 6.2.4 Thank you in advance for your answers. Best Regards,

When I tried to import the Policy from FortiGate 400E with firmware V6.0.6 to the FortiManager the below error appeared, So can anyone help me to solve this issue, Thanks in advance. 

Hi; Can a Fortigate Firewall running version 5.2.x or 5.4.x insert an XFF header?  If yes, how exactly can this be done? Does it apply to the following models? or it will apply no matter the models?1500D, 600C, 1000C, 300D, 2000E KindlyWasfi    

Hi There,  I'm pretty new to Fortigate Firewall. I have a requirement to integrate the firewall for LDAP authentication.Initially I have tried to add the LDAP server and perform the test connectivity and it failed. Later when I checked the firewall I noticed that the LDAP server is not reachable when I use the execute ping command. I have below questions.[ol]While trying to reach out to the LDAP server does the firewall by default use the Management interface or will it refer to the routing table and use the traffic interface as per the routing?I was also trying to perform the test from the Firewall by executing the ping command with the management interface IP address as the source IP address also I noticed that the ping is enabled for the management interface. But the ping command failed from the firewall. I went on to check the switch connected to the management interface and from there I was able to reach the LDAP server by setting the source address to management VLAN interfa

After our laptops update to Windows 10 v2004, they will no longer connect to our WPA2-Enterprise FortiAP WiFi network. We have troubleshooted and checked our RADIUS/NPS settings, and they are correct. The users get authenticated, but the connection fails with this message in the FortiGate Logs: WPA-invalid-2/4-key-msgProbably wrong password entered, invalid MIC in 2/4 message of 4-way handshake from client  The laptop's event logs report "Dynamic Key exchange did not succeed withing configured time" Other laptops still on Windows 10 1909 can connect just fine. And if we roll back the Windows 10 update to 1909, it will connect again. If we take the laptop to our other office with Aruba AP's they connect just fine. So it's something to do with the Windows 10 2004 update and the FortiAP 221E Access Points. We just can't figure out how to fix it. Any ideas or suggestions would be greatly appreciated! Thanks!

Hi AllI have a filtered list of nearly 4000 devices in the Device Inventory of a 1500D FortiGate I support and wondered if there is a way to export the list Thanks in advance

a FortiGate 200D firewall on my side needs to update the firmware.currently its firmware verison is v5.0,build0318 (GA Patch 12) i tried searching for recommended upgrade path of firmware for this device in here https://docs.fortinet.com/upgrade-tool, however, not so sure about it. alright, the question is, in order to upgrade the firmware from v5.0 build0318 to v6.0.10,I had to upgrade to version 5.2.9, 5.2.11, 5.2.13, 5.4.10, 5.6.9, 5.6.11, 6.0.10 in sequence? update for like 7 times?!!what about the upgrade between v5.0 build0318 and version 5.2.9??? can i  jump from v5.0 to 5.2.9?

Just got an old fortigate 200D firewall but not familiar with it.I wanna aggregate two ports together and link them to downlink 2 switch ports. would like to know:is it doable to aggregate 2 ports together and link to switch ports (to increase bandwidth)?if so, then will the port speed be limited to the lowest automatically?(the switch port speed is 10Gb using CAT6 cable) thanks in advance

Hi, Please help me using my fortigate 100D as aggregate switch just as we do in Cisco layer 2 switch as below : interface GigabitEthernet1/0/33  switchport trunk native vlan 400  switchport trunk allowed vlan 2,3,400  switchport mode trunk  switchport nonegotiate  channel-protocol lacp  channel-group 11 mode active ! interface GigabitEthernet1/0/34  switchport trunk native vlan 400  switchport trunk allowed vlan 2,3,400  switchport mode trunk  switchport nonegotiate  channel-protocol lacp  channel-group 11 mode active and interface Port-channel11  switchport trunk native vlan 400  switchport trunk allowed vlan 2,3,400  switchport mode trunk  switchport nonegotiate I tried to do it as creating new interface 802.3ad aggregate with 2 ports but even after applying and enabling those ports, new interface shows down.  I have no idea if it is supported on FGT 100D.Please help RegardsR