Solved

All,Successfully upgrading a FortiGate 200F results in a broken FortiDDNS application.  The FortiDDNS server list no longer populates with a list of available domains which breaks the service.  Rebooting the firewall does not solve the problem.  Further, the maintenance tunnel through FortiCloud will not connect to the system.  Has anyone else experienced this issue?  Is there a solution to this? If the FortiDDNS service is important to you, then I recommend against upgrading to FortiOS 6.4.2 until this is addressed.

Hi, guys, I am rather new to Fortigate devices, after a pair of Forti400e have formed HA structure, I found them not synchronized due to the following message:login: slave's configuration is not in sync with master's, sequence:0 slave's external files are not in sync with master, sequence:1. (type APPDB) slave's external files are not in sync with master, sequence:3. (type CERT_CA) slave's external files are not in sync with master, sequence:4. (type CERT_CA) slave succeeded to sync external files with master slave's external files are not in sync with master, sequence:0. (type APPDB) slave's external files are not in sync with master, sequence:1. (type APPDB) slave's external files are not in sync with master, sequence:3. (type APN_CERT) slave's external files are not in sync with master, sequence:4. (type APN_CERT) slave succeeded to sync external files with master slave's external files are not in sync with master, sequence:0. (type APN_CERT) slave's external files are not in s

Hi, Guys, I created two SD-WAN rules as the following:------------------------------------------------------config service   edit 1       set name "Access_to_Internet"       set dst "all"       set src "all"       set priority-members 1 2 3    next    edit 2       set name "LL_Line-to-16HK-DC"       set dst "16HK_V167_10.16.7.0"       set src "VLAN329_10.32.9.0"       set priority-members 5 4 6    next    end   How can I prioritize the "ëdit 2"  for routing decision, thx a lot ? Many thanks   

I am using an evaulation vm of Fortigate 6.4.1I have enabled all traffic in one rule, and one to block an FQDN (for the sake of this example it would be facebook.com).And yet when I try to reach facebook.com through my browser it is not blocked.If i'll try to use a web filter, Facebook will be blocked.Is this because the evaluation trial of Fortigate doesn't support FQDN, or am I not configuring something properly?Thanks in advance.

Hi, guys,I am new to Fortinet products.We have two sites, I just installed Fortigate 400e HA pair at each site, and multi WAN links at each site, like SiteA has two internet lines for web surfing and then two IPLC lines connect to SiteB ( also has two internet lines ) I would like to get recommendation from your experts, how to design/configure the 400e HA pair at each site:1. Internet lines for web surfing at each site2. IPLC lines for two site communication ( with private IP subnets)    Many thx in advance.  

Hey All, Just got a 60f and putting it through the paces.  I am noticing high mem around 60% and if np does anything basically goes to conserve mode and need to reboot.  Scoured cookbook and other googles and cant seem to find a good NPU best practice.  Wondering if anyone else has played with this at all.  Using at home, about 10 policies, 2 of which do actual filtering.   Just wondering thoughts.

Hi, I am not sure where to post this thread (please correct if this is the wrong forum). Is there an API available to get forti asset information (based on contract/license/serial number related queries) ??

Is possible to do it in VPNSSL? Client certificate plus LDAP username and password for authentication. And a bit more complex, Cliente certificate match UPN with LDAP username. Cliente certificate is only valid for the user that is trying to authenticate throught VPN. https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/751987/ssl-vpn-with-ldap-integrated-certificate-authentication Thanks 

Hi all,I have worked with the Fortigate firewalls now for about 2 years in my current role, but I do not consider myself a firewall person at all.I seem to struggle to come up with a good naming scheme for my policies and also how to best create policies so:[ol]We dont have tons of policieseasier to find the policy you are after[/ol]So we have policies named like "SiteA to SiteB" allowing all services and from and to has 2 different subnets Or we have "Allow AD,DNS,NTP from DMZ to LAN"  with services "Windows AD" + "NTP" from the DMZ subnet to 2 specific domain controllers.But we also have policies named "SiteA Server Lan to Datacentre" which has 4 VLAN interfaces in the from field and 1 VPN tunnel in the To field. The problem i seem to have is coming up with a consistent naming format for my policies and we we seem to mix in regards to creating 1 policy per thing either "SiteA to SiteB" or "Allow SMTP for Server1 to Exchange".[ul]How do you name your policies?Do you create one

Hi all I am trying to send all the log message I get in Logging -> Log Access -> Logs to a syslog server. But none of them arrived. I have the syslog server configured with the IP address, the level is Debug (but also tried with Informational, there is no change. Anyway Debug should include everything above it, therefore also informational). For the Facility I tried a couple of things, such as syslog, local0, auth etc. Is there a documentation how the FortiAuthenticator sends out these log messages, with which Facility? Is it possible in the same syslog server setting to send everything I get in the log file? Thank youMarkus

Hello all. I've enabled an Automation stitch to email me whenever any other admin signs into the FGT (6.2.1) and makes any changes. Those emails look like this: FGT[FGxxxxxxxxxxxxxx] Automation Stitch:Config-Change is triggered.date=2020-06-29 time=08:25:47 logid="0100032102" type="event" subtype="system" level="alert" vd="root" eventtime=1593437147787054028 tz="-0500" logdesc="Configuration changed" user="xxxxxxxxxxxx" ui="ssh(xxxxxx)" msg="Configuration is changed in the admin session" Is it possible to have these emails include the EXACT config change made .e.g. user Andrew made a change: an interface IP address changed, or a policy was disabled?

Hello everyone, we have setup a basic wifi network (UniFi) which auth against a windows 2016R2 radius server All is working fine. The problem we are having is that the fortigate firewall is not seeing the usernames and therefore not pulling them into the correct rule set. Since users authenticate to WiFi using NPS on Win2016, FSSO does not detect them on FGT.Is it possible to get FGT to detect which user is authenticated by the radius??I tried this: https: //cookbook.fortinet.com/ssl-vpn-radius-authentication/ and unsuccessfully. But I do not know if it is right for this workaround. Thank you. Jirka  

On the FortiExplorer page, I see a link for the iOS app...  Is there a corresponding Android app?ThanksJamie

Hi In your opinion, how reliable is application control (as in using it in policies to limit only those applications) when not ssl inspecting the traffic ?

Good day all, we are having fortigate 400E with 6.0.Can it be configured to act as ftp/secure ftp server. If so, where will the files transaction be stored in?  

Hello All,I am running 6.2.4.  I have a new Internet connection via AussieBroadBand here in Aus.  Our link is DHCP but we have two static IP addresses coming in on the same link.  The two IP Addresses are both /32 addresses. I have created a virtual IP as per the following documentation. This is very similar to the pfSense and I have done this previously with the pfsense in a separate environment.https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/502582/creating-a-security-policy I have also created the IPv4 policy as per the documentation.  However, it doesn't seem to work.  In the port forwarding section I forwarded ICMP and have monitored for incoming ICMP on the target machine but don't see any packets reaching the internal machine. I am starting to wonder whether my ISP is in fact forwarding those packets to me.  It's been a long time since I've done any packet sniffing on the fortigate, I'm hoping someone can help me with the

Hei, I have got a  problem with 2FA Mobile token. We use SSL VPN and LDAP. All vpn users  are assigned by 2FA with mobile token  and they are able to login to the network via VPN using 2FA mobile token. But only one user is unable to use the token.  When he tried his username and password , the forticleint not asks for fortitioken mobile and get directly connected into the network  , which is seems same as SSO, eventhough the user is successfully assigned by a fortitoken mobile. What might be the reason for this . How can I troubleshoot this and get it resolved.  Thanks!!

So here's my conundrum. I have 3 sites all with a private fiber connection to our network provider's datacenter, where they carved off a VDOM just for us to use. We run OSPF on a vlan between the 4 sites (network provider datacenter and 3 locations). I had a failover event this weekend where the circuit failed at the main site and it started running through the secondary site. Everything was fine except for the traffic to the firewall itself, which means nobody was able to auth to the SSL VPN at the main site because the core switch at our main site saw the /24 as a connected VLAN and didn't have any way to hit the Fortigate IP directly anymore. My thought is why can't I redistribute a /32 to the Fortigate LAN IP through OSPF to make sure that fails over automatically. But I can't find anything on that anywhere.  I did see about redistributing a loopback through OSPF, but I can't get the SSLVPN auth to originate from a loopback interface as far as I can tell. So if anyon

Hi Guys,This is the first time for me to replace a faulty Fortigate unit ( in cluster A-A ) with new RMA device.I have some plan of action but am confused between two approaches.Approach 1 ) Install same firmware as master, sync licences and restore config backup which was taken from faulty device and then attach network cables.Approach 2) Go as per this document which says that I need to execute this command config system ha and configure some parameters. Once done, attach the new device in network and it will sync the config from primary. https://kb.fortinet.com/kb/documentLink.do?externalID=FD36481Which of the two is correct or are both wrong and I am missing something else.

I hope I didn't get bamboozled on this rather expensive home firewall. The specs show that the WiFi supports 802.11 a/b/g/n/ac but it looks like there's only one radio in the unit so you have to pick between either 2.4 -or- 5 GHz. Is this correct or am I simply doing something wrong? 

 Why "all and guest group" in the source , What if we give "guest group  " only Thanks

Questions to those in the know: 1. In the printout: FG60C (global) # diagnose test application urlfilter 3 Saving to file [/tmp/urcCache.txt] Cache Contents: -=-=-=-=-=-=-=- Cache Mode:   TTL Cache DB Ver: 17.53220 Domain  |IP       DB Ver T URL 1e000000|00000000 17.53219 P B[link]https://vuexcasht3.ad.vu.edu.au/[/link] : what does the "T" indicator show and what values (such a "P", above) can be shown? Also, what does "B" prepending the URL show? 2. is it possible to (regexp or otherwise) filter printout generated by "diagnose test application urlfilter 3" for specific URL? (Currently, I'm forced to use grep on /tmp/urcCache.txt). 3. What is the difference between "diagnose test application urlfilter 3" and "diagnose test application urlfilter 16" 4. When I issue the command, I get an incomplete printout, eg. FG60C (global) # diagnose test application urlfilter 16 Saving to file [/tmp/urcCache.txt] Cache Contents: -=-=

Hi there,I use FG60D, and wanna use VPN web portal.what I've done:- create web tunnel- set AV check- create user and group, then add to portal mapping on menu vpn ssl setting I can reach web portal over web browser, directly, using assigned port.but I can't login, permission denied.am I missed something? unlucky for me, tried to search over forum and fortigate help, but can't find about complete guidance. also, Can I disable this feature, in the future? I mean outside can't reach web portal. please help. thank you.

Hello Everyone if i need my exchange-OWA accessable from Outside i need to create a Virtual IP.eg my public IP is 123.123.123.123 and my internal Exchange IP is 192.168.1.1 So i want that 123.123.123.123 Port 443 maps to 192.168.1.1 Port 443. And here is my question:As far as i can see i have to possibilities to reach my goal. *********************************************Possibility 1) on VIP i configureExternal IP Address/Range: 123.123.123.123Mapped IP Address/Range: 192.168.1.1 On Port Forwarding i configureExternal Service Port: 443Map to Port: 443*********************************************   *********************************************Possibility 2) on VIP i configureExternal IP Address/Range: 123.123.123.123Mapped IP Address/Range: 192.168.1.1And under "Optional Filters" i configure a Service like "HTTPS".*********************************************  Both possibilities work.Buth i guess there is something i don't understand?&n

https://docs.fortinet.com/document/fortigate/6.0.10/fortios-release-notes/760203/introduction