Solved

90D has high CPU utilization almost all the time, using dia sys top, netscan runs at 95% almost all the time. Any ideas?

Good day all, we have some interface & zone that are not in use.What is the best method to delete these & also checking on if it affects anything else.  

https://docs.fortinet.com/document/fortigate/6.2.4/fortios-release-notes/760203/introduction-and-supported-models 

I've tried many times in the past to try and block IPs in our FortiGate 60E (firmware v5.6.3 build1547 (GA)) and I must say it's the most convoluted and confusing UI I've used to date. Which is why I'm here asking what I'm doing wrong. What I've typically done is create a new address and then set it to deny in the IPv4 Policy. (step1.png)Policy & Objects -> Addresses Create New -> Address Name: "45.141.84.162/32 20200805" Type: Subnet Subnet/IP Range: 45.141.84.162/32 Interface: wan1 (or all) (step2.png) Policy & Objects -> IPv4 Policy Create New Name: "Block 45.141.84.162" Incoming Interface: wan1 Outgoing Interface: internal Source: "45.141.84.162/32 20200805" Destination: all Schedule: always Service: ALL Action: DENY Enable this policy: Checked But i then still see traffic coming through as if it did nothing. I've also tried using IP ranges of 45.141.84.162-45.141.84.162 and that has done nothing as well. So far the only way I've seen to actua

Good day all, Using zones in our fortigate firewall. Is traffic within the same source & same destination zone allowed by default or it needs a rule in place? 

Fortigate 100E 6.4.1Hello guys, I am new at forum as well at Fortinet Firewall. I am working in a company at Greece. We have Fortigate 100E with 6.4.1. Before i mention my problem let me explain you my topology. We have 2 ISP on WAN 1 and WAN 2. On WAN 1 which connected to ISP1 we have a block of 16 static IPS and on WAN 2 he have ISP 2 with DSL connection, ISP modem/router in Bridge Mode and in WAN 2 on Fortigate PPPOE ( Username and password) with static IP. On my Local Network i have my LOCAL LAN ( 192.168.230.0/24) and i have created 2 VLANS ( VLAN 100, 192.168.5.1/24 and VLAN 200, 192.168.8.1/24) under my LOCAL LAN. In the VLANS i have Servers ( Mail Server, FTP Server, Web Server, Web app Server etc) My Goal is to achieve traffic from LOCAL LAN and VLAN 100 go through WAN1 ( I have setup in my WAN 1 secondary IPs so i can bind every server with one static IP ( one to one NAT) ) and i havee setup firewall policies. And VLAN 200 traffic go through WAN 2 ( PPPOE with Static) an

Hi,scenario is, we have MPLS p2p VPN and internet DSL link and DIA link. our server is on another site where we have MPLS connectivity. currently internet traffic is going through DIA link this subnet 192.168.4.0. rest of the traffic is going through MPLS which is correct. but i want to make DSL primary internet. i can do this by changing ADMINISTRATIVE DISTANCE but the problem is from outside those who are connecting through SSL vpn cannot login in. what is the solution?

All,Successfully upgrading a FortiGate 200F results in a broken FortiDDNS application.  The FortiDDNS server list no longer populates with a list of available domains which breaks the service.  Rebooting the firewall does not solve the problem.  Further, the maintenance tunnel through FortiCloud will not connect to the system.  Has anyone else experienced this issue?  Is there a solution to this? If the FortiDDNS service is important to you, then I recommend against upgrading to FortiOS 6.4.2 until this is addressed.

Hi, guys, I am rather new to Fortigate devices, after a pair of Forti400e have formed HA structure, I found them not synchronized due to the following message:login: slave's configuration is not in sync with master's, sequence:0 slave's external files are not in sync with master, sequence:1. (type APPDB) slave's external files are not in sync with master, sequence:3. (type CERT_CA) slave's external files are not in sync with master, sequence:4. (type CERT_CA) slave succeeded to sync external files with master slave's external files are not in sync with master, sequence:0. (type APPDB) slave's external files are not in sync with master, sequence:1. (type APPDB) slave's external files are not in sync with master, sequence:3. (type APN_CERT) slave's external files are not in sync with master, sequence:4. (type APN_CERT) slave succeeded to sync external files with master slave's external files are not in sync with master, sequence:0. (type APN_CERT) slave's external files are not in s

Hi, Guys, I created two SD-WAN rules as the following:------------------------------------------------------config service   edit 1       set name "Access_to_Internet"       set dst "all"       set src "all"       set priority-members 1 2 3    next    edit 2       set name "LL_Line-to-16HK-DC"       set dst "16HK_V167_10.16.7.0"       set src "VLAN329_10.32.9.0"       set priority-members 5 4 6    next    end   How can I prioritize the "ëdit 2"  for routing decision, thx a lot ? Many thanks   

I am using an evaulation vm of Fortigate 6.4.1I have enabled all traffic in one rule, and one to block an FQDN (for the sake of this example it would be facebook.com).And yet when I try to reach facebook.com through my browser it is not blocked.If i'll try to use a web filter, Facebook will be blocked.Is this because the evaluation trial of Fortigate doesn't support FQDN, or am I not configuring something properly?Thanks in advance.

Hi, guys,I am new to Fortinet products.We have two sites, I just installed Fortigate 400e HA pair at each site, and multi WAN links at each site, like SiteA has two internet lines for web surfing and then two IPLC lines connect to SiteB ( also has two internet lines ) I would like to get recommendation from your experts, how to design/configure the 400e HA pair at each site:1. Internet lines for web surfing at each site2. IPLC lines for two site communication ( with private IP subnets)    Many thx in advance.  

Hey All, Just got a 60f and putting it through the paces.  I am noticing high mem around 60% and if np does anything basically goes to conserve mode and need to reboot.  Scoured cookbook and other googles and cant seem to find a good NPU best practice.  Wondering if anyone else has played with this at all.  Using at home, about 10 policies, 2 of which do actual filtering.   Just wondering thoughts.

Hi, I am not sure where to post this thread (please correct if this is the wrong forum). Is there an API available to get forti asset information (based on contract/license/serial number related queries) ??

Is possible to do it in VPNSSL? Client certificate plus LDAP username and password for authentication. And a bit more complex, Cliente certificate match UPN with LDAP username. Cliente certificate is only valid for the user that is trying to authenticate throught VPN. https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/751987/ssl-vpn-with-ldap-integrated-certificate-authentication Thanks 

Hi all,I have worked with the Fortigate firewalls now for about 2 years in my current role, but I do not consider myself a firewall person at all.I seem to struggle to come up with a good naming scheme for my policies and also how to best create policies so:[ol]We dont have tons of policieseasier to find the policy you are after[/ol]So we have policies named like "SiteA to SiteB" allowing all services and from and to has 2 different subnets Or we have "Allow AD,DNS,NTP from DMZ to LAN"  with services "Windows AD" + "NTP" from the DMZ subnet to 2 specific domain controllers.But we also have policies named "SiteA Server Lan to Datacentre" which has 4 VLAN interfaces in the from field and 1 VPN tunnel in the To field. The problem i seem to have is coming up with a consistent naming format for my policies and we we seem to mix in regards to creating 1 policy per thing either "SiteA to SiteB" or "Allow SMTP for Server1 to Exchange".[ul]How do you name your policies?Do you create one

Hi all I am trying to send all the log message I get in Logging -> Log Access -> Logs to a syslog server. But none of them arrived. I have the syslog server configured with the IP address, the level is Debug (but also tried with Informational, there is no change. Anyway Debug should include everything above it, therefore also informational). For the Facility I tried a couple of things, such as syslog, local0, auth etc. Is there a documentation how the FortiAuthenticator sends out these log messages, with which Facility? Is it possible in the same syslog server setting to send everything I get in the log file? Thank youMarkus

Hello all. I've enabled an Automation stitch to email me whenever any other admin signs into the FGT (6.2.1) and makes any changes. Those emails look like this: FGT[FGxxxxxxxxxxxxxx] Automation Stitch:Config-Change is triggered.date=2020-06-29 time=08:25:47 logid="0100032102" type="event" subtype="system" level="alert" vd="root" eventtime=1593437147787054028 tz="-0500" logdesc="Configuration changed" user="xxxxxxxxxxxx" ui="ssh(xxxxxx)" msg="Configuration is changed in the admin session" Is it possible to have these emails include the EXACT config change made .e.g. user Andrew made a change: an interface IP address changed, or a policy was disabled?

Hello everyone, we have setup a basic wifi network (UniFi) which auth against a windows 2016R2 radius server All is working fine. The problem we are having is that the fortigate firewall is not seeing the usernames and therefore not pulling them into the correct rule set. Since users authenticate to WiFi using NPS on Win2016, FSSO does not detect them on FGT.Is it possible to get FGT to detect which user is authenticated by the radius??I tried this: https: //cookbook.fortinet.com/ssl-vpn-radius-authentication/ and unsuccessfully. But I do not know if it is right for this workaround. Thank you. Jirka  

On the FortiExplorer page, I see a link for the iOS app...  Is there a corresponding Android app?ThanksJamie

Hi In your opinion, how reliable is application control (as in using it in policies to limit only those applications) when not ssl inspecting the traffic ?

Good day all, we are having fortigate 400E with 6.0.Can it be configured to act as ftp/secure ftp server. If so, where will the files transaction be stored in?  

Hello All,I am running 6.2.4.  I have a new Internet connection via AussieBroadBand here in Aus.  Our link is DHCP but we have two static IP addresses coming in on the same link.  The two IP Addresses are both /32 addresses. I have created a virtual IP as per the following documentation. This is very similar to the pfSense and I have done this previously with the pfsense in a separate environment.https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/502582/creating-a-security-policy I have also created the IPv4 policy as per the documentation.  However, it doesn't seem to work.  In the port forwarding section I forwarded ICMP and have monitored for incoming ICMP on the target machine but don't see any packets reaching the internal machine. I am starting to wonder whether my ISP is in fact forwarding those packets to me.  It's been a long time since I've done any packet sniffing on the fortigate, I'm hoping someone can help me with the

Hei, I have got a  problem with 2FA Mobile token. We use SSL VPN and LDAP. All vpn users  are assigned by 2FA with mobile token  and they are able to login to the network via VPN using 2FA mobile token. But only one user is unable to use the token.  When he tried his username and password , the forticleint not asks for fortitioken mobile and get directly connected into the network  , which is seems same as SSO, eventhough the user is successfully assigned by a fortitoken mobile. What might be the reason for this . How can I troubleshoot this and get it resolved.  Thanks!!

So here's my conundrum. I have 3 sites all with a private fiber connection to our network provider's datacenter, where they carved off a VDOM just for us to use. We run OSPF on a vlan between the 4 sites (network provider datacenter and 3 locations). I had a failover event this weekend where the circuit failed at the main site and it started running through the secondary site. Everything was fine except for the traffic to the firewall itself, which means nobody was able to auth to the SSL VPN at the main site because the core switch at our main site saw the /24 as a connected VLAN and didn't have any way to hit the Fortigate IP directly anymore. My thought is why can't I redistribute a /32 to the Fortigate LAN IP through OSPF to make sure that fails over automatically. But I can't find anything on that anywhere.  I did see about redistributing a loopback through OSPF, but I can't get the SSLVPN auth to originate from a loopback interface as far as I can tell. So if anyon