Solved

Is there any way to block fake "Client" field just like the one on the attachment? In the attachment, there is "Header from" field pointing to an appropriate (trusted) sender, but the "Client" field displays unwanted and potentially dangerous sender. If there a method to block such fake senders?

hi, a few weeks ago I started to receive attacks on all my servers nated by fortinet, I tried to block the attacking ip or networks but it does not work, the ip continue to attack and the fortinet does not work.  

Hi everyone, I have a problem on Fortigate 600D and Fortigate 60E systems, when i fill the Generate Certificate Signing Request form i cannot use it to get the RapidSSL certificate because of "country code invalid" error. Whether i use Country / Region field or no - i allways get that error code, on multiple CA websites. Country code should be HR which stands for Croatia. Can anyone assist please? Kind regards,Goran

Hello Everyone, We have FortiGate 140D with OS 5.6 . We are currently depending on WAN1 port to access the internet which is microwave link. I have a new 4G device, which i would like to connect to FortiGate WAN2 but use it only for windows update downloads. I tried to connect the 4G link to WAN2 port, then suddenly all internet is disconnected from the users !! How can I use WAN2 just only for update of software?? even if its down, i don't want this traffic to go to WAN1. Best Regards,Alzaiem

Howdy,Perhaps you can shed some light on the following.  We have two Fortigate 300Ds (v6.2.3) in an Active-Passive HA cluster.  Up to now, only the Primary unit has had the "outside" interface (let's call it WAN1) plugged in; we don't have a switch between the Fortigate and the ISP (ISP1) in order to have WAN1 plugged in on both Primary and Slave.Now, we have a second internet pipe (ISP2).  I know the typical deployment would have a switch between each Fortigate in the HA cluster and the ISP:[ul]Primary WAN1 = ISP1Primary WAN2 = ISP2Secondary WAN1 = ISP1Secondary WAN2 = ISP2[/ul]The above would be ideal, but I need to make things work without the upstream switches. Here are the requirements:If ISP1 is having issues, which is plugged into Primary WAN1, HA fails over to Secondary which has ISP2 plugged into WAN2. If I keep ISP1 plugged into Primary WAN1 (Secondary WAN1 has nothing plugged in), and plug ISP2 into Secondary WAN2, is it as easy as setting up link mo

Hi all, I hope this is the right forum for this question. I have a 60E on a VDSL WAN service. My question:- for overall performance is it better (however that's defined!) to let the CPE router manage the PPPOE session or let the Fortigate do it? My understanding is that managing PPPOE on the Fortigate disables hardware acceleration so I was thinking it may be better to let the CPE router handle the PPPOE session and just let the Fortigate route towards the CPE router? Is there any suggestions or guidance on his is best managed? Kind Regards,  Andy.  

Good Morning,   I am planning out an upgrade to our Fortigate Systems from the 60D to the 100F. We have grown some and with all the new requirements placed on the network I am noticing the 60Ds are taxed and at times can become unresponsive with100% CPU usage. We currently have 2 60Ds in HA (A-P) and I was wondering if I could just place the 100F's in the cluster and demote the 60D's after the sync? Trying to plan this with as little downtime and complications as possible. I figured since the 100F's are in the cluster the configs would just sync to them and then I could make on of them the Master and remove the 60Ds. Would this work?

Hello,If just find out that some Fortigate have End of Support Date (EOS) (https://support.fortinet.com/Information/ProductLifeCycle.aspx)But i can't find some of them like:-FortiGate-60D-Fortigate-100D-FortiGate-200D-FortiGate-240D Does it seems to be not yet announced for the Fortigate in "D" ? Regards,Nicolas

Hi All:I'm using 81E and did some https traffic, and saw re-signed ca from captured packets. And I wanna know which command can find the ssl inspection statistics. I got one, but I'm not sure what stand for "C" and "T". Is "C" for current? what's for "T"?:FGT81ETK19002696 # diag ips ssl sta ------------------ SSL configuration -------------------- Bypass:                    false Session resumption:        true -------------------- SSL statistics --------------------- SSL transactions: C/T/E/S   SSL v3:  0/0/0/0   TLS 1.0: 0/0/0/0   TLS 1.1: 0/0/0/0   TLS 1.2: 3312629/3335323/0/0

 Hello to you all, I have a problem with crashing application within the Fortigate 1500D. So far I can see it is the WAD application (Cache & Wan optimization deamon). The strange thing that some traffic seems to have problems with it crashing. The next strange thing is that the feature “WAN Link Load Balancing” isn’t activated. What can be the cause of this application to be crashing all the time. Firmware: V5.2.1Type Fortigate: 1500D Has somebody have a idea? date=2014-12-31 time=13:24:02 logid=0100032546 type=event subtype=system level=warning vd="root" logdesc="Application crash" action=crash msg="Pid: 28447, application: wad, Firmware: FortiGate-1500D v5.2.1,build0618b618,140915 (GA) (Release), Signal 11 received, Backtrace: [0x011ad238] [0x0120cab8] [0x0120cfc0] [0x012136fb] [0x0126ee7a] [0x0126f0a6] [0x0126e5ed] [0x012a1a78] [0x0043d35c] [0x0043a3e3] [0x2a95c40475] [0x0043a889]" date=2014-12-31 time=13:20:50 logid=0100032546 type=event subtype=system

We are installing a new HA pair of 501E's (v5.6) to replace some older FG's, and we're adding a FAZ 400E (v6.0) to the mix. No FAZ installed previously. I have one FAZ port on our mgmt VLAN and I can access it fine. I plan to use a separate FAZ port to receive the logging from the FG(s). Is there any way to cable the FAZ directly to the HA pair to receive logging? E.g., port10 on first 501E to FAZ port3 and port10 on second 501E to FAZ port4. I don't see any internal switching capability in the FAZ to put two ports together with a single IP address. I don't see any layer 2 protocol options between FAZ & FG either. I don't have any other bright ideas. Has anyone attempted this with success? If we use only one FAZ port then whatever switch module that port connects to is a single point of failure. All other devices of this significance in our network have redundant connections to different switch modules. We don't see the need for a 2nd FAZ as we will also be logging to the

We have a VPN IPsec setted by wizard to use by forticlient.It seems that split-tunnel is disabled. If I connect and then go to internet I navigate by company ISP (tested by whatismyip). The VPN works like a charm but we cannot make call by MS Teams. The chat works but non video/audio call. I found that there are some problem with Teams. I would know if I can exclude the Teams connection from the tunnel using ipv4-split-include/ipv4-split-exclude settings or if there is any workaround. [Update 20-03-02]Using a VPN Native windows without split tunnel Teams works, calls included. The problem is Forticlient. [Update 20-03-11]Using Forticlient on MAC it works, only windows does not work. [Update 20-03-12]Group calls works. P2P calls no. There's a bug in the recent version of FC. Use version 6.0.0.0067 to solve the issue. It works. Regards,Graziano. 

I'm trying to troubleshoot a routing or policy issue and I'm trying to capture traffic to help me.  Unfortunately, I can't seem to capture any traffic coming through my VPN.I have a IPSEC VPN connected and passing traffic to the internal network. My IP address while connected is 172.16.255.65.When I run "diag sniffer packet Outside-PSD-10G 'src host 172.16.255.65' 4 10" I get nothing.If I run the same query with the filter set to none, I get gobs of traffic.  If I change the interface to the VPN interface, it returns "That device is not up for RASVPNWIN".Does anyone have any idea what I'm doing wrong?Any insights are appreciated,Thank you,Bill

Its time to start my first significant round of Fortigate upgrades and am looking for tips and tricks from those that have done many. I'm using the following as a starting point; https://kb.fortinet.com/k...=FD35329&sliceId=1 Assumption - Firmware upgrades via the FG GUI can generally be relied upon to be hitless.  Environment - All firewalls are clusters and have serial consoles connected- Clusters use 'session-pickup enable' and 'session-pickup-connectionless enable' - I intend to use the FG GUI to perform the upgrades - All firewalls are connected to FortiManager 6.0.8. - First upgrades will be to get all 5.4 firewalls to 5.6 Procedure for first (Lab) cluster/ADOM 1. Take FMG backup via GUI 2. Upgrade ADOM to 5.6 in GUI 3. Check Device Manager 'Config Status' is Auto-update/Synchronised in FMG 4. Take FG backup 5. Connect to serial consoles 6. Perform first step in Upgrade Path 7. Login to FG GUI and check Firmware version and cluster status 8. Login to

Hello! I did an upgrade to 6.4 last Week on our Fortigate 100E. I mentioned that many features are missing now and policies have been changed. So I did have Policies that there is no deep SSL Inspection for Android Handys. After the Update there is no Option for the Devices available. WTF !?? Not sure if I should switch back to my old firmware. We have a lot of problems here now. What can I do? Best Regards Wolfgang

Good day everyone,I am trying to understand what this command is used for to no avail. I did it under the neighbor configs and nothing seemed to happen. Any ideas?Thanks.Yuri.config neighbor    edit "12.12.12.12"        set soft-reconfiguration enable        set interface "Loop2"   <-- This one ?        set prefix-list-in "accept-dflt-only"        set remote-as 111        set route-map-out "LocalOutACL"        set update-source "Loop2"  <-- I thought these were interrelated but didn't find any link        set weight 10    nextend

Hi All,  Looking for ways to export logs from a Forti200D (5.6.8) into .csv format / easily readable by excel. Currently, during import into excel (using 'space' as delimiter), some fields will run. Is there ways to generate the logs with " " / custom delimiter instead?  Thank you.   

I recently upgraded our test firewalls to 6.4.0 and now split tunneling doesn't work. The VPN connects fine but all portals push a default route instead of the routes I specify.  Creating new portals with the GUI or CLI have the same issue. 

Hey guys, i'd like to wipe all data from this fortigate 60d (firmware v6.0.9) and tried a lot already, but it's still showing licensing information in System->FortiGuard (especially FortiCare Support is set to Registered, followed by an email address..).I have access to the device via rj45 on port 1/login with default username and password. What did i do already:- execute factoryreset via cli- execute formatlogdisk- execute erase-disk usb-1 (but not boot disk,because the device probably wouldn't boot anymore?)- upgraded firmware from v6.0.6 to v6.0.9 - which is installed now) But now i ran out of ideas. Especially with 'execute factoryreset' i was hoping to delete everything from the device.. So i would really appreciate any help!   RegardsFrank

Hiho, I just got this strange issue here: two FGT 100E with 6.0.8 running. Between both is an ipsec tunnel.Side A says (in IPSec Monitorr) the tunnel is upSide B say (-"-) the tunnel is downSide B still gets new SA Requests for that tunnel from Side A In Debug Log on Side A you see that Side A is doing the complete handshale and even sends the tunnel up snmp trap to side B.On Side B you only see new SA Requests from Side A and then negtiation timeouts. P1 auto negotiation is disabled on Side B but enabled on Side A I have no clue why this happens...

Hi all,I have a question about a feature in fortigate.I cannot activate the feature via cli. This is a Video for FGT Version 5.4:https://www.youtube.com/watch?v=LI3bW2eO-ck config system settings set gui-policy-learning [enable | disable] endcommand parse error before 'gui-policy-learning' Command fail. Return code -61get the error message. in gui i couldn't find the function in features either, so I can turn it on.I have several 201E in use, on which I tried it. It does not work. Is this function no longer available for the actual Fortigate Images?if so, how can I proceed?i want to create new policys with the information of the connections that have taken place.a described here:https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-whats-new-54/Top-policy-learning.htm Thanks,Yusuf

Hi all Maybe you can give me a hint with the following situation:We've setup an IPSec S2S connnection from our local FortiGate to Azure (virtual gateway, not a full FortiGate Virtual Appliance), following the cookbook: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/587640 This worked like a charm so far, great :)  Now I tried to add the ability to dial into our local network via the existing SSL-VPN connection (FortiClient) and then access the ressources on the remote side of the IPSec tunnel.I tried this cookbook as references, but as it's not Fortigate-to-Fortigate, the Wizard won't provide the same settings: https://cookbook.fortinet.com/ssl-vpn-to-ipsec-vpn-56/index.html  Basically it's not working, I can't ping an Azure ressource via SSL-VPN remotely, while I can ping it from our local network. I have checked:1. Additional policies for SSL-VPN --> IPSec tunnel and back 2. A static route that routes everything for the Azure subnet range

Hello everyone, I've a doubt about the Explicit Proxy feature, I hope someone can help me with this. I've configured 2 FGT in HA and then installed the FSSO in Agent (standard mode) on both the Domain Controllers in the infrastructure.Then, I configured the FSSO Agent via GUI in the Security Fabric Menu adding both the two Domain Controllers, synched the AD Groups and then configured the IPv4 Policy adding the FSSO AD group permitted and enabling the Web Filtering option so I can block unpermitted web sites category.In this way all the not authenticated users (non AD users) are redirected to the Fortigate portal where the can type the temporary credentials. So, my questions are:- do I need to enable the explicit proxy?- which are the advantages I can get by enabling it?- I do not need to chenge the user's browser setting in the way I did and I think I can manage everything but...If the explicit proxy exists there will be a reason. Please, can you help to understand it? I

I setup a redundant Internet on my 100e using the cookbook. I setup the link monitor and stuff too. I set all of this up on monday night, and when I came in this morning, I noticed the backup internet's ip in the logs of something I was working on. So I did Whatsmyip and it seems that it is using Wan2, which is the backup, as a primary.  I am looking in the GUI for where to change the weight/priority/distance and I can't find it. I saw those options when I initially configured it I thought, at least I saw priority and im pretty sure I made the primary 5 and the secondary 10. But clearly I did something wrong.  I am running 6.0.5 Build0268 (GA) btw.I know the problem is that I have one of the above things wrong, its weight, priority, distance, or something. I cant find where to change it, and I dont know the CLI commands to show me the current settings or change the current settings. Can someone tell me the commands to check the settings and change them as

Hi guys, I need to find out why PPPoE on my FG40 is failing connection. Using:diag debug enable diag debug application pppoe -1 diag debug application ppp -1is giving me nothing. I'm connecting my fiber converter directly to the WAN interface. The same info is being written to console all the time, but it's not giving me much useable info:pppd 0 pppoed wan      nopersist noipdefault noauth defaultroute default-asyncmap hide-password nodetach mtu 1492 mru 1492 noaccomp noccp nobsdcomp nodeflate nopcomp novj novjccomp user MY_USERNAME lcp-echo-interval 5 lcp-echo-failure 3 sync plugin /bin/pppoe.so     pppoe_retry_time 1 pppoe_padt_time 1 pppoe_srv_name  pppoe_ac_name  pppoe_hostuniq 1423b4c0 pppoe_sock2parent 12 wan ipunnumbered 0.0.0.0 idle 0 unnumbered-negotiate enable The WAN connection just says 'Failed'. It would be nice to see a simple error saying 'password incorrect' or something like it. Any help is much appr