Solved

Goodday everyone, In one of the ipsec vpn, both phase1 and phase2 configuration show "set proposal "aes256-sha1 aes256-md5".what is the need for two authentication & encryption methods for a single ipsec connection and how will this work?   

Hi there, I'm getting something odd happening which I've never seen before, I am intermittently getting DNS queries answered with a 198.18.x.y address. Using Fortiguard or local DNS servers doesn't make any difference to the behaviour. It happens with both local clients and through the CLI on the box. For instance:  Have to say I've no seen that before! Any ideas? Thanks, Jon

HelloI Have one client using vpn site-to-site with my company, now another customer has appeared in which the network segment is the same as that of the first customer, that is, both have the 10.1.0.0/16 network "Phase 2 Selectors - Remote Address" . How would you handle the ipsec tunnel for this other customer? Thanks all

If a FortiWiFi is in place and the FortiWiFi wireless is in use, can one or more FortiAP‘s be added using wireless provided by the FortiWiFi wireless as well as the FortiAP wireless? Can this arrangement function as it does with 2 or more FortiAP’s including roaming and the same SSID’s on all access points?

Hi everyone!  I need your precious help about this scenario, please see attached diagram below. What do you recommend as being the best way to configure HA on these 2 Fortigates to work properly?Active-Active or active-passiveEach one of the Firewalls is connected to ISP through only 1 link and the ISP is the same but has configured VRRP between ISPRouter1 and ISPRouter2.  Thank you so much!  Regards!

Hi,we have a problem with forticlient, the traffic to a site stops every hour for 2 minutes. They are all IPSEC and the connection does not drop. This does not occur on locale site network but only for remote connection. I saw that I can't change the values of the standard vpn configuration from the fortigate. Some idea?Tnx

We see many false positives in the compromised hosts list, to the point where it makes the list almost useless. Most of them seem to be legitimate web advertising that is detected as Malware CnC. The most common of these is assets.ubembed.com and <randomstring>.js.ubembed.com. Is there some workaround to whitelist these or otherwise reduce the number of false positives?

So i'm completely new to Fortinet and have a new 60F and S124EP switch for my lab. The 60F is connected to Forticloud and the S124EP is connected to the 60F using FortiLink. I'm looking at building out a few VLAN's and having a hard time understanding the best place for the gateway to live for these. Should everything be built on the Fortiswitch and have that do DHCP and everything or should all the VLAN interfaces be built on the 60F? Suggestions? Advantages one way or another?

Hi, Fortinet guys, I am fully new to Fortinet products. Recently, my company purchased a pair of Fortigate 400E to set up HA structure. May I know if the Fortigate 400E:1. Active-active mode is good deployment for Fortigate 400E ?1. Supports "FGCP HA with 802.3ad aggregated interfaces" ?2. Which 2 interfaces are used/good to be deployed Heartbeat interfaces ? Many thanks in advance. 

Greetings.  Here is my situation, and I would like some suggestions. We have 2 branch offices.  Branch office 1 has a FortiGate 100F, and 2 internet connections, different ISP's (WAN1 and WAN2 respectively). Branch office 2 also has a FortiGate 100F, but only ONE internet connection (WAN1). I would like to accomplish the following: 1. Branch 1 failover internet connection - when WAN1 goes down, traffic is pushed over to WAN2. When WAN1 is restored, traffic jumps back over to WAN1.  Essentially make WAN2 a backup connection...only activated if WAN1 fails. 2. Site-to-site VPN connection between the 2 sites, but with redundancy.   So, if 1 of the 2 internet connections goes down at branch office 1, the site-to-site VPN will not be disrupted. What is the best way to accomplish this?  SD-WAN..priorities....CLI magic? I'd appreciate some assistance! Thank you for your time!  

Does anyone know that FortiOS 6.0.10 supports FAP-231E? When will this version 6.0.10 be released?Thanks！

Hello every one,My cisco AP ( cisco 2802iS K9) can not assign form DHCP server ( user FOrtinet300d), i refer on Cisco comunity .need enable DHCP option 43 on DHCP server,how to enable DHCP option 43 and input correct value on Fortinet DHCP ? thanks so much 

Trying to learn more about the FortiSwitch. I see that when using multiple FortiSwitch switches it is common to use ISL between the switches. Will this restrict connection speed between switches? In other words what bandwidth does this ISL support?

Is there any way to block fake "Client" field just like the one on the attachment? In the attachment, there is "Header from" field pointing to an appropriate (trusted) sender, but the "Client" field displays unwanted and potentially dangerous sender. If there a method to block such fake senders?

hi, a few weeks ago I started to receive attacks on all my servers nated by fortinet, I tried to block the attacking ip or networks but it does not work, the ip continue to attack and the fortinet does not work.  

Hi everyone, I have a problem on Fortigate 600D and Fortigate 60E systems, when i fill the Generate Certificate Signing Request form i cannot use it to get the RapidSSL certificate because of "country code invalid" error. Whether i use Country / Region field or no - i allways get that error code, on multiple CA websites. Country code should be HR which stands for Croatia. Can anyone assist please? Kind regards,Goran

Hello Everyone, We have FortiGate 140D with OS 5.6 . We are currently depending on WAN1 port to access the internet which is microwave link. I have a new 4G device, which i would like to connect to FortiGate WAN2 but use it only for windows update downloads. I tried to connect the 4G link to WAN2 port, then suddenly all internet is disconnected from the users !! How can I use WAN2 just only for update of software?? even if its down, i don't want this traffic to go to WAN1. Best Regards,Alzaiem

Howdy,Perhaps you can shed some light on the following.  We have two Fortigate 300Ds (v6.2.3) in an Active-Passive HA cluster.  Up to now, only the Primary unit has had the "outside" interface (let's call it WAN1) plugged in; we don't have a switch between the Fortigate and the ISP (ISP1) in order to have WAN1 plugged in on both Primary and Slave.Now, we have a second internet pipe (ISP2).  I know the typical deployment would have a switch between each Fortigate in the HA cluster and the ISP:[ul]Primary WAN1 = ISP1Primary WAN2 = ISP2Secondary WAN1 = ISP1Secondary WAN2 = ISP2[/ul]The above would be ideal, but I need to make things work without the upstream switches. Here are the requirements:If ISP1 is having issues, which is plugged into Primary WAN1, HA fails over to Secondary which has ISP2 plugged into WAN2. If I keep ISP1 plugged into Primary WAN1 (Secondary WAN1 has nothing plugged in), and plug ISP2 into Secondary WAN2, is it as easy as setting up link mo

Hi all, I hope this is the right forum for this question. I have a 60E on a VDSL WAN service. My question:- for overall performance is it better (however that's defined!) to let the CPE router manage the PPPOE session or let the Fortigate do it? My understanding is that managing PPPOE on the Fortigate disables hardware acceleration so I was thinking it may be better to let the CPE router handle the PPPOE session and just let the Fortigate route towards the CPE router? Is there any suggestions or guidance on his is best managed? Kind Regards,  Andy.  

Good Morning,   I am planning out an upgrade to our Fortigate Systems from the 60D to the 100F. We have grown some and with all the new requirements placed on the network I am noticing the 60Ds are taxed and at times can become unresponsive with100% CPU usage. We currently have 2 60Ds in HA (A-P) and I was wondering if I could just place the 100F's in the cluster and demote the 60D's after the sync? Trying to plan this with as little downtime and complications as possible. I figured since the 100F's are in the cluster the configs would just sync to them and then I could make on of them the Master and remove the 60Ds. Would this work?

Hello,If just find out that some Fortigate have End of Support Date (EOS) (https://support.fortinet.com/Information/ProductLifeCycle.aspx)But i can't find some of them like:-FortiGate-60D-Fortigate-100D-FortiGate-200D-FortiGate-240D Does it seems to be not yet announced for the Fortigate in "D" ? Regards,Nicolas

Hi All:I'm using 81E and did some https traffic, and saw re-signed ca from captured packets. And I wanna know which command can find the ssl inspection statistics. I got one, but I'm not sure what stand for "C" and "T". Is "C" for current? what's for "T"?:FGT81ETK19002696 # diag ips ssl sta ------------------ SSL configuration -------------------- Bypass:                    false Session resumption:        true -------------------- SSL statistics --------------------- SSL transactions: C/T/E/S   SSL v3:  0/0/0/0   TLS 1.0: 0/0/0/0   TLS 1.1: 0/0/0/0   TLS 1.2: 3312629/3335323/0/0

 Hello to you all, I have a problem with crashing application within the Fortigate 1500D. So far I can see it is the WAD application (Cache & Wan optimization deamon). The strange thing that some traffic seems to have problems with it crashing. The next strange thing is that the feature “WAN Link Load Balancing” isn’t activated. What can be the cause of this application to be crashing all the time. Firmware: V5.2.1Type Fortigate: 1500D Has somebody have a idea? date=2014-12-31 time=13:24:02 logid=0100032546 type=event subtype=system level=warning vd="root" logdesc="Application crash" action=crash msg="Pid: 28447, application: wad, Firmware: FortiGate-1500D v5.2.1,build0618b618,140915 (GA) (Release), Signal 11 received, Backtrace: [0x011ad238] [0x0120cab8] [0x0120cfc0] [0x012136fb] [0x0126ee7a] [0x0126f0a6] [0x0126e5ed] [0x012a1a78] [0x0043d35c] [0x0043a3e3] [0x2a95c40475] [0x0043a889]" date=2014-12-31 time=13:20:50 logid=0100032546 type=event subtype=system

We are installing a new HA pair of 501E's (v5.6) to replace some older FG's, and we're adding a FAZ 400E (v6.0) to the mix. No FAZ installed previously. I have one FAZ port on our mgmt VLAN and I can access it fine. I plan to use a separate FAZ port to receive the logging from the FG(s). Is there any way to cable the FAZ directly to the HA pair to receive logging? E.g., port10 on first 501E to FAZ port3 and port10 on second 501E to FAZ port4. I don't see any internal switching capability in the FAZ to put two ports together with a single IP address. I don't see any layer 2 protocol options between FAZ & FG either. I don't have any other bright ideas. Has anyone attempted this with success? If we use only one FAZ port then whatever switch module that port connects to is a single point of failure. All other devices of this significance in our network have redundant connections to different switch modules. We don't see the need for a 2nd FAZ as we will also be logging to the

We have a VPN IPsec setted by wizard to use by forticlient.It seems that split-tunnel is disabled. If I connect and then go to internet I navigate by company ISP (tested by whatismyip). The VPN works like a charm but we cannot make call by MS Teams. The chat works but non video/audio call. I found that there are some problem with Teams. I would know if I can exclude the Teams connection from the tunnel using ipv4-split-include/ipv4-split-exclude settings or if there is any workaround. [Update 20-03-02]Using a VPN Native windows without split tunnel Teams works, calls included. The problem is Forticlient. [Update 20-03-11]Using Forticlient on MAC it works, only windows does not work. [Update 20-03-12]Group calls works. P2P calls no. There's a bug in the recent version of FC. Use version 6.0.0.0067 to solve the issue. It works. Regards,Graziano.