Solved

I'm trying to troubleshoot a routing or policy issue and I'm trying to capture traffic to help me.  Unfortunately, I can't seem to capture any traffic coming through my VPN.I have a IPSEC VPN connected and passing traffic to the internal network. My IP address while connected is 172.16.255.65.When I run "diag sniffer packet Outside-PSD-10G 'src host 172.16.255.65' 4 10" I get nothing.If I run the same query with the filter set to none, I get gobs of traffic.  If I change the interface to the VPN interface, it returns "That device is not up for RASVPNWIN".Does anyone have any idea what I'm doing wrong?Any insights are appreciated,Thank you,Bill

Its time to start my first significant round of Fortigate upgrades and am looking for tips and tricks from those that have done many. I'm using the following as a starting point; https://kb.fortinet.com/k...=FD35329&sliceId=1 Assumption - Firmware upgrades via the FG GUI can generally be relied upon to be hitless.  Environment - All firewalls are clusters and have serial consoles connected- Clusters use 'session-pickup enable' and 'session-pickup-connectionless enable' - I intend to use the FG GUI to perform the upgrades - All firewalls are connected to FortiManager 6.0.8. - First upgrades will be to get all 5.4 firewalls to 5.6 Procedure for first (Lab) cluster/ADOM 1. Take FMG backup via GUI 2. Upgrade ADOM to 5.6 in GUI 3. Check Device Manager 'Config Status' is Auto-update/Synchronised in FMG 4. Take FG backup 5. Connect to serial consoles 6. Perform first step in Upgrade Path 7. Login to FG GUI and check Firmware version and cluster status 8. Login to

Hello! I did an upgrade to 6.4 last Week on our Fortigate 100E. I mentioned that many features are missing now and policies have been changed. So I did have Policies that there is no deep SSL Inspection for Android Handys. After the Update there is no Option for the Devices available. WTF !?? Not sure if I should switch back to my old firmware. We have a lot of problems here now. What can I do? Best Regards Wolfgang

Good day everyone,I am trying to understand what this command is used for to no avail. I did it under the neighbor configs and nothing seemed to happen. Any ideas?Thanks.Yuri.config neighbor    edit "12.12.12.12"        set soft-reconfiguration enable        set interface "Loop2"   <-- This one ?        set prefix-list-in "accept-dflt-only"        set remote-as 111        set route-map-out "LocalOutACL"        set update-source "Loop2"  <-- I thought these were interrelated but didn't find any link        set weight 10    nextend

Hi All,  Looking for ways to export logs from a Forti200D (5.6.8) into .csv format / easily readable by excel. Currently, during import into excel (using 'space' as delimiter), some fields will run. Is there ways to generate the logs with " " / custom delimiter instead?  Thank you.   

I recently upgraded our test firewalls to 6.4.0 and now split tunneling doesn't work. The VPN connects fine but all portals push a default route instead of the routes I specify.  Creating new portals with the GUI or CLI have the same issue. 

Hey guys, i'd like to wipe all data from this fortigate 60d (firmware v6.0.9) and tried a lot already, but it's still showing licensing information in System->FortiGuard (especially FortiCare Support is set to Registered, followed by an email address..).I have access to the device via rj45 on port 1/login with default username and password. What did i do already:- execute factoryreset via cli- execute formatlogdisk- execute erase-disk usb-1 (but not boot disk,because the device probably wouldn't boot anymore?)- upgraded firmware from v6.0.6 to v6.0.9 - which is installed now) But now i ran out of ideas. Especially with 'execute factoryreset' i was hoping to delete everything from the device.. So i would really appreciate any help!   RegardsFrank

Hiho, I just got this strange issue here: two FGT 100E with 6.0.8 running. Between both is an ipsec tunnel.Side A says (in IPSec Monitorr) the tunnel is upSide B say (-"-) the tunnel is downSide B still gets new SA Requests for that tunnel from Side A In Debug Log on Side A you see that Side A is doing the complete handshale and even sends the tunnel up snmp trap to side B.On Side B you only see new SA Requests from Side A and then negtiation timeouts. P1 auto negotiation is disabled on Side B but enabled on Side A I have no clue why this happens...

Hi all,I have a question about a feature in fortigate.I cannot activate the feature via cli. This is a Video for FGT Version 5.4:https://www.youtube.com/watch?v=LI3bW2eO-ck config system settings set gui-policy-learning [enable | disable] endcommand parse error before 'gui-policy-learning' Command fail. Return code -61get the error message. in gui i couldn't find the function in features either, so I can turn it on.I have several 201E in use, on which I tried it. It does not work. Is this function no longer available for the actual Fortigate Images?if so, how can I proceed?i want to create new policys with the information of the connections that have taken place.a described here:https://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-whats-new-54/Top-policy-learning.htm Thanks,Yusuf

Hi all Maybe you can give me a hint with the following situation:We've setup an IPSec S2S connnection from our local FortiGate to Azure (virtual gateway, not a full FortiGate Virtual Appliance), following the cookbook: https://docs.fortinet.com/document/fortigate/5.4.0/cookbook/587640 This worked like a charm so far, great :)  Now I tried to add the ability to dial into our local network via the existing SSL-VPN connection (FortiClient) and then access the ressources on the remote side of the IPSec tunnel.I tried this cookbook as references, but as it's not Fortigate-to-Fortigate, the Wizard won't provide the same settings: https://cookbook.fortinet.com/ssl-vpn-to-ipsec-vpn-56/index.html  Basically it's not working, I can't ping an Azure ressource via SSL-VPN remotely, while I can ping it from our local network. I have checked:1. Additional policies for SSL-VPN --> IPSec tunnel and back 2. A static route that routes everything for the Azure subnet range

Hello everyone, I've a doubt about the Explicit Proxy feature, I hope someone can help me with this. I've configured 2 FGT in HA and then installed the FSSO in Agent (standard mode) on both the Domain Controllers in the infrastructure.Then, I configured the FSSO Agent via GUI in the Security Fabric Menu adding both the two Domain Controllers, synched the AD Groups and then configured the IPv4 Policy adding the FSSO AD group permitted and enabling the Web Filtering option so I can block unpermitted web sites category.In this way all the not authenticated users (non AD users) are redirected to the Fortigate portal where the can type the temporary credentials. So, my questions are:- do I need to enable the explicit proxy?- which are the advantages I can get by enabling it?- I do not need to chenge the user's browser setting in the way I did and I think I can manage everything but...If the explicit proxy exists there will be a reason. Please, can you help to understand it? I

I setup a redundant Internet on my 100e using the cookbook. I setup the link monitor and stuff too. I set all of this up on monday night, and when I came in this morning, I noticed the backup internet's ip in the logs of something I was working on. So I did Whatsmyip and it seems that it is using Wan2, which is the backup, as a primary.  I am looking in the GUI for where to change the weight/priority/distance and I can't find it. I saw those options when I initially configured it I thought, at least I saw priority and im pretty sure I made the primary 5 and the secondary 10. But clearly I did something wrong.  I am running 6.0.5 Build0268 (GA) btw.I know the problem is that I have one of the above things wrong, its weight, priority, distance, or something. I cant find where to change it, and I dont know the CLI commands to show me the current settings or change the current settings. Can someone tell me the commands to check the settings and change them as

Hi guys, I need to find out why PPPoE on my FG40 is failing connection. Using:diag debug enable diag debug application pppoe -1 diag debug application ppp -1is giving me nothing. I'm connecting my fiber converter directly to the WAN interface. The same info is being written to console all the time, but it's not giving me much useable info:pppd 0 pppoed wan      nopersist noipdefault noauth defaultroute default-asyncmap hide-password nodetach mtu 1492 mru 1492 noaccomp noccp nobsdcomp nodeflate nopcomp novj novjccomp user MY_USERNAME lcp-echo-interval 5 lcp-echo-failure 3 sync plugin /bin/pppoe.so     pppoe_retry_time 1 pppoe_padt_time 1 pppoe_srv_name  pppoe_ac_name  pppoe_hostuniq 1423b4c0 pppoe_sock2parent 12 wan ipunnumbered 0.0.0.0 idle 0 unnumbered-negotiate enable The WAN connection just says 'Failed'. It would be nice to see a simple error saying 'password incorrect' or something like it. Any help is much appr

Hi all,I am trying to display dhcp server config on 30e but i am not sure this gives code 5 error? Any idea?# show ? <Enter> Or full-configuration show full configuration# show full-configuration system dns Command fail. Return code 5 Secondly I want to do debugging on dhcp server traffic to see what is wrong....Any workaround? Thanks help

Hello, We are looking to upgrade our Fortimail soon but have not seen much feedback on the newer OS versions.  Considering Fortimail 6.2.3 vs 6.2.2 vs 6.0.8 and of Fortigate we generally wait for a x.x.4 release or higher.  Anyone testing Fortimail 6.2.2 or .3 and any big bugs?  Looking forward to geolocation and a bug fix for the html warning.  I have seen some feedback on FortiOS in general for 6.2.3, but curious about Fortimail and how the newer versions are treating folks.  

Hi everybody, I'm looking for a bit of a sanity check (on me and the requirements I'm dealing with). I've been tasked to have a look at the reporting coming out of the FD600's where using in conjunction with the Fortianalyzer.  The Fortigates are currently used purely for monitoring in our environment (web company) and are sitting behind the firewalls (or to the side really) to monitor all the traffic , regardless of whether or not it's relevant to us or we even own the hardware the attacks are aimed at (CCTV and BAC systems) so the security profile contains everything.  However there is also a requirement to have targeted realtime alerting for stuff which is relevant to us while at the same time having a log of everything.  From my (admittedly new and limited) understanding this is simply not possible? We configure the security profile with what's relevant to us and then have it alert on the relevant threat levels and categories?  Coul

Hi all, I am setting up a Site-2-site VPN from our hosting center to a customer network. (I only have control of the Fortigate at our end.) However the LAN addresses used on the customer network, is already used by another of our customers. Can I NAT the remote networks addresses in my end? Any description of how to set this up?I have tried finding info in the Forti Cookbook, but didn't find this scenario. TYIA.

I have a hub-and-spoke topology, 25 remote sites with site VPNs.Objective: I want to leverage DNS Server on the FGT 60D units to respond to client DNS queries.. putting less dependence on the main site and that VPN for resolution.  Some sites have RODCs (Windows), others do not.  Thus, some have an option for split-DNS to a local host, but others rely on a full DC back at the main site.  I also want to leave the System DNS set to FortiGuard and do want external lookups to use that. So.. Can I add my local interfaces to forward to System DNS (which in turn are the FortiGuard DNS servers), "and" either have normal forwarding for the local domain to either the local server or a remote server over the VPN?  Or, better, can I have a zone transfer as a secondary? I haven't seen a config example which will do "all of that" yet. I'm having mixed results trying to get something configured myself.  Last was an AXFR from my remote DC caught on WireShar

https://docs.fortinet.com/product/fortigate/6.4 It's dropped support for the 30e / 50e, so I wont be able try and load into test lab :(

Hi all, I'm deploying a new pair of 1000D in active/active configuration. Outside interface's are connecting to a single ISP & seem to be working fine. The issue I'm having is communication between our core Nexus 9K's & the 1000D's. This is a multi-tenant environment and therefore we are leveraging VDOM's on the FG & VRF's on the 9K's.  I'm using individual /29 networks between the FG & 9K's to route. We are also using LACP on the FG & VPC on the pair of 9K's. The 9K's are not new & have been in production for quite some time. They are configured according to Cisco best practices.  The issue we ran into was that we were unable to communicate properly between the core switches & the firewalls on one of the /29 networks. After working with Fortinet Support for hours, I was told that best practices was for a L2 switch to be physically installed between the firewalls and our core switches. This apparently is due to some requirement for HA con

Hi there! I need some help with configuring Transit VLAN on FortiGate firewall.Basically as you can see in the attached diagram that I need to link between two networks; network EAST got L3 switch whereas network WEST got L2 switch and connected FortiGate firewall which handles the routing. I've been told that in order to make both networks to communicate and reach other that i need to use "Transit VLAN" between the L3 Switch on EAST and FortiGate firewall and use it for routing.So, shall I use another physical port from the firewall to L2 Switch and create this Transit VALN under that physical port? or use the existing physical port (port1) and create transit VLAN under it?

Hi, I'm reviewing the available configurations and options of the DHCP Server in order to confirm to a customer that a small FGT appliance will be good enough to handle their needs. The thing is, there's a specific setting I'm not sure in what scenario would be used at. auto-configuration (enable/disable) IMO, documentation is not clear enough as it describes the option in a useless way :\set auto-configuration {disable | enable} Enable/disable auto configuration. Do any of you know what actually does? or in what scenario would be needed? Max

Looking for advice on how to open ports that a service says will require a large number of addresses on, say, port 51000.  Please tell me if I'm doing this correctly: In a new policy, I'm creating Address entries for each IP or IP range (attached to Destination), then creating a Service with the port needed to open and leaving the address as 0.0.0.0. Can manual entry for services that use large amount of IP addresses be avoided? This would be for services that DON'T appear in the Internet Service database.

Can an SSL VPN  run without NAT? FortiClient 10.200.0.x -> Router 10.0.0.1 -> FGT 10.0.0.10 -> Internal Network 10.0.0.X Running into a problem with internal software trying to connect back to the client but it only sees the client as 10.0.0.10 and not 10.200.0.x. Is it as simple as disable NAT on the policy? Or is there more to it than that? Thanks

Hallo!I am looking for instruction for Fortigate, FortiOS 4.3. I found a page with links to movies "how to... in OS 4.3":https://cookbook.fortinet...-4-3-videos/index.htmlBut there is a problem: always, when I click the link, I go to YT, instead of displaying the video, I have information:"Movie not available. This video is private."Logging in to YT doesn't help. Does anyone know of a way for me to have access to it? Greetings!Andrzej.