Solved

Hi all,I am trying to display dhcp server config on 30e but i am not sure this gives code 5 error? Any idea?# show ? <Enter> Or full-configuration show full configuration# show full-configuration system dns Command fail. Return code 5 Secondly I want to do debugging on dhcp server traffic to see what is wrong....Any workaround? Thanks help

Hello, We are looking to upgrade our Fortimail soon but have not seen much feedback on the newer OS versions.  Considering Fortimail 6.2.3 vs 6.2.2 vs 6.0.8 and of Fortigate we generally wait for a x.x.4 release or higher.  Anyone testing Fortimail 6.2.2 or .3 and any big bugs?  Looking forward to geolocation and a bug fix for the html warning.  I have seen some feedback on FortiOS in general for 6.2.3, but curious about Fortimail and how the newer versions are treating folks.  

Hi everybody, I'm looking for a bit of a sanity check (on me and the requirements I'm dealing with). I've been tasked to have a look at the reporting coming out of the FD600's where using in conjunction with the Fortianalyzer.  The Fortigates are currently used purely for monitoring in our environment (web company) and are sitting behind the firewalls (or to the side really) to monitor all the traffic , regardless of whether or not it's relevant to us or we even own the hardware the attacks are aimed at (CCTV and BAC systems) so the security profile contains everything.  However there is also a requirement to have targeted realtime alerting for stuff which is relevant to us while at the same time having a log of everything.  From my (admittedly new and limited) understanding this is simply not possible? We configure the security profile with what's relevant to us and then have it alert on the relevant threat levels and categories?  Coul

Hi all, I am setting up a Site-2-site VPN from our hosting center to a customer network. (I only have control of the Fortigate at our end.) However the LAN addresses used on the customer network, is already used by another of our customers. Can I NAT the remote networks addresses in my end? Any description of how to set this up?I have tried finding info in the Forti Cookbook, but didn't find this scenario. TYIA.

I have a hub-and-spoke topology, 25 remote sites with site VPNs.Objective: I want to leverage DNS Server on the FGT 60D units to respond to client DNS queries.. putting less dependence on the main site and that VPN for resolution.  Some sites have RODCs (Windows), others do not.  Thus, some have an option for split-DNS to a local host, but others rely on a full DC back at the main site.  I also want to leave the System DNS set to FortiGuard and do want external lookups to use that. So.. Can I add my local interfaces to forward to System DNS (which in turn are the FortiGuard DNS servers), "and" either have normal forwarding for the local domain to either the local server or a remote server over the VPN?  Or, better, can I have a zone transfer as a secondary? I haven't seen a config example which will do "all of that" yet. I'm having mixed results trying to get something configured myself.  Last was an AXFR from my remote DC caught on WireShar

https://docs.fortinet.com/product/fortigate/6.4 It's dropped support for the 30e / 50e, so I wont be able try and load into test lab :(

Hi all, I'm deploying a new pair of 1000D in active/active configuration. Outside interface's are connecting to a single ISP & seem to be working fine. The issue I'm having is communication between our core Nexus 9K's & the 1000D's. This is a multi-tenant environment and therefore we are leveraging VDOM's on the FG & VRF's on the 9K's.  I'm using individual /29 networks between the FG & 9K's to route. We are also using LACP on the FG & VPC on the pair of 9K's. The 9K's are not new & have been in production for quite some time. They are configured according to Cisco best practices.  The issue we ran into was that we were unable to communicate properly between the core switches & the firewalls on one of the /29 networks. After working with Fortinet Support for hours, I was told that best practices was for a L2 switch to be physically installed between the firewalls and our core switches. This apparently is due to some requirement for HA con

Hi there! I need some help with configuring Transit VLAN on FortiGate firewall.Basically as you can see in the attached diagram that I need to link between two networks; network EAST got L3 switch whereas network WEST got L2 switch and connected FortiGate firewall which handles the routing. I've been told that in order to make both networks to communicate and reach other that i need to use "Transit VLAN" between the L3 Switch on EAST and FortiGate firewall and use it for routing.So, shall I use another physical port from the firewall to L2 Switch and create this Transit VALN under that physical port? or use the existing physical port (port1) and create transit VLAN under it?

Hi, I'm reviewing the available configurations and options of the DHCP Server in order to confirm to a customer that a small FGT appliance will be good enough to handle their needs. The thing is, there's a specific setting I'm not sure in what scenario would be used at. auto-configuration (enable/disable) IMO, documentation is not clear enough as it describes the option in a useless way :\set auto-configuration {disable | enable} Enable/disable auto configuration. Do any of you know what actually does? or in what scenario would be needed? Max

Looking for advice on how to open ports that a service says will require a large number of addresses on, say, port 51000.  Please tell me if I'm doing this correctly: In a new policy, I'm creating Address entries for each IP or IP range (attached to Destination), then creating a Service with the port needed to open and leaving the address as 0.0.0.0. Can manual entry for services that use large amount of IP addresses be avoided? This would be for services that DON'T appear in the Internet Service database.

Can an SSL VPN  run without NAT? FortiClient 10.200.0.x -> Router 10.0.0.1 -> FGT 10.0.0.10 -> Internal Network 10.0.0.X Running into a problem with internal software trying to connect back to the client but it only sees the client as 10.0.0.10 and not 10.200.0.x. Is it as simple as disable NAT on the policy? Or is there more to it than that? Thanks

Hallo!I am looking for instruction for Fortigate, FortiOS 4.3. I found a page with links to movies "how to... in OS 4.3":https://cookbook.fortinet...-4-3-videos/index.htmlBut there is a problem: always, when I click the link, I go to YT, instead of displaying the video, I have information:"Movie not available. This video is private."Logging in to YT doesn't help. Does anyone know of a way for me to have access to it? Greetings!Andrzej. 

Hi Everyone, Installing policy from the Fortimanager to the Fortigate gives this weird message ... Where to find this certificate in the Fortimanager, or how to delete the certificate from the Fortigate .. Appears to be a Wifi certificate (I am pretty sure Wi-Fi features are not in use on the fortigate where the policy is being pushed to ... ) <hostname> (ca) $  delete "Entrust_Root_Certification_Authority_-_G2"Can not delete a static table entryCommand fail. Return code -61<hostname> (ca) $  end<hostname> $  end  ---> generating verification report( certificate ca )            delete "Entrust_Root_Certification_Authority_-_G2"( vpn certificate ca )            delete "Entrust_Root_Certification_Authority_-_G2"<--- done generating verification report Any suggestions, most appreciated :)  &nb

Hi all.As per subject - how do I need to proceed, to be able to use the two 40G ports (53 & 54) on a FSW1048E?In the GUI I see only up to port 52 and I would like to use 53-54 for ISL between two identical FSW1048E (running 6.0.3).Thanks,Flavio.

Hello experts, today we deployed FGT200E to part of the network. We terminated two parts of the network - vlan666 and vlan777 - both networks are WiFi and both have DHCP on FGT. DNS is Google DNS Everything works ok, only in the log we have very often a message: Deny-policy violation - dst iface unknow-0. Although it is legitimate traffic to be routed to the internet. No BGP or OSPF is used, NAT is performed on an IP pool on a public IP address. config firewall policy    edit 26        set name "UINIFI Guest->WAN"        set uuid 671a3c32-e734-51e8-b9c2-43cbdf86ab1f        set srcintf "VLAN777"        set dstintf "wan1"        set srcaddr "UNIFI Guest"        set dstaddr "all"      

Goodmorning!I have Fortniet Fortigate 310B.I buy this, because I need make a VPN connection. It is of course not a new unit, but used.  And now I have problems with connection with this unit.First: according instruction in internet I connect ethernet cable to Port 1, set the host IP:192.168.2.1, but Port 1 is inactive. No connection in this way.Second way: I connect serial cable to console port, configure COM1 to 9600/8/1/none/none, start PuTTY, PuTTY is conected to Fortinet.And now I see serial numner, and login, and a question mark.So I type: admin <Enter>, password <Enter> (without of password).I try type "admin", "Admin","ADMIN", ....always "Login incorrect".In instruction is, login: admin, password: none (just press Enter).The seller assured that the device is reset to factory settings.Factory settings are: admin/none. What I am dooing wrong?Regards! 

I am adding another building to an existing network and I am trying to create the following network setup: [1st building]cable modem ISP --> fortigate firewall --> JGS524NA --> cable to 2nd building [2nd building]cable from first building --> JGS524NA --> internal network of computers The 1st building network has been excellent and has an existing switch to expand and support the onprem devices. Now I am trying to extend this network into a second building (less than 100m) away. Here's the problem - when I plug in the cable from the first building into the new switch - its like the switch isn't even working - no lights show that the cable is plugged in. When I plug the cable directly into my laptop - it works just fine and I can get DHCP address. But when I plug that cable into the switch and attach other devices to the switch - no other device will work. Some observations:[ol]I purchased another switch - to rule out a hardware problem

   Hello  could you please help me which device is better for reporting purpose, fortianlayzer or forti cloud.  Can please give me detailed difference between FortiAnalyzer and FortiCloud

Hello,I have fortigate and fortimanager vm trial version 6.0.2. I could not add FortiGate to Fortimanager.There is no connectivity problem between fortigate and fortimanager, but I get "Probe Failed" error. FMG protocol is enabled on related interface. I checked task monitor logs on FortiManager, I saw "Cannot communicate with remote device (tunnel is down)" and in the description "2019-04-29 15:14:24:fgfmstarterror". what might be the problem? thank you,

Dear all this will be my very first post and please go easy on me :) and I hope I get good respond and thanks before! So far, any fortinet literature or cookbook or video only show that site-to-site IPSEc is created between two fortigate (site to site ipsec illustration.png), and the policy and static routing is created based on the two directly connected subnet (to fortigate).  For example, between HQ internal network (assuming 10.10.10.0/24) to Branch internal network (assuming 192.168.10.0/24), the private network is part of directly connected subnet to the fortigate physical interface.  What happen if private network  is behind another layer 3 device? for example, I want to create a VPN between 10.10."20".0/24 to 192.168."20".0/24. it means, both those .20 network are not directly connected to fortigate broadcast domain / physical interface. If I am configuring HQ FGT, Should I simply state local address as 10.10.20.0/24 and remote address as 192.

HelloCould you please help me how to block sub advertisement in a website.please find the attachedI am using fortigate 100E

Just had an interesting experience when updating an HA a-p setup. The failover unit was re-installed earlier this year due another issue. When updating firmware, it turns out the passive unit had an older version of the Internet Service Database Definitions. Given this, the unit simply replaced the services involved in the policy as some of the services didn't exist in the current version. The policy had Microsoft-Office365, Microsoft-Microsoft.Update and Microsoft-Azure defined. After the failover switch, the policy was replaced with Microsoft-Office365, Microsoft-Other and Microsoft-Other. How can I make sure this doesn't happen future wise? 

I had a client request whatsapp be opened up temporarily during this lockdown period while some of them are in the office and communicating via the app.  They had it blocked and opened it again and ensured the application policy was enabled ok and confirmed with the client it was indeed working fine. The next day it stopped working, disabled the policy and re-enabled it again and working again, next day not working.  I created a new policy with the ports whatsapp uses and tried that and working and again today not working.  What is causing this to stop every day?

Hello,  I am new to FortiClient and am using it for Anti Virus on a few Win 7 Pro computers.  When some youtube videos are attempted (i.e. [link]https://www.youtube.com/watch?v=A6DqPBJNkvk[/link] ), I get an error message in the viewer "Video unavailable This video is restricted.  Try signing in with a Google Apps account."  If Forticlient is shutdown, the video works.  If Forticlient is restarted, the video fails again.  I do not see any indication that the site is blocked in Forticlient (no notifications, 0 Sites Blocked).  I tried adding an exclusion *.youtube.com  but that didn't help either.  I cleared the Forticlient log, tried to open video, and then exported the log.  However, I do not see any blocking.  I can add the log file if that is useful to anyone.    Any suggestions to troubleshoot this issue are appreciated.Thanks,Dale Sykora 

Hi! I have a Mac running High Sierra with the latest version av FC.When connecting to VPN it takes a couple of seconds, then the icon in the menu bar disappears and nothing happens.If i open the console it says "connecting" and the button "Disconnect" but nothing happens even after waiting for minutes.  I have a client that runs 5.6.0.703 and it connects without any issues.  Have tried reinstalling, rebooting etc.