Solved

Hi all,I need to manage Fortigate 100 E with FortiOS 5.6.12 and I try to connect using my account and switching between many tab of my browser and multi-screen.But I can't because i'm logged of from de previous tab when I  logon on other tab.Is thre workaround to allow me switching with multitab? Thank you for your help

Hello, I've just created a FortiClient VPN (Client‑to-Gateway IPsec VPN) on a FortiGate unit that already had a site-to-site VPN set up. When I connect to the FortiClient VPN that I created, I can reach LAN resources behind the internal interface but I cannot reach resources behind the site-to-site VPN interface. I created 2 Firewall rules, one allowing trafic from the FortiClient VPN interface to the site-to-site VPN interface and another one from the site-to-site VPN interface to the the site-to-site VPN interface but it still doesn't work. What am I missing? Please check the network diagram with the VPNs and flow of traffic that is working vs not working.

Hi all, My setup(in basics): I have multiple Fortigate SG60, they are different physical locations. I configured a site-to-site IPsec VPN between the Fortigate SG60 in the DC to all sites. Which works fine (as far as I know). Lets call DC site A. Site A:I have a MGMT vlan and within this VLAN multiple VMs reside. It is possible to ping from a VM in site A to site B. In other words, to ping the other side of the VPN tunnel. I also have a dial-up VPN from my laptop to site A. Which works fine. From my laptop it is now possible to enter the MGMT network. Also it is possible to ping site B over the VPN. The routes are advertised.  So far so good. Now the problem, I recently added site C. A new Fortigate on a different physical location. IPsec site-to-site works fine. Also it is possible to ping site C from a VM in the mgmt network in site A. What is not possible: to ping site C from my laptop (that is connected with the dial-up VPN).For some reason the ro

Hello, we have a 200D in HQ and a lot of 60D branches all with IPsec Sito to Site connected in Hub and Spoke. now we issue a 3 - 4 times in a day that the Tunnel do freeze (for example i see it if i am on the RDP Connection and the connection get lost and retries to do the Session and after 3- 4 Times the session is UP again.) The tunnel is always UP and i see no Errors in the Logs. Do someone had similar strange behavior? its pretty annoing..

I'm trying to add a software switch to a zone, but i can't seem to do it. The software switch exists, has an IP, and has two physical interfaces assigned to it. When i go into the Zone config in the GUI though, the software switch doesn't show up. It also doesn't show up in the zone config in the CLI either. I can however add the switch called qtn.root. Are there any caveats to adding a software switch to a zone? Does it matter if i have an underscore in the software switch's name? (Using a FortiWiFi 61E running 6.2.1) TIA

We are having problem on one of our VDOMS regarding the IPSec dial up connections which seems to be only limited to 10 users.How can we increase the number of concurrent connections

Dears,I am syncing time on fortinet 1200D from Internet servers and i want my fortinet to be a NTP server for all windows servers and Cisco network devices, i have a server vlan which is terminated on cisco core switches as DG for the server vlan  and from core it is a trunk connecting to fortigate with aggregate interfaces for other servers going to the internet. how i can achieve the configuration of NTP, I think i dont need to create the policies here if i am not wrong becz traffic is not passing through the firewall it just hitting the inside  interface and coming back, from the same interface. thanks  

I need to create a report in Fortianalyzer which shows the details found in the dataset "vpn-Top-SSL-Web-Users-By-Bandwidth-and-Avail". However I need to have it list all the ssl vpn users, not just the top users. Can you please tell me how to do this? This is the query for the data set:select user_src, remip as remote_ip, from_dtime(min(s_time)) as start_time, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from (select devid, vd, remip, user_src, tunnelid, min(s_time) as s_time, max(e_time) as e_time, (case when min(s_time)=max(e_time) then max(max_traffic_in)+max(max_traffic_out) else max(max_traffic_in)-min(min_traffic_in)+max(max_traffic_out)-min(min_traffic_out) end) as bandwidth, (case when min(s_time)=max(e_time) then max(max_traffic_in) else max(max_traffic_in)-min(min_traffic_in) end) as traffic_in, (case when min(s_time)=max(e_time) then max(max_traffic_out) else max(max_traffic_out)-min(min_traffic_out) end) as traffic_out fr

I'm looking for the full install file for the FortiClient VPN installer v6.2 - the one with no support. I've been to the Firmware Images section of the Support Portal, but in the ForticlientTools there is only an online installer. The online installer DOES NOT connect to the servers to download the image, it times out, so I am unable to install it. I could just install an older version but I'd rather have the latest version. There is nothing wrong with my internet connection.

Just thought I'd post this here for others who have the same issue in future.  According to Fortinet support there is a bug in firmware 5.2.2 that causes the "ALL" service group to be ignored, so any policy rules that use it will be ignored.  It is fixed in 5.2.3, and in the meantime use "ALL_UDP, ALL_TCP & ALL_ICMP" instead of "ALL". We upgraded a 100D on Saturday from 5.0.2 to 5.2.2 (following the correct upgrade process) on Saturday and today noticed some traffic being blocked.  The GUI logs just showed "deny" with a PolicyID of 0 (no such policy ID visible).  From the CLI a debug showed "Denied by forward policy check (policy 0)" for any traffic that used the ALL service group.

We have a business case to use 2 seperate Remote Access VPN configurations on one Fortigate. We have a 50 FortiClient license for our corporate laptops with full access to the network services. With the current COVID 19 situation we are  looking into allowing users using their home computer with the free FortiClient VPN to only access RDP services for remote desktop. I have tried to create a second Remote Access VPN (Different Shared secret and source IP range) on the same untrust interface, but that one got precedence over the other and people couldn't use the original VPN anymore. Is want I want even possible?  Thanks

With a lot of remote workers as of today we have a situation with a couple apps (VoIP and screenshare) that require direct client to client communications.  But that seems to be blocked with any of the documented standard configurations. VPN client to our internal and several remote networks function just fine, but one VPN client cannot talk to another.  Makes sense security-wise (like similar restriction on our wireless network) but with current WfH situation not practical. Not even sure I could create ssl.root interface to ssl.root policy as that would seem both unnecessary and incestuous somehow but I'm at a loss of how else I might allow this.  Documentation, cookbooks and forum searches have come up empty.  Can anyone help or definitely say no way?

Hi. It is the first time I have setup a FortiGate 100F Cluster (FortiOS 6.2.3). I followed the tutorials for "HA" and selected "active-passive" for the FortiGate. I have setup the "ha1, ha2" interfaces an connected them. Then I have selected the "wan1" interface for monitoring. Basically the HA-Settings are working - I have got the master and the slave unit. If "wan1" loosing the connection (pulling cable out / or restart of master) it switches to slave which becomes new primary. But if "wan1" of old primary is restored I will get no connection from outside - only if I'm pulling out "wan1" cable of slave. F1 = master -> monitoring "wan1" F2 = slave -> monitoring "wan1" F1 > wan1 is lost > F2 = primary, F1 = slave ... all connections are now running correctly over F2. Then F1 > wan1 is restored > F1 = primary, F2 = slave ... I can only connect to F1 via MGMT (MGMT of F2 is not responding).. but I'm not able to ping the public IP of wan1, and I'm also not abl

Firmware version is v5.2.1,build618I have a user which is matched on a LDAP server. The user also has a FortiToken assigned, but I don't think that's relevant.The user is a member of a firewall local group. This group is added to the SSL policy (under Source Address, Source User(s)). When I try to log in the user through the FortiClient, I receive "Permission denied. (-455)".The Fortigate logs: sslvpn_login_unknown_user. I tried to set the users password to local as well, that did not work either.However, if I add the user directly to the policy, I can log in.  It seems that the policy does not process groups, only users. Is this correct? Then what do we need groups for?

The other day our LAN to WAN webfiltering started blocking about 80% of sites. The last change to the firewall had happened about 16 hours earlier, but nothing that should have blocked banking sites or duckduckgo. I had to turn off webfiltering until I could reboot the firewall. Since I rebooted (with the same webfiltering active again), I've had no problems. This is a 100D running 6.0.9 on voltage regulating UPSs. Just curious if this had happened to anyone else.  Dave

https://docs.fortinet.com/document/fortigate/6.0.9/fortios-release-notes/760203/introduction The known issues are the shortest list I remember

Basically, I am trying to do this but instead of IPSec tunnels or internal clients, it's only for our SSLVPN users: https://yatznet.com/2018/08/21/using-fortigate-as-a-local-dns-server/ In short, it works great on the LAN, but if I try to use FortiGate for DNS when connected via SSLVPN, all I get are DNS request time out errors. I do have a test policy in place that allows all ssl.root traffic to any destination within the LAN, and I can even ping the IP of the FortiGate when connected via SSLVPN, so traffic is flowing. I've done a debug and it didn't come up with anything useful, at least to me. Here is an example of an internal client using the DNS on the fortigate successfully, and the second one is our SSLVPN client timing out. It looks the same except for the flag, but I couldn't find out what that means. id=20085 trace_id=18 func=print_pkt_detail line=5517 msg="vd-root:0 received a packet(proto=17, OURLANCLIENT:59609->OURFIREWALLIP:53) from LAN. " id=20085 trace

I am trying to get tacacs authentication to work for user ronald (to start with) on our Fortigate 600D firewall.Tacacs server is a Centos 7 linux machine running tac_plus. Firewall config:config global config system admin edit "ronald" set remote-auth enable set accprofile "super_admin" set vdom "OOB" set remote-group "fwadmins" set password ENC SH2NlBggP0nKPW8lt6sfJaohuRG4BpAyUSjXp8jp6Fb/+RIZX5LtM5yMm2/S84= next edit "ronald" set remote-auth enable set accprofile "super_admin" set vdom "OOB" set remote-group "fwadmins" set password ENC SH2NlBggP0nKPW8lt6sfJaohuRG4BpAyUSjXp8jp6Fb/+RIZX5LtM5yMm2/S84= endconfig vdom edit OOB config user tacacs+ edit "tacserver" set server "10.11.1.11" set key ENC rRpp8EzKAhzRCOb0OaiS+voJjnRaN7g86rhrkLG3H4t6EF6QOrMPDTmR1Sx9yEYen1ScT6xpMBIlfjggc9IYcz2VlS42rFxaPeIA4cuWuvSxm/ HMJN2cA6b1+ZfBRYI+w74d6+wtKiVIKFwHpFCfxBTwtsbigNBtkLw55zqd2dKLWmg3FjWD0UbrQ+0/E/Hg== set authorization enable set source-ip 10.10.1.1 next endconfig vdom edit O

Hi Guys,I'm trying to switch my national ipsec vpn site-to-site network from static routing to ospf. Each branch's got around 6 subnets from which only 4 should be routed via the ipsec tunnel. Using static routing it's easy since I add only what exactly I need.My VPN network it's using a star topology and it might change to an extended star.I've started with 2 branches, the HQ and a branch.Everything works fine except that I'm not able to filter what routes are been advertised via OSPF since I'm using "config redistribute "connected""Attached is a lab I did to test it, but still no luck. The routers in the diagram I've attached are FG-70D's.I've tried:- prefix-list with in and out on both sides - no luck- access list with in and out on both sides - no luck I'm missing something here, right ?!?!Hope the diagram will give you a clear idea of what I wan to achieve. Cheers,Tony

Hello,On my Branch office I need stablish two active Dialup VPN with my HQ.On my HQ I have two ISPs Internet links and at the my BR only one.At the Fortigate on BR I have set Two Dialup client to ISP1 and ISP2 for HQ.My problem is never two tunnels is UP at the same time, when one come up other to Down.I wonder if is possible to keep active the two tunnels Dialup at the same time on client side. follow the configuration on two box, version is 6.0.9. please disregard psk and peerid #HQ VPN Dialup server Config config vpn ipsec phase1-interface edit "Dialup-MGT" set type dynamic set interface "INTERNET-MGT" set mode aggressive set peertype one set mode-cfg enable set proposal 3des-md5 aes128-md5 set dpd disable set nattraversal disable set peerid "c.c.c.c" set assign-ip disable set psksecret fffff next edit "Dialup-EQX" set type dynamic set interface "INTERNET-EQX" set local-gw t.t.t.t set mode aggressive set peertype one set mode-cfg enable set proposal 3d

Hello all, We're using Fortigate 600C and just upgraded FortiOS to v5.6.6 from v5.4. While using v5.4, action=accept in our traffic logs was only referring to non-TCP connections and we were looking for action=close for successfully ended TCP connections. After we upgraded, the action field in our traffic logs started to take action=accept values for TCP connections as well and we're now having difficulties in differentiating the successfully ended TCP connections. We've looked at the forums, found this and also went through FortiOS - Log Reference document for v5.6.6 but got no success in understanding the real difference. FortiOS - Log Reference document for v5.6.6 only states the example field values (i.e. close, server-rst, client-rst) without any explanation, very revealing documentation indeed. What is the real difference between action=accept and action=close in v5.6.6? Any help would be very much appreciated! PS: Two sample segments from our traffic logs for

Hi,I'm trying to forward some traffic (PBR) via different interface (GRE Tunnel). When I have a default route via port1 (with better metric) it doesn't work: Local-FortiGate # get router info routing-table allRouting table for VRF=0Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP       O - OSPF, IA - OSPF inter area       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2       E1 - OSPF external type 1, E2 - OSPF external type 2       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area       * - candidate defaultS* 0.0.0.0/0 [10/0] via 10.200.1.254, port1C 10.0.1.0/24 is directly connected, port3C 10.200.1.0/24 is directly connected, port1C 10.200.2.0/24 is directly connected, port2Local-FortiGate # get router info routing-table databaseRouting table for VRF=0Co

Hi everyone, actually we're running a FMG-VM with FOS6.2.3, and we want to use the new feature of 6.2, "Consolidated Policy". As described in the cookbook https://docs.fortinet.com/document/fortimanager/6.2.0/new-features/49766/consolidated-firewall-mode, I am not able to turn on the display option for the consolidated policies, because it is simply not there:  Any clue why it behaves like that? I tried every combination of enabled and disabled consolidated policy feature on the regarding FGs and in the Policy Package option. It is a 6.2 ADOM.It seems to be just a bug. Any hint would be highly appreciated! BRFlorian 

I am setting up a fortiwifi 60e  V6.0.8 build 0303 and i have a strange problem with network interfaces.I find a single "software switch" that i have never used. This switch software has internal and wifi members.From the internal member i want to remove a port, for example the 7, but i can't.  I am going crazy . Does anyone know how to do? Thank' to all. FROM CLI: ConnectedFWF60 # config system virtual-switch FWF60 (virtual-switch) # show config system virtual-switch edit "internal" set physical-switch "sw0" config port edit "internal1" next edit "internal2" next edit "internal3" next edit "internal4" next edit "internal5" next edit "internal6" next edit "internal7" next end next end

Do I need add two groups in the firewall to be able to use the same LDAP group for both FSSO type of rules, and SSL-VPN rules? Or did I miss something obvious?