Solved

Dear community, I need your help, I created an aggregate interface (Port1 and port2) with multiple VLANs for internal network, there is no ip address on aggregate interface when connected those ports (Port1 and port2) to a cisco switch (Interface g1/0/1 and g1/0/2) the link doesn't come up, so the fortiGate can't communicate with the internal network (Cisco switch) On Cisco switch : - interface g1/0/1 :switchport trunk native vlan 99switchport mode trunkend - interface g1/0/2 :Switchport mode trunkend Interface vlan 99 : 192.168.254.251/29ip route 0.0.0.0 0.0.0.0 192.168.254.254 On fortigate (Aggregate interface) i have multiple VLANs, vlan 1, vlan 100, vlan 110, vlan99 ...etc, - Sub-interface of VLAN 99 : 192.168.254.254/29 Any help please,Thanks

We're configuring our first/new FortiGate device and need to connect in users on the LDAP/RADIUS and SSO pages. There is no local server, AD, or domain controller presence in the organization, as they exclusively use Office 365, so we are trying to configure the FortiGate to connect to Office 365 or Azure for the LDAP/RADIUS and SSO configuration. We've been scouring the documentation/help at Fortinet and at Microsoft but to no avail.  We will face a similar challenge next week with an org that has only G-Suite users and no local servers either.

Would anyone have a mental model to offer for what the SSL VPN feature is doing when it is 'checking rules'?  I'm trying to spin up an SSL VPN service, using the heavy FortiClient, the client sees "Permission denied".  The relevant output of "diagnose debug application sslvpn -1" looks as follows: [...]2020-03-30 09:04:15 [22521:root:2]sslvpn_auth_check_usrgroup:2039 forming user/group list from policy. 2020-03-30 09:04:15 [22521:root:2]sslvpn_auth_check_usrgroup:2145 got user (0) group (1:0). 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1642 validating with SSL VPN authentication rules (1), realm (). 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1690 checking rule 1 cipher. 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1698 checking rule 1 realm. 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1709 checking rule 1 source intf. 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:

Hi we have been running a couple of sites using FortiGate sd-wan in a hub-spoke topology. We randomly get complaints from users about application sessions being kicked out users has to restart the application (web,erp). I see there is often sdwan member changes in the logs such as the attached. My question when the link does meet the success criteria of a specific sla and it is moved out of the sd-wanr rule . what happens to the existing sessions that were running on the link is it going to time out will it be dropped by fortigate. I tested this out some months ago, I noticed an ICMP packet recovered but a rdp session would get stuck if the link failed and even if the other link is ready to take the session.   

Hello everyone, We have a clientless ssl vpn on fortigate 300E.There are few applications that users access which listen on varied ports tcp-42180 & 51050.How do these be configured on ssl portal as bookmark for a user to access. Portal only gives http/s, rdp etc as available options. Please help. Thank you in advance.

I have used the FortiGate for SSL-VPN only.  I would like the fortiGate send only log "User access Fortigate and User login SSL-VPN". to a syslog. What should I do?  DetailsFortiGate 101FFirmware 6.2.3

Hi all I'm trying to configure SSL VPN connection on my new Fortigate 60D (formware 5.2.1) and I want to enable split tunnel SSl VPN is already working (using Forticlient) but users cannot browse internet when connected to the office I select VPN - SSL - Portals - double click on "tunnel-access"; if I check "Enable split tunneling" I need to insert a "routing address" What to I need to insert ? I read some docs (for example : http://docs.fortinet.com/...1/fortigate-sslvpn.pdf but there is no detail about "routing address"...) I have already created the  "static route" with device "ssl.root" and the firewall policy (ssl.root to wan1) but it still does not work so I suppose I need to enable the "split tunneling" Thank you Corrado

Hi We are running a FortiGate 60E using a single WAN-Connection (set of public IPs) and a straight C-Class private LAN. We have some services in our LAN that my colleagues and me are using every day. Basically everything works just nicely. I have set up a dialup VPN Tunnel (IPsec) to provide access from remote networks. This VPN Tunnel is set to have "Enable IPv4 Split Tunnel" checked as normally we would like have internet traffic not to take the VPN route, but to go there directly. This tunnel works great and we are happy with bandwith and performance. Now in addition to that, we need to have a VPN-Tunnel with "IPv4 Split Tunnel" disabled. In some cases we need to have all traffic go through that tunnel and for internet traffic we'd like to have a different public IP address being used than the one generally defined for WAN1. So appart from the "Split Tunnel" feature and a different Client Address Range, there should not be a difference. But the thing is, this second dialup VPN tu

Hi community we have a FortiGate 200D with ~30 SSL VPN Users. We have a problem that we're unable to find the cause of. All connected users are getting disconnected all at once several times during the day. It's not possible for them to work like this. I want to upgrade the firmware of our firewall, to see if the problem can be solved by that. In the known issues of the version 6.0.9 it says that it also has the problem with the random disconnects. I want to avoid those problems and have a stable infrastructure, so I'm tempted to try version 6.0.8. In the known issues section of 6.0.8 there's no mention of RDP Problems. I wanted to ask if those issues are exclusive to 6.0.9 or is version 6.0.8 also affected by them? Thank you.

Hello everyone, how does the fortigate ip pool work for users.We have a object (vpn-pool) defined as 192.168.100.0/24. This is then applied to the Ip policy along with groups.users get IP from 192.68.100.x once connected. Query on this - 1) how does it keep track of what ip's are in use, is there any command to check this?2) why do users get subsequent ip's as ip and gateway (example, 192.168.100.1 as IP & gateway as 100.2 on ipconfig)3) Is it possible to do a static IP reservation on this?4) what is different between this pool and the actual dhcp function within fortigate? Appreciate all inputs. 

Without going into the depths of the setup we have a bunch of virtual Fortigates clustered and only the cluster IP is visible to our monitoring platform - Solarwinds. I'm trying to understand / workout the best way of doing this, and am looking for ideas, or even solutions. I have found this OID: 1.3.6.1.4.1.12356.101.13 but when running it against our tool it gives a result of "2" which is utterly menaingless to me. So, I can monitor / alert on the traps or specific OID's and need some assistance in trying to identify which are the best and helping me understand the output. OIDs I can or should use please?What output do they give (if not obvious)? Alternatively - what SNMP trap(s) can I use? If it makes a difference then all FWs are running OSv6.2

Hi all,I need to manage Fortigate 100 E with FortiOS 5.6.12 and I try to connect using my account and switching between many tab of my browser and multi-screen.But I can't because i'm logged of from de previous tab when I  logon on other tab.Is thre workaround to allow me switching with multitab? Thank you for your help

Hello, I've just created a FortiClient VPN (Client‑to-Gateway IPsec VPN) on a FortiGate unit that already had a site-to-site VPN set up. When I connect to the FortiClient VPN that I created, I can reach LAN resources behind the internal interface but I cannot reach resources behind the site-to-site VPN interface. I created 2 Firewall rules, one allowing trafic from the FortiClient VPN interface to the site-to-site VPN interface and another one from the site-to-site VPN interface to the the site-to-site VPN interface but it still doesn't work. What am I missing? Please check the network diagram with the VPNs and flow of traffic that is working vs not working.

Hi all, My setup(in basics): I have multiple Fortigate SG60, they are different physical locations. I configured a site-to-site IPsec VPN between the Fortigate SG60 in the DC to all sites. Which works fine (as far as I know). Lets call DC site A. Site A:I have a MGMT vlan and within this VLAN multiple VMs reside. It is possible to ping from a VM in site A to site B. In other words, to ping the other side of the VPN tunnel. I also have a dial-up VPN from my laptop to site A. Which works fine. From my laptop it is now possible to enter the MGMT network. Also it is possible to ping site B over the VPN. The routes are advertised.  So far so good. Now the problem, I recently added site C. A new Fortigate on a different physical location. IPsec site-to-site works fine. Also it is possible to ping site C from a VM in the mgmt network in site A. What is not possible: to ping site C from my laptop (that is connected with the dial-up VPN).For some reason the ro

Hello, we have a 200D in HQ and a lot of 60D branches all with IPsec Sito to Site connected in Hub and Spoke. now we issue a 3 - 4 times in a day that the Tunnel do freeze (for example i see it if i am on the RDP Connection and the connection get lost and retries to do the Session and after 3- 4 Times the session is UP again.) The tunnel is always UP and i see no Errors in the Logs. Do someone had similar strange behavior? its pretty annoing..

I'm trying to add a software switch to a zone, but i can't seem to do it. The software switch exists, has an IP, and has two physical interfaces assigned to it. When i go into the Zone config in the GUI though, the software switch doesn't show up. It also doesn't show up in the zone config in the CLI either. I can however add the switch called qtn.root. Are there any caveats to adding a software switch to a zone? Does it matter if i have an underscore in the software switch's name? (Using a FortiWiFi 61E running 6.2.1) TIA

We are having problem on one of our VDOMS regarding the IPSec dial up connections which seems to be only limited to 10 users.How can we increase the number of concurrent connections

Dears,I am syncing time on fortinet 1200D from Internet servers and i want my fortinet to be a NTP server for all windows servers and Cisco network devices, i have a server vlan which is terminated on cisco core switches as DG for the server vlan  and from core it is a trunk connecting to fortigate with aggregate interfaces for other servers going to the internet. how i can achieve the configuration of NTP, I think i dont need to create the policies here if i am not wrong becz traffic is not passing through the firewall it just hitting the inside  interface and coming back, from the same interface. thanks  

I need to create a report in Fortianalyzer which shows the details found in the dataset "vpn-Top-SSL-Web-Users-By-Bandwidth-and-Avail". However I need to have it list all the ssl vpn users, not just the top users. Can you please tell me how to do this? This is the query for the data set:select user_src, remip as remote_ip, from_dtime(min(s_time)) as start_time, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from (select devid, vd, remip, user_src, tunnelid, min(s_time) as s_time, max(e_time) as e_time, (case when min(s_time)=max(e_time) then max(max_traffic_in)+max(max_traffic_out) else max(max_traffic_in)-min(min_traffic_in)+max(max_traffic_out)-min(min_traffic_out) end) as bandwidth, (case when min(s_time)=max(e_time) then max(max_traffic_in) else max(max_traffic_in)-min(min_traffic_in) end) as traffic_in, (case when min(s_time)=max(e_time) then max(max_traffic_out) else max(max_traffic_out)-min(min_traffic_out) end) as traffic_out fr

I'm looking for the full install file for the FortiClient VPN installer v6.2 - the one with no support. I've been to the Firmware Images section of the Support Portal, but in the ForticlientTools there is only an online installer. The online installer DOES NOT connect to the servers to download the image, it times out, so I am unable to install it. I could just install an older version but I'd rather have the latest version. There is nothing wrong with my internet connection.

Just thought I'd post this here for others who have the same issue in future.  According to Fortinet support there is a bug in firmware 5.2.2 that causes the "ALL" service group to be ignored, so any policy rules that use it will be ignored.  It is fixed in 5.2.3, and in the meantime use "ALL_UDP, ALL_TCP & ALL_ICMP" instead of "ALL". We upgraded a 100D on Saturday from 5.0.2 to 5.2.2 (following the correct upgrade process) on Saturday and today noticed some traffic being blocked.  The GUI logs just showed "deny" with a PolicyID of 0 (no such policy ID visible).  From the CLI a debug showed "Denied by forward policy check (policy 0)" for any traffic that used the ALL service group.

We have a business case to use 2 seperate Remote Access VPN configurations on one Fortigate. We have a 50 FortiClient license for our corporate laptops with full access to the network services. With the current COVID 19 situation we are  looking into allowing users using their home computer with the free FortiClient VPN to only access RDP services for remote desktop. I have tried to create a second Remote Access VPN (Different Shared secret and source IP range) on the same untrust interface, but that one got precedence over the other and people couldn't use the original VPN anymore. Is want I want even possible?  Thanks

With a lot of remote workers as of today we have a situation with a couple apps (VoIP and screenshare) that require direct client to client communications.  But that seems to be blocked with any of the documented standard configurations. VPN client to our internal and several remote networks function just fine, but one VPN client cannot talk to another.  Makes sense security-wise (like similar restriction on our wireless network) but with current WfH situation not practical. Not even sure I could create ssl.root interface to ssl.root policy as that would seem both unnecessary and incestuous somehow but I'm at a loss of how else I might allow this.  Documentation, cookbooks and forum searches have come up empty.  Can anyone help or definitely say no way?

Hi. It is the first time I have setup a FortiGate 100F Cluster (FortiOS 6.2.3). I followed the tutorials for "HA" and selected "active-passive" for the FortiGate. I have setup the "ha1, ha2" interfaces an connected them. Then I have selected the "wan1" interface for monitoring. Basically the HA-Settings are working - I have got the master and the slave unit. If "wan1" loosing the connection (pulling cable out / or restart of master) it switches to slave which becomes new primary. But if "wan1" of old primary is restored I will get no connection from outside - only if I'm pulling out "wan1" cable of slave. F1 = master -> monitoring "wan1" F2 = slave -> monitoring "wan1" F1 > wan1 is lost > F2 = primary, F1 = slave ... all connections are now running correctly over F2. Then F1 > wan1 is restored > F1 = primary, F2 = slave ... I can only connect to F1 via MGMT (MGMT of F2 is not responding).. but I'm not able to ping the public IP of wan1, and I'm also not abl

Firmware version is v5.2.1,build618I have a user which is matched on a LDAP server. The user also has a FortiToken assigned, but I don't think that's relevant.The user is a member of a firewall local group. This group is added to the SSL policy (under Source Address, Source User(s)). When I try to log in the user through the FortiClient, I receive "Permission denied. (-455)".The Fortigate logs: sslvpn_login_unknown_user. I tried to set the users password to local as well, that did not work either.However, if I add the user directly to the policy, I can log in.  It seems that the policy does not process groups, only users. Is this correct? Then what do we need groups for?