Solved

The other day our LAN to WAN webfiltering started blocking about 80% of sites. The last change to the firewall had happened about 16 hours earlier, but nothing that should have blocked banking sites or duckduckgo. I had to turn off webfiltering until I could reboot the firewall. Since I rebooted (with the same webfiltering active again), I've had no problems. This is a 100D running 6.0.9 on voltage regulating UPSs. Just curious if this had happened to anyone else.  Dave

https://docs.fortinet.com/document/fortigate/6.0.9/fortios-release-notes/760203/introduction The known issues are the shortest list I remember

Basically, I am trying to do this but instead of IPSec tunnels or internal clients, it's only for our SSLVPN users: https://yatznet.com/2018/08/21/using-fortigate-as-a-local-dns-server/ In short, it works great on the LAN, but if I try to use FortiGate for DNS when connected via SSLVPN, all I get are DNS request time out errors. I do have a test policy in place that allows all ssl.root traffic to any destination within the LAN, and I can even ping the IP of the FortiGate when connected via SSLVPN, so traffic is flowing. I've done a debug and it didn't come up with anything useful, at least to me. Here is an example of an internal client using the DNS on the fortigate successfully, and the second one is our SSLVPN client timing out. It looks the same except for the flag, but I couldn't find out what that means. id=20085 trace_id=18 func=print_pkt_detail line=5517 msg="vd-root:0 received a packet(proto=17, OURLANCLIENT:59609->OURFIREWALLIP:53) from LAN. " id=20085 trace

I am trying to get tacacs authentication to work for user ronald (to start with) on our Fortigate 600D firewall.Tacacs server is a Centos 7 linux machine running tac_plus. Firewall config:config global config system admin edit "ronald" set remote-auth enable set accprofile "super_admin" set vdom "OOB" set remote-group "fwadmins" set password ENC SH2NlBggP0nKPW8lt6sfJaohuRG4BpAyUSjXp8jp6Fb/+RIZX5LtM5yMm2/S84= next edit "ronald" set remote-auth enable set accprofile "super_admin" set vdom "OOB" set remote-group "fwadmins" set password ENC SH2NlBggP0nKPW8lt6sfJaohuRG4BpAyUSjXp8jp6Fb/+RIZX5LtM5yMm2/S84= endconfig vdom edit OOB config user tacacs+ edit "tacserver" set server "10.11.1.11" set key ENC rRpp8EzKAhzRCOb0OaiS+voJjnRaN7g86rhrkLG3H4t6EF6QOrMPDTmR1Sx9yEYen1ScT6xpMBIlfjggc9IYcz2VlS42rFxaPeIA4cuWuvSxm/ HMJN2cA6b1+ZfBRYI+w74d6+wtKiVIKFwHpFCfxBTwtsbigNBtkLw55zqd2dKLWmg3FjWD0UbrQ+0/E/Hg== set authorization enable set source-ip 10.10.1.1 next endconfig vdom edit O

Hi Guys,I'm trying to switch my national ipsec vpn site-to-site network from static routing to ospf. Each branch's got around 6 subnets from which only 4 should be routed via the ipsec tunnel. Using static routing it's easy since I add only what exactly I need.My VPN network it's using a star topology and it might change to an extended star.I've started with 2 branches, the HQ and a branch.Everything works fine except that I'm not able to filter what routes are been advertised via OSPF since I'm using "config redistribute "connected""Attached is a lab I did to test it, but still no luck. The routers in the diagram I've attached are FG-70D's.I've tried:- prefix-list with in and out on both sides - no luck- access list with in and out on both sides - no luck I'm missing something here, right ?!?!Hope the diagram will give you a clear idea of what I wan to achieve. Cheers,Tony

Hello,On my Branch office I need stablish two active Dialup VPN with my HQ.On my HQ I have two ISPs Internet links and at the my BR only one.At the Fortigate on BR I have set Two Dialup client to ISP1 and ISP2 for HQ.My problem is never two tunnels is UP at the same time, when one come up other to Down.I wonder if is possible to keep active the two tunnels Dialup at the same time on client side. follow the configuration on two box, version is 6.0.9. please disregard psk and peerid #HQ VPN Dialup server Config config vpn ipsec phase1-interface edit "Dialup-MGT" set type dynamic set interface "INTERNET-MGT" set mode aggressive set peertype one set mode-cfg enable set proposal 3des-md5 aes128-md5 set dpd disable set nattraversal disable set peerid "c.c.c.c" set assign-ip disable set psksecret fffff next edit "Dialup-EQX" set type dynamic set interface "INTERNET-EQX" set local-gw t.t.t.t set mode aggressive set peertype one set mode-cfg enable set proposal 3d

Hello all, We're using Fortigate 600C and just upgraded FortiOS to v5.6.6 from v5.4. While using v5.4, action=accept in our traffic logs was only referring to non-TCP connections and we were looking for action=close for successfully ended TCP connections. After we upgraded, the action field in our traffic logs started to take action=accept values for TCP connections as well and we're now having difficulties in differentiating the successfully ended TCP connections. We've looked at the forums, found this and also went through FortiOS - Log Reference document for v5.6.6 but got no success in understanding the real difference. FortiOS - Log Reference document for v5.6.6 only states the example field values (i.e. close, server-rst, client-rst) without any explanation, very revealing documentation indeed. What is the real difference between action=accept and action=close in v5.6.6? Any help would be very much appreciated! PS: Two sample segments from our traffic logs for

Hi,I'm trying to forward some traffic (PBR) via different interface (GRE Tunnel). When I have a default route via port1 (with better metric) it doesn't work: Local-FortiGate # get router info routing-table allRouting table for VRF=0Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP       O - OSPF, IA - OSPF inter area       N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2       E1 - OSPF external type 1, E2 - OSPF external type 2       i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area       * - candidate defaultS* 0.0.0.0/0 [10/0] via 10.200.1.254, port1C 10.0.1.0/24 is directly connected, port3C 10.200.1.0/24 is directly connected, port1C 10.200.2.0/24 is directly connected, port2Local-FortiGate # get router info routing-table databaseRouting table for VRF=0Co

Hi everyone, actually we're running a FMG-VM with FOS6.2.3, and we want to use the new feature of 6.2, "Consolidated Policy". As described in the cookbook https://docs.fortinet.com/document/fortimanager/6.2.0/new-features/49766/consolidated-firewall-mode, I am not able to turn on the display option for the consolidated policies, because it is simply not there:  Any clue why it behaves like that? I tried every combination of enabled and disabled consolidated policy feature on the regarding FGs and in the Policy Package option. It is a 6.2 ADOM.It seems to be just a bug. Any hint would be highly appreciated! BRFlorian 

I am setting up a fortiwifi 60e  V6.0.8 build 0303 and i have a strange problem with network interfaces.I find a single "software switch" that i have never used. This switch software has internal and wifi members.From the internal member i want to remove a port, for example the 7, but i can't.  I am going crazy . Does anyone know how to do? Thank' to all. FROM CLI: ConnectedFWF60 # config system virtual-switch FWF60 (virtual-switch) # show config system virtual-switch edit "internal" set physical-switch "sw0" config port edit "internal1" next edit "internal2" next edit "internal3" next edit "internal4" next edit "internal5" next edit "internal6" next edit "internal7" next end next end

Do I need add two groups in the firewall to be able to use the same LDAP group for both FSSO type of rules, and SSL-VPN rules? Or did I miss something obvious?

I'm interested in obtaining a used Fortigate FW appliance like a 40C to learn. Not sure how the licensing works. Can I just buy a used one without support and it will work or do you need a license key to get basic functionality?  

Hello,I need to add 800 static routes on my box FGT100F version 6.0.3 but the default value for router.static is 500 it´s possible chage this default value ? if yes, how to.

Hi Guys, I am Ernest and new to Fortigate. I have two LANs in my network ( 192.168.0.0/16  and 172.20.0.0/16)    There is routing defined in the core between these two LANs which allows access to services and applications on either side . My Fortigate Firewall however is directly connected to an interface on the 192.168.0.0 network . I have configured on the FG Firewall  ssl vpn access to the network , my problem however is that I am unable to reach the 172.20.0.0 network over the SSL VPN Connection. I would really appreciate your input as to how to resolve this. Thanks.

Just wondering if someone can answer this definitively. Can I "share" an address range between an ssl vpn and an ipsec vpn? The current setup is an SSL VPN, Source IP Pool x.y.z.1-254 and using the "Automatically assign addresses" option so that the entire 1-254 range is used for clients connecting.  Rarely more than a few dozen simultaneous clients so the size of the range is irrelevant.The plan is to:[ol]Specify a custom IP range for the SSL VPN x.y.z.1-127.Then create IPSEC VPN and client address range of IP x.y.z.128-254.[/ol]The reason for this is that extensive internal layer 2 ACLs, manual routes, and server firewall rules all have the x.y.z.0/24 segment already defined. Trying to use a different range for the LT2P IPSEC clients would mean extensive updates to many switch stacks and dozens of server's local FW settings. The Powers That Be are concerned that "sharing" that range would cause problems with one or the other.   

I'm moving FortiManger (and Analzyer) from hyper-v to KVM. Is it as simple as spinning up the new appliance and restoring the config or are there steps to do after that?  I've setup the new appliance and restored the config but I don't see any of my policies/objects/scripts. Is there a separate step for this? All I can find for documentation is this: https://help.fortinet.com/fmgr/50hlp/56/5-6-2/FMG-FAZ/2400_System_Settings/0200_Dashboard/0430_Migrating%20the%20Configuration.htm Thanks

Hello all, I am new to the forum as well as new to Fortigate.  I am looking at switching over from another firewall vendor and there is no converter for them.  I need to add about 140 static routes and I am not looking forward to manually entering all of them. I wanted to know if anyone has a batch file or script that will parse a text file and output it to a file and I can paste into the CLi.  Any help would be greatly appreciated! Thank you in advance!!

Is there any reason that anyone knows why VIPG's are not nestable? Address Groups are nestable. I can create an Address, add it to an address group, and have that address group a member of a master address group that is set up on an outbound policy.I want to do the same on an inbound policy with a VIP Group.  My use case is relatively simple - we run a multi tenant environment of somewhat standardised services, and I always prefer the other admins to edit group membership not policies.  That way, it's less likely that a wayward change is made to a policy, and typically the most impact of an accidental action is to open additional ports up to servers that aren't listening to those ports anyway.... our structure would be Tenant-VIP is a member of tenant-vipgrp which is a member of service-vipgrp, and service-vipgrp is used on the policy.  A new tenant using a service just requires adding their tenant-vipgrp to the service-vipgrp.  That's safer in my view tha

Hello I would like to create a policy that consists of the white list URLs and a rule that block all other URLs. So I started with creating a WEB filter and added only one rule that block everything. Then I added the filter into the policy. Unfortunately this filter blocks only insecured web sites (http) but not secured (https). Could you please help? Thanks 

Hi all, I have a lot of users always searching and working on network files. With Real-Time Protection active, the users are always complaining, saying that the file search and opening are to slow.They have maped a network drive (X:\).I don't want to disable Real-Time protection on their profiles.What should I do to make the their searchs faster? Should I enable exclusions and enter "X:\GT" on "Paths to exclude folders" or "Path to Exclude Files" .Can anyone help me? Samuel

Hi. I have a FortiGate 100F which I have configured for SSL-VPN in "Tunnel-Mode" (also configured a policy) > which is working. Now I would like to set up "Split Tunneling" > I have enabled it and set up the routing addresses. Now the issue is, that I can only connect to the "MGMT-IP-Address" if I set the outgoing-interface to "any". I have attached a screenshot of the VPN policy. If it is configured like in the screenshot, then I'm able to connect to the "MGMT-IP-Address" for remote managment over VPN. "Security Fabric" marks this as "failed".  But I can't select "MGMT" as interface in the policy rules, it is not appearing in the list of interfaces. If add all available interfaces (execpt "any") to the "outgoing interface" then I'm not able to connect to the "MGMT-IP-Address" with VPN. For the MGMT-IP-Address I have created a "firewall address", which I have added to the "routing addresses": config firewall address     edit "VPN-MGMT"   

Hi All, As i start upgrading Fortigates, i'll be in an interim configuration where some of the firewalls are on 5.6, but the ADOM is still  on 5.4. What limitations are there in this configuration? Is it still possible to provision new VDOMs on a 5.6 firewall?Can I still pull migrated policy from a newly created VDOM on a 5.6 firewall? Thanks

SW INFO: -Fortigate VM Eval 6.2.3 I just tried both method of FSSO which is Local and  "Collector and Agent".Since both can do-point to multiple AD-filter to certain groups only QUESTIONS: 1. what  "Collector and Agent" can do which Local FSSO can't do2. in what situation Local is enough because Local doesn't have to install any softwaretq

Hello, I´m doing a migration from an box 600C to 100F but I don´t have save any PSK on my IPsec tunnels.I wonder if there is any way I get theses PSK or copy and paste the Encode PSK from 5.2 version to 6.0.I did a test copy and paste PSK encode but didn´t work.any tipe is welcome.thanks   

Hello, Im new to fortigate and trying to get the gist of it all. Especially the reports needed by my organization and the default ones are not what we are looking for. Tried to custom make a report to suit our tastes but the data it shows isnt exactly whayt i hoped it would be. Currently running Fortigate 60E v5.6.5. Mainlt want the top 5 users who have the most internet usage along with the sites they frequently visit, sessions etc. If anhone can provide assistance please.    Thanks :)