Solved

Hello,I need to add 800 static routes on my box FGT100F version 6.0.3 but the default value for router.static is 500 it´s possible chage this default value ? if yes, how to.

Hi Guys, I am Ernest and new to Fortigate. I have two LANs in my network ( 192.168.0.0/16  and 172.20.0.0/16)    There is routing defined in the core between these two LANs which allows access to services and applications on either side . My Fortigate Firewall however is directly connected to an interface on the 192.168.0.0 network . I have configured on the FG Firewall  ssl vpn access to the network , my problem however is that I am unable to reach the 172.20.0.0 network over the SSL VPN Connection. I would really appreciate your input as to how to resolve this. Thanks.

Just wondering if someone can answer this definitively. Can I "share" an address range between an ssl vpn and an ipsec vpn? The current setup is an SSL VPN, Source IP Pool x.y.z.1-254 and using the "Automatically assign addresses" option so that the entire 1-254 range is used for clients connecting.  Rarely more than a few dozen simultaneous clients so the size of the range is irrelevant.The plan is to:[ol]Specify a custom IP range for the SSL VPN x.y.z.1-127.Then create IPSEC VPN and client address range of IP x.y.z.128-254.[/ol]The reason for this is that extensive internal layer 2 ACLs, manual routes, and server firewall rules all have the x.y.z.0/24 segment already defined. Trying to use a different range for the LT2P IPSEC clients would mean extensive updates to many switch stacks and dozens of server's local FW settings. The Powers That Be are concerned that "sharing" that range would cause problems with one or the other.   

I'm moving FortiManger (and Analzyer) from hyper-v to KVM. Is it as simple as spinning up the new appliance and restoring the config or are there steps to do after that?  I've setup the new appliance and restored the config but I don't see any of my policies/objects/scripts. Is there a separate step for this? All I can find for documentation is this: https://help.fortinet.com/fmgr/50hlp/56/5-6-2/FMG-FAZ/2400_System_Settings/0200_Dashboard/0430_Migrating%20the%20Configuration.htm Thanks

Hello all, I am new to the forum as well as new to Fortigate.  I am looking at switching over from another firewall vendor and there is no converter for them.  I need to add about 140 static routes and I am not looking forward to manually entering all of them. I wanted to know if anyone has a batch file or script that will parse a text file and output it to a file and I can paste into the CLi.  Any help would be greatly appreciated! Thank you in advance!!

Is there any reason that anyone knows why VIPG's are not nestable? Address Groups are nestable. I can create an Address, add it to an address group, and have that address group a member of a master address group that is set up on an outbound policy.I want to do the same on an inbound policy with a VIP Group.  My use case is relatively simple - we run a multi tenant environment of somewhat standardised services, and I always prefer the other admins to edit group membership not policies.  That way, it's less likely that a wayward change is made to a policy, and typically the most impact of an accidental action is to open additional ports up to servers that aren't listening to those ports anyway.... our structure would be Tenant-VIP is a member of tenant-vipgrp which is a member of service-vipgrp, and service-vipgrp is used on the policy.  A new tenant using a service just requires adding their tenant-vipgrp to the service-vipgrp.  That's safer in my view tha

Hello I would like to create a policy that consists of the white list URLs and a rule that block all other URLs. So I started with creating a WEB filter and added only one rule that block everything. Then I added the filter into the policy. Unfortunately this filter blocks only insecured web sites (http) but not secured (https). Could you please help? Thanks 

Hi all, I have a lot of users always searching and working on network files. With Real-Time Protection active, the users are always complaining, saying that the file search and opening are to slow.They have maped a network drive (X:\).I don't want to disable Real-Time protection on their profiles.What should I do to make the their searchs faster? Should I enable exclusions and enter "X:\GT" on "Paths to exclude folders" or "Path to Exclude Files" .Can anyone help me? Samuel

Hi. I have a FortiGate 100F which I have configured for SSL-VPN in "Tunnel-Mode" (also configured a policy) > which is working. Now I would like to set up "Split Tunneling" > I have enabled it and set up the routing addresses. Now the issue is, that I can only connect to the "MGMT-IP-Address" if I set the outgoing-interface to "any". I have attached a screenshot of the VPN policy. If it is configured like in the screenshot, then I'm able to connect to the "MGMT-IP-Address" for remote managment over VPN. "Security Fabric" marks this as "failed".  But I can't select "MGMT" as interface in the policy rules, it is not appearing in the list of interfaces. If add all available interfaces (execpt "any") to the "outgoing interface" then I'm not able to connect to the "MGMT-IP-Address" with VPN. For the MGMT-IP-Address I have created a "firewall address", which I have added to the "routing addresses": config firewall address     edit "VPN-MGMT"   

Hi All, As i start upgrading Fortigates, i'll be in an interim configuration where some of the firewalls are on 5.6, but the ADOM is still  on 5.4. What limitations are there in this configuration? Is it still possible to provision new VDOMs on a 5.6 firewall?Can I still pull migrated policy from a newly created VDOM on a 5.6 firewall? Thanks

SW INFO: -Fortigate VM Eval 6.2.3 I just tried both method of FSSO which is Local and  "Collector and Agent".Since both can do-point to multiple AD-filter to certain groups only QUESTIONS: 1. what  "Collector and Agent" can do which Local FSSO can't do2. in what situation Local is enough because Local doesn't have to install any softwaretq

Hello, I´m doing a migration from an box 600C to 100F but I don´t have save any PSK on my IPsec tunnels.I wonder if there is any way I get theses PSK or copy and paste the Encode PSK from 5.2 version to 6.0.I did a test copy and paste PSK encode but didn´t work.any tipe is welcome.thanks   

Hello, Im new to fortigate and trying to get the gist of it all. Especially the reports needed by my organization and the default ones are not what we are looking for. Tried to custom make a report to suit our tastes but the data it shows isnt exactly whayt i hoped it would be. Currently running Fortigate 60E v5.6.5. Mainlt want the top 5 users who have the most internet usage along with the sites they frequently visit, sessions etc. If anhone can provide assistance please.    Thanks :)

Hi everyone, I think I need some help. I will try to explain what I'm trying to achieve. We have a headquarter and three small locations. In our headquarter we have a big FG1500 and on the three small locations we have FGT30E 3G/4G. The locations are connected through eternity circuit and and running OSPF between. On the small locations I configured dial up IPsec through LTE to our main Fortigate with OSPF.Everything is working fine on sub locations while connected to the ethernet circuit. I learn routes through OSPF as expected and can reach everything.... The default route is learnd from the headquarter Fortigate and that's fine.... When I disconnect the ethernet circuit the IPSec kicks in and the routes are learnd through the IPSec interface except the default route... Instead of learning my default route form the main Fortigate the default route from the LTE is injected in to the routing table with a distance of 10 I tried to change the distance under

We have two sites, site A and Site B. Both sites sites have a Fortigate firewall. Fortigate devices ARE NOT configured for high availability, nor will they be. Both sites have an internet connection provided by the same ISP: Site AFortinet Firewall Public IP: A.A.A.13/30ISP Gateway Public IP: A.A.A.14/30 Site B Fortinet Firewall Public IP: B.B.B.16/30 ISP Gateway Public IP: B.B.B.17/30 We have a two BGP published IP address range that have been provided by our ISP: BGP Advertised Public IP Range Q: Q.Q.Q.Q/27 BGP Advertised Public IP Range R: R.R.R.R/27 Local AS: 4294836658 Remote (ISP) AS: 7545 Local and Remote ASN is the same for both sites (single ISP only). Under normal conditions, we need to all traffic going to Q.Q.Q.Q/27 to be directed to site A. However, if site A is down, we need all traffic going to Q.Q.Q.Q/27 to be directed to site B. Likewise under normal conditions, we need to all traffic going to R.R.R.R/27 to be directed to site B. However,

Hello everyone, Can anyone explain to me why I have this error message and what kind of SFP+ adapter I should use??????  Best regards,Omar A

HI Everyone,  I have a pair of 80E running in HA cluster with Dual ISP and SD-WAN enabled on 6.2.3 for the last 3 weeks.  Since I have enabled HA ,  my WAN1 interface keeps going down and up every couple of minutes. ( it gets DOWN on SD WAN Performance SLA due to packet loss). I have troubleshoot it and it appears that it's not receiving back packets from ISP gateway (not receiving reply on the ARP request for gateway MAC address - L2 issue. I opened and incident at my ISP and after troubleshooting they said the issue is with Fortigate which is using same virtual MAC for all firewalls clusters. Most probably there is another cluster in the same subnet on my WAN ( which is part of a /24) Indeed, if you look at the Virtual MAC formula here : https://kb.fortinet.com/kb/documentLink.do?popup=true&externalID=11772&languageId= , unless you change group ID, enable VDOM or virtual cluster will be : 00-09-0f-09-00-00 .  Vi

Hi everyone, I have a Fortigate 80E running on 6.2.3 . I have configured SSL VPN for remote users access, installed signed certificate and tested  - running ok . Tunnel mode & web mode both OK. Then I configured 2 Portals : 1st  is for Admins (tunnel and web) - there is a  IPv4 policy in place which grants them access to all the subnets and another one for Internet Access. User accounts are created locally on the firewall. 2nd is for Corprorate users access  which are authenticating against a RADIUS server. There is a dedicated IPv4 policy in place which grants them access to required internal resources and another one for Internet access.   Issue: ALL users are authenticated against 1st portal from the list - RA management portal and IP addresses are assigned from RA for Admins Pool. ( both scenarios  tested - Forticlient or Web based VPN). Any ideea how can I have dedicated portals for each group ?  Kind regards, Adi

Hi Guys, Have noticed that the GUI DLP configuration page is missing from 6.2.2.  I can, of course use the CLI, however, I'm lazy and prefer point and click.  Does anyone know if it's buried deep in the system somewhere? Thanks

Hi; Can a different RADIUS Service client be defined uniquely by its hostname? Even if the IP address is the same? For example a.abc.com   defines radius service client1 which requests a single factor password authentication onlyb.abc.com defines radius service client2 which requests a two factor authentication However, both a.abc.com and b.abc.com share the same IP address?  KindlyWasfi

I have been fighting this for so long, I dont know what to do. I have several sites running FGT and FAPs. Yesterday I made the desition to TFTP new firmware on all the FAPs and FGTs to see if a clean start can fix the problem. The thing is. The setup can work fine, and then all the sudden the speed is terrible. I go inside the FGT and check  SNR and stuff like that and everything looks great, but it is not. Once this client had this problem and I tried to change a setting in the AP profile, and after that, poof  everything was fine again.  Another client reboots the FAP when it is to slow and all the sudden everything is fine again. So it does seem to be something with the APs. But a user should have to do that. Has anyone heard of these kind of problems. I have had so many clients having problems with the FAPs, I am att crossroad where I am seriously thinking about exchanging those and never look back. But that would be very expensive. I spoke to som

I spent some times on fortianalyzer NOC view. Then i noticed some internal users have a lot of blocked udp outgoing connections. So far nothing looks suspicious on workstations. Whatsoever, i'd really like to understand what is going on.So if you have any ideas.ty Sample

I ask this question to Indonesia Forti employee this morningLet say I have Fortigate HA with same model.Later next year my model already EOL.If one of Fortigate died and need to be replaced with newer model.He said that must use same model QUESTIONS: 1. anyone tried replacing with newer and better model. maybe not exactly the same model but similar model. number of ports are the same but maybe faster CPU and bigger RAM tq

I will be reading this later https://docs.fortinet.com/document/fortigate/6.2.3/fortios-release-notes/760203/introduction-and-supported-models  

Hi ALL, I need some recommendations , I have to create a network infrastructure setup for a company with 150 users. Now i have Fortigate 300e with 20 cisco catalyst 2960L switches and WLC cisco 3500 series with cisco 2801 series access points.  Would this be a good Idea to use these devices? are they compatible with each other ? any issues reported ? any recommendations before going to setup this infrastructure would be a great help.  thanksUsman Ali