Solved

Hi all I'm trying to configure SSL VPN connection on my new Fortigate 60D (formware 5.2.1) and I want to enable split tunnel SSl VPN is already working (using Forticlient) but users cannot browse internet when connected to the office I select VPN - SSL - Portals - double click on "tunnel-access"; if I check "Enable split tunneling" I need to insert a "routing address" What to I need to insert ? I read some docs (for example : http://docs.fortinet.com/...1/fortigate-sslvpn.pdf but there is no detail about "routing address"...) I have already created the  "static route" with device "ssl.root" and the firewall policy (ssl.root to wan1) but it still does not work so I suppose I need to enable the "split tunneling" Thank you Corrado

Hi We are running a FortiGate 60E using a single WAN-Connection (set of public IPs) and a straight C-Class private LAN. We have some services in our LAN that my colleagues and me are using every day. Basically everything works just nicely. I have set up a dialup VPN Tunnel (IPsec) to provide access from remote networks. This VPN Tunnel is set to have "Enable IPv4 Split Tunnel" checked as normally we would like have internet traffic not to take the VPN route, but to go there directly. This tunnel works great and we are happy with bandwith and performance. Now in addition to that, we need to have a VPN-Tunnel with "IPv4 Split Tunnel" disabled. In some cases we need to have all traffic go through that tunnel and for internet traffic we'd like to have a different public IP address being used than the one generally defined for WAN1. So appart from the "Split Tunnel" feature and a different Client Address Range, there should not be a difference. But the thing is, this second dialup VPN tu

Hi community we have a FortiGate 200D with ~30 SSL VPN Users. We have a problem that we're unable to find the cause of. All connected users are getting disconnected all at once several times during the day. It's not possible for them to work like this. I want to upgrade the firmware of our firewall, to see if the problem can be solved by that. In the known issues of the version 6.0.9 it says that it also has the problem with the random disconnects. I want to avoid those problems and have a stable infrastructure, so I'm tempted to try version 6.0.8. In the known issues section of 6.0.8 there's no mention of RDP Problems. I wanted to ask if those issues are exclusive to 6.0.9 or is version 6.0.8 also affected by them? Thank you.

Hello everyone, how does the fortigate ip pool work for users.We have a object (vpn-pool) defined as 192.168.100.0/24. This is then applied to the Ip policy along with groups.users get IP from 192.68.100.x once connected. Query on this - 1) how does it keep track of what ip's are in use, is there any command to check this?2) why do users get subsequent ip's as ip and gateway (example, 192.168.100.1 as IP & gateway as 100.2 on ipconfig)3) Is it possible to do a static IP reservation on this?4) what is different between this pool and the actual dhcp function within fortigate? Appreciate all inputs. 

Without going into the depths of the setup we have a bunch of virtual Fortigates clustered and only the cluster IP is visible to our monitoring platform - Solarwinds. I'm trying to understand / workout the best way of doing this, and am looking for ideas, or even solutions. I have found this OID: 1.3.6.1.4.1.12356.101.13 but when running it against our tool it gives a result of "2" which is utterly menaingless to me. So, I can monitor / alert on the traps or specific OID's and need some assistance in trying to identify which are the best and helping me understand the output. OIDs I can or should use please?What output do they give (if not obvious)? Alternatively - what SNMP trap(s) can I use? If it makes a difference then all FWs are running OSv6.2

Hi all,I need to manage Fortigate 100 E with FortiOS 5.6.12 and I try to connect using my account and switching between many tab of my browser and multi-screen.But I can't because i'm logged of from de previous tab when I  logon on other tab.Is thre workaround to allow me switching with multitab? Thank you for your help

Hello, I've just created a FortiClient VPN (Client‑to-Gateway IPsec VPN) on a FortiGate unit that already had a site-to-site VPN set up. When I connect to the FortiClient VPN that I created, I can reach LAN resources behind the internal interface but I cannot reach resources behind the site-to-site VPN interface. I created 2 Firewall rules, one allowing trafic from the FortiClient VPN interface to the site-to-site VPN interface and another one from the site-to-site VPN interface to the the site-to-site VPN interface but it still doesn't work. What am I missing? Please check the network diagram with the VPNs and flow of traffic that is working vs not working.

Hi all, My setup(in basics): I have multiple Fortigate SG60, they are different physical locations. I configured a site-to-site IPsec VPN between the Fortigate SG60 in the DC to all sites. Which works fine (as far as I know). Lets call DC site A. Site A:I have a MGMT vlan and within this VLAN multiple VMs reside. It is possible to ping from a VM in site A to site B. In other words, to ping the other side of the VPN tunnel. I also have a dial-up VPN from my laptop to site A. Which works fine. From my laptop it is now possible to enter the MGMT network. Also it is possible to ping site B over the VPN. The routes are advertised.  So far so good. Now the problem, I recently added site C. A new Fortigate on a different physical location. IPsec site-to-site works fine. Also it is possible to ping site C from a VM in the mgmt network in site A. What is not possible: to ping site C from my laptop (that is connected with the dial-up VPN).For some reason the ro

Hello, we have a 200D in HQ and a lot of 60D branches all with IPsec Sito to Site connected in Hub and Spoke. now we issue a 3 - 4 times in a day that the Tunnel do freeze (for example i see it if i am on the RDP Connection and the connection get lost and retries to do the Session and after 3- 4 Times the session is UP again.) The tunnel is always UP and i see no Errors in the Logs. Do someone had similar strange behavior? its pretty annoing..

I'm trying to add a software switch to a zone, but i can't seem to do it. The software switch exists, has an IP, and has two physical interfaces assigned to it. When i go into the Zone config in the GUI though, the software switch doesn't show up. It also doesn't show up in the zone config in the CLI either. I can however add the switch called qtn.root. Are there any caveats to adding a software switch to a zone? Does it matter if i have an underscore in the software switch's name? (Using a FortiWiFi 61E running 6.2.1) TIA

We are having problem on one of our VDOMS regarding the IPSec dial up connections which seems to be only limited to 10 users.How can we increase the number of concurrent connections

Dears,I am syncing time on fortinet 1200D from Internet servers and i want my fortinet to be a NTP server for all windows servers and Cisco network devices, i have a server vlan which is terminated on cisco core switches as DG for the server vlan  and from core it is a trunk connecting to fortigate with aggregate interfaces for other servers going to the internet. how i can achieve the configuration of NTP, I think i dont need to create the policies here if i am not wrong becz traffic is not passing through the firewall it just hitting the inside  interface and coming back, from the same interface. thanks  

I need to create a report in Fortianalyzer which shows the details found in the dataset "vpn-Top-SSL-Web-Users-By-Bandwidth-and-Avail". However I need to have it list all the ssl vpn users, not just the top users. Can you please tell me how to do this? This is the query for the data set:select user_src, remip as remote_ip, from_dtime(min(s_time)) as start_time, sum(bandwidth) as bandwidth, sum(traffic_in) as traffic_in, sum(traffic_out) as traffic_out from (select devid, vd, remip, user_src, tunnelid, min(s_time) as s_time, max(e_time) as e_time, (case when min(s_time)=max(e_time) then max(max_traffic_in)+max(max_traffic_out) else max(max_traffic_in)-min(min_traffic_in)+max(max_traffic_out)-min(min_traffic_out) end) as bandwidth, (case when min(s_time)=max(e_time) then max(max_traffic_in) else max(max_traffic_in)-min(min_traffic_in) end) as traffic_in, (case when min(s_time)=max(e_time) then max(max_traffic_out) else max(max_traffic_out)-min(min_traffic_out) end) as traffic_out fr

I'm looking for the full install file for the FortiClient VPN installer v6.2 - the one with no support. I've been to the Firmware Images section of the Support Portal, but in the ForticlientTools there is only an online installer. The online installer DOES NOT connect to the servers to download the image, it times out, so I am unable to install it. I could just install an older version but I'd rather have the latest version. There is nothing wrong with my internet connection.

Just thought I'd post this here for others who have the same issue in future.  According to Fortinet support there is a bug in firmware 5.2.2 that causes the "ALL" service group to be ignored, so any policy rules that use it will be ignored.  It is fixed in 5.2.3, and in the meantime use "ALL_UDP, ALL_TCP & ALL_ICMP" instead of "ALL". We upgraded a 100D on Saturday from 5.0.2 to 5.2.2 (following the correct upgrade process) on Saturday and today noticed some traffic being blocked.  The GUI logs just showed "deny" with a PolicyID of 0 (no such policy ID visible).  From the CLI a debug showed "Denied by forward policy check (policy 0)" for any traffic that used the ALL service group.

We have a business case to use 2 seperate Remote Access VPN configurations on one Fortigate. We have a 50 FortiClient license for our corporate laptops with full access to the network services. With the current COVID 19 situation we are  looking into allowing users using their home computer with the free FortiClient VPN to only access RDP services for remote desktop. I have tried to create a second Remote Access VPN (Different Shared secret and source IP range) on the same untrust interface, but that one got precedence over the other and people couldn't use the original VPN anymore. Is want I want even possible?  Thanks

With a lot of remote workers as of today we have a situation with a couple apps (VoIP and screenshare) that require direct client to client communications.  But that seems to be blocked with any of the documented standard configurations. VPN client to our internal and several remote networks function just fine, but one VPN client cannot talk to another.  Makes sense security-wise (like similar restriction on our wireless network) but with current WfH situation not practical. Not even sure I could create ssl.root interface to ssl.root policy as that would seem both unnecessary and incestuous somehow but I'm at a loss of how else I might allow this.  Documentation, cookbooks and forum searches have come up empty.  Can anyone help or definitely say no way?

Hi. It is the first time I have setup a FortiGate 100F Cluster (FortiOS 6.2.3). I followed the tutorials for "HA" and selected "active-passive" for the FortiGate. I have setup the "ha1, ha2" interfaces an connected them. Then I have selected the "wan1" interface for monitoring. Basically the HA-Settings are working - I have got the master and the slave unit. If "wan1" loosing the connection (pulling cable out / or restart of master) it switches to slave which becomes new primary. But if "wan1" of old primary is restored I will get no connection from outside - only if I'm pulling out "wan1" cable of slave. F1 = master -> monitoring "wan1" F2 = slave -> monitoring "wan1" F1 > wan1 is lost > F2 = primary, F1 = slave ... all connections are now running correctly over F2. Then F1 > wan1 is restored > F1 = primary, F2 = slave ... I can only connect to F1 via MGMT (MGMT of F2 is not responding).. but I'm not able to ping the public IP of wan1, and I'm also not abl

Firmware version is v5.2.1,build618I have a user which is matched on a LDAP server. The user also has a FortiToken assigned, but I don't think that's relevant.The user is a member of a firewall local group. This group is added to the SSL policy (under Source Address, Source User(s)). When I try to log in the user through the FortiClient, I receive "Permission denied. (-455)".The Fortigate logs: sslvpn_login_unknown_user. I tried to set the users password to local as well, that did not work either.However, if I add the user directly to the policy, I can log in.  It seems that the policy does not process groups, only users. Is this correct? Then what do we need groups for?

The other day our LAN to WAN webfiltering started blocking about 80% of sites. The last change to the firewall had happened about 16 hours earlier, but nothing that should have blocked banking sites or duckduckgo. I had to turn off webfiltering until I could reboot the firewall. Since I rebooted (with the same webfiltering active again), I've had no problems. This is a 100D running 6.0.9 on voltage regulating UPSs. Just curious if this had happened to anyone else.  Dave

https://docs.fortinet.com/document/fortigate/6.0.9/fortios-release-notes/760203/introduction The known issues are the shortest list I remember

Basically, I am trying to do this but instead of IPSec tunnels or internal clients, it's only for our SSLVPN users: https://yatznet.com/2018/08/21/using-fortigate-as-a-local-dns-server/ In short, it works great on the LAN, but if I try to use FortiGate for DNS when connected via SSLVPN, all I get are DNS request time out errors. I do have a test policy in place that allows all ssl.root traffic to any destination within the LAN, and I can even ping the IP of the FortiGate when connected via SSLVPN, so traffic is flowing. I've done a debug and it didn't come up with anything useful, at least to me. Here is an example of an internal client using the DNS on the fortigate successfully, and the second one is our SSLVPN client timing out. It looks the same except for the flag, but I couldn't find out what that means. id=20085 trace_id=18 func=print_pkt_detail line=5517 msg="vd-root:0 received a packet(proto=17, OURLANCLIENT:59609->OURFIREWALLIP:53) from LAN. " id=20085 trace

I am trying to get tacacs authentication to work for user ronald (to start with) on our Fortigate 600D firewall.Tacacs server is a Centos 7 linux machine running tac_plus. Firewall config:config global config system admin edit "ronald" set remote-auth enable set accprofile "super_admin" set vdom "OOB" set remote-group "fwadmins" set password ENC SH2NlBggP0nKPW8lt6sfJaohuRG4BpAyUSjXp8jp6Fb/+RIZX5LtM5yMm2/S84= next edit "ronald" set remote-auth enable set accprofile "super_admin" set vdom "OOB" set remote-group "fwadmins" set password ENC SH2NlBggP0nKPW8lt6sfJaohuRG4BpAyUSjXp8jp6Fb/+RIZX5LtM5yMm2/S84= endconfig vdom edit OOB config user tacacs+ edit "tacserver" set server "10.11.1.11" set key ENC rRpp8EzKAhzRCOb0OaiS+voJjnRaN7g86rhrkLG3H4t6EF6QOrMPDTmR1Sx9yEYen1ScT6xpMBIlfjggc9IYcz2VlS42rFxaPeIA4cuWuvSxm/ HMJN2cA6b1+ZfBRYI+w74d6+wtKiVIKFwHpFCfxBTwtsbigNBtkLw55zqd2dKLWmg3FjWD0UbrQ+0/E/Hg== set authorization enable set source-ip 10.10.1.1 next endconfig vdom edit O

Hi Guys,I'm trying to switch my national ipsec vpn site-to-site network from static routing to ospf. Each branch's got around 6 subnets from which only 4 should be routed via the ipsec tunnel. Using static routing it's easy since I add only what exactly I need.My VPN network it's using a star topology and it might change to an extended star.I've started with 2 branches, the HQ and a branch.Everything works fine except that I'm not able to filter what routes are been advertised via OSPF since I'm using "config redistribute "connected""Attached is a lab I did to test it, but still no luck. The routers in the diagram I've attached are FG-70D's.I've tried:- prefix-list with in and out on both sides - no luck- access list with in and out on both sides - no luck I'm missing something here, right ?!?!Hope the diagram will give you a clear idea of what I wan to achieve. Cheers,Tony

Hello,On my Branch office I need stablish two active Dialup VPN with my HQ.On my HQ I have two ISPs Internet links and at the my BR only one.At the Fortigate on BR I have set Two Dialup client to ISP1 and ISP2 for HQ.My problem is never two tunnels is UP at the same time, when one come up other to Down.I wonder if is possible to keep active the two tunnels Dialup at the same time on client side. follow the configuration on two box, version is 6.0.9. please disregard psk and peerid #HQ VPN Dialup server Config config vpn ipsec phase1-interface edit "Dialup-MGT" set type dynamic set interface "INTERNET-MGT" set mode aggressive set peertype one set mode-cfg enable set proposal 3des-md5 aes128-md5 set dpd disable set nattraversal disable set peerid "c.c.c.c" set assign-ip disable set psksecret fffff next edit "Dialup-EQX" set type dynamic set interface "INTERNET-EQX" set local-gw t.t.t.t set mode aggressive set peertype one set mode-cfg enable set proposal 3d