Solved

i make DLP sensor and map it with a policy to prevent download files large than 500M after apply, user can not download small or large files

Model: fortigate 400dAfter I upgraded firmware from 5.4.5 to 6.2.3 I found that there are certificate-inspection and upg certificate-inspection. (refer to the attached picture.) At the moment, Fortigate 400d is using both certificates. Which one I should use?Thank you

Hi I have a query regarding policy routes.  We have a customer whose network is connected to our firewall as in the diagram.  Their network overlaps with our own internal network subnets. In order to support our customer, we need to jump onto some servers on their network, say 10.40.1.10.  We are using a RDP jump box, located in our DMZ, to jump across onto the customer network. The problem is that if we try and connect to 10.40.1.10 the firewall static route sends us out our internal interface instead of the customer interface. BTW we have devices on 10.40.1.0/24 in our network too but the RDP server doesn’t need to connect to them. I am thinking about using policy routing to get around this issue on the FortiGate 100E. IS that something I can do, will the policy rule overrule the static route? am I on the right track or will I need to use NAT?

We have been using the remote access SSL VPN for sometime. We were using a private WAN to connect our three sites together. Recently, we removed the WAN and setup a site-to-site IPsec VPN over the Internet. This has been working fine for a few weeks except today I noticed a problem. I cannot connect to resources over the IPsec VPN from the remote access web portal. We especially use the RDP option. I have been playing around with firewall rules and it all looks good. I now believe the problem is because the traffic is originating from the default MGMT IP (192.168.1.99). I know this because a sniffer reveals this:49.628847 VPNInt out 192.168.1.99.3107 -> 10.30.16.18.3389: syn 3016459478 50.622905 VPNInt out 192.168.1.99.3107 -> 10.30.16.18.3389: syn 3016459478 52.623622 VPNInt out 192.168.1.99.3107 -> 10.30.16.18.3389: syn 3016459478 56.635057 VPNInt out 192.168.1.99.3107 -> 10.30.16.18.3389: syn 3016459478 64.667940 VPNInt out 192.168.1.99.3107 -> 10.30.16.18.3389: syn 3

Hello, Im new to fortigate and was wondering if anyone knows how to exempt a specific ip address from web filtering? Thanks in advance

Hello Is it possible to block access to YouTube except of one channel?  RegardsMariusz

Hi, Is there a command to remove a virtual ip, without using the gui?I am using a serial connection to my Fortigate 201e.I've been locked out and can't connect to it over https. Thanks!

Good day, Regular firewall policies has an option to send TCP RST packets to clients, when policy's action is set to "deny": [style="background-color: #888888;"]# set send-deny-packet enable[/style] But as far as I see, if the policy's destination is a VIP or virtual-server (load balancer), this option doesn't work. I configure "set action deny", "set send-deny-packet enable" - but still clients get nothing, their connection attempts are just silently discarded. Is there any option to make FortiGate to return RST in these cases as well? Or maybe it's possible to make an LB to return RST in case action is set to "allow", but none of its realservers pass health checks? Thanks, Vladimir.

Hello, just a simple question (I hope)We want to move a Fortigate vm cluster from one datastore to another. Are there any special considerations to take into account or can we just move it and make sure all virtual (network) interfaces do match? FortiOS is 5.0.10  Thank you and regards,Ralph

I consider using Fortitoken TwoFactorAuthentication for both administrative and SSL-VPN-authentication.  So far, so god. But the problem is that I as a sys-admin need both to have a administrative account and a VPN-account on the unit. There are also 5 branch offices with FortiGates where I need administrative account to. And here is the problem; It seems like there are a one2one2one-relationship between accounts, FortiToken and mobile phone. I can only have one FortiToken on my phone and one Fortitoken cannot be assigned to both a VPN-account and a administrative account; neither on the same device or across devices. Any good solutions or workaround here?    

Since upgrading to 6.2.2 we are having problems with sslvpn clients not being able to connect.  Yesterday we had to reissue a FortiToken to get one user working -- still investigating others.  Just wondering if anyone else is having similar issues?  Happy to share more details if anyone is interested.

Hello, for one of our customers I am looking for a way to see which forti softtokens have been used in the last few months.This can help to save tokens, if they are not used, the account can be disabled.The customer has a FortiAnalyzer and I want to generate an overview of vpn users that have logged in during the last 2 or 3 months. Better would be to see which fortitokens have only be used months ago, so these can be given out to different users.Does anyone has a usable idea? Thank you and regards,RalphArnhem, Netherlands

Hi, I want to replace 100D model with 100E model in FortiManager. I was thinking that an easy method would be to use this kb: https://kb.fortinet.com/kb/documentLink.do?externalID=FD34527 which is for same model replacement. TAC told me that it won't work, but was wondering if anyone in this forum has experience with this? Having to remap interfaces, and add the device in VPN manager will take manual work that i would like to avoid. Thank you, 1984  

Hi all,  Would like to know whether there's a workaround for this.  Currently a /29 WAN subnet is created on a WAN 1. e.g. 202.188.1.130/29. Gateway is 202.188.1.129.I want to separate a particular IP out e.g. 202.188.1.132 and connect it to another port e.g. Port 15 for SSL-VPN purpose. By default, under the SSL-VPN settings, the box will only listen on the WAN 1 IP i.e. 202.188.1.130:443. How can I make the box to listen to 202.188.1.132 for the SSL-VPN.  Thank you in advance for your guidance.     

Does anyone know if LACP is supported on the 61e?The doc shows "Link Aggregation Control Protocol (LACP) is now supported on FortiGate and FortiWiFi 90E, 80E, 60E, 50E, and 30E devices." Not sure why it's limited to these model numbers and not the "odd numbered" units.I can't find the option available in a 61e after a firmware update. Does anyone have any insight? Thanks!

If I have disk logging disabled and I'm forwarding all logs to a FAZ that is unavailable, what is the negative effect on a FortiGate that has 100s or 1000s of logs building up in the queue? Will this potentially cause memory issues? Thanks!

Hi guys, I haven't implemented this thing before. So please tell me if it is possible to implement like below:Our Fortigate at HQ has two FTTH WAN lines (WAN1, WAN2). I have configured two default routes with the same distance but different priority (we has some DMZ servers, so we want access to these servers by VIP on both two WAN link). At the branch, we just have one FTTH WAN (WAN1). Currently, we just have IPSEC VPN site-to-site-tunnel from WAN1 of the Branch Firewall to WAN1 of HQ Firewall named it "VPN tunnel 1". Is it possible to create another IPSEC VPN site-to-site tunnel, eg: from WAN1 of the Branch Firewall to WAN2 of HQ Firewall. I attached sample topology for refer. Thanks for reading.

Hi Everyone! Good day! I was trying to work with this scenario and anyone could help me if this is possible? See attached test.jpg. I have a FortiGate, a core switch, distribution switch and client pc. The goal is that FortiGate must act as the DHCP server of all the VLANS (10,20,30). I've already tried to create vlans on the FortiGate (same vlans from the core switch) and enabled dhcp. I already tried to allow all vlans from the core switch (trunk) going to the firewall. The result, the test client in vlan 30 can obtain IP from the firewall, but cannot access internet even firewall policy was already configured on the firewall (virtual interface (vlan30) to WAN)). Best Regards, Kulas

HI, I'm using POSTMAN (REST API) to login my Fortios FW,I can get the policy (ipv4)I can get the address objectsI can get the static route from POSTMAN(REST API) But I can't found any url to get the interface IP address.Is there any document talk about it? Also, except the document below,http://www.tuncaybas.com/FOS_JSON_REST_API_523.pdfI can't found any other document talk about the REST API to FORTIOS.Is there any document for other version of FORTIOS? Many Thanks!

Hello gyus,on our FAZ-VM-BASE I found message "Log rate (xxx logs/second) exceeds the peak limit (50 logs/second) over the last 30 minutes." I think, that licensing on VM is about logs/day and storage and limit logs/sec is only for HW FAZ (according to data sheet).So what exactly this message means? Is only information about amount of peak of logs or some limits for this VM?Many thanks  

Hi ,how to verify that auto save is enabled code 5.2.xWhen I click revision ,I can see " you have unsaved changes ,save now " What does it mean ,How can I see pending configuration to be saved Thanks 

Hey, I just start working with Fortigate 60D routers, everything was fine but now our company need to setup some routes to make all locations visible to each other. For example: Office1 with IP 10.0.1.1 connected to MAIN location 10.0.0.1 with side-to-side vpnOffice2 with IP 10.0.2.1 connected to MAIN location 10.0.0.1 with side-to-side vpnI need to forward traffic from Office1 to Office2. That's mean Office1 should see all network at MAIN location + Office2. And Office2 need to see MAIN location + Office1.  I tried:1. Setup policies at MAIN location to allow traffic from Office1 to Office2. 2. Setup static route at Office13. Setup Policy Routes at MAIN location and Office1 location. 4. Setup Phase2 on VPN at Office1 with MAIN + Office2 network. And Office1 still can't see Office2. Can anyone who did it before, help me with that, please. What I need to setup to make Office1 visible to Office2?  Thank you for any help! 

Hi all, Does anybody know if FortiGate can be configured to do this?[ul]When a client opens a TCP connection to predefined port (typically, HTTPS), respond to the TCP handshake on behalf of a server.Accept the "Client Hello" TLS message from the client,Read the server's hostname specified in the SNI field of the "Client Hello".Check the hostname against "destination" of the firewall policies - maybe by performing its own DNS resolution to see if the IP falls into allowed ranges, or maybe by textual comparison if the destination is set as some regexp object?Make a Allow/Block decision based on the result?[/ul]Today, when virtually any TLS client supports the SNI field, this would be very useful feature. Thanks,Vladimir.

Does anyone know if the following FortiGate model supports 802.3ad LAG and LACP? My switches do support LACP and would like to avoid non-LACP aggregation. 400, 500, 600, 601E  Thank you,

How to completely disable Wifi on FortiWifi60? Disable interface WLAN don' t interrupt WIFI! Thanks