Solved

Hi everyone, I think I need some help. I will try to explain what I'm trying to achieve. We have a headquarter and three small locations. In our headquarter we have a big FG1500 and on the three small locations we have FGT30E 3G/4G. The locations are connected through eternity circuit and and running OSPF between. On the small locations I configured dial up IPsec through LTE to our main Fortigate with OSPF.Everything is working fine on sub locations while connected to the ethernet circuit. I learn routes through OSPF as expected and can reach everything.... The default route is learnd from the headquarter Fortigate and that's fine.... When I disconnect the ethernet circuit the IPSec kicks in and the routes are learnd through the IPSec interface except the default route... Instead of learning my default route form the main Fortigate the default route from the LTE is injected in to the routing table with a distance of 10 I tried to change the distance under

We have two sites, site A and Site B. Both sites sites have a Fortigate firewall. Fortigate devices ARE NOT configured for high availability, nor will they be. Both sites have an internet connection provided by the same ISP: Site AFortinet Firewall Public IP: A.A.A.13/30ISP Gateway Public IP: A.A.A.14/30 Site B Fortinet Firewall Public IP: B.B.B.16/30 ISP Gateway Public IP: B.B.B.17/30 We have a two BGP published IP address range that have been provided by our ISP: BGP Advertised Public IP Range Q: Q.Q.Q.Q/27 BGP Advertised Public IP Range R: R.R.R.R/27 Local AS: 4294836658 Remote (ISP) AS: 7545 Local and Remote ASN is the same for both sites (single ISP only). Under normal conditions, we need to all traffic going to Q.Q.Q.Q/27 to be directed to site A. However, if site A is down, we need all traffic going to Q.Q.Q.Q/27 to be directed to site B. Likewise under normal conditions, we need to all traffic going to R.R.R.R/27 to be directed to site B. However,

Hello everyone, Can anyone explain to me why I have this error message and what kind of SFP+ adapter I should use??????  Best regards,Omar A

HI Everyone,  I have a pair of 80E running in HA cluster with Dual ISP and SD-WAN enabled on 6.2.3 for the last 3 weeks.  Since I have enabled HA ,  my WAN1 interface keeps going down and up every couple of minutes. ( it gets DOWN on SD WAN Performance SLA due to packet loss). I have troubleshoot it and it appears that it's not receiving back packets from ISP gateway (not receiving reply on the ARP request for gateway MAC address - L2 issue. I opened and incident at my ISP and after troubleshooting they said the issue is with Fortigate which is using same virtual MAC for all firewalls clusters. Most probably there is another cluster in the same subnet on my WAN ( which is part of a /24) Indeed, if you look at the Virtual MAC formula here : https://kb.fortinet.com/kb/documentLink.do?popup=true&externalID=11772&languageId= , unless you change group ID, enable VDOM or virtual cluster will be : 00-09-0f-09-00-00 .  Vi

Hi everyone, I have a Fortigate 80E running on 6.2.3 . I have configured SSL VPN for remote users access, installed signed certificate and tested  - running ok . Tunnel mode & web mode both OK. Then I configured 2 Portals : 1st  is for Admins (tunnel and web) - there is a  IPv4 policy in place which grants them access to all the subnets and another one for Internet Access. User accounts are created locally on the firewall. 2nd is for Corprorate users access  which are authenticating against a RADIUS server. There is a dedicated IPv4 policy in place which grants them access to required internal resources and another one for Internet access.   Issue: ALL users are authenticated against 1st portal from the list - RA management portal and IP addresses are assigned from RA for Admins Pool. ( both scenarios  tested - Forticlient or Web based VPN). Any ideea how can I have dedicated portals for each group ?  Kind regards, Adi

Hi Guys, Have noticed that the GUI DLP configuration page is missing from 6.2.2.  I can, of course use the CLI, however, I'm lazy and prefer point and click.  Does anyone know if it's buried deep in the system somewhere? Thanks

Hi; Can a different RADIUS Service client be defined uniquely by its hostname? Even if the IP address is the same? For example a.abc.com   defines radius service client1 which requests a single factor password authentication onlyb.abc.com defines radius service client2 which requests a two factor authentication However, both a.abc.com and b.abc.com share the same IP address?  KindlyWasfi

I have been fighting this for so long, I dont know what to do. I have several sites running FGT and FAPs. Yesterday I made the desition to TFTP new firmware on all the FAPs and FGTs to see if a clean start can fix the problem. The thing is. The setup can work fine, and then all the sudden the speed is terrible. I go inside the FGT and check  SNR and stuff like that and everything looks great, but it is not. Once this client had this problem and I tried to change a setting in the AP profile, and after that, poof  everything was fine again.  Another client reboots the FAP when it is to slow and all the sudden everything is fine again. So it does seem to be something with the APs. But a user should have to do that. Has anyone heard of these kind of problems. I have had so many clients having problems with the FAPs, I am att crossroad where I am seriously thinking about exchanging those and never look back. But that would be very expensive. I spoke to som

I spent some times on fortianalyzer NOC view. Then i noticed some internal users have a lot of blocked udp outgoing connections. So far nothing looks suspicious on workstations. Whatsoever, i'd really like to understand what is going on.So if you have any ideas.ty Sample

I ask this question to Indonesia Forti employee this morningLet say I have Fortigate HA with same model.Later next year my model already EOL.If one of Fortigate died and need to be replaced with newer model.He said that must use same model QUESTIONS: 1. anyone tried replacing with newer and better model. maybe not exactly the same model but similar model. number of ports are the same but maybe faster CPU and bigger RAM tq

I will be reading this later https://docs.fortinet.com/document/fortigate/6.2.3/fortios-release-notes/760203/introduction-and-supported-models  

Hi ALL, I need some recommendations , I have to create a network infrastructure setup for a company with 150 users. Now i have Fortigate 300e with 20 cisco catalyst 2960L switches and WLC cisco 3500 series with cisco 2801 series access points.  Would this be a good Idea to use these devices? are they compatible with each other ? any issues reported ? any recommendations before going to setup this infrastructure would be a great help.  thanksUsman Ali

Hello, we have been asked to implement the UK Government's Prevent agenda web filtering to stop people going to radicalisation sites etc. Does anyone have any guides or notes on what to do to implement it on the FortiGate firewalls?  Thanks,Paul

i make DLP sensor and map it with a policy to prevent download files large than 500M after apply, user can not download small or large files

Model: fortigate 400dAfter I upgraded firmware from 5.4.5 to 6.2.3 I found that there are certificate-inspection and upg certificate-inspection. (refer to the attached picture.) At the moment, Fortigate 400d is using both certificates. Which one I should use?Thank you

Hi I have a query regarding policy routes.  We have a customer whose network is connected to our firewall as in the diagram.  Their network overlaps with our own internal network subnets. In order to support our customer, we need to jump onto some servers on their network, say 10.40.1.10.  We are using a RDP jump box, located in our DMZ, to jump across onto the customer network. The problem is that if we try and connect to 10.40.1.10 the firewall static route sends us out our internal interface instead of the customer interface. BTW we have devices on 10.40.1.0/24 in our network too but the RDP server doesn’t need to connect to them. I am thinking about using policy routing to get around this issue on the FortiGate 100E. IS that something I can do, will the policy rule overrule the static route? am I on the right track or will I need to use NAT?

We have been using the remote access SSL VPN for sometime. We were using a private WAN to connect our three sites together. Recently, we removed the WAN and setup a site-to-site IPsec VPN over the Internet. This has been working fine for a few weeks except today I noticed a problem. I cannot connect to resources over the IPsec VPN from the remote access web portal. We especially use the RDP option. I have been playing around with firewall rules and it all looks good. I now believe the problem is because the traffic is originating from the default MGMT IP (192.168.1.99). I know this because a sniffer reveals this:49.628847 VPNInt out 192.168.1.99.3107 -> 10.30.16.18.3389: syn 3016459478 50.622905 VPNInt out 192.168.1.99.3107 -> 10.30.16.18.3389: syn 3016459478 52.623622 VPNInt out 192.168.1.99.3107 -> 10.30.16.18.3389: syn 3016459478 56.635057 VPNInt out 192.168.1.99.3107 -> 10.30.16.18.3389: syn 3016459478 64.667940 VPNInt out 192.168.1.99.3107 -> 10.30.16.18.3389: syn 3

Hello, Im new to fortigate and was wondering if anyone knows how to exempt a specific ip address from web filtering? Thanks in advance

Hello Is it possible to block access to YouTube except of one channel?  RegardsMariusz

Hi, Is there a command to remove a virtual ip, without using the gui?I am using a serial connection to my Fortigate 201e.I've been locked out and can't connect to it over https. Thanks!

Good day, Regular firewall policies has an option to send TCP RST packets to clients, when policy's action is set to "deny": [style="background-color: #888888;"]# set send-deny-packet enable[/style] But as far as I see, if the policy's destination is a VIP or virtual-server (load balancer), this option doesn't work. I configure "set action deny", "set send-deny-packet enable" - but still clients get nothing, their connection attempts are just silently discarded. Is there any option to make FortiGate to return RST in these cases as well? Or maybe it's possible to make an LB to return RST in case action is set to "allow", but none of its realservers pass health checks? Thanks, Vladimir.

Hello, just a simple question (I hope)We want to move a Fortigate vm cluster from one datastore to another. Are there any special considerations to take into account or can we just move it and make sure all virtual (network) interfaces do match? FortiOS is 5.0.10  Thank you and regards,Ralph

I consider using Fortitoken TwoFactorAuthentication for both administrative and SSL-VPN-authentication.  So far, so god. But the problem is that I as a sys-admin need both to have a administrative account and a VPN-account on the unit. There are also 5 branch offices with FortiGates where I need administrative account to. And here is the problem; It seems like there are a one2one2one-relationship between accounts, FortiToken and mobile phone. I can only have one FortiToken on my phone and one Fortitoken cannot be assigned to both a VPN-account and a administrative account; neither on the same device or across devices. Any good solutions or workaround here?    

Since upgrading to 6.2.2 we are having problems with sslvpn clients not being able to connect.  Yesterday we had to reissue a FortiToken to get one user working -- still investigating others.  Just wondering if anyone else is having similar issues?  Happy to share more details if anyone is interested.

Hello, for one of our customers I am looking for a way to see which forti softtokens have been used in the last few months.This can help to save tokens, if they are not used, the account can be disabled.The customer has a FortiAnalyzer and I want to generate an overview of vpn users that have logged in during the last 2 or 3 months. Better would be to see which fortitokens have only be used months ago, so these can be given out to different users.Does anyone has a usable idea? Thank you and regards,RalphArnhem, Netherlands