Solved

Hi All, I'm having a bit of an issue understanding the Forti route-maps and prefix lists.  Whilst I concur there are many examples and documentation, there's no real clear explanation of what it all does and how it works... Sorry if I am missing this after my 20+ years in the networking field, maybe I'm just getting too old. In any case, given the below:config router prefix-list edit "RFC1918"   set comments "Matches RFC1918 Addresses"   config rule     edit 1       set prefix 10.0.0.0 255.0.0.0       unset ge       unset le     next     edit 2       set prefix 172.16.0.0 255.240.0.0       unset ge       unset le     next     edit 3       set prefix 192.168.0.0 255.255.0.0       unset ge       unset le     next   end   next end config router route-map &n

Hello, I have a cluster of 100E Box on version 6.2.2 but I have face some problem as follow 1 - WEB GUI unstable, somtetimes it stop to work 2 - Out of Sync HA 3 - Two times the HA link went down and occurred the cluster failover So I wonder if this version 6.2 it´s an stable and recommend version. any tip about is welcome. thanks.

HiI want to monitor each WAN Interface Traffic via SNMP, to get output similar to the value in Interface History Widget only via SNMPIs there any way to get Wan1 and Wan2 Current Bandwidth?I looked in to Fortigate MIB and the only Bandwidth MIB I Found is "fgHaStatsNetUsage" - Network Usage of Cluster (HA)I dont Think this is the one I need,any ideas?

I have posted this question to r/Fortinet and to spiceworks, and so far no one has an answer for me. First, I should state that I am a huge fan of Fortinet. We manage and recommend many of their products. Their firewalls are miles better in value and features than any I have seen. The APs though....  To summarize, all APs we have in production max out at around 220Mbps to the end clients (maybe 60 APs at different clients). I haven't tested the 421 series, but all others (regardless of model or release date) offer the exact same throughput.  We have had 4 tickets open with support for APs that simply cannot produce bandwidths to the specifications of the devices. I have gone through the support calls, and even brought out an exact same spec AP from another manufacturer (6 antenna wave 2, 802.11ac max speed 1.3 Gbps release date 2012) to compare to their FAP321C. They cant help. It's maddening. They go through the checklist, and we see no improvement. I see

Hello to all dear friends! I'm running out of ideas to do a job that is simple but it puts me in trouble.I would like to understand with you which best practices i can use. In practice, i have a Fortigate 100d with a local network 192.168.1.0/24 on port 1 , which is the main network. To make my users work in terminal servers, a tenant is asking me to create a VPN with another network behind a watchguard in subnet: 10.150.5.0/24 where is the server we need to reach. I have to deny everything that can come from the other network (10.150.5.0/24) to mine.  I'm running out of ideas or best practices ... can you help me ?thank you all.

Hello, I would like to request information from my Fortigate via the SNMP protocol, so I configured the protocol, community etc. on the web interface, then activated the protocol on an internal interface to make it operational.However, I have no answer from my Fortigate during the requests: Timeout,... Thank you for your help.

<<Photo attached>> well , basically i had that 60d for a really long time , and after couple years it was in the storage i need it. the problem i cant seem to be able to configure it because i cant access it. when plugged into power the 3 lines near the logo light up, and the PWR light also lights up. everything else isn't. so i think its been reset or something because there's no IP or anything when connecting to any of the interfaces. So i thought maybe i should reset it again. no response when trying to reset using a little pin. connecting a usb mgmt port and using fortiexplorer , but there's no devices recognized, the sound of the usn connection is there so the unit is workinbg but i am doing something wrong , and was hoping that someone can point me into the right direction since i never encountered a completely blank forti unit. any help appreciated.  

I just wanted to know about following things in forticlient:- 1) What are the tick marks for every category? 2) When setting up for the first time and the web filter/parental contol is enabled, what all is blocked? 3) What is the difference between tick marks and the option to block, allow etc.

Hello Guys ,I need someone show me how can i do Export rules from Fortigate 300d to Excel Sheet  .We dont have a Fortimanager to do this export .Any idea please ? Regards

Hi,I was wondering if anyone has any experience in creating a custom alert in Fortimail upon high SMTP Auth Failures.I checked the guide, but i couldn't figure out of this was possible at all.I found how to create custom alerts, but i can't seem to figure out if this can be applied to high SMTP auth failures.What i would like to do is get an alert when smtp auth failures are high from ip x.x.x.x Thanks p

Hello Guys, First of all I want to say that I am glad to participate in this Forum discussions.I have a question regarding FortiGate VDOMs use cases I am working for a client which use FortiGates for firewall solution.With the current setup they split FortGate into Multiple VDOMs.Usually they are doing this when site have Two Internet service providers. root VDOM - Internal Netoworkfw1 VDOM - Primary Internet providerfw2 VDOM - Secondary Internet provider Inter-vdom links between root-fw1 and root-fw2 two default routes on the root VDOM (towards fw1 and fw2 VDOMs)one with lower priority towards the preferred LINE.They are utilizing the secondary provider by configuring static routes on root vdom which are pointing to fw2 VDOM (Some kind of a load-sharing). In NSE self study guide I've learned that usually you would need to split FortiGate box when you are managed security service provider and you want assign different VDOMs to different customers.But why a

I have to create an ipsec ssl tunnel with a customer.Everything seems fine, both phase 1 and phase 2 are up.But, they asked me to SNAT an internal IP.Tried to recreate the VPN in policy mode with the same settings - not working.In phase 2 local subnet is 172.16.5.0/24 and remote is 10.1.43.0/24They are expectig traffic from 172.16.5.170 to 10.1.43.5 using source nat 10.252.13.1.Quote:"As per the IDD traffic should be coming to our firewall from 10.252.13.0/27 subnet. Hence pls configure the source NAT at your end.Source Address: 172.16.5.170Destination Address: 10.1.43.5Source NAT: 10.252.13.1" How should I do this? Thank you!

Hi,we want to generate a CSR for a web site certificateThe only option is the 2048 bitswe do not have an option to generate SHA2 CSRIs there a command line for this? 

Hello Fortinet users, have you read https://fortiguard.com/psirt/FG-IR-18-100 and https://seclists.org/bugtraq/2019/Nov/38 already? The author of the vulnerability suggests that all information of traffic that is analyzed by "FortiGuard AntiVirus", "FortiGuard AntiSpam" and "FortiGuard Web Filter" is being transfered to Fortinet´s server => really?  There is no limitation mentioned on the homepage of the author, i.e. "FortiCloud logging enabled". We currently use: - Fortigate Firewalls with FortiOS 6.0.7 - Web Rating Overrides - SSL inspection is enabled - Antivirus-Monitoring WITHOUT "FortiSandbox Cloud for Inspection" - Anti-Spam WITHOUT "Spam Submission" option We don´t use: - FortiCloud for logging So I´m ask myself if we were ever affected by this issue at all? Does someone knows more?

Hello,Currently our Fortigate 500E has many vlan interfaces.The vlan interfaces are divided into zones in the firewall ruleset, for example:ZONE-CLIENT - vlan interface/subnet where we have the internal PC clients.ZONE-SERVER - vlan interface/subnet where we have the internal servers. Here's an example of firewall rule and who it looks in the cli of the Fortigate.SOURCE 192.168.1.0/24DESTINATION 192.168.10.100,192.168.10.101PROTOCOL/PORT TCP/80---config firewall policy edit 25 set name "CLIENT HTTP TRAFFIC" set srcintf "ZONE_CLIENT" set dstintf "ZONE_SERVER" set srcaddr "ADDR_NET_192.168.1.0" set dstaddr "ADDR_SRV_192.168.10.100" "ADDR_SRV_192.168.10.101" set action accept set schedule "always" set service "HTTP" next end---We are in the process of migrating routing from the Fortigate firewall to a Cisco core switch. The Fortigate will still be used as a firewall and the vlan interface with corresponding ip ranges will be created in the new core switch. We have created a

Hello, I am looking for a command that would allow me to see the signal attenuation on FortiGate 900D and 1500D ports. I looked in the knowledge base, but I found only articles related to an ADSL line. I watched if there were similar commands in my 900D and 1500D, but without success. Would anyone know a magic command to see this attenuation ?Just for information, the firewalls are running in v6.0.4. Thank in advance for your help.

As title - not working for me in firewall policies I have a ticket open, but wonder if anyone seen the same?

hello there, i hope you can help me with this issue, i have a gateway to gateway VPN site configuration, the tunnel goes up and seems fine, however on the remote subnet some IP addresses are not reachable from my local LAN, these addresses are reachable when i ping them locally (at the remote site).setup:FGT80, Firmware 5.6.10 (also tried with 5.6.11) - local subnet 192.168.13.0/24FGT60, Firmware 6.0.6, remote subnet 172.16.16.0/24i'm using a routing based VPNpings works from the remote site to the local site. Diganostics:I've tried  tcp dump on the local fortigate lan interface to monitor icmp:FW (root) # diagnose sniffer packet LAN "icmp" interfaces=[LAN] filters=[icmp] 16.620849 192.168.13.103 -> 172.16.16.1: icmp: echo request 21.326596 192.168.13.103 -> 172.16.16.1: icmp: echo request 26.331553 192.168.13.103 -> 172.16.16.1: icmp: echo request 31.331637 192.168.13.103 -> 172.16.16.1: icmp: echo request trace route from the local host:Tracing route t

Hi All, I was wondering if anybody had any luck configuring Radius admin authentication to the Cisco SG-500 switches, or for that matter any of their "Small-Business" line? So far I have the switch configured as a Radius Client in FortiAuth, filtered down to a remote LDAP group. This works perfectly for allowing the login, but unfortunately the group members get privilege level 1, ie they have then elevate permissions using the Enable password. The old FortiAuth3.3 Interoperability Guide talks about configuring the FortiAuth to send Radius Attributed of "Cisco-AVPair = shell:priv-lvl=15" and "Service-Type = NAS-Prompt-User" to elevate permissions to priv levl 15 which bypasses Enable. (pg 44 - http://docs.fortinet.com/uploaded/files/1991/fortiauthenticator-two-factor-authentication-interoperability-guide.pdf) I cannot get this to work. I have found other forum posts that state the service-type needs to be "Administrative-User" but still no dice. My concern is that a pack

Good morning all, I am doing some work on a fortigate in a testbed environment and have noteiced that one of the VDOMS created has a red circle icon with a black dot in the middle when it is viewed in the VDOM drop down menu on the GUI. I cant figure out what this means, and have not been able to find a reference to it in the fortiOS cookbook. Is anybody able to enlighten me on what it means please? Thanks for your time 

Dear Brothers My company currently use several fortigate 100D firewall UTM devicesI need to upgrade to new model because atm the CPU of FGT always reachs high usage, and found that Fortigate 100F and Fortigate 200E meet requiments. Any body can give me that which model between them should be compatible for fortigate 100D replacement?Our company has 1000 CCU, fortigate device run webfilter, dlp, app control, Explicit proxy. We also have some ipsec vpn channel and web ssl vpn for 50 vpn clients. Thanks very much with best regards              

Hi there, Let me start off by saying I'm new to Fortigate. I just passe NSE-2 and are currently 'studying' NSE-3 and afterwards NSE-4. I work for a small service provider and kind of got the firewall thrown in my lap. Not that i mind, I like the challenge, but still there is a lot to learn... With that in mind, I ran in to a conundrum. One of our clients has 9 stores with customer counters. One of these stores cannot connect with the server for updates. They all go though the same FW... So i made a new policy for this location and get client-RST or Accept: IP connection error when using a laptop to go to the portal the counter should go. When I Telnet to the location I can reach it without problems or errors on the FW. Can anyone tell me what I can troubleshoot next? If anymore info is needed please tell me what you need. Thanks in advance

Hello I have passed the NSE7 certificate and managing to pass the NSE8 .Since there is not too much information \ material on this certificate , and no material in the network security academy , I wanted to ask here :- If anyone familiar with the material ?- Which products are involved in the NSE8 exam ?- Is it much difficult than the NSE7 exam ?- Does anyone familiar with sites that give courses and material on this exam ? NSE8 certified engineers , can you please share you experience at the NSE8 exam ? Thanks

Please, help me to find where I can get FW for my Fortigate 140D-POE-T1.There are no suitable image on donwload portal. 

Hello guys,We have URL filtering enabled on our fortigate, with specific user subnets having different URL filtering policies. These users have statically assigned IPs. But we now want to switch to dynamic addressing and using AD to group users. How do i integrate the AD to our fortigate and configure URL policies based on the groups defined in the AD Thanks.