Solved

Hi Guys, i need to configure a vpn site-to-site between Fortigate100E in HA and Azure . The Fortigate is set with 2 wans in load balancing .I want to know how to configure this vpn from the Firewall with two wans to Azure Cloud , in such a way that to have a high reliability of the vpn (in case one of the line is down  the vpn is routed to the other active line) . Firmware version of two firewalls is 6.0.2thanks for your support Antonio  

Hi, We have requirement to setup the connectivity on Fortigate as below: 1) We have our office in Country A and Country B. 2) We need to access a third party application hosted in Country C for which connectivity has been allowed by the third party application owner by whitelisting of Country B Fortigate WAN IP. 3) Our application hosted on servers hosted behind firewall in Country A has to access the application hosted in Country C via/through Country B firewall. Flow will be like: Request will be initiated by Country A servers towards the Country B firewall and then Country B firewall has to route the request to the Country C third party application using Country B firewall wan IP (because wan ip is whitelisted by application owner).Kindly please advise how to achieve this and what configuration is required on our Country A, Country B Fortigate firewall. As of now there is no connectivity established between Country A and Country B firewall.

Hello,I have a hub and spoke with three spokes. Everything is ok, clients from spokes networks can join each other and to the central network (ping, AD, SMB, DNS).From central, everythings is ok too.BUT ,from hubs and spokes CLI, i can't ping nothing but the local network.one hub can't ping other hub and ping other machine on a hub network or central network. For example, i can't redirect a hub log flow to the central syslog server.Can you help me? Thanks. 

Hi there, I found one of the WIFI mesh leaf APs got disconnected from time to time. when I check the status by using command:  "diagnose wireless-controller wlac -c wtp" I found the following msg: last failure : 7 -- Change state pending timer expired last failure param: N/A last failure time: Thu Sep 12 06:56:12 2019 I tried to google "7 -- Change state pending timer expired", it doesn't really help. Can someone tell me what that failure code really means? CheersJason 

Hi, I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls. So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat. testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"But I get no response. The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no differenceI cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not. I'm sure I'm just missing something, can someone here see any obvious signs?

Hi All, I have configured a redundant site to site IPSEC VPN between 2 FGT E units, both running 6.0.6. Basically, setup is as follows: Tunnel 1 - Site A ISP1 to Site B ISP1Tunnel 2 - Site A ISP2 to site B ISP1 To allow failover, administrative distance is set to 10 for each static route, and a priority is set to allow for an organized prioritization of tunnels. When this was originally set up in FortiOS 5.4, I used the following commands to customize the failover settings: dpd-retrycount 3dpd-retryinterval 3 REFERENCE ONLY: Please see this forum post made back in 2017 that helped me with that issue (thanks to neonbit and Mike for all the help - settings pretty much working up until today!) However, when trying to set up a new site, using the commanddpd-retrycount 3will not error out but it will not show up in the configuration. Furthermore, the failover does not work properly unless I purposely adddpd on-idle(which is supposedly a default settin

Hello guys,  we bought and installed the FG61E (6.0.3) + FortiCare license for 1year 8x5. Without UTM. We use only site2site IPsec. Is there any way to remove the error message (I mean those red ones) that the license expired? I have tried some tips from the forum: config system fortiguard    set antispam-force-off enable    set outbreak-prevention-force-off enable    set webfilter-force-off enable end unfortunately without success. This does not appear on version 5.6.7.  Thank you for the tips. Jirka

Hello, I have deployed a very simple traffic shaping policy, but when I issue the diag firewall shaper traffic-shaper command, I see wrong guaranteed bandwidth shown, which is different than what I have configured. The config is as follows: config system interface edit wan1 set estimated-up 250 set estimated-down 2024 end config firewall shaper traffic-shaper edit low set priority low next edit high set guaranteed 250 set priority high next end config firewall shaping-policy edit 1 set service ALL set dstintf wan1 set srcaddr xxx set dstaddr all set traffic-shaper high next edit 2 set service ALL set dstintf wan1 set srcaddr all set dstaddr all set traffic-shaper low next end My intention is to guarantee 250Kbps to traffic originating from srcaddr xxx. When I issue the diag firewall shaper traffic-shaper, I get: name low maximum-bandwidth 0 KB/sec guaranteed-bandwidth 0 KB/sec current-bandwidth 4 KB/sec priority 4 overhead 0 tos ff packets dropped 0 bytes dropped 0 name high maxi

Hello, While checking, it is seen that when an sslvpn client (using forticlient 6.0.6) starts a vpn request via the fortigate firewall towards the authentication(radius) server , instead of one there are two or sometimes three requests seen.eg. as below. 10.0.58.55  is the fortigate firewall & 10.1.4.21 is the authentication server. 4.355284 port3 out 10.0.58.55.12039 -> 10.1.4.21.1812: udp 126 9.360274 port3 out 10.0.58.55.12039 -> 10.1.4.21.1812: udp 126 Please assist. thanks.

Hello, Does any one know how to get a login banner for fortigate vpn client.(similar to ones in cisco anyconnect).Replacement messages are an option, but they do not seem to be for the client.verion - 6.2 Appreciate all help.

Hello to you all, I upgraded last week (5.6 -> 5.6.8 -> 5.6.11) The upgrade was completed normally. Then we rebooted MASTER and SLAVE once each (FailoverTest). The test was also completed normally. But I found a strange Crash Log. Signal 11 Log related to Hatalk occurred at the time of reboot of both equipment Crash log has occurred twice. I suspect BUG. If it's not BUG, I wonder why the symptoms occurred. Thanks crash log374: 2019-11-10 01:37:16 <00083> firmware FortiGate-200D v5.6.11,build1700b1700,190814 (GA) (Release) 375: 2019-11-10 01:37:16 <00083> application hatalk 376: 2019-11-10 01:37:16 <00083> *** signal 11 (Segmentation fault) received *** 377: 2019-11-10 01:37:16 <00083> Register dump: 378: 2019-11-10 01:37:16 <00083> RAX: 0000000000000000   RBX: 0000002a99f69000 379: 2019-11-10 01:37:16 <00083> RCX: 0000000002120fb0   RDX: 0000000002120fb0 380: 2019-11-10 01:37:16 <00083> R8:  0000

Hi,We have Fortinet 201E with LDAP configured. The web policy is configured based on user groups & AD is forwarding wrong user names to collector agent. Instead of logged in user, it is forwarding Domain\Administrator & the internet wont work for that user. We have upgraded the firmware to the latest & reinstalled latest FSSO agent. Still unable to resolve the issue. Request for helpThanks in advanceRegardsMurali S L

Hi folks, I'm a bit new to this, so hoping someone can help.  I have our SSL VPN set up and working decently well:  remote clients can access internal the (single) internal network resources, and also split tunnels through to external resources (e.g. AWS).  So that's working well.  The part I'm struggling with is getting the internal network to access VPN clients.   I have a policy set up as such:----------------------------------- Incoming Interface:  internalOutgoing Interface: SSL-VPN tunnel interface (ssl.root)Source: allDestination: VPN RangeSchedule: alwaysService: AllAction: Allow (This is in addition to the regular SSL-VPN -> internal/wan policies that are working as expected right now) Internal IP Range: 10.0.1.0/24VPN IP Range : 10.0.2.0/24 Ping from SSL VPN to Internal is fine (e.g. 10.0.2.123 -> 10.0.1.123)Ping from Internal to SSL VPN times out (e.g. 10.0.1.123 -> 10.0.2.123) When I ping from in

hello everybody I have a problem with looping through an SSL VPN connection. The goal should be to register via VPN to the first Fortigate and then to access the subnets of the second and third fortigate. Construction network: Modem with port forwarding of the VPN connection to the first Fortigate. Each fortigate defines and routes its own subnets. The connection to the second / third fortigate is created via a VLAN. on all fortigates runs RIPv2. on all fortigate's the addresses of the other fortigate's (subnets) are known. From each subnet of a fortigate, the subnetted of the other fortigate can be accessed. this works. VPN connection from an external PC to the first fortigate is established and access to the subnets works. However, I do not come with this vpn connection on the subnets of the other fortigate's. Where can I start for it? The whole thing is constructed as a ring network. later several fortigs will be connected to the ring.any ideas?  

Hi everyone.I have been working with fortimanager for a few days, right now I have a problem when a try to send the policy packages to the fortigates.The problem is that one of the interface´s settings  that I´ve configured is different between what the fortiManager tries to send and I dont now why.  

Fortigate 80C Firmware 5.0 I am having an issue trying to block youtube.com. [ul]I have the web-filter subscription.I have edited the Web filter profile to block all "Bandwidth consuming" sites (Streaming ect)Enabled website filter, *Youtube.com / Wildcard / Block / Enable. [/ul][ul]I have added Web filter to my policy for my network. (Internal 2 - WAN 1) I rebooted the Fortigate to ensure all sessions were stopped, so this could take effect. [/ul]People on the network are still accessing Youtube. Still no luck, Any assistance would be appreciated.  

Hi, FortiGate 200D - FortiOS v5.6.11 build1700 (GA). 5 wan connections.   Every 1-2 days some connections status changed to down. But the connections are up! If I change the detect server its OK.     After 1-2 days down again! change the detect server all OK. Example: Used 8.8.8.8 - OK, when down change to 8.8.4.4 - OK, when down back to 8.8.8.8, then 8.8.4.4 and so on... I tried few others Ip addresses as detect server same result.  Any idea?   Thanks, Lior. 

Has anyone created a script for importing a list of IP addresses to create Object Addresses within the FortiGate firewall? Ideally this script would allow for updates etc on a monthly basis. example list IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2,OUTSIDE 333.333.333.333,HOST-3,OUTSIDE to produce an output like the following: edit HOST-1 set type ipmask set subnet 111.111.111.111/255.255.255.255 set associated-interface OUTSIDE next edit HOST-2 set type ipmask set subnet 222.222.222.222/255.255.255.255 set associated-interface OUTSIDE next edit HOST-3 set type ipmask set subnet 333.333.333.333/255.255.255.255 set associated-interface OUTSIDE end

Is there an easy (preferrably, but anything goes..) way to cross-check any references to other items in the cli?I just realised I don't know any way to do this...Is it even possible?Grep doesn' count...:)

Hello, I have two fortigate routers on two sites. Between the sites I have an antenna connection. I would like to create an ipsec vpn, but instead of using internet and wan interfaces, I would like to create the ipsec using the internal interface and create it inside this antenna connection. Is this possible? if yes, how can I achieve it? Thanks.

Does anyone know if there a reason that the outbreak protection minimum interval is 15 minutes?   (This limit isn't documented in the CLI manual, but when you try to set it below this from the CLI it's blocked).   Outbreak protection seems like it would be a great feature if we could set it to 5 or even 10 minutes, but 15 minutes is just too long for end users... they end up screaming at the help desk looking for their messages, so we end up having to turn the outbreak protection off. A related question.... does anyone know if outbreak protection utilizes the sender reputation status to weigh against its findings?   If not this seems like it would be a good thing... Jeff

Hi there,           I'm still in the learning process of fortigate. I'm trying to setup a backup VPN tunnel. Now, I have a primary vpn tunnel from site A firewall to site B firewall. I will need a secondary vpn tunnel from site C firewall to site B firewall to turn on automatically whenever the primary connection is down. Both site A&C have 90D, site B has 60E. I know I'm supposed to setup some lower value in the setting, but not sure where I need to do it? phase 1 or 2 parameters? Or security policy? priority value of static route?          Also correct me if I'm wrong for the settings I need to do. 1. Using vpn wizard create vpn tunnel 2. setup ipv4 policy 3. setup security policy 4. setup static route               Thank you for your time and advice. Really appreciate it!! 

Hey everyone, I have what I consider a little bit of an odd routing situation and I am not sure if the Fortigate's support it and how you do it. I haven't found it in the manual yet. I have personally never run into it before but I can't believe it is uncommon today.  So here is the situation:[ul]We currently run 200D Fortigates on 6.0.X.At one of my locations I have a /29 on a WAN interface from our ISP.[ul]I need to add additional IPs and we would like to do it by adding another /29. (I don't even know what you call this technically.) This amounts to supporting two subnets on the same external/WAN interface. This is something I have never done before but I am aware it can be done on other hardware.[/ul]I saw some information for 4.x that appears to be relevant to internal routing but not from the outside in.[/ul]Our options are Two /29s as described above or move to a new /28 and change everything that is on the existing /29. I would rather avoid moving to the /28 as it mea

Let say I have file ID.txt that contain Indonesia ip subnet223.130.20.0/22 223.164.0.0/16 223.165.4.0/22 223.255.224.0/21it contains 2700 ips GOALS: 1. only allow SSH from those ID.txt2. block those ips that from Indonesia that doing Brute Force ssh attack with 5x consecutive failure QUESTIONS:1. How to achieve that tq

Hi everyone, We have a Memory Usage problem（89%） here . Our Fortigate 300D which version is 5.4.5. Here are the disa sys top-summary output: PID RSS ^CPU% MEM% FDS TIME+ NAME * 10368 522M 6.6 6.5 263 43:58.40 ipsmonitor [x5] 10395 18M 5.5 0.2 12 00:00.36 sshd [x4] 10385 104M 1.9 1.3 1772 01:31.78 wad [x5] 10386 35M 0.9 0.4 45 19:10.95 scanunitd [x4] 10388 57M 0.9 0.7 15 55:53.17 updated 10371 7M 0.0 0.1 12 01:38.19 fclicense 10372 28M 0.0 0.4 23 58:50.98 forticron 10373 10M 0.0 0.1 15 00:14.76 forticldd 10374 9M 0.0 0.1 42 00:23.81 authd [x3] 10369 7M 0.0 0.1 11 19:52.96 merged_daemons 10376 7M 0.0 0.1 9 00:00.00 httpclid 10377 7M 0.0 0.1 11 00:41.45 radius-das 10378 3G 0.0 [style="background-color: #ff0000;"]43.7[/style] 22 39:10.30 reportd 10379 20M 0.0 0.3 38 55:52.49 sslvpnd [x4] 10380 7M 0.0 0.1 11 01:40.00 info_sslvpnd 10370 9M 0.0 0.1 13 00:31.30 fnbamd 10382 780K 0.0 0.0 4 00:00.00 smbcd 10383 22M 0.0 0.3 122 42:22.91 proxyd [x3] 10384 11M