Solved

Hi Everyone! Good day! I was trying to work with this scenario and anyone could help me if this is possible? See attached test.jpg. I have a FortiGate, a core switch, distribution switch and client pc. The goal is that FortiGate must act as the DHCP server of all the VLANS (10,20,30). I've already tried to create vlans on the FortiGate (same vlans from the core switch) and enabled dhcp. I already tried to allow all vlans from the core switch (trunk) going to the firewall. The result, the test client in vlan 30 can obtain IP from the firewall, but cannot access internet even firewall policy was already configured on the firewall (virtual interface (vlan30) to WAN)). Best Regards, Kulas

HI, I'm using POSTMAN (REST API) to login my Fortios FW,I can get the policy (ipv4)I can get the address objectsI can get the static route from POSTMAN(REST API) But I can't found any url to get the interface IP address.Is there any document talk about it? Also, except the document below,http://www.tuncaybas.com/FOS_JSON_REST_API_523.pdfI can't found any other document talk about the REST API to FORTIOS.Is there any document for other version of FORTIOS? Many Thanks!

Hello gyus,on our FAZ-VM-BASE I found message "Log rate (xxx logs/second) exceeds the peak limit (50 logs/second) over the last 30 minutes." I think, that licensing on VM is about logs/day and storage and limit logs/sec is only for HW FAZ (according to data sheet).So what exactly this message means? Is only information about amount of peak of logs or some limits for this VM?Many thanks  

Hi ,how to verify that auto save is enabled code 5.2.xWhen I click revision ,I can see " you have unsaved changes ,save now " What does it mean ,How can I see pending configuration to be saved Thanks 

Hey, I just start working with Fortigate 60D routers, everything was fine but now our company need to setup some routes to make all locations visible to each other. For example: Office1 with IP 10.0.1.1 connected to MAIN location 10.0.0.1 with side-to-side vpnOffice2 with IP 10.0.2.1 connected to MAIN location 10.0.0.1 with side-to-side vpnI need to forward traffic from Office1 to Office2. That's mean Office1 should see all network at MAIN location + Office2. And Office2 need to see MAIN location + Office1.  I tried:1. Setup policies at MAIN location to allow traffic from Office1 to Office2. 2. Setup static route at Office13. Setup Policy Routes at MAIN location and Office1 location. 4. Setup Phase2 on VPN at Office1 with MAIN + Office2 network. And Office1 still can't see Office2. Can anyone who did it before, help me with that, please. What I need to setup to make Office1 visible to Office2?  Thank you for any help! 

Hi all, Does anybody know if FortiGate can be configured to do this?[ul]When a client opens a TCP connection to predefined port (typically, HTTPS), respond to the TCP handshake on behalf of a server.Accept the "Client Hello" TLS message from the client,Read the server's hostname specified in the SNI field of the "Client Hello".Check the hostname against "destination" of the firewall policies - maybe by performing its own DNS resolution to see if the IP falls into allowed ranges, or maybe by textual comparison if the destination is set as some regexp object?Make a Allow/Block decision based on the result?[/ul]Today, when virtually any TLS client supports the SNI field, this would be very useful feature. Thanks,Vladimir.

Does anyone know if the following FortiGate model supports 802.3ad LAG and LACP? My switches do support LACP and would like to avoid non-LACP aggregation. 400, 500, 600, 601E  Thank you,

How to completely disable Wifi on FortiWifi60? Disable interface WLAN don' t interrupt WIFI! Thanks

Hi All, I'm having a bit of an issue understanding the Forti route-maps and prefix lists.  Whilst I concur there are many examples and documentation, there's no real clear explanation of what it all does and how it works... Sorry if I am missing this after my 20+ years in the networking field, maybe I'm just getting too old. In any case, given the below:config router prefix-list edit "RFC1918"   set comments "Matches RFC1918 Addresses"   config rule     edit 1       set prefix 10.0.0.0 255.0.0.0       unset ge       unset le     next     edit 2       set prefix 172.16.0.0 255.240.0.0       unset ge       unset le     next     edit 3       set prefix 192.168.0.0 255.255.0.0       unset ge       unset le     next   end   next end config router route-map &n

Hello, I have a cluster of 100E Box on version 6.2.2 but I have face some problem as follow 1 - WEB GUI unstable, somtetimes it stop to work 2 - Out of Sync HA 3 - Two times the HA link went down and occurred the cluster failover So I wonder if this version 6.2 it´s an stable and recommend version. any tip about is welcome. thanks.

HiI want to monitor each WAN Interface Traffic via SNMP, to get output similar to the value in Interface History Widget only via SNMPIs there any way to get Wan1 and Wan2 Current Bandwidth?I looked in to Fortigate MIB and the only Bandwidth MIB I Found is "fgHaStatsNetUsage" - Network Usage of Cluster (HA)I dont Think this is the one I need,any ideas?

I have posted this question to r/Fortinet and to spiceworks, and so far no one has an answer for me. First, I should state that I am a huge fan of Fortinet. We manage and recommend many of their products. Their firewalls are miles better in value and features than any I have seen. The APs though....  To summarize, all APs we have in production max out at around 220Mbps to the end clients (maybe 60 APs at different clients). I haven't tested the 421 series, but all others (regardless of model or release date) offer the exact same throughput.  We have had 4 tickets open with support for APs that simply cannot produce bandwidths to the specifications of the devices. I have gone through the support calls, and even brought out an exact same spec AP from another manufacturer (6 antenna wave 2, 802.11ac max speed 1.3 Gbps release date 2012) to compare to their FAP321C. They cant help. It's maddening. They go through the checklist, and we see no improvement. I see

Hello to all dear friends! I'm running out of ideas to do a job that is simple but it puts me in trouble.I would like to understand with you which best practices i can use. In practice, i have a Fortigate 100d with a local network 192.168.1.0/24 on port 1 , which is the main network. To make my users work in terminal servers, a tenant is asking me to create a VPN with another network behind a watchguard in subnet: 10.150.5.0/24 where is the server we need to reach. I have to deny everything that can come from the other network (10.150.5.0/24) to mine.  I'm running out of ideas or best practices ... can you help me ?thank you all.

Hello, I would like to request information from my Fortigate via the SNMP protocol, so I configured the protocol, community etc. on the web interface, then activated the protocol on an internal interface to make it operational.However, I have no answer from my Fortigate during the requests: Timeout,... Thank you for your help.

<<Photo attached>> well , basically i had that 60d for a really long time , and after couple years it was in the storage i need it. the problem i cant seem to be able to configure it because i cant access it. when plugged into power the 3 lines near the logo light up, and the PWR light also lights up. everything else isn't. so i think its been reset or something because there's no IP or anything when connecting to any of the interfaces. So i thought maybe i should reset it again. no response when trying to reset using a little pin. connecting a usb mgmt port and using fortiexplorer , but there's no devices recognized, the sound of the usn connection is there so the unit is workinbg but i am doing something wrong , and was hoping that someone can point me into the right direction since i never encountered a completely blank forti unit. any help appreciated.  

I just wanted to know about following things in forticlient:- 1) What are the tick marks for every category? 2) When setting up for the first time and the web filter/parental contol is enabled, what all is blocked? 3) What is the difference between tick marks and the option to block, allow etc.

Hello Guys ,I need someone show me how can i do Export rules from Fortigate 300d to Excel Sheet  .We dont have a Fortimanager to do this export .Any idea please ? Regards

Hi,I was wondering if anyone has any experience in creating a custom alert in Fortimail upon high SMTP Auth Failures.I checked the guide, but i couldn't figure out of this was possible at all.I found how to create custom alerts, but i can't seem to figure out if this can be applied to high SMTP auth failures.What i would like to do is get an alert when smtp auth failures are high from ip x.x.x.x Thanks p

Hello Guys, First of all I want to say that I am glad to participate in this Forum discussions.I have a question regarding FortiGate VDOMs use cases I am working for a client which use FortiGates for firewall solution.With the current setup they split FortGate into Multiple VDOMs.Usually they are doing this when site have Two Internet service providers. root VDOM - Internal Netoworkfw1 VDOM - Primary Internet providerfw2 VDOM - Secondary Internet provider Inter-vdom links between root-fw1 and root-fw2 two default routes on the root VDOM (towards fw1 and fw2 VDOMs)one with lower priority towards the preferred LINE.They are utilizing the secondary provider by configuring static routes on root vdom which are pointing to fw2 VDOM (Some kind of a load-sharing). In NSE self study guide I've learned that usually you would need to split FortiGate box when you are managed security service provider and you want assign different VDOMs to different customers.But why a

I have to create an ipsec ssl tunnel with a customer.Everything seems fine, both phase 1 and phase 2 are up.But, they asked me to SNAT an internal IP.Tried to recreate the VPN in policy mode with the same settings - not working.In phase 2 local subnet is 172.16.5.0/24 and remote is 10.1.43.0/24They are expectig traffic from 172.16.5.170 to 10.1.43.5 using source nat 10.252.13.1.Quote:"As per the IDD traffic should be coming to our firewall from 10.252.13.0/27 subnet. Hence pls configure the source NAT at your end.Source Address: 172.16.5.170Destination Address: 10.1.43.5Source NAT: 10.252.13.1" How should I do this? Thank you!

Hi,we want to generate a CSR for a web site certificateThe only option is the 2048 bitswe do not have an option to generate SHA2 CSRIs there a command line for this? 

Hello Fortinet users, have you read https://fortiguard.com/psirt/FG-IR-18-100 and https://seclists.org/bugtraq/2019/Nov/38 already? The author of the vulnerability suggests that all information of traffic that is analyzed by "FortiGuard AntiVirus", "FortiGuard AntiSpam" and "FortiGuard Web Filter" is being transfered to Fortinet´s server => really?  There is no limitation mentioned on the homepage of the author, i.e. "FortiCloud logging enabled". We currently use: - Fortigate Firewalls with FortiOS 6.0.7 - Web Rating Overrides - SSL inspection is enabled - Antivirus-Monitoring WITHOUT "FortiSandbox Cloud for Inspection" - Anti-Spam WITHOUT "Spam Submission" option We don´t use: - FortiCloud for logging So I´m ask myself if we were ever affected by this issue at all? Does someone knows more?

Hello,Currently our Fortigate 500E has many vlan interfaces.The vlan interfaces are divided into zones in the firewall ruleset, for example:ZONE-CLIENT - vlan interface/subnet where we have the internal PC clients.ZONE-SERVER - vlan interface/subnet where we have the internal servers. Here's an example of firewall rule and who it looks in the cli of the Fortigate.SOURCE 192.168.1.0/24DESTINATION 192.168.10.100,192.168.10.101PROTOCOL/PORT TCP/80---config firewall policy edit 25 set name "CLIENT HTTP TRAFFIC" set srcintf "ZONE_CLIENT" set dstintf "ZONE_SERVER" set srcaddr "ADDR_NET_192.168.1.0" set dstaddr "ADDR_SRV_192.168.10.100" "ADDR_SRV_192.168.10.101" set action accept set schedule "always" set service "HTTP" next end---We are in the process of migrating routing from the Fortigate firewall to a Cisco core switch. The Fortigate will still be used as a firewall and the vlan interface with corresponding ip ranges will be created in the new core switch. We have created a

Hello, I am looking for a command that would allow me to see the signal attenuation on FortiGate 900D and 1500D ports. I looked in the knowledge base, but I found only articles related to an ADSL line. I watched if there were similar commands in my 900D and 1500D, but without success. Would anyone know a magic command to see this attenuation ?Just for information, the firewalls are running in v6.0.4. Thank in advance for your help.

As title - not working for me in firewall policies I have a ticket open, but wonder if anyone seen the same?