Solved

Hi,we want to generate a CSR for a web site certificateThe only option is the 2048 bitswe do not have an option to generate SHA2 CSRIs there a command line for this? 

Hello Fortinet users, have you read https://fortiguard.com/psirt/FG-IR-18-100 and https://seclists.org/bugtraq/2019/Nov/38 already? The author of the vulnerability suggests that all information of traffic that is analyzed by "FortiGuard AntiVirus", "FortiGuard AntiSpam" and "FortiGuard Web Filter" is being transfered to Fortinet´s server => really?  There is no limitation mentioned on the homepage of the author, i.e. "FortiCloud logging enabled". We currently use: - Fortigate Firewalls with FortiOS 6.0.7 - Web Rating Overrides - SSL inspection is enabled - Antivirus-Monitoring WITHOUT "FortiSandbox Cloud for Inspection" - Anti-Spam WITHOUT "Spam Submission" option We don´t use: - FortiCloud for logging So I´m ask myself if we were ever affected by this issue at all? Does someone knows more?

Hello,Currently our Fortigate 500E has many vlan interfaces.The vlan interfaces are divided into zones in the firewall ruleset, for example:ZONE-CLIENT - vlan interface/subnet where we have the internal PC clients.ZONE-SERVER - vlan interface/subnet where we have the internal servers. Here's an example of firewall rule and who it looks in the cli of the Fortigate.SOURCE 192.168.1.0/24DESTINATION 192.168.10.100,192.168.10.101PROTOCOL/PORT TCP/80---config firewall policy edit 25 set name "CLIENT HTTP TRAFFIC" set srcintf "ZONE_CLIENT" set dstintf "ZONE_SERVER" set srcaddr "ADDR_NET_192.168.1.0" set dstaddr "ADDR_SRV_192.168.10.100" "ADDR_SRV_192.168.10.101" set action accept set schedule "always" set service "HTTP" next end---We are in the process of migrating routing from the Fortigate firewall to a Cisco core switch. The Fortigate will still be used as a firewall and the vlan interface with corresponding ip ranges will be created in the new core switch. We have created a

Hello, I am looking for a command that would allow me to see the signal attenuation on FortiGate 900D and 1500D ports. I looked in the knowledge base, but I found only articles related to an ADSL line. I watched if there were similar commands in my 900D and 1500D, but without success. Would anyone know a magic command to see this attenuation ?Just for information, the firewalls are running in v6.0.4. Thank in advance for your help.

As title - not working for me in firewall policies I have a ticket open, but wonder if anyone seen the same?

hello there, i hope you can help me with this issue, i have a gateway to gateway VPN site configuration, the tunnel goes up and seems fine, however on the remote subnet some IP addresses are not reachable from my local LAN, these addresses are reachable when i ping them locally (at the remote site).setup:FGT80, Firmware 5.6.10 (also tried with 5.6.11) - local subnet 192.168.13.0/24FGT60, Firmware 6.0.6, remote subnet 172.16.16.0/24i'm using a routing based VPNpings works from the remote site to the local site. Diganostics:I've tried  tcp dump on the local fortigate lan interface to monitor icmp:FW (root) # diagnose sniffer packet LAN "icmp" interfaces=[LAN] filters=[icmp] 16.620849 192.168.13.103 -> 172.16.16.1: icmp: echo request 21.326596 192.168.13.103 -> 172.16.16.1: icmp: echo request 26.331553 192.168.13.103 -> 172.16.16.1: icmp: echo request 31.331637 192.168.13.103 -> 172.16.16.1: icmp: echo request trace route from the local host:Tracing route t

Hi All, I was wondering if anybody had any luck configuring Radius admin authentication to the Cisco SG-500 switches, or for that matter any of their "Small-Business" line? So far I have the switch configured as a Radius Client in FortiAuth, filtered down to a remote LDAP group. This works perfectly for allowing the login, but unfortunately the group members get privilege level 1, ie they have then elevate permissions using the Enable password. The old FortiAuth3.3 Interoperability Guide talks about configuring the FortiAuth to send Radius Attributed of "Cisco-AVPair = shell:priv-lvl=15" and "Service-Type = NAS-Prompt-User" to elevate permissions to priv levl 15 which bypasses Enable. (pg 44 - http://docs.fortinet.com/uploaded/files/1991/fortiauthenticator-two-factor-authentication-interoperability-guide.pdf) I cannot get this to work. I have found other forum posts that state the service-type needs to be "Administrative-User" but still no dice. My concern is that a pack

Good morning all, I am doing some work on a fortigate in a testbed environment and have noteiced that one of the VDOMS created has a red circle icon with a black dot in the middle when it is viewed in the VDOM drop down menu on the GUI. I cant figure out what this means, and have not been able to find a reference to it in the fortiOS cookbook. Is anybody able to enlighten me on what it means please? Thanks for your time 

Dear Brothers My company currently use several fortigate 100D firewall UTM devicesI need to upgrade to new model because atm the CPU of FGT always reachs high usage, and found that Fortigate 100F and Fortigate 200E meet requiments. Any body can give me that which model between them should be compatible for fortigate 100D replacement?Our company has 1000 CCU, fortigate device run webfilter, dlp, app control, Explicit proxy. We also have some ipsec vpn channel and web ssl vpn for 50 vpn clients. Thanks very much with best regards              

Hi there, Let me start off by saying I'm new to Fortigate. I just passe NSE-2 and are currently 'studying' NSE-3 and afterwards NSE-4. I work for a small service provider and kind of got the firewall thrown in my lap. Not that i mind, I like the challenge, but still there is a lot to learn... With that in mind, I ran in to a conundrum. One of our clients has 9 stores with customer counters. One of these stores cannot connect with the server for updates. They all go though the same FW... So i made a new policy for this location and get client-RST or Accept: IP connection error when using a laptop to go to the portal the counter should go. When I Telnet to the location I can reach it without problems or errors on the FW. Can anyone tell me what I can troubleshoot next? If anymore info is needed please tell me what you need. Thanks in advance

Hello I have passed the NSE7 certificate and managing to pass the NSE8 .Since there is not too much information \ material on this certificate , and no material in the network security academy , I wanted to ask here :- If anyone familiar with the material ?- Which products are involved in the NSE8 exam ?- Is it much difficult than the NSE7 exam ?- Does anyone familiar with sites that give courses and material on this exam ? NSE8 certified engineers , can you please share you experience at the NSE8 exam ? Thanks

Please, help me to find where I can get FW for my Fortigate 140D-POE-T1.There are no suitable image on donwload portal. 

Hello guys,We have URL filtering enabled on our fortigate, with specific user subnets having different URL filtering policies. These users have statically assigned IPs. But we now want to switch to dynamic addressing and using AD to group users. How do i integrate the AD to our fortigate and configure URL policies based on the groups defined in the AD Thanks.

Hi Guys, i need to configure a vpn site-to-site between Fortigate100E in HA and Azure . The Fortigate is set with 2 wans in load balancing .I want to know how to configure this vpn from the Firewall with two wans to Azure Cloud , in such a way that to have a high reliability of the vpn (in case one of the line is down  the vpn is routed to the other active line) . Firmware version of two firewalls is 6.0.2thanks for your support Antonio  

Hi, We have requirement to setup the connectivity on Fortigate as below: 1) We have our office in Country A and Country B. 2) We need to access a third party application hosted in Country C for which connectivity has been allowed by the third party application owner by whitelisting of Country B Fortigate WAN IP. 3) Our application hosted on servers hosted behind firewall in Country A has to access the application hosted in Country C via/through Country B firewall. Flow will be like: Request will be initiated by Country A servers towards the Country B firewall and then Country B firewall has to route the request to the Country C third party application using Country B firewall wan IP (because wan ip is whitelisted by application owner).Kindly please advise how to achieve this and what configuration is required on our Country A, Country B Fortigate firewall. As of now there is no connectivity established between Country A and Country B firewall.

Hello,I have a hub and spoke with three spokes. Everything is ok, clients from spokes networks can join each other and to the central network (ping, AD, SMB, DNS).From central, everythings is ok too.BUT ,from hubs and spokes CLI, i can't ping nothing but the local network.one hub can't ping other hub and ping other machine on a hub network or central network. For example, i can't redirect a hub log flow to the central syslog server.Can you help me? Thanks. 

Hi there, I found one of the WIFI mesh leaf APs got disconnected from time to time. when I check the status by using command:  "diagnose wireless-controller wlac -c wtp" I found the following msg: last failure : 7 -- Change state pending timer expired last failure param: N/A last failure time: Thu Sep 12 06:56:12 2019 I tried to google "7 -- Change state pending timer expired", it doesn't really help. Can someone tell me what that failure code really means? CheersJason 

Hi, I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls. So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat. testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"But I get no response. The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no differenceI cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not. I'm sure I'm just missing something, can someone here see any obvious signs?

Hi All, I have configured a redundant site to site IPSEC VPN between 2 FGT E units, both running 6.0.6. Basically, setup is as follows: Tunnel 1 - Site A ISP1 to Site B ISP1Tunnel 2 - Site A ISP2 to site B ISP1 To allow failover, administrative distance is set to 10 for each static route, and a priority is set to allow for an organized prioritization of tunnels. When this was originally set up in FortiOS 5.4, I used the following commands to customize the failover settings: dpd-retrycount 3dpd-retryinterval 3 REFERENCE ONLY: Please see this forum post made back in 2017 that helped me with that issue (thanks to neonbit and Mike for all the help - settings pretty much working up until today!) However, when trying to set up a new site, using the commanddpd-retrycount 3will not error out but it will not show up in the configuration. Furthermore, the failover does not work properly unless I purposely adddpd on-idle(which is supposedly a default settin

Hello guys,  we bought and installed the FG61E (6.0.3) + FortiCare license for 1year 8x5. Without UTM. We use only site2site IPsec. Is there any way to remove the error message (I mean those red ones) that the license expired? I have tried some tips from the forum: config system fortiguard    set antispam-force-off enable    set outbreak-prevention-force-off enable    set webfilter-force-off enable end unfortunately without success. This does not appear on version 5.6.7.  Thank you for the tips. Jirka

Hello, I have deployed a very simple traffic shaping policy, but when I issue the diag firewall shaper traffic-shaper command, I see wrong guaranteed bandwidth shown, which is different than what I have configured. The config is as follows: config system interface edit wan1 set estimated-up 250 set estimated-down 2024 end config firewall shaper traffic-shaper edit low set priority low next edit high set guaranteed 250 set priority high next end config firewall shaping-policy edit 1 set service ALL set dstintf wan1 set srcaddr xxx set dstaddr all set traffic-shaper high next edit 2 set service ALL set dstintf wan1 set srcaddr all set dstaddr all set traffic-shaper low next end My intention is to guarantee 250Kbps to traffic originating from srcaddr xxx. When I issue the diag firewall shaper traffic-shaper, I get: name low maximum-bandwidth 0 KB/sec guaranteed-bandwidth 0 KB/sec current-bandwidth 4 KB/sec priority 4 overhead 0 tos ff packets dropped 0 bytes dropped 0 name high maxi

Hello, While checking, it is seen that when an sslvpn client (using forticlient 6.0.6) starts a vpn request via the fortigate firewall towards the authentication(radius) server , instead of one there are two or sometimes three requests seen.eg. as below. 10.0.58.55  is the fortigate firewall & 10.1.4.21 is the authentication server. 4.355284 port3 out 10.0.58.55.12039 -> 10.1.4.21.1812: udp 126 9.360274 port3 out 10.0.58.55.12039 -> 10.1.4.21.1812: udp 126 Please assist. thanks.

Hello, Does any one know how to get a login banner for fortigate vpn client.(similar to ones in cisco anyconnect).Replacement messages are an option, but they do not seem to be for the client.verion - 6.2 Appreciate all help.

Hello to you all, I upgraded last week (5.6 -> 5.6.8 -> 5.6.11) The upgrade was completed normally. Then we rebooted MASTER and SLAVE once each (FailoverTest). The test was also completed normally. But I found a strange Crash Log. Signal 11 Log related to Hatalk occurred at the time of reboot of both equipment Crash log has occurred twice. I suspect BUG. If it's not BUG, I wonder why the symptoms occurred. Thanks crash log374: 2019-11-10 01:37:16 <00083> firmware FortiGate-200D v5.6.11,build1700b1700,190814 (GA) (Release) 375: 2019-11-10 01:37:16 <00083> application hatalk 376: 2019-11-10 01:37:16 <00083> *** signal 11 (Segmentation fault) received *** 377: 2019-11-10 01:37:16 <00083> Register dump: 378: 2019-11-10 01:37:16 <00083> RAX: 0000000000000000   RBX: 0000002a99f69000 379: 2019-11-10 01:37:16 <00083> RCX: 0000000002120fb0   RDX: 0000000002120fb0 380: 2019-11-10 01:37:16 <00083> R8:  0000

Hi,We have Fortinet 201E with LDAP configured. The web policy is configured based on user groups & AD is forwarding wrong user names to collector agent. Instead of logged in user, it is forwarding Domain\Administrator & the internet wont work for that user. We have upgraded the firmware to the latest & reinstalled latest FSSO agent. Still unable to resolve the issue. Request for helpThanks in advanceRegardsMurali S L