Solved

Hi All, I was wondering if anybody had any luck configuring Radius admin authentication to the Cisco SG-500 switches, or for that matter any of their "Small-Business" line? So far I have the switch configured as a Radius Client in FortiAuth, filtered down to a remote LDAP group. This works perfectly for allowing the login, but unfortunately the group members get privilege level 1, ie they have then elevate permissions using the Enable password. The old FortiAuth3.3 Interoperability Guide talks about configuring the FortiAuth to send Radius Attributed of "Cisco-AVPair = shell:priv-lvl=15" and "Service-Type = NAS-Prompt-User" to elevate permissions to priv levl 15 which bypasses Enable. (pg 44 - http://docs.fortinet.com/uploaded/files/1991/fortiauthenticator-two-factor-authentication-interoperability-guide.pdf) I cannot get this to work. I have found other forum posts that state the service-type needs to be "Administrative-User" but still no dice. My concern is that a pack

Good morning all, I am doing some work on a fortigate in a testbed environment and have noteiced that one of the VDOMS created has a red circle icon with a black dot in the middle when it is viewed in the VDOM drop down menu on the GUI. I cant figure out what this means, and have not been able to find a reference to it in the fortiOS cookbook. Is anybody able to enlighten me on what it means please? Thanks for your time 

Dear Brothers My company currently use several fortigate 100D firewall UTM devicesI need to upgrade to new model because atm the CPU of FGT always reachs high usage, and found that Fortigate 100F and Fortigate 200E meet requiments. Any body can give me that which model between them should be compatible for fortigate 100D replacement?Our company has 1000 CCU, fortigate device run webfilter, dlp, app control, Explicit proxy. We also have some ipsec vpn channel and web ssl vpn for 50 vpn clients. Thanks very much with best regards              

Hi there, Let me start off by saying I'm new to Fortigate. I just passe NSE-2 and are currently 'studying' NSE-3 and afterwards NSE-4. I work for a small service provider and kind of got the firewall thrown in my lap. Not that i mind, I like the challenge, but still there is a lot to learn... With that in mind, I ran in to a conundrum. One of our clients has 9 stores with customer counters. One of these stores cannot connect with the server for updates. They all go though the same FW... So i made a new policy for this location and get client-RST or Accept: IP connection error when using a laptop to go to the portal the counter should go. When I Telnet to the location I can reach it without problems or errors on the FW. Can anyone tell me what I can troubleshoot next? If anymore info is needed please tell me what you need. Thanks in advance

Hello I have passed the NSE7 certificate and managing to pass the NSE8 .Since there is not too much information \ material on this certificate , and no material in the network security academy , I wanted to ask here :- If anyone familiar with the material ?- Which products are involved in the NSE8 exam ?- Is it much difficult than the NSE7 exam ?- Does anyone familiar with sites that give courses and material on this exam ? NSE8 certified engineers , can you please share you experience at the NSE8 exam ? Thanks

Please, help me to find where I can get FW for my Fortigate 140D-POE-T1.There are no suitable image on donwload portal. 

Hello guys,We have URL filtering enabled on our fortigate, with specific user subnets having different URL filtering policies. These users have statically assigned IPs. But we now want to switch to dynamic addressing and using AD to group users. How do i integrate the AD to our fortigate and configure URL policies based on the groups defined in the AD Thanks.

Hi Guys, i need to configure a vpn site-to-site between Fortigate100E in HA and Azure . The Fortigate is set with 2 wans in load balancing .I want to know how to configure this vpn from the Firewall with two wans to Azure Cloud , in such a way that to have a high reliability of the vpn (in case one of the line is down  the vpn is routed to the other active line) . Firmware version of two firewalls is 6.0.2thanks for your support Antonio  

Hi, We have requirement to setup the connectivity on Fortigate as below: 1) We have our office in Country A and Country B. 2) We need to access a third party application hosted in Country C for which connectivity has been allowed by the third party application owner by whitelisting of Country B Fortigate WAN IP. 3) Our application hosted on servers hosted behind firewall in Country A has to access the application hosted in Country C via/through Country B firewall. Flow will be like: Request will be initiated by Country A servers towards the Country B firewall and then Country B firewall has to route the request to the Country C third party application using Country B firewall wan IP (because wan ip is whitelisted by application owner).Kindly please advise how to achieve this and what configuration is required on our Country A, Country B Fortigate firewall. As of now there is no connectivity established between Country A and Country B firewall.

Hello,I have a hub and spoke with three spokes. Everything is ok, clients from spokes networks can join each other and to the central network (ping, AD, SMB, DNS).From central, everythings is ok too.BUT ,from hubs and spokes CLI, i can't ping nothing but the local network.one hub can't ping other hub and ping other machine on a hub network or central network. For example, i can't redirect a hub log flow to the central syslog server.Can you help me? Thanks. 

Hi there, I found one of the WIFI mesh leaf APs got disconnected from time to time. when I check the status by using command:  "diagnose wireless-controller wlac -c wtp" I found the following msg: last failure : 7 -- Change state pending timer expired last failure param: N/A last failure time: Thu Sep 12 06:56:12 2019 I tried to google "7 -- Change state pending timer expired", it doesn't really help. Can someone tell me what that failure code really means? CheersJason 

Hi, I am setting up a new 30E firewall for a small office and for once I had some time on my hands so I thought I would play around a little bit with the rest API for learning purposes since it would help out with managing other firewalls. So I read through the reference guide http://docs.fortinet.com/d/fortiweb-5.5-restful-api-reference which seems pretty straight forward. However I get stuck right from the bat. testing out the initial example: curl -H "Authorization: YWRtaW46" -k "https://172.22.10.74:90/api/v1.0/System/Network/StaticRoute"But I get no response. The firewall arrived with fortios v5.4.1 which I think has api v2 so I tried changing the url accordingly but with no differenceI cannot find anywhere to verify which api version my firewall is using, also I am lacking information in the reference guide on weather I have to manually enable the api or not. I'm sure I'm just missing something, can someone here see any obvious signs?

Hi All, I have configured a redundant site to site IPSEC VPN between 2 FGT E units, both running 6.0.6. Basically, setup is as follows: Tunnel 1 - Site A ISP1 to Site B ISP1Tunnel 2 - Site A ISP2 to site B ISP1 To allow failover, administrative distance is set to 10 for each static route, and a priority is set to allow for an organized prioritization of tunnels. When this was originally set up in FortiOS 5.4, I used the following commands to customize the failover settings: dpd-retrycount 3dpd-retryinterval 3 REFERENCE ONLY: Please see this forum post made back in 2017 that helped me with that issue (thanks to neonbit and Mike for all the help - settings pretty much working up until today!) However, when trying to set up a new site, using the commanddpd-retrycount 3will not error out but it will not show up in the configuration. Furthermore, the failover does not work properly unless I purposely adddpd on-idle(which is supposedly a default settin

Hello guys,  we bought and installed the FG61E (6.0.3) + FortiCare license for 1year 8x5. Without UTM. We use only site2site IPsec. Is there any way to remove the error message (I mean those red ones) that the license expired? I have tried some tips from the forum: config system fortiguard    set antispam-force-off enable    set outbreak-prevention-force-off enable    set webfilter-force-off enable end unfortunately without success. This does not appear on version 5.6.7.  Thank you for the tips. Jirka

Hello, I have deployed a very simple traffic shaping policy, but when I issue the diag firewall shaper traffic-shaper command, I see wrong guaranteed bandwidth shown, which is different than what I have configured. The config is as follows: config system interface edit wan1 set estimated-up 250 set estimated-down 2024 end config firewall shaper traffic-shaper edit low set priority low next edit high set guaranteed 250 set priority high next end config firewall shaping-policy edit 1 set service ALL set dstintf wan1 set srcaddr xxx set dstaddr all set traffic-shaper high next edit 2 set service ALL set dstintf wan1 set srcaddr all set dstaddr all set traffic-shaper low next end My intention is to guarantee 250Kbps to traffic originating from srcaddr xxx. When I issue the diag firewall shaper traffic-shaper, I get: name low maximum-bandwidth 0 KB/sec guaranteed-bandwidth 0 KB/sec current-bandwidth 4 KB/sec priority 4 overhead 0 tos ff packets dropped 0 bytes dropped 0 name high maxi

Hello, While checking, it is seen that when an sslvpn client (using forticlient 6.0.6) starts a vpn request via the fortigate firewall towards the authentication(radius) server , instead of one there are two or sometimes three requests seen.eg. as below. 10.0.58.55  is the fortigate firewall & 10.1.4.21 is the authentication server. 4.355284 port3 out 10.0.58.55.12039 -> 10.1.4.21.1812: udp 126 9.360274 port3 out 10.0.58.55.12039 -> 10.1.4.21.1812: udp 126 Please assist. thanks.

Hello, Does any one know how to get a login banner for fortigate vpn client.(similar to ones in cisco anyconnect).Replacement messages are an option, but they do not seem to be for the client.verion - 6.2 Appreciate all help.

Hello to you all, I upgraded last week (5.6 -> 5.6.8 -> 5.6.11) The upgrade was completed normally. Then we rebooted MASTER and SLAVE once each (FailoverTest). The test was also completed normally. But I found a strange Crash Log. Signal 11 Log related to Hatalk occurred at the time of reboot of both equipment Crash log has occurred twice. I suspect BUG. If it's not BUG, I wonder why the symptoms occurred. Thanks crash log374: 2019-11-10 01:37:16 <00083> firmware FortiGate-200D v5.6.11,build1700b1700,190814 (GA) (Release) 375: 2019-11-10 01:37:16 <00083> application hatalk 376: 2019-11-10 01:37:16 <00083> *** signal 11 (Segmentation fault) received *** 377: 2019-11-10 01:37:16 <00083> Register dump: 378: 2019-11-10 01:37:16 <00083> RAX: 0000000000000000   RBX: 0000002a99f69000 379: 2019-11-10 01:37:16 <00083> RCX: 0000000002120fb0   RDX: 0000000002120fb0 380: 2019-11-10 01:37:16 <00083> R8:  0000

Hi,We have Fortinet 201E with LDAP configured. The web policy is configured based on user groups & AD is forwarding wrong user names to collector agent. Instead of logged in user, it is forwarding Domain\Administrator & the internet wont work for that user. We have upgraded the firmware to the latest & reinstalled latest FSSO agent. Still unable to resolve the issue. Request for helpThanks in advanceRegardsMurali S L

Hi folks, I'm a bit new to this, so hoping someone can help.  I have our SSL VPN set up and working decently well:  remote clients can access internal the (single) internal network resources, and also split tunnels through to external resources (e.g. AWS).  So that's working well.  The part I'm struggling with is getting the internal network to access VPN clients.   I have a policy set up as such:----------------------------------- Incoming Interface:  internalOutgoing Interface: SSL-VPN tunnel interface (ssl.root)Source: allDestination: VPN RangeSchedule: alwaysService: AllAction: Allow (This is in addition to the regular SSL-VPN -> internal/wan policies that are working as expected right now) Internal IP Range: 10.0.1.0/24VPN IP Range : 10.0.2.0/24 Ping from SSL VPN to Internal is fine (e.g. 10.0.2.123 -> 10.0.1.123)Ping from Internal to SSL VPN times out (e.g. 10.0.1.123 -> 10.0.2.123) When I ping from in

hello everybody I have a problem with looping through an SSL VPN connection. The goal should be to register via VPN to the first Fortigate and then to access the subnets of the second and third fortigate. Construction network: Modem with port forwarding of the VPN connection to the first Fortigate. Each fortigate defines and routes its own subnets. The connection to the second / third fortigate is created via a VLAN. on all fortigates runs RIPv2. on all fortigate's the addresses of the other fortigate's (subnets) are known. From each subnet of a fortigate, the subnetted of the other fortigate can be accessed. this works. VPN connection from an external PC to the first fortigate is established and access to the subnets works. However, I do not come with this vpn connection on the subnets of the other fortigate's. Where can I start for it? The whole thing is constructed as a ring network. later several fortigs will be connected to the ring.any ideas?  

Hi everyone.I have been working with fortimanager for a few days, right now I have a problem when a try to send the policy packages to the fortigates.The problem is that one of the interface´s settings  that I´ve configured is different between what the fortiManager tries to send and I dont now why.  

Fortigate 80C Firmware 5.0 I am having an issue trying to block youtube.com. [ul]I have the web-filter subscription.I have edited the Web filter profile to block all "Bandwidth consuming" sites (Streaming ect)Enabled website filter, *Youtube.com / Wildcard / Block / Enable. [/ul][ul]I have added Web filter to my policy for my network. (Internal 2 - WAN 1) I rebooted the Fortigate to ensure all sessions were stopped, so this could take effect. [/ul]People on the network are still accessing Youtube. Still no luck, Any assistance would be appreciated.  

Hi, FortiGate 200D - FortiOS v5.6.11 build1700 (GA). 5 wan connections.   Every 1-2 days some connections status changed to down. But the connections are up! If I change the detect server its OK.     After 1-2 days down again! change the detect server all OK. Example: Used 8.8.8.8 - OK, when down change to 8.8.4.4 - OK, when down back to 8.8.8.8, then 8.8.4.4 and so on... I tried few others Ip addresses as detect server same result.  Any idea?   Thanks, Lior. 

Has anyone created a script for importing a list of IP addresses to create Object Addresses within the FortiGate firewall? Ideally this script would allow for updates etc on a monthly basis. example list IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2,OUTSIDE 333.333.333.333,HOST-3,OUTSIDE to produce an output like the following: edit HOST-1 set type ipmask set subnet 111.111.111.111/255.255.255.255 set associated-interface OUTSIDE next edit HOST-2 set type ipmask set subnet 222.222.222.222/255.255.255.255 set associated-interface OUTSIDE next edit HOST-3 set type ipmask set subnet 333.333.333.333/255.255.255.255 set associated-interface OUTSIDE end