Solved

Hello Experts, I am a user of FGT60D which is deployed in proxy-mode as firewall only. No UTM services.I have not configured anything under Security Profiles Recently, after upgrading my ISP bandwidth from 120Mbps to 500Mbps I have noticed my FG is now a bottleneck.When I check Sessions widget in Dashboard I can see number of session and SPU 0.0%.Executing diagnose sys session list command I can see that none of the sessions if offloaded to SPU/NPU with lots of reasons like no_ofld_reason:  localno_ofld_reason:  non-npu-intf  When I connect directly to FG on DMZ port I get 100% of bandwidth.When I connect directly to FG on Port1 which is a trunk (native vlan + a few tagged vlans; FG is DHCP server), I get 35% of bandwidth does not matter in which vlan. My question is following:FG60D has NP4Lite NPU which should allow to offload most of firewall processing from CPU to NPU. I have never deactivated it, what should I do to take advantage of NPU offloadi

Dears , i have 3 internet sources in 3 WANs ... i need to direct the traffic of specific URL to a Specific WAN , is it possible ?  Thanks in advance :) 

hi there,we use FG-60D. all ports already configured as interface.we want to make 1 port can connect to multiple other ports.incoming port: Port_A10.10.10.X, gateway: 10.10.10.1other ports:Port_B: 192.168.10.X, gateway 192.168.10.1and WAN I want:on Port_A, destination to 192.168.10.10 and 192.168.10.11, will redirect to Port_B, and connect to 192.168.10.10 or 192.168.10.11. each destination has different service.for other destination, will connect to Internet over WAN I have configure:- IP Policy, Port_A to Port_B; with destination 192.168.10.10 and 192.168.10.11 (each destination has its policy)- IP Policy, Port_B to Port_A, with destination to all IP range on port_A and all services.- IP Policy, Port_A to WAN, source IP is Ip Range on Port_A, destination to all- Policy Route:Any port, Port_A with outgoing 192.168.10.10, 192.168.10.11 forward to port_B any port, Port_A to with outgoing all forward to WAN Am I miss something? Port_A can't connect to internet, n

Good afternoon, everyone! I've recently started supporting a new office that has the FortiWifi 60E firewall/wireless device and am very unfamiliar with this product. Our situation is that we have a business cable Internet connection coming into the building.  Sometimes this Internet connection will prove to be unstable and my client has had a few extended outages in the past. We have a secondary Internet connection that we would like to use in the event that the first Internet connection experiences an outage.  Since the DSL service is very poor in this area, my client has opted to go with a Verizon Wireless JetPack which will connect to a wireless bridge.  From the bridge is the ethernet port that we would like to connect to the second WAN port on the FortiWifi device. I've spent a few hours reading the documentation on how to configure the secondary Internet / WAN connection to work with this device and have found the instructions to be vague at bes

Hi All, Not sure if this is the correct place to ask, but i hope someone might be able to assist.In our current configuration, we are using Forticlient 6.0.3. They connect to a FortiGate 61E using SSL VPN.Some of our users are getting issues, that when they are working from home, they cannot access our company's network.We have multiple people with the same problem. Below is one of many issues we are facing at the moment:Person is in the office. Connects to our WIFI, which is not part of our internal network. Connects SSL VPN and is compliant. Can access our internal network. Person is at home. Connects to their home WIFI, which is not part of our internal network. Connects via SSL VPN and is compliant. Can not access our internal network. We are also facing below issue:Person is at home. Connects to their home WIFI, which is not part of our internal network. Connects via SSL VPN and is compliant according to the client and the admin portal from Fortigate. Can not a

Device: Fortiwifi 30E We have 2 locations that is connected together via P2P using Ubiquiti PBE-2AC-400.Location A - Main Office use Fortiwifi 30E with it's own internet connectionLocation B use TP-Link Archer D20 with it's own internet connection - Different IP Address. Now we have RDP's to Location B which is successfully running using our P2P connection and just adding secondary IP (IP range from main office) to client PC's (Location B).Our problem is every time we connect Location B to Location A. Location A (Fortiwifi 30E) automatically detects the IP address of the TP-LINK Router on location B and using location B's IP address range as it's DHCP.Question is How do we stop our fortinet device at main office from automatically detecting and using the IP address of Location B please?Not a network wizard so I am bumping into a wall here.

PATCH NOW if you are running 5.6.7 or lower!  2018-13379 is being actively exploited in the wild. Resolves the SSLVPN LDAP authentication issue that surfaced when Fortinet patched for CVE 2018-13379.  Also addresses other critical CVEs like 2018-13383 and 2018-13382. Release notes Patch successful in our HA environment, coming from 5.6.6.  We updated to 5.6.8 then 5.6.11 per the recommended upgrade path.

Hello ALL Community,  I have a new fortigate 300E and now i want to connect ISP to WAN port . but i didn't find any wan port in it. where are the wan ports in it ?  What are S1,S2 and VM1 and VM2 ports ? How should i Connect ISP to Fortigate300E ? Would be a great help in this regard.  thanks Usman Ali 

Hi, so I need to do a query that shows the app, user and the kind of threat. But the app and the user are on the "Traffic" kind log and the things related to threats are in another kind of log.So is it possible to join fields from one Log of certain kind to another of different kind?And if it's possible, how could it be done? Regards.

Hello,i need reboot slave in HA, how i proceed.Thanks

I need to install  FSSO agent & DC agent in secondary DC. in primary DC FSSO client is their & sync with fortigate   now we are installing DC FSSO agent on 2nd DC but we did not restart the DC its not sync with fortigate does restart is needed ? I just want to configure 2nd DC in fortigate in case primary fails. also at the time of installing collector agent we give option to select domain controller do we need to select both domain controller or only one that we installing the collector agent on. ( also user facing an issue after installing FSSO agent on 2nd Dc but haven't restart th DC system & does not sync with fortigate hence many user are losing internet access in middle on session does currently its uninstalled from secondary DC) Thanks in advance

I am new to the FortiManager. I;ve been working with Fortigate products for a long time but first time in fortimanager and with a new project that consists of over 30 100Ds and a few 900Ds Fortigates. What is the best practice to handle the interfaces for different products, do you create an interface Port1 for each of the models? or just Port1 and it is called in the policies and the packages that are destined to each model? Or do you create a Port1_100D and a Port1_900D in order to segregate them? Anybody has several models installed that can guide me to what has worked for you when it comes to mapping the ports? Thank you kindly.

i want to setup an ipsec tunnel adjusted for stability and best performance/throughput, ignoring security. the security is not a requirement here fortigate 200e. what's the best settings and proposal needed for best performance and stability, while ignoring security? thank you

Just FYI in case you might encounter this situation in the future and I didn't find any in the forum. I've been testing IKEv2 IPSec VPN between FG1500D and Cisco 1941 but couldn't bring it up when 1941 was placed behind a NAT device (means Cisco is the initiator). In addition to NAT-T, the problem comes with Cisco's static-VTI/route-based IPSec (Tunnel0 interface). If I use crypto-map(policy-based) it comes up with FG's route/interface-based IPSec.Today, I got both Cisco TAC and Fortinet TAC on a call w/ remote access to my PC then we concluded that Cisco sends out all Configuration Payload request options regardless they're relevant to the setup or not, and FG is trying to process them, like IP/DNS requests, although those are relevant only for "dial-up" vpn then drops the request because "mode-cfg" is not enabled (not needed for site-to-site static vpn). Based on the original RFC, the recipient is supposed to be returning an error reply if it's not relevant instead of drop the r

Hi all, Checked other forum threads, but found only one mention here https://forum.fortinet.com/tm.aspx?m=142160 and it is not answered.Basically we have just purchased a pair of Fortigate 60E firewalls that we would like to use for site-to-site IPSec VPN.So I set them up sitting next to each other connected via a patch cable. I used VPN Wizard, everything seems to have started working ok, however. I am using a cisco switch as a client on one side and a mac laptop on the other. I run continuous ping from Mac to the switch and it appears to be working fine, no timeouts or lost packets. Same thing done from switch side towards Mac looks similarly ok, however if I run a ping with say 10000 repetitions, that shows issues: Type escape sequence to abort.Sending 10000, 100-byte ICMP Echos to 172.11.11.99, timeout is 2 seconds:!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Is there an equivalent of a Cisco SVI interface on a Fortigate switch? If so, can someone direct me to documentation? I have looked over the cook books; however, I am not seeing what I want or need. Maybe I do not speak Fortinet/Fortiswitch yet.

Hi there, i got a problem with a Fortinet FortiGate 600C. My fortigate wont boot up and I try to console with putty I get FortiGate-600C (20:43-08.19.2014) Ver:04000023 Serial number:FG600C RAM activation --------------------------------------------------- Stuck on "RAM activation" and not resume to like on technical document FortiGate-200D (18:47-05.08.2013) Ver:04000006 Serial number:FG200D4613800892 RAM activation CPU(00:000206a7 bfebfbff): MP initialization CPU(02:000206a7 bfebfbff): MP initialization Total RAM: 2048MB Enabling cache...Done. Scanning PCI bus...Done. Allocating PCI resources...Done. Enabling PCI resources...Done. Zeroing IRQ settings...Done. Verifying PIRQ tables...Done. Boot up, boot device capacity: 15272MB. Press any key to display configuration menu... Is there any solution? Thanks

Hello I'm beginner with fortinet product. I try to configure my FortiGate 50E. I configure the vpn. I can connect with FortiClient VPN without problems.. on the Fortigate On dns I specify my dns server as primary server and the Local Domain Name. On my remote pc , When I'm connected with the VPN I ping the DNS server with ip adress but not with his name.if I make a nsloockup MYserver I got this : nslookup MYserver Serveur :   fortinet-public-dns-53.fortinet.com Address:  208.91.112.53 *** fortinet-public-dns-53.fortinet.com ne parvient pas à trouver hellboy : Non-existent domain Did you have an idea ?Regards

I am using IPS signatures filtered by operating system and target = Client to protect my clients.I thought that with this policy I could prevent and detect botnets and attacks to my clients when they browse the Internet.But now I see that most Botnets signatures have a target = Server, so they don't apply to the policy I use with my clients. For example, I wanted protection against the Emotet Trojan, but the signature is target = Server In this document https://www.fortinet.com/blog/threat-research/deep-dive-into-emotet-malware.html you can read: "Fortinet has also developed an IPS signature named “Emotet.Botnet” to detect the traffic between the C2 server and the infected machine".  So, the infected machine is a client, why is the signature defined with the target "Server"?How should I use the Signature target to configure IPS?Thanks https://fortiguard.com/encyclopedia/ips/33105Emotet.Cridex.BotnetDescription This indicates that a system might be infected

Hello, we are running on FortiOS 5.6.3.I try to use nested LDAP Groups for Authentication.Users Accounts are member of the LDAP Group: "GL_SSLVPN"Global Group is member of "L_SSLVPN" Group The  "L_SSLVPN" Group should be authenticated in Fortigate. As discribes here:http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD37091 the follwing Settings should be made:config user ldap edit "example.local" set group-member-check user-attr set search-type nested next end But the "set search-type nested" value is not available in FortiOS 5.6.Any idea how to implement nested LDAP Groups now, or isn't this possible anymore? Regards Thomas

I have no Internet access out from a vlan. I would just allow certain URLs to be allowed.I have created a policy that I have added a Web Filter to.In the Webfiler I have added Static URLs. For example:URL *mcdonalds.comType WildcardAction AllowStatus Enable I end the Statatic URL with:URL *Type WildcardAction BlockStatus Enable Is this the right way to do it?If the request matches this policy source, destination etc it looks like the last * Block stops the request from continuing go throw other policies.  Fortios 5.6.9

Hi All,  Fortigate 60D v5.2.4(Build688) I've had a bit of a google and it appears it should be possible to setup my VDOMs to log to multiple Syslog servers, but I am struggling to find out how to get this working. I have overridden the global syslog settings to allow me to log per VDOM and this is working. Under the global config I get the option to configure syslogd, syslogd2 and syslogd3, but under the VDOM, I only get the option for syslogd.  VDOM options: FIREWALL (root) # config log custom-field Configure custom log fields. eventfilter Configure log event filters. fortianalyzer Configure first FortiAnalyzer device. fortiguard Configure log for FortiGuard. gui-display Configure log GUI display settings. memory Configure memory log. setting Configure general log settings. syslogd Configure first syslog device. threat-weight Configure threat weight settings. Global options: FIREWALL (global) # config log fortianalyzer Configure first Forti

Hi I cannot get DHCP server to work on a software switch, configured like this: config system switch-interface    edit "soft_switch"  set vdom root        set member "Vlan16" "VxLan-IPsec-DR"        set intra-switch-policy explicit    nextend Computer configured with static IP, then I can ping 172.16.0.1, so the interface and VLAN works. Why do I not get an DHCP address? See images FortiGate 30E v6.0.4 build0231 (GA) /Kim

Hello! I have DHCP Server enabled on 'internal' interface [Hardware switch] at Fortigate 60E, FortiOS 6.2.0 build0866 (GA).I had ca. 100 entries at 'IP Address Assignment Rules' and I wanted to check my VOIP phones addresses so I searched them by the IP '10.100.250.' I got list, check what I wanted to check and click OK at the bottom of site. Next time I entered this site I had only those 8 entries and no chance to get my other entries back. I cleared colums filters and so on, nothing works. How can I get my entries back? I have backup, so not a big problem, but I want to prevent this in future. Filtering deletes other entries? Bug or normal behavior? Greetings!

Hi i have installed FortiAuthenticator and setted it up as Radius server according to Cookbok.trying to connect to it from Fortigate, and i can't, got error.It is successfuly get users from LDAP server, everything cool.I have scanned ports from outside - RADIUS port closed, but it is opened on FORTIGATE, i mean policies ALLOWED everything to this Fortiaythenticator and everything from it.Ssh, ping, everything works fine.Anybody knows how to troubleshoot it? Radius doesnt works :(Thank you!