Solved

Hi folks, I'm a bit new to this, so hoping someone can help.  I have our SSL VPN set up and working decently well:  remote clients can access internal the (single) internal network resources, and also split tunnels through to external resources (e.g. AWS).  So that's working well.  The part I'm struggling with is getting the internal network to access VPN clients.   I have a policy set up as such:----------------------------------- Incoming Interface:  internalOutgoing Interface: SSL-VPN tunnel interface (ssl.root)Source: allDestination: VPN RangeSchedule: alwaysService: AllAction: Allow (This is in addition to the regular SSL-VPN -> internal/wan policies that are working as expected right now) Internal IP Range: 10.0.1.0/24VPN IP Range : 10.0.2.0/24 Ping from SSL VPN to Internal is fine (e.g. 10.0.2.123 -> 10.0.1.123)Ping from Internal to SSL VPN times out (e.g. 10.0.1.123 -> 10.0.2.123) When I ping from in

hello everybody I have a problem with looping through an SSL VPN connection. The goal should be to register via VPN to the first Fortigate and then to access the subnets of the second and third fortigate. Construction network: Modem with port forwarding of the VPN connection to the first Fortigate. Each fortigate defines and routes its own subnets. The connection to the second / third fortigate is created via a VLAN. on all fortigates runs RIPv2. on all fortigate's the addresses of the other fortigate's (subnets) are known. From each subnet of a fortigate, the subnetted of the other fortigate can be accessed. this works. VPN connection from an external PC to the first fortigate is established and access to the subnets works. However, I do not come with this vpn connection on the subnets of the other fortigate's. Where can I start for it? The whole thing is constructed as a ring network. later several fortigs will be connected to the ring.any ideas?  

Hi everyone.I have been working with fortimanager for a few days, right now I have a problem when a try to send the policy packages to the fortigates.The problem is that one of the interface´s settings  that I´ve configured is different between what the fortiManager tries to send and I dont now why.  

Fortigate 80C Firmware 5.0 I am having an issue trying to block youtube.com. [ul]I have the web-filter subscription.I have edited the Web filter profile to block all "Bandwidth consuming" sites (Streaming ect)Enabled website filter, *Youtube.com / Wildcard / Block / Enable. [/ul][ul]I have added Web filter to my policy for my network. (Internal 2 - WAN 1) I rebooted the Fortigate to ensure all sessions were stopped, so this could take effect. [/ul]People on the network are still accessing Youtube. Still no luck, Any assistance would be appreciated.  

Hi, FortiGate 200D - FortiOS v5.6.11 build1700 (GA). 5 wan connections.   Every 1-2 days some connections status changed to down. But the connections are up! If I change the detect server its OK.     After 1-2 days down again! change the detect server all OK. Example: Used 8.8.8.8 - OK, when down change to 8.8.4.4 - OK, when down back to 8.8.8.8, then 8.8.4.4 and so on... I tried few others Ip addresses as detect server same result.  Any idea?   Thanks, Lior. 

Has anyone created a script for importing a list of IP addresses to create Object Addresses within the FortiGate firewall? Ideally this script would allow for updates etc on a monthly basis. example list IP,Hostname,Interface 111.111.111.111,HOST-1,OUTSIDE 222.222.222.222,HOST-2,OUTSIDE 333.333.333.333,HOST-3,OUTSIDE to produce an output like the following: edit HOST-1 set type ipmask set subnet 111.111.111.111/255.255.255.255 set associated-interface OUTSIDE next edit HOST-2 set type ipmask set subnet 222.222.222.222/255.255.255.255 set associated-interface OUTSIDE next edit HOST-3 set type ipmask set subnet 333.333.333.333/255.255.255.255 set associated-interface OUTSIDE end

Is there an easy (preferrably, but anything goes..) way to cross-check any references to other items in the cli?I just realised I don't know any way to do this...Is it even possible?Grep doesn' count...:)

Hello, I have two fortigate routers on two sites. Between the sites I have an antenna connection. I would like to create an ipsec vpn, but instead of using internet and wan interfaces, I would like to create the ipsec using the internal interface and create it inside this antenna connection. Is this possible? if yes, how can I achieve it? Thanks.

Does anyone know if there a reason that the outbreak protection minimum interval is 15 minutes?   (This limit isn't documented in the CLI manual, but when you try to set it below this from the CLI it's blocked).   Outbreak protection seems like it would be a great feature if we could set it to 5 or even 10 minutes, but 15 minutes is just too long for end users... they end up screaming at the help desk looking for their messages, so we end up having to turn the outbreak protection off. A related question.... does anyone know if outbreak protection utilizes the sender reputation status to weigh against its findings?   If not this seems like it would be a good thing... Jeff

Hi there,           I'm still in the learning process of fortigate. I'm trying to setup a backup VPN tunnel. Now, I have a primary vpn tunnel from site A firewall to site B firewall. I will need a secondary vpn tunnel from site C firewall to site B firewall to turn on automatically whenever the primary connection is down. Both site A&C have 90D, site B has 60E. I know I'm supposed to setup some lower value in the setting, but not sure where I need to do it? phase 1 or 2 parameters? Or security policy? priority value of static route?          Also correct me if I'm wrong for the settings I need to do. 1. Using vpn wizard create vpn tunnel 2. setup ipv4 policy 3. setup security policy 4. setup static route               Thank you for your time and advice. Really appreciate it!! 

Hey everyone, I have what I consider a little bit of an odd routing situation and I am not sure if the Fortigate's support it and how you do it. I haven't found it in the manual yet. I have personally never run into it before but I can't believe it is uncommon today.  So here is the situation:[ul]We currently run 200D Fortigates on 6.0.X.At one of my locations I have a /29 on a WAN interface from our ISP.[ul]I need to add additional IPs and we would like to do it by adding another /29. (I don't even know what you call this technically.) This amounts to supporting two subnets on the same external/WAN interface. This is something I have never done before but I am aware it can be done on other hardware.[/ul]I saw some information for 4.x that appears to be relevant to internal routing but not from the outside in.[/ul]Our options are Two /29s as described above or move to a new /28 and change everything that is on the existing /29. I would rather avoid moving to the /28 as it mea

Let say I have file ID.txt that contain Indonesia ip subnet223.130.20.0/22 223.164.0.0/16 223.165.4.0/22 223.255.224.0/21it contains 2700 ips GOALS: 1. only allow SSH from those ID.txt2. block those ips that from Indonesia that doing Brute Force ssh attack with 5x consecutive failure QUESTIONS:1. How to achieve that tq

Hi everyone, We have a Memory Usage problem（89%） here . Our Fortigate 300D which version is 5.4.5. Here are the disa sys top-summary output: PID RSS ^CPU% MEM% FDS TIME+ NAME * 10368 522M 6.6 6.5 263 43:58.40 ipsmonitor [x5] 10395 18M 5.5 0.2 12 00:00.36 sshd [x4] 10385 104M 1.9 1.3 1772 01:31.78 wad [x5] 10386 35M 0.9 0.4 45 19:10.95 scanunitd [x4] 10388 57M 0.9 0.7 15 55:53.17 updated 10371 7M 0.0 0.1 12 01:38.19 fclicense 10372 28M 0.0 0.4 23 58:50.98 forticron 10373 10M 0.0 0.1 15 00:14.76 forticldd 10374 9M 0.0 0.1 42 00:23.81 authd [x3] 10369 7M 0.0 0.1 11 19:52.96 merged_daemons 10376 7M 0.0 0.1 9 00:00.00 httpclid 10377 7M 0.0 0.1 11 00:41.45 radius-das 10378 3G 0.0 [style="background-color: #ff0000;"]43.7[/style] 22 39:10.30 reportd 10379 20M 0.0 0.3 38 55:52.49 sslvpnd [x4] 10380 7M 0.0 0.1 11 01:40.00 info_sslvpnd 10370 9M 0.0 0.1 13 00:31.30 fnbamd 10382 780K 0.0 0.0 4 00:00.00 smbcd 10383 22M 0.0 0.3 122 42:22.91 proxyd [x3] 10384 11M

Hello Experts, I am a user of FGT60D which is deployed in proxy-mode as firewall only. No UTM services.I have not configured anything under Security Profiles Recently, after upgrading my ISP bandwidth from 120Mbps to 500Mbps I have noticed my FG is now a bottleneck.When I check Sessions widget in Dashboard I can see number of session and SPU 0.0%.Executing diagnose sys session list command I can see that none of the sessions if offloaded to SPU/NPU with lots of reasons like no_ofld_reason:  localno_ofld_reason:  non-npu-intf  When I connect directly to FG on DMZ port I get 100% of bandwidth.When I connect directly to FG on Port1 which is a trunk (native vlan + a few tagged vlans; FG is DHCP server), I get 35% of bandwidth does not matter in which vlan. My question is following:FG60D has NP4Lite NPU which should allow to offload most of firewall processing from CPU to NPU. I have never deactivated it, what should I do to take advantage of NPU offloadi

Dears , i have 3 internet sources in 3 WANs ... i need to direct the traffic of specific URL to a Specific WAN , is it possible ?  Thanks in advance :) 

hi there,we use FG-60D. all ports already configured as interface.we want to make 1 port can connect to multiple other ports.incoming port: Port_A10.10.10.X, gateway: 10.10.10.1other ports:Port_B: 192.168.10.X, gateway 192.168.10.1and WAN I want:on Port_A, destination to 192.168.10.10 and 192.168.10.11, will redirect to Port_B, and connect to 192.168.10.10 or 192.168.10.11. each destination has different service.for other destination, will connect to Internet over WAN I have configure:- IP Policy, Port_A to Port_B; with destination 192.168.10.10 and 192.168.10.11 (each destination has its policy)- IP Policy, Port_B to Port_A, with destination to all IP range on port_A and all services.- IP Policy, Port_A to WAN, source IP is Ip Range on Port_A, destination to all- Policy Route:Any port, Port_A with outgoing 192.168.10.10, 192.168.10.11 forward to port_B any port, Port_A to with outgoing all forward to WAN Am I miss something? Port_A can't connect to internet, n

Good afternoon, everyone! I've recently started supporting a new office that has the FortiWifi 60E firewall/wireless device and am very unfamiliar with this product. Our situation is that we have a business cable Internet connection coming into the building.  Sometimes this Internet connection will prove to be unstable and my client has had a few extended outages in the past. We have a secondary Internet connection that we would like to use in the event that the first Internet connection experiences an outage.  Since the DSL service is very poor in this area, my client has opted to go with a Verizon Wireless JetPack which will connect to a wireless bridge.  From the bridge is the ethernet port that we would like to connect to the second WAN port on the FortiWifi device. I've spent a few hours reading the documentation on how to configure the secondary Internet / WAN connection to work with this device and have found the instructions to be vague at bes

Hi All, Not sure if this is the correct place to ask, but i hope someone might be able to assist.In our current configuration, we are using Forticlient 6.0.3. They connect to a FortiGate 61E using SSL VPN.Some of our users are getting issues, that when they are working from home, they cannot access our company's network.We have multiple people with the same problem. Below is one of many issues we are facing at the moment:Person is in the office. Connects to our WIFI, which is not part of our internal network. Connects SSL VPN and is compliant. Can access our internal network. Person is at home. Connects to their home WIFI, which is not part of our internal network. Connects via SSL VPN and is compliant. Can not access our internal network. We are also facing below issue:Person is at home. Connects to their home WIFI, which is not part of our internal network. Connects via SSL VPN and is compliant according to the client and the admin portal from Fortigate. Can not a

Device: Fortiwifi 30E We have 2 locations that is connected together via P2P using Ubiquiti PBE-2AC-400.Location A - Main Office use Fortiwifi 30E with it's own internet connectionLocation B use TP-Link Archer D20 with it's own internet connection - Different IP Address. Now we have RDP's to Location B which is successfully running using our P2P connection and just adding secondary IP (IP range from main office) to client PC's (Location B).Our problem is every time we connect Location B to Location A. Location A (Fortiwifi 30E) automatically detects the IP address of the TP-LINK Router on location B and using location B's IP address range as it's DHCP.Question is How do we stop our fortinet device at main office from automatically detecting and using the IP address of Location B please?Not a network wizard so I am bumping into a wall here.

PATCH NOW if you are running 5.6.7 or lower!  2018-13379 is being actively exploited in the wild. Resolves the SSLVPN LDAP authentication issue that surfaced when Fortinet patched for CVE 2018-13379.  Also addresses other critical CVEs like 2018-13383 and 2018-13382. Release notes Patch successful in our HA environment, coming from 5.6.6.  We updated to 5.6.8 then 5.6.11 per the recommended upgrade path.

Hello ALL Community,  I have a new fortigate 300E and now i want to connect ISP to WAN port . but i didn't find any wan port in it. where are the wan ports in it ?  What are S1,S2 and VM1 and VM2 ports ? How should i Connect ISP to Fortigate300E ? Would be a great help in this regard.  thanks Usman Ali 

Hi, so I need to do a query that shows the app, user and the kind of threat. But the app and the user are on the "Traffic" kind log and the things related to threats are in another kind of log.So is it possible to join fields from one Log of certain kind to another of different kind?And if it's possible, how could it be done? Regards.

Hello,i need reboot slave in HA, how i proceed.Thanks

I need to install  FSSO agent & DC agent in secondary DC. in primary DC FSSO client is their & sync with fortigate   now we are installing DC FSSO agent on 2nd DC but we did not restart the DC its not sync with fortigate does restart is needed ? I just want to configure 2nd DC in fortigate in case primary fails. also at the time of installing collector agent we give option to select domain controller do we need to select both domain controller or only one that we installing the collector agent on. ( also user facing an issue after installing FSSO agent on 2nd Dc but haven't restart th DC system & does not sync with fortigate hence many user are losing internet access in middle on session does currently its uninstalled from secondary DC) Thanks in advance

I am new to the FortiManager. I;ve been working with Fortigate products for a long time but first time in fortimanager and with a new project that consists of over 30 100Ds and a few 900Ds Fortigates. What is the best practice to handle the interfaces for different products, do you create an interface Port1 for each of the models? or just Port1 and it is called in the policies and the packages that are destined to each model? Or do you create a Port1_100D and a Port1_900D in order to segregate them? Anybody has several models installed that can guide me to what has worked for you when it comes to mapping the ports? Thank you kindly.