Solved

Hi there, i want to reboot my FortiGate 60E via the REST-API. Im using this endpoint: doing this Request(obviously already authenticated):curl -k -i -H "Accept: application/json" -X POST "https://ip:port/api/v2/monitor/system/os/reboot" --cookie cookie.txt But I receive a Forbidden: {  "http_method":"POST",  "status":"error",  "http_status":403,  "vdom":"root",  "path":"system",  "name":"os",  "action":"reboot",  "serial":"serial",  "version":"v6.0.5",  "build":268} How do I reboot the FortiGate via REST API? PS: Im trying this with a user who has RW permission on all CategorysThank you!

Hello, I tried several VPN setting and have a lot of problem with all of these.The requirements are many:* Navigate through the local gateway (Split tunneling)* Communicate from lan to remote clients* Communicate from remote clients to lan I have created finally a VPN for FortiClient, following the Wizard, and using split tunneling.From the fortigate, I can ping to everything.From a remote device, I can ping to local deviceFrom a local device, I cannot ping to remote device. The wizard just created for me a rule, which allows traffic from VPN clients to Local Clients, with the NAT enabledI created the reverse rule, to allow everything from lan to VPN clients (using the VPN interface as outgoing interface, and using the VPN range as destination addresses), I tried with and without NAT, just in case, still the same: ping to remote devices never returns Any idea?Thanks in advance.Regards,Damián

I've got a IPsec Tunnel that I want to disable for 1 month.  How can you disable the tunnel w/o removing the tunnel from the configuration? Ver 5.6.5 Thanks!Dan

Hi All, I believe I know the answer to this already but... Is it possible to configure multiple vpn's via a "batch job" on a FortiGate 200E?

Hello, I have a Fortigate 90D (Firmware Version: 5.4.10,build1220) with the following configuration:wan1 - connected to cable ISPwan2 - connected to 4G ISP I want all internet traffic to go through wan1, unless wan1 loses internet connection. In that case, I'd like to failover to wan2. I added 2 static routes (1 for each interface ) and set the Administrative Distance of both to 10. I set the priority of wan1 to 0 and set the priority of wan2 to 10. I then set a link-monitor with the following configuration:ROUTER (link-monitor) # sh full-configurationconfig system link-monitor    edit "Wan1Failover"        set srcintf "wan1"        set server "8.8.8.8"        set protocol ping        set gateway-ip <gateway ip omitted>        set source-ip 0.0

Hello.I tried to debug non-working VPN tunnel and suspect there is PSK mismatch.Fortigate doc says: "It is possible to identify a PSK mismatch using the following combination of CLI commands:diag debug app ike filter name "phase1-name"...I got an error after this command, "command parse error before 'name'", why ? Are there any ways to do this ?My Fortigate version is v5.6.4

Hi,Pfa an elaborated network diagram. Firewall FGT100D at Site 2 act as a router only. FGT600c at Site 1 Headoffice side has been used for firewall permissions with different policies created for Site_2. Now the issue is with the routing that when we use NAT at Site_2 it won't show desktops local lan IP at Site_1 firewall FGT600c, it just shows the wan side ip i.e., 17.17.17.2 or 18.18.18.2 of the Site_2 Firewall and the IP based policy won't work. Disabling NAT doesn't let internet work on desktops but it shows connectivity at Site_2 Firewalls terminal window and can ping gmail.com/yahoo etc.Please help.*SDWAN is enabled at Site_2 and P2P lease lines act as 2 wan connections.*D235 mentioned in diagram is equivalent to Site_2 RegardsRohit K

Hi,I have an issue with RADIUS authentication between the 2 devices in subject and a RADIUS server on Windows 2008. I`ve configured this on the fortigate:  config wireless-controller vap edit vap1 set radius-mac-auth enable set radius-mac-auth-server 192.168.1.95 end And on the Windows side I`ve configured NPS like this:And configured usernames as MAC address in several syntaxesi.e. xxxxxxxxxxxx XXXXXXXXXXXXxx-xx-xx-xx-xx-xxXX-XX-XX-XX-XX  Windows gave me this  while fortigate gave me this:  Any advice? Thanks

Dear experts i have a fortigate firewall and also a Cisco Firewall (FTD) and i m planning for fortinet Sandboxing solution will Cisco FTD firewall  will work with Fortinet Sandboxing, please confirm. thanks

Hello everyone ,  I'm new here and it may be a silly question but i didn't find anything on the internet .  Can someone explain me what is the differance between the "Install Packege&Device setting" and the "Install Device setting(only)" ?   What does the "Device setting" mean ?  i thougt that this is the configuration that was on the "Device manager" but it seems that there is also "Install Config" .  Can anyone clear things out for me ?  Thank you :)

I have a FortiGate 50E with a FortiSwitch 124E-FPOE I have a client subnet on the switch with my clients, a NAS and a printerIn addition, i have a vlan for VoIP and IPSec VPNI can ping across all all Subnets, but not within the client subnet. e.g. client to printerI can ping from outside the client subnet (from Wlan, from IPSec etc) to the NAS and the printer I can ping from my client subnet to all other subnetsBut I can not ping from the client subnet to other systems in the client subnet.What do i need to change?

Hi, i gotta a question when an user is member of two LDAP groups and both groups has different portal in teh SSL VPN, each one with different range of addres.My question is, when the user log in, to which group belong? REgards

Hello,I'm trying to upload a script via the web interface but the script keeps on failing and i don't know why. Here is the script :  config vdom edit Hubconfig vpn ipsec phase1-interfaceedit "0630000X-tun1"set interface "wan2"set nattraversal disableset authmethod pskset remote-gw <hidden-IP>set psksecret <somelongpassword>nextendend When I type the same commands line by line under CLI through SSH everything goes well... I have enabled "diagnose debug" and set it to "cli 7", here is the output of the script : 0: config vdom 0: edit Hub0: 0: config vpn ipsec phase1-interface0: edit "0630000X-tun1"0: set interface "wan2"0: set nattraversal disable0: set authmethod psk0: set remote-gw <hidden-IP>0: set psksecret <somelongpassword>1: next0: end0: 0: end Do you have any idea please ?Sincerely, Hardware: FG200E v5.6.9 build1673

Greetings, Our faithful 1500D currently fails over to our T1 (phone) when our cable connection dies, which does occur from time to time. Since we need 24/7 uptime and we process credit cards we need 24/7 SLA. I do not need load balancing nor want to discuss it - thanks. I really want to pursue alternatives given we are having issues with our T1 provider....or, they are having issues and I'm sick of being reliant on another stack of managed gear I don't own with a revolving gear of support techs. I see hotpots used more and more and enterprise level failovers and looking for suggestions / pitfalls for coupling with my 1500D. 

Hi allI am new to Fortigate (this is also my 1st post to the forum) and attempted to setup FSSO. I followed the steps as described in this link (http://cookbook.fortinet.com/providing-single-sign-using-ldap-fsso-agent-advanced-mode-expert/), hiowever after completing all the steps - I can see the logins from my users in the FSSO agent installed on the DC, however I am seeing nothing on Fortigate. There is no user entry under "User & Device > Monitor > Firewall" - and from CLI I get the below: # diagnose debug authd fsso list----FSSO logons----Total number of logons listed: 0, filtered: 0----end of FSSO logons---- Did I miss something or do something wrong? Any advice welcome.

Hi all,On my 100E I ran an update from 6.02 to 6.04 and after the reboot, the web GUI was not available. Running a scan of the ports confirms that HTTPS isn't responding. The firewall appears to be functioning properly otherwise.I was able to access the CLI via the MGMT port, and confirmed that HTTPS was allowed on all the interfaces that I was trying.In Forticloud, under management\config, it has a message saying "device config version does not match device firmware version v6.0.4, build 0231." The device config version is still showing as 6.0.2, but the firmware version is 6.0.4.I'm unable to access the console at the moment (lost cable, looking for another). Does anyone have any thoughts?

Hello, Since FortiConverter is not a free tool, any advise for migrating from Cisco ASA to FortiGate smoothly?   

Introducing FortiMail 6.2FortiMail 6.2.0 has been approved and is being distributed to the support site.  This release adds several new features including:  MS Office 365 Active Threat Remediation FortiMail can now perform post-delivery on-demand scan of the email on MS Office 365 out of band using the MS Graph API (License required). Real-time scan will be added in future releases.  FortiIsolator integration FortiMail is now able to participate in the security fabric with FortiIsolator.  FortiMail can rewrite URLs on a per category basis to FortiIsolator for zero trust browser isolation. Fortinet Security Fabric Added support for the new security fabric integration using in FortiOS 6.2. Note that previous integration with FortiOS 6.0 is no longer supported. Compliance enhancements In order to comply with compliance standards such as GDPR, the following new features have been added: - Detailed  log of all configuration changes - Detailed  lo

Hi there,             I'm new to this community and fortigate. I have a question about sending syslog from public ip router to private ip solarwinds. The port for syslog is UDP 514 and it's already open in fortigate. In order to send syslog from a public ip to a private ip, what else do i need to do? Do I need to setup IPv4 policy? I never used fortigate before, so please forgive if question is stupid. Any advice would be helpful. Thank you!!

Hello guys, I have a VMware ESXi Server on my office, running FortiDDoS v5.2.0 just for testing and personal lab.I tried the same method to create management ip interface by typing "config system interface" then "edit mgmt1" then "set ip/netmask" etc.. but when i finish them all, and when i type "end" top save and exit, the system says "the attribute "type" must be set". i know what that means if that on fortigate, means the type of that interface, like vlan or anything else.. but when i typed "?" after i typed "set", there is no type.. and i tried type it manually, still cant.. i search at the fortiddos handbook, i follow the steps, there is no type.. but the system wont save the config unless i define the interface type.. So now, i cant access the GUI and dont know the management ip is.. i cant even change the mode to dynamic.. the system only gives static mode... i also done defining the gateway. Can someone help and explain to me? i tried reboot and change version to

Hi All Community,  I have a question about License renewal of fortigate Secutiy services, As we are using sonicwall and every 1 or 2 year we need to renew license for the services like content filter , Nodes/user, App control, content filtereing client, DPI SSL, DPI SSH, Boltel Filter and many more security services,  My Question is if i moved to Fortigate from sonicwall do i also need to renew security services after every specific time period? or  its just like one time pay and we can use those services for longer time ?  can anyone please inform me about this confusion that i have .  thanks  Usman Ali.  

Hi connections!!Like every other typical networks all my internal PCs are always sending DNS queries with port 53 to the internet. I want all those PCs' IP addresses and the DNS queries, they are sending to the internet. I have a Fortigate 100E; 2 ISPs; 1 LAN (192.168.1.0/24); No VLAN. For additional info: My Firewall's LAN port IP is - 192.168.1.1 and all the client are having that IP as their default gateway. Can anyone help me out? 

I am trying to generate a report to show the top applications by session count and the destination IPs. Essentially I have :Dataset 1 to show top applications by sessions.select appid, app, appcat, (case when (utmaction in ('block', 'blocked') or action='deny') then 'Blocked' else 'Allowed' end) as custaction, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth,count(*) as num_session from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and nullifna(app) is not null and policyid != 0 group by appid,app, appcat,custaction order by bandwidth desc Dataset 2 to show all the destination IPs by application and number of sessions.select dstip, app, appid, hostname, count(*) as total_num from $log where $filter and logid_to_int(logid) not in (4, 7, 14) group by dstip, app, appid, hostname order by total_num desc Dataset 2 does not sort the results by the *top* applications like in dataset 1 but rather by the session count, i have tried every SQL statement

Hello Dear Members please need to share your experience. i am novice Indeed I installed an open source application on my 2008 server, it works well in my LAN (with port 80), it connects via the internal fixed ip of the server 10.10.10.3:80. The server is connected to an internet network that has a public IP address (xx.xx.xx.xx) and which is also configured on a firewall. the Fortigate 60E Firewall can be accessed from the outside with the Public IP I would like to access the application and my server from outside via the internet. I want to know how to do NAT on Fortigate 60E and write the traffic / port to the internal address of the server,   Thank you for helping me please, I remain available

Hi All Members,  I have question regarting logging and reporting features,  I want to buy Fortigate300E but before buying i want ask few questions ,  i'm not sure if Fortigate300E has an Active Directory Connector and if we can authenticate users through native AD or at least LDAP. Need suggestions about it  and secondly  If i buy Fortigate300E do i also need to buy fortianalyzer or fortimanager for logging , reporting and monitoring ?  thanks