Solved

i want to setup an ipsec tunnel adjusted for stability and best performance/throughput, ignoring security. the security is not a requirement here fortigate 200e. what's the best settings and proposal needed for best performance and stability, while ignoring security? thank you

Just FYI in case you might encounter this situation in the future and I didn't find any in the forum. I've been testing IKEv2 IPSec VPN between FG1500D and Cisco 1941 but couldn't bring it up when 1941 was placed behind a NAT device (means Cisco is the initiator). In addition to NAT-T, the problem comes with Cisco's static-VTI/route-based IPSec (Tunnel0 interface). If I use crypto-map(policy-based) it comes up with FG's route/interface-based IPSec.Today, I got both Cisco TAC and Fortinet TAC on a call w/ remote access to my PC then we concluded that Cisco sends out all Configuration Payload request options regardless they're relevant to the setup or not, and FG is trying to process them, like IP/DNS requests, although those are relevant only for "dial-up" vpn then drops the request because "mode-cfg" is not enabled (not needed for site-to-site static vpn). Based on the original RFC, the recipient is supposed to be returning an error reply if it's not relevant instead of drop the r

Hi all, Checked other forum threads, but found only one mention here https://forum.fortinet.com/tm.aspx?m=142160 and it is not answered.Basically we have just purchased a pair of Fortigate 60E firewalls that we would like to use for site-to-site IPSec VPN.So I set them up sitting next to each other connected via a patch cable. I used VPN Wizard, everything seems to have started working ok, however. I am using a cisco switch as a client on one side and a mac laptop on the other. I run continuous ping from Mac to the switch and it appears to be working fine, no timeouts or lost packets. Same thing done from switch side towards Mac looks similarly ok, however if I run a ping with say 10000 repetitions, that shows issues: Type escape sequence to abort.Sending 10000, 100-byte ICMP Echos to 172.11.11.99, timeout is 2 seconds:!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!!

Is there an equivalent of a Cisco SVI interface on a Fortigate switch? If so, can someone direct me to documentation? I have looked over the cook books; however, I am not seeing what I want or need. Maybe I do not speak Fortinet/Fortiswitch yet.

Hi there, i got a problem with a Fortinet FortiGate 600C. My fortigate wont boot up and I try to console with putty I get FortiGate-600C (20:43-08.19.2014) Ver:04000023 Serial number:FG600C RAM activation --------------------------------------------------- Stuck on "RAM activation" and not resume to like on technical document FortiGate-200D (18:47-05.08.2013) Ver:04000006 Serial number:FG200D4613800892 RAM activation CPU(00:000206a7 bfebfbff): MP initialization CPU(02:000206a7 bfebfbff): MP initialization Total RAM: 2048MB Enabling cache...Done. Scanning PCI bus...Done. Allocating PCI resources...Done. Enabling PCI resources...Done. Zeroing IRQ settings...Done. Verifying PIRQ tables...Done. Boot up, boot device capacity: 15272MB. Press any key to display configuration menu... Is there any solution? Thanks

Hello I'm beginner with fortinet product. I try to configure my FortiGate 50E. I configure the vpn. I can connect with FortiClient VPN without problems.. on the Fortigate On dns I specify my dns server as primary server and the Local Domain Name. On my remote pc , When I'm connected with the VPN I ping the DNS server with ip adress but not with his name.if I make a nsloockup MYserver I got this : nslookup MYserver Serveur :   fortinet-public-dns-53.fortinet.com Address:  208.91.112.53 *** fortinet-public-dns-53.fortinet.com ne parvient pas à trouver hellboy : Non-existent domain Did you have an idea ?Regards

I am using IPS signatures filtered by operating system and target = Client to protect my clients.I thought that with this policy I could prevent and detect botnets and attacks to my clients when they browse the Internet.But now I see that most Botnets signatures have a target = Server, so they don't apply to the policy I use with my clients. For example, I wanted protection against the Emotet Trojan, but the signature is target = Server In this document https://www.fortinet.com/blog/threat-research/deep-dive-into-emotet-malware.html you can read: "Fortinet has also developed an IPS signature named “Emotet.Botnet” to detect the traffic between the C2 server and the infected machine".  So, the infected machine is a client, why is the signature defined with the target "Server"?How should I use the Signature target to configure IPS?Thanks https://fortiguard.com/encyclopedia/ips/33105Emotet.Cridex.BotnetDescription This indicates that a system might be infected

Hello, we are running on FortiOS 5.6.3.I try to use nested LDAP Groups for Authentication.Users Accounts are member of the LDAP Group: "GL_SSLVPN"Global Group is member of "L_SSLVPN" Group The  "L_SSLVPN" Group should be authenticated in Fortigate. As discribes here:http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD37091 the follwing Settings should be made:config user ldap edit "example.local" set group-member-check user-attr set search-type nested next end But the "set search-type nested" value is not available in FortiOS 5.6.Any idea how to implement nested LDAP Groups now, or isn't this possible anymore? Regards Thomas

I have no Internet access out from a vlan. I would just allow certain URLs to be allowed.I have created a policy that I have added a Web Filter to.In the Webfiler I have added Static URLs. For example:URL *mcdonalds.comType WildcardAction AllowStatus Enable I end the Statatic URL with:URL *Type WildcardAction BlockStatus Enable Is this the right way to do it?If the request matches this policy source, destination etc it looks like the last * Block stops the request from continuing go throw other policies.  Fortios 5.6.9

Hi All,  Fortigate 60D v5.2.4(Build688) I've had a bit of a google and it appears it should be possible to setup my VDOMs to log to multiple Syslog servers, but I am struggling to find out how to get this working. I have overridden the global syslog settings to allow me to log per VDOM and this is working. Under the global config I get the option to configure syslogd, syslogd2 and syslogd3, but under the VDOM, I only get the option for syslogd.  VDOM options: FIREWALL (root) # config log custom-field Configure custom log fields. eventfilter Configure log event filters. fortianalyzer Configure first FortiAnalyzer device. fortiguard Configure log for FortiGuard. gui-display Configure log GUI display settings. memory Configure memory log. setting Configure general log settings. syslogd Configure first syslog device. threat-weight Configure threat weight settings. Global options: FIREWALL (global) # config log fortianalyzer Configure first Forti

Hi I cannot get DHCP server to work on a software switch, configured like this: config system switch-interface    edit "soft_switch"  set vdom root        set member "Vlan16" "VxLan-IPsec-DR"        set intra-switch-policy explicit    nextend Computer configured with static IP, then I can ping 172.16.0.1, so the interface and VLAN works. Why do I not get an DHCP address? See images FortiGate 30E v6.0.4 build0231 (GA) /Kim

Hello! I have DHCP Server enabled on 'internal' interface [Hardware switch] at Fortigate 60E, FortiOS 6.2.0 build0866 (GA).I had ca. 100 entries at 'IP Address Assignment Rules' and I wanted to check my VOIP phones addresses so I searched them by the IP '10.100.250.' I got list, check what I wanted to check and click OK at the bottom of site. Next time I entered this site I had only those 8 entries and no chance to get my other entries back. I cleared colums filters and so on, nothing works. How can I get my entries back? I have backup, so not a big problem, but I want to prevent this in future. Filtering deletes other entries? Bug or normal behavior? Greetings!

Hi i have installed FortiAuthenticator and setted it up as Radius server according to Cookbok.trying to connect to it from Fortigate, and i can't, got error.It is successfuly get users from LDAP server, everything cool.I have scanned ports from outside - RADIUS port closed, but it is opened on FORTIGATE, i mean policies ALLOWED everything to this Fortiaythenticator and everything from it.Ssh, ping, everything works fine.Anybody knows how to troubleshoot it? Radius doesnt works :(Thank you!

Hi there, i want to reboot my FortiGate 60E via the REST-API. Im using this endpoint: doing this Request(obviously already authenticated):curl -k -i -H "Accept: application/json" -X POST "https://ip:port/api/v2/monitor/system/os/reboot" --cookie cookie.txt But I receive a Forbidden: {  "http_method":"POST",  "status":"error",  "http_status":403,  "vdom":"root",  "path":"system",  "name":"os",  "action":"reboot",  "serial":"serial",  "version":"v6.0.5",  "build":268} How do I reboot the FortiGate via REST API? PS: Im trying this with a user who has RW permission on all CategorysThank you!

Hello, I tried several VPN setting and have a lot of problem with all of these.The requirements are many:* Navigate through the local gateway (Split tunneling)* Communicate from lan to remote clients* Communicate from remote clients to lan I have created finally a VPN for FortiClient, following the Wizard, and using split tunneling.From the fortigate, I can ping to everything.From a remote device, I can ping to local deviceFrom a local device, I cannot ping to remote device. The wizard just created for me a rule, which allows traffic from VPN clients to Local Clients, with the NAT enabledI created the reverse rule, to allow everything from lan to VPN clients (using the VPN interface as outgoing interface, and using the VPN range as destination addresses), I tried with and without NAT, just in case, still the same: ping to remote devices never returns Any idea?Thanks in advance.Regards,Damián

I've got a IPsec Tunnel that I want to disable for 1 month.  How can you disable the tunnel w/o removing the tunnel from the configuration? Ver 5.6.5 Thanks!Dan

Hi All, I believe I know the answer to this already but... Is it possible to configure multiple vpn's via a "batch job" on a FortiGate 200E?

Hello, I have a Fortigate 90D (Firmware Version: 5.4.10,build1220) with the following configuration:wan1 - connected to cable ISPwan2 - connected to 4G ISP I want all internet traffic to go through wan1, unless wan1 loses internet connection. In that case, I'd like to failover to wan2. I added 2 static routes (1 for each interface ) and set the Administrative Distance of both to 10. I set the priority of wan1 to 0 and set the priority of wan2 to 10. I then set a link-monitor with the following configuration:ROUTER (link-monitor) # sh full-configurationconfig system link-monitor    edit "Wan1Failover"        set srcintf "wan1"        set server "8.8.8.8"        set protocol ping        set gateway-ip <gateway ip omitted>        set source-ip 0.0

Hello.I tried to debug non-working VPN tunnel and suspect there is PSK mismatch.Fortigate doc says: "It is possible to identify a PSK mismatch using the following combination of CLI commands:diag debug app ike filter name "phase1-name"...I got an error after this command, "command parse error before 'name'", why ? Are there any ways to do this ?My Fortigate version is v5.6.4

Hi,Pfa an elaborated network diagram. Firewall FGT100D at Site 2 act as a router only. FGT600c at Site 1 Headoffice side has been used for firewall permissions with different policies created for Site_2. Now the issue is with the routing that when we use NAT at Site_2 it won't show desktops local lan IP at Site_1 firewall FGT600c, it just shows the wan side ip i.e., 17.17.17.2 or 18.18.18.2 of the Site_2 Firewall and the IP based policy won't work. Disabling NAT doesn't let internet work on desktops but it shows connectivity at Site_2 Firewalls terminal window and can ping gmail.com/yahoo etc.Please help.*SDWAN is enabled at Site_2 and P2P lease lines act as 2 wan connections.*D235 mentioned in diagram is equivalent to Site_2 RegardsRohit K

Hi,I have an issue with RADIUS authentication between the 2 devices in subject and a RADIUS server on Windows 2008. I`ve configured this on the fortigate:  config wireless-controller vap edit vap1 set radius-mac-auth enable set radius-mac-auth-server 192.168.1.95 end And on the Windows side I`ve configured NPS like this:And configured usernames as MAC address in several syntaxesi.e. xxxxxxxxxxxx XXXXXXXXXXXXxx-xx-xx-xx-xx-xxXX-XX-XX-XX-XX  Windows gave me this  while fortigate gave me this:  Any advice? Thanks

Dear experts i have a fortigate firewall and also a Cisco Firewall (FTD) and i m planning for fortinet Sandboxing solution will Cisco FTD firewall  will work with Fortinet Sandboxing, please confirm. thanks

Hello everyone ,  I'm new here and it may be a silly question but i didn't find anything on the internet .  Can someone explain me what is the differance between the "Install Packege&Device setting" and the "Install Device setting(only)" ?   What does the "Device setting" mean ?  i thougt that this is the configuration that was on the "Device manager" but it seems that there is also "Install Config" .  Can anyone clear things out for me ?  Thank you :)

I have a FortiGate 50E with a FortiSwitch 124E-FPOE I have a client subnet on the switch with my clients, a NAS and a printerIn addition, i have a vlan for VoIP and IPSec VPNI can ping across all all Subnets, but not within the client subnet. e.g. client to printerI can ping from outside the client subnet (from Wlan, from IPSec etc) to the NAS and the printer I can ping from my client subnet to all other subnetsBut I can not ping from the client subnet to other systems in the client subnet.What do i need to change?

Hi, i gotta a question when an user is member of two LDAP groups and both groups has different portal in teh SSL VPN, each one with different range of addres.My question is, when the user log in, to which group belong? REgards