Solved

Hione site has a web facing wan ip address (site A) and the other site is behind a router (Site B)I've used the wizard to create a site-to-site VPN between both sites.Site A tunnel has a "dialup" template, Site B has a "Site to Site" template After creating both tunnels, here are the errors in "VPN Events" log:The logs on Site A shows " peer SA proposal not match local policy"The logs on Site B shows success Any help would be appreciated. Thanks

Hello everyone,  I'm a newbie/newcomer with Fortinet's products. Now I heard that upgrading to the latest version for FortiGate is not a recommendation. (from product supplier, not Fortinet)Then, I'd like to find/check more details so what that really does mean.I found that some points with Resolved/Known issues between the present and the newer version in Release NoteAnd I want to discuss detail here is related to some resolved CVEs' issues. Here my discussing matter・Currently using FortiOS version: 5.6.5・I want to upgrade to version: 5.6.8Although, I found that some CVEs (security related issues) that resolved on the 5.6.8 version of the Release Note.But hold it on, when I reversely check on the CVE-2018-13371 (risk rather high) that written in Release Note of 5.6.8,With the supported links: https://fortiguard.com/psirt/FG-IR-18-230On the part [Affected products], I saw this "FortiOS version 5.6.7 and below"so that means my FortiOS version is i

I have looked through the canned reports and don't see a way to get this information from FortiAnalyzer.  I need a report that will run daily that gives a report of all the VPN Login/Logouts or possibly list all of the VPN logins with a duration of the login. There are some pretty decent looking reports but most of them are TopN reports.  I opened a ticket with Fortinet support and was told this requires a custom data set and that support doesn't help with creating them.  Currently running v5.2.1-build0662 141212. ThanksMike  

 I'm definitely a beginner with Fortigate, but have some experience with stateful firewalls (from iptables). I'm setting up a system (Fortigate 30E) which should look like: SD-WAN (wan + lan4) -> two different internet connections, select ports forwarded to Internal (below)Local (lan3): Single computer that is a local server and responsible for most of our load (including stuff it forwards), unlimited outgoing connections via SD-WAN.Lan (lan1 & lan2): connect to some WiFi routers; unlimited outgoing connections via SD-WAN, limited to select ports to Local. My Configuration so far is outlined below. Note that I know I do not have rules to permit LAN to access anything on Local right now. What works: Internet connections to Local for selected ports only; Local accessing internet; Load balancing with SD-WAN.What Doesn't work: Lan accessing internet. Using the packet sniffer, I determined that for DNS requests going out from Lan, the returning packets from the na

I allow myself to write this post because I have a lot of difficulty in configuring vxlan over ipsec, the operation is not guaranteed (at least from my experience)　from the FortiOS version 5.6.2 vxlan can be used nativelyconsidered that the[ul]vxlan over ipsec does not support 802.1q (while internet traffic is encrypted)native vxlan supports 802.1q (instead internet traffic is not encrypted)[/ul]　I decided to make a configuration using IPSEC with loopback interface and use the native vxlan with the loopback interfaces.With this configuration, traffic with the native vxlan is encrypted with the IPSEC　attached the configuration adopted between fortigate 80E and Fortigate 90E ######################### FTG80E ###############　##creation of subnet address　config firewall address    edit "LoopBackLocal172.30.31.0"        set subnet 172.30.31.0 255.255.255.0    next    edit "LoopBackRemote172.30.30.0" &nb

Hello everyone,  I need to perform an upgrade firmware  to my FortiAPs 221C that now running on version 5.2, and I can't find any information about actions to perform if it will fail during an upgrade and won't come up after hard reset,Is it has CLI?, Can I connect to it via console and upload image with TFTP like on FortiGates?  in other words what to do if device stacked during an upgrade, OS don't boot up and hard reset doesn't help.

Hello All, I want to show a customer the advantages of FortiManager. I installed FortiManager VM and a Fortigate VM using VM Workstation.  When I try and add the Fortitgate device to the FortiManager I get "Probe Failed" message.      Both FortiManager and Fortigate are running 5.6 and are in there Trial license period. I have network connectivity to the Fortigate as I can ping it from FortiManager. I have Centralised Management on the Fortigate set to FortiManager:  When I check in the logs I can see a successful connection using TCP/541 from the FortiManager to the Fortigate. The only blocked traffic I see is on TCP/542 from the FortiManager to the Fortigate. TCP/542 is not listed in the Local In Policy. Checking the Fortinet Documentation about TCP/542, this port seems to be related to IPv6. If someone can offer some assistance as to why adding the device is failing. It would be appreciated.  

the format/syntax for creating an address object on FortiGate (5.x and 6.x) is  Name:Subnet/IP range: Do you put the IP in the name? If not then would the "Subnet/IP range:" be the place to put the actual IP? and if so would the following be correct syntax ? 192.168.10.10/32or192.168.10.10 255.255.255.255   Thanks in advance  

Hello there!I am trying to add a new network to act as a dedicated iLO network.I have configured an additional port on my Fortigate 60E router and have configured a policy route to route between this network and our Core network. Core/Server Network: 192.168.69.0 /24iLO Network: 192.168.50.0 /24 Our DHCP server lies on the 69 network and it is servicing IP Addresses to the iLO cards of our servers on the 50 network. I can ping the Router port and switch configured on the 50 network from the 69 network but cannot ping any of the iLO cards. If I plug in a laptop to the 50 network switch I can ping the iLO cards and router and the 69 network port on the fortigate but cannot get any further. Also devices on the 69 network can ping the router port and switch on the 50 network but not the devices on it. I'm wondering what I've missed here, and any help would be appreciated!Thanks.

I am hoping somebody can help me out with this.  I have a client with a fortigate 60D I have it setup with remote access ipsec vpn's using the forticlient software to for clients to connect to router.  This is at a law enforcement site so there is another router on this network that goes out to the Florida Department of Law Enforcement (FDLE).  I have the ipsec vpn connected and can see the internal network and I have route static route statements in the fortigate to route internal network to the FDLE router and that works great I just need to get the ipsec vpn clients to send certain subnet requests over the vpn besides just the internal network subnets.  So the question is how do I get the clients to send other subnets over the vpn connection along with the internal network requests? Thank youJason 

Hello, We have a 61E connected to the Internet that is getting random attempts at building an IPSEC tunnel from random IP's.  I want to block this traffic. I've followed this tech note: https://kb.fortinet.com/kb/viewContent.do?externalId=FD36318&sliceId=1 I applied this local-in-policy: FGT-61E # show firewall local-in-policy config firewall local-in-policy    edit 1        set intf "wan2"        set srcaddr "all"        set dstaddr "all"        set service "ISAKMP"        set schedule "always"    nextend However I'm still getting IPSEC connection attempts in the log.  Message meets Alert condition date=2019-08-06 time=17:49:15 devname=<MY_DEVICE> devid=<MY_ID> logid="0101037131" type="event" s

Hi, i updated my 100D from 5.6.0 to 5.6.3. Since then, I no longer have access to the Admin web Interface. I always get the message "ERR_CONNECTION_RESET".Ssh, Ping and SSL VPN web Interface are working normaly.Admin-port is 81 and admin-sport is 444. regardsTom

Hello fellas, Trying to verify if the reason push notifications from FAC (5.3.0 232) using FortiTokens (mobile) is not working is because the FAC interface is a private address and only gets NATed outbound with a PAT? Does it require a static 1 to 1 NAT so it can be reached from the internet? As no inbound connection can be initiated from the internet in its current configuration. I can't find any info on this regarding the FAC, but the instructions for Fortitoken mobile configured directly on a Fortigate says the outbound interface needs to be 'reachable from the internet.' Any help would be greatly appreciated.  Thanks in AdvanceNoel 

Hello guys For a while I used FAZ to get the information from our FGT and reports, but the cost is relevant and then some questions have arisen. The Syslog server has only the function of storing the data and FGT would not query this Syslog data, right?Can we use the Syslog server to receive the data by hosting in a database so that we can make selects to extract information and thus to stop using the FAZ? Which Syslog server would you indicate for this purpose and which can be used with FGT and other network assets? Have you ever used any tool like Power BI to extract information instead of using FAZ? Thank you for your support! Hugs

hello im using FG-81E v6.0.4i created ssl vpn in tunnel mode , no split tunnel,when im using hotspot,LAN,wifi i can connect to sslvpn and reach my servers .but when im using cellular modem i cant reach my servers, im getting :  PING: transmit failed. General failure.i checked my routing table and i can see no route to my servers , when im manually adding route to windows i can reach my servers.my question is how can i push proper route to clients ?  hotspotWireless LAN adapter Wi-Fi:Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::f0d4:4bb0:1eb7:fc29%17 IPv4 Address. . . . . . . . . . . : 192.168.43.138 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.43.1 IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.43.1 192.168.43.138 55 127.0.0.0 255.0.0.

Hello - We tried to connect fiber (single-mode, 1 Gb) to an FS 448D, but there was no connection and the FS didn't indicate that it even recognized the transceiver (FG-TRAN-SFP+LR).  We are currently using a StarTech Fiber LC to ethernet converter for this connection, and that is working, but we would rather connect directly to the switch (keeping the external converter as a backup).  Does the port or anything else on the switch need to be configured for this connection?  Everything I found seems to indicate it's mostly PnP, but I haven't found much documentation on this.  Also, this is a 48 port switch, but the SFP ports are numbered 49-52.  Are they paired with any ethernet ports like 45-48?  There's nothing that indicates that, but that's how I've usually seen it done with other brands.  Seems odd that they would give you 4 extra ports.  Any help would be appreciated. Thanks...  Mike

with only one weird bugfix in the release notes: 529745 FortiOS 5.4.11is no longer vulnerable to the following CVEReference: l CVE-2018-1338 https://docs.fortinet.com.../fortios-release-notes

Hi! The current Fortigates offer the feature "Use FortiSandbox Database" in AV-profiles. Is there any difference on that feature depending on:- Using FortiSandbox Cloud- Using FortiSandbox On-Prem- Non of both?  --> Are the pattern, that are detected on any "sharing" Fortisandbox directly pushed to the Fortiguard-Updates, are there differences according to the rest of the FortiSandbox-usage? Thank you for your help! KPS

Im in the middle of setting up a policy to block all traffic outside of the US.   It appears I have to add each country to the Policy & Objects > Addresses section separately and then create a group and add the addresses to the group ...then create a policy to block the group.  I have started to do that and it appears to be working fine, but I was wondering if there is a way to create an allow list instead? I thought if I setup a policy to Allow US, but no one else...will this block everyone else?  I didnt know if the data would be read through the security like...data from country b arrives....policy 1: its not US...go to policy 2-9...there are no other policies that "block" country B...allow data.... Or will it be...  data from country  b arrives...policy 1: its not US...blocked...dont care about other policies. It seem like the default is ...if there is no policy...let it through.

Hi everyone, I looking for experience on this topic. I'd like to move the configuration from a Port1 (hardware switch) to a aggregated link.How is this done easiest? For that I can see, I have to remove the IP from the HW-switch, and re-configure it on the aggregated link + change all IPv4 policies were port1 is set as source IF. Kind regardsJonas 

Hi All, I'm having trouble nailing down this question. I manage a global network in which each site has a pair of 500E or 300Es in HA mode. A site with 300Es was shut down. One of those FWs went to Guatemala, a new site, and the other FW got sent to a datacenter for a more desperate need. So the FW in GUA was reconfigured to be standalone. Now- after a few months in production in standalone mode, we had another site go dark so that freed up another 300E. This was sent to GUA to be the HA secondary. My pressing question is- Does the secondary FW NEED TO BE FACTORY RESET prior to connecting to the primary in HA? I will have the priority on the Primary set for 128 and the new secondary set for 50. Will the sync process completely overwrite the old config from the shutdown site?FYI- I am well versed in HA and those details. I have just never come across this situation of adding a previously configured FW as an HA pair. (A-P). The Primary is in production which is why I am very concern

looking at upgrading some of my fortinets to 6.04, and it reads like the fortianalyzer would need to be upgraded to 6.04 first.question:I have couple of 60C that are at EOL at end of year, and cannot be upgraded beyond 5.2.13would they be able to communicate with fortianalyzer running 6.04? we are replacing those 60Cs at end of year, but until then wonder if they would work with fortianalyzer at 6.04 

Hi I am looking for a Fortigate with port mirroring functionality and i cant find any information about what models can do this, can the 60d do this or do i need to look for a bigger appliance?  Thanks

Has this tab been relocated somewhere else or removed?  I have check "All" in event logging.  The screenshot shows it in 6.0.0 but not in 6.2.1...   

Hi, New here so forgive me if I've not posted this in the correct spot or if it has been asked before (couldnt find it anywhere). I have an IPSec Tunnel configured with a Fortigate 201E at the local end and a Cisco Meraki MX appliance at the other end.At the other end, we have frequent ISP drop outs (another issue we are working to fix) but it usually comes back up quite quickly. The problem for us is that obviously when the link drops, the tunnel drops, but the link usually comes up within a minute or so and I can see the tunnel coming back online on the Fortigate but there is no traffic passing through. I have to manually take down the tunnel on the Fortigate, and it then immediately comes back up and traffic starts passing through. I cant for the life of me work out why traffic does not resume when the tunnel reconnects.  Any ideas? ThanksAlex