Solved

Hello fellas, Trying to verify if the reason push notifications from FAC (5.3.0 232) using FortiTokens (mobile) is not working is because the FAC interface is a private address and only gets NATed outbound with a PAT? Does it require a static 1 to 1 NAT so it can be reached from the internet? As no inbound connection can be initiated from the internet in its current configuration. I can't find any info on this regarding the FAC, but the instructions for Fortitoken mobile configured directly on a Fortigate says the outbound interface needs to be 'reachable from the internet.' Any help would be greatly appreciated.  Thanks in AdvanceNoel 

Hello guys For a while I used FAZ to get the information from our FGT and reports, but the cost is relevant and then some questions have arisen. The Syslog server has only the function of storing the data and FGT would not query this Syslog data, right?Can we use the Syslog server to receive the data by hosting in a database so that we can make selects to extract information and thus to stop using the FAZ? Which Syslog server would you indicate for this purpose and which can be used with FGT and other network assets? Have you ever used any tool like Power BI to extract information instead of using FAZ? Thank you for your support! Hugs

hello im using FG-81E v6.0.4i created ssl vpn in tunnel mode , no split tunnel,when im using hotspot,LAN,wifi i can connect to sslvpn and reach my servers .but when im using cellular modem i cant reach my servers, im getting :  PING: transmit failed. General failure.i checked my routing table and i can see no route to my servers , when im manually adding route to windows i can reach my servers.my question is how can i push proper route to clients ?  hotspotWireless LAN adapter Wi-Fi:Connection-specific DNS Suffix . : Link-local IPv6 Address . . . . . : fe80::f0d4:4bb0:1eb7:fc29%17 IPv4 Address. . . . . . . . . . . : 192.168.43.138 Subnet Mask . . . . . . . . . . . : 255.255.255.0 Default Gateway . . . . . . . . . : 192.168.43.1 IPv4 Route Table =========================================================================== Active Routes: Network Destination Netmask Gateway Interface Metric 0.0.0.0 0.0.0.0 192.168.43.1 192.168.43.138 55 127.0.0.0 255.0.0.

Hello - We tried to connect fiber (single-mode, 1 Gb) to an FS 448D, but there was no connection and the FS didn't indicate that it even recognized the transceiver (FG-TRAN-SFP+LR).  We are currently using a StarTech Fiber LC to ethernet converter for this connection, and that is working, but we would rather connect directly to the switch (keeping the external converter as a backup).  Does the port or anything else on the switch need to be configured for this connection?  Everything I found seems to indicate it's mostly PnP, but I haven't found much documentation on this.  Also, this is a 48 port switch, but the SFP ports are numbered 49-52.  Are they paired with any ethernet ports like 45-48?  There's nothing that indicates that, but that's how I've usually seen it done with other brands.  Seems odd that they would give you 4 extra ports.  Any help would be appreciated. Thanks...  Mike

with only one weird bugfix in the release notes: 529745 FortiOS 5.4.11is no longer vulnerable to the following CVEReference: l CVE-2018-1338 https://docs.fortinet.com.../fortios-release-notes

Hi! The current Fortigates offer the feature "Use FortiSandbox Database" in AV-profiles. Is there any difference on that feature depending on:- Using FortiSandbox Cloud- Using FortiSandbox On-Prem- Non of both?  --> Are the pattern, that are detected on any "sharing" Fortisandbox directly pushed to the Fortiguard-Updates, are there differences according to the rest of the FortiSandbox-usage? Thank you for your help! KPS

Im in the middle of setting up a policy to block all traffic outside of the US.   It appears I have to add each country to the Policy & Objects > Addresses section separately and then create a group and add the addresses to the group ...then create a policy to block the group.  I have started to do that and it appears to be working fine, but I was wondering if there is a way to create an allow list instead? I thought if I setup a policy to Allow US, but no one else...will this block everyone else?  I didnt know if the data would be read through the security like...data from country b arrives....policy 1: its not US...go to policy 2-9...there are no other policies that "block" country B...allow data.... Or will it be...  data from country  b arrives...policy 1: its not US...blocked...dont care about other policies. It seem like the default is ...if there is no policy...let it through.

Hi everyone, I looking for experience on this topic. I'd like to move the configuration from a Port1 (hardware switch) to a aggregated link.How is this done easiest? For that I can see, I have to remove the IP from the HW-switch, and re-configure it on the aggregated link + change all IPv4 policies were port1 is set as source IF. Kind regardsJonas 

Hi All, I'm having trouble nailing down this question. I manage a global network in which each site has a pair of 500E or 300Es in HA mode. A site with 300Es was shut down. One of those FWs went to Guatemala, a new site, and the other FW got sent to a datacenter for a more desperate need. So the FW in GUA was reconfigured to be standalone. Now- after a few months in production in standalone mode, we had another site go dark so that freed up another 300E. This was sent to GUA to be the HA secondary. My pressing question is- Does the secondary FW NEED TO BE FACTORY RESET prior to connecting to the primary in HA? I will have the priority on the Primary set for 128 and the new secondary set for 50. Will the sync process completely overwrite the old config from the shutdown site?FYI- I am well versed in HA and those details. I have just never come across this situation of adding a previously configured FW as an HA pair. (A-P). The Primary is in production which is why I am very concern

looking at upgrading some of my fortinets to 6.04, and it reads like the fortianalyzer would need to be upgraded to 6.04 first.question:I have couple of 60C that are at EOL at end of year, and cannot be upgraded beyond 5.2.13would they be able to communicate with fortianalyzer running 6.04? we are replacing those 60Cs at end of year, but until then wonder if they would work with fortianalyzer at 6.04 

Hi I am looking for a Fortigate with port mirroring functionality and i cant find any information about what models can do this, can the 60d do this or do i need to look for a bigger appliance?  Thanks

Has this tab been relocated somewhere else or removed?  I have check "All" in event logging.  The screenshot shows it in 6.0.0 but not in 6.2.1...   

Hi, New here so forgive me if I've not posted this in the correct spot or if it has been asked before (couldnt find it anywhere). I have an IPSec Tunnel configured with a Fortigate 201E at the local end and a Cisco Meraki MX appliance at the other end.At the other end, we have frequent ISP drop outs (another issue we are working to fix) but it usually comes back up quite quickly. The problem for us is that obviously when the link drops, the tunnel drops, but the link usually comes up within a minute or so and I can see the tunnel coming back online on the Fortigate but there is no traffic passing through. I have to manually take down the tunnel on the Fortigate, and it then immediately comes back up and traffic starts passing through. I cant for the life of me work out why traffic does not resume when the tunnel reconnects.  Any ideas? ThanksAlex 

This is my internal interface connected to cisco 4500 switch gig port. Why is the download smaller than  upload ?

I'm using Fortigate 200Es in a NSA Commercial Solutions for Classified (CSFC).  It details some pretty standard requirements for the overall operation of a network (e.g. time sync, syslog, etc.).  I'm not all too familiar with Fortigates (most of my experience is Sidewinders (I know, I'm dating myself)).  I'm making the following assumptions based on my experience and what I've read: 1.  Each port is it's own security boundary 2.  The OS native services (ntp/syslog) are associated with the Management interface(s) by design3.  The Management interface(s) is/are meant for OOB management (e.g., walk up and plug a laptop into it) I have a management network on Port 2 between two firewalls (home and forward).  There is a tunnel to port 2 on each 200E (IPSEC, Phase 1 using cert auth, etc.).  On the 'home' side, I have servers for syslog, file server, ntp and am trying to find the best way (the Fortigate approved way) to get the Fortigates on

Hi there,I've set up a Virtual Server on a 60D for Load Balancing purposes. That works fine so far, but creating a virtual IP with port forwarding mapped to the Virtual Server doesn't...Configuring the port forwarding to one of the real servers instead of the virtual server works just fine though. The setup with some imaginary IPs for illustration purposes:Virtual Server: 192.168.1.10 Real Server #1: 192.168.1.11 Real Server #2: 192.168.1.12 Virtual IP VIP_1: 123.45.67.89 --> 192.168.1.10(TCP: 30001 --> 30000) | Interface: wan1 Virtual IP VIP_2: 123.45.67.89 --> 192.168.1.12(TCP: 30002 --> 30000) | Interface: wan1"telnet 123.45.67.89 30002" succesfully establishes a connection. But "telnet 123.45.67.89 30001" times out. So VIP_2 works just fine, VIP_1 doesn't. Any ideas how I could debug this or what the issue might be?Or is this scenario simply not supported? Would there be any workarounds in that case?

New to FortiSwitch. Beyond the fact that you can manage the FortiSwitch via the FortiGate, what other differences are there between Cisco small business switches and FortiSwitch? What FortiSwitch would be comparable to the Cisco SG 250 and SG 350 switches?

Good day!Does anybody use port forwarding from 1 external ip to several internal hosts?For example, I have IP 1.1.1.1 on wan1 and want to translate port 21 to 192.168.1.2:21, port 25 to 192.168.1.3:25port 80 to 192.168.1.4:80.First virtual IP was created without any problem. But when I try to add second VIP with my 1.1.1.1 external IP, I catch this error: "Conflicts with the External IP of another VIP". I've created only 2 VIPs on wan1 at all - first 1.1.1.1:21 -> 192.168.1.2:21 and second 0.0.0.0:25 -> 192.168.1.2:25. Third VIP I cannot create.Another vendors, such as Cisco or Zyxel, can translate too much external ports to different local hosts and ports.I'm guess, that Fortigate can do the same. But I haven't find any manual for this.Only 1 external IP to 1 internal IP. Thanks in advance for your help.

Has anyone successfully setup and used the FortiAuthenticator as the IdP for Azure AD?We're following the Microsoft guidelines here https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp and having issues with the final steps. The user login page is redirected to the FortiAuthenticator, successfully authenticated and then passed back to Microsoft where we are getting "Message: AADSTS50107: Requested federation realm object 'http://{Our-FA-URL}/saml-idp/{Our-IDP-Prefix}/metadata/' does not exist. The FA logs show;SAML request from SP 'Office365_GCC' failed: SAML assertion request validation error: Issuer 'urn:federation:microsoftonline.us' does not match SP config

Hi All,I've just joined the forums and hoping to get some feedback please.  We are currently running FortiOS 5.6.5, but are hitting a bug where the CPU gradually increases. This bug is reported as being fixed in 5.6.6 which was released last month.  If anyone has already installed 5.6.6, is it stable? Or are there any issues that we should be aware of before upgrading please?Thanks.Phil

ANY UPDATE FORTINET ??????  HELLLOOOOO

This problem persist to me:  "memory traffic log is 95% full", although if i make this commands: config log memory setting           set diskfull overwrite Any idea? Thanks!

I was trying to do SD WAN cofiguration in fortinet VM(6.0) in gns3 before going live in production. But i cant add members to SDWAN, it shows error FAILED DEPENDENCY. What could be the reason?. I also checked whether the interface adding is there in any policy. I can add one interface to SDWAN,when adding second one it shows failed dependency error.

Hello, we are currently in the process of buying a FG-500E. I have a question regarding groups and web filter profile usage: We are planning on using agent-based FSSO and creating multiple AD-Groups that can be assigned to users to manage their internet access. A user can be a member of multiple groups. I can create multiple authentication rules, each of them having different Web Filter policies. Authentication Rule 1: group A - Webfilter Profile A (full access)Authentication Rule 2: group B - Webfilter Profile B (allow test.de)Authentication Rule 3: group C - Webfilter Profile C (allow testing.de)Authentication Rule 4: group D (normal user)  - Webfilter Profile D (restricted access (deny test.de + deny testing.de + allow fortinet.com)) If a user is in group A and group D, only Authentication Rule 1 is used. If a user is only in group D, only Authentication Rule 4 is used. What happens, if a user is in group B and D? Will he have access

Hello, I'm using FortiGate to decrypt web server traffic, how to know if the traffic is really decrypted from the FortiGate log itself ?