Solved

Hi! The current Fortigates offer the feature "Use FortiSandbox Database" in AV-profiles. Is there any difference on that feature depending on:- Using FortiSandbox Cloud- Using FortiSandbox On-Prem- Non of both?  --> Are the pattern, that are detected on any "sharing" Fortisandbox directly pushed to the Fortiguard-Updates, are there differences according to the rest of the FortiSandbox-usage? Thank you for your help! KPS

Im in the middle of setting up a policy to block all traffic outside of the US.   It appears I have to add each country to the Policy & Objects > Addresses section separately and then create a group and add the addresses to the group ...then create a policy to block the group.  I have started to do that and it appears to be working fine, but I was wondering if there is a way to create an allow list instead? I thought if I setup a policy to Allow US, but no one else...will this block everyone else?  I didnt know if the data would be read through the security like...data from country b arrives....policy 1: its not US...go to policy 2-9...there are no other policies that "block" country B...allow data.... Or will it be...  data from country  b arrives...policy 1: its not US...blocked...dont care about other policies. It seem like the default is ...if there is no policy...let it through.

Hi everyone, I looking for experience on this topic. I'd like to move the configuration from a Port1 (hardware switch) to a aggregated link.How is this done easiest? For that I can see, I have to remove the IP from the HW-switch, and re-configure it on the aggregated link + change all IPv4 policies were port1 is set as source IF. Kind regardsJonas 

Hi All, I'm having trouble nailing down this question. I manage a global network in which each site has a pair of 500E or 300Es in HA mode. A site with 300Es was shut down. One of those FWs went to Guatemala, a new site, and the other FW got sent to a datacenter for a more desperate need. So the FW in GUA was reconfigured to be standalone. Now- after a few months in production in standalone mode, we had another site go dark so that freed up another 300E. This was sent to GUA to be the HA secondary. My pressing question is- Does the secondary FW NEED TO BE FACTORY RESET prior to connecting to the primary in HA? I will have the priority on the Primary set for 128 and the new secondary set for 50. Will the sync process completely overwrite the old config from the shutdown site?FYI- I am well versed in HA and those details. I have just never come across this situation of adding a previously configured FW as an HA pair. (A-P). The Primary is in production which is why I am very concern

looking at upgrading some of my fortinets to 6.04, and it reads like the fortianalyzer would need to be upgraded to 6.04 first.question:I have couple of 60C that are at EOL at end of year, and cannot be upgraded beyond 5.2.13would they be able to communicate with fortianalyzer running 6.04? we are replacing those 60Cs at end of year, but until then wonder if they would work with fortianalyzer at 6.04 

Hi I am looking for a Fortigate with port mirroring functionality and i cant find any information about what models can do this, can the 60d do this or do i need to look for a bigger appliance?  Thanks

Has this tab been relocated somewhere else or removed?  I have check "All" in event logging.  The screenshot shows it in 6.0.0 but not in 6.2.1...   

Hi, New here so forgive me if I've not posted this in the correct spot or if it has been asked before (couldnt find it anywhere). I have an IPSec Tunnel configured with a Fortigate 201E at the local end and a Cisco Meraki MX appliance at the other end.At the other end, we have frequent ISP drop outs (another issue we are working to fix) but it usually comes back up quite quickly. The problem for us is that obviously when the link drops, the tunnel drops, but the link usually comes up within a minute or so and I can see the tunnel coming back online on the Fortigate but there is no traffic passing through. I have to manually take down the tunnel on the Fortigate, and it then immediately comes back up and traffic starts passing through. I cant for the life of me work out why traffic does not resume when the tunnel reconnects.  Any ideas? ThanksAlex 

This is my internal interface connected to cisco 4500 switch gig port. Why is the download smaller than  upload ?

I'm using Fortigate 200Es in a NSA Commercial Solutions for Classified (CSFC).  It details some pretty standard requirements for the overall operation of a network (e.g. time sync, syslog, etc.).  I'm not all too familiar with Fortigates (most of my experience is Sidewinders (I know, I'm dating myself)).  I'm making the following assumptions based on my experience and what I've read: 1.  Each port is it's own security boundary 2.  The OS native services (ntp/syslog) are associated with the Management interface(s) by design3.  The Management interface(s) is/are meant for OOB management (e.g., walk up and plug a laptop into it) I have a management network on Port 2 between two firewalls (home and forward).  There is a tunnel to port 2 on each 200E (IPSEC, Phase 1 using cert auth, etc.).  On the 'home' side, I have servers for syslog, file server, ntp and am trying to find the best way (the Fortigate approved way) to get the Fortigates on

Hi there,I've set up a Virtual Server on a 60D for Load Balancing purposes. That works fine so far, but creating a virtual IP with port forwarding mapped to the Virtual Server doesn't...Configuring the port forwarding to one of the real servers instead of the virtual server works just fine though. The setup with some imaginary IPs for illustration purposes:Virtual Server: 192.168.1.10 Real Server #1: 192.168.1.11 Real Server #2: 192.168.1.12 Virtual IP VIP_1: 123.45.67.89 --> 192.168.1.10(TCP: 30001 --> 30000) | Interface: wan1 Virtual IP VIP_2: 123.45.67.89 --> 192.168.1.12(TCP: 30002 --> 30000) | Interface: wan1"telnet 123.45.67.89 30002" succesfully establishes a connection. But "telnet 123.45.67.89 30001" times out. So VIP_2 works just fine, VIP_1 doesn't. Any ideas how I could debug this or what the issue might be?Or is this scenario simply not supported? Would there be any workarounds in that case?

New to FortiSwitch. Beyond the fact that you can manage the FortiSwitch via the FortiGate, what other differences are there between Cisco small business switches and FortiSwitch? What FortiSwitch would be comparable to the Cisco SG 250 and SG 350 switches?

Good day!Does anybody use port forwarding from 1 external ip to several internal hosts?For example, I have IP 1.1.1.1 on wan1 and want to translate port 21 to 192.168.1.2:21, port 25 to 192.168.1.3:25port 80 to 192.168.1.4:80.First virtual IP was created without any problem. But when I try to add second VIP with my 1.1.1.1 external IP, I catch this error: "Conflicts with the External IP of another VIP". I've created only 2 VIPs on wan1 at all - first 1.1.1.1:21 -> 192.168.1.2:21 and second 0.0.0.0:25 -> 192.168.1.2:25. Third VIP I cannot create.Another vendors, such as Cisco or Zyxel, can translate too much external ports to different local hosts and ports.I'm guess, that Fortigate can do the same. But I haven't find any manual for this.Only 1 external IP to 1 internal IP. Thanks in advance for your help.

Has anyone successfully setup and used the FortiAuthenticator as the IdP for Azure AD?We're following the Microsoft guidelines here https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp and having issues with the final steps. The user login page is redirected to the FortiAuthenticator, successfully authenticated and then passed back to Microsoft where we are getting "Message: AADSTS50107: Requested federation realm object 'http://{Our-FA-URL}/saml-idp/{Our-IDP-Prefix}/metadata/' does not exist. The FA logs show;SAML request from SP 'Office365_GCC' failed: SAML assertion request validation error: Issuer 'urn:federation:microsoftonline.us' does not match SP config

Hi All,I've just joined the forums and hoping to get some feedback please.  We are currently running FortiOS 5.6.5, but are hitting a bug where the CPU gradually increases. This bug is reported as being fixed in 5.6.6 which was released last month.  If anyone has already installed 5.6.6, is it stable? Or are there any issues that we should be aware of before upgrading please?Thanks.Phil

ANY UPDATE FORTINET ??????  HELLLOOOOO

This problem persist to me:  "memory traffic log is 95% full", although if i make this commands: config log memory setting           set diskfull overwrite Any idea? Thanks!

I was trying to do SD WAN cofiguration in fortinet VM(6.0) in gns3 before going live in production. But i cant add members to SDWAN, it shows error FAILED DEPENDENCY. What could be the reason?. I also checked whether the interface adding is there in any policy. I can add one interface to SDWAN,when adding second one it shows failed dependency error.

Hello, we are currently in the process of buying a FG-500E. I have a question regarding groups and web filter profile usage: We are planning on using agent-based FSSO and creating multiple AD-Groups that can be assigned to users to manage their internet access. A user can be a member of multiple groups. I can create multiple authentication rules, each of them having different Web Filter policies. Authentication Rule 1: group A - Webfilter Profile A (full access)Authentication Rule 2: group B - Webfilter Profile B (allow test.de)Authentication Rule 3: group C - Webfilter Profile C (allow testing.de)Authentication Rule 4: group D (normal user)  - Webfilter Profile D (restricted access (deny test.de + deny testing.de + allow fortinet.com)) If a user is in group A and group D, only Authentication Rule 1 is used. If a user is only in group D, only Authentication Rule 4 is used. What happens, if a user is in group B and D? Will he have access

Hello, I'm using FortiGate to decrypt web server traffic, how to know if the traffic is really decrypted from the FortiGate log itself ?

Hi, is anyone has experience with XML API ?  I don't know why, but all my request are not able to execute because I have an error "<errorCode>11</errorCode><errorMsg>No permission for the resource</errorMsg>". This is what I done :1) create user with super_admin profile2) enable web service on interface3) download wsdl from fortimanager4) create a request as : URL : [link]https://fmgIP:8080/FortiManagerWSxml[/link]<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:r20="http://r200806.ws.fmg.fortinet.com/">   <soapenv:Header/>   <soapenv:Body>      <r20:addCliGlobalSystemAdminUser>            <!--Optional:-->  <servicePass>            <!--Optional:-->   <userID&g

Anyone out there running a large FGT, like 600E, in the Fortinet "Enterprise/Office Closet" topology with FSW 1000+ at the distribution layer (MDF), and 35 FSW's broken up between multiple IDF's and data center top-of-rack switches, all using Fortilink?  Trying to understand how practical is would be manage that number of switches entirely through FortiGate interface. Thanks!

Hello, I have 3 fortigates A, B and C.The fortigate B connects to the A and C fortigade with IPSEC vpn. In fortigate A I have internal network 10.0.10.0/24 In fortigate B I have internal network 10.0.20.0/24 In C fortigate I have internal network 10.0.30.0/24The network 10.0.20 accesses the networks 10.0.10 and 10.0.30, but I need to make the network 10.0.10 access the network 10.0.30, passing through the fortigate B. Making vpn between Fortigates A and C is not an option.How do I do this? TKS for all. 

Helloi have fortigate 80c and hp switch 1910.my network (internal 1 ) working with 172.26.30.254/255.255.255.0.now i created on hp switch vlan 100 with interface 172.26.0.1/255.255.0.0.how can i connect vlan 100 to my fortigate ?       

I'm having some routing issues with an MPLS circuit that terminates on an interface to my Fortinet. MPLS Fortinet Interface IP:10.200.66.1AT&T MPLS HSRP Router IP:10.200.67.2I've added a static route for 198.105.206.0/24 to HSRP 10.200.67.1.  I've created a security policy for my internal/trusted zone to MPLS to allow everything. I can't ping anything on the other end but the LAN. I don't maintain the AT&T Cisco router or any of the config.  I was told by the vendor to add their public blocks via static route and point to HSRP of the cisco router.  I'm at a loss here.Here is traceroute that shows it makes it to AT&T MPLS router but nowhere else:Tracing route to ts099.scl.five9.com [198.105.206.150] over a maximum of 30 hops:   1   1 ms   <1 ms   1 ms 10.200.32.1   2   <1 ms   2 ms   3 ms 192.168.53.1   3   <1 ms   <1 ms   <1 ms bedfordfortigate.daystartv.internal [10.200.106