Solved

Hello! I have Fortigate 60E and I want to forward some services and devices to internet. For example IP cameras to watch them in Android app. I have 7 cameras and I want forward all of them at ports 65001-65007. Fortigate let me forward only one camera at port 80. Same situation with Remote Deskpot Services. I don't want to forward it at default port and I need more than one RDP forwarded. Greetings!

Hi A couple of questions about Fortimanager HA cluster behavior; 1- Per to guides, they stated that:[style="background-color: #ffff00;"](If the primary FortiManager unit fails you must manually configure one of the backup units to become the primary unit.[/style] [style="background-color: #ffff00;"]The new primary unit will have the same IP addresses as it did when it was the backup unit.)[/style] Does this mean that there is no auto-failover, and the backup unit will not get the primary unit IP address?[style="background-color: #ffffff;"] [/style]In this case the managed devices will loss connectivity to FM and we have to build a new connection based on the backup unit IP... 2- when configuring HA, does every node keep its interfaces IPs, or they will share the primary unit interfaces IPs? Thanks 

Hi All, we currently use an Open Source tool to backup our network configs. This includes FortiGate firewalls and HP Switches. It's a great bit of software but can take a while to get up and running. Does anyone here use similar software that's Open Source?

I know you can reset via console, but the one I need to reset is at remote site with no IT people there.tried to walk someone through resetting it via reset in back, using paperclip, but it appears to only have rebooted it.is that due to not holding in the reset button long enough, or is that all the reset is used for ? and if you succesfully reset, it goes back to old firmware right?90d was purchased with 5.2 I think, and when user sent me picture of login screen, looked like 5.4 login.which just makes me think more that it was only restarted not factory reset. someone used this spare for testing, and no one knows password so I just need to get it factory reset, so I can get them logged in, and have them load backup of the confg file. 

Hi everybody, Small question, we've setup an "Admin Profile" for a specific admin-user which points to a specific VDOM (not global).This admin-users needs to have the ability to change e-mailaddresses for the local users in the VDOM. In global the SMTP has been configured and works, (you cannot setup a SMTP per VDOM so it uses the global settings). When I login as the "global admin" I'm able to change these e-mailaddresses for the created users in the specific VDOM. If I login with the "Admin Profile" for the specific VDOM, it tells me a "SMTP has not been configurered" so I can't change an e-mailaddress, it's greyed out with an exclamation mark. But as a global admin I can.. why the error while SMTP works for the VDOM.. Did I miss something? Kind regards,Tim 

Hello  I have 2 sites what need to be connected together temporarily until their re-structuring is finished. We are slowly fusioning both sites together but it's a bit on standby.  LAN1 (site1) - 192.168.100.2/255.255.252.0 (connected directly to fortigate 60c internal1)LAN2 (site2)- 192.168.200.254/255.255.0.0 (connected via antenna directly to 60c internal2) These are overlapping subnets, however with set allow-subnet-overlap enable I am able to have lan1/lan2 on the same subnet. I only really need 2-3 machines from site1 to talk to site2 and visa versa, but I'm a bit confused on LAN-to-LAN policies when both sites have their own internet connec./firewall/dhcp etc etc. However we have no IP conflicts between the both sites. How should I attack this? I was even thinking of maybe using WAN1 for site2 and keeping site1 on LAN1 and configure it like a 'firewall' but I'm not sure this is a good idea.

Hello,I recently got a Fortigate 50b from an old company, i couldn't manage to find the password so i did a factory reset and i downloaded the firmware from fortinet's website, i wanted to install it on the Fortigate but it doesn't start up anymore,the "status" LED is always on and i can't connect to the CLI using the console cable.Does any one have a solution ? Thank you  

Hi everybody, I've got a question about vxlan, in FortiOS 5.6 I've found the following.[ul]FortiOS 5.4 VxLAN encapsulation within IPsec only supports forwarding untagged framesAre tagged frames within the IPSEC/VXLAN supported in version 5.6? Kind regards,Tim [/ul]

I cant login SSL VPN and i debug : with this  FG100D3G17801978 # diagnose test authserver ldap Keppel-AD phunv ABCD@1234[2137] handle_req-Rcvd auth req 34006537 for phunv in Keppel-AD opt=0000001b prot=0[366] __compose_group_list_from_req-Group 'Keppel-AD'[605] fnbamd_pop3_start-phunv[1043] __fnbamd_cfg_get_ldap_list_by_server-Loading LDAP server 'Keppel-AD'[1552] fnbamd_ldap_init-search filter is: sAMAccountName=phunv[1561] fnbamd_ldap_init-search base is: dc=hcm\2C dc=keppelland\2C dc=com[974] __fnbamd_ldap_dns_cb-Resolved Keppel-AD(idx 0) to 10.244.200.199[1025] __fnbamd_ldap_dns_cb-Still connecting.[508] create_auth_session-Total 1 server(s) to try[941] __ldap_connect-tcps_connect(10.244.200.199) is established.[815] __ldap_rxtx-state 3(Admin Binding)[196] __ldap_build_bind_req-Binding to 'admin.phunguyen@hcm.keppelland.com'[852] fnbamd_ldap_send-sending 60 bytes to 10.244.200.199[864] fnbamd_ldap_send-Request is sent. ID 1[815] __ldap_rxtx-state 4(Admin Bind resp)[1056]

Hi,  I have two Wan interfaces, 1 and 2. Wan 1 is set for vlan 10 and Wan 2 for vlan 60.To be able for computers on vlan 60 use the wan 2 internet, I created a Policy Route below:  The problem: There is an http server in vlan 10 that hosts a website and it is listening in wan 1 IP (already set in Fortigate and on Http Server). Computers on vlan 10 can open the website using the wan "1"  IP but computers on vlan 60 can't reach the website. But vlan 60 can ping the wan "1" IP. When I disable the policy route created before, vlan 60 can open the website normally. What is the problem?  Thank you.    

I don't know if this is an LDAP issue or an SSL VPN configuration issue but I'll start by posting it here.  This thing has been giving me a headache for a couple of days so it's time to seek help. I've got three 80C's in three offices around the world.  All are configured identically as far as SSL VPN goes and all were working in the past.  They all authenticate against the same LDAP server where users who are members of the "VPN Users" group are allowed to log in.  I recently upgraded the firmware on one firewall from 5.4.4 to 5.4.6 and it appears it's been since this time that I can no longer log in to that firewall while the other two still work fine.  When I try on this firewall, I get a "Permission denied" error and the logs on the firewall also show the permission is denied with a "SSL user failed to log in" message. If I run a tcpdump on the directory server, I see some initial back and forth which I assume is the handshake, then I see a couple

I'm setting up a pair of 60E's in HA but I'm unable to get the cluster to form, and both units think they are master.  The units were factory reset and both upgraded to 5.6.6.  I issued the following on the "primary":config system dhcp serverdelete 1endconfig firewall policydelete 1endconfig system session-helperdelete 13endconfig system virtual-switchdelete internalendconfig system globalset hostname "ussv4gvlfw1-1"endconfig system haset group-name "ussv4gvlfwcluster1"set mode a-pset password DktJSnrGZGTVSF7vset hbdev "internal6" 200 "internal7" 100set override disableset priority 110set monitor "internal1"end And this on the "secondary":config system dhcp serverdelete 1endconfig firewall policydelete 1endconfig system session-helperdelete 13endconfig system virtual-switchdelete internalendconfig system globalset hostname "ussv4gvlfw1-2"endconfig system haset group-name "ussv4gvlfwcluster1"set mode a-pset password DktJSnrGZGTVSF7vset hbdev "internal6" 200 "internal7" 10

Hello, In the quick installation guide for the FAP-C24JE (https://docs.fortinet.com/uploaded/files/3925/FAP-C24JE-QSG.pdf) it is mentioned that "FortiGate support may be available for certain region codes." and also "please ensure that you are running the Fortinet recommended version of software on both FortiGate and FortiAP units.".   Do you know for which region codes and which firmware version support the deployment of a FAP-C24JE through a FortiGate?   Thanks

Hello, I recently tried the FortiOS 6.0 and I have to rollback to 5.6.4.After upgrade, I notice high CPU usage, IDP is constantly crashing and made every policy using AV + WebFilter + APP unusable.I have not the same behavior on 5.6 version currently running. I have tried to create another APP/Webfilter, removing AV the policy, enable it on IPv4 policy only but the pb was the same. Does anyone face this kind of pb ? Here an extract of my system log. date=2018-06-02 time=13:30:29 logid="0100040705" type="event" subtype="system" level="notice" vd="root" eventtime=1527939029 logdesc="CPU usage statistics" action="cpu-usage" cpu=99 msg="CPU usage reaches: 99" date=2018-06-02 time=13:30:29 logid="0100032546" type="event" subtype="system" level="warning" vd="root" eventtime=1527939028 logdesc="Application crashed" action="crash" msg="Pid: 00259, application: ipsengine 04.012, Firmware: FortiGate-90D-POE v6.0.0,build0076b0076,180329 (GA) (Release), Signal 11 received,

Dear All, Is there any number which we can be use for technical support ? Regards,SANU

Hi, Fortinet!Recently one of my customers is asking me about this question below:Can Fortigate trigger policy fall-through when one session doesn't match a policy on the top? He means, when the srcint/dstint/srcip/dstip/service/schedule are matched, but application profile not matched, will we be able to fall through down policies till the end, or till one that matches.I think he is referring to Palo Alto policy configs when asking this. I have searched a lot but can not get an obvious answer, so I'd like to post it here to leave a mark. Thanks a lot!

Simple question for anyone who has been working with ForiGates for any reasonable time.  We need to purchaser a replacement device for our current one that is running Firmwware v5.2.1.  Can I purchase the replacement device and apply the config from our current device to the new one?  Any other considerations that need to be taken in the device replacement?

using standalone FG60E v5.4.1, logging to memory and forticloud (if I can get it working). forward traffic logs are blank. I tried UTM events, all session and web profile "log-all-urls". log still blank. also the forticloud test account button does not work and the account box is blank, but cannot be changed.

Hello Team, We are using FGT50E model with firmware version: v5.4.4 Currently we have a single WAN with 100Mbps speed details: IP: xx.xx.xx.xx subnet: aa:aa:aa:aa gateway:bb:bb:bb:bb DNS: cc:cc:cc:cc/dd:dd:dd:dd Static Route has been configured for WAN1 as: AD:10 and priority:0 We will be getting a new WAN connection of 100Mbps: IP: yy:yy:yy:yy subnet: mm:mm:mm:mm gateway: nn:nn:nn:nn DNS: oo:oo:oo:oo/pp:pp:pp:pp I have a single LAN for my clients: 192.168.1.0/24 I want to configure it such a way that clients with IP address: 192.168.1.30-192.168.1.50 should use WAN1 as their outgoing interface and rest local IPs should use WAN2 as their outgoing interface. I would like to know what should be the static Routes configured and how to specify the DNS address as both WAN are having a different DNS servers.

just a bugs fixed patch..no new features available...https://docs.fortinet.com/uploaded/files/4755/fortios-v6.0.3-release-notes.pdf

Hi there guys, we are a company that develops software for a small company. We have developed an app that makes a connection to a box server in the company using Domino Access services. It is a REST API https connection. The app is making a GET request and server sends back data in JSON format. Our app is hosted in IBM Cloud and it has public url it uses for communication. The IT security of the company is managed by a different IT technical support company and they are using FortiGate 90e firewall. The person configuring this firewall was unable to quickly have a suitable solution on how to restrict EVERYTHING else from communicating with server except that one app that has dedicated URL. We tried to block connection based on IP, but since the app is hosted in the cloud IPs can change, we were given IP ranges by IBM, but they don't even match the IP of request of the app. So we are thinking on restricting everything except these https requests from an app that was given URL by IBM c

Hello! I would really appreciate your help regarding this issue that I am having with AWS IPSEC tunnels over a Fortigate. Scenario: Currently I have a working Fortigate (F60D) with 2 tunnels to AWS VPC to servers that resides at 192.168.0.0 on one internet provider (ISP1)Now, I added second internet provider(ISP2) and a new Fortigate (F70D) with static IP that is connected to a gateway on a point to point line to get to the internet through ISP2.I would like to COPY the already existing tunnels (from ISP1) onto the new Fortigate(ISP2) that I have (to be used in tandem or as backup), so I created a new virtual gateway on amazon (AWS) and attached the gateway with the routes.The problem: The tunnels do show as "UP" on the fortigate (ISP2) but I cant reach the AWS servers.I have triple checked the configuration given from AWS and how it is added on the fortigate and cant figure out what is wrong. Also checked the configurations on AWS VPC dashboard and everything seems ok there.

Hi allI have two siteSiteA Fortinet A--- WAN1: 55.55.55.20----WAN2: 172.18.254.1--- Int1: 10.20.1.1 --- Port 3394 should be forwarded from WAN1 to 10.10.1.17 in Site B SiteB Fortinet B--- WAN1: 66.66.66.60----WAN2:172.18.254.2 ---- Int1: 10.10.1.1--- Server on 10.10.1.17 port 3389 open and ready I create vpn  using siteA WAN2 and siteB WAN2. Its work Now  need when users connect to siteA WAN1 port 3389  there was redirect through ipsec vpn to siteB to server 10.10.10.17I create Ip virtual and ip policy. But it doesnt work.    Can anyone help me?

We are now using FortiMail Version 5.3 and FortiSandbox version 2.3.3 for email scanning.In the FortiMail, we set that the email with attachment will send to FortiSandbox for Scanning AntiVirus. The integration and the operation is fine.Starting from last month, we found that no email with attachment sent to FortiSandbox for AntiVirus scanning. All the email just accumulated in the Mail queue and send to the receiver until 30 minutes timeout. We have try to send a test email to test this case. In the FortiMail log message of the testing email, it stated that the mail has been send to FortiSandbox. However, we cannot find the session ID, log ID or message related to this testing email in the FortiSandbox. No scanning process has taken in the FortiSandbox. We have checked the connectivity between the FortiMail and FortiSandbox and the connection between them is well Are there any suggestion for this issue? Thanks

like HTTP, SSH... Services? Or for Side2Side and singleside VPN's? Using here FortiOS 6.X Thanks a lot :)