Solved

Hello All, I'm new to Fortigate. I've one Fotigate 40C with FortiOS 5.2. I have 2 ISPs A & B with BGP. I've terminated both the ISP on WAN1 and WAN2 Ports and have configured the same as suggested in the below KB, followed every word (except for IPs :) ) :http://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-advanced-routing-52/Routing_BGP/Dual_Homed_Example.htm All was working, but now the BGP routes of ISP A are being redistributed to ISP B and vice versa, which created a loop like problem in my network and it went down. I had to shut the port of ISP B. I am looking for the solution, so that the BGP routes of ISPs are not redistributed to each other and the failover works perfectly. Please help me on this. ThanksAjay Bohra

Hi I have FG501E with one of its FAN high RPM speed (very noisy).Is there a way to reduce its speed? Thanks

Hello Team,We are using Fortinet 50E Firewall for small office/home office environment. Currently, we are having dual WAN/internet connection live on firewall. We are load-balancing outgoing traffic with fail over. Both the connections are active/active scenario with single LAN connection. Along with that we have hosted web server and mail server by using port forwarding through VIP. Now, we are planning to introduce new 3rd Internet connection however, firewall has only two WAN ports (WAN1 & WAN2). Is there any way to provision third Internet WAN connection. Appreciate your responses. :) Regards,Mayur Rajyaguru

Hello guys, I need to delete an interface from my FortiOS 5.4, but I can not do that because there is a System Administrator (admin) as a REF. I don't know what to do with this issue. How can I delete this object to allow me remove this interface.   Thanks and regards,

We have a 200D running v6.01. I've created a SSL portal, my user can connect to it without problems. Once connected they can reach a variety of websites and other resources. The one website I've built the configuration for is the only one that doesn't work. When we click a bookmark or try to quickconnect a new tab opens in the browser, the page background changes and then there's nothing, just an empty page.I'm not sure where to troubleshoot from. The site is hosted on a linux VM, the page loads on all the browsers we test with. Its an apache webserver connecting to a tomcat 8 application. The host's apache and tomcat logs show a connection without problems. We can use the website through tunnel mode.  The one guess I have is there's a conflict with certificates or ciphers. The Tomcat app and the pages it presents are stubbornly ssl only. This isn't homegrown, it was written by Microfocus and recently released. I've dug pretty deep trying to get it to send unencrypted connect

Hello, We are deploying a WiFi solution with Fortigate and FortiAuthenticator. We will use the device self-enrollment feature and we are not sure about the "Max. device" setting within Device Self-Enrollment configuration. Does anyone know what this feature is?   We want to limit end users to connect only one mobile device to the WiFi network. Does the "max device" feature prevent this?   Thank you!

Hello All,Few days ago I discover that I'm unable to connect to elastix web site with and without web filter activated.I create a rule with any-any accept without any restriction and got the same error: ERR_CONNECTION_RESETAny help please, firewall model is 60E version 5.6Thanks and kind regards,Gr1n3 

Hello! I have Fortigate 60E and I want to forward some services and devices to internet. For example IP cameras to watch them in Android app. I have 7 cameras and I want forward all of them at ports 65001-65007. Fortigate let me forward only one camera at port 80. Same situation with Remote Deskpot Services. I don't want to forward it at default port and I need more than one RDP forwarded. Greetings!

Hi A couple of questions about Fortimanager HA cluster behavior; 1- Per to guides, they stated that:[style="background-color: #ffff00;"](If the primary FortiManager unit fails you must manually configure one of the backup units to become the primary unit.[/style] [style="background-color: #ffff00;"]The new primary unit will have the same IP addresses as it did when it was the backup unit.)[/style] Does this mean that there is no auto-failover, and the backup unit will not get the primary unit IP address?[style="background-color: #ffffff;"] [/style]In this case the managed devices will loss connectivity to FM and we have to build a new connection based on the backup unit IP... 2- when configuring HA, does every node keep its interfaces IPs, or they will share the primary unit interfaces IPs? Thanks 

Hi All, we currently use an Open Source tool to backup our network configs. This includes FortiGate firewalls and HP Switches. It's a great bit of software but can take a while to get up and running. Does anyone here use similar software that's Open Source?

I know you can reset via console, but the one I need to reset is at remote site with no IT people there.tried to walk someone through resetting it via reset in back, using paperclip, but it appears to only have rebooted it.is that due to not holding in the reset button long enough, or is that all the reset is used for ? and if you succesfully reset, it goes back to old firmware right?90d was purchased with 5.2 I think, and when user sent me picture of login screen, looked like 5.4 login.which just makes me think more that it was only restarted not factory reset. someone used this spare for testing, and no one knows password so I just need to get it factory reset, so I can get them logged in, and have them load backup of the confg file. 

Hi everybody, Small question, we've setup an "Admin Profile" for a specific admin-user which points to a specific VDOM (not global).This admin-users needs to have the ability to change e-mailaddresses for the local users in the VDOM. In global the SMTP has been configured and works, (you cannot setup a SMTP per VDOM so it uses the global settings). When I login as the "global admin" I'm able to change these e-mailaddresses for the created users in the specific VDOM. If I login with the "Admin Profile" for the specific VDOM, it tells me a "SMTP has not been configurered" so I can't change an e-mailaddress, it's greyed out with an exclamation mark. But as a global admin I can.. why the error while SMTP works for the VDOM.. Did I miss something? Kind regards,Tim 

Hello  I have 2 sites what need to be connected together temporarily until their re-structuring is finished. We are slowly fusioning both sites together but it's a bit on standby.  LAN1 (site1) - 192.168.100.2/255.255.252.0 (connected directly to fortigate 60c internal1)LAN2 (site2)- 192.168.200.254/255.255.0.0 (connected via antenna directly to 60c internal2) These are overlapping subnets, however with set allow-subnet-overlap enable I am able to have lan1/lan2 on the same subnet. I only really need 2-3 machines from site1 to talk to site2 and visa versa, but I'm a bit confused on LAN-to-LAN policies when both sites have their own internet connec./firewall/dhcp etc etc. However we have no IP conflicts between the both sites. How should I attack this? I was even thinking of maybe using WAN1 for site2 and keeping site1 on LAN1 and configure it like a 'firewall' but I'm not sure this is a good idea.

Hello,I recently got a Fortigate 50b from an old company, i couldn't manage to find the password so i did a factory reset and i downloaded the firmware from fortinet's website, i wanted to install it on the Fortigate but it doesn't start up anymore,the "status" LED is always on and i can't connect to the CLI using the console cable.Does any one have a solution ? Thank you  

Hi everybody, I've got a question about vxlan, in FortiOS 5.6 I've found the following.[ul]FortiOS 5.4 VxLAN encapsulation within IPsec only supports forwarding untagged framesAre tagged frames within the IPSEC/VXLAN supported in version 5.6? Kind regards,Tim [/ul]

I cant login SSL VPN and i debug : with this  FG100D3G17801978 # diagnose test authserver ldap Keppel-AD phunv ABCD@1234[2137] handle_req-Rcvd auth req 34006537 for phunv in Keppel-AD opt=0000001b prot=0[366] __compose_group_list_from_req-Group 'Keppel-AD'[605] fnbamd_pop3_start-phunv[1043] __fnbamd_cfg_get_ldap_list_by_server-Loading LDAP server 'Keppel-AD'[1552] fnbamd_ldap_init-search filter is: sAMAccountName=phunv[1561] fnbamd_ldap_init-search base is: dc=hcm\2C dc=keppelland\2C dc=com[974] __fnbamd_ldap_dns_cb-Resolved Keppel-AD(idx 0) to 10.244.200.199[1025] __fnbamd_ldap_dns_cb-Still connecting.[508] create_auth_session-Total 1 server(s) to try[941] __ldap_connect-tcps_connect(10.244.200.199) is established.[815] __ldap_rxtx-state 3(Admin Binding)[196] __ldap_build_bind_req-Binding to 'admin.phunguyen@hcm.keppelland.com'[852] fnbamd_ldap_send-sending 60 bytes to 10.244.200.199[864] fnbamd_ldap_send-Request is sent. ID 1[815] __ldap_rxtx-state 4(Admin Bind resp)[1056]

Hi,  I have two Wan interfaces, 1 and 2. Wan 1 is set for vlan 10 and Wan 2 for vlan 60.To be able for computers on vlan 60 use the wan 2 internet, I created a Policy Route below:  The problem: There is an http server in vlan 10 that hosts a website and it is listening in wan 1 IP (already set in Fortigate and on Http Server). Computers on vlan 10 can open the website using the wan "1"  IP but computers on vlan 60 can't reach the website. But vlan 60 can ping the wan "1" IP. When I disable the policy route created before, vlan 60 can open the website normally. What is the problem?  Thank you.    

I don't know if this is an LDAP issue or an SSL VPN configuration issue but I'll start by posting it here.  This thing has been giving me a headache for a couple of days so it's time to seek help. I've got three 80C's in three offices around the world.  All are configured identically as far as SSL VPN goes and all were working in the past.  They all authenticate against the same LDAP server where users who are members of the "VPN Users" group are allowed to log in.  I recently upgraded the firmware on one firewall from 5.4.4 to 5.4.6 and it appears it's been since this time that I can no longer log in to that firewall while the other two still work fine.  When I try on this firewall, I get a "Permission denied" error and the logs on the firewall also show the permission is denied with a "SSL user failed to log in" message. If I run a tcpdump on the directory server, I see some initial back and forth which I assume is the handshake, then I see a couple

I'm setting up a pair of 60E's in HA but I'm unable to get the cluster to form, and both units think they are master.  The units were factory reset and both upgraded to 5.6.6.  I issued the following on the "primary":config system dhcp serverdelete 1endconfig firewall policydelete 1endconfig system session-helperdelete 13endconfig system virtual-switchdelete internalendconfig system globalset hostname "ussv4gvlfw1-1"endconfig system haset group-name "ussv4gvlfwcluster1"set mode a-pset password DktJSnrGZGTVSF7vset hbdev "internal6" 200 "internal7" 100set override disableset priority 110set monitor "internal1"end And this on the "secondary":config system dhcp serverdelete 1endconfig firewall policydelete 1endconfig system session-helperdelete 13endconfig system virtual-switchdelete internalendconfig system globalset hostname "ussv4gvlfw1-2"endconfig system haset group-name "ussv4gvlfwcluster1"set mode a-pset password DktJSnrGZGTVSF7vset hbdev "internal6" 200 "internal7" 10

Hello, In the quick installation guide for the FAP-C24JE (https://docs.fortinet.com/uploaded/files/3925/FAP-C24JE-QSG.pdf) it is mentioned that "FortiGate support may be available for certain region codes." and also "please ensure that you are running the Fortinet recommended version of software on both FortiGate and FortiAP units.".   Do you know for which region codes and which firmware version support the deployment of a FAP-C24JE through a FortiGate?   Thanks

Hello, I recently tried the FortiOS 6.0 and I have to rollback to 5.6.4.After upgrade, I notice high CPU usage, IDP is constantly crashing and made every policy using AV + WebFilter + APP unusable.I have not the same behavior on 5.6 version currently running. I have tried to create another APP/Webfilter, removing AV the policy, enable it on IPv4 policy only but the pb was the same. Does anyone face this kind of pb ? Here an extract of my system log. date=2018-06-02 time=13:30:29 logid="0100040705" type="event" subtype="system" level="notice" vd="root" eventtime=1527939029 logdesc="CPU usage statistics" action="cpu-usage" cpu=99 msg="CPU usage reaches: 99" date=2018-06-02 time=13:30:29 logid="0100032546" type="event" subtype="system" level="warning" vd="root" eventtime=1527939028 logdesc="Application crashed" action="crash" msg="Pid: 00259, application: ipsengine 04.012, Firmware: FortiGate-90D-POE v6.0.0,build0076b0076,180329 (GA) (Release), Signal 11 received,

Dear All, Is there any number which we can be use for technical support ? Regards,SANU

Hi, Fortinet!Recently one of my customers is asking me about this question below:Can Fortigate trigger policy fall-through when one session doesn't match a policy on the top? He means, when the srcint/dstint/srcip/dstip/service/schedule are matched, but application profile not matched, will we be able to fall through down policies till the end, or till one that matches.I think he is referring to Palo Alto policy configs when asking this. I have searched a lot but can not get an obvious answer, so I'd like to post it here to leave a mark. Thanks a lot!

Simple question for anyone who has been working with ForiGates for any reasonable time.  We need to purchaser a replacement device for our current one that is running Firmwware v5.2.1.  Can I purchase the replacement device and apply the config from our current device to the new one?  Any other considerations that need to be taken in the device replacement?

using standalone FG60E v5.4.1, logging to memory and forticloud (if I can get it working). forward traffic logs are blank. I tried UTM events, all session and web profile "log-all-urls". log still blank. also the forticloud test account button does not work and the account box is blank, but cannot be changed.