Solved

Hi all, On systems events I discovered that there is a lot of ssh auth failed attempts with different usernames and from different ips from all over the world. for me it smells like some one/script is trying to access my fortgate. Could you please advice on better actions to take

Hello! I'm trying to migrate from Juniper to fortigate and I have a hard time configuring BGP to work as the same way from Juniper to Fortigate, Mainly to have the following settings in the Fortigate:- neighbor 2.2.2.1 { - local-address 2.2.2.2;- authentication-key "blabla2";  What would be the equivalent in Fortigate OS ?  Juniper config:: protocols { bgp { traceoptions { file bgp size 10m; } local-as 12345; group ISP1{ neighbor 1.1.1.1 { local-address 1.1.1.2; authentication-key "blabla1";peer-as 55444; } } group ISP2{ neighbor 2.2.2.1 { local-address 2.2.2.2;authentication-key "blabla2";peer-as 44555 } } } stp; } Thanks for your help !

Situation:We have a site2multi-site situation. The main site A 10.10.0.x and secundary site B 10.10.16.x .Printer 10.10.16.230 directly connected to the firewall.Site2site with IPSEC vpn tunnel Policy:Site A -> Site B allow anySite B -> Site A allow anyNo antivirus or anything enabled Problem:When we try to surf to a printer or switch webconfig page from A -> B the browser shows http://10.10.16.230/index.html  but it keeps loading. @Site B we can browse perfectly fine to the webconfig. Noticed:- Ping works in both ways- RDP works from B-> A if we disable IPV4-Offload (NIC computer)- DNS server @site A, so the client computers @siteB can surf without any issue through dns server(A)- Other sites are not having this issue- The printer cannot send mail from site B -> Mailserver Site A Already tried:- Remove ipsec tunnel and created a new one- rebooted firewall @siteB- disabled/enabled auto-asic on all policy's (A + B) Does anyone have a clue wha

# ike 0:SMS_VPN:5992: out 342E6F0B27AFEAA0D82BFE965E8C0E68051002010000000000000064D9F12BCED6F0ACE221A7391988A5F38E8115CAC54BED6219F3348EF3A91D6EAECB20F969755D914697C4D06B3354AB3A7072886F4542AE9308A9D15BA783751087D750FD92724A4C ike 0:SMS_VPN:5992: sent IKE msg (P1_RETRANSMIT): 200.7.150.150:500->200.2.166.167:500, len=100, id=342e6f0b27afeaa0/d82bfe965e8c0e68 ike 0:SMS_VPN:SMS_VPN: IPsec SA connect 6 200.7.150.150->200.2.166.167:0 ike 0:SMS_VPN:SMS_VPN: using existing connection ike 0:SMS_VPN:SMS_VPN: config found ike 0:SMS_VPN: request is on the queue ike 0:SMS_VPN:SMS_VPN: IPsec SA connect 6 200.7.150.150->200.2.166.167:0 ike 0:SMS_VPN:SMS_VPN: using existing connection ike 0:SMS_VPN:SMS_VPN: config found ike 0:SMS_VPN: request is on the queue ike 0:SMS_VPN:SMS_VPN: IPsec SA connect 6 200.7.150.150->200.2.166.167:0 ike 0:SMS_VPN:SMS_VPN: using existing connection ike 0:SMS_VPN:SMS_VPN: config found ike 0:SMS_VPN: request is on the queue ike 0:SMS_VPN:SMS_VPN: IPsec SA conn

I have a Fortigate 60D running 5.2.4 that I am trying to get the FGT to act like a router on a stick paired with a Cisco 2960x switch. However, I am having a very hard time to get the inter-vlan routing to work. Here is my current configuration.[ul]VLANS 10,30,40,50 are created on both the FGT and Cisco switch. (These show up as connected routes)DHCP is configured for VLANs 40 and 50 (This works)I have an "ALLOW ALL" policy in place to eliminate policies as a problemSwitch has a trunk port that allows the VLANs into that trunkInternal interface has no IP address assigned. Only the VLANS have IP addresses[/ul]I have been looking at this for quite a while and am not sure how to do a router-on-a-stick configuration on a FGT. Do you guys know of a good guide or some helpful tips on something that I may have overlooked?

(Noobie Alert !! - forgive any non-standard terminology...) We have 10 FortiGate or FortiWiFi installations across the country, 9 of which are hooked into the 'main' network thru IPSec tunnels.  We also have a Primary AD server, and two clone AD's at 3 of the ten locations. On the locations that have an AD server directly attached (on the same subnet) to a Firewall, I have setup an LDAP, and Remote Users as an ADMINs...   On the firewalls without AD servers directly attached, I cannot setup an LDAP poiinting to our primary AD server, which is on a different subnet, and so cannot setup Remote Users... Everytime our policy dictates that it's time to change a password, for the ADMINs, it needs to be changed in the AD, and on each of the 7 firewalls without an AD server.  Needless to say, this leads to much complaining, and occasionally to a screwup where someone needs to signon to the Master Admin to reset another Admin's password... How do I go abo

Hi guys, I have a FortiGate and three firewall policies: one for the communication from clients (laptops) to servers, one for the communication from servers to clients, and one for Internet access from clients to Internet: Clients --> ServersServers --> ClientsClients --> Internet I have configured two IPS profiles for protecting clients (target: client) and servers (target: server), called "protect_client" and "protect_server" respectively.What IPS profiles I have to use in each policy? Regards,Julián

HiI would like to implement SSL VPN with certificate authentication. I have configured SSL VPN with PKI users and CA certificate is uploaded to  Fortigate. client certificate is installed in root certificate folder. when i try to choose the certificate from Forticlient SSL VPN setting, it is not showing the installed certificate from the list. Has anyone faced this issue before? But if i select IPsec VPN option from Forticlient, i can see the the certificate from list. ThanksA

Hi, I need some assistance in setting up routing between interfaces and subnets. We have two ports that are members of aggregate interface that is connected to a cisco switch where LACP (LAG) is enabled and vlan tags were added to the trunk on the cisco cli. Clients get dhcp and also the wireless VLANS are working and packets are tagged. What I can't get to work is routing between the main native subnet on the aggregate and the vlan subnets also on the aggregate. I have tried both way policies, and a combination of policy routes and ipv4 policies. I created then another physical interface on the FortiGate and set up ipv4 policy from the native subnet to the new interface on a different subnet and I had access to that subnet.  There are also another subnet in our internal network behind a router that I can't access. Please advise if there are issues with Aggregate interface routing and if I should rather have a normal interface? Thanks

I have a fortigate 60e with 2 WAN lines coming in so I setup SD WAN with 50% volume on each and then set a SD-WAN status check and it shows as both WANs up. Then I changed my IPv4 policy instead of it been WAN1 to SD-WAN but now the internet wont work. ANny ideas whats wrong ive followed guides but doesnt seeem to work oddly. Is there a step I've missed? Switched back to just using 1 WAN for now but really wnat 2 so we have a fail safe if one goes down.

Actually, I don't understand why we have webfiltering - we aren't subscribed to it, and under the Web Filter Profile, Enable Web Site Filter is not checked.  But we are being filtered, and the filter is too aggressive - it blocks sites that are quite legitimate.  So, how do I disable this? Thanks,Harry

Dear Team ,       recently after upgrading one of my client fortigate 100e to FortiOS-6.0.1,i find out that option for FSSO setting is not available and i am not able to create any traffic shaping policy .it give me error that address name is invalid.there is nay bug in fortios 6.0.1 or they hide the optionplease help me with this .

I have two WAN interface - wan1 and wan2.SSLVPN is Listen on Interface wan1.How do I setup the redundancy of sslvpn ? Only add WAN2 on Listen interface ?Sorry I cannot do the experiment, cuz my Fortigate 200D is on production.  Thank you.

I work in company, and i must configure new fortigate 90D to existing 100C because end of life. To shorten the time I configure I do a copy and paste configuration from 100c to 90d on the backup file. Then i do restore on 90d, but load is soo long ... And now i can not access admin page at default 192.168.1.99, can anyone help me?

Hi Everybody,I have a weird question about SSLVPN tunnel mode. Now I am running a Fortigate 800C model with SSL-VPN tunnel mode, of cousre everything was good. Today there is somethimg that it makes me curious about a static route for return traffic ssl.root interface and then I tried to delete this routing line but the remote users is still running normally. Why Why???Thanks a lot.  

This is a new Fortigate and it has to run for next one week with internet provided by 4G dongle. The vlan 1 traffic via policy route trafficked to the port 12 which is connected router giving access via 4G dongle.config router policy edit 1 set input-device "vlan1" set dst "0.0.0.0/0.0.0.0" set output-device "port12" set status disable next  The server establishing internet connection through the output device port 12, as the traceroute to 4.2.2.2 is completing via a next hop that can be reached via port 12. It is doing so despite policy route kept disabled? Not finding any suitable explanation.... so would be glad to get an answer please  

Hello,We recently implemented the Forticlient with anti-virus and webfilter.I know see the System Event log full of errors of FCHelper64.exe, on all client pcs.It appears about every 5 minutes.Any idea? Version installed 5.6.3.1130 Regards,Natascha 

Hi everyone,  Just a simple question about email alerts on fortigate. To my understanding, the necessary settings are the following: config system email-serverset port 25set server smtp.example.comset authenticate enableset username FortiGateset password *************endconfig alertemail settingset username fortigate@example.comset mailto1 admin1@example.comset mailto2 admin2@example.comset filter categoryset IPS-logs enableend My only question is this: where does one get the fortigate's email address from (fortigate@example.com)? Does every appliance come with its own email address, is it a case of putting the UTM's FQDN or what? Thanks.

Hi experts, About these two timers we have the following:  According to me there is no difference when a user correctly logs off or when a user forgets to log off and the workstation goes to standby mode or disconnected:[ol]When a user correctly logs off and turns off the workstation, and the Workstation verify interval kicks in, the collector agent cannot connect the workstation and the user status changes to "Not verified". The user entry remains in the collector agent for eight hours (by default) and then is purged.When a user forgets to log off and directly closes the workstation, the workstation is again turned off or in standby mode, then when the Workstation verify interval kicks in, again the collector agent cannot connect the workstation and user status changes to "Not verified". The user entry remains in the collector agent for eight hours (by default) and then is purged.[/ol]Is this correct or am I missing something? Regards,Julián

Hello!My name is Henrique, and I am a 22 y/o apprentice, new user of FortiAnalyzer. The company I work at has been using Fortinet products for many years now, but haven't touched a whole lot in FortiAnalyzer yet. Being like this, I have been assigned for being responsible to learn more about FortniAnalyzer and make use of its report system functions.All I need to learn about is how to create simple, understandable reports, readable by non-IT people. Unfortunately, I too have little understanding of coding language and technical functions. I've seen, however, that FortiAnalyzer possesses premade, simplistic reports and charts, that could be customized to suit the company's needs.I have been searching for ways to get started through all the great videos and posts made by the team and community, and it has helped me a bit to understand basic concepts; but there isn't really anything related to getting started when you have such little knowledge of IT. What I'm looking for are on

Hello Fortinet-Support members One of our customer has a FGT 201-E Cluster enviroment - this customer Needs a IP-Blacklist solution, where they can enter 1000-1500 IP-adresses We can do that via policy rules  and objects but thats not really productive Do you know any other possible solution for that device or is there any other device that you can recommend me ? thank you ..

Hello All, could anyone tell me that why I enable AV profile on policy, but two other options (Proxy Options and SSL Inspection) are also be enabled ? Thanks. Here is my FortiGate setting:FortiOS: 5.6.4  

Hello. I was given access to one (nonroot) VDOM and I would like to add it to my own Fortimanager. However there is no possibility to configure Central Management in that VDOM. My questions:1) is this expected behavior that I cannot add my VDOM to Fortimanager if the Fortimanager feature is not configured/enabled on the root/global VDOM?2) Is it possible to assign different VDOMs to different Fortimanagers? If so then...3) ... which configuration steps are needed to have only my VDOM connected to my Fortimanager (while having the option to assign other VDOMs to different Fortimanager)? I'm really new with Fortinet tech and have not yet found the answers in Fortimanager admin guide. Maybe I'm trying to accomplish something impossible. Thanks!

Topology: Hello All, I have the privilege to manage two FGTs.(I can control NAT, Route... etc on two FGTs.) Question:1.Can I route local traffic to 8.8.8.8 via following path ?   [ Local PC -> FGT1 -> ISP1 -> ISP2 -> FGT2 -> ISP2 -> Internet ]   In other words, when local PCs visit Internet, they have to go through FGT2 first.2.If possible, how to implement it? 

Hi, Does anyonw know if or when the FortiWLC will get the FortiOS ? .. as far as I can see there is no support in Fortiwlc for either fortimanager or fortianalyzer .... and in general, the weg ui looks like 1995 :)