Solved

I have a, maybe silly question but maybe someone can answer me.. We have FAC setup with RADIUS clients in a 10.10.0.0/16 subnet, mainly used towards switches for MAB. The thing is we want to configure VPN for a firewall with an IP in the same subnet. Is it possible to configure this as a /32 without it being affected in the /16 subnet policy?

Hello, I am trying to setup a FortiAuthenticator policy for Wireless dot1x. The authentication works but RADIUS attributes (vlan and ACL) is not pushed to client.Here is what I have tested; Added the Remote LDAPCreated a User Group which retrieves user via LDAP Filter (not via imported users).Created a Realm for LDAP UsersCreated a Policy that:WLC as RADIUS ClientAuthentication Type Password/OTP (PEAP and EAP-MSCHAPv2)Identity Source - username@realm - Points to LDAP Realm, uses Windows AD Domain Auth and filters on the groupAuthentication Factors - Password Only and Windows AD computer authentication I have tested with User Group pointed to imported users and remote user sync rule but that does not work either.Does anyone have any idea? I checked the debug logs but cannot find anything interested. Also we havetested this with a local group (MAB) and it works fine.

If use lacp-mode static because the peer equipment does not support lacp, it seems similar to use h/w switch or s/w switch instead of LAG. What's the difference between Fortigate's lacp-mode static and h/w & s/w switch?

Hello to all,I’m trying to build a single spoke hub & spoke (Dual hub) topology using the overlay template provided by FMG 7.6.3.The architecture is formed by 2 VM fortigate hubs in 7.4.6 and an onprem A/S pair that acts as spoke in 7.4.6.Full internet topology, each hub has only one link while the spoke has 2.All the tunnels are UP, and HUB side I see the advertisement in BGP of the test subnet that I’m using onprem side (192.168.99.0/24). The BGP advertisement has something strange, I would have expected to see the VPNs as next-hop interfaces, instead it uses directly the port 1 (outside of the hub) used by the underlay.I noticed that the templates created by FMG do not assign an IP on the HUB interface tunnels, I don’t know if this is an error.From the hub loopback (172.16.5.252) I can successfully ping the spoke’s Lo (172.16.5.1).

Both the FortiGate Firewall content processor（CP） and the network processor（NP） have IPsec encryption and decryption functions, and there is overlap in their functions. How are the two processors divided in IPsec encryption and decryption?

Hi all,I'm doing a trial setup of some FortiExtender FEX-202Fs with my existing Fortigate 91Gs which are managed via a FortiManager VM. I plan on using these as LAN extenders for remote microsites. I've managed to get the FEX units working well with the FGTs on their own, but the trouble comes when I try to use FMG to create firewall policies involving the FEX interfaces.  In the FGT UI, I can see the FEX units correctly appearing under the "LAN Extension" category. Firewall polices work fine when configured directly on the gates. However, when the FGT configs are imported into FMG these same interfaces appear as the "VLAN" type. I am then not able to select these interfaces when making firewall polices. I'm assuming this is because the "role" variable on the erroneous VLAN page for these interfaces is set to "Undefined". Unfortuantely I am not able to change the interface role, as an error message appears notfying that "VLAN ID must be between 1-4096", but the option to set

Good morning! How does static mode work in LACP on Fortigate?As far as I know, Fortigate don't send lacp messages in static mode,so how can I communicate in a static-static configuration? Thank you

FortiNAC self-registration Guest Management with wireless dynamic Vlan management .During the registration process without doing nothing . I got a native vlan ip.In NAC's Network>Inventory>Device>Virtualized Devices>root I haven't add native Vlan id . What is the fault ? 

One of our customer planning to integrate Forcepoint DLP with our FortiGate firewall using ICAP profile and require information regarding SSL inspection, specifically whether deep SSL inspection is necessary for this integration. As deep inspection enables the firewall to decrypt, inspect, and re-encrypt encrypted traffic by acting as an intermediary, which requires distributing FortiGate’s CA certificate to all endpoints to avoid certificate warnings. Could you please confirm if deep SSL deep inspection is mandatory for Forcepoint DLP integration with FortiGate?   

Hello! Our fortianalyzer stopped displaying logs 2 days ago. I am using fortigate with version 7.0.13 build0566 and fortianalyzer with version 7.6.3.From the fortigate graphical interface I can successfully run a connection test with fortianalyzer. However, through the CLI command "execute log fortianalyzer test-connectivity" I see the output "Log: Tx & Rx (log not received)": execute log fortianalyzer test-connectivity FortiAnalyzer Host Name: FAZ-MINUANO FortiAnalyzer Adom Name: FortiGate Device ID: FGT40FTK21099EV4 Registration: registered Connection: allow Adom Disk Space (Used/Allocated): 0B/Unlimited Analytics Usage (Used/Allocated): 0B/Unlimited Analytics Usage (Data Policy Days Actual/Configured): 0/0 Days Archive Usage (Used/Allocated): 0B/Unlimited Archive Usage (Data Policy Days Actual/Configured): 0/0 Days Log: Tx & Rx (log not received) IPS Packet Log: Tx & Rx Content Archive: Tx & Rx Quarantine: Tx & Rx Certificate of Fortianalyzer valid and ser

Hi, Would like to know if I can backup a FortiGate device through FortiManager?

Hello everyone, we use a FortiMail VM02 with version 7.2.5. I would like to set up a "Content Profil" for attachments that only allows selected (explicitly defined) "File Types" and "File Extensions" to pass through.All other "File Types" and "File Extensions" should be removed from emails. (and insert some disclaimer, send notification, ...) I've set up "File Filters" for the allowed "File Types" and "File Extensions".In addition, I set up a "File Filter" "all_other_attachments" with “File Type” and “File Extension” “*.*”. But no matter how I combine these "File Filters" in a "Content Profile" ("Attachment Scan Rule" operator "Is" or "Is Not" and regardless of the order) all attachments are always removed from emails.The log always says "File name: testpicture.PNG, detected by Content Filter, attachment scan rule: all_other_attachments". Can anyone give me a tip on how I can implement this allowlist?How do you manage email attachment restrictions? Best re

hi there, I need to add override url so won't be blocked.what I understand, there are two way:1. create custom web category2. add url on web filter profile am I correct?there are hundreds url address that I need to add. what is the best practice to add locally, without add manually one by one?thanks

All our FortiGates (running 7.2.8) are managed by a virtual FMG (running 7.2.5), and backups have run consistently since they were setup. We recently implemented FAZ, and as soon as we setup a root for the security fabric, every backup has been failing except for the one that is the root. The backup for the root FortiGate is now creating 5 files every night (file sizes are different) and we get 5 alerts; also, all files are in the same folder. Files are encrypted, so I don't know if they are all from the same firewall, but I may disable encryption for a night to see what I can find inside the files. Incidentally, we have 13 FortiGates and should have 13 backup files. Can someone point me in a direction to look at to figure why the backups are no longer running? Thank you.

Hello,we have different sites connected between us via three vpn ipsec with different isp using sd-wan and static routing.We want to move from static routing to bgp and started some test on one vpn using the normal neighbor configuration and all is working, the peering is ok and i see the routing table.Using three vpn ipsec ffor each site connected ivolve a lot of neighbor to configure.I want to use neighbor-group and neighbor-range, but the documentation about this is lack of details.Can I use the neighbor-group on each side?And also the neighbor-range implementation is not clear, what infomation I must insert when I declare a network range?I implemented a test configuration, but the peering process is not started.Below the schema  For test purpose I using only vpn over isp3.In network range I declared the ip configurated in system interface for interface peer.On phase1-interface I disabled net-device.I set also the policies to allow ping and tcp 179 between loopback interfaces.B

I have 2 offices, Site A is Sophos and Site B is Fortigate. I have established Site-To-Site VPN for the two sites. The tunnel between the two sites is UP, but the Tunnel Interface IP cannot ping each other and the two sites cannot ping each other. The server under the site cannot ping the opposite endpoint. The following is relevant information:Site A (Sophos)WAN IP : 11.11.11.11LAN IP Subnet : 172.29.21.0/24, Server IP: 172.29.21.11 (LAN Gateway under Sophos Firewall)Tunnel Interface IP : 10.212.0.1/29Firewall Policy: Accept LAN(172.29.21.0/24) toVPN(10.210.101.0/24) Site B (Fortigate)WAN IP : 22.22.22.22LAN IP Subnet : 10.210.101.0/24, Server IP: 10.210.101.11 (LAN Gateway under Fortigate Firewall)Tunnel Interface IP : 10.212.0.6/29Static Route: 172.29.21.0/24 via interface S2S_DCOF_MFirewall Policy: Accept LAN(10.210.101.0/24) to S2S_DCOF_M(172.29.21.0/24)  (Below Fortigate IPSec Tunnel Status)   Here I'm using Route-based to establish a Site-To-Site VP

Hi Community, We have 2 IPsec Tunnels (Tunnel 10 and Tunnel 20) between Fortigates (Remote and Concentrator) with only 1 Phase 2 Selector configured and auto-negotiate disabled. Both tunnels are working as expected where we have connectivity from both sides.  Tunnel 10 is presenting 2 Phase-2 Selectors via GUI und CLI, where the first Phase-2  is UP and the second one is DOWN. We have already deleted the entire Phase 2 Interface and reconfigured it, restarted the entire cluster (A-P) and nothing helps. We really don´t understand why there are 2 Phase Selectors in a scenario where we have only 1 configured, please any idea how to troubleshooting and solve this issue? FortiOS 6.4.11 and keep in mind that Tunnel 20 with the same setup in the same device has not this issue and we have several others FGT with the same setup and also not presenting this issue.  I really appreciate any comments, thank you!FortiGate 

The only link I can find on the support site with this scenario I am wanting to achieve is https://community.fortinet.com/t5/FortiGate/Technical-Tip-DNS-database-with-FortiGate-as-a-slave-to-a/ta-p/192942 where it gives the basic items to do to get this working. What I am making further inquiry about is what might need to be done on the Windows side? i.e... since this is going to a secondary DNS, is the FortiGates's DNS, BIND, and thus I need to set the Windows DNS properties to allow BIND secondaries? Do I need to turn off DNSSEC for remote responses? Just those types of inquiries since the article did not expound on that at all...and since I am running into errors, this has gotten me to make further inquiry. From the Windows side of things, I get a "Validation error, please try again later".  From the FortiGate's side, when I do "diag test application dnsproxy 8" from the CLI, I do get record information like the example output of the link provided, yet from the G

After upgrading our FG200E from v7.2.4 build 1396 to v7.2.5 build1517 our configured SD-WAN zone and both of our WAN interfaces no longer show up in the dropdown selection "Outgoing Interface" when editing or creating new firewall policies.Additional facts I have collected so far:I can see and edit the SD-WAN zone under "Network" > "SD-WAN".When editing the SD-WAN zone, clicking on "References" delivers no results.When editing the SD-WAN members, the dropdown "SD-WAN Zone" shows no selectable entries.I can use the configured SD-WAN zone in firewall policies and edit the zone and the members via CLI, so there is a workaround, it seems to be a web-GUI issueDoes anybody know wether this is a (known) issue with the firmware or are there any possible mistakes we could have made in our configuration which just did not pop up until after the upgrade?

Fortgate 80E firewall memory usage hanged up at 82% and Firewall Showing (Conserved mode Error). Which stopped firewall mode to 82% usage for safer side.Some services were working and some were disturbed. I deleted all logs of fortigate to resolve this issue.  Needs suggestion from Senior members what was this issue, why this occured , what is best approach to reolve this issue? Either my solution was true or not?

Hello! I have an odd problem with L2TP server over IPSEC on my FG-100F box running 7.4.6 software.My configuration:config vpn ipsec phase1-interface edit "L2TP-VOLZ" set type dynamic set interface "VLAN96-TESTLAB" set ike-version 2 set peertype any set net-device enable set proposal aes256-sha512 set dpd on-idle set psksecret ENC <removed> set dpd-retryinterval 60 next end config vpn ipsec phase2-interface edit "L2TP-VOLZ" set phase1name "L2TP-VOLZ" set proposal aes256gcm set encapsulation transport-mode set l2tp enable next end config vpn l2tp set status enable set eip 10.100.251.254 set sip 10.100.251.1 set enforce-ipsec enable set usrgrp "IPSEC VPN" end config system interface edit "l2t.TESTLAB" set vdom "TESTLAB" set allowaccess ping set type tunnel set snmp-index 99 next end config system interface edit "L2TP-VOLZ" set vdom "TESTLAB" set ip 0.0.0.0 255.255.255.255 set allowaccess ping set type tunnel set snmp-index 129 set interface "VLAN96-TESTLAB" next end confi

Hello,trying to convert a FTD policy to Fortigate using FC 7.2.0.Some ACLs contain multiple source interfaces.The converted policy imho seems to miss source interfaces.This happens with FTD ACLs having multiple source interfaces as well.example: access-list CSM_FW_ACL_ remark rule-id 268444674: ACCESS POLICY: ACLFirePower - Mandatory access-list CSM_FW_ACL_ remark rule-id 268444674: L7 RULE: Inside_kms access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc Verwaltung any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc Bibo_Inside any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc Inside any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list CSM_FW_ACL_ advanced permit tcp object-group-ifc ServerNetz any object-group-ifc ServerNetz object rz-kms eq 1688 rule-id 268444674 access-list

Hello Everyone, I deployed a FortiSIEM 7.3.0 standalone supervisor and one collector, and they were working properly. However, now the services are frequently down and I can't access the GUI; it requires restarting manually. Even after restarting, they are still too delayed.additionally, the default Super organization is not found in the list of organizations, and the  collector health status is in Critical (Collector Buffer greater than 50MB).please, everyone assist on this!

Hi Dear Community Members,  I am bit confused to take and restore Fortigate 201F firewalls backup.  Someone clearly guide me , how we can take and backup 2 fortigate firewalls if they are operating in HA mode Primary and secondary. After backup how we can reset them and restore again backups so that previous primary remains primary only restoring backups.  --> Either we need to take backup of both firewalls--> Primary & Secondary individually or only using HA cluster ip --> after resetting both firewalls or only primary firewall if we restore those taken backup eithe previous primary will automatically become primary and secondary will syn again? 

I have a 61F firewall with 1 Gbps ports.   Comcast raised the download speeds to 1100 Mbps and use a 2.5 Gbps port.  How can I get a 2.5 Gbps switch and put two cat 6 cables from it to two 61F ports and link them for WAN?