Solved

Howdy, I just have a question on a firewall policy that I have been playing around with. I have an IPSec tunnel between my agency and our parent agency allowing traffic to 2 subnets on their end (192.168.139.x). On my end, we have a supernet (172.19.41.x) passing clients using their application to their servers over that tunnel and everything is working well. However, the local LAN at my agency (192.168.56.x) is on a subnet that conflicts with one at the parent agency's, so we cannot pass that traffic over the IPSec tunnel. In an attempt to get around that, I created a firewall policy to pass the traffic but with a NAT IP Pool that falls within the allowed supernet, so the conflicting 192.168.56.x subnet is disguised as the allowed 172.19.41.x subnet. This works going out but does not work coming in. I can ping the parent agency's application server, but I can't connect to it from one of the end user computers. I have the two firewall policies for this below (sanitized), can anyon

Hi, In log view or FortiView I'd like to see netbios / host names next to the IP address - or as a column - for each entry. This would save me from doing individual reverse lookups in our internal DNS.  I've looked at the settings and added columns for "host name" but they are not populated.  Am I missing a setting somewhere to achieve this?

Hello and sorry for my english, I want to activate revision on my fortigate 901G. I saw this article : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Using-the-Revision-option-to-revert-to-a-previous/ta-p/194312 But the commands doesn't works on my fortigate and i find anything in the GUI about this...How to activate revision ? i 'd like to have backup when configuration is change et come back easily in last configuration with revision. thansk a lot

We bought some Firewalls 81F, but unfortunately they all have BLE inbuilt and it is not possible to go through TEMPEST screening. Is it possible to remove inbuilt BLE? Thank you.

Hello team how to make the two interface to be best path i want each interface to carry different traffic but it canot work beacause the other interface is not best path

I wanted to download the latest firmware for my old Fortigate 50B. Running version is 3.00,build0480,070330. Where can i find it?

Hi, conserve mode is something we didn't have for a long time with all the FGs we are managing right now but now it happened the 3rd time with a FG80F cluster. All 3 times the FGs were restarted right away so we didnt have time to react and check. Normally we dont have memory issues or CPU issues in no moment when we are connected, for example right now 64% memory and 0% CPU. We changed some configurations, disabled Features which are not necessary, deactivated IPS (something we dont like), logging in the policies, etc. but it still happened. Any ideas or suggestions? Thanks!

I have a Fortigate 40f (enterprise) and a Fortiswitch 108F  Fortilink is up, see below Dunno what i am doing wrong i have no internet acces on the switch, i have now set everything back to factory.   

Hi, we have this one site which is giving us memory problems after updating to 7.4.X. First we created Stitches for IPS and WAD and we thought with that we have it under control and we can wait until 7.4.X to come out. But these last days, also with the Stitches we have always over 72% memory usage. Checking memory we get:FG_XXXX # diagnose sys top-memnode (17550): 67393kBreportd (168): 41030kBipsengine (5424): 25112kBlocallogd (175): 22091kBipsengine (5427): 21890kBTop-5 memory used: 177516kB Checking the freeable memory we get only 7%FG_XXX # get system performance statusCPU states: 5% user 1% system 0% nice 93% idle 0% iowait 0% irq 1% softirqCPU0 states: 3% user 1% system 0% nice 95% idle 0% iowait 0% irq 1% softirqCPU1 states: 5% user 0% system 0% nice 93% idle 0% iowait 0% irq 2% softirqCPU2 states: 4% user 2% system 0% nice 94% idle 0% iowait 0% irq 0% softirqCPU3 states: 5% user 0% system 0% nice 94% idle 0% iowait 0% irq 1% softirqMemory: 1910984k total, 13

Hi, we have one office with FG80E on FortiOS 7.4.4 where we have quite some memory issues (varios Stints to manage). Now we are thinking about updating to 7.4.6 (some WAD issues have been resolved) but I was checking if there could be issues with our FortiAPs. We have some 231F models with 7.4.2 which should not have any problems but my concern is about some 221E models with also 7.4.2. Anyone with experience with older FAP models and 7.4.6? Thanks!

I've been trying figure how to find the mac address and arp tables for one of our fortigate firewalls, but all the documentation seem to be for firewalls not connected to Fortimanager. As you may know, the cli becomes very limited one the a firewall when you connect to Fortimanager, and the CLI on it only seem to give the arp for the manager itself which is not very useful. We're running the Fortimanager VM64 KVM 7.2.8 if that helps. The firewall in question is 200f. Any help would be appreciated.

Hello all I'm a new fortigate user and have a Fortigate 40F at home. How is it possible to create a Fortigate firewall policy that expires after a certain period of time?I don't mean a policy with "Policy expiration - Expiration date"! I mean a policy where I can set that it can only be active for 1 hour during 24 hours and then resets itself the next day and again for 1 hour may be active.Reason of the question:I'm looking for a way to limit internet access for my teenagers to a certain time per day, so that they only have internet access for a total of, for example, 1 hour each day.  (not always same time every day - so a timer)If I could then activate this policy rule with an admin account, that would be great.Thank you for your help.GreetingBenjamin 

Hallo zusammen At home I have a Fortigate 40F for my home office.Unfortunately, my Fortigate 40F doesn't have that much RAM. (just 2GB)That's why Fortigate simply removed the proxy policies from firmware 7.4.4! ! !https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/519079?preview_token=6ac61bfb23d50d4e67fe I had proxy policies - these were simply changed to flow based during the automatic firmware update to 7.4.6!I would now like to completely switch off the automatic firmware update so that the Fortigage remains at 7.4.3 firmware version.I've tried this post several times, but every time my Fortigate updates back to 7.4.6 after about a week! ! !https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-disable-automatic-firmware-upgrades-on/ta-p/326998 Does anyone know what I can do to actually keep my Fortigate on 7.4.3????Thank youGreetingsSwiss daddy

Hello, help me please.I have two similar fortigate devices. One of them displays full license information, the other one displays it in a "short" format. Why is this happening?  

Dear Team, I would like to understand the SSL VPN connectivity features of the latest version of Fortigate combined with FortiClient. In scenarios without EMS integration, is security posture checking still supported?As shown in the figure below:Bruce Liu   

Hi Team, Our client is requesting us to use Lets Encrypt certificate for SSL VPN certificate protection. We are hosting this customer on the 1200D datacentre firewall as a VDOM. Please advise if we can use this feature? I am getting the below message and the "Lets Encrypt" button is greyed out. Use Let's Encrypt and the ACME protocol to automate certificate creation and maintenance. You will need to enable DDNS or purchase a domain. Kind Regards,Shiv AdhikaryNetwork Engineer

we are currently testing proofpoint email security software.how do i whitelist proofpoint under application control ?currently this policy do not have any application control or web filter applied. 

 Hi everyone,I've recently upgraded FortiManager from 7.4.5 to 7.4.6 and noticed a change in behavior regarding policy block names. Previously, FortiManager would prepend the name of a policy block to the name of a policy when deploying the rules to the FortiGate. However, this no longer seems to be the case in version 7.4.6.Immediately after the update I noticed that when deploying policies to the FortiGate it would fail because of duplicate policy names.For instance I have a rule defined on a Policy Package for FortiGate1 which is named "DNS" and I have a policy block called "global" appended to that policy package which also has a rule defined named "DNS". If you check the names of the rules on the FortiGate directly they had the names "DNS" and "global-DNS" before the update.After the update both rules would now be called "DNS" which leads to this duplicate issue and therefore the policy install fails from FortiManager. Current workaround is to just make su

Cross posting with https://forum.opnsense.org/index.php?topic=44897.0 due to the reason I still found no answer or clueI have a S2S IPSec tunnel between an Opnsense (24.7.11) and a Fortigate 60F (current FortiOS) device. Establishing a connection is working, but after some time (Phase 2 rekeying?) the tunnel sometimes breaks and comes back way later without any action on both sides. I captured a log trace (no debug) on the OpnSense side, see below. Both configs are correct in my point of view.Any ideas, is a debug log necessary and if yes, there are a lot of logging options with IPSec, which one?I'm no VPN or network expert, so please excuse if this is an easy mistake on my side.   2024-12-28T22:13:46 3 Informational charon 82877 14[IKE] <a075e27f-ad8d-4e7a-bd35-2f5c5ea0cee5|3> CHILD_SA closed 2024-12-28T22:13:46 3 Informational charon 82877 14[IKE] <a075e27f-ad8d-4e7a-bd35-2f5c5ea0cee5|3> received DELETE for ESP CHILD_SA with SPI e8e6a428 2024-12

Hello, We are currently running two FSSO agents for two different domains on two different servers under these domains. Is it possible to query two different domains from a single server with a single FSSO agent? Is it possible to install two different FSSO agents on a single server? What is the best practice method for this? Regards,

Hello, I have a problem. Some companies do not have FortiGate licenses. Is it still possible to perform a firmware update? For example, from Firmware v7.4.3 build 2573 (Feature) to Firmware v7.6.1 build 2573 (Feature)

I am attempting to limit access to our SSL-VPN to only specific IP addresses.  It works great for IPv4, but any clients on AT&T mobile internet don't work because they receive an IPv6 public IP address.   I tried adding the public IPv6 addresses to the allowed hosts but it still will not allow the connection it just says "Unable to establish the VPN connection.  The VPN server my be unreachable" For troubleshooting I added the "all" IPv6 addresses object to the allowed addresses group but it still will not allow a connection.   I can't find in the logs were these blocked connections would be so that I can troubleshoot the issue. My questions are:Is there something else I need to do in the settings on the FortiGate-101F to allow these IPv6 connections?Where would I find the logs of connections blocked by the "Limit access to specific hosts" setting?

 We are planning to set up a High Availability (HA) cluster in Active-Active mode using two FortiGate 901 firewalls.Our question is straightforward: is it possible to create and manage an HA Active-Active cluster without using FortiManager?As far as I understand, the creation of the HA cluster does not require FortiManager. After the cluster is established, all settings configured on the primary unit can be automatically synchronized to the secondary unit through FGCP. Additionally, the primary unit can be accessed and managed directly via its web interface.I would appreciate an official response to this query so that I can share it with my manager.Thank you for your assistance.

If you buy a new firewall alone, does it do anything like stnd packet filtering?If you buy DNS & Video Filtering Service, will it work alone and offer firmware updates or do you need this plus FortiCare?Thank you

The goal is to restore a saved database from my PC to a new Fortinac build running Forti-OS v7.2.8.  Following this article.https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Restore-FortiNAC-Database-from-CLI/ta-p/201729  Having two issues: 1- Using WinSCP, I connect to Fortinac, get authenticated, but it stalls out at "starting the session". Same result on multiple NAC appliances. 2- Looking at my directory structure in the linux shell, I do not even have this directory: "/bsc/campusMgr/master_loader/mysql/" Any ideas ?