Solved

hi,i just want to confirm if i'm doing it right when creating a new FW policy section in fortimanager.do i right-click on the specific policy, in this case in want under sequence 10, then choose "add section"?is this the same as click on the policy sequence 10 > section > + add?   

Does FortiGate BGP support the use of both 16 and 32 bit AS numbers? I've been looking at the FortiGate 7.4.2 admin guide and not seeing anything definite there to answer my question. Bill

Hi, the subject explains everything. This morning I installed the newest update. Since then noone can start a vpn-connection. Me neither - and I am sure, that my logon is correct. And the others can't be all wrong also. Everything else works, and in the office I can logon as administrator - everything looks fine.The LDAP-Server is running, and hasn't been changed at all, not even rebootet. I rebootet the FortiGate again, just in case - didn't help. We use FortiTokens, but it is not asking for the token - already a problem with the logon. Any Ideas?

Hello, I would like help with the following problem.As shown below, creating a URL Object (Policy & Object Address) is subject to the maximum limit.  So, I am curious as to whether it is possible to expand the limit.Thank you so much!

Hello!I am trying to import secret with secret upload template but can't understood how to mention target because after importing it shows empty and I need manually convert it and choose right target. This target address is available in host field after importing.Anyone experience such issue and can point me with solution?

Hello, I am implementing a scenario in which I have branches connected to the headquarters through IPSec tunnels. In my environment, I need to direct all traffic originating from the branch's local network through the IPsec tunnel so that this traffic destined for the internet uses the headquarters' WAN. For other services at the branch, I need to use the local WAN link. For example, branch office ether1, network 192.168.56.0/24, all traffic must be routed through the IPsec tunnel. As for ether2, network 172.16.56.0/24, traffic must be directed through the local WAN. I already have this working environment, I am using IPsec SDWAN to close the tunnels, make them redundant across different WANs and my question/problem is the following. For traffic originating from the branch network, 192.168.56.0/24 and destined for the internet to work, I must have a static default route created in the headquarters firewall, with gateway to the WAN 10.100.100.2, withou

Hello everybodyHow can i route youtube traffic only to the backup isp via fortigate.

  Hello, I am implementing a scenario where I will have a headquarters and several branches, connected through IPSec tunnels. In the headquarters firewall I will have a fixed public IP address and in the branches I will have internet links with dynamic IP addresses (CGNAT and LTE/4G). I need to connect two IPsec tunnels per branch with the headquarters, one tunnel for each WAN and I need to use SDWAN to control this traffic and define the SLA for each tunnel. I already have this working format using IPsec SDWAN, where I create 1 tunnel for each link.However, at headquarters, I only have one WAN interface and I use it in all tunnels with branches. Could this cause me some kind of problem? I've already noticed that when I make a change on the matrix side in a tunnel, it momentarily "drops" the connection in the other tunnels.What is correct on the head office side, considering that I only have 1 WAN interface, is to have 1 tunnel for each branch? Today

Hello! I'm setting up override on my cluster and I saw this article: Primary unit selection with override enabled | FortiGate / FortiOS 6.0.0 | Fortinet Document Library It says that we lose configuration changes if the primary goes down, we do changes on secondary (that is going to be temporarily primary), primary comes back up, negociates to get his primary status back and overwrite the changes made on the secondary (who lost his temporary primary status). By using the setting that the end of the article: set override-wait-timeCan we avoid losing configuration changes if the override-wait-time is long enough?Does the secondary will have time to overwrite the primary configuration before primary negociates to get his status back? I know that setting is there to smoothen the transition, but was wondering if it could have that nice side effect. Thanks!Konnan

How exactly is this code used?I want to set ondemand 10gb but it doesn't work.  filesize-limit [-h|-l|-t] -t[all|ondemand|netshare|jsonrpc|icap|device] -v[MB] -u[MB]

If i want to supply FortiGate-60F from 12V DC source - what is min and max input voltageis it the standard 12V ±10% ??

Hi All, My boss has asked to me is it possible to accessing proxy server via public IP or FQDN which published to public?The goals is he want to use proxy from internet while out of office.I have suggest to use PAC for another option but he asked for first option possibility. Can you guys help me for the solution like this is possible or do you have alternate solution to achieve the goals?FortiProxy FortiGate 

hi , can anyone please advise what is the default tcp handshake timeout value? I know the default session time out value is 3600 sec. thanks in advance!

I am setting up a Hub and Spoke ADVPN with BGP. The VPN tunnel itself work well. I can ping both way within the tunnel. However, a BGP routing cannot be not established unless I created a neighbor instead of a neighbor group in my Hub BGP settings. The Hub BGP settings even worked with a neighbor alone and without a neighbor group.Hub: FortiGate 60F FW: 7.2.8Spoke: FortiGate 40F FW: 7.2.8 Hub BGP (working):config router bgp    set as 65000    set ibgp-multipath enable    set additional-path enable    config neighbor        edit "10.0.61.4"            set soft-reconfiguration enable            set remote-as 65000            set route-reflector-client enable        next  &n

We are wondering if there is a way to display the Comments for a rule on the Firewall Policy screen? 

Hey All, Is it possible to update the Internet Service Database manually, without TFTP'ing or FTP'ing the file onto the Fortigate?I have the file downloaded locally on my Win11 PC and have local access to the FW etc? Thanks, 

Hello everyone, I'm facing some security alerts in the software (here I would put the site's name) flagged on the website www.virus.total.com and would like to understand better how to distinguish between legitimate 'alerts' and 'false positives'.Could someone explain to me what criteria are used to determine if an alert is genuine or if it might be a false positive?Also, what are the best practices for handling these alerts without compromising the security of my system, and what are the direct channels for contacting for clarification, alert removal, or for engaging services related to this issue?Thank you for your help!

Hi everyone, I want to set a different time server than the one provided from Fortinet. I have run diagnose sys ntp status, and have found the synchronisation status set to "no". I have read this is a common issue and want to set a different time server for my Fortigate but I still get the synchronisation status error. The NTP server I want to use uses a hostname and has no static IP address. I have tried to use the guide posted in another thread but it has not worked for me so far (https://community.fortinet.com/t5/FortiGate/Technical-Tip-An-alternate-way-to-sync-the-NTP-server-to-avoid/ta-p/280309). Does anyone know how may I fix this issue? P. S. Why is synchronisation with Fortinet NTP server set to "no" despite time being accurate in the GUI? 

Hi all, new Fortigate user here.  Looking at our Fortianalyzer we have the error You have exceeded your daily logs GB/day licensing limit within the last 7 days. I've been through this forum and done some Google-Fu, so far so normal.  However, and I only saw this just now, the dates are totally wrong. This is where Google-Fu fails me and I call upon the experts to assist.  Any ideas? Cheers, Simon.

HiI tried several times reading about how NAT works in Fortigate, but it doesnt work.FortiGate 60F, firmware 7.2.8 build 1693.I found many guides using "IPv4 policy", but this is not present in my "Policy & Objects" menu, I think maybe different firmware.So I create Virtual IPs I need, then I create firewall policies from wan to virtual ip.But it doesn'n works, i presume i made something wrong o I didn't do at all something that is necessary.I am new in FortiGate, coming from other manifacturer products, any help is welcome. Edit: I add some informations may help:System is in NAT mode.Gateway is a modem/router Fritz, and Fortigate is in DMZ on it.Activating https admin on wan interface, it is reachable from internet.   

Hello everyone,is it a solution to manage ldap servers integrated to a fortigate, but with an account in protected users group.It seems that once the account i use to connect my fortigate and my AD servers is put in the protected users group, the fortigate cannot contact ldap servers anymore, so all the SSL VPN authentication requests fail. Thanks for your help, if you have any solution.

Hello  Please can you let me know if it is possible to create multiple remote access SSL VPN Tunnels (vrf aware). I have two LAN interfaces (subnet overlap) in separate VRFs. I want 2 ssl.root interfaces so that I can add VRF information.  Is this supported ? Thanks

Dear Expert, I am searching Fortigate SD-WAN load Balancing, and I found 2 commands:1.set load-balance-mode [source-ip-based|weight-based|...]This command is under : config system sdwanAnd: 2. set load-balance [enable|disable]This command under: config service (SD-WAN rule)I don't understand what is purpose of them , and why do FortiGate SD-WAN has  these 2 commands look like same ?Because, if traffic match sdw-wan rule, the command 2 will execute, right ?, and when command 1 is executed ?Thanks !

Dear Team, We have Endpoint authenticated via FortiNAC via RADIUS Local. Endpoint has Persistent Agent installed. Our purpose is to give endpoint access when their PC is compliant but we noticed that endpoint shown OFFLINE on FortiNAC after around 30-40 minutes. This offline cause endpoint compliance being failed. During that time, FNAC also mark switchport as Link Down, Not Connected while on Actual Switch , Port is still connected, Authorized by Radius, MAC Address Table shown on the switchport. Note: Endpoint has PA installed, Switch integrated with L2 Polling SNMP, RADIUS.  Thank You FortiNAC

Hey All,I am having an issue with setting up VIPs to redirect incoming traffic on a FortiGate with Central NAT enabled to a remote public IP. A few months back, I had a need to change existing VIPs that mapped from public to private, so that the new mapped IP was another public IP that is not ours. I found this article, and it all worked nice a smooth from testing to deployment in production. This was on a 200F at 7.2.8 without Central NAT. The one strange thing is that I don't get any hits on the Policy Routes. Now, I have to configure the same thing on two more FortiGates, both also at 7.2.8 - one is a 200F without Central NAT and the other is a 100E with Central NAT enabled. I'm having an issue with the 100E. There is a Central NAT policy that says any>internet / src all | dest all / NAT as outgoing interface. There are three other policies that should not be affecting my traffic as they have defined interfaces and addresses that are not involved with this. The 100E has