Solved

 Hello Expert, I have two 400E in a HA cluster .We use the default HA ports for Heartbeat interface but had to add redundancy using the lan port.(BR_DATA port8) After reviewing numerous documentation we found that this was not best practice since the lan port is heavy use for data.I would like to assigned a new deliciated port (24)  to be my  backup heartbeat and remove (BR_DATA (port8) but would need some guidance since this is a production environment.  Also to configure port 24 as heartbeat port are there any special configuration need prior to it being assigned . GuyOffice-1 (ha) # showconfig system haset group-name "trans_amt"set mode a-pset password g==????Swdeeset hbdev "ha" 200 "port8" 100set session-pickup enableset override disableset priority 200set monitor "port8"end Thank you 

Hello, I am new to FortiManager and have successfully imported my two devices and their respective VDOMs. I have placed a specific VDOM into a specific ADOM because I want my client to manage it autonomously.When I am in the specific ADOM, I can create a firewall rule without any issues. However, when I try to push the configuration to the Fortigate, the device is not found. Do you have any idea why this might be happening?   Thank you for your help!

Hello,I have the following setup:FG 60F at our HQ - LAN IP: 192.168.205.0/24FG 60F at our DC - LAN IP: 192.168.5.0/24L2TP clients connecting with Dial-up connection and getting IP from subnet 192.168.199.0/24HQ and DC are connected via site-to-site ipsec VPN and both subnets x.x.205.0/24 and x.x.5.0/24 can communicate. When I connect to HQ as a L2TP dialup user I can access the network on HQ x.x.205.0/24 but I cannot connect to DC. I add a policy on HQ which allows traffic from L2TP-VPN to DC but it is not working. Can anyone please help set this up so a dialup user will only have to connect to HQ to gain access also to DC?

 Hello,I'm having trouble configuring an SSL VPN on my FortiGate 40F device. I've been searching for the corresponding configuration tab, but I can't seem to locate it anywhere. I also checked the "Core" section under "Feature Visibility," but to no avail. My firmware version is 7.4.4.Could you please assist me in understanding why I'm unable to access the SSL VPN configuration? I greatly appreciate your help.Thank you,

Hello,I am in the process of learning and understanding FortiManager and what it can do for my FortiGates.    I have one FGT that I am working on that was in-sync with both Config and Policy.  I changed a policy object, added a local user and added it to a group, and proceeded to install the change to the FGT.  Upon review in the Installation preview it listed out a bunch of things that were going to be deleted on the FGT.  I did not make such config changes on the FMG nor did any of my co-workers.  The FGT had not been edited either, everything was in-sync prior to the changes on the FMG.   So... what mechanism determines what things are to be deleted? is there a way to see this in the GUI? can I alter this so that it doesn't delete things unless I say so?  is there a flag to check or something? Just trying to understand what this thing is doing so that I or my co-workers don't delete something important and so that I can exp

I have Fortimanager installed.  I added my fortigate devices and can see them in the Fortimanager but I can also see that when I make changes in Fortimanager to the Fortigates I do not see the changes reflected on the FortiGate.  I am also not seeing the logs from the fortigates on the Fortimanager even though its configured. Does anyone know of any good videos or the like showing how to add Fortigates to FM and how to manage the Fortigates in FM... I am running Forigates 7.4 and Fortimanager 7.2

We are in the process of moving from on prem Exchange to O365/Exchange Online hybrid deployment.Can anyone advise which ports should be forwarded:- From O365 to on prem Exchange.- From O365 to on prem AD servers. FG FMW is 7.4.4 (Not brave, forced by insurance to keep firmware up to date...) I have all ports and FQDN listed in Microsoft white papers entered and policy from on prem servers to O365 in place. I've been using all sorts of firewalls in the last 30 years but Fortigate's VIP is by far the weirdest thing ever. Good idea, but poorly implemented and very limited functionality. Thank you for any suggestion you may have. (Yes I did search the forums but I hope I don't have to RTFM) T  

HI AllRecently something has popped up, our work internet line is being maxed (40mb up and down line speed from the ISP), when i check under Fortiview Sources the bandwidth doesnt match whats being used which tells me something else is using the bandwidth, is there any other way to check. All traffic goes through the Fortigate, so Im a little stumped. Any advice? Fortigate 60F v7.0.12 build 0523  

Hi all,I have a configuration request from one of my client . They have 2 isps wan on their Fortigate soo they need to use separate dns for they wan link. And also they have different vlan created on lan interface and half are routed through isp1 anf half are routed through isp2 so now they need to Use separate Dns for they lan traffic passing through both isp link so how can i configure that ??? Please help 

I'm using the latest and greatest Forticlient (ver 5.2.2.0624) and I also have installed certificates from a Smart Card I use for other business. However, when I open the the Forticlient and try and use the SSL-VPN, I'll immediately get a prompt to install the smart card. I've verified that "Client Certificate" is NOT checked on the connection settings yet it continues to want and check the client certificates from the Smart Card. Need to find a way to get the Forticlient to NOT check for them without effecting the installed Smart Card certificates.

Looking for the effects of enabling DPD on IPSec tunnels using Dialup connections. We have a remote site with 2 ISP connections and our main site which also has 2 ISP connections. From each site, we have 2x tunnels connected on each ISP for a total of 4x tunnels. We ran into an issue where one of the ISPs went down, but traffic was not redirected over either of the remaining 2 tunnels. I want to enable DPD on these tunnels which is pretty straight forward, but I cannot find any information regarding the effects enabling DPD may have on a dialup connection and being a remote site, I don't want to inadvertently bring the site down. Any input or advice would be greatly appreciated!

Hi, hope you are doing well,I would like to confirm if the FortiMail 200F does not provide Data Loss Prevention (DLP) functionalities? Therefore, I will have to suggest a 400F instead for my client. Thank you.

Hello guys,I have a dual WAN scenario and honestly I have some doubt.I noticed that when the SD-WAN has been configured, I can't create any WAN to LAN policy.There is a way to create a NAT 1:1 SD-WAN -> LAN policy?Therefore, is this the the right way (set-up SD-WAN) to obtain this goal:if the WAN2 (WAN2) fails or run out of bandwith, then activate the WAN1TNX

Hello team.As far as I understand in 802.1x authentication there are two mechanism evolved to authenticate supplicant. The outer method than encapsulates and secure the eap messages (like PEAP and TTLS) and inner methods (like PAP and CHAP and ms-chap-v2). I can see that PEAP can be used along with mschapv2 and this is clear when I configure the supplicant. However, I am not sure what mschapv2 means when it is listed among other methods in Fortinac RADiUS configuration as outer method. And can mschapv2 used alone in 802.1x and how can I configure the supplicant correctly to use it.

 Hello, I'm trying to connect my FortiGate to FortiManager.   My FortiManager (10.10.0.2) VM is in VLAN 10, directly connected to FortiGate A (10.10.0.254). I successfully connected FortiGate A to FortiManager. My problem is with FortiGate B. I created an IPsec tunnel between FortiGate A and FortiGate B and created rules (any to any) to allow traffic between VLAN 10 (A) and VLAN 40 (B), but I can't contact FortiManager from FortiGate B (10.40.0.254). Do you have any ideas?

Hi,I'm deploying FortiGate SDWAN with dual-hub (DC and DRC) with many spokes. The spokes may not required to communicate each other, so that ADVPN is optional.I have routing challenge when I use iBGP between Hubs and Spokes. At the first, the iBGP includes Hub to Hub, Hub DC to Spokes, Hub DRC to Spokes. Then behind the hub is connected with router which is running OSPF. In that case, I need redistribute the spokes prefix from BGP into OSPF, but I found some routing loop issue in the behind caused by redistribution and advertises OSPF between DC router <> DRC router and advertises iBGP between Hub DC <> Hub DRC.My colleague advise me to use eBGP instead of iBGP for Hubs to Spokes and Hub to Hub. I need insight about what impact or disadvantage if I use eBGP in SDWAN deployment. Since I learn that the best practice of FortiGate SDWAN is to use iBGP. Thank you in advance.

Hi All, I am getting below error when attempting to connect VPN. This is new setup so kindly advice what could be the issue.   

   Good day family, Background:We have 2 ISP (like most companies do for fault tolerance)  Fortimail worked well until incoming mails (external) stopped coming/not being logged at all. My manager switched over to the other ISP2 for incoming mails (with the concern about our mail server being on the DNSBL due to public IP change) to start working coming in. Timeline:May 21, 2024 : ISP 1 went down, ISP 1 is designated for smtp traffic, no more incoming mails (external & internal), neither being logged in Fortimail.May 21-22, 2024 : Failed over to ISP2,  Fortimail incoming mails(external, internal) started coming in and being logged.May 22-23, 2024 : With ISP1 still down and Fortimail still coming, An IT team member made some change in either the public dns/DynDNS or Fortigate Firewall. As are result, no more external mails are being received as well as being logged in Fortimail. Internal mails are being received locally, but not logge

Gents, Need some help here.. I setup s2s. Tunnel is up and both p1 and p2 are up, however I encounter issue. Customer can't reach my loopback ip but loopback ip can reach and ping customer ip.  I've attached diagram and log result for everyone's information. Maybe I missed something here. Btw, it was working on 1st day and suddenly stop.  A kind support is highly appreciated.diagram and log resultRegardsHB

Hello, we have a Fortinet Wifi 60D. Now we have received the access data from our new ISP in the form of IP address, subnet mask, gateway etc.But I just can't find where I can set the gateway. For your information: WAN Port 2gets its IP settings from the DHCP of the Fritz Box AVM router from Vodafone and is our current working connection.WAN Port 1 has to be set manually by us.The IP address, the subnet mask and the gateway were given to us by Telecom.I have read in other posts that this is only possible via a static route, is that correct? Please find attached a network plan and our routing table.The current static route is obsolete I think, because it was something the guy before my did for using VPN. Right now we just need an easy setup, so if WAN1 ISP has a problem we just deactivate WAN1 and activate WAN2. No Loadbalancing, no automatic failover (maybe I like to do it in the future, but right now I just need the simple setup). 

Hello,I have WAF ( FortiWeb-VM 7.4.3,build0638(GA),240405) & I want to whitelist IPs ,is it available ?

Fortinet has an article posted about which FortiOS is recommended in comparison to hardware platforms (Technical Tip: Recommended Release for FortiOS - Fortinet Community).  I have been wrecking my brain in trying to better understand what the philosophy is behind the recommendations.  FortiOS 7.0 was released roughly 3 years ago (2021-03-30) and therefore has obviously the most bug fixes in it.  But according to the product life cycle page it will reach the end of it's engineering support by the end of this month (2024-03-30, Fortinet Service & Support).   FortiOS 7.2 has been on the market for 2 years now (released 2022-03-31).  I am surprised that it takes Fortinet roughly 2 years to finally recommend it's own software for usage.  It almost seems like the only reason why Fortinet considers the recommendation for 7.2 now is because 7.0 has reached its EOES.   Does anyone know why Fortinet would not potentially recom

I had a working IPSEC VPN between our main site and my home computer, a few days ago my VPN stopped working and I can't figure out why. So let me lay the important VPN details down:- Fortigate model: 100-F- Fortigate unit NOT behind NAT.- Home computer IS behind NAT.- OS: Windows 11 Pro version 22H2- VPN type: IPSEC (Dialup)- Authentication: X.509 client cert- This VPN works on a strongSwan client under Debian 12.Here's the FTG log:ike 0:****************/0000000000000000:370001: responder: aggressive mode get 1st message...ike 0:****************/0000000000000000:370001: VID CISCO-UNITY 12F5F28C4...ike 0:****************/0000000000000000:370001: VID RFC 3947 4A131C81070---ike 0:****************/0000000000000000:370001: VID draft-ietf-ipsec-nat-t-ike-02 CD6046433...ike 0:****************/0000000000000000:370001: VID draft-ietf-ipsec-nat-t-ike-02\n 90CB80913E...ike 0:****************/0000000000000000:370001: VID DPD AFCAD71368A1...ike 0:****************/0000000000000000:370001: VID fortic

Hello gentlemen,I need your help. I configured a SSLVPN as described in this article:https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-configure-specific-SSL-VPN-address-pool-to/ta-p/195190It's setup with individual SSL-VPN portals, where each has it's own Source IP Pools.SSL-VPN Settings are configured, so each User/Groups has it's own Portal.SSLVPN client can connect, but they are not getting an IP address from the correct IP Pool.I have check similar setups on other firewalls, and I am unable to spot the issue.Any idea what I am missing?

Hi All, Is it possible to combine RSSO and FSSO on the sametime ? I want to configure the policy using FSSO group becasue FSSO Group is more granular for the grouping as we can choose or retrieve the SG / OU on the AD which we want to add. And in the sametime i want fortigate to lookup on the RSSO authentication table list for IP to User mapping. Because RSSO is more reliable fof IP to User mapping. However i dont want to add attribute class on the Radius Server. So basically i just want to use RSSO to get the IP to user mapping information, and use FSSO group on the Policy. Is it possible ? any advice ? Thanksakala