Solved

Hello, I need your help. I have the following issue: I work with Fortigate Firewall, and my task is to connect my network to another Cisco router. My OSPF is working fine; it sees the internal LAN networks. However, I also need to set up NAT. I need to NAT from my other LAN, 192.168.0.5, to 10.10.10.10 (for example), and ensure they can see this route. I tried using Virtual IPs, but it didn't work out. How can I set up destination NAT and advertise the route in OSPF?FortiGate #OSPF #virtualIP 

Hi, We are using Fortigate, Fortiswitch and Fortinac.They are using static ip configuration in their client system.We wanted to push Dynamic access control lists via fortinac.Can someone please guide in this case.

 I am unable to click on Install Now button, 

Is there a way to add a link that will direct a user to request a blocked site be allowed and a email will be sent to help desk for further review? 

When enabling the Explicit Proxy feature on a FortiGate 40F(ver6.4.11) and performing several thousand Kerberos authentication tests from a test tool, 1001 users appeared in the authentication list on the web management console, but no additional users were shown beyond that. We had not considered the configuration or limitations regarding the number of concurrent authentications, so we researched the related settings and found the following website. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Limiting-concurrent-user-authentication/ta-p/199277https://community.fortinet.com/t5/FortiGate/Technical-Note-Limiting-concurrent-user-authentication/ta-p/190373   When we checked the configuration on the tested FortiGate, the value of "policy-auth-concurrent" was set to 0. So far, we have not been able to obtain information on the maximum number of concurrent authentications possible. Please tell me the maximum number of concurrent authenticated u

This may seem like a silly question... but which file should I download to update my fortimail VM in wmare? When I go to the Fortinet support site, several images appear.   

HelloI'm facing a problem regarding uninstalling FortiClient to install a different version.I'm on Linux (Kubuntu 19.10). When I try to uninstall FortiClient ( sudo apt-get purge forticlient or sudo apt-get remove forticlient ) I can't because "Unable to uninstall forticlient while connected to EMS". But when I try to disconnect from EMS ( sudo /opt/forticlient/epctrl -u ) it asks me for a "deregistration password". It's the same when I try to disconnect it from the GUI:However, I don't have this password. I found a link about a "password recovery tool", but it is for Windows, and I don't have any program like that in the /opt/forticlient folderhttps://docs.fortinet.com/document/forticlient/7.2.4/ems-administration-guide/543835/using-the-passwordrecovery-toolFor what I remember, I installed my version of FortiClient from the company I formerly worked with (to access their VPN), so maybe it was a different version than the free one where I can have full control of the pro

We recently installed an 80F and we are now having issues with our ERP being able to connect to FTP sites of our vendors to upload order data. Previously on our old network based firewall, we didn't have these issues. It appears that an active session is being created with the FTP site. I can connect to the FTP site from our ERP manually but once I'm connected and I try to run any commands, I receive a 500 illegal port message and then a 425 use PORT or PASV first message. If I enter pass then it shows passive mode as being on and I can execute commands successfully. The problem is that once this connection is ended and we try again, we are back to the same issues. Our vendor who is responsible for this firewall is running into a wall on what to do so I'm hoping someone may have some ideas on what we need to do to resolve this. This ERP server has a public IP so traffic from the internet to it comes directly to the firewall. When traffic is going out from it, it goes from the firewall

Still learning all of particulars about this product. My inquiry is about the Policy ID when viewing the log details of a message. I have had to sort through the message log chain on several occasions now and am trying to discern the Policy ID it reports and trying not to assume the logic that makes sense to me. So if my log detail reports the Policy ID of 3:1:1:SYSTEM, does this mean it processed through Access Control ID3, then IP Policy ID1, then Recipient Policy ID1 with the default system domain? Or did I completely butcher that logic...lol Thanks. 

I have a FortiGate SDWAN rule configured to select the outgoing WAN interface by Best Quality as the result of Performance SLA measurements. What happens if bandwidth of the selected outgoing WAN interface is saturated? Does excess traffic begin to use the next most preferred outgoing WAN interface from the Best Quality Performance SLA measurement results?Or will the WAN interface with Best Quality from Performance SLA measurement results continue to be used?

Hello everybody,I'm working on a Fortigate 60E (FortiOS 7.2.8).My pc is on an isolated network (i'm the only host) and there is only one simple rule: As you can see, the security profile is very simple, it has a DLP configured with a profile that only intercepts the credit cards' informations. The dictionary is the default c redit card type, while the sensor is configured to any message or file regarding every protocol:   The problem is that for some reason, sites like facebook.com are blocked by the same policy.   date=2024-06-19 time=17:57:53 id=7382244222788698112 itime="2024-06-19 17:57:54" euid=1026 epid=1030 dsteuid=3 dstepid=101 logflag=3 logver=702081639 type="traffic" subtype="forward" level="notice" action="close" utmaction="block" policyid=19 sessionid=796241 srcip=10.1.20.4 dstip=157.240.203.35 transip=192.168.1.4 srcport=64759 dstport=443 transport=64759 trandisp="snat" duration=1 proto=6 sentbyte=1886 rcvdbyte=1565 sentpkt=14 rcvdpkt=14 logid=000000001

Hello, i need your help.You have one FortiGate and two routers. You need the FortiGate to know routes but not advertise them to the routers. For example, you have Area 10 where Router1 advertises 192.168.0.0/24, and Area 20 where Router2 advertises 192.168.100.0/24. However, when you check Router1, it also knows about Router2's network 192.168.100.0/24. This should not happen. How can you separate these networks? Can route maps or ACLs help? Have you encountered such a situation before? Any information would be valuable to me.#fortigate #ospf #routemap #acl #routingtable #routes

Hi All, I got deny log from the Fortigate even I already configure to allow the connection.This application using port 1433. The details log as below : Event Action : DenyThreat Action : BlockThreat Name : Policy ViolationThreat Type : Reconnaissance Application Service : Elid06 I check on the security profile & not find any possibility that it will block by security profile. Then I change to other service TCP_1433 and the connection was success. Anyone know what is the possibility of the deny traffic. TQ    

Hi all,our current setup is FG 80f acting as a firewall and  NAT device with Layer3 switch  acting as a router for office network and intervlan routing.We would like to replace current layer3 switch with 2 switches from Forti ecosystem that can act as redundant routers.Requirements are as following:L3 switch handles intervlan routingL3 switch acts as a router for private networksL3 switch/es supports HSRP or VRRPFG80f handles NAT and traffic inspectionSwitch and future Forti AP-s are managed via FG80f   So basically i want central management for Forti network devices and L3 traffic between private networks to be handled on switches which are redundant gateway for client network devices. Is that feasible ? Regards,Drazen

Hello everyone, first of all the most important information:FortiManager Platform type: VM-64FortiManger version: v7.4.3-build2487 240514 (GA)FortiGate model: 200FFortiGate version: v7.2.8 build1639 My scenario:I want to pre-configure a FortiGate 200F for which I do not yet have a serial number. To do this, I have added the device via "Add Device" => "Add Model Device" and the settings:"Link Device By" => Pre-shared Key"Device Model" FortiGate-200F"Automatically Link to Real Device" => enabled"Provisioning Templates" => Our TemplateNow I have received the FortiGate, switched it on and brought it into the FortiManager network and followed the instructions from Fortinet on how to integrate an FG with a PSK.The CLI config was as following:config system central-managementset type fortimanagerset fmg ip addressendand thenexe central-mgmt register-device fmg-serial-number pre-shared key My problem:I assume that the device in the FortiManager is then assigned to the

hello I have FortiGate100F I applied wan failover (I have two lines from my ISP ) if wan1 disconnect all traffic going from wan2.Now I connect new subnet to port10 .. I need all traffic going from port 10 to wan2 not wan1  (i add policy to allow traffic from port 10 to wan2 ) when i connect my pc to port10 it take IP and DNS (already I enabled DHCP) but no Internet anyone help me please 

Hello,I would like to know what is wrong with this rule, it doesn't work at all, attacks are still coming from the countries that I have added to this rule. Thank you in advance for any suggestions. 

Hi,  TLDR - I have a /63 prefix and I'd like to delegate a /64 to each of two interfaces. Delegation works but both interfaces get the same prefix. Where in Forti documentation would I find the correct syntax? I'm a home user looking to upgrade an old router. I played with *sense, then found FortiGate-VM. I have no experience with FG but prefer the UI. I'm continuing to play with an FG-VM, with a view to purchasing a hardware FG. Thanks to FortiNet for providing an easy way to get a VM. My ISP delegates a dynamic /62 prefix, and seems to require an ONT which then essentially limits anything downstream to a /63 (long story, and is the only available ISP). I've never used IPv6 either but I'm determined to try it out with the FG-VM. I'm trying to delegate a /64 on the FG-VM to each of two LAN interfaces. Both interfaces get the same prefix so I'm missing something. port1, my WAN interface, has the following ipv6 config - config ipv6 set ip6-allowaccess

Hi, I need help to debug IPSEC VPN between Fortigate to ForcePoint Here the ForcePoint conf : Here my fortigate conf config vpn ipsec phase1-interface edit "IPSEC_XXX" set interface "vlnk_XXX" set peertype any set net-device disable set proposal aes256-sha1 set dhgrp 5 set remote-gw 1.2.3.4 set psksecret ************ next endconfig vpn ipsec phase2-interface edit "IPSEC_XXX" set phase1name "IPSEC_XXX" set proposal aes256-sha1 set dhgrp 5 set src-subnet 10.XX.XX.0 255.255.255.0 set dst-subnet 10.XX.XX.0 255.255.255.0 next endHere my log 2024-06-19 14:27:42.549271 ike V=VIPP:2:IPSEC_VIPP:IPSEC_VIPP: created connection: 0x10111700 19 10.1.0.6->185.87.229.218:500. 2024-06-19 14:27:42.551162 ike V=VIPP:2:IPSEC_VIPP: HA start as master 2024-06-19 14:27:42.551178 ike V=VIPP:2:IPSEC_VIPP:45: initiator: main mode is sending 1st message... 2024-06-19 14:27:4

HelloMy implementation has been leaning towards a two-tier MC-LAG design. I am reaching out to you to explore the possibility of evolving it to EVPN-VXLAN seeing that data centre designs have shifted in that direction.So I would like to find out from Fortinet the following:1. If EVPN-VXLAN is a fit for purpose solution in this case2. How mature the technology is on FortiSwitch OS3. The level of after deployment support within Fortinet.4. Please note that the FS-2048-F switches are being used for 25G connections to the servers. So the spine-leaf architecture where nothing connects to spines is out of the question,There is very little Fortinet documentation of this feature on the internet. Please also share some documentation regarding this topic.Thank you

Hi, maybe we missed something and this feature was removed but I would like to see local reports and before I had like 7 versions on the memory (in Log Settings > Local Logs it is activated) and I dont see anything else. Also on Forticloud we had like 7 days some reports. Is it possible that there is no option anymore without another licence? Thanks,Roland

Hi!I'm trying to understand the relationship between periods specified in "System Settings" -> Storage Info: Data Policy : Keep Logs for Archive"... and "System Settings" -> "Advanced" -> "File Management" : Automatically Delete : "Device log files older than" because they both seem to dictate how long the Archive Logs are retained before deletion.Are they related? If so, who has higher priority; otherwise, If not related, how are they different?R's, Alex   

Hi Fortinet Community! I have a question that I’m having trouble answering despite going through the training, documentation, and searching online. We recently purchased a FortiSwitch 148F-FPOE with a FortiLAN Cloud management license.The switch has been adopted and deployed to the new network, it pulled an IP address from DHCP, and everything looks good connectivity-wise. I need to assign a static IP address to the switch within a management network, which does not have DHCP. Does this need to be done via the command line? I found an area to set a static IP (physical interface configuration), but I do not see any place to set the gateway. The switch will not be doing any routing, so my idea was to untag the switch uplink on the management VLAN and set a static IP/gateway (or set a static IP/GW on the VSI internal interface) and tag (allow) other VLANs.Any advice would be greatly appreciated. #FortiSwitch#FortiLAN#FortiCloud Thank you! 

Hi Guys,  I am grateful for this community, some great teachers here, I am learning alot about Fortimail and have done some good work so far. I have now fully integrated my fortimail in the DMZ, the fortigate fwl, getting smtp traffic, inspection of smtp traffic actually WORKING, thank God. However, one problem lol. ALOT of false positives and people are squealing. I used the full inspection rules instructed by guide below - antispam, antivirus, content etc and I tell you mails are being inspected hard.https://ebin.pub/fortinet-fortimail-lab-guide-for-fortimail-72.html Can anyone here post me a good setup for traffic inspection (not so robust/sensitive)? I am currently using the recipient policy as that is what was selected by my team. I was the one that configured the fortimail from scratch and deployed it(with the help/knowledge of you guys of course).

Hi all, I am unable to activate my Forti VM: FortiFirewall-VM64 # execute vm-license-options account-id enrico.thau@siemens-energy.comFortiFirewall-VM64 # execute vm-license-options account-password xxxxFortiFirewall-VM64 # execute vm-licenseThis VM is using the evaluation license. This license does not expire.Limitations of the Evaluation VM license include:1.Support for low encryption operation only2.Maximum of 1 CPU and 2GiB of memory3.Maximum of three interfaces, firewall policies, and routes each4.No FortiCare SupportThis operation will reboot the system !Do you want to continue? (y/n)yFailed to download VM license. But Internet connections is ok:FortiFirewall-VM64 # execute ping 8.8.8.8PING 8.8.8.8 (8.8.8.8): 56 data bytes64 bytes from 8.8.8.8: icmp_seq=0 ttl=128 time=47.4 ms64 bytes from 8.8.8.8: icmp_seq=1 ttl=128 time=46.8 ms^C--- 8.8.8.8 ping statistics ---2 packets transmitted, 2 packets received, 0% packet lossround-trip min/avg/max = 46.8/47.1/47.4 msFortiFi