Solved

Hi FortiGate adminsIn my case I need a redundant dial-up VPN from branch office FG to HQ FG, where HQ FG has 2 WAN in a SD-WAN zone.A "classic" setup didn't work, I see the tunnels flapping from the first to the second and vice versa.When configuring one tunnel (A or B) it works well, but enabling the two seems problematic.Didn't troubleshoot deeper so far, so I don't know the root cause yet.Any advice would be appreciated?

Hi team, So i found a Fortimail 7.2 Lab/install Guide that basically instructs new users how to setup standard features for all modes, gtw, trans, serv. I am using the nstructions for the gtw mode - antispam, antivirus, policies, encryption etc, pretty standard, well developed lab guide.But still...... i think more can be explored and the admin guide just give definitions, not much real world setup to follow. Does anyone or rather, can anyone send a more robust template/settings for all features on fortimail to inspect smtp traffic, specifically the tabs - (policy, security, encryption, dlp), something robust. For e.g. banned words are VAST, other fortimail features are so daunting and almost endless. What, where or which is best? Asking for someone's .cfg with some nice gateway setup and just removing their internal IP details would not be cool lol, though a bit flexible and efficient.  Can anyone assist?

Hi i have kind of an unusual situation where i need to replace private asn to public asn but keep the asn prepend. I have 3 FortiGate firewalls, FG11. FG2, and FG3.I have a BGP between FG1 and FG2, and between FG1 and FG3.fg1 asn is set to 1111 (Public ASN example)fg2 asn is set to  64512 (Private ASN)fg3 asn is set to 3333 (Public ASN example)I have set as prepend on FG2 so now the advertisements include ASN 64512 64512 64512 64512.I would like to manipulate the bgp settings so when FG1 re-advertise to FG3 a network learned from FG2 it would replace the asn so FG3 will see asn 1111 multiple times. how can i do it?What i did so far is creating aspath-list:config router aspath-listedit "as-fg2"config ruleedit 1set action permitset regexp "64512"And then i have created a route map:config router route-mapedit "ASPATH-REPLACE"config ruleedit 1set match-as-path "as-fg2"set set-aspath-action replaceset set-aspath "1111"I have assigned the route map to BGP peering towards FG3 (

Hello everyone, I have a licensing problem on FortiMail. FortiMail is displaying the following error "Invalid Duplicated Error". I need to re-upload it multiple times for the license to be valid. But the problem persists.During the installation, I downloaded the license onto a first VM. Then, I deleted it.I reinstalled another VM and uploaded the same license, but I'm encountering this problem.I don't know if the problem could be due to this action. How could I resolve the problem? 

Hello Fortinet Community, We are in the process of configuring FortiWeb 7.4.3 as a reverse proxy for our on-premises web servers. Our FortiWeb deployment is VM-based. Alongside hosting a web service, these servers are also involved in IP-Sec tunnels established on our core firewall (FortiGate) with various financial institutions.Our objective is to bypass traffic destined for these IP-Sec tunnels through FortiWeb, excluding HTTPS/HTTP traffic directed towards the web servers (HTTP/HTTPS Traffic should be inspected in FortiWeb)We seek clarification on the following points:IP-Sec Tunnel Bypass: How can we ensure that traffic intended for the IP-Sec tunnels bypasses FortiWeb? Are there specific configurations or policies within FortiWeb that we should implement to achieve this seamlessly?Impact on Financial Institutes' Settings: Will configuring our servers behind the WAF (Web Application Firewall) necessitate any changes at the end of the financial institutes regarding their IP-Sec

Hi,I have this problem of sync in Fortigate.Anyone that can help me? Thanks

Hello Fortinet family, Can someone provide some insight and/or solution? I just put my fortimail in the dmz, my mail server is behind the fortigate fwl, enabled smtp traffic on fortigate, mails are processed/flowing via the fortimail perfectly(a lot of false positives though, some inspection settings might need to be tweaked down). I have to ethernet ports enabled on my fortimail hyperv vm:eth0 -> internaleth1 -> dmz I can login to Fortimail web UI  via port1-internal lan(172.16.10.5) . However, i am unable to login to the web ui via port2-dmz(172.16.40.10). What do i need to do to log in the fortimail web ui via the dmz port/IP? ANY help would be great, thanks. 

Hi, I have recently tried to restrict our SSL VPN to one specific country. I have created the Geography Object for the country, added it under SSL-VPN Settings, limit access to specific hosts.Under the SSL-VPN tunnel interface policy the source for IPs was all, so I have changed it to the object I created for the country as I understand the Country has to be set in both places.The problem I am having is that users can connect, but once connected they cannot access anything. If I take the Country out of the SSL-VPN tunnel interface policy and change back to all it works fine.As far as I can see I have implemted as recommended so unsure of where to go next. I have tried one two different VPN devices both with public IPs in the country I created.

Hi there,My query is regarding Forti web,i have servers connected to the back of Forti web in reverse proxy mode but my backend server needs to connect to its update portal outside but can not connect.is there any outgoing policy or any way to allow my specific server for allowing internet for updates.Thanks

How can I add a second server if the first fails.And I tried to add another server but it tells me that it has the same domain and I cannot validate it through the CLI.I appreciate your helpI have the server virtualized 

HiI have trial fortianalyzer vm and it has 500 GB disk size in esxi but in dashboard I see only 50 GB disk quota. How can i use all 500 GB space?

 I am looking for some tips or advice on performing firmware upgrades through FortiManager. This tool, https://docs.fortinet.com/compatibility-tool/fortimanager has been helpful but I want to make sure I understand what's its telling me. When it refers to fortiOS family, is that for all devices in direct relation to Fortimanager? Because there seems to be a second layer of compatibility between when its going from the FortiGate to a FortiSwitch. https://docs.fortinet.com/document/fortiswitch/7.4.2/fortilink-compatibility I just want to make sure the firmware I upgrade some of these devices to doesn't exceed what's supported by our FMG or directly connected devices. Any clarification or information on this process is appreciated. Also I am fairly new to Fortigate products so be gentle.

We have an egress policy to allow traffic to a (partner) service hosted in AWS - thus the IP address of the remote server is dynamic.In these scenarios, is there a way to create a policy object that can represent a dynamic lookup? Or how else might this be addressed on a Fortinet firewall... aside from a "looser" policy that only specifies source and protocol? TIA!

HelloI found nothing documented regarding ZTNA server path regular expression.Anyone knows how to use it? 

I have a FortiMail FE-60D operating in transparent mode. In my LAN, I have an Exchange server, and everything is configured and functioning correctly. There are some clients within the local network who have, in addition to our corporate email, another email configured with a POP3 connection to retrieve their emails. My question is whether the FortiMail can be configured to filter incoming emails from a different domain that come through the POP3 protocol.

Hi,I was hoping that running the command "psql -U phoenix phoenixdb -c "select * from ph_device;"" would give me, besides the device list, the consumed EPS per device. It doesn't, so I'm asking if there is such a command/GUI menu to show/export such information. Thanks

Hi all,I have a question about the logging in FortiAnalyzer when the FortiGates are part of the Security Fabric. So, FortiGate A has servers connected to it and a client behind FortiGate B sends traffic to one of these servers. Will there be 2 logging records in the FortiAnalyzer, one for each FortiGate? Or will there be only one logging of this traffic?  Thank you in advance!

Hi all,We use the Fortclient SSL VPNs on users laptops that work from home and this works well however we have a single user that uses a softphone program on her laptop to connect to a voip cloud platform (gamma horizon) but the VPN is causing a delay in this (it works fine without the VPN on). I know in older versions of Windows there was a tick box in the IPV4 settings on the NIC to not use the default gateway on the remote machine which would then let the local internet (at the users house) be the breakout point for everything that wasn't needing to go across the VPN but that option is no longer there so someone has said to setup split tunneling on the Fortinet Router (100F) but is this the correct way to do this as i thought if it's having to hit the router to pick this up in the first place then it kind of misses the point of the breakout being at the users house ?Hope that makes sense but if anyone can advise ?Thanks

I am running FortiGate in AWS.  I have users who will be using SSL VPN (no natting).   I have many hosts I need to reach over SSL-VPN in AWS that are accessed via a TransitGateway.  The TransitGateway has the route of 10.0.0.0/8.  However, when I am trying to access some of the servers the packets are not making it back to the FortiGate Firewall. Does anyone know if I should create a route for the TransitGateway propagating the SSL-VPN pool IPs?

I have split tunnel and split dns set up.  When I vpn in I can see that my dns servers are set to what is defined in the split tunnel configuration.  However, when I try to do a dns lookup the response shows me the dns server from the split tunnel but then gives me "Request timed out".   If I change the Firewall rule to do NATing of the SSL VPN connection DNS lookups work fine. Does this mean I need a firewall rule allowing ssl.root to access the dns servers?

hi, guys do you have any idea how can i know the date of End of support fortigate  80F. 

HI there,I am adding 3rd party threat feeds using external connecter in fortigate and then i am calling threat feed name in outbound deny policy.my question is that does it requires any downtime or other service effect in fortigate?

HiI am using faz trial license and it says you logs exceeda your limit. So my question is, what happens to logs send to faz after that?

I'm experiencing issues with FortiClient for the last 2 months. There are no problems connecting the the vpn however once connected if i open up certain applications like my developer IDE or outlook then it'll disconnect. I have checked the logs and noticed the following entries when this happens.info sslvpn FortiSslvpn: 22716: Ras: connection to fortissl terminatedinfo sslvpn FortiSslvpn: 8872: Did not find interface for local_gwy Also, i use docker desktop in windows. Docker Desktop refuses to start if i'm already connected to the vpn. To get this working I have to start docker desktop before trying to connect via FortiClient Any help on this will be appreciated. Thanks

Hello everyone,I have a problem where i cannot ping PC from fortiGate, I already set the Static Routing inside fortiGate for the PC network Segment, but I can ping the router IP with same segment as PC. Here's the topology below.