Solved

Hello, allAs I am preparing for the new FCP exam and going through the material about IPSEC VPN and found the option of the FEC. This is on the version 7.2.x.Can anybody explain the purpose of this, where to use and what does the noisy links means at the expense of using more bandwidth and the use case for the ingress and egress.The screenshot is also attached for the reference. 

Hi all,Actually I'm testing my new fortigate 60f and for test I have this configurations:modem -> oldFirewall (wan ip 10.0.0.10; lan 20.0.0.1) -> fortigate (wan ip 20.0.0.10; lan 192.168.10.1)I can can connect to forticlient but actually I cannot ping any device in the same subnet of wan connection. for example I cannot ping 20.0.0.20-254 devices)  can some one help me which setting let clients to reach all devices also that devices connected to the old firewall?many thanks in advance

Dear   We have Fortigate FG200E firewall, we need to access the Firewall through FQDN for that we have added the A records in our local and public DNS.   But now we need to stop the access direct from public IP, and the administrators must use the FQDN to access the Firewall management page.   Can anyone please help that how can I achieve this?

Hello guys. Quick question about fortiweb: can it interpret any script flavor? I've read somewhere that FortiManager supports TCL scripting, but haven't found anything related with FortiWeb. So, if I need to recreate lots of similar objects (ex.: similar profiles), how can I automate that task? Thanks.  

Hi all, If you can not understand what i'm saying,I apologize for my poor English.   I have a ha cluster using 1500D with version 5.0.14 and without ntp server. When I adjust system time to real time.My slave forti starting appear error log like   date=2016-11-07 time=11:16:55 logid=0100035010 type=event subtype=system level=error vd="root" msg="HA slave sync failed in 3 turns"   Logs like this appear 2-3 times daily. After I config time before change,this log still appear. I've tried re-build HA cluster but looks like didn't work.   Really need help.Thanks   I've show checksum in both of forti,and they are the same

Hello, I'm unable to uninstall FortiClient, the uninstall button is grayed, as far as the only session on the computer is an admin one, I don't understand why I can't uninstall it...

Hello Community, The setup is a FortiWiFi 80F running v7.2.6 firmware. My goal is to know which port the SD-WAN has chosen and get that data from the API. From the GUI, I access Network > SD-WAN > SD-WAN Rules In the 'IPv4' Column and 'Members' Row this cell shows two ports along with a check mark. The check mark tells which adapter the SD-WAN rule is using.   How can I know what the SD-WAN has chosen from the API?   I have tried health check but have not seen what I am looking for         https://192.168.50.1:443/api/v2/monitor/virtual-wan/health-check?access_token=nwm3N6Nfsjp5szxtdG64hqn8g9s8sx             Appreciate it

Hi  I already created an ipsec remote access tunnel and it is working. I want to create second tunnel for a different group but it does not connect. How can i do that?

Good day guys.I have the following setup.200F with dual WAN4 tunnels to AWS (the usual IPSEC with 2 tunnels).Probably, next year, hopefully, I will have AWS Direct Connect.Let´s begin with the IPSEC tunnels first:I´m having issues with the ECMP on the AWS TGW, what I need is just failover between the tunnels, but I want to setup the priority in which they are used under normal conditions, like in the following graph:  I want to influence the traffic (inbound and outbound) so it has the Tunnels in this order of preference: Main_Tunnel01Main_Tunnel02Secondary_Tunnel01Secondary_Tunnel02OrMain IPSECSecondary IPSECRight now, what I´m having (with ECMP disabled) is that I´m loosing traffic partially if I lose a Tunnel. If I enable ECMP, I get traffic through all the tunnels, and I do not want that. I found the Technical Tip : Difference between asymmetric routing and auxiliary sessions., I will testing that also, but right now I´m confussed with this AWS documentatio

Hi,   i was wondering.  Is there a way to put a ha cluster in maintenance mode?  With maintenance mode i mean, there will be no response to heartbeat failures for example.  Primary member remains active.  Secondary remains not active.  This would be handy in a situation where there is maintenance on the networking infrastructure between two sites, impacting the hearbeats between the nodes.  And we want to prevent split brain scenario's...   Ofcourse, we can shutdown the secundary node.  But since the used Fortigates cannot be powered on again remotely without someone going physically onsite to press the power button...

I try to solve a (maybe) edge case for a customer:   The Customer has multiple Website behind a Fortigate which he would like to make public available: web1.domain1.tld web2.domain1.tld web3.domain2.tld There is only 1 public IP Address. All the Website should be available on Port 443 (HTTPS). The Websites should be protected by WAF.   What I have tried: I can make the first two Websites (web1, web2) available with "Virtual Servers" and by using a Wildcard (public signed) certificate. Then I used a Firewall Rule with a Web Application Firewall Profile to secure the Servers. But then web3 cannot be added because it is using a different Domain.   I also tried it with ZTNA, Proxy Policy and by disabling the Client Certificate requirement by setting "set client-cert disable". This way I was able to publish all of the 3 Domains. But that way i cannot use any protection as Web Application Firewall cannot be used together with ZTNA as far as i know. Also, i noticed, that when

how do i enable disk logging in FG100F?i dont see the option in both CLI n GUI for disk, only memory and fortianalyzer.  

i have setup STMP server under Settings -> Email Service, for sending emails alerts for our FG100F.but it does not seems to work.what else must I enabled on the firewall.firmware version is 7.2.5

Hi,         I have a question about hairpin NAT. When doing hairpin between two interfaces of FGT, do I have to create/use public VIP for the source and destination? I found out it works without NAT as well. What type of specific case do I have to use NAT? Thank you.

Might be a simple one for you. Any hint is appreciated.I have a FGT-60F cluster that has an active LDAP server pointing to an AD server that is located on a local "internal1" interface. This connection works fine. If I do "Test Connectivity", I can see in the packet capture (on internal1) some LDAP bindrequests on port 389. LDAP works perfectly. I want now to add another LDAP Server that is located behind an IPSec VPN. However, the packet capture on the VPN interface does not show any LDAP traffic at all when I do "Test Connectivity".  Routing is correct. Traffic beween local interface and remote network via VPN tunnel is working fine. I suspect a policy issue, but I have to admit I am puzzled. Since the fortigate is the originator of the LDAP requests, what do I have to choose for the originating interface in the policy setup?And why do I not have to setup a policy for the LDAP Server on the internal1 interface? In any case, how would I, step by step, troubles

We just ran into this: today our FortiMail states it has no antispam and virus outbreak license.It did have one because it also states the last update of the antispam definitions was on 2024-02-06 and it cannot do that without vallid license. If I look into support portal I can see that our License bundle includes both licenses and they are both valid until 2027.FortiMail also states that FortiGuard services are reachable. I also opened a ticket with TAC on this as this should not at all happen for security reasons! cheersSebastian

Hello, I have a mystery on a Fortigate.I have a security group that block Facebook using application control and webfilter categories.My users told by that they still can use Facebook. I checked the log and I see that most of the traffic linked to Facebook is blocked, but, I have some line with allowed traffic to facebook, using the same firewall policy. it's unbelievable, my own rules which block Facebook is also allowing it.How this is possible ?    

Hi All, We are running different tenant (Azure Intra ID), and want to integrate with FortiSIEM, we have created application and defined the credentials in FortiSIEM, and assigned in credential association tab as manage.office.com. Now the confusion is that we can not create the same entry with manage.office.com and we have assigned 2 credential at a time as it allows us to do so. But we can see logs from one of the tenant the other one is not showing any events. Any one has any experience with this scenario before ? TIA

Do the Forti syslogs also contain the DHCP logs if the Forti is responsible for DHCP?

Installed FortiClient to see if the standalone web filtering would work for a few of our mobile users; however, despite having categories enabled, it seems to lump all websites into the "unrated" category.  I can block every category available except unrated and have access to the entire web...until I block the unrated category, then I only have access to my exceptions list.  What am I doing wrong?  Is this by design on the free version?  If I click wrong category (after i've added fortinet.net to exceptions), it goes to a page on fortinet.net which displays the proper category. 

Hi, I can't ping WAN IPs from the LAN. The only IP address I can ping is the one configured on the WAN interface.   ES:WAN interface - 192.168.10.1/29LAN interface - 192.168.1.1/24 From the LAN if I ping the IP address 192.168.10.1 I will reach it. However, if I try to ping the IP addresses 192.168.10.2, 192.168.10.3, 192.168.10.4, 192.168.10.5 and 192.168.10.6, I cannot reach them   Have i nice day Andrea

Dear All   I just purchased EMS last week and setup finished, everything seems fine at EMS server. I want to use EMS ZTNA to control SSLVPN user who only match zero trust tag can access lan server. When I added the tag make my SSLVPN cannot access my Local LAN, removed it everything is fine. Any step I am missing or incorrect setup ?   Resolved Address can see my vpn ip View matched endpoint can see my laptop, but it still show 0  when I move the mouse on it.         Firewall policy added tag - cannot access lan server Removed tag everything fine Connection is ok      I can view all zero trust tag at EMS portal   Creat new tag "Test" and fortigate also can show up        

Hi,  I have a dual hub topology active-active. I configure BGP on the hub with Capability: default originate enable, to inject the default route to the branch.  In the branch i can see on the routing table 4 default route 2 for HUB1 and 2 for the HUB2..   ex: Routing table branch         0.0.0.0/0 [5/0] via 172.16.1.1, HUB-1-1_0 active   sdwan routes                  [5/0] via 172.17.1.1, HUB-1-2_0 active                  [5/0] via 172.16.2.1, HUB-2-1_0 active                  [5/0] via 172.17.2.1, HUB-2-2_0 active   The question is.It is possible or how can i do that in the branch fgt prefer o inject on the routing table the default route for HUB1 and just in case the connection for H

Hi all, I just want to confirm about the command "diagnose debug enable".If I enabled "diag debug enable" command in Fortigate it will only enabled only for 30 min or it will run as long as I don't reset or manually disable the debug?Also , after I reboot or shutdown the FortiGate , "diag debug" state will still be enable state or disabled state when it comes up? Thank you

Good afternoon,  We have a FG-60F with 2 SD-WAN zones. The first one for corporate use is connected to a single Starlink antenna. The second SD-WAN zone for client use is connected to 2 Starlink antennas. These 2 apply load balancing to maximize bandwidth. The problem is that we can't use both SD-WAN zones at the same time for their respective uses because the 2 Starlink antennas all use the same gateway IP 100.64.0.1. Whenever I set a static route 0.0.0.0 to use this IP it will only work for SD-WAN zone 1 or 2, not both Can this be fixed using policy based routing instead of static routes? Or is there another way to get this to work correctly? Unfortunately, we're unable to change the gateway address of the Starlink devices.   Thanks in advance,