Solved

Hi all, I am configuring a 40F for a small branch site, using a VPN to the main core site.  The VPN is up and running, but I am having problems with access to the core FortiManager and out to FortiGuard. The FW is on a private address behind an ISP router. The problem is that the FW is using the 192.168 IP from the inside of the ISP's router as the source for the FW originating traffic. Is there a way to set the source to a routable address ?  

Hi everyone,   We are moving our School environment over to a Fortigate 100F with 5 year UTM - and after setting up our web filtering profiles, I am looking for a way to setup email notifications when certain categories are blocked.   For example, if a member of X group attempts to go to a website categorised as Adult content. When it is blocked, we would like an email to be sent detailing the user and the website. Is this possible with the current licensing we have in place or do we need to look into alternatives like FortiAnalyzer? Is this even possible with FortiAnalyzer?   Any help is appreciated.    

Hello, I am currently working with a FortiAnalyzer cluster. In the Log View I can see several "IPS detected intrusion" events with an "alert" severity. When double-clicking the events, a detail view is opened. Now the detail view displays that the threat direction is outgoing, although the source interface role is WAN while the destination interface role is LAN. A screenshot of one such event is attached below. Why is the direction "outgoing" instead of incoming and how can I fix this? I would have assumed that the direction is determined based on interface roles. Is this a bug or a configuration error on my side? And should the IPS even report an intrusion since this is coming from the outside (just another vulnerability scanner) and there is no indication of compromise? Thanks in advance.   

I enabled FortiLAN in europe and the "Combined Default" network was automagically created in my FortiLAN. When clicking on the options I can only clone it. If I create a new network, I can delete and rename it. So, what's with this mystical network that I can't find in the docs? Is there a way to get rid of it or rename it to something that can satisfy my OCD?

Hello, We have 2 Virtual Fortigate deployed on ESXi with 2 trial licenses (provided by Fortigate) and I'm trying to configure Active-Standby Failover. Also we have Out of Band Mgmt (added one interface to another VRF and added one default route). When I'm activating HA on firelwalls, Fortigate do reboot and after that I lose access to the web. I have access just via ESXi console.  How I can fix it? 

Hello,I have a situation on a fortigate 100 E.I have two policies in place, to permit communications between two vlans:The policy wich permit communication between Production Lan to Vlan 102 is working, from 10.10.0.x i can access anything on 10.10.2.xBut the reverse policy is not working. I cannot access anything from 10.10.2.x to 10.10.0.xMy settings are in the picture belowThe working policyworking policyNot working policy not working policyWith anticipated thanks for pointing me in the right direction,Hans

Hi All, i've recently setup a New  site-to-site VPN Tunnel  Tunnel Mode on our 200D, in 5.4.Tunnel is Up and Running and i'm able to reach the remote FW  in https and remote Users are Able to reach Local resources.but, but....Here is my issue :there is an UDP traffic which not working correctly, namely SIP traffic (5060).i'm able to see the Original direction going throuh different VDOMs, but the reply direction on the last VDOM going through the bad Tunnel IPsec and the IP phoone never succeed in registration. already check diag sni pack during while pinging --> okalready check diag debug flow while pinging and it is matching the good tunnel :(already check diag debug flow to see what happens ( UDP 5060 traffic)--> some traces id=20085 trace_id=2116 func=print_pkt_detail line=4751 msg="vd-VPN received a packet(proto=17, 192.168.XXX.2:5060->192.168.200.XXX:5060) from FWA-FWB. " id=20085 trace_id=2116 func=resolve_ip_tuple_fast line=4815 msg="Find

friends good day a question:In our review of malicious connections from the internal network, we observed that there are many malicious connections from the fortigate IP. Could you help me with your comments, why is this happening?currently the fortigate has a vulnerable version and I don't know if it might be related to this.

So i have  three VLAN 1,100,1000 - i've enabled DHCP on VLAN 1000, the other VLAN's do not have DHCP Snooping turned on. When i plug my laptop into one of the ports i get no IP from the Native Vlan - 1. If i disable dhcp snooping on vlan 1000 it works fine. MY question is when you enable DHCP snooping for ANY vlan does that impact the trust/untrust setting regarding of whether other vlan's have it or not? - my assumption is yes i proved it by trusting the uplink/downlink port and reenabling DHCP Snooping on VLAN 1000 - continues to work fine. FWIW - the switch is not being managed by the FG - managed directly Just wanted to check with others. Cheers,

Unable to connect to my Radius Server . Test connectivity settings on Fortigate primary server fails

 Hello everyone ! I have a weird bug with explicit proxy . All users( with exception of 2 )  gets only domain user group .while test in cli shows 2 groups For user FortiGate-201F_Backup # diagnose test authserver ldap ldap-kerberos testuser testpassauthenticate 'testuser' against 'ldap-kerberos' succeeded!Group membership(s) - CN=PC,OU=Permissions,OU=Groups,OU=AEG,DC=domain,DC=localCN=Domainusers,OU=Permissions,OU=Groups,OU=AEG,DC=Domain,dc=local  So this user only gets one group shown in “assets & identities - firewall users “and so firewall rule does not work correctly as it shows only 1 group “domainuser”. And the main weird thing is thatthere are 2 users in domain where fortigate displays correctly in assets & identities - firewall users “ “2 or 3 or 4 whatever” groups for those users and the  firewall policy works correctly for them .  

1500D 7.2.5.I have two 1500Ds each with an EMAC interface on the same vlan.What criteria is used to generate the EMAC mac address? Is there a way to change the EMAC mac address or at least control how the address is assigned when the interface is created?

hihow can prevent start page violation with fortiweb 6.3 and above? in older versions of fortiweb like 5.x version start-page access was in UI console!thanks

My SSL VPN RDP connection bookmark closes immediately.

Hello Dears, one of our customers has a HA FGT devices and we implement new FMG 7.2.2 so i'm confused how we can add them as a single device to avoid license consumed two devices.

Dear All, just one question. Is it possible to use a Fortigate 50E without costs or contract? To get for instance "Firmware & General Updates" without a fee?RegardsHeimo

friends, could the traffic shaping configuration be considered a good practice? I've been reviewing a FG but I don't see traffic shaping policies so I plan to create a few.

Dear Forum! I have one question for you: I have one Pubilc IP which maps to several internal Servers and different Porst: 62.218.51.90 -> 192.168.15.233    Ports : TCP 1723 GRE(IP:47)62.218.51.90 -> 192.168.200.253  Ports: UDP 5083 and 10000-2000062.218.51.90 -> 192.168.15.240    Ports: TCP 432562.218.51.90 -> 192.168.15.236    Ports: TCP 25 How can i manage this because the Fortigate says to me its an conflict. 

Hello, We have 2 Fortigate with Eval license applied, is it possible to configure Active-Standby Failover and then when we will receive our licenses we just apply them to the firewalls? 

we have FSSO Agent running on member server, it pollss the AD server.when looking at Show Logn Users, most of the users show as Type DC-agent, but a few are showing as type EventLog.can someone tell me why?  my understanding of our setup is it polls the AD server, and those users in certain AD groups are allowed internet based on the group they are in.so what is EventLog type in that case?

I have created VIP objects on the Fortigate. Since I am in the process of replacing another firewall with the Fortigate. Now I have experienced the following phenomenon. Every request is sent to the Fortigate and not to the other firewall running in parallel. How can this be that the Fortigate gets these requests although I have not yet created a policy just the VIP Objects?

Hi All,Today I have configured successfully email based authentication for Forticlient VPN and when I configure using Local user that time I am getting authentication code. I want, the user type must be Radius user not Local user.User must be authenticate using Radius server.Can anyone guide how can I achieve this things.Please refer the snapshot.    

The latest build of FortiClient EMS ships apache version 2.4.54, which is vulnerable to CVE-2023-25690 and others.Is there a planned fix, or is it possible to upgrade apache independently to the rest of the application?Thanks.

Hi!. Currently we have a FortiSwitch directly connected and managed by a FortiGate. The trunk between the FortiSwitch and the FortiGate is automatically formed by fortilink (default-auto-isl), so the name of this trunk corresponds to the serial-number of the FortiGate. The FortiGate is managed by a FortiManager. In the event of a FortiGate failure, what would be the process to replace it? Is it necessary to apply some configuration in the FortiSwitch so that the trunk updates the name or does this change automatically? Thanks,

I'm a newbie regarding Fortinet products, so forgive me if I ask something silly  :) When I hit an innocuous website likewww.newsweekjapan.jpI get fortinic firewall notification that access was blocked by firewall policy 15.I then check policy ID 15It's named GEOBLOCKIt has for destinations two address groups'GEO IP FILTER'and'BLOCKED-IPs-Group'The first group does contain "Japan" (why it would is a mystery to med at the moment)The 2nd does not contain the ip address (block) of NewsweekjapanSo yeah.. Seems all Japan ip/sites are blocked right?Yet random *.jp sites I tried in chrome come up just fineI found no exceptions that would seem to allow some jp sites through but not othersConfused