Solved

I need help with configuring redundant IPsec tunnels. The peer firewall has 2 public IP addresses. When the primary ISP is offline, the firewall routes everything through the backup ISP, which is working fine so far. On our Fortigate, I have configured two IPsec tunnels and, as recommended in many posts, I have set the priority of the static route for the backup tunnel higher. Unfortunately, this is not working for me. I suspect the issue lies with the tunnel configuration rather than the routing. Even when the primary ISP is offline at the customer's end and the tunnel is established through the backup ISP, the status of the primary tunnel remains up on the Fortigate. Because it doesn't switch to down, the routing is likely not functioning properly. At least that's my guess.After about 45 minutes the tunnel changed to state down but this is probably because of the "keylifeseconds 3600" in phase 2. Can someone help me with this?  I have replicated this in a lab

I opened a TAC case regarding this but maybe somebody already had this issue:We're importing a large number of FortiGates into FortiManager. After importing the first 3 devices I noticed the following behavior:Authorizing and importing the configurations went well. All 3 devices have some interfaces with same interface name but different configurations (VLAN ID, IP, Alias, bandwidth settings, etc).After import I can verify that the device settings show the correct interface with the original interface settings, normalized interface is mapped per device to the correct device interface.When I try to install the policy in the 2nd and 3rd device the install preview shows that several settings of those interfaces will be overwritten by the values imported from the first firewall (e.g. alias, bandwith-settings and allowaccess settings). VLAN ID or IP settings will not be modified.Why does this happen? Do we need to rename the interfaces on each firewall to make them unique?

 1.Regarding FortiAuthenticator's support for both Radius and Tacacs, as a Radius Server, it supports CHAP and PAP as multi-factor authentication methods for verification. I would like to know how FortiAuthenticator, as a Tacacs Server, performs multi-factor authentication with Tacacs Clients.  2.Based on the FortiAuthenticator specifications, both physical and virtual versions of FortiAuthenticator support a certain number of "NAS Devices." Does this "NAS Devices" include both Radius Clients and TACACS Clients?

ON My fortigate under fabric connectors I do not have the option of  active directory server under SSO/identity. I am running FortiOS6.4.5 . I am using the basic free licence.I am using this on my home test environment.I am also not connected to the cloud,

Hello, when using a certificate inspection profile, the browser warns with ERR_CERT_AUTHORITY_INVALID, because the certificate issuer is 'Fortinet Untrusted CA'Why can't the Forti verify website certificate? FortiOS v6.2.15

Looking for how many revisions of backup config files each FortiSwitch can hold. I'm assuming it depends on the model/flash mem size. If someone knows where the maximum value doc exists for FSWs, like FortiGate. Please let me know. Also wondering how those rev IDs are managed/decided because after a factoryreset, the new backup's IDs are starting from '6'.SW1234567-2 # exe revision list configID TIME ADMIN FIRMWARE VERSION COMMENT6 1970-01-01 00:03:49 admin V7.2.0-build444-REL0 Automatic backup (logout)7 1970-01-01 00:50:58 1234567 V7.2.0-build444-REL0 Automatic backup (session expired)8 2023-06-21 22:48:22 1234567 V7.2.0-build444-REL0 Automatic backup (logout)Thanks, Toshi

Hi Admin,Again, newbie here, I would like to setup a dashboard display for network engineer to monitor the avg in/out traffic for all the firewall, but I cannot make it work in the analytic filter search. the below screenshot I get from Fortinet Taiwai youtube tutorial, I trying to make something like that.2ndly, wonder why my version of fortiSIEM cannot make the display to 50% 50%. =) .. 

Why i cant select file filter in the security profile on fortimanager?  

Hi, I would like if possible monitoring the comunication of the Fortigate with the FortiGuard. We have had problems with a firewall that was 30 days without comunicate with the FortiGuard and stopped working. We want monitoring this check. FortiGate 

Hello , we have LAN address 10.0.0.0\23 and two vlan's in zone VLAN_10 10.10.10.0\24 and VLAN_15 15.15.15.0\24, firewall polices was created Lan to Zone(with two vlan) . Lan 10.0.0.0 can ping vlan15( 15.15.15.0) but can't ping vlan10 (10.10.10.0)? Any idea?  Vlan's ping each other 15.15.15.x to 10.10.10.x and 10.10.10.x to 15.15.15.x.

I successfully created a LDAP server on my Fortiwifi, The connection to the Server works, but not the user credentials says invalid credentials. I tried the credentials on windows and logs in successfully#ldap 

Hi there. I have a question Let's say I have a root vdom and vdom2 as a secondary vdom.Root vdom has own vlans under fortilink and connected to the fortiswich with fortilink.Vdom2 also has a vlan which is part of root vdom's fortilink and fortiswich's port1 configured as shown in the link below https://docs.fortinet.com/document/fortiswitch/7.0.0/devices-managed-by-fortios/801172/multitenancy-and-vdoms#FortiSwi2 The problem with that setup the port is dedicated to vdom2.What I want is share that port with the root vdom.Example: port 1 native vlan for root vlan10Port 1 Allowed vlan for Vdom2 vlan20 Any idea or advice for this will save my life. Thank you very much in advance.    

Hello,On Forti Authenticator we are sending vpn token through sms to our users, we have 1.100 users on the system, sometimes sms provider goes down and we have to change "Deliver token code by" setting to email manually for all users, as you can imagine it takes long time, i was wondering is there any CLI or API method to change "Deliver token code by" setting for all user at once?

After upgrading our FortiGate to v7.4.0 from 6.4.7 (with optional upgrade path 6.4.9 then 6.4.11 ...) All our IPSEC tunnels are down and phase1 and phase2 are down. At the same time all other config seems to be in place... We found out that as soon as we choose local gateway "Specify" (our secondary WAN IP) not "Primary IP" the tunnel is down and no communication is happening between our and client FW (all WAN IPs are from one ISPs GW). We can ping clients IP. Proposals and configuration of P1 and P2 are correct, as I mentioned as soon both sides chooses gateway (our primary IP) tunnel works. Policies are in place, traffic is accesable from both sides when tunnel is up. Routes created. As I understand there is some misconfiguration or missing setting within FortiGate after upgrade. IPsec tunnel does not work if I choose other WAN as gateway address which means the NAT configuration or something. But at the same time all other resources that are being hosted behind o

After upgrading our FortiGate to v7.4.0 from 6.4.7 (with optional upgrade path 6.4.9 then 6.4.11 ...) All our IPSEC tunnels are down and phase1 and phase2 are down. At the same time all other config seems to be in place...We found out that as soon as we choose local gateway "Specify" (our secondary WAN IP) not "Primary IP" the tunnel is down and no communication is happening between our and client FW (all WAN IPs are from one ISPs GW). We can ping clients IP. Proposals and configuration of P1 and P2 are correct, as I mentioned as soon both sides chooses gateway (our primary IP) tunnel works. Policies are in place, traffic is accesable from both sides when tunnel is up. Routes created. What could be the possible issues where to look. I tried to find similar issues on forums but no success. Would appreciate any ideas and help.  

Topology：HQFG(WAN1,10.100.100.6)----PE(10.100.100.21)--(WAN1)Remote-FG2(VRRP,172.100.10.254) When I set "update-static-route" in the "link-monitor" configuration of Remote-FG2 to "disable," the VRRP Failover fails to switch, and the priority remains unchanged until I set "update-static-route" to "enable." However, I don't want my static routes to disappear as a result. How should I configure it? Certainly, when I checked the status of the link-monitor using "diagnose sys link-monitor status," I confirmed that the link-monitor is in a "die" state. Please assist me in clarifying and improving this issue. Thank you. My VRRP config as the following:config router static    edit 1        set gateway 10.100.100.21        set device "port1"        set link-monitor-exempt enable    next    edit 2        set dst 10.100.100.6 255.255.255.255       

tried to search with no luck Using the fortigate cloud manager how many fortigate can i manage with single account? Thanks

Hi,Forticlient EMS 7.2.1. What it this option? I can't find documentation 

Hi guys, As you can probably tell, I'm new here :) We are running Fortigate firewall OS 6.4.10 - all is good!Trying to get a handle on what this SSL policy rule is doing .... if anything at all, some basic understanding would be greatly appreciated.Thank you From the GUI under,Policy & Objects,SSL Inspection & Authentication    Edit PolicyIncoming Interface: LAN users Outgoing Interface: WANSource: LAN usersDestination: All Security Profile:SSL Inspection: no-inspectionPolicy enabled From the GUI under:Security ProfilesSSL/SSH Inspection    Edit SSL/SSH Inspection ProfileName: no-inspectionSSL Inspection Options:Enable SSL inspection of: Multiple Clients Connecting to Multiple Servers Protecting SSL ServerInspection method: Full SSL InspectionCA Certificate: Fortinet_CA_SSLBlocked certificates: BlockUntrusted SSL certificates: AllowServer certificate SNI check: Enable Common OptionsInvalid SSL certificates: CustomExpired ce

The problem we are facing is how to login into the fortiwifi device.We put username: admin and password: leave blank as the manual instructed but it is not working. And it shows " Authentication failure", how can solve this problem? 

Hi, we installed Windows Agent on (Virtual Machine) Windows Server.Is it correct that the IP address of the machine in the CMDB is the physical IP address of the server and not the Virtual Machine itself? 

for all these malware resources update, is it we must subscribe to their service? is there any free to update?

I know fortiedr is from the ensilo acquisition. Anyone have any recent experiences with FortiEDR ? and maybe some opinions on how it compares to other ones in the market ? We have fortigate routers and switches, but not sure we definitely need to have that "single panel" convenience, though it sounds nice. Obviously nothing catches everything, and we would prefer better lateral spread prevention, than protection of said endpoint (as in we could sacrifice a known corrupted endpoint, which maybe the fortisandbox might help with as well). that and we would only allow VPN connections if the client was running forticlient with protection, rather than letting any endpoint connect. It might be difficult to determine on login, whether the endpoint had EDR running outside of the fortinet security fabric mechanisms..So we are considering Windows Defender ATP (endpoint), s1, fortiedr right now. There just isnt much information on fortiedr out there. S1 kind of requires MSP, and we're looking to k

Hi everyone, I have a FortiGate 60F with Fortios 6.4 for to protect my Windows with Active Directory network.I have setup the FSSO Agent into my server, and is linked to my FortiGate. I can obtain usergroups list from my AD and the device shows 'up' in the External Connector section into admin web.Here I my case: I use wifi router for to provide access to several users, this was my previous device to provide internet before current FortiGate. And when I check users activity, all the sessions and web visits and almost all the log registries of any activity are not user-related, but IP related. This IP is always the router one, because users are 'behind' the router and share this IP. Is there a way that my FortiGate 'recognizes' the individual user that is performing the actions and stores it?In essence, maybe having all my users sharing same internal IP makes FortiGate unable to individualize then, even if I have the FSSO Agent working with my Active Directory?Thanks a lot and

A couple of questions regarding VLANs and the necessary policies to reach other VLANs and the internet. Scenario: I have a couple of ports on our FortiGate set up as a hardware switch (LAN). I have a single static route set up (0.0.0.0/0 to ISP) and I have policies that allow the LAN to communicate with the WAN port and vice versa. We have internet / no issues. I have just added a couple of VLAN interfaces under the hardware switch. Devices on new VLANs (set with DHCP Relay) are pulling DHCP addresses from appropriate pools/appropriate server. 1. What policies do I need to reach the internet from a VLAN? Do I need policies for the VLAN and WAN to communicate, or do I just create policies for the VLAN and LAN to communicate? 2. Same question for VLAN-to-VLAN communication. Let's say that I have a VLAN for printers and a VLAN for a subset of users. Do I create policies between those 2 VLANs, or do I just create policies that allow those individual VLANs to communicate