Solved

I have upgraded kubuntu 22.10 to version 23.04 recently, and since then Forti Client refuses to connect with the error message "Config routing table failed" (was working well before).  An excerpt from the sslvpn.log: 20230424 21:10:49.713 [sslvpn:DEBG] route:380 Tunnel mode: Full tunnel20230424 21:10:49.713 [sslvpn:DEBG] route:381 Exclusive routing: Disabled20230424 21:10:49.713 [sslvpn:DEBG] route:434 Can't find dev for IP XXX.XX.XXX.XX (tun)20230424 21:10:49.713 [sslvpn:EROR] vpn_connection:1335 Config routing table failed I have already tried reinstallation, also with a different version of the Forticlient (7.0.7.0246 instead of 7.2.0.0644), and I have also tried connecting from a different network - without success. Has anybody encountered similar problems after upgrading to ubuntu 23.04? Thanks in advance,Friedrich

Currently we have 2 sites that we connect through a Site to site VPN, this is already up and running. All of our servers are on Site1. We would like to have our printers and access controllers on Site2 get an ip address (and communicate with) from the server on Site1 without adress translation or a static route. Is this possible? And what should I do for this and/or what am I doing wrong because it is not working. My apologies if this is a stupid question, if anyone feels like taking a look at this dummy problem with us, we are immensely grateful.... 

Hi Is there any option to monitor the percentage of accelerated sessions in fortigate firewalls with enabled VDOM?I've been  looking for an OID to get this parameter but I can't find it.thanks Manel

I have successfully configured a site-to-site VPN connection between 2 Fortigates.The two subnets of the locations can also reach each other with static routes.However, if I create a policy-based route instead of a static route, no data is transferred.Unfortunately I didn't find a suitable article about FortiOS 7.2.This article cannot be implemented this way under 7.2: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-policy-routes-for-route-based-interface/ta-p/193376Can someone give me a tip here?

I have the following use case with Fortigate 6.4.12: I have a DNS domain hosted with my ISP for internet facing service say myorg.com. Therein I have several hostnames for services. I need to split-brain only specific hostnames under this domain internally on my corporate LAN. For example  When www.web.myorg.com is resolved from the internet I wish to give 1.1.1.1When www.web.myorg.com I wish to return 2.2.2.2When anything underneath it (host.www.web.myorg.com etc.) is resolved I wish to forward to another set of DNS servers Internally on my corporate we use Windows DNS servers. Whilst these support conditional forwarding catering for 2 and 3 is messy and requires multiple upstream DNS servers. Can the Fortigate DNS servers setup with non-authoritative zones simply answer for specific records and forward for all others in a zone? 

Hello. we are using a 100d and the field crew is working over ssl vpn. Now we are thinking about backing up the clients over ssl vpn as well. Unfortunately it's not possible to get this running. Client update of the backup software (acronis) is not working but the client is shown as online in the managemnt console. Is there a principle thing I do not hink about? The access of c$ is not possible as well.

Hello Fortinet Community We have FortiNAC 9.4.3. All corp hosts have PA agent. We enabled PA optimization on all access switches.Without IP phone everything works fine. However when we connect a host with PA agent behind a IP phone, the PA seems not to initiate DHCP request when VLAN is changed, so the host's IP remains unchanged, until we initiate ipconfig /renew, here the IP is renewed correctly and all works fine.This issue happens every time when VLAN is switched by FortiNAC, e.g.: from isol to prod, or from prod to isol, or from prod1 to prod2, ... etc Any useful idea would be appreciated.    

Hi. I have a question regarding IPSec VPN.We have a customer that is currently in the process of switching from an ASA 5505 to a FG-40F-3G4G, both physical on-prem.They have an IPSec VPN as of right now, which we use to access thier enviroment to make regular maintenance. With this, they will also replace their physical server which they host two VM's on (App and DB) with two VM's hosted in our cloud service along with another virtual firewall (PfSense) hosted in the same cloud. My question is, they have a public ISP with a dynamic public IP address and this in turns makes it hard for us to setup IPSec VPN on the FortiGate. Is it best to make the PfSense an OpenVPN client and make a OpenVPN connection to the FortiGate, or is there a better way to do this?If more information is needed, feel free to ask and thank you for all the answers. Kind regards

We have a current SD WAN setup with LAN internet connectivity traffics load balanced to 2 ISP providers - both WAN interface IPs are used and the bandwidths are combined.192.168.0.0/24 --> ISP-A-50Mb (1.1.1.1/29) + ISP-B-50Mb (2.2.2.1/29)Both IPs are used randomly in each session even in a single deviceBandwidths are combined to 100MbpsThis time I would like to use the other available IPs from each ISP block then still have the bandwidth combined and load balance from a diff LAN subnet.192.168.10.0/24 --> ISP-A-50Mb (1.1.1.2/29) + ISP-B-50Mb (2.2.2.2/29)Attempt: Assign overload IP pool for each ISP, and setup an outbound firewall policy NAT to it.Only single IP (random) is used per deviceOnly single ISP bandwidth is utilized - 50Mbps

Good day all. The IP address assigned to one of my WAN interfaces on my Fortigate changed unexpectedly a few days ago. It is assigned by my ISP via DHCP. Is there a log I can check to determine exactly when this happened?

Hello I just want to know if it is possible to make a suggestion for NSE training institute for adding the feature of different playing speeds. As in x0.25, x0.5, x.075, x1, x1.25, x1.5, x1.75, x2 speeds. If I am supposed to make this suggestion somewhere else, please refer me.Best regards.

Morning: New to Fortigate, and am trying to setup SNATing some VMs out to the Internet from my home lab on VLANs. It's a 40F, so it doesn't have a VLAN switch. In this instance, the VM is on vlan50, using the Fortigate as a DHCP server. It receives an IP in the proper range, and I can move the VM from vlan to vlan in the lab, and it recognizes the different subnets and gets DHCP for them. So tagging seems fine. I just can't get out. My processAdded VLAN interfaces to the LAN w/DHCP, which is just ports 1-3 for now.Central SNAT is enabled. ALL/ALLFirewall policy: vlan50 > wan, ALL/ALL/ALLThe policy is getting hits, but I still can't ping out to any external IPs. I have a feeling I'm missing something simple here :) Any suggestions on what I'm missing?  id=20085 trace_id=197 func=print_pkt_detail line=5846 msg="vd-root:0 received a packet(proto=17, 10.16.50.50:57296->1.1.1.1:53) tun_id=0.0.0.0 from vlan50. " id=20085 trace_id=197 func=init_ip_session_c

Dear All,            I have a fortigate 61F, just wonder if Web filter support on only blocking specific gmail address rather than blocking the whole gmail.com ? any help would be appreicated  keith

I understand that the steps are to download the config fileChange the firmware , build, version, interfaces of the config fileUpload the edited config file into new firewall.Any other steps I need to take to ensure that the configuration port over is ok?

Hello guys! I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?

I have web filter configured on my fortigate 80F to my AD users and for the las 3 months it have been working fine, since last month a profile where the Web Chat category is permited started blocking the whastapp web. The logs tells the block is because the webfilter is categorizing whatsapp web as Social Networking. The FortiGuard Web Filter Lookup categorizes it as Web Chat, I created a web rating overrides to solve the problem but why my fortigate is categorizing it like social networking?Please, see the following raw log:date=2023-03-21 time=15:30:54 id=7213068811073749046 itime=2023-03-21 15:30:54 euid=12697 epid=1206 dsteuid=3 dstepid=101 type=utm subtype=webfilter level=warning action=blocked sessionid=179721645 policyid=41 srcip=XXX.XX.XXX.XXX dstip=157.240.222.60 srcport=53029 dstport=443 proto=6 cat=37 logid=0316013056 service=HTTPS user=USERNAME group=FSSO_SPO_ProPlus eventtime=1679423454318969117 sentbyte=1239 rcvdbyte=3451 srcintfrole=lan dstintfrole=wan direction=outgoing

Hello team!!  Greetings!! We have 2 sites with a FGT60F in each site. (7.2.3 in one and 7.2.4 in the other)Each site has 2 WAN interfaces in an SD-WAN Currently we have 2 VPNs IPsec site to site:* Site 1 Wan 1 <-> Site 2 Wan 1* Site 1 Wan 2 <-> Site 2 Wan 2We are having troubles with this, sometimes one VPN stop passing traffic and users complain.  Then we change route distances to use the other VPN. I am wondering about the differences between "Aggregate" "Redundant Interface" and "SD-WAN" for IPsec site to site VPNs.Some considerations:* We dont care if the traffic is balanced, but we want the link will be working as much as it is possible* We would like to view the redundant links status, preferably in gui* It would be nice to create some email alert when some link is down.Which method do you reccomend?  Thanks in advance.Regards,Damián 

Dear guys!! I can not send my email to other via outlook when use my network (forttinet router) on both WIFI too cannot send, but I try on an andriod it's send normally, So why? can help me plz!!!!

Hi Forum I've been tasked by my company to investigate the deployment of Forticlient EMS (Enterprise Management Server). I realise that Forticlient EMS does alot of things though initially it will be used by my company to manage the Forticlient licenses.The company currently uses a SSL VPN connection directly onto a Fortigate and uses the free version of the Forticlient.They want to migrate to use the full FortiClient licenses version and then gradually rollout the appropriate functionality. I have found the QuickStart Guide here:https://docs.fortinet.com/document/forticlient/7.0.2/ems-quickstart-guide/516451/introduction I'm looking for a high level overview of how the Forticlient EMS works but can't find a resource on the Fortinet site that gives me that! I have found diagrams like the following showing the traffic flows between the Forticlient, Fortigate, Fortclient EMS and AD.https://docs.fortinet.com/document/forticlient/6.0.3/ems-administration-guide/5772

Hello,  I have a fortigate and it is registered to forticloud.  I would like to change the account it is registered to. I have done it previously  through CLI, but I cannot find the correct command.  I have found this page but I get an errorhttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Logging-in-to-FortiCloud-from-FortiGate-CLI/ta-p/193664 Any help appreciated Thanks and regards, Konstantinos

I'm preparing my first 60E for deployment. This unit came with the new 5.4 firmware. Early in the process of configuring the unit I locked myself out of the firewall. I see a Reset switch on the outside of the firewall enclosure. Can this be used to reset to factory settings? I did not see any information about this switch in the manuals for the 60E. If this can be used how do you perform a reset, i.e. hold the reset switch in with a paperclip while powering up the unit? Is the use of the Reset switch documented somewhere, if so where? Thanks!

Our FTM is running 7.2.2 and our FTG's are running 7.2.4. These are relatively new installations, and we're trying to trim the amount of syslog traffic to our SIEM. On the FTM at Device Manager > [FortiGate] > Log & Report > Threat Weight, there are several security settings. I don't see where to apply these to the syslog settings, nor can I find any documentation to do so. The "Log Threat Weight" is enabled. We do not have FortiAnalyzer. Is there a way to configure syslog to send security-related info that can be ingested into our SIEM without having a bunch of extra fluff? Thanks

I have a FGT 90D and a 60D, both with FortiOS 5.0.12.The "set daily-restart enable" works just fine, but I think a weekly reboot would be more appropriate.Is there any way to achieve that in FortiOS? Thanks EDIT: Solution found on my last post... thanks!

FG 60Ev 7.2.4 I need help with the traffic shaping policy triggering and the traffic direction. When I created a VoIP traffic shaping policy based on the traffic direction from the source to the destination, which includes RTP and SIP services, I experienced some problems with the SIP DSCP marking. Applied EF but the output for the SIP packages was still CS0.The sessions output for the external inbound call for SIP session was:  session info: proto=17 proto_state=01 duration=540676 expire=179 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3 origin-shaper= reply-shaper= per_ip_shaper= state=may_dirty npu statistic(bytes/packets/allow_err): org=62869363/107131/1 reply=56299023/112453/1 tuples=2 tx speed(Bps/kbps): 135/1 rx speed(Bps/kbps): 106/0 orgin->sink: org pre->post, reply pre->post dev=46->37/37->46 gwy=10.10.5.25/10.55.100.100 hook=pre dir=org act=noop 10.55.100.100:5060->10.10.5.25:5060(0.0.0.0:0) hook=post dir=reply act=noop 10

We currently run v6.4.10 for our FMG-VM and manage bigger customer's FortiGates(FGTs) totalling about 600 (soon to be 800+).And one of them needs one VIP group (two VIPs) at all 500+ locations. We use policy packages for this customer to standardize their policies, which is almost the same at all locations. But when I looked at the VIP object config under Policy&Objects->Object Configurations->Firewall Objects->Virtual IPs then hit "Create New->Virtual IP", I don't see a way to select a dynamic address object for the External IP and Mapped IP.This means we need to create 500+ x 2 VIPs manually putting each IP, then worse, we need to create 500+ different policies and use "Installation Target" to be for one specific FGT. Is there a better way to have just one policy for one VIP group for 500+ FGTs? Or, can I use meta fields+CLI template to define those on Device DB side and somehow let the policy to refer to the VIP group name?  There should be a