Solved

I have one fortigate 100E, one public IPI have multiple subnet for multiple servicesI done 3 Ipsec Remote acces VPN on it and each VPN reach a specific network.My issue is that only one VPN is work, the two other throught an error Thank you for your help

Hi, my firewall detected POP3 Invalid Message Number blocked by IPS. I have checked the fortiguard encyclopedia.Encyclopedia : "This indicates that a client has tried to retrieve a message from a POP server with a number higher than 65535. This is an indication of a buffer-overflow or denial-of-service attack." Does it mean someone tried retrieving a message with a port higher than 65535?Or the total number of messages retrieved is higher than 65535? Or the content of a message has a number of words higher than 65535?Or any other meaning? I am not familiar with this, please someone explain to me. FortiGate 

Hello, I have this question, can we keep the informatons of last hit et last used of rules in Fortigate and Fortimanager after an upgrade to FortiOS 6.4.11? Thank you 

Hello Everyone We have FortiEMS and we are almost always out of licenses. So I have a few questions anyone using FortiEMS: How are licenses counted?One install equals one license, or each user can install on X number of devices? Clean up Is there an automated cleanup process, where a license is released if client uninstalls or is out of contact for x number of days?Is it purely a manual process where we decide when to reclaim a license from a client?@Anonymous: If I am posting in the wrong subgroup, please move me to the correct part of the forum Best RegardsMartin

Hello, i have a problem wtih a fortigate 200F Log of the console : FortiGate-200F (11:59-01.19.2021)Ver:05000008Serial number:FG200FT921901705RAM activationCPU(00:00050665 bfebfbff): MP initializationCPU(01:00050665 bfebfbff): MP initializationCPU(02:00050665 bfebfbff): MP initializationCPU(03:00050665 bfebfbff): MP initializationCPU(04:00050665 bfebfbff): MP initializationCPU(05:00050665 bfebfbff): MP initializationCPU(06:00050665 bfebfbff): MP initializationCPU(07:00050665 bfebfbff): MP initializationTotal RAM: 8192MBEnabling cache...Done.Scanning PCI bus...Done.Allocating PCI resources...Done.Enabling PCI resources...Done.Zeroing IRQ settings...Done.Verifying PIRQ tables...Done.Boot up, boot device capacity: 28626MB.Press any key to display configuration menu................................Reading boot image 3079118 bytes.Initializing firewall...System is starting...Starting system maintenance...Scanning /dev/sda1... (100%)Scanning /dev/sda3... (100%)batch descriptor

Good morning everyone. Attached is the current scene. We have now acquired a second Fortigate 100F. The idea is to configure the two in active-passive HA (High Availability). I have some doubts. 1) Can the WAN be the same? 2) How do I connect and where do I connect the three doors of the second Fortigate? 3) The 3 ports of the first Fortigate are configured as DHCP Servers, will they continue to work?

We have a host in a VLAN that needs to be openly accessed by an outside provider through a 2nd WAN port. We've followed Fortinet documentation on port forwarding and 1:1 NAT but we aren't able to ping the host. The configuration is as follows: We have a default route to our primary WAN on port 1 with a static public IP x.x.x.200. We have a 2nd WAN connection on port 18 with a static public IP of x.x.x.199. We have an internal VLAN (DMZ) with a gateway of 10.200.80.1 and a host at 10.200.80.2. We need any traffic hitting our 2nd WAN (x.x.x.199) to be forwarded to the 10.200.80.2 host.We have a a virtual IP configured to map the 2nd WAN to 10.200.80.2 (x.x.x.199 -> 10.200.80.2). We also have firewall policy stating [ SRC INT: WAN2 - DST INT: DMZ  SRC: Any - DST: VIP (x.x.x.199 -> 10.200.80.2) SERVICE: ALL  NAT: Dynamic IP Pool (One-One, x.x.x.199) Preserve Source Port  ] We aren't able to ping the host or pass any traffic to 10.200.80.2 when we hit x.x.x.19

Hi team, I would like your help with the followingI have a company that wants to give a kick to an SSG140, and they ask me for a FortiGate hardware to be able to replace it. I don't see that Fortinet has any sizing tool for these cases, so reviewing the datashee of this SSG140, it seems that all the 60, 70 and 80 models fit perfectly, but I want your support, I don't want wrong sizing https://www.juniper.net/documentation/hardware/netscreen-systems/netscreen-systems54/GSG_SSG140.pdf http://www.nha-fl.com/files/SSG140.pdf

Hello there, I need to replace old AV software installed on Windows Servers in our organization.Because we already have about 400 Forticlients installed on users computers connected to EMS I want also make it for servers.I was thinking about making additional profile, with disabled Remote access, Web filter and Firewall and adding some exclusions for files, folders or extensions (ex. .ldf, .mdf on SQL server).I want to install it on AD, DNS, DHCP, File servers, some App servers and SQL servers.Do you have some additional suggestion I should be aware of?

We are configuring a two firewall HA pair using 2600-series and want to be able to log into each separately. This documentation appears to describe the configuration (https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/313152/out-of-band-management-with-reserved-management-interfaces), but when I go to System > HA > Primary Firewall, under the Management Interface Reservation, port17 isn't available to be selected, which is the management interface. It's on a different VRF than the other ports; however, I put another port into that particular VRF, and it shows up. I'm currently logged into the firewall using port17, so is that the problem? Could there be something else? Thank you.

Any REST API available for authentication failed wifi clients with reason..

Hello, We are dealing with  botnet CnC DNS related requests. DNS Filter is being aplied in FortiGate so DNS requests asking to resolve malicious domains are successfully redirected to Block Portal By the way, FortiAnalyzer shows corresponding events as "Unhandled". Shouldn't it be automatically  marked otherwise, such as "Mitigated" ? Thanks for your help,

Hi Why Fortigate v7.2 port 4 and 5 disappear? instaed something else appear. Please see the below output of show system interface. Thanks  ZT40 # sh system interfaceconfig system interfaceedit "port1"set vdom "root"set mode dhcpset allowaccess ping https ssh http fgfmset type physicalset snmp-index 1nextedit "port2"set vdom "root"set type physicalset snmp-index 2nextedit "port3"set vdom "root"set type physicalset snmp-index 3nextedit "naf.root"set vdom "root"set type tunnelset src-check disableset snmp-index 5nextedit "l2t.root"set vdom "root"set type tunnelset snmp-index 6nextedit "ssl.root"set vdom "root"set type tunnelset alias "SSL VPN interface"set snmp-index 7nextedit "fortilink"set vdom "root"set fortilink enableset ip 10.255.1.1 255.255.255.0set allowaccess ping fabricset type aggregateset lldp-reception enableset lldp-transmission enableset snmp-index 8nextend

Hi,Can someone help me to explain about throughput in 'Top SD-WAN Device Monitor' in FortiView?The graph shows the throughput more than 1GB/s.Meanwhile, the FortiGate only connects to LAN user switch with 100Mbps full duplex with provider uplink bandwidth 100Mbps. Why is the throughput go over 1GB/s with bandwidth 100Mbps? Thanks,Arie

Even when I am in the Vdom context, when I do "get system interfaces", it will show interfaces belonging to all VDOMs. It does not even have a column to say which vdom it belongs to. I also tried "diag ip address list" and it does not tell me that information either.Is there a better command to display and even filter the information?Thanks

Hello everyone, Outgoing Remote Desktop Protocol (RDP) are risky since it is possible for the client to share her local drives with the server (as well as network drives, usb drives, printers, ports, clipboard, etc.) Is it possible for FortiGate to inspect outgoing RDP traffic in order to block connections sharing such resources? Thank you,

HI, I'm trying to perform an ipsec between a fortigate device and a teltonika rut950, and I can't get it, I'm looking for an idea of why or if there is no compatibility   

Hi, we're using a FortiGate 100E (v6.0.2 build0163 (GA)) with SSL VPN configured. Remote clients are assigned the entire 10.0.95.0/24 subnet while LAN 192.168.1.0/24 subnet.No troubles for the remote subnet to access the internal LAN but cannot find a way to make internal LAN access SSL clients. I've tried to set a specific policy to enable traffic from LAN to SSL subnet but it seems to be ignored. Also, the route isn't correct because if I make a tracert from an internal LAN device pointing to a remote client it seems that the FortiGate sends the packet to the outside instead of redirecting them to the remote client through the tunnel interface. What I am missing?  Thank you This is the policy that I tried:

Hi, I have some experience sdwan on viptela system, which need vsmart, vbond and vmanager etc. After I review sdwan with fortigate, I feel fortigate is pretty easy. My question is,  it is possible for us to run sdwan with fortigate on lab or eve-ng? Thanks

Greetings In versions 6.0.x and previous, the maximum number of usable LDAP servers you could define was ten. You could define more than that, but the Fortigate would only check ten of the defined servers (and not in a predictable way, it appeared pseudo-random). I have a doc from 6.0.x that indicates this limit: https://docs.fortinet.com/document/fortigate/6.0.0/cli-reference/15405/user-ldap but I have not been able to find a similar one for 6.4.x. Has the limit changed? Thank you.

I want to create Fortigate policies that apply different web filtering to members of AD security groups, based on student grade levels. I have followed the Technical Tip: Configuring Radius Single Sign-On using NPS 2019. The students are able to connect to the wireless network, authenticate using 802.x, and placed in a specific VLAN. I'm struggling with passing the Network Policy's Class value (TestRSSO) from the NPS to the Fortigate. Where would this information show up when it's working, because I don't think it is. Would FSSO be a better option for this?

Hi FortiManager is installed as vm at vmware. When I enter command "show system interface", the output is like below. We cannot see port 1 - 5 status since it show it too fast. Please see the below. What command can we use to show port 1 - 5 status? or show one page by one page. Thanks   

I'm a new FortiGate user, following the Azure AD SSO documentation here In the docs, Fortinet points to msft to explain the certificate upload.However Msft docs have the following steps Sign in to the management portal of your FortiGate appliance.In the left pane, select System.Under System, select Certificates.Select Import > Remote Certificate.Browse to the certificate downloaded from the FortiGate app deployment in the Azure tenant, select it, and then select OK.My FortiGate 40F v7.2.3 however does not show that option.In fact, I can't find certificate management anywhere in the GUI, except hidden inside setup wizards for other features.. I tried to do config vpn certificate remoteAnd add the cert there, I managed to add it but config user samledit "AzureSSO"set cert <name of the cert> gave me an error..What am I missing?

We have a Data center (DC) and a Central Location (HQ).For a redundancy we have 4 separate lines:- 2 are direct leased lines, which I want to use for a primary connection;- 2 are trough Internet and I would like to use them as a backup connection. I have implemented the IPSec between all points and I am using BGP.The question is how to achieve maximum bandwidth usage and redundancy in the same time?Should I:1. Use IPSec aggregate or SDWAN on the primary and secondary interfaces?2. How to make sure the secondary is used only in case secondary goes down? In my current setup I tried to use BGP with communities, but still there is traffic on all interfaces.3. I have to add move remote locations with, each with one primary and one backup line. If I put them into the same SDWAN, whenever the primary goes down the packets are sent to the other members in the same SDWAN, is this a normal behavior? 

I have two Fortigate 500E's in separate locations (primary site and failover site) that connect to each other via ISP link. I have 7 branch locations that connect to both sites (primary and failover) via the same link. Each 500E has it's own independent Internet connection and I would like to create a failover connection, so if the primary site goes down, all branch gates route to the failover site instead. Because they are all connected via the same link, I only have one WAN port. I set each WAN port to have a secondary address which matches the failover site LAN. I am looking for suggestions on how to configure the branch gates to automatically re-route to the failover site if connection to the primary site is lost.Network config:Primary gate: Primary IP 10.0.0.1 / Secondary IP 20.0.0.1Failover gate: 20.0.0.2Branch A WAN 1: Primary IP 10.0.0.4 / Secondary IP 20.0.0.4Branch B WAN 1: Primary IP 10.0.0.5 / Secondary IP 20.0.0.5Branch C WAN 1: Primary IP 10.0.0.6 / Secondary IP 20.0.0.6E