Solved

Hello,   I am having query on SDWAN ADVPN child tunnel interface sequence. In my LAB topology I have 1 Hub and 3 Branches with internet underlays. We have necessary ADVPN configurations available in Hub and spoke branches Scenario, We have VPN named as ADVPNBranch 1 communicating to Branch 2 - This will form ADVPN child tunnel interface ADVPN_0 at both end (Branch1 and Branch2)Branch 3 communicating to Branch 1 - This will form ADVPN child tunnel interface ADVPN_0 at Branch3 but since Branch1 already has ADVPN_0 (towards Branch2), at Branch 1 ADVPN_1 child tunnel interface will be created to Branch3.. Whether this scenario is ok ??.. I mean Branch 1 has ADVPN_1 child tunnel interface to Branch 3 while in reverse path Branch 3 has ADVPN_0 child tunnel interface towards Branch 1.. Having two different child tunnel interface at both end is ok or is it an issue?? Whether this will cause any route lookup failure in reverse path considering no interface available.. P

I am following https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-block-iCloud-Private-Relay-from-bypassing/ta-p/228629 to block iCloud private relay from bypassing the security inspection. My question come into the DNS filter portion of the guide. Since I do not user the DNS filter option in my FortiGates, I just create DNS policies on my internal Windows DNS servers to DENY (provides a response and not a drop) those domains. This brings up the bigger question for me of, Apple's own admission is that the only two domains needing to be set with "no error no answer" or at least some response...just not dropped, is mask.icloud.com and mask-h2.icloud.com. The linked guide however, adds several other domains to this beyond what Apple states, so just wondering about the discrepancy between Apple and Fortinet?

Hi, I used to configure 3rd party DDNS on 6.4.x using the following:Execute the following commands in a CLI session:config system ddnsedit 1    set monitor-interface "wan1"    set ddns-server ddnsservice.example    set ddns-domain "hostname"    set ddns-username "username"    set ddns-password passwordBut with 7.2.1 i could not find the option to add the username and password just the server, and domain !! Any tips To configure DDNS servers other than FortiGuard in the CLI:config system ddns edit <DDNS_ID> set monitor-interface <external_interface> set ddns-server <ddns_server_selection> set server-type {ipv4 | ipv6} set ddns-server-addr <address> set addr-type ipv6 {ipv4 | ipv6} next endhttps://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/685361/ddns  

Running on Yosemite, I have now tried both the latest(5.2) and 5.0 but for one or other reason I am connected for sometimes less than a minute. I then get above mentioned error but it connects immediately again. Please help.

We have fortianalyser but not able to get the details of the IPs banned/quarantined by Fortigate on Fortianalyser. Is there any way to get the report also?

Hi, I have an strage error with logging.I have two Test VMs (10.244.15.41 and 10.244.14.109) in AWS segmented by an Fortigate 7.2.2 First I did an SSH connection from 10.244.15.41 to 10.244.14.109As next step I ping 8.8.8.8 from 10.244.14.109But the Fortigate Logging shows the connection in an wrong order with 3 Minutes delay! Date TimeSource IPDestination IPProtocolActionRule2022/11/09 09:44:4710.244.15.4110.244.14.109SSHACCEPTAWS-Internal2022/11/09 09:41:3810.244.14.1098.8.8.8PINGACCEPTAWS-External Has anyone an explanation for this? ThX Mag

Hi,If the FortiGate has 2 default route but with different priority like below: config router staticedit 1set device wan1set gateway 192.168.208.29set priority 10nextedit 2set device wan1set gateway 192.168.208.30set priority 20nextend Without the link-monitor configuration, can FortiGate failover to static route #2 when the static route #1 is unreachable? ThanksArie

I'm in the process of reconfiguring my 1800f v7.12 to a firewall on a stick topology. The new configuration will only have 2 active physical ports that connect to CORE1 and CORE2 switches. The CORE switches have a physical connection to the Edge router. I'm using BGP for the routing and that seems to be working. Each active port have 2 sub interfaces, a trusted VLAN and an untrusted VLAN. My issue is the trying to modify my current FW policies. The inside to outside seems to be working fine. However, I do need several policies that allow for my DMZ traffic to hit certain IPs on the inside. With only a trusted and untrusted ports to choose from I'm confused as to what that policy would look like. Technically, now my inside IPs and my DMZ IPs are considered inside addresses.  BTW, the CORE switches forward all my DMZ subnet to the FW. The gateway for the DMZ subnet is the FW.  I have no static routes, its all BGP.

Hello, We are using FortiGate 61E v7.0.8 build0418.And we want start using Forti switches but fortilink error stands in our way.When i try to open default fortilink interface via GUI it gives me an error:"Failed to load data."We never used fortilink or fortiswitches so is doesn't have any references.When i try to delete it:Generic errorSwitch interfaces can only be deleted from the switch interface table.Command_cli_delete:6677 delete table entry fortilink unset oper error ret=-160. Fortlink interface via GUI looks like so: CLI:     # config system interface # edit fortilink # show config system interface edit "fortilink" set vdom "root" set ip 169.254.1.1 255.255.255.0 set allowaccess ping fabric set type hard-switch set device-identification enable set lldp-transmission enable set role lan set snmp-index 7 next end   I know a workaround is to disable fo

Hello All, Hope you are all fine. I have an issue with the FortiClient. I'm building a lab for a project that I will deploy. I tried to deploy a Remote Access VPN (SSL VPN) on a VM edition of the Fortigate, but it is not working with me. When I try to connect, I get the error below: Unable to establish the VPN connection. The VPN server may be unreachable. (-5) My Fortigate is on OS FortiGate-VM64 v6.2.3,build1066,191218 (GA)And my FortiClient version is: 6.4.2.1580 After debugging, I get the logs below: [169:root:2c]allocSSLConn:289 sconn 0x7fb37a483e00 (0:root)[169:root:2c]SSL state:before SSL initialization (192.168.187.1)[169:root:2c]SSL state:before SSL initialization:DH lib(192.168.187.1)[169:root:2c]SSL_accept failed, 5:(null)[169:root:2c]Destroy sconn 0x7fb37a483e00, connSize=0. (root)[169:root:2d]allocSSLConn:289 sconn 0x7fb37a483e00 (0:root)[169:root:2d]SSL state:before SSL initialization (192.168.187.1)[169:root:2d]SSL state:before SSL initializ

In my machine (FortiWiFi 60E FortiOS v6.4.4 build1803) I got on Route policy screen:how I can clear it, and start over? 

Currently we are using a FortiGate with explicit proxy in our environment because we have always used a proxy in the past to control which users get access to the internet and which do not. The same FortiGate is also the main firewall and default gateay. On the proxy policies, we use the following security features:- SSL Deep Inspection- Antivirus- Web Filter- Application Control- File Filter The clients get the proxy information via PAC file. However, the proxy address is the same as our default gateway, which means internet connection could be established over normal IPv4 firewall policies as well. From time to time, there is problems with websites or applications that do not go over the proxy correctly. Either there is a problem with authentication (407 Authentication Required) or the websites simply break as soon as any security profile is applied (i.e. the browser returns err_emtpy_response). That makes me wonder, aside from the user authentication part, are there any be

Hi everyone, I've just downloaded the VPN-only free version of FortiClient for MacOS. Even after successful installation and configuration I'm not able to connect. Can you help me figure out the issue please? Do you know if the downloadable file available in the website is compatible with the latest Monterey 12.6.1 MacOS version recently released? I've had a look at this article which seems helpful, but even then I cannot find all the extensions mentioned there. Thanks all for your help with this.leti

Hello Expert, I have configure  a "vpn"  tunnel between FortiGate 80F a Palto Alto device.The wan interface of the Palto Alto device is using private ip address for the wan interface because the another device on the network is use for full internet access The public ip address is 81.135.253.181        private ip addess 192.168.190.2           (remote identier)  I do not know where in fortigate I must input this ip address 

Kindly I need for your support for FortiManager Cloud. I'm asking about if FortiManager cloud can be logging to FortiGate hardware appliances GUI.

Hello, everyone Does anyone know where can I find the official documentation for FortiAuthenticator's OID lists? I am aware there are two MIB files you can download from the SNMP configuration page in FAC but for some reason it is not getting any CPU metrics while sensing via PRTG.  Thank you!

Hallo, I have been noticed from some users of our network, that today and yesterday, some PCs with windows 10 started to show classic BSOD, and restart during normal use. Sometime it happens more than once a day.PCs come from different brands, and hardware configurations, but are all windows 10 pro.In the last days we have applied 7.0.5 update to all Forticlients. (7.0.3 previous ver.)Any related recent known issue possible?Thank you in advance.Marco   

FortiGate200F , firmware version 7.0.8, I need some hint. 1- So I configure an LDAP server on my Fortinet, used the "test" button with a username and password and it's working. (Edit LDAP Server image : That "test user credentials" button is working.)   2- I configure a group (GUI : User & Authentification - User Groups), named GRVPNLDAP pointing to a LDAP group on Active Directory. 3- I then configure a remote VPN with GRVPNLDAP to authenticate with the IPSec Wizard, remote - native - Windows Native. (VPN Creation Wizard image : We use this Wizard to create the new Remote VPN.) 4- I convert the new R100 IPSec Tunnel , so I can use a secondary IP address on the Wan interface. 5- When I test the VPN, In the Event VPN logs, I see : Pass1 ok Pass2 ok, then the connection closes. 6- I test/configure another Remote VPN, with the same settings, except with a local user, it works. 7- I test/configure a login for the Fortinet GUI that

Hi there, SFTP configuration backup fails if there is an @ in the username, Is this configuration not supported? execute backup config sftp <file name> <SFTP server> <username@domain.com> <password> 

Hello Team,Is that possible to configure more than one Syslog Server in a FortiSwitch? In the documentation I see just this command related to syslog configuration. The are not any information about adding another server. config log syslogd settingset status enableset server "Server_IP"end Is there something similar as Fortigate, where I can set an additional Syslog Server with the commando config log syslogd2 setting or config log syslogd3 setting? Thanks. FortiSwitch 

Hi, I am deploying Fortigate Standalone on GCP, FG deployment was successful. In GCP we have created 4 VPCs (unprotected, protected, App & DB). VPC peering is configured between protected vpc to App vpc and between protected vpc to DB vpc via versa. Between App VPC & DB VPC we are unable to communicate. Communication between APP VPC & DB VPC should happen via Fortigate.  How we can achieve the same ? 

I would like to know if i conect a fortiswitch with an interface SFP+ (10GB) to another Fortiswitch with an interface SFP (1GB), this conection will work ? can auto negotite the speed to 1GB ??? I found this on the administration guide ¨Auto-module speed detectionWhen you enable auto-module speed detection, the system reads information from the module and sets the port speed to the maximum speed that is advertised by the module. NOTE: Auto-speed detection is supported on 1/10G ports¨ But i read in a KB that no all fortiswich serie support autonegotiation. Can some have test it ? FortiSwitch  

Hello, We've configured our Fortigate firewall this afternoon and configured our SSL VPN together with MFA. Everything works fine, but it seems that we have a problem with our MFA. The Fortitoken application is configured and shows a MFA code. The Approve/Deny prompt isn't always working, it only appears to work sometimes while manually entering the 6-digit MFA code works fine in the same attempt. Did anyone ever experience something like this that managed to solve this? We've enabled FTM on our WAN interface, a valid Forti Softwaretoken license is connected to the account. It doesn't matter which account we use, ever VPN account seems to experience this problem. Thank you in advance!

FortiManager-VM64 v7.0.3 GA build0254Log View... TrafficI notice many "Policy Violations" from china.Is this just standard "door knocking" on Telnet ports that I can ignore or is it symptom of more serious problem? 

Bonjour,Je veux essayer de résoudre les conflits d'ip lorsque je suis sous vpn.Mes utilisateurs ont besoin de se connecter en rdp à un serveur qui peut avoir la même ip que celui qu'ils ont chez eux.être explicite ; L'exemple :le serveur : 192.168.0.66home ip :192.168.0.66Il m'a semblé qu'avec l'option "Enable Split Tunneling" il était possible d'éviter ce conflit. Mais j'ai fait quelques tests, ça ne marche pas.J'ai peut-être tort ?Une idée ? Merci