Solved

Hi Guys~! My customer's used FG100D with firmware 5.0.11 and log max age 20 days.  Today, He want me a law log file. ( GUI Section in log & report - law log download option) In fortigate 100D display correctly 20 days log. But, when the law log downlad, downed file contents limited 400,000 line counts. Is anyone who know This? I confirm FG-analyzer lower firmware bug 400,000 line limites. Fortigate is too? or Originaly limites 400,000 line counts? Thanx for read guys.  

Hello @All, Our web pages have a problem, they hang up again and again when called up or the display is faulty or incomplete.In the browser Firefox the work is possible only in the private mode, in the normal call almost not.The call in Google Chrome is error-free, in Edge mostly too.Several Windows clients and browser versions have been tested, but we cannot find a reason for this behavior.The internal call of the web pages is error-free.Fortiweb version 7.01. Build 81 For help we would be very grateful TBC

Hi I have SSL VPN configured and working using a Let's Encrypt certificate. It has been configured for a FQDN (vpn1.domain.com) that points to IP address at Fortigate port1 interface.Now I have a second ISP connection on port2 and want to listen to SSL VPN connections on port2 also.Fortigate part is simple. Just add interface to "Listen on Interace(s)" field. FortiClient part is also simple. Just add a second remote gateway using a new FQDN (vpn2.domain.com) that points to port2 IP address.But server certificate used for SSL VPN profile just points to vpn1.domain.com. For any reason that FortiClient connects to port2 (vpn2.domain.com) a certificate warning is issued.Add a wildcard certificate is not possible.Is there any way to avoid this warning using a certificate issued by Let's Encrypt and managed by FortiOS (including automatic renewal) ?Or I have to issue a wildcard certificate by myself, load into FortiGate  and renew it by myself ? Thanks in advance.

i have issue with DHCP REPLY on firewall, the traffic not pass from DHCP to LAN side, attached topology for your understanding, the dhcp  server interface address 192.168.1.10 connect to switch and to Port1 Firewall. port 1 address 192.168.2.100.

Hi,When in FGCP A-P, the virtual-switch mac-address is following the virtual MAC Address of the HA.What are attributes that can we change to make the virtual-switch mac-address different between cluster?We are running FortiGate A-P and using virtual-switch in multiple site, but we are facing issue where the virtual-switch mac-address is conflict between site. Thanks

Hi all, I have clients using Android tablets where split tunneling is configured, and not working. Im pretty sure this is down to the DNS configuration on both client and Fortigate, rather than split tunnelling. I can see all DNS requests going through the SSL interface. Windows devices are working fine, as they seem to have internet DNS server on the adapter. Ive found a lot of KB articles around split DNS, which have me a bit confused. Im wondering could someone advise me on the clear steps required here to enable split DNS (assuming thats my issue), on the Android devices? Of course I dont want to impact the current 500+ VPN users, so need to be mindful of any global DNS changes. Thanks, D 

I'm using Fortimanager v6.2.9-build1471.I am having trouble with the following events.Event 1Execute "diagnose fgfm session-list" from FMG and execute SSH to the displayed tunnel IP, but login is not possible.Event 2I clicked "Connect to CLI via SSH" from FMG's WebGUI, but I couldn't log in.Event 3There were some devices that enabled SSH login with the following command.However, SSH login is still not possible on many devices.　exe fgfm reclaim-dev-tunnel <device_name> forceI guess it corresponds to the following items written in FortiManager 6.4.6 Release Notes.BugID:667442FortiManager may not be able to connect to FortiGate CLI via SSH widget or executeTCL scripts.Therefore, updating to FortiManager 6.4.6 may solve the problem, but due to circumstances, it cannot be updated immediately.Please let me know if there is a way to connect via SSH other than updating.

We are using SSL VPN through Fortigate at the moment. We deployed FortiAuthenticator for 2FA which is working fine with Parallels RAS solution. Now we are going to enable 2FA for SSL VPN. At the moment Fortigate configured to allow only select AD groups for vpn access. If we are going to use FortiAuthenticator for SSL VPN where can I select user group so only those group members can access vpn. Right now I imported users from AD group using Remote User Sync rules which imports all users group AD group and assign Fortitoken. We don't want all imported users to have VPN access. So how I can allow access to vpn for selected users.Thank you.

Dear All,  Could you please tell me how can I view the settings (F-SBID) of predefined ips signatures? Also where can I modify the rate/limit setting for example for the SMTP.Login.Brute.Force ? Especially in CLI?Thank you fortigate 600e

Anyone that knows if it would be possible to use ZTNA destination before a user login? We think it might be a good solution to publish FortiSandbox and a SIEM solution with the ZTNA Access Proxy but we need it to work before a user login. Thanks!

Hello Guys,a question: I have two fortinet working in VRRP each fortinet is connected to different switch trunked with lacp. The configuration of two firewall is fine but they are at the same time master . They exchange some messages between them 224.0.0.8 (protocol 112) but nothing they remain master both. I tried to ping from one switch the physical ip address of the other but nothing . From each switch we can see only the virtual IP that is the virtual ip of the local firewall . The switches are trunked well.I wonder if It is mandatory to use with VRRP proxy-arp configuration because I  suspect that arp do not resolve the physical IP of the firewalls connected to the other switch.Configuration:switch 1 connected to firewall 1switch 2 connected to firewall 2switch 1 and switch 2 trunked I checked with get info router vrrp of both everything is fine but do not resolve the arbitrage who is master who is slave, probably because they do not see each other due to some arp proble

Hello Team, Please who has an idea on how can we mitigate this risk? Kindly help me with a solution please Regards,Firdausi Nababa

I just setup a Fortigate under Azure recently, we have a web server behind the Fortigate with Virtual IP configured. It is working fine, I could access the website externally. But when I disable NAT, web server is inaccessible.  We would need the NAT disabled as there is a script from the webserver that needs to capture the original source  IP of the web visitior. Here's a sample of the network:(Azure Public IP) --> Fortigate Port1 (WAN facing) --> Fortigate Port2 (LAN Port) --> Web Server IPWhere:FG port1 = 10.1.1.5FG port2 = 10.0.0.5Webserver = 10.0.0.4 Currently the webserver only captures the 10.0.0.5 IP because of NAT, instead of the Original IP of web visitor.What would be the best way for the webserver to capture the original IP of web visitor? 

i want to configuration load-balance but found wan2 only

Dear All, I had a problem with rekeying phase2 tunnels, the dhgroup numbers were different. After a vpn reset the phase2 works until the first rekey occurs. The solved by recheck the two side parameters, but what is frustrating is I can not get this exact info via debug. with:diagnose debug application ike -1diagnose debug enableI can get only this info:ike 0:ahvpn:ahvpn: IPsec SA connect 17 x.x.x.x->y.y.y.yike 0:ahvpn:ahvpn: using existing connectionike 0:ahvpn:ahvpn: config foundike 0:ahvpn: request is on the queuewith flow debug only this:id=20085 trace_id=2256 func=ipsec_common_output4 line=878 msg="SA is not ready yet, drop"Is there any method that can debug a rekeying process or that can go a little deeper in debug level where the dhgroup mismatch possibly shown?thank you

Hello Team, I would like to know if we can update Forti OS for Specific VDOM?Say for example I have multiple VDOMS configured on my FortiGate firewall. root VDOM, Internet VDOM, UAT VDOM. Can I update only Internet VDOM and no other VDOM, as per my understanding it is not possible. but I am not getting any documents related to this, any reference document would help. 

Using Fortigate 80F v6.4.10.I'm starting with an edict to "block all outgoing ports".  Obviously, that's not going to work and keep reasonable internet service.  If doing this on a port basis, it seems that one would first set up instrumentation (logging) to see what's going on before an approach for parsing into "block/allow" can be done.  I should add that I'm trying to use Policy-based NGFW mode and expect to "block/allow" Applications instead of just ports.I have a syslog server set up and am wondering what to use for search/filter in identifying outgoing application traffic.  What is typically done for this?  I only ask because I've not seen traffic in the log that I might expect.  I guess ports 80 and 443 might be a good starting point perhaps to just identify IP addresses and other pertinent appplication info for building a rule??I believe that one can come at this rather tangentially with the Fortigate by blocking all but known important "in u

Hi, I have this problem related to my Fortimail unit.I have installed the fortimail unit in front of a zimbra mail server in transparent mode, on the same DMZ subnet and obviously behind the fortigate.Incoming connections are coming from port 1 configured for smtp proxy are inbound and enabling local connectionsWhile the server is enabled on port 3 and is in pass trought both incoming and outgoing.On the fortimail unit only one domain "example.com" is configured and the relay type is set as HOST by specifying the IP address of the mail server behind the fortimail unit, making the conection rest on relay host, everything works.I can send mails and receive them without any problems, again from webmail.On the other hand, when I try to connect with a client from an external network such as a mobile device or from an internal network such as a printer that sends scans via mail.I get the error SMTP AUTH Failure.Conversely, if the relay type on the domain is set as MX record and no longer spe

I have a 48 switch. I have made 2 VLAN (Computer and Voice) I have now a new device and put it on VLAN Voice. I will get an correct ipadres and DNS but it has no internet. The other 20 phones are working correct. What is going wrong. If a put the IP Phone on the VLAN Computer it get an correct IP adres and has internet connectivity. So everything in the phone is correct. Why i cannot get internet on the device on VLAN Voice?

I have an Fortigate 60E with on port 7 with a Fortigate 48 ports switch connected trough Fortlink with IP adres 192.168.5.1 - 192.168.5.254. On my FortiSwitch a have a VLAN ID 60 for Wifi with adres 192.168.2.1/255.255.255.0. On port 40 of my switch i have an Fortigate AP (FC24JE). with adres 192.168.2.25 I have an WiFi SSID Sonos with adres 192.168.6.1/255.255.255.0. I can registrate my Iphone on it an get an ip adres 192.168.6.25. But i cannot install my Sonos with the Sonos ap. De app will not find my Sonos system. How can i fix this. With regards Dennis   

Hey guys, I've run into a couple different scenarios where the Fortigate will ignore an eBGP route (distance 20) and instead hold on to a higher distance router (e.g. static, or ospf) which it had learned about previously.  Here is an example. My Fortigate learns about routes to 10.2.137.0/24 via both BGP & OSPF. If it learns the BGP route first, and then the OSPF, it shows both in the router database, but selects the BGP route as it is lower distance: O 10.2.137.0/24 [110/2] via 10.4.3.178, port1, 00:02:31B *> 10.2.137.0/24 [20/0] via 10.4.3.181, Colo, 00:02:44 However, if for some reason the OSPF route is learned first, when the BGP route is learned, it never adds it to the routing database or routing table:O *> 10.2.137.0/24 [110/2] via 10.4.3.178, port1, 00:03:36 #get router info routing-table details 10.2.137.0/24Routing table for VRF=0 Routing entry for 10.2.137.0/24 Known via "ospf", distance 110, metric 2, best Last update 00:04:01 ago

Hi friends! How are you? We are following a tutorial:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Enable-expired-password-LDAP-renewal-with-Active/ta-p/191879 But we found an issue with GCDS. We use Active Directory and Google Cloud Directory, and our LDAP syncs with Google via Google Cloud Directory Sync (GCDS). Using Remote Desktop to the Active Directory server, when we right-click an AD user and select Reset Password and change it, GCDS runs as well and change the user's password on Google Cloud Directory. But we tried using the steps described on that tutorial but Google Cloud Directory seems to not activate when the user changes It's password via FortiClient VPN GUI. FortiClient is able to detect that the password expired and must be changed on next logon, it pop's the new password window, the user applies it, the password changes at Active Directory but GCDS doesn't get activated, so the user will now have 2 passwords, 1 for AD and 1 for Goo

I have a private point to point network over IPSEC VPN.  I'm trying to allow only SMPT sendmail service from a single client on one end to a host on the Internet via the WAN interface.  I've created an outbound FW rule to allow SMTP port 25 to a FQDN (smtp.gmail.com) from the internal client with NAT enabled using the outside WAN interface IP.  I've also created an inbound rule allowing ALL traffic from smtp.gmail.com to that specific client.I can telnet from the CLI to port 25 on the smtp server but I cannot do the same from the client.I've enabled and disabled NAT on the inbound side with same results.I'm pretty new to Fortigate but have experience with other firewall and policy products.

Hi all,    Can i disable ipv6 on interface ? I have some log on the wan(PPPoE) interface. it's show descriptoin "RADVD Local AdvLinkMTU disagrees with remote site" Event message " our AdvlinkMTU on port xx doesn't agree with fe80::1".  i verify configure on the interface it's show - config ipv6 , -set ipv6-send-adv enable, - ip6-other-flage Information [FG1100E, 7.0.3] 

Good morning! Samething very strange. When I make an SSL VPN connection from my smartphone, with SSO enabled, the username changes to pinocchio, but all the logs in the fac and fortigate shows the correct user. I have tried with differents users. I think that is a forticlient issue. The linux forticlient version works ok.forticlient 7.0.6.0049 android app.Thank you!