Solved

Hello TogetherI am running a FortiWEB and Fortigate.Can it be a problem if I run the FortiWEB in the HA cluster and the Fortigate in the HA cluster with the same default group number?The FortiWEB is a VM.

Hi All,Forticlient EMS server detect Security Vulnerability CVE-2018-1285 for log4net on client's PC .How can i mitigate and solve this issue . Best regards

Hi,I have to Source NAT two  voip phones connected by a LAN (A_LAN) with a Fortinet 600D firewall port to speak with a Call Manager and viceversa. I have create a VIP definition and a policy for it. After NAT process the packets sent by phones will address some GRE tunnels. I would like to know if the syntax is ok or in the VIP definition I have to add "set nat-source-vip enable" in the VIP definition or further policies in the firewall policy or use IP pools ---------------VIP definition---------------    edit "A_VOIP_PHONE_1"        set uuid 329a7a02-a3db-51ea-a515-68fab7d1ce5f        set extip 10.1.180.171        set mappedip "10.18.1.171"        set extintf "any"    next    edit "A_VOIP_PHONE_2"        set uuid 329ad952-a3db-51ea-dea5-7de08db5ef41 &nb

In fortigate firewall, commands are pushed down automatically. (at least in GUI) Q1 Is there a way to "undo" changes you have done?Q2 Is there a way to see "changes" and then choose to "commit" them like cisco and palo alto? With regards to syncing HA,Q3 How do I check using cli why 2 members cannot sync?Q4 what are the command lines to break down as well as to force 2 members to sync?

Hello, I am configuring the SSL VPN on a FortiGate 100D running firmware 6.0.5. I have setup RADIUS auth because we are using Duo MFA. When I use the "Test User Credentials" option it's successful. Although, when I try to connect to the VPN, it fails. The logs on the FortiGate say "ssl-login-fail Reason: sslvpn_login_unknown_user". Up until recently, users were using local accounts on the firewall to connect to the VPN. I'm suspecting the FortiGate thinks my user is a local user and isn't finding it. The VPN setup has my new group using RADIUS listed and mapped to a portal, so I'm not sure what I'm doing wrong. Any suggestions?

Technical Tip: Fragment IP packet before IPsec enc... - Fortinet Community It seems the NP6 does not support pre-encapsulation and we need to turn off the NP by disable the auto-asic-offload in firewall policy. May I know if NP7 support pre-encapsulation or not?

On my FG100G I have created a local-in-policy with the command:config firewall local-in-policyedit 1Then I have entered just 'set' and hit enter to see a list of all commands but it did not show any command list.I entered 'show' and it shows the uuid.I configured the local-in-policy and when I enter show it shows the policy settings and the uuid.Do I have to remove the uuid or is this something I don't have to worry about? May thanks in advance  

Hi guys, i've a strange problem: when i'm connected through forticlient and try to login to my fortigate via the mgmt  address, i'm promped with an "authentication failure" error although the credentials are correct.When trying to access the same ip via the site2site tunnel it works, and even if i try to connect directly through the pubblic ip of the Fw i can access, the problem is only via the Forticlient (user and password i'm sure are correct).Do you have any tips or do you know is this happening?it only only happens with fortigate devices... Thanks in advance

Hi, guys,   Just would like to know, this snmp "HA Cluster Member 1 - Network Bandwidth Usage" or "HA Cluster Member 2 - Network Bandwidth Usage" for which part of the Fortigate HA cluster; as the attached ? 1. It should not be device interface traffic utilization2. It should not be device HA heartbeat interface traffic utilization So what does it mean "HA Cluster Member 1 - Network Bandwidth Usage" or "HA Cluster Member 2 - Network Bandwidth Usage" ? Thanks a lot 

I am moving the DHCP from the windows server to the Fortigate, and the existing DHCP exclusions are more that three subnets like 6 In the GUI configuration i can add only three exclusions, can i add more using the command like when i configure the DHCP or still limited to three ? Thanks

Good afternoon. I'm in need of ordering more tokens for our internal Fortiauthenticator environment and I was looking to order Mobile tokens since they are perpetual. I'm trying to determine, if I purchase and import mobile tokens into my internal fortiauthenticator environment, if I ever choose to move to "FortiCloud", will those mobile tokens be able to transfer to that? Also, is the FortiCloud option usable for the internal FAC agents I have installed on all my servers, workstations and network equipment? The reason I ask is because of remote workers. Right now, my remote workers are exempt users on their devices because offline tokens aren't suitable for long-term at home users. I could certainly expose my Fortiauthenticator to the internet, just not sure if I want to do that. Would I be able to specify and internal fortiauthenticator device and the cloud url to my clients so they could use either one depending on where their token is stored? Or is this solution just not that

is there any use case wherein I can integrate 2FA with ZTNA?Current setup we are using SSL VPN to access our internal resources such as RDP. SSL VPN users tied up to FToken.Now we want to explore how the ZTNA works. Cant figure out how to maintain 2FA without SSL VPN and through ZTNA my staff could access our internal resources.

Hello Guys,I deployed two SSID in  WPA2 Enterprise architecture with authentication on Windows Radius ( NPS ) as the link below and everything works ( https://docs.fortinet.com/document/fortiap/6.4.0/fortiwifi-and-fortiap-cookbook/414919/wifi-with-wsso-using-windows-nps-and-user-groups )To differentiate groups on Windows AD I followed this guide ( https://docs.fortinet.com/document/fortigate/7.2.0/administration-guide/710485/restricting-radius-user-groups-to-match-selective-users-on-the-radius-server )The FW sees the connected users as Wifi Single-Sign On  is it possible to group some account in different firewall policies ?I have tried creating Radius type users on the FGT but it does not work.Do you know if there is a way?  Thank you very much 

Hi together,is there any possibility (for example a parameter) to open FortiClient with another part of the user interface?At the moment it always open the "Zero Trust Telemetry", but for our employees I'd like to have the "Remote Access" active when opening FortiClient.

Hi, I need a simple way or at least the easiest way :) to find the details of configuration changes. Just knowing John changed this rule is not enough. I need details: John added this object to source, removed that destination, changed the protocol and so on. Any help would be appreciated. BTW, desired is to see this on memory and system events log not on syslog messages forwarded to a log server. Regards,

Hi All, i know enabling assymetric routing is a bad (bad) thing  :) but we are using an "old" fortinet to migrate between two firewalls. The only job it has to do is routing packet using policy routing to avoid assymmetric routing on the others two firewalls. Then we enabled assymmetric routing, but it applies only on TCP packets, not UDP. This his a problem with telephony.https://community.fortinet.com/t5/FortiGate/Technical-Note-How-the-FortiGate-behaves-when-asymmetric-routing/ta-p/198575 On this link they say we have to do a policy for UDP, but not which one. We are unable to find how to do. Any help is appreciated Thnaks a lot

Good afternoon everyone, I have a general question about FortiGate firewalls. Is there any latency difference on them in L3 and L2 modes? 

The remote office has Pfsence which is behind the router and has no public ip(wan interface) it's on local subnet of the router, FortiGate is direct with wan interface stati so how we can have IPSec in this scenario  kindly explain 

Hi all, The FG 1000D is a 32 or 64 bits architecture? Where I can find the information about processor and or FortiOS operational system if is a 64 bits? Thanks

Hey,Thanks!

Hello,I am trying to set up Azure AD as remote authentication facility for Fortigate SSL VPN, im using fortigate v7.2.1 . As I try to configure SSO, I have to select the Azure certificate at "Identity Provider Details". I added the certificate as remote certificate through "System -> Certificates" before, however, it does not show up in the drop down menu.  any explain how to show it up ?thanks @fortigate @Anonymous  

Hello, just trying to understand the benefit of Graceful Restart when you already have BGP Holdtime.For example with BGP Holdtime (default 180 seconds) a BGP peer will not drop the connection until 180 seconds without an update from the other side.Then we have Graceful restart which enables a peer to advise the other peer that it will be down for 120 seconds (default) while it upgrades or fails over.I want to understand what the point of 'graceful restart' is, if the Holdtime will not drop the connection for a longer period anyway ?

HelloI am new to Fortinet and currently stuck on something very simple and would need some help.I am simply trying to enable port forwarding from the WAN interface to the LAN interface so that if a request comes in on a WAN interface on a particular port the request gets forwarded to the local device on the LAN. Have setup as below:The problem is when I try to access on the wan IP (192.168.70.34), I am not able to access the RDP server. Not sure what I am missing here but glad if someone can help on this.I have checked the guide on the below link but sthttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Virtual-IP-VIP-port-forwarding-configuration/ta-p/198143 Thanks 

I have edit a configuration file for my fortinet 600D. He load and running correctly but when I visualize the firewall policy on the dashboard only few security policies has been updated . If i try to include manually the system said that the label of policy already exist. If i download the backup of configuration the number of policy are different from the policies visualized on the dashboard . This issue i have only for firewall policy all the other section are corrected interpretated.Any idea? any command to know if the input file has issues? I tried also with different editor but nothing  

Hi, i am currently looking into changing my Layer 3 Core switch and implement Layer 3 routing between vlans on the fortigate. The question is , can the fortigate support and handle the inter vlan routing in addition to internet traffic?we are trying to do accomplish network segmentation to provide extra security measures in our environment . It is much easier to implement policies on the Fortigate rather than ACLs on a layer 3 core switch Can the fortigate handle this ?  Thanks