Solved

 One firewall in my LAN is configured with PIM dense mode and wish to communicate  with another firewall ( same model Fortigate 600D) but configured with multicast forwarding. Can the first node PIM enabled able to transfer and receive multicast traffic with the  second one? and how? If I set the first one in PIM dense passive mode can I resolve the problem?

Hi,I've to configure an IPSec tunnel between a fortigate VM (local) and a FortiWiFi 40F (remote).Remote site have a network configuration alreday used by another IPSec tunnel so i've to add NAT on this tunnel. Tunnel is UP and configurations seems to be OK, but no packet are received on remote site. Some informations :<Local Networks> : 10.9.0.0/16 ; 10.20.0.0/16<Remote Network> : 192.168.1.0/24<Remote Network with NAT> : 192.168.10.0/24 My configuration :on VM :- IPSEC Tunnel :local address : <Local Networks>Remote Address : <Remote Network with NAT>- Static route :set dst 192.168.10.0 255.255.255.0set device "vpn"- Firewall policy :Accept ALL from <Local Networks> to <Remote Network with NAT> on FortiWiFi- IPSEC Tunnel :local address : <Remote Network with NAT>Remote Address : <Local Networks>- Static route :set dst 10.0.0.0 255.0.0.0set device "vpn"- Firewall policy :config firewall policyedit 1set srcintf "in

Which or how many ports out of the box are set to the default 192.168.1.99/24 ?Is it just the mgmt port, or port 1, or every port except for the HA port.

Hi,What I'm simply looking for is to see logs (detailed and meaningful logs) about Fortigate viruses and attacks detected by rules where IPS and AV are enabled in security profile. For now, with logs on memory (via live GUI or console CLI not using any solution like Fortianalyzer).With logging enabled on an Internet-facing firewall, I expect to see a lot of IPS logs pointing to a specific attack. Also, I expect to see files being blocked by AV engine (A simple test including downloading a sample virus file from Internet will suffice) At the time being, I cannot see any logs in GUI except rules logs. Should I configure any additional settings on logs? use 3rd party and remote logging? enable SSL inspection with custom settings for both outgoing and incoming traffic? or ...... Regards, 

Backup FortigateApós vários desafios consegui resolver o tema com backups para fortigate.Utilizei um ambiente de testes, constituído por uma máquina Linux e uma fortigate VM 7.0.5.Em primeira instância configurei um servidor Linux para correr o serviço do sftp, de seguida garantimos a conectividade entre o servidor sftp com a nossa fortigate. Script -execute backup full-config sftp /home/neto/FGTCCNAFORALL.%%date%%-%%time%%.conf 192.168.88.137:22 neto 12Estou a preparar o video e um pdf com as configurações feitas. Não te esqueças de seguir no meu channel: http://www.youtube.com/ndawedua#ccnaforall    

Hi all, we have a new FortiGate 600E with the Firmware v7.0.6. We configured the "Resolve Hostnames" setting in the Log settings.Now we saw that only the destination ips are getting resolved. Is there any option that we see the hostnames of the source addresses?We have the internal DNS server configured. any ideas?thanks a lot in forward!    

I have established an S2S VPN tunnel from my FortiGate-100F to AWS VPCI can ping from the EC2 to a local device but however, I cannot ping from a local device to my AWS EC2I have already set up a static route and even tried the policy route but still no luck...below is the config I have setMuch appreciate any helpThanks in advance!

Buen dia, tengo un FortiGate 60, quisiera saber si hay alguna version mas reciente, ya que la que tengo es muy vieja. FGT-602906537315 # obtener el estado del sistema Versión: Fortigate-60 3.00,build0754,101027 Virus-DB: 8.00631(2008-01-15 14:27) IPS-DB: 2.00461(2008-01-18 11:23) Número de serie : FGT-602906537315 Versión de BIOS: 04000000 Nombre de host: FGT-602906537315 Punto de bifurcación: 754 MR/Información de parche: MR7 Parche 10 Revise el Upgrade Path Tool Table, pero no arroja el modelo de mi Fortigate,Saludos.

Hello everyone,       I am new into working with firewalls. I took some online classes and learned to do small activities, like filtering trafic from web. But now I face a problem: I need to set-up a DMZ (on a Fortigate E-50) with a particular action - Remote Desktop Gateway.I mention from start that I know how to configure the PCs already, for RD gateway as well. However I am facing issue with the traffic between networks. The setup cannot be changed to a simpler version, you can see the layout attached to this topic.  Host PC: 50.2.2.40/16 Gateway: 50.2.2.100  DMZ PC: 50.4.1.1/24 Gateway: 50.4.1.100  Client PC: 10.10.30.1/24 Gateway 10.10.30.100   Firewall P1: 50.2.2.100/16 Internal Network - configured as Interface/hardware switch  Firewall P2: 50.4.2.100/24 DMZ Network - configured as Interface/hardware switch  Firewall P3: 10.10.30.100/24 External Network - configured as Interface/hardware switch   I am con

Hello,is there a chance to add a Host-Check for Win-Server to block them for VPN Connection? Many thanksTBC

Specific IP not getting internet through the Fortigate 200F firewall but communicating with a local gateway. We have checked the forward traffic logs and found there is send bytes but no received bytes for those IP. We have no bindings or no security profiles in the security policy but still, we are facing this issue. Mention those IPs in using printing service, when changing IP address then getting everything is okay. Those IPs are 10.10.32.94, 10.10.32.52, 10.10.33.34

I thought SSL VPN sessions were synced so I could do the swap stealthy to recover the "Error"ed tokens after a swap over when the cluster was upgraded last night to 6.4.9. I was wrong and all SSL VPN customers are complaining about the drops. All active SSL VPNs seemed to have dropped.Would you expect this, while all IPSec VPNs (I meant site-to-site. We don't have dialup IPsec VPNs) are kept up? Toshi

There are data in several places and several stages. During installation FortiSIEM settings. In Admin>Ssettings, Admin>Device Support, Admin>Setub and CMDB there are changes made. Also, hosts are added to the "hosts" file. How do whole backup FortiSIEM so that I can restore it later?For a minimum, I tried to backup the configuration of the device.I tried to back up the network device configuration and installed software versions from /data/svn. I did not find svn in /the data folder. Also, the database files are stored in"/data/cmdb/data". I did not find the folder in this place. I copied them from another place.I tried to archive the events from the web Admin>Settings>Database, but I did not know which organization should search for.Is there a built-in tool to backup FortiSIEM or do I have to use a backup system like Dell AVAMAR?

Hi, So I configured a managed Fortigate via Fortimanager, what I did was  1. add an address object2. added this address object to a dynamic group For some reason it has been a day and I still don't see the new address object on the managed Fortigate. I do see under Configurations and Installations Config Status: Auto Update checked Not sure how to troubleshoot this Thanks in advanceJeff

Hi all, got one question about downgrade and recovery after failed update in HA cluster (A-P).When update failed and need to downgrade and upload configuration once again the best way for this is to:1. disconnect slave from HA,2. downgrade firmware and config to master3. reconnect HA4. wait for slave to sync? But what when both units failed with updates and need to downgrade also Slave? Only difference is that need also to downgrade slave?In this scenario should I also upload config on slave or only on master and after connecting to HA wait for sync? When making configuration backup notice only got config from Master, is there any scenario I should have config file from Slave?

Hi all, I like to know is there possibility to keep VPN IPSec tunnels up when linked to backup interface (WAN2) and backup ISP.I got FGT60E with WAN1 (1 ISP) and WAN2 (2 ISP - backup), to WAN1 got connected IPSec Tunnel to another FGT, and on WAN2 got connected different IPSec tunnel (needed as backup) to different location.In Static Routes WAN1 has lower distance (8) than WAN2(10) tunnels linked to WAN2 are down, is there possibility to make them always up? Of course WAN2 interface is up.I got enabled Auto-negotiate and Autokey Keep Alive.When WAN1 go down and WAN2 starting to pass traffic tunnels get up and send data with no problem. 

Hi all, FortiManager: v7.2.0 b1124 220411 (GA)Fortifgate 200F (2 devices, HA Cluster Configured) - FortiOS v6.4.8 build1914 (GA) Two Fortigate devices are configured, up and running, A-P HA mode, 2 VDOM. If I add cluster devices to FortiManager using Add Model HA Cluster, devices are visible but almost all configured information are N/A Host Name FG200F*****Serial Number FG200F*****IP Address 10.73.0.1System Time - Fri Jun 17 02:01:41 2022 PDTUptime - N/AFirmware Version - FortiGate 6.4,build1950Hardware Status - N/AOperation Mode -NATVDOM - VDOM Disabled If I try to import configuration it only import default policy section. Device Interface no entry found. Additional information:    If I try to add device using Discover Device, all information are available and update. Import configuration is fine. Any additional information with adding HA devices to FortiManager and import their configuration?  Thanks.  &nbsp

Hi all, FortiClient EMS connection status display "Unknown Errors" when I try to connect.   And, FortiClient EMS uses built-in certificate. When I try to authorize the certificate: How can I solve this?  Thank you

Dear Community, I'm nearly new to Fortinet and a bit confused.In the FortiCloud Asset Management Dashboard, I can see, that we've got 4 products - Fortigates espacially - but only 3 of them are listed in Software Lifecycle.I don't get why.As an explanation I have to mention that we have 2 devices for testpurposes only and 2 productive devices in an Active-Passive High Availabilty Cluster.The product that isn't listed in Software Lifecylce is one of the HA Cluster devices.I tried to register it with it's serial number, but it says that it is already registered.It appears in Support & Subscriptions and also in Hardware Lifecycle.What could be the reasons why this device isn't listed in Software Lifecycle.Any Ideas would be appreciated.

I would like to post a solution to the community that would of otherwise caused even further downtime. Hope this will help someone else out there. So in this particular site there is a Forigate 100F without redundancy. The HW ID is c1aj43-04aa-0000 One day out of the blue it just failed, with the error message like thisNP6XLITE: Error: xaui.usxs[0].usxs_port_sts 00000000.NP6XLITE: Error: xaui.usxs[4].usxs_port_sts 00000000.api return err code -3 opcode 5 BCM_VLAN_CREATE_SCC len 56 request 0 reply 1api return err code -3 opcode 7 BCM_VLAN_PORT_ADD len 56 request 0 reply 2api return err code -3 opcode 15 BCM_VLAN_CROSS_CONNECT_ADD len 56 request 0 rep ly 3bcm sdk 140 exit.bcm_sdk 140 is down with code 1.Kernel panic - not syncing: BUG! " The RMA unit came, with the hardware ID c1aj43-20aa-0000The system came with firmware 6.4.9 which is not something that we use nor a perfect match with our configuration file. So I was told to downgrade the firmware via format and tftp upl

I have the following configuration   10.20.x.x/16    [Cisco ASA]   <--> [FGT]     FGT-INT2 [192.168.5.1/24]   -> Downstream subnet10.20.0.0/16 I need for staff on the Cisco Side 10.20/16 network to access a server on the FGt side 10.20/16 remote subnet. The VPN is Policy based. Ideally I would like to front the server on the right side with a unique IP address (maybe VIP) - but not sure if VIP will work on the FGT side with a Policy based VPN  Ideally  10.20/16 ---> 192.168.5.5 [VIP] -- 10.20.16.1/32  I have configured, the logs show the traffic coming in and sending it to VIP but no traffic is sent to the remote network from the VIP  I am not sure a VIP will work in this scenario tbh. Any guidance would be appreciated.

Hi, I need to replace the old firewall with a new one (let's assume from a 200F (v 6.4.7) to a 400E (v7.0.5) ) and AFAIK, the backup can only be restored from devices with the same model and FortiOS. In my example, is there anyway to copy the config and correct the missing/conflicting parts?It will be outstanding if I can even clone the same rules and policies on the new firewall and do the rest of config manually (lots of objects and policies are present on the old one) Regards,

Hi,I am looking for a firewall  for 1500users, and 500  VDI access,500 camera recording  at 7 mbps , expecting approximately 1 gb  internet traffic Mostly collaboration application like teams  Please help to size,Ho much throughput I should I look for Thanks

I've been scratching my head on this for a few hours.  I've been playing with my ForitAP 223E and changed some settings to allow split tunneling.  After enabling the split tunneling on the AP my SSID's stopped broadcasting all together.  So, I disabled and tried restoring to the basic settings and the AP will no longer broadcast anything, at all.  I even tried, deleting the profile and creating a new one.  I've double checked and triple checked to ensure the SSID's broadcast button is enabled, the region is correct, the AP is authorized, and even shows connected in the dashboard... but no SSID's will broadcast and the AP shows offline.  I've even rebooted the Fortigate and did a factory reset on the FortiAP.  Am I missing something?  Do you think the antennas are defective?

Hi,Simply this is I need to do: I like to filter and decide about connections to a destination based on the port, protocol and the application if possible. Two things in my wish list which I elaborate by an example: 1- I need to disable RDP on any port not just 3389 which is the default.2- I wish to limit SSH connections to a server just to those who are established via Putty.exe file Any help would be appreciated. Regards,