Solved

Hi all, On a vessel I'm working on, I've got two internet connections connected to WAN1 and WAN2. I'd like to have two VPN connections, using one of the WAN connetions each. WAN1 (Production VPN, Internet access)Fixed IP: 10.241.105.192 / 255.255.255.240Gateway: 10.241.105.193 WAN2 (Development VPN)DHCP: 94.234.190.55 / 255.255.255.240Gateway: 94.234.190.49 Production VPN: Site-to-Site VPN with vessel behind NATDevelopment VPN: Remote Access using FortiClient I have configured Static Route as this:Production VPN and general internet access for from WAN1 works as expected - But how should I get the Development VPN working on WAN2? The Incoming Interface for the Development VPN is set to WAN2. I understand I need a Gateway assiociated with WAN2, so I tried to add this as a Policy Route as below, but without success.I'm not sure if I'm doing the above correct?Is there anything else I need to configure to achive functionality of Development VPN over WAN2?&nbsp

Hi - hoping someone can help me with this seemingly simple problem. Coming from the Cisco world we are replacing two of our routers with two FortiGate firewalls in HA active-passive mode.  My knowledge of the FortiGate configuration is limited (but growing). I'm currently trying a basic configuration with 1 PC connected to 1 switch which is connected to one FortiGate with two connections. Currently only one of the two networks on the Fortigate is reachable (192.168.10.1).I've setup an identical configuration but instead using our cisco router and as you can see in the routing table it is logging the 192.168.116.0 route reachable via the two routes. The Fortigate is only showing this route via port2 even though it is also technically reach able via port1. I'm assuming this is the reason I can only reach the network from the port2 link and not the port1 ip of 192.168.20.1.  If this is the reason how can I populate the route to 192.168.116.0 via either port1 or port 2

Hi all, I've followed a guideline of Sophos to configure IPSec between Fortigate and Sophos, everything working well: the VPN is up, the user from Sophos site can ping the IP of Fortigate site, but the user of Fortigate site can not ping IP of Sophos site. the longest way I can do is to tracert to the local IP of Sophos site and reached the default gateway and done, nothing else. I've tried many ways: disable Windows firewall, checking the Sophos policies...and deep dive into google and I recognize there are some people who got the same problem with me and they can fix it in some way but no one posted the solution => I have no clue. can please help me where I was wrong? Thanks a lot.    

Hi all,I have searched for this in the forum and internet without much success so just wanted to clarify that i AM doing this the right way.I've got a WAN connection (say 1.1.1.1) and i've got an internal IP of a device on 192.168.70.50. I have added a secondary IP to that WAN interface of 1.1.1.2 and i want to route the 192.168.70.50 out of that ip (1.1.1.2) so i've added a policy route with the incoming interface as the Data Internal interface (which is what the 192.168.70.50 is connected to) and a source address of 192.168.70.50/255.255.255.255, then a destination address of 0.0.0.0/0.0.0.0 and in the outgoing interface i've selected the WAN interface and then set the gateway address as 1.1.1.2 ?I've ran packet trace and i can see packets coming INTO 1.1.1.2 to 192.168.70.50 but nothing going out.Have i configured this correctly or am i missing anything ?I'm not that familiar with Fortigate products (model is a 60E on V7 software by the way)Thanks all

Hello guys,I have very strong problem with this permormance AP .In several release i have the same issue; they reload every 2 or 3 days, in particular the AP with most connection. We have in my office 23 431F and 3 223E. The second no problem..the version is : FortiAP-431F v6.4,build0185,210903 (GA)I have the KERNEL LOG HELP ME PLEASE

   Hi, there are user's unused active connection in the SSL VPN service. (Please see image atteched) We have active the option : "Limit Users to One SSL-VPN Connection at a Time" but still unsed active connection. We have 3er party and official forticlients. Any ideas where is the problem? Thanks

Hi all, Will wild card certificate works for admin login GUI ?. Please note here im not generating any CSR and will import a wildcard cert provided by customer into fortigate local certificate and then in Settings>> Administrator settings. PFA image Pls advise

Hi all,I have a number of overly permissive rules using any services. What would be the most effecient way of extracting a report in FAZ, so I can see what services are actually hitting the rule, and design a policy around that?Thanks.  

I realized that there is a custom 1 and custom 2 setting inside my DNS and Antivrus web filter.Where can I find more info about this and can I edit the settings?  

Hello Will shutting down of the Primary-FG via GUI be a graceful shutdown and immediately issue a failover to the Secondary-FG of the HA pair? This is an FG-101F and I plan to do a: system > shutdown Reason is, I need to have only the Secondary-FG up and running as the true primary for troubleshooting purposes. Pretty new to this vendor and I want to ensure that it does fail over this way. Thank you.

Hi all,  Is it possible to achieve website control in Policy based Routing using internet service . . Below im attaching image of PBR configuration page My fortigate device version 7.0.2 Pls advise

Or where can I get the logs output?

I searched online but couldn't find exactly how to do this.We want to upload a logo image file to replace in the disclaimer page. But want to do it from TFTP or SFTP via CLI. Does anybody have the command and destination folder in the FGT's filesystem? Thanks, Toshi

{Forti OS 7.0.2}One Way Audio, Scratchy Voice and missing voice issues.Recently provisioned a new 3CX server and installed a new 60F Fortinet onsite for a customer. I setup all the usual forwarding rules and it PASSED the 3CX Firewall checker. At this point the customer was experiencing quite a lot of one-way audio and scratchy voice calls. Almost every forum says only disable SIP ALG but it didn’t help, after a week of digging and consulting with other SME’s I found a solution that worked. I applied it to 3 sites, and all are now operational. Creating a VIP - Go to Policy & Objects > Virtual IPs > Create NewFill out the information accordingly for each port required (note you can specify interface) Once you’re done add all the created VIP’s to a Group - Create a ServiceGo to Policy & Objects > Services and create a new Service and Specify your 3CX ServerCreate a VoIP priority shaper Go to Policy & Objects > Traffic Shapers and create new.Set Type

Hi All, I hope you are having a great day. Upgraded to FortiOS 7.2 and noticed there are 2 SFP ( grayed out ) under Network > Interfaces while there are no physical SFP ports. Also, I have missing "Firmware" menu under "System". Now I cannot downgrade to the previous firmware. I am new to Fortigate device. Any help/suggestions would be greatly appreciated. Thanks in advance.

Hello @All,I looking for a solution to redirect a URL like this one:User input: https://www.site.net:8080to; https://www.site.net:8080/info/faq.html I have look to this example:In my case, regular Expression is https://www.site.net:8080 and the replacement is https://www.site.net:8080/info/faq.html.If I try https://www.site.net:8080 I only get 404 not foundOn Policy / Web protection Profile, I have added the URL Rewriting. If I type that URL https://www.site.net:8080/info/faq.html everything is working. What I'm doing wrong?Many thanks for helping!TBC

Hello all,how can i access from outside over fortiweb to an internal web server without input of Login Details? We have an internal ADFS Server for Changing Passwords for the User.The User needs access to this internal Server from outside without any Logins. Is that possible? Many thanksTBC

Recently the FortiGate received attack from 114.34.160.41 and IPS successfully blocked the attack, but then caused a false alarm on SIEM. As the FortiGate sent a “Allowed – session reset” log message to SIEM, the SIEM triggered a high-alert message, which the keyword “allowed” made a confuse of the Firewall bypassed the attack. Any suggestion to prevent that? Thanks.  

Hi,it is possible on Fortigate 100F to have one vlan configured on multiple ports?Let's say I have vlan5 192.168.5.0, it is possible to attach it on port1 and port2 so then I will have on these ports the same shared vlan5 subnet ? thanks

I'm reading the FortiOS Handbook on page 1120 it says To import a separate server certificate and privat key files - GUI ......Go To System > Certificates and select ImportBut, there is no "Certificates" under System?????? 

Hi ¡¡¡ I have 2 doubts:  1) I have published WEB servers, which are in my DMZ. I have adjusted thresholds and protected them against TCP attacks since they only allow HTTPS traffic. I suppose there is no point in protecting them from other types of attacks DoS (UDP, ICMP etc). On the other hand, my firewall connects to an ISP and receives the public IP on one of its interfaces directly (witouth NAT). Is not the public IP (VIP) to connect to the web servers but is the same internet connection. This interface doesn't have any administrative acces enable (ICMP, HTTP etc are disable). I was wondering if I should protect the interface itself from DoS attacks, but I understand that it is not necessary since I do not have any services enabled. If there is no service enabled, they cannot do a DoS. However, I have monitored the IP of the interface with very low thresholds and if found anomaly alerts come out and I don't understand why it detects them when ports or services that a

Hello,  I have a 100D and I would like to clean installI boot it and got in the configuration menu so now I cannot upload through TFTP Is there a solution? Regards, Konstantinos

Hello,newbie using Fortigate.I created an automation sticth to upload a config backup to an SFTP server. I used the following CLI command execute backup config sftp /path/firewall_backup.cfg SFTP_IP SFTP_user SFTP-password If i run the above "CLI" command manually, file is created using the name I specify (in the example, firewall_backup.cfg) if I run the same command via an automation stitch, filename is prefixed with the fortigate serial number (i.e. it becomes FG123456789_firewall_backup.cfg) Of course such prefix doesn't disturb me, but I would like to understand WHY this prefix... Checked on documentation but since I'm a newbie on fortigate was unable to find the right point.Can someone help me understanding this  behaviour?Thanks in advance

Hi,Trying to evaluate Fortianalyzer, I created a Forticloud account, logged in and downloaded the VM image but as my lab is not able to access Internet, I cannot connect the VM in lab to get the free trial license directly from forticloud. Is there anyway I can download a free trial license file using my account and upload it to my lab VM?Regards, 

FortiNAC is not providing DHCP service for Isolated network via eth1 service interface. How can i resolve this issue?