Solved

Hello - is it possible to GUI into the secondary of an HA cluster even though there are no MGMT interfaces configured - only WAN. I know I can log into the HA2 via CLI, but it does not appear I can GUI into HA2. I assume if I had an MGMT interface configured I would be able too? Thank you.

Hi,I´m having a problem with the new signature "name_server: DNS.PTR.Records.Scan". The signature is generating a lot of logs entries, and any of them is an real attack.I´m trying to disable it from my Sensor, but even though I disable this signature, disable the logs from it (Over CLI), but the FortiGate ignores the settings, and continues showing a lot of the logs.Someone can help-me please. 

Q1 What is the difference between fortigate and fortinet ? Q2 For this diagram, is it possible not to configure any ip addresseson the first interface and any configure on the sub interfaces? Q3 Is it possible to form an etherchanneland configure ip address only on the sub interfaces? Q4 What commands can I type to troubleshoot site to site vpn not working with other vendor?

I currently have a Watchguard firewall.I see that My Computer is trying to reach out to the firewall on port 8013I am frunning the Forticlient V 6.0.4.0182 to VPN into a handful of my customers.One customer requires we keep it running constantly to connect to their network.As such I see the client reaching out to the gateway on port 8013, which gets denied by my firewall. Why is the client trying to do this?

Good day everyone, I will appreciate all feedback on understanding what is the main difference between npu Vdom link & only Vdom link.They appear to be two seperate things. i read about acceleration but didn't quite grasp it.  So when should one use npu vdom & normal vdom link?only creating the vdom link from interfaces, can it be used or does it have issues.  

Commands like 'fmpolicy print-adom-object', 'fmpolicy print-adom-package', 'fmpolicy print-device-database', 'fmpolicy print-device-object', 'fmpolicy print-prov-templates' have an option to redirect their output to 'Output file name', by default, '/tmp/pl'.However, I'm not able to find documentation on how to retrieve or use this file. Anyone?

Please help me to get youtube URL report. Which i am getting attached image. Kindly help

Hello, I am a beginner with Fortigate and i am trying to connect an H.323 video conference system in my office in order to make conferences with remote locations but since i will connect the system behind NAT, i have to forward several ports to the video conference IP address. After looking at the forums, etc. i understood how to forward a single port to an IP, using VIP but i cannot understand how to forward multiple ports or ports range to a single IP.  Can someone help me please? thank you very much in advance!

Looks like FAC's FTM activation email subject line format seems to be below:   "FortiToken Mobile FTKMxxxxxxxx Activation on <FAC's Interface IP?>" Which is different from FortiGate's activation email:   "FortiToken Mobile Activation on FortiGate" In our case, the interface IP in the subject line is from port2, which we're using for our internal admin access and remote auth server connections, while all client(FortiGate) accesses come through port1 over the internet. Why does it pick the port2 IP? And more importantly, we don't want to show any IP in the subject line. Can it be replaced with like ".... on FortiAuthenticator"? Our FAC runs 6.3.3. Thanks,  Toshi  

Hello everyone,I just wanted to make sure if this is going to work: Our customer has two WAN subnets which are connected to one interface on the FortiGate. Therefore I need two default routes, one to each gateway. The secondary subnet is configured as secondary IP at the wan1 interface. Does the FortiGate know automatically which gateway it should choose? (See the attached images)Unfortunately I cannot test this yet since it's not installed at the customer's site... Thank you in advance! 

Hi there, we run through the handbook for FortiOS 6.0 to enable explicit proxy with kerberos authenticationHandbook | FortiGate / FortiOS 6.0.0 | Fortinet Documentation LibraryWe have done anything correctly, we think. Proxy address matches the address we used for spn/keytab. kerb auth is correctly requested and send back Response is with negotiate YII.... so its kerberos, fine But we get this when we add, for example the domain users group to a ruleAnd in user events we can see this Which is kind of not expected, but we cant figure out why this happens.  To our ldap/kdc/domain controller Server we have opened the ports 636 TCP and 88 TCP/UDP, we use LDAPS for LDAP connection which seems to work (able to browse ldap directory and connection test is successful)SPN on Kerberos User is set to HTTP/<hostname we use for proxy access> through ktpassWe are able to browse ldap directory For the LDAP configuration we use another user than the kerber

hi all When processing a packet - which will have priority over the routing of that packet ? 1)      Existing session2)      Sd-wan rules3)      Policy routing4)      Static routing ====================== It also seems that if a session already exists, fortigate will always use back the existing session’s ingress interface to egress the return packet without checking the routing configuration e.g. t1) packet ingress to firewall at wan1 and exit lan1-- new session createdt2) return packet ingress at lan1-- existing session foundt3) firewall will always egress at wan1 without checking any routing Is this expected ? Thank you

Hi everyone !  I need your help. I'm a bit confuse how to correctly configure FortiAuthenticator to validate SSL VPN Connections with machine (computers) SSL Certifacte.  I tried a lot of options but nothing work, so I'm sure someone can help me :) The workflow is this one : - Computer is AD join with a valid CA certificate, for example : pc1.mydomain.local- ForitAuth is correctly configured and I can sync my computer.- I configured RADIUS with "Windows AD computer authentication" Now, what are the correct options to tell FortiGate to user computer certificate to validate the connection (if it's possible) ?Thanks

Hi, I have a working SSLVPN solution where I use client validation to check for a computer certificate from our internal PKI on the client. Domain computers get a certificate using autoenrollment policies and the root certificate is stored on the Fortigate. By enabling users to select the computer certificate in FortiClient during login, they can select the right certificate, which can be validated by Fortigate. So far so good... The problem is, any certificate/key pair on the client, with a matching root on the Fortigate passes certificate validation. Since we use Lets Encrypt certificates, I uploaded the root of LE onto the Fortigate. If I install any valid LE certificate on the client, this certificate is also accepted. Fortigate accepts any valid certificate for which it has a root certificate installed. Is there a way to limit validation to specific root certificate(s)? Or perhaps check on specific certificate details?  Using only Fortigate, no other

Hello, A client from us is having problems with connecting via FortiClient to a FortiGate firewall.Unfortunately, Fortinet wouldn't support me on the phone so hopefully you guys can help out. I have an installation of FortiClient on an iMac and when I try to connect with the FortiGate, it will not connect.When trying this from a Windows machine with the same credentials, there is no problem. Can you guys help out with this? Thanks in advance.

Hello, My question is very simple. Is it pssible to change SSL VPN Web login page portal ? As I can see it fits the FortiGate Langugate but how can I customize it without changing the FortiGate Language ? For exemple, my fortigate is in english and I need to have this page translated to another language : Thanks 

Hi!My SSL VPN always disconnects after 6 minutes.What could be the cause?Please help.

Vul of CVE-2022-0778 found at 2022-03-15 (https://www.openssl.org/news/secadv/20220315.txt), The openssl version is affects :1.0.2, 1.1.1 and 3.0 It was addressed in the releases of 1.1.1n and 3.0.2 on the 15th March 2022. OpenSSL 1.0.2 users should upgrade to 1.0.2zd (premium support customers only)OpenSSL 1.1.1 users should upgrade to 1.1.1nOpenSSL 3.0 users should upgrade to 3.0.2 Does Forti Product is affected by this Vul ?

Hi,On Fortigate FortiOS 6.4, this is I'd like to do: Limit an admin login to a single session, so if another login happened with the same admin user from another system (another PC), the current session goes off. Is that possible? Regards, 

Hello everyone, I'm new on this forum and a rookie in networking/Fortinet :) I have a question regarding my topology with Fortilink :  I have multiple VLANs across the switches and the Fortigate is managing all the switches.At this moment, all the internal traffic is going through the Fortigate and I'd like to change that.I have seen that with the "Advanced license", I could set up the SW1 as L3.My questions are :- If I put the SW1 in standalone mode to perform as L3, can I still have all the other switches managed by the Fortigate as it is right now?- If yes, all the internal traffic would be performed by the SW1 even if the other switches are managed by the Fortigate? I'm all ears if there is/are other solutions. About the config/firmware : All the links are in auto-mode / FG and FSW firmware is 7.0.1 (GA). Thanks in advance, GiGi. 

Hi Community,I have two HA Clusters that I need to connect.DC1 has 2x FG200E running active-acativeDC2 has 2x FG201F running active-passiveHow would you connect those two HA clusters? I want to be able to lose one of the Forigates on each side.Would you put a switch in between and connect to the switch using an aggregate?Or would you directly connect the Fortigates?I want to create a /30 transfer network to route traffic between the two DCs.Thanks for your suggestions. :)

Hi!I'm trying to setup an ssl vpn using LDAP on a Fortigate 40F, but using the server name fails.If I try to ping server ip from CLI it works, the server name fails.In Network / DNS the correct DNS is entered and can also ping external addresses like google.com.What other tests or configs do I need to do?Iv've been following the tutorials on https://docs.fortinet.com/document/fortigate/7.0.5/administration-guide/115783/ssl-vpn-with-ldap-user-authenticationThanks in advanced!

Hi, Please any help i want to know if the FortiSwitch 124E can work with an cisco SFP 1000BaseSX SFP.version 6.2.3 I changed an switch cisco 2960 by a new a FortiSwitch 124E standalone cabling to a switch core cisco 3750 but it didn't work, i don't know exactly the problem any suggestion please !thanks in advance.

Hi ! I have a strange behaviour with FortiAuthenticator and SSL VPN on FortiGate FortiAuthenticator is configured to sync ldap user accountFortiAuthenticator is configured to act as RADIUS with remote usersOn RADIUS policy, I used checked "User Windows AD Domain Authentication"ForiGate SSL VPN is correctly configured with RADIUSWithout 2FA enabled on FortiAuthenticator accountOn SSL VPN web interface I can connectIf I reset the password on my Active Directory (force change), on SSL VPN interface I can set a new password With 2FA enabled on FortiAuthenticator accountOn SSL VPN web interface I can connect with tokeIf I reset the password on my Active Directory (force change), on SSL VPN interface when I enter the token I'm not redirected to change password page but I have an error On Autentication > User Account Polices I haveIf I disabled "Request password reset after OTP verification". The behaviour is a bit different.I can change de password, then I recieved the

Hey, I'm new to Fortinet in general. We just got a fortiweb 400E and Im basically trying to ping through it and cannot.  Im not sure why. Basically what Im trying to do is this.....Laptop(192.168.1.1) >Cisco FW > Fortiweb400E > Cisco FW >laptop (192.168.1.10) The Ciscos are in transparent mode, I can ping through them no problem.  I'm guessing its a policy somewhere?  But I cannot see anything obvious in the logs.  I've turned on traffic logs and they tell me nothing.  I currently have it in OP mode "transparent inspection", port 1 is Mgmt on a different subnet, port 2 and 3 are plugged into each FW.  Any ideas would be great......