Solved

Hi !  I have a strange behaviour with dialup vpn. I have an HQ Fortigate with theses interfaces configured :port1 : 172.15.1.1/24dmz : 172.18.1.1/24 I have a Fortigate Client connected with dial-up vpn to this HQ. When I execute a traceroute on this Foritgate Client to reach for exemple a server behind my HQ Forigate with IP 172.15.1.218, the result is shown like that :  traceroute to 172.15.1.218 (172.15.1.218), 32 hops max, 3 probe packets per hop, 84 byte packets1 172.18.1.1 4.866 ms 5.031 ms 5.181 ms2 1172.15.1.218 5.355 ms 4.989 ms 4.527 ms Why dmz interface ip is in the path ????? Is it a normal behaviour ?  Thanks

Hello, I need help solving a routing problem. HQ and Brand Fortigate FW are connected via VPN IPsec Site to Site, everything is working fine, we can ping and have access from servers and ressources LAN to LAN from both side.  I created a static route from Brand's LAN 10.0.151.0/24 to HQ's router 10.0.78.253 on Firewall Arkoon. We host a SaaS solution with a service provider and this one to authorize the different lan to connect to the solution (France agencies + UK agency) On our Arkoon Firewall, we have authorized the different LANs that must have access to the LAN of the SaaS solution, 192.168.100.0/24. This works very well for all the agencies in France, except for the UK LAN with 10.0.151.0/24 addressing. When i do tracert cmd from a computer brand's LAN 10.0.151.109, I can ping 10.0.78.253 and 10.0.78.254.But, when I try ping or tracert with 192.168.100.20 it cannot found a route and it fails at first jump after 10.0.151.254. Thank you

Hello, Can I please get my nickname changed from MusicMaikel to SupportLibraICT? Thanks

Hi, two of our customers can't reach a website, but that webmaster says he can't remove them, because they are listed in the "Fortinet MaliciousServer list" and he can't remove them. The cause was the firewall of those two clients of ours, which they have since replaced. How do you get yourself removed from that list?Who should I ask? Thanks!

Hello everyone ! I need your help today. I have a FortiGate managed by FortiManager.I added some user in my FortiGate (User & Authentication > User Definition), I retrieved the configuration in my FortiManager. Now all is correct. But, if I push a policy package or update it, all my local users are deleted ! Why and how can I prevent this behaviour ?  Thanks

Hello. I have a FortiGate 60F and I have a layer-2 switch attached to one of the ports. On that nameless L2 switch is my WiFi WAPs (just some old Aruba's we had laying around). I want to have a guest network on those WAP's, but also want to have normal connectivity like I currently have. I'm trying to fumble my way through, but I can't seem to figure out a way to allow multiple IP/VLANs on one port. The L2 switch is on Port3, and I have that as part of the internal VLAN Switch (default setup) as pictured. Port3 > 8-port L2 switch > two Aruba WAPs with 2 VLANs (VLAN 0 and Guest VLAN)

Hi everyone, If I understand well, Web filter gives you more control over the things you can allow or block, in addition you don't need to use the FortiGuard DNS servers, so you don't have this limitation. Then, my question is, why do you need DNS filter if you can do the same or better with Web filter? Any example? Regards,Julián

Hello everybody! I encountered a problem - I cannot create a report template of youtube usage by individual users. The report has to contain: username, name of a video, a link to the viewed video, traffic, viewing start(date and time), viewing ending(date and time), view duration. Mates, please, write a solution if you are able to, thank you!

Hello @All,I have to Set up some internal DNAT and SNAT Entries and on reading some guides how to do that.I have seen that there is a feature calling Central SNAT available.I'm not really understand for what it is.Could someone explain to me what is the goal of Central SNAT and do I need that? Many thank'sTBC

Hi all, I run anomaly DoS detection between a students network and our campus lan. Thresholds are still default values. Problem is our campus dns server.I get many udp_dst_session, udp_flood, ip_dst_session just because of legitim (?) dns requests. 99% of all triggered anomalies are: clients -> dnsserver:53/udp. Sure, I could adopt thresholds but this would affect all udp traffic. Better would be to whitelist udp traffic to this dns server. Is this possible? anomaly: ip_dst_session, 7735 > threshold 5000, repeats 1312 times since last log  BTW: how are thresholds counted? udp is ip traffic, so does a 53/udp packet count for all three categories (udp_dst_session, udp_flood, ip_dst_session). And is this threshold for one client to server or all clients to server? Encylopedia says "the number of concurrent UDP sessions to an IP address is above specified threshold level", so I would assume latter.

Hi Folks! i have a special problem, we want that our user´s can use our public ip over vpn, but i don´t find any options in our fortigate FW60. has anyone the same? maybe someone can help. thanks a lot

Hi All, According to FortiGate support, I am the only person in the whole world who has had this problem. Configuration: FortiClient 7.0.2/.3 on MAC (Monterey) -> FG100/200 (6.4.8) IPsec VPN -> Cloudflare -> Secure WebsiteIPv6 is not configured on the FortiGates. Depending on the Internet provider (xFinity) and Verizon (hotspot), The user receives a block on Cloudflare because it see the xFintiy IPv6 address instead of the FG100/200 Internet IPv4 address.  Cloudflare only allows the FG100/200 IPv4 address access to the website.  If the user swaps to their hotspot, then the user can access the website. It doesn't matter what user is used to sign into the IPSec VPN. Fortinet support believe the issue is FortiClient, but since we don't have EMS, they won't provide support. I believe the issue is on the FortiGate side as the IPv4 IP address assigned to the IPSec connection should be the address that is pushed through the FortiGate and seen b

Hi all, I try to get "loadbalacing" (better call it host routing) working with virtual server and HTTP host as balancing method. I got a cert with all 3 server names as aliases, configured all 3 servers with their hostnames. Problem: What and how many firewall rules to get it working? I added two rules for each subnet, but it seems that no matter which hostname I access, only one rule is triggered. The first host (serv1) which matches the triggered rule works flawless. The other two hosts just seem to work on startpage. Any hints how to fix this? Do I need one very generic rule for both networks and why just works startpage? Is it due to persistance? config firewall vip edit "serv1-3" set comment "Server1 + Server2 + Server3" set type server-load-balance set extip 172.16.0.1 set extintf "any" set server-type https set http-ip-header enable set monitor "Check_Ping" set ldb-method http-host

Hello, I am trying to redirect the traffic coming from the WAN to a specific machine based on the domain name that a user types as a URL. This is somewhat tough to explain properly since this is my first time doing it so I will try to provide a detailed example. The FortiGate Firmware version is 6.4.7.I have 2 different servers in the same network that run as webservers, one machine has a 192.168.1.10/32 address and the other one 192.168.1.11/32. I have a DNS hosting were I can create several alias registries pointing to the public IP address that is set on the WAN. The main plan is the following.I created an entry in the DNS that points machineA.mydomain.com to the public IP address set on the WAN and I I created a Virtual IP that redirects this request directly to the webserver at 192.168.1.10/32. This one worked flawlessly since it was done directly though port forwarding.The problem comes when I try to add a second registry that points to the same public IP address on the WAN

Hi everyone, I am working on an SDWAN topology with 1 hub and 3 spokes (Spoke 1, spoke 2, spoke 3) routed via iBGP with the hub as Route reflector server. All spokes are RR clients. The actual issue is that the Hub is advertising all the best routes to the spokes but spoke 2 does not receive the route of spoke 1 and spoke 1 does not receive the route of spoke 2. Spoke 3 receives all the routes and spoke1 and spoke 2 receive the spoke 3 routes. I don't see any route-map or filter on spoke 1 or Spoke 2, I have done a soft bgp clear but still have the same issue. This make ADVPN shortcut never goes up between spoke 1 and 2. have you ever faced the same issue ? Kind regards

I've searched this issue and seen the technical tip about the issue in which it says "FortiAnalyzer not only shows information based on FortiGate logs, but can retrieve additional information from the FortiGate directly.This is done by FortiAnalyzer triggering a login from the miglogd daemon running on FortiGate and then querying the FortiGate API." I am interested in what kind of "additional information" it tries to get from the FortiGate by logging in? 

hello good peopleis there a feature of remote interface failure detection in FortiGate firewallsI have a redundant group of two ports "port1 and port5" each one of them is connected to a different Layer 3 switch, currently, all the traffic is traveling through port1 if it fails port 5 will take charge.but what if the remote interface that port1 connected to on the l3switch failsis there any way to detect that the interface facing port1 is down and dynamically switches to port 5 to move traffic?thank you

Hi,I've to remove several object using the FortiManager (6.0.11).  May I simply remove the objects or must I clean/remove the rules before? What will be the behaviour if the rule would be empty, if I simple remove the objects only? Regards,Bernhard 

Dear people, I have in FGM a lot of CLI Scripts, I use for automated Installation of a Fortigate.One of my problem is, that I must assign step by step the scripts to a fortigate and it does need nearly 10 Steps until the fortigate are completed. If I use all cli scripts in once, so I get Error from the FGM. Thats the cause, why I splitted the CLI scripts to mutch standalone cli scripts.  My question is, gives there some possibility, install all cli steps in once? For example I can not purge the DHCP from WAN and following delete the WAN Interface. So I get a error if I will execute this script. Kind Regards

Hi all,Since few days, we have started to use FortiToken and 2FA with the Fortigate's solution. Firstly, we have users in our AD, but we couldn't add mails associate in each user automatically. For that, you have to add mails manually for each user. You have any ideas about that?In addition, we can't automate the distribution of token for users? Because with a hundred users, it's not normal to attribute tokens manually.Any help would be appreciated.Thanks,Ali

Hello friends, I need some support in the configuration of a FortiAP. I have a specific vlan (with vlan-id 99) for all FortiAPs connected to my FortiGate-firewall. This vlanis the management-VLAN for the FortiAPs. My goal is that the FortiAPs broadcast a wifi-network which is bridged to my lan-network (connected to port2 of the FortiGate-firewall). But how to configure it? If I choose "Bridge" as "Tunnel Mode" in the configuration of the SSID then the wireless-clients get an ip-address in the management-vlan of the FortiAPs. If I choose "Tunnel" as "Tunnel Mode" I get a new (wifi)-interface on the FortiGate-firewall (with the name of the SSID) and I have to define an ip-address/netmask for this wifi-interface. Would the next step be to create a software-bridge with port2 and the wifi-interface as member ports? As mentioned above my goal is to have the wifi-clients in the same network as the clients connected to my lan (which is connected to port2). Ca

Good morning,I have a MV Fortianalyzer, I saw that I can generate the report of time used by the user, but my doubt is if I can pull it retroactively. viewtopic.php?f=15&t=19269 I need to get a report of the connected time of the users per day since 01/02/2022 I saw the general option that takes the total. but I need the consumption per day. can someone help me.Regards

Hello @All, i'm on configuration of our new fortigate latest OS to allow our external companies to using the ssl-vpn client to get access to our internal systems.We have several external companies and they need to have access to different internal systems.Neither company is allowed to see the other's systems. All of them using one VPN-Pool IP-Range (exampl. 10.10.1.0/24)User Login is based on LDAP Auth.I have try this configuration:1. Setup LDAP User/Groups2. Setup ssl-vpn-portal with split tunneling "Enabled Based on Policy Destination", Source IP Pools = 10.10.1.0/24; No "Web Mode" Active.3. SSL-VPN Settings "Listen Interface = WAN"; Tunnel Mode Client Settings "10.10.1.0/24"; Authentication/Portal Mapping "I add all VPN Groups from our external Companies"4. Firewall Policy, I add for all external Companies one Rule with:   Incoming Interface = ssl-vpn tunnel interface   Outgoing Interface = Internal Port to our Systems   Source = The VPN-Pool 10.10

Hi, I have changed our core switching to a pair of ArubaOS-CX devices and wanted to move the existing Fortigate LAG on X1/X2 on a 100F (6.0.14) to go to each of the Arubas.The Aruba multi-chassis LAG can only be set up with LACP and it didn't come up so ended up creating a non-LACP LAG to just one of the switches to get us up and running. I have looked at the Fortigate and seen that the LACP type is static. My question is, can this be changed to active or passive on an already configured Fortigate LAG? Or like with everything else, do I have to remove all config and start again to create a new one?I don't want to have to travel to the site to find out it can't be changed with a CLI command. Thanks!

I edited a backup .conf file and restored it through the webGUI. This apparently crashed the firewall and powered it off. After uploading the .conf and clicking enter, the webGUI said "Rebooting system" followed by "System reboot is taking longer than expected". Now, I can no longer access the webGUI or ping the device, and a console server it's connected to says it's disconnected. I have no physical access to the device until next week. I have a rescue backup .conf file. I'm just curious what I should expect next week. Did it crash because I edited a .conf instead of doing it through the cli/gui? Will it boot to the last working config - if at all - or is it in some sort of error state?  Basically, is it recoverable?