Solved

Hello, I have an incoming route-map applying a MED metric of 10 to a received default route.I can see this metric of 10 showing in the route table so confirms it works. However, I am also receiving another default route from another BGP peer with a MED metric of 1.I can see this route coming in, however it is not replacing the existing default route with metric 10. I thought lowest metric wins. How come the new, lower metric default route is not taking over from the existing one ? Thanks for any help.

I am having trouble when try to reach a server which is used as a NAT with virtual IP address from the VLAN20. Please could you give me some idea what's holding vlan20 to reach that server? Debug flow : id=20085 trace_id=885 func=print_pkt_detail line=5665 msg="vd-root:0 received a packet(proto=6, 192.168.2.3:61108->10.10.10.2:443) from ENKA SITE. flag [S], seq 3245614174, ack 0, win 64240"id=20085 trace_id=885 func=init_ip_session_common line=5836 msg="allocate a new session-00c7d9b0"id=20085 trace_id=885 func=_pre_route_auth line=106 msg="pre_route_auth check fail(id=0), drop"   My topology is here: Vlan10 - 192.168.1.0/24Vlan20 - 192.168.2.0/24 WAN1 : 10.10.10.2/24WAN2 : 20.20.20.2/24 STATIC ROUTE : WAN1 - 10.10.10.1 - Priority 0STATIC ROUTE : WAN2 - 20.20.20.1 - Priority 5 Policy Route : Incoming interface: VLAN20 - Source: 192.168.2.0/24 - Destination : 0.0.0.0/0.0.0.0 - Action: Forward Traffic - Outgoing interface: WAN2 - Gateway: 2

hello we switched from the version 5.6old to v6.4 ,now using fortigate 1000d v6.4 cannot find source devices/devices for SSid so i can add the devices in the source like we can add in the old version 5.6..in order to restrict devices by mac-id. Thank you

Hello friends, I have the two following questions. Perhaps you can help me :-). 1. Is it possivle to configure a specific dns-server for a specific internal domain? I need it to resolve internal FQDNs like abcde.internal-domain.comby a dns-server I would like to speficy. The FortiGate-firewall should then pass the dns-requestsfor this domain (for example abcde.internal-domain.com) to the dns-server which is resposiblefor this domain. For external FQDNs (for example www.google.de) the dns-servers under "Network" --> "DNS Servers" should be used (for example 8.8.8.8 or 1.1.1.1). 2. Is it possible to configure one side of an ipsec-site2site-tunnel (Fortigate-firewall on bith sides)as "passive" and the other side as "active"? The goal is to establish an ipsec-tunnel where one side is connected to an lte-connection (mobile network) and the other side is connected to a dsl-connection (static ip address on wan-interface). The Fortigate-firewall on the lte-side shou

hi fortinet community, i almost done setup fortimanager 7.0 in my internal network. rules to connecting the internet using a proxy. My problem is I wanna login fortimanager with forticloud account to activate trial license, but got error "timeout". I already done setup "config fmupdate av-ips web-proxy & config fmupdate web-spam web-proxy" but still same got error "timeout". do you have a suggestion bro ? Thanks FortiManager FortiCloud Products

Brand new FortiGate 60F. For some reason, instead of a Hardware Switch it has a VLAN Switch (Network >> Interfaces). I'd much rather have it have a Hardware Switch, like the other FortiGate Firewalls we administer, but how do I change it/delete it? I've tried factoryreset and factoryreset2, but it has survived :( So how do I delete the VLAN Switch, change it to a Hardware Switch? I'm ready to wipe the configuration and start from scratch. The FortiGate is running FortiOS 6.4.8. Thanks!

Helloi try to setup automatic backup over automation.I use the cli command:execute backup full-config ftp /Netdevice-BCK/BU-FWZ/BU-FWZ-test.cfg server user passwordExecuted in cli, it works fine. When i try to start the command as automation stitch, the backup is not uploaded to the ftp server.What am i missing?RegardsMario-> Debug output when testing automation stitch: 0: config global0: config system auto-script0: edit "autod.858"0: set script "execute backup full-config ftp /Netdevice-BCK/BU-FWZ/BU-FWZ-test.cfg server user password"0: end0: end-1: execute backup full-config ftp /Netdevice-BCK/BU-FWZ/BU-FWZ-test.cfg server user password

Hello Guys I have this Fortinet configuration with HA active-passive mode, and an aggregate was configured with port3 and port4 on the fortinet side and in each Mellanox Switch that is in mlag mode (VPC in Cisco), an 802.3ad LACP with two ports was created (swp41,swp42) with a clag id. The LACP on the Switch side always shows up, but on the fortinet side, it always shows us down the lacp in the Passive Firewall when I run a diag net aggr name Lacp_Spine the status is down, but the active one is always up. I would like to ask you for help if this behavior is normal, where the passive always looks down. Thanks 

I already connect SNMP with PRTG and shown the data on their dashboard such as bandwith and port status (UP / Down).But in System Event still have message "SNMP failed to match community" The question is, how can delete that message cause every hour always shown that. Thank you for your attention 

Hello... I have a FortiGate 600E device... In the current design there is one internal interface that connects all internal vlans to the firewall:(10 users vlans, 1 guests WIFI vlan, 1 Servers Farm vlan)... This connection comes directly from a Cisco Nexus 9396 switch which is the default gateway for all of the vlans. Now I want to separate these vlans from each others in order to set policies between the users' vlans, WIFI vlan and server farm vlan...  What I know is that I have to setup the vlans in the internal connection of FortiGate device and make it the default gateway for them instead of the Nexus switch.. Is this the right way??And can the FortiGate 600E handle the routing instead of the Cisco Nexus device?? Any advice will be appreciated 

Hello Expert, Yesterday  i  factory reset my 524D switch.I connect the cable from laptop to the management port on the switch but was not able to login in.Upon troubleshoot I realize I  cannot  ping the interface.  The only access I have to the switch is via command line. I humbly request some guidance to enable access via the management port using the default ip (192.168.1.99) Thank youRegards

HIWe've just had our MC4200 RMA'd The new one is up and running but out of 68 APs it can only talk to two.None of the others can be pinged from the controller. They can ALL be pinged from my computer. My computer can also ping the controller and the controller can ping my computer.All the APs are on the same subnet as the controller. I can't think of any reason why the controller cannot talk to them when a computer on a different subnet can.We also have a box called an SA250 sitting under the MC4200. I have no idea what it is or what it does and I have never connected to it. I tried to get to it's web interface today (assuming it has one) and that does not work. It is also on the same subnet as the APs and the controller but the controller CAN ping this box.Since the replacement MC4200 was installed all the POE switches onsite have been rebooted which should have rebooted all the APs. I have also turned off and on one of the switch ports connected to one of the APs and watched the ping

we just bought a fortiweb and in my network, most of our servers dont use http and https ports but instead they use ports like udp and tcp 3500  , 3501 and so on. My question is the following: is fortiweb used to protect servers that don't use HTTP or HTTPS? like how described in my environment? or it is exclusively used for http and https access? because the idea to place all my services that use tcp and udp ports behind a fortiweb? because when im checking config guides on fortiweb it shows the policy configuration is always showing a http and https profiles, while many of my servers don't use http and https and use other ports for other applications like GPS and so on

Hi,I have a FortiGate 100F with a LAN interface (10.1.10.1) that uses the local Captive Portal to authenticate users to Azure AD using SAML 2.0 SSO.I also have a Wi-Fi Interface (10.1.40.1) that uses the local Captive Portal to authenticate guest users with temporary accounts created in ‘User & Authentication -> Guest Management’.The Captive Portal FQDN is -  captive.local.acme.co.ukI have setup the FortiGate DNS Server database, created a local.acme.co.uk zone and created two DNS A records for the Captive Portal for this FQDN.Captive -> 10.1.10.1Captive -> 10.1.40.1All appeared to work OK for a few days, but now the DNS resolution is selecting the wrong A record, e.g. 10.1.40.1 is being resolved when trying to connect to the Captive Portal from the LAN interface.Is there any way to force the correct FQDN to IP Address resolution? Or an alternative way of achieving Azure AD firewall authentication and Guest Wi-Fi on the same FortiGate?Thanks!

Has anyone been able to get a phone like this registered to a Fortivoice 40?  Also, same with a Grandstream gxp1630.  I am not able to register either.  Any help is appreciated..

i have made a vlan(192.168.2.1/24) for may APs under my lan switch(192.168.1.1/24)...my problem is im not able to allow or gave the vlan internet access even do i have made policy wifi vlan -> sdwani am able to ping lan address via the ap with a policy wifi vlan -> lan and lan -> wifi lanmy ap config is that all user connected to ap will be in the vlan. the AP im using is tplink eap320 and engenius ews300ap am i missing something in my configuration fg201ev7.0.5 

I'm in the process of converting a Linux firewall at the office which had evolved over many years to a Fortigate setup. I've used Fortigate for our hosting environment for a couple of years, so I'd not quite the newbie... One thing we currently have set up is that incoming SSH connections get forwarded to an internal jump host, with the exception of incoming SSH connections from one particular IP address. I had expected that I could create a VIP address with a source IP filter for that address and have that go to a special internal host, and create another VIP address without a source IP filter that forwards the SSH connection to the jumphost. However it seems that the source IP filter is not considered when deciding whether the entry is a duplicate or not. This is basically how it's done in the linux firewall with iptables: iptables -t nat -A PREROUTING -s $special_ip -d $my_ip -p tcp --dport ssh -j DNAT --to-destination $specialhostiptables -t nat -A PREROUTING&nb

Hello, So I have a question I cannot find if there is an answer to. We have a Fortigate 201E that contains a dedicated management interface.  We do NOT have that interface connected normally to any network.  We use it as a "Something has gone wrong, and I need direct access to the firewall"...The problem we had (literally this morning), was that we locked ourselves out, because most of our accounts are LDAP based, and suddenly the firewall couldn't connect to the internal network. We have a local admin account, but for some reason, we had 5 different passwords saved for that account.  This locked us out, and delayed us getting services back online because of this simple problem. I would like to have the max login attempts either disabled, or at least changed for that single interface only.  Can this be done?

Q1 How do you configure a switch virtual interface anddo vlan tagging on the firewall ports using GUI? Q2 If it is possible, pls do guide me and advice if I am supposedto use a software switch or a hardware switch? Q3 How come there can be 3 ip addresses for the physicaland virtual interfaces? Ip addresses should only be on the physicalor virtual interface, not both. (there are one physical and 2 virtual interfaces) Q4 How do you configure an interface and assign sub-interfaces to itusing GUI?

Hello,i am looking for a fast and efficient way to check if 800 or so ip addresses are contained in the fortigate blacklists.Can you help me?Thank you

Hi,SetupI use a Fortigate 60E (WAN Router) to split our internet connection to a 2nd location.On the 2nd location we also have a Fortigate 60E.I used a traffic shaper on the WAN Router to limit there speed to 100Mbit.Both run FortiOS 6.2.10 The Issue:On the 2nd location for one reason or another, 1 user can use up 100% of that 100MBit during a download.Any other device at that point will not be able to internet untill the download is done.Has anyone seen this before? it feels like the 2nd Fortigate doesn't know the line speed, even though I set the Estimated Bandwidth to 100000 kbps. I don't understand why its not balancing the connection.

Hello friends.I have a fortigate 400D, receiving 100 Mbps from my ISP (UTP cable). Now I want to connect it to fiber at the same speed (100 Mbps). I saw that it has 8xGE SFP slots that I assume supports fiber.My questions is:Is it possible to connect it to a fiber working at 100 Mbps speed?If yes, what kind of module I need? Thankx. 

Hi,   I have a query.. I have few fortigate devices which are being configured directly until now. We have lot of static routes, firewall policy, SDWAN rules, interfaces etc..  Currently I want to manage these fortigate devices through Fortimanager. How can I add a preloaded config Fortigate device into Fortimanager so that Fortimanager gets policies, configs from Fortigate and continue to save it for future changes?. Any documents available on this?. RegardsRaja

Hi,I just use these firewall from some days but I'm runnig into a problem.I try to summurize- Server A (192.168.0.230) is connected to Server OUT (192.168.100.200) through a 80E vers 6.2.6 - Server A is able to ping (even reach http/https and so on) SERVER OUT - I add server B 192.168.0.231 to the lan, I add to the rule on the firewall Server B ... but I'm not able to "ping" server OUT.There are no routes on the serversthere are no rotes on the firewall (or even I'm not able to see them)no software firewll on the serverIf I "swap" ip addresses from SERVER A to SERVER B  B will be able to reach SERVER OUT and A noIf I change server B address to somethig differnet still no working (so there shuold not be dirty entries) Can some one give me an idea to what to check?Thank you in advance, hope to be understendable.Carlo

Good Day, I'm looking for a solution to implement an HA cluster between 2 Fortigates that are installed in different server racks/server rooms. Rooms are connected with Fiberlinks over a switch stack (not Fortinet Switch). To add to that, there's 2 ISPs on site and would like to have it redundant with SD-WAN and everything. I have found 2 documents stating that both solutions are possible on their own but NOT used togetherhttps://docs.fortinet.com/document/fortigate/6.4.0/new-features/297020/fortigate-ha-between-remote-sites-over-managed-fortiswitches-6-4-2https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/759633/sd-wan-with-fgcp-ha-expertIf you have any inputs or different solutions to this, let me know!