Solved

Hello Guys I am starting to study fortigate and I have simulated some labs in GNS3 with good results, but now I am trying the following configuration1 FW2 Switch core connected by LACP to the FW. The core switches are in L3.1 ToR switch1 PC connected to Tor to vlan 101From the Core I have a response from the IP 192.168.0.17 of vlan 117 and vice versa. From the PC the IP 192.168.0.17 of the FW responds, so add the segment 10.214.1.0/24 192.168.0.18 as a static route in the FW. My problem is that the PC does not have internet access, the FW only has vlan 117 because I want to test if it is possible to go to the Internet with this configuration, because in another laboratory I had no problems when I created vlan and dhcp in fortinet, they went to internet without errors, but in this case I have not been able to achieve it I have tried creating the segment 10.214.1.0/24 in fortigate, created a policy that everything that comes from vlan 117 goes out and still the same p

Our Fortimanager(FMG) is running 6.4.7. We encountered a situation we had to add one VIP policy at only one location/FGT (so far) of this customer while all other policies (60+ of them) are the same with other locations.I kind of know the answer already but I have to ask because my current option I'm thinking is to clone the current policy package and change the name then add a VIP policy with VIP objects, which is not so smart because every time we need to add/change one thing to any other policies, we have to remember to add the same change to this policy package as well.And similar cases might grow when we add more this retail-chain customer's location (so far 100+, but expected to grow much bigger) and the number of policy packages would grow. So, I want to ask if I can somehow add one policy only for one location/FGT in one policy package. Thanks,  Toshi

Hi team, We are new using fortinet firewall but our company website: Marj3y.com is being blocked without a clear reason. I can't find anything related in the logs?Also how can I check it against viruses from the firewall console? 

Forticlient blocks access to the C:\Backup directory, prevents creating it or writing to it if it already exists.We have a commercial software that requires saving files inside the C:\BACKUP directory, if the folder does not exist it creates it. We have been using it for several years without any problems.We installed Forticlient on the computers in October-November, and it is in this month of February that we need to update that software on some computers; the updater sends an error message that it does not have access to the mentioned directory.I checked then that in all the computers that use Forticlient, it is impossible to create the directory or write inside those that have it created for some other reason (a simple manual backup inside that folder made 2 years ago).In the FEMS I have already added the exclusion in all the profiles; I have searched how to "pause protection" (I have not found it), but I deactivated all the protection modules and it still blocks the directory.The o

Good afternoon community. My case is the following, I hired a block of 8 public IP's with my ISP and I have not been able to configure it properly in my FT100e. MY ISP gives me the service through an ONT which I connect to my WAN1 in PPPoE mode and assigns a local IP of the ONT to WAN1.Configure a VLAN subinterface on my WAN1 where I configure the first usable IP of the /28 block, the others I place as secondary.Create a static route pointing to the GW that is assigned to WAN1 dynamically.Create a policy to allow LAN=>WAN1 access Under this scenario, the LAN network on my port 1 navigates without problems, but the FG100e does not ping the Internet nor can I reach the IPs of the block externally. Any help or suggestion would be greatly appreciated. Greetings.

I followed the guide below to configure explicit proxy and enable Kerberos with NTLM in fallback:Administration Guide | FortiGate / FortiOS 6.4.8 | Fortinet Documentation Library Everything works correctly. The problem is that all users authenticate through NTLM and not Kerberos:# diagnose wad user list ID: 2, IP: 10.1.100.202, VDOM: vdom1 user name : TEST31@DOMAIN duration : 7 auth_type : Session auth_method : NTLM pol_id : 1 g_id : 5 user_based : 0 expire : no LAN: bytes_in=6156 bytes_out=16149 WAN: bytes_in=7618 bytes_out=1917 I have a doubt: is it all here or is some configuration missing? I found this article on TechNet:Active Directory: Using Kerberos Keytabs to integrate non-Windows systems - TechNet Articles - United States (English) - TechNet Wiki (microsoft.com) In particular it seems to be necessary to enable Kerberos for the service user used for the keytab: <After the keytab generation, t

Hi community, Can anyone help me about the procedure how to upgrade a FortiGate 60D from 5.2.3 to 6.4.8. I have taken a look at the Upgrade Path Tool, but it doesn't show either 5.2.3 nor 6.4.8. Any ideas? Regards,Julián

Hi Everyone, I would like to seek an advice if is it possible to create 2 IP Sec VPN tunnel on fortigate firewall with 1 WAN interface ? if so is there any link or documentation that I can refer how to do so ?I attached some topology for better understanding on this thing.

Hello,FortiClient 6.2.3.0912 on windows 10 computer is configured through EMS. I cannot activate Real time protection. The reason is quite clearly esxplained in log:06.02.2020 08:42:22 Information Config Third-Party AV (Trend Micro Security Agent, ) is installed. To avoid conflicts, scheduled AV scans will not be imported.06.02.2020 08:42:22 Information Config Third-Party AV (Trend Micro Security Agent, ) is installed. To avoid conflicts, real-time AV will not be enabled.06.02.2020 08:42:22 Error Config Error in importing module: xmlav06.02.2020 08:42:22 Debug Config 'scan on registration' is disabled - delete 'on registration' vulnerability scan.06.02.2020 08:42:22 Debug Config ImportConfig: tag <\forticlient_configuration\antiexploit\exclusion_applications> value is empty. The problem is that I already uninstalled the Trend Micro Security Agent. I manually checked that all TM files are deleted from the disk. I manually checked that there are no TM keys in registry. I

Hello,we have a Webserver at backend with following configuration:Ubuntu 20.04apache 2.4PHP 7.4Software GLPIKerberos SSOIf we unsing on windows pc the internal url (fqdn) from Webserver the user loged in automaticly.Parameter Satisfy Any is disbaled in that case! If we using external Fortiweb URL we enter user an password we get this Browser Message: UnauthorizedThis server could not verify that you are authorized to access the document requested. Either you supplied the wrong credentials (e.g., bad password), or your browser doesn't understand how to supply the credentials required. If we aktivate Satisfy Any in apache ssl config the login with external (over fortiweb) is woking after enter Credentials.But with this configuration, the login with internal URL require a authentcation. On Fortiweb we have as Site Publish rule this: Can someone tell me what is wrongmany thanks for helping

Dear users, Just a question. Yesterday I have set up the Fortimanager and imported some Fortigates into it. All went well except the policy packages. All of them have status modified.  I know I can push the policy back to the FortiGate to get it in sync but I'm afraid that it will broke somethingIs there a quick way to fix that? How would you fix the modified packages to get them in sync

Hi all, We have 2 (non-HA) FortiAuthenticators on prem that were configured to use DC agent with DNS IP validation, but were finding that when someone moves from a wired to a wireless connection that it would take too long for DNS to replicate and FortiAuthenticator to update the IP address of a workstation. We have therefore installed the SSOMA on a couple of devices as a PoC, which works great for the above issues, but we are seeing an issue with VPN connected and On-Prem connected clients that are on the same LAN subnets. Example:User 1 connected to Cisco AnyConnect on 10.0.0.1 with local wireless network: 192.168.0.1User 2 connected to On-Prem network on 192.168.0.1 The FortiAuthenticator sees both connections for User 1 and updates its' DB, then when User 2's SSOMA updates FortiAuth, the DB removes User 1 IP: 192.168.0.1 and adds User 2 IP: 192.168.0.1. Then User 1's SSOMA updates FortiAuth, which removes User 1's entry. We have IP Filters created, but as the b

New to FortiExtender. Trying to determine if using FortiExtenders might be a good choice for a  WAN2 connection in the event that the existing WAN1 connection goes off-line for a time. I'm curious what options exist to subscribe to the SIM cards. I know that some cellular carriers have fairly low cost data plans, but that it is easy to exceed the allowed data usage. I think that there are other plans that have high or unlimited data useage caps but that are quite expensive.  Does Fortinet offer cellular data plans? Are there some plans that are well suited for this usage? Do any plans pool data allotments such that a single SIM card in use in a month can use the pooled plan minutes of all SIM card plans? 

Hello, i have the following problem:we purchased new Hard Tokens and i wanted to activate them in the fortigate. All i get is a Invalid serial number message.I found the old problem with the Serial Number Checking Tool but this is failing too with a SN Not Found massage.The SN are all starting with "FTK200BA8" Is there a new chicking tool or do we have to contact our reseller? Thanks in advance and greeting,Dominik Gronau

Hi all. I'm hoping someone will be able to advise me on a work around, or an alternative solution, to avoid the following limitations with Microsoft NPS Extension for Azure MFA (without having to implement a completely different solution!): https://feedback.azure.com/forums/169401-azure-active-directory/suggestions/36647266-mfa-nps-ext-support-for-network-policies-via-rad For context, our customer originally had a FortiClient to FortiGate SSL VPN that utilized LDAP authentication, allowing different levels of network access depending on AD user group membership.Our customer subsequently moved their AD into Azure cloud and introduced Azure MFA.Our customer now wants to integrate the existing SSL VPN to with their Azure MFA for 2-factor authentication. We followed the following Cookbook document to successfully implement this: https://docs.fortinet.com/document/fortigate/6.2.0/azure-cookbook/517582/configuring-forticlient-vpn-with-multifactor-authentication 

Hi,  When we have different region HUB topology in the network. Each Hub will have iBGP peer with its spoke and eBGP peer with the other region Hub. So , when we build IPSEC tunnels between the Hubs whether this should be a full mesh tunnel or a dialup tunnel?.  Should we need to add these ipsec tunnel interfaces (Between Hub to Hub) as part of SDWAN interfaces and to write SDWAN rules at hub for a spoke in one region to speak with other spoke??.. Or the other option is , without bringing HUB to HUB ipsec interfaces in SDWAN interface and just play with BGP routing ??. What is the best way to deploy and any documentation available for this. When we add it in SDWAN interface, we get benefit of running performance sla on top of it and to pick the interfaces.. RegardsRaja 

I have a second-hand FortiGate 80C and fortiap 223b,I want to upgrade them.When I downloaded it in the technical support, I found that I needed the contract number, but I didn't.Who has time to download their firmware and mail it to me,I'd really appreciate!my email 958041914@qq.com  or zlajl90712@outlook.com

Hello,Tried to make IPSEC tunnel between my fortigate and server build on OPNsense.My fortigate is 100F behind SNAT. SNAT is made by Virtual IP and forward connection form external IP to IP on loopback interface. Don't have any interface directly connected to internet so have to use Virtual IP as SNAT. Opnsense is also behind SNAT 1:1 .Something like :OPNsense 10.0.0.1/21<-->SNAT<-->95.100.100.1<-->Internet>95.100.200.1<-->SNAT on Virtual IP>10.200.0.1/32 on loopback<-->Local netIPs are for show purposes only.I've made successfully tunnel , phase1 and phase 2 is on green from both side.Problem is that  that Fortigate receives incoming packets from OPNsense but reject it as it comes from unknown SPI. In log details I have correct local IP, correct remote IP and the most important correct SPI number from both sides.I'v tried IKE v1 and v2 , with NAT nad without NAT and many other options. Nope, all the time Fortigate even if tunnel from

I can create a GeoIP and select a country to distribute the rules to the region at once. But what if I want to add or exclude some addresses in this list? I have Fortigate-600D-LENC (that is, it is not connected to cloud services and auto-updates) and I have not found a way to view the database of addresses included in the GeoIP of a particular country.

Hello, I have Fortinet Firewall 200E with SDWAN configured and I need to configure a VPN ipsec Client to site  I create the tunnel, I added the policy I can connect but I cant reach the local subnet  is there any think specific with sdwan  just for information it works within SDWAN thx for help  

Dear FortiMail Expert,Pls bear with me, not so technical questions. I just want to hear how others may address such questions.I bumped to one of my client and asked me the ff entries in FML Datasheet. Is anyone willing to share his/her tought on below items?1. Recipient-Based Policies (per Domain / per System) —Incoming or Outgoing800 / 3,0002. Antispam, Antivirus, Authentication, and Content Profiles(per Domain / per System)50 / 403. Email Routing (per hour)**1.5M3.a FortiGuard Antispam + Virus Outbreak (per hour)** 1.0 Million-->these numbers are bidirectional or intended for inbound only?  thank you in advamce

 Hi, Did someone face a block on all in the last 2 hours google.com and www.google.com starting to automatic block duo to sandbox block?Fortigate version 6.4.6 - 6.4.8

Hi,I use the below query to provide a summary of every user that hits the categories identified in the list. I would be very grateful if anyone knows of a way to include the Source IP address as one of the returned columns. Given that lots of our users have more than one device, it would mean I wouldn't have to go back to the Analyzer for confirmation.Kind regards,NetMan_Bath selectfrom_dtime(dtime) as timestamp, user_src, catdesc, hostname as website,action as status, sum(bandwidth) as bandwidthfrom###(select coalesce(nullifna(`user`), ipstr(`srcip`)) as user_src,dtime, catdesc, hostname, utmaction as action,sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidthfrom $log-trafficwhere $filter andhostname is not null andlogid_to_int(logid) not in (4, 7, 14) and ((logver>=52 and countweb>0)or((logver is null) and utmevent in ('webfilter', 'banned-word', 'web-content','command-block', 'script-filter'))) and (catdesc='Child Abuse' or catdesc='Child **bleep**ual Abuse' or

Hi all, I setup user auth with FSSO DC agent mode, and as there is many entries I would like to filter a bit.The filter criteria I would like to setup is based on the workload IP addresses.I have many users, connecting from home, that have FSSO entries with their own private home IPs.For example. user lamdba is seen with its VPN tunnel IP to Office and its private IP (so 2 FSSO entries).As the last ones are useless for filtering, I would like to know if it is possible to filter on DC agent or Collector Agent ?Thanks a lotFB

Good evening,  Experiencing an issue with FG Routing can anyonn assist,  I have the following setup on a Proxmox node: 1. Ubuntu (Client) 2. Foritgate Firewall  The Client has two interfaces attached with the following networks: 1. 192.168.61.X for management 2. 192.168.10.x (shared network to reach the Fortigate) LAN The Fortigate has three interfaces attached with the following networks: 1. 192.168.61.X for management 2. 192.168.10.x (shared network to reach the client ) LAN3. 192.168.100.x (WAN Interface to reach wan router) I cannot get internet on the client through the FG.  I can ping between both the client and the FG on the  192.168.10.0 network but if i try to ping an external network from the client with the FG as the gateway there is no reply.  After running sniffers and debug flow i can see the packet reaching the Fortigate with the following output:    FortiOS