Solved

Hello, After upgrading from 5.4.5 to 5.6.3, the DNS service on a loopback interface is not working anymore. The traffic is arriving on the VDOM and the debug flow shows the traffic is accepted and sent to the loopback. However the DNS service itself does not reply. A wireshark shows exactly the same behavior, the packet is incoming on the VDOM, but there's no reply back. DNSproxy debugging shows: udp_receive_request()-2065: vd=8, intf=39, len=32, alen=16, 10.1.0.47:42857=>172.16.10.13 handle_dns_request()-1395: id:0xabb5 pktlen=32, qr=0 req_type=3 get_intf_policy()-876: ifindex=39 A config compare between 5.4.5 and 5.6.3 shows no modified configuration whatsoever related to DNS or the loopback interface. Running the DNS service on a physical interface does seems to be working. Has anyone by chance run into this before? It seems like a bug or behavior change.

HI there, Im trying to configure a local in policy to allow a VOIP provider's ROBOT to be able to ping the Wan interface to report that the internet is up at any given stage. I can do this but I want to limit the response to specific hosts Public IP addresses. So I have a VLAN (10) configured as my PPP wan connection bound to the physical port wan1. My VLAN interface is called WAN-UFB with an appropriate alias. I have enabled ping on this interface and ZI can ping in from outside no problem.Now I want to limit the hosts that can ping so I'm trying to create a couple of local-in-policy's bit I cant get past the set intf as follows:config firewall local-in-policy edit 1 set intf "WAN-UFB" set srcaddr "xxx.xxx.xxx.xxx" set dstaddr "all" set service "PING" set schedule "always" next endWhen I get to intf, i get the error :  " node_check_object fail! for intf Attribute 'intf' MUST be set. Comma

I have a firewall with a wrong command in the config, I am exploring whether I can correct it without rebooting the firewall.  The following syntax is in the Fortigate firewall. However, the command "set associated-interface "Terminal10" in red is wrong, it should not be there. Can the wrong command be removed by CLI without restoring the firewall config file? Restoration will cause disruption to the firewall operation as there will be rebooting. Appreciate your advice. Thanks. edit "Terminal_192.168.1.1"        set associated-interface "Terminal10"        set comment "Terminal_192.168.1.1"        set subnet 192.168.1.1 255.255.255.255    next After the removal, it becomes as follows:edit "Terminal_192.0.132.1"        set comment "Terminal_192.168.1.1"        set subnet 192.168.1.1 255.255.255.255    next

I am trying to figure out how to deploy traffic shaping for the below situation. I am receiving conflicting information, so I thought I would reach out to the group to see if anyone could provide some guidance. I have 5 separate subnets in which I need to apply traffic shaping to. Each subnet shares a 300 down and 30 up internet connection. Each subnet should have a minimum of 60 down and 6 up; however, if bandwidth is available, each subnet should be allowed to burst to 300 down and 30 up.In conversations with support, it was recommended I create 5 separate "shared shaping" policies for each subnet. However, after researching this further and based on my understanding of the way policies are applied, each policy operates independently, so each policy would think it could burst to 300 as it is not aware of the other policies. In other conversations with support, it was recommended I create a single "shared shaping" policy. Based on my understanding, this approach would n

We have a 524D switch, and using a 40GB breakout cable to 10GB. The FortiSwitches are managed through the Fortigate. We then have a transceiver to be plugged in to an HPE Gen 10 Server. The documentation mentions the following: "Auto-speed detection is supported on 1/10G ports, but not on higher speed ports (such as 40G)". What does this mean for the 4 x 10GB speed ports? Can they be set to Auto 10GB? The port speed on the present Cisco transceivers in the HPE Gen 10 servers are already set to 10GB auto. Also I am not understanding what the speed setting called Auto-Module is used for? We are running version 6.4 version of firmware. And one more question regarding MTUs. If we look at the settings on the switch this is what we see. " The VLANS are set to an MTU of 1500, but the ports themselves are set to 9198". This is confusing. Does one. overide the other?  Thank you

I found the bid in the FortiOS log field.I'm not sure what this field means.who can tell me? The log format documentation doesn't even mention the bid field.

I' m using FortiClient for VPN purposes only and dont need it running any other time. I cant get disable fortinet from starting on startup. Its getting very frustrating. I' ve followed this guide; http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD31776   But when I go to step 2 and try to uncheck FortiClient Service Scheduler and click Apply, it automatically re-ticks itself. Anyone had this problem or know how to solve it? We use Forticlient for corporate vpn and I' m having second thoughts now.

I have a version of the Fortigate 600D-LENC device, that is, without access to Fortinet cloud services and without access to FortiManager and FortiAnalyzer. Is there a possibility on FortiOS Firmware v5.4.1 build 3753 configure automatic backup actions and security policy changes?

Hello Guys,i have a strange question:i have two IPSEC tunnels as below:branch 01 ----- HQ ------ azureip1 -> iphq    iphq->ip1                   iphq+ip1->ipaz       ipaz->iphq+ip1we can't have any more IPSEC tunnel on brach01 so i'm trying to route the subnet ipaz presented by the tunnel between hq and azure to branch01 and vice versa.I think i'm missing something in between also i can't nat because we have video traffic that don't like nats. any ideas? THX a lot! 

Hi , I have read the new feature in 6.4 release note, for advpn and shortcup behind NAT.  UDP Hole Punching. But i have not look if this parameters is by defaut in 6.4 or if it' a parameter in fortigate? I don't have found this information in forum or cookbook.  Anyone have  some information for that? I try to use with advpn and OSPF routing. https://community.fortinet.com/t5/FortiGate/Technical-Tip-UDP-hole-punching-for-spokes-behind-NAT/ta-p/192762  Thanks,  

Hi Guys, I am using Fortigate 60D v6.0.12. recently I deployed the SD wan, in our network. When I see the performance SLA in GUI it shows more than %. it's totally wrong. Is anyone facing the same issue. please help me.       

Hi, Currently having some concerns as I'm adding a /22 on my policy. I have a working configuration for /24 and the new one cant push the internet connection even that policy setup is working before.

Here's a scenario, I have a branch fortigate using a base configuration which uses two ISPs for the virtual link. In this case we do not yet have the link for WAN2 (Waiting on the carrier to install) So in the SDwan we see WAN1 up and WAN2 down. When hitting an SLA on wan1, does the fortigate bring wan1 down until it it meets SLA? Even if WAN2 is hard down? Or is there some sort of safety built into this since WAN2 is hard

To check the 7.0.5 release in a test environment, I downloaded the imageFGT_VM64_KVM-v7.0.5-build0304-FORTINET.out.kvmand added it to GNS3. I've done this plenty of times. The image will run a couple of days in eval mode and I can then exec factoryreset to reset the eval timer. Works fine in a simulation environment like GNS3. However, I seem to have an issue, as the eval license is not working anymore.  Each time I spin up the image, I am greeted with the following after a few seconds :"*ATTENTION*: Admin sessions removed because license registration status changed to 'INVALID'" and, surely it shows:FortiGate-VM64-KVM # diag debug vm-print-licenseSerialNumber: FGVMEVX0OGFYAC9ACreateDate: Thu Feb 10 08:20:15 2022Evaluation license expires: Wed Dec 31 16:00:01 1969Model: EVAL (1)CPU: 1MEM: 2048VDOM license:permanent: 1subscription: 0  usually exec factoryreset or exec factoryreset2 would to the job.Or downloading a new copy of the image. But this time

In Log > Log Settings is... Logs older than 7 day(s) are deleted from the disk Can I extend it to 10 days? 15 days? A month?

Hi , I'm not familiar with Fortinet at all.  I would like to understand what is the best practice when we need to enable a connection to a site like Github and such .Since the certificate copy  produced by Fortinet replacing the original Github  certificate isn't valid by the client and we get a SSL error. So how do we deal with such a situation ? i.e allowing SSL connection to Github ( as an example ). I would be much obliged if you could answer me as to a completely noob.Thanks  

When creating a backup config file from a ipsec connected Forticlient and using that file to create a new Forticlient only the username shows up when installing the custom Fortlclient on a new PC.How to modify the config file that also the password is transferred to the new PC.We using Forticlient 6.0.10.0297.

Hi I  Have maybe a bug in my 6.0.14 OS   httpsd 18282 R 98.9 0.0dnsproxy 439 S 17.7 0.5ipsengine 598 S < 11.4 0.3updated 2059 S 11.4 0.2ipsengine 579 S < 10.4 0.3ipsengine 606 S < 10.4 0.3ipsengine 591 S < 10.4 0.3ipsengine 580 S < 10.4 0.3ipsengine 588 S < 10.4 0.3ipsengine 603 S < 10.4 0.3ipsengine 602 S < 10.4 0.3ipsengine 583 S < 9.3 0.3ipsengine 597 S < 9.3 0.3wad 526 S 8.3 0.4ipsengine 582 S < 8.3 0.3ipsengine 610 S < 8.3 0.3ipsengine 589 S < 8.3 0.3ipsengine 604 S < 8.3 0.3ipsengine 605 S < 8.3 0.3ipsengine 586 R < 8.3 0.3 This causes excessive slowness in the GUI - it happened only after i upgrade from 6.0.10 to 6.0.14 i tried this :fnsysctl killall httpsddiag sys kill 11 172  but it didn't help  What can i do more ?

Hello, I am wanting a layer 2 trunk (supporting 5 VLANs) across a dialup IPSEC tunnel.I will have two Fortigate 60Es on each end for the L3 IPSEC tunnel, then will use VXLAN for the layer 2 trunking.In theory this should be possible with FortiOS, correct ? Thank you.

Hi,I wanted to figure out the best way to add signatures to protect a particular service, and make sure I have everything included.For example how could I filter or IPS signatures to properly secure OWA? Or to protect web servers? Thanks

Hello Experts,  I would like to access one of local address in another local network but still no news. On Fortigate 80F(FortiOS v7.0.2)  I set something that  you can see below: Firewall address:edit "LAN-CUP-10.2.x.x/24"set uuid e1e4a43a-4234-51ec-1d33-78ef82b1ea54set subnet 10.2.x.x 255.255.255.0 config firewall policyedit 17set name "Any to CUP"set uuid cc69133e-6340-51ec-a051-06a9cb3d812bset srcintf "any"set dstintf "any"set action acceptset srcaddr "all"set dstaddr "CUP-Portal" "LAN-CUP-10.2.x.x/24" "Portal"set schedule "always"set service "ALL"set ssl-ssh-profile "Test for Portal CUP"set logtraffic allThere is also static route for destination network.  Inside the Firewall  I can ping 10.2.x.x/24 but from source network (192.168.10.x ) can not ping 10.2.x.x/24. Do you have any ideas? Thank you so much  Best,Ghasem  

Hi,I'm trying to figure out what could be the best solution to block access attempts to our SFTP server on a specific port (type 2222). The Dos policy seems to me a valid option, except that it presents some problems: putting a high enough threshold does not mean that all attacks are correctly intercepted.Conversely, putting a threshold too low can lead to false negatives.Could it be a solution to create a custom signature? In case I should somehow decrypt the traffic or am I wrong? How could this be done in your opinion?Thank you very much

Hello Experts, I have a one Fortigate ( 80F) with last version of firmware(FortiOS v7.0.3 build0237). I added some policies on it and installed it for our client. Our client claim that he can not access to their local server which is in same IP range, I mean for example from 192.168.1.2 can not access to 192.168.1.250. He claim that when restarting the Fortigate its working fine but after for example 5 hours again Forigate  dropping all connection and as result again he can not access to their server.  Have you ever seen this kind of issue? Could you please give me some advice?  Thank you, Ghasem  

Hi all, Base my need, I use reset button behind firewall to reset mine 90D.I can not login web UI (https://192.168.1.99) using default admin and without password after I reset it.It always show me password incorrect. Is there any good solutions to resolve my question?grateful thanksPoter

Hi,I have a problem with a job backup by the Automation Stitch.When i execute the backup by automation stitch i see this error: "Connect to ftp server 192.168.50.50...Error code 1: File not foundSend config file to tftp server via vdom root failed.Command fail. Return code -1" But if i copy and paste the command in the cli console, the backup work correctly.Any idea? Thanks