Solved

Hi, Is it possible to change Fortiauthenticator management access port from 443 to other? Farooq

Hi, everyoneHow can I change the value of Default Distances I would have to change the DHCP value, which is moderately default to 5 and static to 10. I would like to set DHCP to 40 or higher. Anyone know how I can change that? many thanks for your help.

HeyHow can i add admins account on FORTISWITCH through CLI? what is the commands? Thanks

Hi guys,I hope you can help me as I am just too dumb right now. My setup looks like the following:2 sites, both with a Fortigate for WAN connectivity and between the sites are 2 L3 devices connecting the sites with eachother. Site1 has Area 0 and other areas directly connected to the L3 switch and area 0 is also used for OSPF connection to the Fortigate. The L3 switch inject default route to the other site - connected by OSPF stub area.The second site has a L3 switch as well, connected with the same stub area to the firewall there.The plan is to use the default route from site 2 fortigate for all site a connected devices (so Fortigate Site 2 needs to inject its default route into the stub and overrule default route from Site 1). In case of failure or health links jitter is too high, the default route should be discarded and now Site 2 should take the default route injected from Site 1.For testing purposes I even disconnected Site 1 from Site 2 but still on my L3 switch I cannot get the

i have some local VPN users in my fortigate firewall.We need to change them to radius authentication, is there any way to change in CLI instead of re-creating them in GUI ? edit "user"set type passwordset two-factor fortitokenset fortitoken "FTKM9E3E"set email-to "email-address"set passwd-time 2021-09-21 11:18:52set passwd ENC password 

Hi , i have turn on Deep_Packet_Inspection on my lan to outside , i havent  moved my whole network behind firewall so some part of network is behind firewall some isnt , for example my vCenter is not behind firewall yet , i have put Deep packet inspection on my lan to all outside traffic, and i have imported the firewall certificate, i dont have CA server .  the problem is when i log into my vcenter, i cannot use VMRC consol, it says SSL negotiation failed , i have imported firewall Certificate onto vcenter, but still same thing , any idea or solution ?   i have also added Vcenter in the exempt addresse it only helped me to open the vcenter it self, thanks in advance

Hello,I currently use an analog PBX. I have a PSTN connection to the router, and from the router the PBX is connected to the phone port. I currently have 6 VoIP lines for my PBX and all of them go through this route to the analog PBX. I want to transition to Fortivoice, and I am thinking of getting the Fortivoice 100E. The thing is that this model does not have any FXO ports to connect the analog line to it. Since the lines are VoIP, will it be possible to connect through ethernet from my router to the Fortivoice and have telephony like this? Thanks a lot in advance.

I' m trying to figure out how to backup over SCP. I' ve enabled ' admin-scp' in config sys global, but am now trying to actually figure out how to use it. Anyone able to get me started? Thanks.

After deployment Win10 x64 (with preinstalled FortiClient 6) I have in FortiClient Enterprise Management Server console all my computers with one serial number and UID2.How I can change this (SN or UID2) to split my computers in FC EMS?

Good day, I'm setting up a Tacacs.net server to authenticate all our FGTs and it's working fine.But, when a diferent (TacacsUserGroup) tries to log in a FGT which doesn't have configured it's (TacacsAdmin_profile), it logs in as a super_admin instead of denying access. Tacacs.net config for that group: <Service><Set>service=fortigate</Set><Set>memberof=FGT_access</Set><Set>admin_prof=csu</Set></Service> debug fnmbad [705] parse_author_reply-Authorization arg0: memberof=FGT_access[705] parse_author_reply-Authorization arg1: admin_prof=csu // This profile doesn't exist in the FGT.[709] parse_author_reply-Authorization result=2[788] auth_tac_plus_result-Passed group matching[1059] find_matched_usr_grps-Group 'tacacs_access' passed group matching[1060] find_matched_usr_grps-Add matched group 'tacacs_access'(2)[217] fnbamd_comm_send_result-Sending result 0 (nid 0) for req 637653419, len=2000[747] destroy_auth_session-d

I have Fortigate 200b unit. I want to give an access to my internal web server to users outside. I read documentation about a port forwarding. But I have a small question. The VIP address can be the same as the external address of the interface ( the interface that connects your FortiGate unit to the Internet)? Thanks in advance for your reply

hello Two questions please: 1- What does it means the default action in the antivirus profile ? what if I select "none" ?"see screenshot" 2- What is the recommended version and is there any path to upgrade from 5.3.3 to the recommended version ?  

Hello all, I've had a look through the documentation, but can't find any information about what URL access forti sandbox needs to function properly. We'd like to lock down the internet access the devices have, but need to make sure we don't cause any problems. Can anyone point me in the right direction?

Hi there, i got a problem with a Fortinet FortiGate 60C. I saved my configuration and after that i restarted the fortigate, using the console port (and putty with an opened COM connection) i managed to format the boot.After that i'm unable to connect to a TFTP server because it seems that NO port are working (WAN1, WAN2, DMZ, 1to5)Now i'm unable to boot and unable to connect to a TFTP server to flash the firmware again. Is there any solution?Thanks

Hi,I have a 40F and want to use it for websecurity. At the moment I use a PfSense firewall with 2 internet connections and a 4G backup. Because I don't want to configure everything new at this time (homeoffices, second branch connected via Wifi, Vlans etc...) I only want to secure the traffic to our terminal server as everybody uses this server for webbrowsing.TerminalServer is 192.168.100.2PfSense is 192.168.100.169.I set the Lan address of the FG to 192.168.100.168, set a route 0.0.0.0 to pfsense (192.168.100.169) and changed the gateway on the server to .168. This works for outgoing traffic, but not for incoming traffic. I also created on the pfSense a default route for 192.168.100.2 -> 192.168.100.168. But this did not help.I think segmenting the subnet would be an option, but .1 is taken and connot be changed, alsochangeing   the address of the TS would be a lot of work.  Can anybody tell me if it is possible what I want to do and how? I know this is not bes

HelloCan i configure FORTIGATE in order that internal LAN interface on PORT1 (VLAN30) of the FORTIGATE can comunicate to the builtin DMZ interface (no VLAN)?I setuped IP 172.16.30.1 on LAN (port1) and 20.20.20.1 on DMZ Interface but im not abble to ping from LAN to DMZ (i have INTERNET on both interfaces)....what could be the reason?thanks

Probably a dumb question... I only want to access my fortigate through VPN. I am using the forticlient to establish a SSL-VPN connection. How can I then access the Fortigate web admin Gui? What IP do I have to enter in the browser. Do I have to configure other setting? Thanks. 

Hello All, I was looking for a little clarity on the behavior of using a deny policy. The goal is to deny a subnets outbound traffic to a specific service, for example http. When you set the action to deny http does that same policy implicitly "allow" all other services? 

Why is this so hard? I have a 60e 6.4.8 FileZilla keeps coming back with Port command tainted by router or firewall.Machine is in a firewall rule that allows ALL.Deep packet inspection on all ports. Also tried it with no packet inspection and no security profiles at all, just for giggles.I was reading online about a service FTPoverTLS. I don't even have that service. But again, ALL is allowed.I'd hate to open a ticket on this, it seems like it should be easy enough.Any help would be appreciated.

Hi All, Can the Let's Encrypt Certificate (using ACME) be used for SSL deep packet inspection.  As of now, we are using Fortigate Self Signed certificate for SSL Inspection. But it is difficult to manage certificate installation for the guest users. 

I try so much times and always display error. Could anyone help me to solve this problem, or provide some document to reference? Thanks a lots!  FortiAuthenticator 

Hi, I'm trying to add some local and remote addresses on my VPN Tunnel Phase 2 Selectors and after I added all of them, I've encountered a red box when saving it. Is there any limitation or any incorrect configuration happened?

Dear people can somebody explain me the marked bold places: 2021-12-22 11:44:37.472461 VPN-TU -- 10.99.19.12 -> 10.15.12.1: icmp: echo request2021-12-22 11:44:37.504576 VPN-TU -- 10.15.12.1 -> 10.99.19.12: icmp: echo reply2021-12-22 11:44:37.508988 VPN-TU -- 10.15.12.83.40820 -> 192.168.40.53: udp 292021-12-22 08:53:50.466435 VPN-TU -- 10.15.12.83.52751 -> 10.15.12.109.9100: syn 638097597I will analyze the traffic over the Tunnel to reduce the traffic to the necessary ports on policys.So I am not sure, what does it mean exactly, and wich policy are necessary to get a hit on the right policy.Thanx a lot! 

Is there any fortiswitch OS image available for the EVE-NG lab?

HI guys , I Have FG200F   , after turning IPS on  our LAN ,Anydesk has become very slow , it takes ages to connect , but after when i turn IPS off , it works correctly ? does anyone have any idea to use IPS and still be fast