Solved

HelloI have two fortigate devices 500E and 600E ... I know in this case that I can't benefit from HA..So right now I'm just using 600E in my production network.Is there any way that I can get the most of these devices together ? Thanks

I have multiple FortiGate running v6.4.8 with FortiAnalyzer (VM) v6.4.7 for logs. I am planning to upgrade the FortiAnalyzer (VM) to v7.0.2. Wanted to know if there will be any logs that may discard on the FortiAnalyzer when FortiGate running v6.4.8 FortiOS? Due to the existing FortiGate model that does not support  to v7.0.x wanted to check on this.

Authenticate with user/pass vs access_token. I have succeeded to authenticate with a user/pass against the Rest API where i put the username/secretkey as the payload in the body with a POST method. Have also succeeded to authenticate with the access_token with a GET method by appending the access_token in the URL (with ?access_token=<token>).I would like to authenticate with the access_token, but put it in the payload as a POST-method. Because when authenticating with the access_token in the url it will not be encrypted over the https tls channel. So, my question is.. how do i authenticate like the above username/secretkey but with the generated access_token (Rest API key) instead?I have tried to replace the password with the access_token, but do not work. Thanks in advanced 

Hello...I used to have one WAN line that handles all the traffic to outside... Recently I added another 2 lines which I combined as an SD-wan interface, and when trying to configure static route I got the message:"you cannot have duplicate routes on SD-wan and non SD-wan interfaces" I need to keep the first WAN interface separated and don't combine it with the other two inside the SD-wan interface... What should I do to accomplish this ?? Thank you

Has anyone else seen this?I am running a regex match against the word Fortinet, the OID response to .1.3.6.1.2.1.1.1.0 comes back with the Description entered, which is against most of the SNMP standards I have ever seen.I am running 6.0.9 on the hardware in question.   Models tested:500D, 2201E, 60F, 100FCan anyone confirm this?It would appear to be a bug?Thanks for the assist

Hello, I am new to fortigate.  For model numbers such as Fortigate-60, Fortigate-80, Fortigate 100, does BGP come with these devices?  The spec sheets do not have routing protocols. thank you,

Hi all, I have problem with several objects on FortiManager:These objects I used for SSL-VPN and I decide that remove that option.So I remove SSL-VPN settings, and also all settings in policy package but when I trayremove users, user groups and LDAP Server, I receive information that objects is used somewhere. When I click to see where is object used, I get No record found and I cant remove that object.How can I delete these objects at all? Thanks        

I saw several similar problems on this forum, but not exactly like this.So, I have: ISP1, ISP2 ,ISP3 links. First two are in sd-wan mode. And I used it for surfing. ISP3 used for business network. My branch office used vpn site to site, and connect over ISP3. My static route is:0.0.0.0 -> sd-wan x.x.x.x -> ISP3... other routesx.x.x.x is branch office ip but dynamic change every 24h. So tha vpn to work I have to manually change the address. And this is a problems.1.  I try replace 0.0.0.0 -> sd-wan with 0.0.0.0 -> ISP3 and set SD-WAN in Policy Routes. But I cant add SD-WAN interface in Policy Routing Rules. Only per interface. So that is not solution.2. I try add ISP3 to member sd-wan, and used sd-wan rules. But If I make this, I cant use independent interface ISP3 to Firewall Policy. Also not solution. Before Fortigate I used Checkpoint, and that vendor have option to set outgoing interface for vpn, independently of static routes. Is there anyt

Hey guys,I'm trying to create a new IPsec tunnel from my FortiGate using a costume selections.For some reason I cannot create the tunnel itself and I'm getting a red box over my phase 2 selectors.I tried using the specific addresses I wanted and also 0.0.0.0 as local and remote addresses but still getting the same red box with no error.What could be the issue here?Thanks!

Hello,   I have recently taken over a site that has a Pair of FortiGate 100F's (6.4.8). Looking at the GUI I see VDOMs are not enabled. When I query the Sys Global Full Config VDOM-MODE is set to NO-VDOM.  However when I query the System Interfaces I see that the MGMT Port is not on the Root VDOM. I believe the prior person manually set this and setup IPs so he could manage each unit separately via the MGMT Port as each has it's own IP and HTTPS and Management enabled.  Is there some documentation on setting this up or did he just do this himself. Is this a viable config or will there be possible issues to look for?

Hi, relatively new to the world of PCI compliance as well as certificates and need some advice. A PCI scan continues to fail with the certificate connected with port 8013 being the issue. I cannot for the life of me find the service that runs on that port to either shut it off or correct the certificate issue. Any help is greatly appreciated.

Hi Experts,I am new to this community and would like to ask for help and advice from all the experts out there.Has anyone here already encountered an unexpected power-off and when you check the event logs it the power-off shows 15 minutes late. I have a Firewall that suddenly went down at 2:15 PM then went UP again at 2:30 PM. When I check the event logs it shows that the Fortigate had experienced an unexpected power off at 2:30 PM which is 15 minutes late.Best Regards,

Hi, recently I made update of my FortiGate's 60E working in HA.I notice after update has changed MAC address of Hardware switch, Internal1 where got connected all VLANs, from something like xx:xx:xx:09:00:12 to xx:xx:xx:09:00:03.Is it normal, or I missing something. In cluster, Primary Fortigate after update is this same Fortigate.I'm curios because we had also EMS, and configured On-Fabric Role Sets with Local IP/Subnet and MAC, and after update and MAC change some FortiClients think are off fabric because of MAC not right.

Hi! We use Fortigate 6.4.6 and we didn't upgrade to 6.4.7 and 6.4.8 because we use a collector fsso agent in ldaps.  It seem strange to me that it cannot work for the last 4-5 month, and I see almost nothing on internet around this problem.  Is it under other specific condition? Thanks

I am having a weird problem with a testing FAC instance. It's a VM with private IP 192.168.1.109. It's in a isolated environment and I am using a jumpbox machine 192.168.1.100 to access it.  The issue is if I access it by https://192.168.1.109/ , it's fast ( will show me a certificate warning as expected ); if I access it by https://fac.mydomain.local/ ( no certificate warning because the certificate is generated by a Windows CA and the root CA is trusted on the jumpbox),  it's very slow. The VM is configured as Host Name: "fac", Device FQDN: "fac.mydomain.local" . fac.mydomain.local is added into Windows hosts file map to 192.168.1.109.  Chrome Browser dev tool shows lots of requests took 5S~10S to load :same "dashboard/" request only take 200ms if I use IP to access it. I can refresh the UI and got same result.   

Hi everyone, I’m faceing a strange issue on a FortiGate. I have two 100F running in an A-P HA Cluster. I have an aggregater interface connected to a Cisco Nexus 9K. The LACP between the Cisco switch and the 100F FortiGate is up and running. I’ve created serveral VLANs on the aggregated interface. They are working perfekt. Today I added another VLAN interface to the aggregated link on the FortiGate. I’ve confirmation that the MAC andres of the VLAN interface is pressent and detected on the Cisco Switch. However… The L3 IP that I have configured is up/up on the FortiGate, but I’m unable to ping the interface from the FortiGate itself. After some basic troubleshooting, I came across that the IP/network of the VLAN interface doesn’t show up under the locally connected part of the routing table. I’ve been unable to solve the issue so far. By the way, I’m running FortiOS 6.2.9.

I have 2 FortiGate 51E's that are at remote sites but connected together using a LAN port on each firewall, connected over an ISP provided LAN Extension. Both of these FortiGate's are on the same private subnet and talk directly to each other. Is there a functionality available where I can let each device discover each other? Connectivity and traffic routing is working fine, I was just wondering if there was a similar functionality like the Managed FortiSwitch interface where I can see each hardware device connected to each other and was wondering if that was a thing, and if so, what other additional functionality would that provide? Both FortiGate's are running FortiOS v6.0.12 build0419 (GA)

We have a splitted subnet: LAN2: (physical interface)172.29.6.1/255.255.255.128 for FortiAP's Wi-Fi SSID:172.29.6.129/255.255.255.128 I have connected a cabled physical device and given static ip details:ip:  172.29.6.201gw: 172.29.6.129sub: 255.255.255.128  Was hoping I could reach this device from the Wi-Fi clients, but no good. All good when connected to cable though. Where am I going wrong here? -PM *edited LAN1 to LAN2

Hello, I'm attempting to access an old FortiGate 90E that I had setup. I hooked up the console cable and was able to access it via putty using my old credentials. I attempted to use the command found in some documentation.  CLI Commandshttps://help.fortinet.com/fauth/5-3/Content/Admin%20Guides/5_3%20Admin%20Guide/200/204_CLI_commands.htm  It seems like this command wasn't recognized.  Here is the version of the firewall. I'm pretty certain the firewall used to be configured so that someone could access the GUI through one of the ports on the firewall, but I cannot remember which port it could be. Is there a way for me to list the IPs each port is assigned to? What is the best way for me to access this firewall without messing up the configuration to much?  Thank you! 

Hello!Happy new year! We have many fortigate devices and I was wondering if there is a way to generate an alert email when a hardware or software event appears.For example:- CPU utilization above a threshold- Memory utilization above a threshold- A service is stopped anormally If I set "Severity based" alerts, with "Critical" we get a lot of messages, many unnecesary for usIf I set "Event based" alerts, I dont have an option for this kind of event. If not, probably, is there a way to change level for some event types?I have seen a previous post similar to this but without a solution. Thanks in advance.Regards,Damián

Hi, I just upgraded my 100E to 7.0.3 OS release. What I see is that the dial up IPSec created with wizard for native win client doesnt work anymore?I can connect but can not reach anything on the other side. When I roll back to 6.4.8 everything is working fine again.Any idea what has changed and how to resolve it? I have all policies set

Running the latest firmware on a 80f and when I try and generate a cert using let's encrypt it works but give me a STAGING cert. I have another Fortigate (60f) that I setup like 2 weeks ago and it generates a normal one. I tried downloading the CA cert from that one and importing it in  on the one that is STAGING and removing the STAGING ACME certs and it doesn't work. I still generates a STAGING cert. I know that you can specify the STAGING Cert to verify everything works before you setup a geniune one but I don't need that. Does anyone know the command to specify the cert?

Since some days there is a "Fortinet Webfilter".And it is blockinig pages, I want to go. I get the message:FORTINET WebfilterThis Connection is Invalid. SSL certificate expired.A secure connection to pincoya.de cannot be established.When you try to connect securely, sites will present trusted identification to prove that you are going to the right place. However, this site's identity can't be verified.Sitepincoya.deCertificate CN*.pincoya.deCertificate AuthorityR3Certificate ValidityNot Before: Dec 6 18:17:34 2021 GMTNot After: Mar 6 18:17:33 2022 GMTCertificate Chain-----BEGIN CERTIFICATE----- I dont know, where this "Fortinet" comes from. I dont know, how to operate this "Fortinet".And I dont want it! So - how get I rid of it?Please answers for dummies! 

Hi All,Is there a way to remove a firewall from the FortiManager through CLI or any other way? Currently our FMG is bugged, see the picture below.  

Hi All, Can someone tell me how can we block personal Zoho mail login via web filtering policy.