Solved

We deploy the FortiGate 400E as IDS to port mirror FortiGate FW.- ips license is enable on this 400E, but without web filtering license.To get http header raw data(request url, request method, user agent, x-forwarded-for,referer) from ips log.Am I able to get http header data if just enable extended-log in ips profile setting ?"set extended-log enable" Thanks in advance.Henry Xu

Hey guys, Can anyone please confirm if using VIP objects set with interface "any" is the issue? I talked to TAC and they are not sure, though fortinet guru site shows it should be fine. Any feedback is appreciated.

We've been using a FMG-VM about 7 months in production, which is now 6.4.8 running. But still see Auto-update happens to a few managed FGTs without any local config changes.Mostly seems to be harmless when I diff config revisions before and after, which makes me more specious "why needs to happen???". But when I upgraded those FGTs last time, about 30 of them at a time, 2-3 of them got an IPS sensor's content removed 5 - 60 minutes later after the maintenance was completed. TAC said that particular one was probably a bug but closed the case since I already re-installed the policy package and nothing to look at. And no explanation about the random auto-updates. Does anyone know the conditions an auto-update might happen? Toshi

Hello everyone,I have a design plan on my mind with one FortiGate 200F (or 100F) that will have the WAN from ISP Router. Then I will have 2  (can be 4 or more) FortiSwitch 248E. I am planning to buy these and make network infrastructure with. Our office has 300 employees, no VoIP phone (only Windows based VoIP). I don't want to chuck the firewall by using only Tier 2.Fortigate will all the routing to internet and the clients \ APs will be connected to switches. Is it helpful to connect every switches to the fortigate's interfaces (nt1.png) or should I put two switches as Distribution LAyer between fortigate and access switches (other switches) (nt2.png)?   I tried to draw diagram on Cisco Packet Tracer just to draw. disregard the switch models 2960 :)Every solution , suggestions will be much appreciated :)Merry Christmas and stay nerdy

Hi all,got configured IPSec tunnel it is up (phase 1 and 2) but no Outgoing Data.Policy from Zone (with vlan10 in it) to VPN tunnel configured, Static Route (with subnet I try to reach, and VPN interface configured) also.When Ping from computer with vlan10 I see deny and hit policy 0 in FAZ. What is the best practice to check why traffic is not hitting this tunnel or policy?P.S I have access only to my side of tunnel.P.S II. Is is possible that when my part of the tunnel is configured ok, policy and route also but on the other side of the tunnel something is missing tunnel will show up on 2 phases but will send no data to the tunnel?What's bother me is that there is O B in Outgoing data.FGT OS. 6.4.6

We upgraded to 6.2.10 after being on 6.0.13.  Previously you could disable and re-enable a policy without it clearing the traffic counters but now it clears the counters, bytes, first used, last used dates on a policy - why has this been changed? Is this the same in later firmwares? This was useful information and you may just be disabling a policy temporarily but now you lose the information if the policy has ever had traffic on the fortigate without searching logs and you logs may not be able to go back far enough in the logs.  Especially if you are considering deleting a policy it is good to know if it was last used 3 months/6months/1 year ago etc.  You could manually clear them right clicking and clearing counters if you wanted to.  Why is fortigate resetting this information now?  This was really good for providing information on the policy usage without looking at the logs. 

Hello, I just bought a Fortigate to migrate our entire Mikrotik network to Forigate and the following question arises:How can you have 4 Subnets on a single LAN port?Example:192.168.1.1/24172.16.50.1/24192.168.1.1/24

Hello we have a BGP WAN connection with two interfaces - primary and secondary. We use weighting and prepending on these to prioritise the primary interface over the secondary. See below config. We have just tried to advertise a statically configured default route out this pair of WAN interfaces by simply adding the command 'set-capability-default-originate enable' on each one (see attached screenshot). The default route was advertised. However this seemed to result in default route flapping i.e. BGP neighbours were sending default route traffic in to us via both our primary and secondary WAN interfaces (inconsistent behaviour). I do not understand how this could happen as we are using prepending on our secondary interface to force inbound traffic to only use the primary interface. Are there some commands we were missing on our WAN interfaces ? To clarify, we are advertising a default route on both our primary and backup WAN connections from this Fortigate because this particular Fort

 I cannot seem to figure out how to see the other Windows devices on my network if the device that I am on is connected to the firewall.  How to I enable NetBios broadcasts?

Hello All, I have strange issue with with Fortigate 40F using 7.0.3 (lastest version), the same was for 7.0.2.I have dual stack network on my home. Using IPv6 and IPv4 in paraller.Most of the Firewall rules are exact the same for two protocol versions. But funny thing is, whatever I'll change on my Fortigate, even description of the rule (even for IPv4), IPv6  traffic is freezing for 5-10sec and back to normal. The issue is even between LAN interfaces (on trunk, one VLAN to second VLAN).So we can skip WAN issues there. I have no clue how to document it (I have valid support), I can only record video when host using IPv6 are freezing, getting lags (IO timeout) when using NFS/iSCSI over IPv6. This situation as mentioned is for 5-10 and then back to normal without any action from my side. I wondering maybe this is related to ASIC offloading for IPv6, that there is a bug/issue with that? The IPv4 protocol is working fine, only IPv6 got freezee. It's hard

Hello, I am having some problems configuring IPv6 on FortiGate.My ISP provides me a /48 but wants me to use a static IP on a transport network (/126) on WAN, where my router is ::2 and their router is ::1. Can someone help me on this? I tried setting the ::2/126 on WAN interface, creating a static route to ::/0 from ::1 and manually setting a  /64 subnet on a interface but the interface is not pingable and I can't ping outsite from this interface aswell.

I would like to setup FortiAuthenticator and Fortigate to provide McDonald like WIFI access, when you connect, it pop up a disclaim page, and once user clicked "I accept", it grant the user access directly. Is this doable ? I have tried to use Portal policy with MAC authentication ( but doesn't really restrict any MAC ), it looks like FortiAuthenticator does send Access-Accept  to Fortigate, but there is no Fortinet-Group-Name radius attributes.  If I don't enable "Account registration" in Guest portal, there are new "social login users" created, but they can't be automatically added into a user group. Tried MAC group with device tracking enabled on guest portal, also no luck ( turn on device tracking doesn't add new social login user's MAC into the chosen MAC group. ).     

There is a way to upload a script via GUI: That script ends up here:  Is it possible to execute that script via the CLI?  ThanksDan

Would appreciate a response from Fortinet regarding the Apache log4 vulnerability if any Fortinet productis affected. Any information regarding updated IPS signature for CVE-2021-44228?

We have a Raspberry PI at one of our locations that I think is having an issue with VLANS and our Fortigate, I am not totally sure about this just suspecting.Here is the setupCampus 1 has a Fortigate 400E, switches are Extreme x440 with VLANS in place, the Fortigate does all the routing between VLANs and other campuses. The Raspberry Pi is on a VLAN that has rights to all other VLANS and campuses. The Raspberry Pi is located at Campus 1.Campus 2 has a Fortigate 600CSo here is what I have discovered thus far.If I connect the Raspberry Pi directly to the FortiGate 400E I can ping the FortiGate at Campus 2.If I connect the Raspberry Pi to a switch and put it on the correct VLAN I can ping the Fortigate 400E at campus 1 but I can not ping the Fortigate 600C at campus 2.We have gone through the steps to make the Raspberry Pi VLAN aware.Does anyone have any ideas about what might be causing this?

Hey guys, I was wondering and apologies if this sounds like a silly question, but, does forticonverter works in trial mode without a license? I was trying to see if I can convert Check Point config over to Fortinet, but it simply says "tunning" for last 3 hours and no progress. Any ideas? I attached a screenshot of it as well.

If someone is managing multiple FortiGates via the free version of FortiCloud, is it possible to verify that the IP signatures are up to date, to ensure that the log4j signature can be detected and blocked? Thank you!

When I want to view logs from Interface->internal they do not show up, from other subnets they show up normal

HiI've just update firmware from 6.0.14 to 6.2.0 and I found that 10 free VPN license on previous release is deleted.Now, if I need to enable 10 VPN SSL connection on new release, what do I do? What is EMS? ThanksMarco 

Hi Everyone,I'm facing an issue where on my FortiGate 100F (v6.2.3 build6188 (GA)) unable to create Virtual Server IP due to there is no Virtual Server tab under the Policy & Objects. I have multiple of servers and trying to create Virtual IP for those servers and load balance it. Anyone have idea what might be the cause of this ? 

On Fortigate firewall do we need to take any actions against LOG4J ?

Hello, We recently set up a Fortigate 6.2.5 device and set up IPsec VPN for external access for our co-workers. Now, I would like to block all incoming external traffic (or at least restrict ports and so on), but I could not figure out what interface should I add the rules to. I have tried adding some restrictions to WAN1 (incoming interface) > Internal (outgoing interface) but it does not seem to work, blocking rules are ignored, and no traffic goes through in the new rules. In our previous router (from a different brand), I could simply apply a rule to the WAN1 interface, and that's all. What incoming/outgoing interface should be set to restrict the incoming external traffic? Thank you for any help!

Hi,Im running 600e appliance in my main branch.All branches connected with MPLS and doing NAT to the internet from the main branch.Last week I configured BGP with my ISP and advertised all the local subnets in my MPLS topology, and so far everything works fine. The ISP just installed a secondary backup link for the BGP and another pair of IP addresses (customer IP, and ISP neighbour IP for me to set) I'd like to know how should I configure the backup BGP link, I want to make sure the Fortigate uses only the primary link when they are both available.I'm supposed I have to change costs or something ? Very much appreciate,Thanks.

Hi, we have deployed a Fortigate cluster on AWS cloud, mostly used as a VPN/NAT-Gateway. Now as you usually have no network layer 2 on AWS, there is no ip/mac failover. As the cluster members are deployed in multiple subnets/availability zones, the interface config on each cluster member is unique, with different ip addresses and subnets. Failover is done by Fortigate using the AWS api and modifying route tables and elastic/public ip assignment. So far so good. As a consequence of the above, you have to exclude some configuration items from the configuration sync with the ha peer, namely the interface config and router static config (by default also vip configuration is excluded). As we will do definitely DNAT in our VPNs, I have removed the exclusion of the vip already. But interface config and static routes must kept excluded. Now to the issue with this: For each VPN you have to configure some static routes pointing to the tunnel interface. But now with stati

I have a pair of 200e that I'd like to get into an HA pair. My issue is that I will not be able to cable the passive one the same as the primary for a few months because reasons. I want to link them via the HA port so that the primary unit automatically sends the config to the 2nd and in case of complete hardware failure, anyone on the team can just move the cables over and the unit is ready to go. Is this possible?  Is there another solution to have the configs mirrored to each other?