Solved

Hello, the following feed is discontinued.Anyone can help me? thank you   

Dear community My question is:Does a VRRP-IP (the "gateway") generally answer to ping/icmp requests (or not)? We have four fortigates in two datacenters (in each datacenter is an active/passive cluster). On each of those clusters are the same vlans configured and we spanned vrrp over these vlans.The goal is, that everything does to one datacenter, until both fortigates in that datacenter (or the whole datacenters) goes down...and then the vrrp-ip should go to the second cluster in the other datacenter.The ip addresses of the fortigate clusters temselves in those vlans are answering to ping/icmp as expected (because it is configured accordingly). However, the customer claims that the vrrp ip in the vlan is not responding to IP.We still are investigating, but I just want to ask whether the vrrp ip in general is supposed to answer to pings or not (to make sure we are not chasing ghosts here :)). Thanks for your helpscheuri FortiGate 

Hello, I don't understand  when to set or unset the NAT button. I have two servers on my LAN that are reachable on the same WAN with port mapping from WAN adress IP: port_to_translate to  LAN IP: port_translated.On the first server I have a SSH server without the NAT button set on the Policy  and it works.I can access the server from WAN.On the second server I have a web server ( node.js) but I have to  have the NAT switch set on.If the switch is off , I can't access the server web. In which case in port translate I need to turn the switch on or off in the policy?Thank you. Félix 34           

Hi Teams, Is there a way to show ip address on spoke tunnel interface when enable "mode-cfg" on hub and spoke site?  The Spoke has assigned a ip address from hub but no command to show.

Hi everyone!I have FG300 and FMG version 6.2.7Such a problem has recently emerged:I change the interface settings on the device, in particular, add networks to the exceptions on the captive portal. Apply this.      config user security-exempt-list     edit "DMZ-exempt-list"     config rule     edit 1     set srcaddr "DMZ Subnet" "gatchina" "IPsec subnet" "main" "medical equipment" "mgmt" "phone" "printers" "Remote access" "servers" "other devices network"     next     endEverything passes correctly. Next, I change any policy (only policy, not device settings) I apply changes and eventually get that the interface settings are returned to their original position!config user security-exempt-list2: edit "DMZ-exempt-list"3: config rule4: edit 15: set srcaddr "DMZ Subnet" "gatchina" "IPsec subnet" "main" "medical equipment" "mgmt" "phone" "printers" "Remote access" "servers"6: next7:

I am trying to upgrade my Forti Analyzer 200D appliance box firmware from 6.0.11 but i cannot seems to find the firmware from fortinet support download site ?does it means the  Analyzer 200D is EOL ? 

I have the following setup: FortiGate > FortiSwitch > FortiAP. So far I have been managing FortiAP through FortiCloud just fine. I now want to transition to managing it from the FortiGate. First of all, will the FortiSwitch that is in-between create any problems? But most importantly, when I add the FortiAP to the FortiGate, will the settings (SSIDs etc.) of the FortiAP stay? Or will the FortiGate enforce some default AP Profile, potentially removing the configuration of the FortiAP?  Thanks a lot in advance!

Hi, I'm running a FortiManager in v7.0.2, we have preconfigured "Firmware Templates" to centrally schedule Firmware Upgrades on the managed devices. Now that the new FortiOS 6.4.8 has been released, we would like to upgrade to this version.Unfortunately, I have no way to select this FortiGuard image in my corresponding firmware template.My databases on the Manager look current. Do you have any tip for me? Thanks!

I'm new to Fortinet/Fortigate and am using a 40F as a lab learning device. I have just a few configs that is causing the push install to fail. All it is :config system interface2: delete "lan3"3: delete "lan2"4: delete "lan1"5:endAll three error out with message: "The entry is used by other 1 entries.  Command fail. Return code -23" So how do I undo these commands?  I can't figure it out.

Hi all, We need dual access to a subnet: LAN (MPLS) and IPSEC VPN (Fortigate v6.0.7)If LAN (MPLS) fail, IPSEC VPN get UP as fail-over. Example in route:  S 192.168.1.0/24 [10/0] via 10.10.10.5, LAN (MPLS)  [10/0] is directly connected, VPNtunnel (IpsecVPN), [50/0] Exmple Link_monitor:  config system link-monitor  edit "Monitor_subnet_1"    set srcintf "LAN"    set server "192.168.1.x"    set gateway-ip 10.10.10.5    set source-ip 10.x.x.x    set update-cascade-interface disable  next That work fine, but when we add another subnet:   S 192.168.44.0/24 [10/0] via 10.10.10.5, LAN (MPLS)  [10/0] is directly connected, VPNtunnel (IpsecVPN), [50/0]  edit "Monitor_subnet_44"    set srcintf "LAN" *****    set server "192.168.44.x"    set gateway-ip 10.10.10.5    set source-ip 10.x.x.x  &

With AnyConnect it is possible to authenticate to RADIUS and let NPS handle which group-policy/tunnel-group the user should receive based on their rights in NPS. Is this possible with Fortigate SSL-VPN and is there anything special needed to configure this besides the NPS itself? I can't seem to find any documentation about this type of implementation.

Hi Team,  i am trying to configure the fsso with agent collector.Infrastructure:- 2 sites with 1 FGT40F (v6.4.7) per site- 2 AD with DC Agent- 1 Collector Agent per site (advanced mode) For some workstations, authentication is random.I am thinking of the laptop that opens the session before being connected to the company network? So I wanted to possibly do a redirect to the authentication portal if the user is not authenticated.I tried to apply the method with set auth-method always and 2 rules.But I don't get the portal. I also need to check that ports 139 and 445 are open as well. Do you have any suggestions or recommendations? Thanks for your help Julien

Hi all, I struggle through every step with these routers, very sorry for the noob questions but please be gentle, I don't really know what I'm doing here. So we were quickly exhausting our single class C network and I decided to run another line from the Fortigate 60E (is that a vlan or a subnet, not sure) to a new switch and give myself another 200+ addresses.  Main net is 192.168.1.0, and I made the new lan 192.168.3.0  I have the fortigate set as the DHCP server for this new segment and so far I've fought my way through to a point where clients pull an ip and can communicate internally and externally. I can ping from a 192.168.1 machine to a 192.168.3 machine, but if I try to remote in by machine name, it fails, so I have a dns issue for sure.  I have the new LAN dns set to our DC at 1.10 I'm also a little worried about security, as I basically just added policies to open everything up between the two LANs and between the wan and new LAN. I'll

Hi there, We're seeing a strange issue with the SNMP data from our FortiGate 1500D firewall.We're running version 6.4.4 and using SNMP V3. Basically it seems that the Octet data isn't being captured on our 10Gbps WAN link when under load.We have a 1Gbps WAN link and that graph is consistent and accurate. We also have some 100Gb switch links being monitored by our SNMP data gathering server, and those are all true as well - so I don't think it has anything to do with the link speed or throughput. When we load up the 10G link you can see the graph information is missing from our SNMP data gathering server, but not from the dashboard in the web interface of the FortiGate. Please see attached example photos.Disregard the Units on the 10Gbps link, just a formatting error from the graphing system. Here is the 1Gbps WAN link with no issues of missing or incorrect data. Here is the 10Gbps link that while under load is missing information and incorrect data rates.2

I am diving off the deep end going to TCL scripting for handling the provisioning of a series of remote FortiGates.  I've been working on the script in parts and while I was trying to figure out some of my input logic, I kept on getting script failures.  Unable to figure out the problem, I put up a very, very simple script: #!puts "Testing ..." I expect that this should just do a simple output of the one line and be done with it.  However, this does not happen: The log is here:  -------Executing time: Thu Nov 15 09:53:02 2018----------- Starting log (Run on device) ----------------End of Log-------------------------  The task history is here:NamePercentDescriptionEVO-0002-RT1(TCL-Test)0%2018-11-15 09:53:02:start installing script TCL-Test to EVO-0002-RT1EVO-0002-RT1(TCL-Test)5%2018-11-15 09:53:04:init state: start to get checksumEVO-0002-RT1(TCL-Test)30%2018-11-15 09:53:08:premagic state: start TCL script fileEVO-0002-RT1(TCL-Test)70%2018-11-15

I can't seem to block users from downloading .ZIP files in my environment. I configured the file filter, and the logs show that it works well with detecting and blocking .ZIP files over HTTP, such as some antivirus definition updates.This can't work for me as most online traffic is HTTPS and the file filter seems unable to detect when a .ZIP file is being downloaded over HTTPS.Am I missing something with configuring the file filter to detect and block when a user is downloading a .ZIP file using HTTPS?Is there another feature that I am supposed to use that I am missing? 

Hello, I have a single public IP address on my Fortigate.If I configured an IPSec tunnel using this address, will this interfere with my regular Internet bound traffic and incoming VIPs that also share this same public IP address ?Or should I ask the ISP for an additional public IP address for my IPSEC tunnel ?Thank you.

Dear community,  Trying to integrate FortiGate with Zabbix, so I can monitor the Firewall, however, not being able to find instructions on how to do it.  Can someone please provide information in regards this integration? Thank you,Laura 

Hi everyone,Im trying to manage new APs with Fortigate Wireless Controller, but without success.Firstly I enable CAPWAP and DHCP Server on Fortigate interface(Fortigate <-> FortiSwitchPOE <-> FortiAPs)Fortigate: v6.0.8 build0303 (GA)FortiAP-U231FFortiAP-23JFI made a packet capture on Fortigate Interface and i have CAPWAP Discovery Requests from FortiAPs to Fortigate.On config wireless-controller wtp-profile  I cannot see those AP models.What should i do? 

I am using multiple Fortigates of different models at work. In my 501E (FortiOS 6.4.7) I am deploying about 80 traffic shapers to manage my traffic, but on a newly acquired 100F (FortiOS 7.0.0) I can't manage to create more than 30 shapers. My Question is :- Is there a relationship between the model or FortiOS version to the number of shapers allowed ?- Is there a way to create more shapers apart from creating a new VDOM ?

I inherited cluster Fortigate-600D from previous admins, which says that the Hardware version is FortiGate-600D Low-Encryption (LENC), and Firmware version is v5. But, first of all, I don't understand why everywhere I look (web, console) shows exactly v5, and not according to the normal type v5.0.2. Secondly, when I click check for updates, it says "No new firmware versions are available" there.I could do a sequential download of each next version to gradually upgrade to the highest possible version, but first I want to be sure.

Hi Team, Who have put the sentinelone connector for fortinet? Have you a experience and recommendation for that?I have not found information in kb and technical documentation in the fortinet website. Where can i find the connector sentinelone ? Best regards, Julien 

Hi, I will migrate a juniper to a fortigate, but my customer use some of default service MS-XXX on his juniper (the definition of these services are here : http://kb.juniper.net/InfoCenter/index?page=content&id=KB12057 Is that possible to define the UUID on service on fortigate ? I didn't found this informations at the moment.. Thanks! Lucas

Sorry, probably this is a dummy question...Obviously, I'm not so good with ADVPN and I also just started learning FortiGate as I got my first FortiGate and trying to build some network.I'm not sure if it's possible and how to make split tunneling on my FortiGate. Our HQ doesn't have that good internet connection and I wouldn't like it that we have more troubles when we add all planned BO. For easier configuration, we chose to use ADVPN with BGP.Btw. We have two BO with a second WAN that uses LTE (no public IP) and at the moment that BO has configuration on some Cisco routers to combine two WANs for better connectivity.Thank you!

Hi all, I have a LAN connected to the internet using a FortiGate 60D.Clients gets an IP Address from DHCP on the the scope of 192.168.1.101-130. When a client gets an odd ip (ex. 192.168.1.101, 192.168.1.103, 192.168.1.105, etc. ....) they can connect to the internet without any problem. When a client gets an even ip (ex. 192.168.1.102, 192.168.1.104, 192.168.1.106, etc. ...) they can NOT connect to the internet. their DHCP lease looks fine. they get a default gateway and all other configuration and they can access the LAN but for some reason the FortiGate blocks them from going on the Internet. They can ping the default gateway but not any hop behind it. As a temporary solution I excluded all even numbers from the scope. Any ideas of what can cause this behavior?