Solved

I need to connect my FS-124F or FS-148F Switch to a Broadcom 57416 SFP+ Network card. This will be for a future server purchase but i currently have servers at my location using the same NIC which has an open SFP+ port (the other is using a Dell twinax/Dac cable connecting back to a Dell switch) and want to test with a spare FS-148F ahead of my project start. I have tried 2 different aftermarket Twinax/Dac cable brands with no luck linking. One was 7m and other was 5m . Has anyone had any luck with a particular aftermarket DAC cable to link between the FS-124F or FS-148F with the Broadcom network card? I know FOrtinet lists a 7m DAC cable but not sure if those are just to interconnect Fortinet switches or they are generic enough to connect to Broadcom nic...plus the Fortinet branded cables are outrageously expensive...

Do u know if it's possible to use a Let's Encrypt-generated certificate into the FortiGate for the VPN Portal?

Hi, guys, The company Fortigate is configured the SSL-VPN Settings 'Limit access to specific hosts'. But boss wants to SSLVPN to company from anywhere, is it possible to configure the specific user exclusive to this limit ? Any advice ? Many thanks    

Hi ALL, We have a FG100D which is temporary set as internal firewall, I saw Fortinet has a guideline of how to manually update the signature for AV, IDP... but actually I can found the browse button to select the downloaded files. My FG100D is installed with the latest version of it (v6.2.4 Build 1112), there has no any way to upload the files for manually updating the db in FortiGuard page, does anyone know the proper way to do so? Many thanks! 

I have  Fortigate VM Eval 6.2.3 with these configsconfig system interface edit "port4"    set vdom "root"    set type physical    config ipv6    set ip6-address 2001::1/124    set ip6-allowaccess ping https ssh fgfm    end    next endconfig system dhcp6 server edit 1    set dns-service default    set domain "domain.com"    set subnet 2001::/124    set interface "port4"    config ip-range    edit 1    set start-ip 2001::    set end-ip 2001::f    next    end    next end GOAL:-set up dhcp6 server in fortigate QUESTIONS:1. how do I know my local ipv6 address using CLII can't see using "show sys int ?"2. where in dhcp6 server stated my gateway ipv6 address. tq

Hello, We are suffering the following issue: We have a Fortigate 100E and was working ok until some users reporting us that they can't access to a web of a bank, we did everything, tried with DNS of fortigate and google and others, even let the navegation without inspection or any shield and nothing worked to access to the page. Finally we created a Policy Route to give access to the web site and this worked but with the pass of the days it has growing the amount of web sites with issue to access. We thought that adding the sites to the Policy Routes it was enought but isn't. We have no access for example to Bank of America in no way. Its like if simply that's sites doesn't exist to the fortigate and every day added one more to that issue. Thanks in advance for your support. 

Hi guys! On our FortiWiFi unit, we're having trouble getting DNS resolving across two internal subnets. Internet works fine on the WiFi and the LAN, and we can access the LAN subnet from the WiFi and vice versa, but cannot resolve DNS. I've tried searching through the Cookbook, watching videos, but can't find any clear guide as to how to set this up. Our FortiWiFi is running firmware v5.6.2, and I've already enabled DNS Server from the Features. Port1 (LAN) = 10.0.0.1/24 WiFi = 192.168.0.1/24 We're not running a corporate domain in our office, and have no on-prem servers (only small, no need). I've tried setting up the DNS Server a few different ways, but cannot get this to work. I know I can add entries in there manually, but that won't be practical to manage, as IP addresses and Hostnames will change. Can someone please assist? Kind regards,Stuart Mitchell

Hi, everybody It seems that I have successfully enabled synchronization of the cluster that was working offline before me, and all the settings were duplicated manually. But when it worked and I see that they are both in a cluster from the main server interface, the backup server page became unavailable to me. I just didn't find confirmation that this is how it should be and in general I recently started working with it. Is this normal? 

Hello all, I have a primary non-Fortinet router that I would like to place a Fortigate 50E behind. My goal is to configure the FortiGate as a site-to-site VPN endpoint/server to utilize the route when needing VPN services. My reasoning for not using the Fortigate as the main firewall is that this is a secondary appliance and I already have an established primary router of which I am very happy using. I do not want to reconfigure my entire network with all of its VLANs, Rules, Services, etc. to be able to use a proprietary VPN appliance. I believe that to be a reasonable enough use case. Currently, I have the following interfaces configured:[ul]WAN interface for the 50E plugged into a standard upstream untagged VLAN (#100) with access to the internet.LAN interface for the 50E plugged into a second standard untagged VLAN (#200) of which the computer(s) that will need the VPN is a member. The LAN interface is how I am reaching the management interface for the FortiGate.[/ul]My c

i had to purchase Firewall for my company with 3 branches and my friend suggest me to go with Fortinet UTM.Now after 15 days getting some issue for which i logged a ticket number 3445986 on 21 August 2019.But did not get any response from Technical Team after 5 days.What will happen in case when any critical condition will arise. So i now i decided i would not procure this product for my other branches and not to recommend  to any my circle in future.

Hello. I'm working on using our 101E for internal network segmentation. I've set up a LAG port to use to increase the amount of bandwidth available for segment to segment communication. I would like to route Internet access through a separate interface than the LAG port. The reason being is that I have a third party IDS that I want to continue mirroring Internet traffic to and the LAG port on the Cisco switch we use won't allow setting it up for port mirroring. So I want to route internal traffic through the LAG and Internet traffic through a different port on the Fortigate. When I add an IP address to the LAG port that is on our main subnet, the Fortigate automatically starts routing all traffic for that subnet to the LAG port. This takes things down as far as Internet access. The LAG port needs to be reachable by internal workstations, so it needs an IP that is reachable by the subnet. Does someone have recommendations on how to set this up? Thanks

Hi, Universal AP are supposed to be manageable with fortigate.I'm using fortios 5.4.4 and i'm not able to get it manage a FAP-U423EV.Anyone succeeded ? fred 

Just installed macOS Big Sur and cannot get a connection with Fortinet firewall VPN anymore, while it did work with macOS Catalina. I tried Forticlient version 6.4 which seems to connect just fine (I get an IP in expected range), but ssh/ping does not work. And also I cannot access a intranet http/https page. Also tried multiple versions of 6.0.x but they all fail to connect and show "Connection was terminated unexpectedly. Error -104". After that, the keyboard (Macbook 16 inch) even fails to register any pressed buttons. For example I open app "notes" and cannot type anything (with every keystroke a sound is played but nothing is written). The only way to get out of this situation is to click "connect to VPN" in forticlient again and before it gets to the error click "disconnect". Then all works as usual (except the VPN obviously). Anyone else having these issues? Update Nov 25th 2020: Ok, so after quite a bit of testing by the people who maintain our firewall

hello experts , simply put , i cannot delete one of my interfaces software switch , which the company used to provide internet to certain people with certain policies.Ii deleted all the policies that were associated with the interface also disabled dhcp server in the interface configurationgoogle brought me to cli command(which i never usually use unless i have to) to find reference of the interface so heres the output. FGT90DXXXXXXX # diagnose sys checkused system.interface.name internal7entry used by child table member:interface-name 'internal7' of table system.switch-interface:name 'DP-LAN'  Basically all i want to do is to delete the software switch and go back to using my internal interface as regular switch for the unit.its 90D with 5.4 OS any help?

Hi all,I have disabled VoIP inspection, but the problem persist.The pbx is within the network like all ip phones.The STUN server on the pbx is enabled. The calls work beyond 30 seconds only without the STUN server and with the pbx published by the VIPs. Do you have any suggestion? Thanks in advanceac

Hello everyone! I got a problem with a FortiWLC-50D running on firmware 8.0 SR1-2 at the moment. When I am logged in the webinterface I get pop-ups for credentials pretty often (definitly not idle timeout). Sometimes the credentials are accepted and I can go on. Sometimes the prompt just disapeers after entering the credentials and appears again after some seconds. My hope is that this is just a problem with the firmware so I tried to update to a newer one.Updating via the web interface leads to the problem stated above all the time and nothing happens. Updates via the cli returns the following: FN-WLC(15)# upgrade controller 8.2-7MR-1This will overwrite all existing system images. Are you sure [y|n]? yPackage security check failed - image  not installed.-If the target release package is touched as root mode manually,  you need to obtain a signed version and try again.ERROR: Please change wrong configurations and then upgrade again, it will exit...Dia

Hello, We have a requirement to create a simple IPSec VPN to another customer who is also using a Fortigate firewall at their end. However, due to a conflict of subnets in our environment, I need to destination NAT their subnet before it hits the IPSec VPN.  Is this even possible? I was of the view that the remote end would have to NAT their subnet that conflicts with our environment and provide us with a new subnet that we can use to route over IPSec VPN. However, the remote end customer is adamant that this should be done at our end. So in other words, I need to do a DNAT before the traffic hits the IPSec VPN tunnel from our end. Can someone please help with this? Thanks.

Hi, I have the following scenario:Site A: 10.149.3.0/27Site B: 192.168.0.0/24Site C:  172.31.10.140/20Site A and Site C must cummunicate.FG is located in site B.On FG in sTie B Site to site VPN A<->B and B<->C is configured.Site to site VPN A-B uses NAT with following configuration: External IP Range172.31.254.9 - 172.31.254.14Internal IP Range192.168.0.1 - 192.168.0.254 Can please assist how to make A<->C communication. Thank you!

Hi All, While trying to import the firewall to FortiManager, getting an error "Data not exist"  while retrieving configuration. FortiManager Version:5.4.2 GAFortiGate firewall: v5.2.4,build688 (GA) Please refer the screenshot attached. Please help me on this. Regards,Sridhar 

Hello, I have configured our Fortigate to authenticate our ssl-vpn users with Azure AD. I've configured the enterprise app within Azure AD and configured the SAML user within the Fortigate. I have no issues when I login the web-mode. However when I try to connect with the Forticlient I receive a blank sceen after passing the authentication. After a while I receive the following error "Login page did not respond within time limit." The second time i press SAML Authentication the forticlient connects within seconds. I reckon one of the URL's might be different for tunnel-mode / web-mode. Did anyone manage to find a solution for this issue?

I have a Cisco Catalyst 4500 core switch, and various cisco access switches. There are a number of VLANs configured on the 4500 and each vlan has its own vlan interface with ip address configured which it is the default gateway of the PCs in the subnet.   Ip-routing is enabled on the 4500 which allows traffic on the various VLANs to be routed back and forth. The internet gateway on the switch is an IP on the Fortigate (10.1.0.90). I cant ping 10.1.0.90 on any of the VLANs except the VLAN the gateway was a member of. Once I dumped a PC onto the VLAN 10.1.x.x, I was able to ping that address with no problem. It looks like a 802.1Q issues. I ran some debugging commands on the Fortigate and the 4500. I setup a running ping from my pc on another VLAN  to ping the address on the 10.1.x.x VLAN. The packet is arriving but as you can see, has issues. From the Fortigate: id=13 trace_id=286 func=resolve_ip_tuple_fast line=4299 msg="vd-root received a packet(proto=1, 10.1.20.3:1-

I have just been told by support that the newer models of Fortigate 80F-PoE and 81F-PoE etc. are NOT going to get the latest firmware's till January. We will be stuck on 6.2.6 till then. For a security company this is embarrassing.

Hi,I'm looking for a command to check interface connection speed in CLI? thanks

As of yesterday we are seeing this on sites that have enabled HSTS, in my example Wikipedia is one of these sites.  Browser is preventing the end user from continuing because it thinks the site has been compromised like a man-in-the-middle attack. Here is what Firefox says and it always mentions our FG100F cert and I've checked and it has not expired yet.  I'm new to using the FortiGate so any help would be appreciated. Thanks,Glen

Hi, Who can say me, what is the latest firmware update for Fortigate 60 ? And where can i download that without contract registration ? Thanks a lot for your reply.