Solved

See this here on FortiOS 6.4.7 with SSL inspection enabled since yesterday. 30. Sept 2021.Likely a server misconfiguration. More details in my post here: https://forum.fortinet.com/FindPost/199137 

Hi,  I've tried in Firefox and chrome to use the search function in on these forums but when I type in 'vlan' and click search a drop  down of results appears for a split second and disappears.Paul

Hi,When you have an LACP aggregated link and/or VLAN interfaces in a fortigate at what "level" are you supposed to set the MTU? On our different generations of switches I have seen different behavior and I don't know which applies to Fortigate. I have seen:- Jumbo frames are set per vlan- Jumbo frames are set per port (on the port level and not the lag level) The FortiOS system interfaces table contains items for each port, vlan and lag so where am I supposed to set the mtu? Thanks!

Dear All,  Is there any way to use dnat without a vip? I have the following situation:clients pc  --- fortigate ---- other device ---  192.168.5.5                                                                 |_  192.168.6.6I would like to achieve:a) - A client with ip 10.10.10.10 if want to go to dst:192.168.5.5 then it dnat-ed to dst:192.168.6.6.b) -while other clients if want to go to dst:192.168.5.5 then no-nat-ed, so dst:192.168.5.5 is unchanged and simply forward to the dst. My problem is that the 'external ip' is not on fortigate, and when I create a DNAT & Virtual IP with:External IP address/range : 192.168.5.5Mapped IP address/range : 192.168.6.6Optional filter / Source address : 10.10.10.10Then a) seems to work, there is dnat-ed outgoing packets and replies, but b) doe

Can someone explain why these and other phenomenon happens after an upgrade to 5.x from 4.x? 1. User clicks on this link within an email http://www.icmc.usp.br/~mcmonard/public/laptec2002.pdf The firewall running 5.4.4 blocks this link under the WAF as a "known exploit" If I shut that off, the link passes. My question. Is this a false positive because ever since upgrading the WAF has been blocking a shitload of content. 2. User receives a daily digest (http://feedproxy.google.com/~r/TheHackersNews/~3/Y7H5FF7-MYU/browser-camera-microphone.html?_m=3n%2e009a%2e1504%2epr0ao08ohs%2ewbq) that was fine before the upgrade but now is blocked. Many other inconspicuous sites are getting blocked as well under "generic attacks". The only way for these sites to work is to turn this off. I never had to before. Why now? Should I wipe it clean and start fresh?

Hi Guys,My company has three branch offices in different locations. We have Fortigate 100F at our main office. I wanted to create a site-to-site VPN between my main branch and one other location. My main branch has a Public IP but my other branch doesn't. Someone told me that we can create site to site VPN tunnel with one public IP and one dynamic IP too. I am not too sure, so anyone can please confirm whether this is possible? Thank you a lot in advance.

We are in a (painful and lengthy) transition from FortiOS 5.6 to 6. Next step in the upgrade path is from 5.6.11 tot 6.0.10. Yes, I know, we are 3 years behind... But for us this upgrade to a major version, feels like a giant milestone. We currently use Forticlient 6.0.3.0155 for VPN (Windows only). In the release notes for 6.0.10 on page 12 it says:FortiOS 6.0.10 greatly increases the interoperability between other Fortinet products. This includes: FortiAnalyzer 6.0.8 FortiClient EMS 6.0.8 FortiClient 6.0.9 FortiAP 5.4.4 and later FortiSwitch 3.6.9 and later Upgrade the firmware of each product in the correct order. This maintains network connectivity without the need to use manual steps. On page 16 it says:If you are using FortiClient only for IPsec VPN or SSL VPN, FortiClient version 5.6.0 and later are supported. We only use Forticlient for VPN, not endpoint checking. Will it work ? Or do we have to upgrade Forticlient first ?

Hi All,Cannot figure this one out.. neither can the Fortigate TAC it seems.FG 500E in HA running 6.0.9users on LAN doing MS teams and/or skype video calls complaining about bad quality from the remote party inbound. however remote party can see LAN users fine and quality is good. so it appears only inbound video quality affected from outside of the company network. we have done and tried the following to date> We checked the external and internal interface but no errors or drops observed > We created a traffic shaper but no improvement > We disabled any security profiles in the policy but no improvement > We created a DoS policy for outgoing traffic for the internal interface and there was a slight improvement but not much.> we put a laptop in ISP router it works 100%.> we put this same laptop on a dedicated port on FW problem appears.> deleted and disabled SIP (made some difference but not enough) However Zoom works 100% (not allowed anymore due to se

Hi all.  I'm in a new company just starting up and have borrowed a Fortigate 600D which I'm currently setting up at home on my internal lan. The fortigate has taken a 192.168.0.77 address on my network and I am able to access that from a wireless PC on my home network.  Effectively outside my network.I'm made a softwareswitch (IP 10.0.1.1) of a range of ports in order to have multiple distributed switches be connected to the same VLAN configuration.  I've made half a dozen VLANs and one of those is for managing network devices (VLAN50 10.0.50.1)  That VLAN works fine on the distributed switches as when I connect a computer to an untagged port for VLAN50 it gets an IP 10.0.50.10 and it can also access the internet. My problem is that I want this computer to be able to manage the fortigate on 10.0.1.1 and although I've put a policy in to allow traffic from VLAN50 to the SoftwareSwitch I am unable to open the management GUI.  I can ping 10.0.1.1 but I ca

Hello all,I have a faulty VPN configuration on an IPsec connection between a Fortigate and a Sophos XG to which I cannot find a solution. I have connected several subnets via the VPN: Fortigate: xx.xx.11.0/24xx.xx.6.0/24XG: xx.xx.100.0/24xx.xx.2.0/24xx.xx.0.0/26The connection is established and also works. However, an error is displayed on the Fortigate. The SAs between the firewalls are displayed with the following notation UP: Source: xx.xx.11.0-xx.xx.11.255 Destination: xx.xx.100.0-xx.xx.100.255, xx.xx.2.0-xx.xx.2.255, xx.xx.0.0-xx.xx.0.62 ....The same SAs are displayed with a different notation than DOWN: Source: xx.xx.11.0/255.255.255.0 Destination: xx.xx.10.0/255.255.255.0, xx.xx.2.0/255.255.255.0,xx.xx.0.0/255.255.255.192On the Sophos XG, all SAs are displayed UP.Does anyone have an idea how I can eliminate this error? This permanently reports a faulty VPN tunnel to our monitoring system. Best regards Felix

Hello,        I would like to resolve internal hostnames on my network, and I read on this Forums that it would suffice to set your internal DNS as the primary DNS server on the Fortigate unit in network configuration. BUT, I would also like to have the Fortigate be the first DNS uplink for my internal DNS server, so I could use Fortiguard DNS servers to monitor and block bad hosts (malware, C&C, etc) out there. So, what would be the recommended practice to having both internal hostnames correctly resolved AND funnel all DNS traffic through Fortinet DNS service (assuming there actually is a way to do this)? PLAN B: is there a way to pre-load all my internal hostnames (a la \windows\system32\drivers\etc\hosts) on my Fortigate unit? Is there an editable HOSTS file of some sort? 

Hi all! We have a working SSL VPN that lets outside users access our internal LAN. But I want to restrict access to specific local addresse. Ie I dont want any VPN users to access 192.168.0.20.How do I block a specific local IP?

Dear all, Do you know how to disable "save password" on Fortinet VPN client ?  I would appreciate your help on this matter. Best regards, Miguel Laruccia   

Hello, In the standalone Fortiswitch, we can configure the following VLAN settings in a port: Native VLAN, Allowed VLAN list and Untagged VLAN list. This configuration is available only in the standalone switch; when the switch is managed by a FortiGate, the only settings available are the Native VLAN and the Allowed VLAN list. Can somebody explain to me why should someone need to set the Untagged VLAN list? It seems to me that the Native VLAN alone should be sufficient. What additional functionality does the Untagged VLAN list provides to the port consifuration, that is not covered by the Native VLAN? Thanks

Hello, I have a wifi printer Samsung ML-2165w  and it can't connect to the network provided by FortiAP 221e. I've tried to disable many options but all attempts were unfortunated. Even can't connect to open network. Printer can connect to other access points successfully. Could you please advice something?  Below is a log from dmesg.Thank you [11257.519816] [957.510] cpu1 wmi_event_debug: dev=wifi1 event_id=0x9028(WMI_PEER_STA_PS_STATECHG_EVENTID)[11257.643880] [957.630] cpu0 vap-01(wlan01): [00:15:99:ea:95:29] recv auth frame with algorithm 0 seq 1[11257.643935] [957.630] cpu0 wmi_cmd_debug: ol_alloc_cookie dev=wifi0 cookie=cdc40e04 seq=139143 in_use=1 cmd_id=0x9022(WMI_PEER_CREATE_CMDID) if_id=1 vap=wlan01 peer_macaddr=00:15:99:ea:95:29[11257.644015] [957.630] cpu0 vap-01(wlan01): [00:15:99:ea:95:29] ieee80211_alloc_node: vap=0xc6ae8000, nodecount=2, ni=0xcc7c0000 ref=2, ni_bss_node=0xcc7c0000 bss_ref=2[11257.644186] wireless_send_event:790 mlmsg cmd=0x8C02 event_len=18 sk

Hi!I'm setting up SSL VPN on FortiGate as described here: http://cookbook.fortinet.com/ssl-vpn-using-ldap-integrated-certificates/. It works but users can connect using just a certificate. To add username/password authentication I've changed VPN usergroup by removing remote LDAP server and adding remote RADIUS server. RADIUS (MS NPS) verifies username/password with ms-chap-v2 in AD, so now it looks like we have certificate + username/password authentication. But here is a situation: User A can use their username/password and User B's certificate and still get successfully authenticated due to the fact that certificate is only checked for validity and trust (issued by same CA). So is it possible to set up SSL VPN with certificate + username/password authentication AND strict checking that certificate CN/UPN matches the username given by user? Thanks for any clues.

Hi all Need help in Fortigate behavior on OSPF routing In the attached image - What will happen if traffic from 0.x is send to server1 via wan2 but return traffic from server1 is send via wan1 ? Thank you

lot of Bug Fixes but WAD Memory Leak (712584) still persists witch keeps me from updating.What do you think?

Hiho, I have an adom which used to bei v6.2 before. As long as it was 6.2 all worked fine even after upgrading the FortiManager to v6.4. Once I upgraded the adom (and the global adom as it provides objects that are used in that adom) to v.6.4 I cannot deploy the policy package anymore. FMG just says deployment has failed but it doesn't let me know why or at which point :(Installation log does not show any error.And the usuall cli debug levels don't show any error too. Also there is much less debug info in 6.4 than there used to be in 6.2.There is almost no debugging output written during the deployment process even with several debuglevels set to 255: I also opened a ticket with TAC but even they did not yet provide a solution or hint.Does anyone have some idea how further debugging in 6.4 could be done to maybe find the problem? cheersSebastian

I am new to Fortinet but I have a strong Cisco background. We are looking at replacing our Cisco 891W with a Fortigate 60D. I am working in a lab trying to get the device configured. In Cisco I can set the DHCP on the VLAN and all devices being tagged for that VLAN can gets its IP from the VLAN DHCP, this does not seem to work on the 60D. I have attached a screenshot of the interfaces. When the DHCP is configured on the interface I can get an IP on a connected PC but the VLAN tag is not added to the packets. When I configure the DHCP on the VLAN the PC cannot get an IP. I can see the DHCP request from the PC, using WireShark, and the 60D shows the DHCP request on it, but the DHCP packet is not tagged with the VLAN and there is no IP return. Looking at the picture of the interfaces, I have attached, it shows that the Voice VLAN is a subinterface to the internal2 interface. Should the DHCP packet get the VLAN tag added to it since the PC is connected to the internal2 port? I am assu

Hello all,  I'am using here fortiswitch 448E. I also have Fortiap's running here. So the goal is that a magic package can send to an other vlan to wakeup some clients. So far I have not found anything that solves this.  On my old HP switch I had to set these options:ip directed-broadcastip forward-protocol udp 10.10.3.255 65535Are there similar options for the Fortiswitch?

Hi, Is it possible to execute the backup automatically with the variable "hostname" as backupname.cfg ?  I need to backup a lot off Fortigate to the same destination, so i need a different name for the backup file.  I can do this manually, but i want to create a cli script to send to to all Fortigates.

Hi,I have imported 2 FGT with their policy package in one ADOM. The policy and other was already configured.In this scenario there is 2 different policy package, one for FGT. The physical interface or zone of FGTs are different name from each other. How do I configured a shared policy for web navigation unique for both?

Hi all, We have an FortiWLC-50D-VM that controls some FAP-U421EV AP's. We would like to migrate these AP's from the FortiWLC to the Fortigate for wifi control. Does anyone have some commands for how I can remotely migrate the AP's from the WLC to the Fortigate via the CLI  (for some reason the gui does not work on our WLC) Thanks

Hi all,I'm new in forum anybody encountered the issues, I can ping google/yahoo but unable to browse?