Solved

We have two devices thing1 and thing2 on the dmz interface of a 60E. The devices are on different subnets. VIP access to thing1 is working fine, but thing2 fails with what looks like a routing issue that I can't sort out.Relevant config:config system interface    edit "dmz"        set vdom "root"        set ip 10.6.6.1 255.255.255.248        set secondary-IP enable        config secondaryip            edit 1                set ip 192.168.91.2 255.255.255.224            next        end    nextendconfig firewall vip    edit "vip-thing1"

I' d like to generate a alertmail, to see whether it is working. I created an smtp server configured an alert mail. In the past i could test-connectivity in release 5 i can' t find a gui option and also could not figure out a cli command. any hints?

Hi - trying to get identical policies on 2 Fortigate 1801F firewalls to the purpose of high availability. The manual says that it is possible to copy the policies. but fails to mention how to do that. So, how do I copy fw policies to it peer? Can someone point me in the right direction? Thank you

Hi, We're planing on puting Forti EMS in DMZ, so clients can pick up telemetry from public.Does Forti EMS server needs to be domain joined machine or we can just connect it via LDAP(S) with AD?Forti EMS will also comunicate with Fortigates for ZTNA tag collectionI was looking official docs, all I can find is that EMS cant be installed on DC Thanks

Hi Guys,My company bought a Fortigate 80F a few months back. At that time we had around 85 users and Fortigate technical person suggested that it will handle up to 100 users in our environment. Now, we have around 70 more people who joined our company, so total employees will be around 160. Now I have few questions - 1) If we buy one more 80F firewall and use it in Active-Active HA mode, will it be able to handle the extra employees we have now? Meaning, (one firewall can handle 100 users), if we have two firewalls, will 200 users will be able to work? 2) Will the VPN users connecting to the firewall will also increase after adding the second firewall? 3) In the future if we get more employees (eg. 500), what is the best practice to handle the load? 

Hi,I have vms in a vlan and I am trying to support tls 1.3 load balancer with full offloading, but I can't get it to work (curl stuck then server no response). Things I tested with same config:- Virtual IP with tls 1.3 works.- half offloading with tls1.3 works.- if I change  the config below to support tls 1.2 it works. On the server side I have nginx with basic tls1.3 config (ssl_protocols       TLSv1.3; + certificates setup) In fortigate I've the certificates setup, and here's the load balancer config: edit "MY_TLS_LOADBALANCER" set type server-load-balance set extip ------.12 set extintf "port1" set arp-reply enable set server-type https set nat-source-vip disable set gratuitous-arp-interval 0 set http-ip-header enable set http-ip-header-name '' set ssl-client-rekey-count 0 set ssl-hpkp disable set ssl-hsts disable set ldb-method static set persistence none set extport 443 config realservers edit 1 set ip 192.168.20

Hello everyone,We have FG300 with FortiOS 6.2.3 and Freeradius. Use RSSO to authorize WIFI users. The user falls into the group on FG, but it is not defined in the policy and, accordingly, the policy does not work. We need help, which may be the reason. FortiGate # dia test app radiusd 3 RADIUS server database [vd root]: "index","time left","ip","endpoint","block status","log status","profile group","ref count","use default profile" 1,07:58:42,"192.168.51.10""host/ARM0796.lokb.spb.ru","allow","no log","<default profile>",1,Yes 2,07:59:57,"192.168.57.4""ushakov","allow","no log","usersLOKB",1,No FortiGate # sh user radius RSSO\ Agent config user radius edit "RSSO Agent" set rsso enable set rsso-radius-response enable set rsso-validate-request-secret enable set rsso-secret "secret" set rsso-endpoint-attribute User-Name set rsso-flush-ip-session enable set rsso-ep-one-ip-only enable next end FortiGate # sh user group RADIUS\ users config user group edit

Hi, we´re switching from MS FTMG to FortiGate with Explicit Web Proxy and a "Web Proxy Forwarding Server". The MS FTMG sends all DNS-Request to the configured 'Upstream Proxy'. How can i configure this Option on a FortiGate? Opening a Website results in '504 DNS look up failed'. Using a local DNS-Server is not an Option. There is no Webfilter configured.

Hello everyone, Someone asked me and I realized that I never knew it. On which port does fortigate start the usage for SNAT ports? I mean, what is the first and last ports usued by fortios on snat port translation?  Thank you all in advance. tioeudes 

Hi,I am having trouble setting up IPv6 on Windows 10 SSL tunnel with FortiClient VPN app. I have configured IPv6 address group to be assigned to users, enabled IPv6 on SSL-VPN portal, checked that IPv6 is enabled on Windows PPP interface, ... but my computer still get only IPv4 address. Have anybody successfuly configured and used IPv6 on SSL VPN through Forticlient VPN app? So far I have found this post http://socpuppet.blogspot.com/2013/09/sslvpn-forticlient-ipv6.html which has not been resolved and some known issues with IPv6 on full Forticlient https://docs.fortinet.com/document/forticlient/6.2.0/windows-release-notes/991883/known-issues. Thanks

I am coming from the Cisco world, and in that world Cisco Policy Base Routing (PBR) is processed outside of the route table, so PBR will get processed before static routes or any route currently in the table. Is this is the same behavior on Fortigate firewalls? What is the order of routing on the Fortigate firewalls? Thank you

i have around 100 FGT's configured under Fortimanager and I thought it would be better to have a backup config for all the FGT's wondering if there is an option to do that at once using FMG?

Hi! I'm working on a lab with a Windows 2012R2 and a Fortigate VM64-KVM (trial version) running version 6 (tried 5.6 as well).When adding the LDAP server to the Fortigate, I always get error LDAP_-5 in red. And I can't get to query against it. When I debug, I can authenticate against it: FortiGate-VM64-KVM # diagnose test authserver ldap "LDAP DC-01" user1 testpassword authenticate 'user1' against 'LDAP DC-01' succeeded! Group membership(s) - CN=Domain Admins,CN=Users,DC=fgtad,DC=local CN=Domain Users,CN=Users,DC=fgtad,DC=local Config:  config user ldap edit "LDAP DC-01" set server "10.10.10.11" set cnid "cn" set dn "dc=fgtad,dc=local" set type regular set username "LDAPconnect" set password ENC ceUtrzALEk7sWZhJjrw1JElXiACZiRxwHScw9Spf2i2Fmr/FGSis8dpC0JyAuuAya/kZ91ECVenukLlLy8xfFyfJZ6hGqheLG5PCIhjVF8aLQxaeWlb8XnPJvR/ZBSIArzHDq+bD34X9fuUO0oraXOJbhOZfshPzCpZzvgJT04fVKhvWtZ3A56yCmgS2VjSVmMh45g== next end Any ideas? Thanks! 

Hi all, you can see the network diagram. I found out that active failover is not working when I do VRRP with a FortiGate appliance (60F) and a H3C router. On the FortiGate (Master): config system interfaceedit port1config vrrpedit 1set vrip 192.168.1.1set priority 255set vrdst 8.8.8.8set vrdst-priority 10 [ul]when the monitoring target specified in vrdst (i.e. the 8.8.8.8) is down (in my case it is because the upstream host having issue), the VRRP priority of it has not changed to the value specified in the "set vrdst-priority"[ul]FGT[WAN1] --[ISP1]- x -Internet H3C[WAN2] --[ISP2] --Internet[/ul]therefore, the end user will keep going to the FortiGate instead of the H3C router.[/ul]I heard this feature only works on 2 FortiGate forming VRRP, but I proved it fails too in my lab with 2 FortiGate appliance. SO, have everyone tried the active failover and succeeded before? Please help.

Hello, I am new in your community and I would like to know how to block a https site because in http it works I have the fortigate 200A thanks in advance Sincerely

So, kinda new here.  I wanted to block traffic inbound from, say, russia, china and korea.  I set up a firewall rule as wan/lan/GEO/all (where GEO was the geographic list).  No traffic.  So I added another entry as a whitelist from any US traffic, as a positive test.  Still nothing.  Tried changing the dstinf from LAN to any (since I thought maybe the new rule - at the top of the rules list - didn't have a destination, so maybe LAN was wrong.)  Still nothing.  Finally, out of desperation, I created a VIP group, and added the various VIP entries (for my mail server, PBX server, etc...)  Lo and behold, the whitelist entry worked.  So I did the same thing for the GEO-IP blocklist, and that is also now working.  My question: is this really necessary, or am I missing something crucial here?  I've gone through the fortios 6.4.6 manual and saw nothing that spoke to this.  FWIW, I am set in profile mode, not policy mode... 

I added a VLAN to an SSID and relaized it was in error, as i attempted to remove the VLAN from the SSID its returns and error "Input not as expected". I have removed any policies, addresses and interfaces using the vlan, with the same result. Any help to find other reference points i may not have thought of would be a great help to remove this, thank you. -Bry

Hi I'm new to FortiOS 6.4.5 and I've been asked to block internet access from a group of pc's on our network.Attached is the policy, the address group and the adress.What am I missing here? 

HI Mate, Anyone know could advise what is the process name in system resource for Feature Device Detection. For example, process name netscan is use for device-identification-active-scan, what about Device Detection (device-identification). Thanks.

Just wondering if anyone has tried this and has words of warning, or wisdom. Our requirement has been raised many times before, but I haven't seen a solution for pre-v6.2. We're running 6.0.12 on a 501E cluster. We want to force certain traffic to one, and only one, member of the sdwan. We have a VoIP appliance with two WAN ports (P1 & P2) and it will handle its own monitoring and failover across these ports. P1 & P2 use private IPs on FG VLANs. P1 has a VIP with a dedicated IP on ISP1. P2 has a VIP on ISP2. SD-WAN rules send P1 traffic via ISP1 and P2 traffic via ISP2, but how to stop it failing over in an outage? The vendor cannot cope with that. I'm considering using policy routes instead of SD-WAN rules to force P1 to ISP1 and P2 to ISP2, and "blackhole policy routes" later in the list to prevent "criss-crossing" during an outage. Blackhole policy routes don't exist AFAIK so my thought is to create a loopback as a dead end. Send the traffic to the loopback and have no

Hi all, I have attached a Captive Portal to my lan interface with a local group authentication. From a pc client, when I open the browser for digit any website, the Fortinet login appear (correct) I insert my username and password (correct) Fortigate accept my credentials because I can see my user from "Monitor" -> "Firewall User Monitor" (correct) the problem is now because in address bar of the browser, I can see a continuous loop of the address: http://172.16.0.X/fgtauth?092321232323cdw2http://172.16.0.X/fgtauth?021372123435ed82http://172.16.0.X/fgtauth?010032723341c889http://172.16.0.X/fgtauth?0933423487fd0fc44 and the website that I asked don't open. Also if I open another tab in Chrome, I can see the same loop with the magic token that change continually. Can I solve or debug this big problem? I haven't found any documentation about diagnostic of Captive Portal feature. thanks!Andrea      &nbs

Hi, For context, I'm not "fresh" to sysadmin, but I am "very fresh" to all things Forti-*.  I'm a month or two into a new gig with an MSP that has FortiGate and FortiAuthenticator deployments sprinked around their (our, I guess) clients.  Chatting with a previous engineer that had a hand in setting it all up, recently, he commented that he couldn't really see the point of mandating 2FA with FortiTokens since this doesn't solve the "rogue contractor with laptop" plugging in somewhere and authenticating to the file server with username and password, since it's at the point where users sign onto their laptop/desktop that has OTP authentication challenge, but if I pass credentials for a standard user to a file server from a device that isn't running the updated msgina.dll, the file server (or other resource provider) happily hands over the requested assets.  I'm betting this is a "solved problem" but I haven't seen the suggested approach in the documents I've

Hello! I created 50 accounts from guest management and when i went to print, nothing happens. The page where i can enter "Break Page After __ Users" comes up and i can type the value and press "OK" and then it just disappears. I have tried changing browser, checking that AdBlock is off but it doesn't work. Can anyone tell me what i'm missing? FortiGate 100E, v6.4.2.

Hi Guys deploying new fortiauthenticator, i have few questions if you guys could help - can I authenticate cisco switches with FAC, when I login via ssh or console that should check with FAC?- how FAC works, I have many Fortigates so FAC will be linked with FGT and users will access via Forticlient or how?i am little confused here, can we link FAC to cisco switch and do 802.1x port based or mac authentication? or need to link with FGT?

We've been using Fortigate and FortiClient managed by EMS for many years now. The Fortigate is currently on 6.0.10 and the FortiClients vary from 6.0.5 to 6.0.10. We have several hundred VPN users and most work without issues.  We've had a couple of users now report they cannot access internal resources. When we check the client, we find they can reach the host by IP, but it appears Windows isn't using the internal DNS server to resolve the host name. If we open a command prompt and type NSLookup, it connects to the internal DNS server we have defined in the SSLVPN settings. We confirmed the DNS suffix is also configured in the Fortigate SSLVPN configuration. The large majority of clients work, but it seems the list of users having issues resolving internal hosts by name is slowly growing. I'm not sure if a Windows update has suddenly caused this to start, but I am looking to the community for some suggestions? Denny