Solved

friends to update the version of fortimail, I click on "UPDATE". I ask this because I read a kb about updating the fortimail but it does it in another way, this is the kb: https://kb.fortinet.com/kb/documentLink.do?externalID=FD45326 according to this document you click on "Restore Firmware" but why? if it is a version update and NOT restore. Could you help me clear this doubt?

Hi all!I have a simple questoin about HA-cluster settings.We have 2 Fortigate 92D in active-passive mode (Master=№1, Slave=№2)The FortiOS version is v6.0.11 build0387 (GA) on both devices.Recently, I have found that my Fortigate 92D №1 didn't become a Master after rebooting or restoring connections.I had to return the Master role to first Fortigate 92D manually.As I understand it, by default, elections inside the HA cluster are launched every 5 minutes.Is that something wrong with my configuration? That's is a Master(№1) config: config system ha    set group-id 10    set group-name "HAGroup1"    set mode a-p    set password ENC *****************************    set hbdev "internal13" 50 "internal14" 50     set session-pickup enable    set override disable    set priority 150end The Slave(№2) config: config sys

Hi, I have a fortigate 30E (6.2.4 firmware version) and I am experiencing problem with internet speed on it. The wan led is constantly blinking amber (speed) and blinking green for LINK/ACT.  I´ve been looking on the internet for any explanation but I cant find any. FGT#diagnose hardware deviceinfo nic wan Description Marvell NETA Gigabit Ethernet driver 00000010 System_Device_Name wan Current_HWaddr 90:6c:ac:63:1b:29 Permanent_HWaddr 90:6c:ac:63:1b:29 State up Link up Speed 100 Duplex full Rx_Packets 2679 Tx_Packets 3737 Rx_Bytes 720292 Tx_Bytes 3840955  Can someone tell me what can this be or help me troubleshoot this issue!

Hello, I created a new interface in Firewall. Although ICMP is allowaccess at Interface; clients cannot ping the gateway address.  When I create debug in Firewall; I see it was dropped because it didn't match the rule. Normally there is no need to have a rule for the client to ping the gateway address. Where could the problem be? id=20085 trace_id=1155 func=print_pkt_detail line=4915 msg="vd-LOCAL received a packet(proto=1, 10.100.17.11:19760->10.100.17.1:2048) from Server-MNG. type=8, code=0, id=19760, seq=486." id=20085 trace_id=1155 func=init_ip_session_common line=5062 msg="allocate a new session-0f73a6b8" id=20085 trace_id=1155 func=fw_local_in_handler line=392 msg="iprope_in_check() check failed on policy 0, drop" 

Hello,Having a new Fortinet network, we are seeing some very strange issues on the network. It is very sporadic, which is hard to pinpoint the issue, as network performance works great and the next minute it fluctuates. First we started seeing that a file copy to our file server (1 GB connection) was occasionally fluctuating fast and slow. When copying files it would burst up to 108 MB/s, then drop down to 10 MB/s or below (sometimes pause for a couple seconds), then increase up to 50 - 80 MB/s, and would form this wave. The second file copy we tried, it would copy around 100 MB/s all the way across (2 GB file copy). So then we try it again a minute later, and the performance is horrible. I noticed a couple things when I started a wireshark capture: Occasionally I will see TCP Spurious Retransmission, TCP ACKed unseen segment, TCP Out-Of-Order, TCP Dup ACK (even when I'm not really actively doing anything on the network). Now here is the strange thing, if

I did a full reset via the CLI with the command: exec factoryreset I looked at the instructions: https://kb.fortinet.com/k....do?externalID=FD37052 Access through the WEB did not work connected via SSH as user: admin set a new password enabled access through the internal interface with the command: CLI commands:     # config system interface        edit <interface name>            set allowaccess ping http https    end I looked at the instructions: https://kb.fortinet.com/k....do?externalID=FD34688 Logged in as a browser at http://192.168.1.99 (port 1) When I go through the settings wizard, I can't go through the registration stage (I registered on the site beforehand) Register with FortiCare This step is required to activate threat protection services and receive firmware & package updates. I enter login (email) and password Country Can't choose a Resell

Hi, Guys, We found some strange syslog as the following, we have not configured or defined these policies ?Any recommendation to fix these problems: uID : 5025117 Date : Today 03:46:51 Host : 10.16.9.6 Messagetype : Syslog Facility : LOCAL7 Severity : ERR Syslogtag : date=2020-12-23 Checksum : 0 Message time=03:46:50 devname="Forti400e_Fw02" devid="FG4H000000000004" logid="1501054200" type="utm" subtype="dns" eventtype="dns-response" level="error" vd="root" eventtime=1608709611360453548 tz="-0400" policyid=0 sessionid=0 srcport=0 srcintf="unknown0" srcintfrole="undefined" dstip=169.254.0.2 dstport=53 dstintf="unknown0" dstintfrole="undefined" proto=17 xid=47105 qname="login.microsoft.com " qtype="A" qtypeval=1 qclass="IN" msg="A DNS resolution error occurs" action="pass" error="DNS query timeout"   Details for the syslog messages with id '5032066' uID : 5032066 Date : Today 04:03:27 Host : 10.16.9.6 Messagetype : Syslog Facility : LOCAL7 Severity : WARNING Sy

Hi Forti People, I am a new member of Fortinet Family and it is great device Fortiwifi 60D, but I need your help. I created my WIFI SSID and computer and for example Apple TV are just coming fine in the Internet but my iPhone does not. Interesting is when I use default "fortinet" connection iPhone can access the Internet. All other LAN connected devices have their own subnet and works just fine. Only iPhone 7 connects but no access to the Internet. I read many posts but I still haven't figured it out how to solve this problem. Please help. Thanks!

On Cisco I can set interface speed label with the 'bandwidth' command. Does Fortigate have an equivalent to set the speed, so bandwidth usage will be correctly assigned a percentage based on the interface speed/bandwidth label?

Hello, I am interested in bridging multicast traffic across a Fortigate. It appears to be either very simple, or very complicated. I have reviewed the technote on Multicast, and I am unsure if I need to worry about configuring PIM routing. If not, then I believe I would have to configure the join-group on the interface that is on the same VLAN as the multicast traffic/group. Here is a diagram for reference. Has anyone configured multicast " bridging?" Am I missing anything? Thanks, Matt

Hello All,I Created a Virtual IP and Group for RDP access, then created the Firewall policy. I am unable to move the Virtual IP Group Policy to the top in Interface Pair View but I can in By Sequence. is that the way its supposed to be done? The external connection using RDP does work.

Hello all,  I hope you can help me, I have 2 different networks at my office, they do not have any interconnection betweem them, please see the diagram, now I need host A to reach host B locally, and to reach host C through the MPLS circuit. since at my coreswitch 1 I have 5 different vlans, and just one of them needs to reach the two remote hosts, I belive that the best and secure way to do this is to interconnecting the 2 fortigates. What do you think? I am not sure how to do this, any help is very appreciated. Thank you all  

We are preparing to implement Split Tunneling for our SSL -VPN users, specifically to include split-tunneling-routing-negate to hopefully exclude Microsoft 365 services from traversing the SSLVPN tunnel and instead go out the local internet connection. We have two (2) Fortigate 101Fs in a HA configuration.  Current firmware is 6.2.4 FortiClient versions 6.4.0.1464 We will be upgrading our firmware from 6.2.4 to 6.4.3, then from 6.4.3 to 6.4.4 as 6.2.4 does not have the split-tunneling-routing-negate option in the next 7-10 days.  Following the firmware upgrade, we want to implement the split tunnel with routing negate and have found only this Fortinet article documenting basic use. and unfortunately does not include a very detailed example. We plan to implement the following commands:config vpn ssl web portal       edit SSLVPN-AllUsers           set tunnel-mode enable   &n

Hello Community, I've to set two different PSK at a site-to-site vpn ikev2 tunnel. The gui or cli will only set one key for psk. I've to set up a tunnel to a lancom firewall, there is a psk configured for local and one for remote.How to set two different psk to one ikev2 tunnel configuration? Thanks Markus

Please see attached screenshot of an auto-discovered device.Device discovery, even if the IP is provided by the FG's DHCP  - may fail to collect the IP addresses of devices.(firmware 6.0.12)What am I missing? it is hard to believe that one is supposed to make IP objects manually for the use in FW rules. Even  some devices are populated with IP address, they can't be used anyway (as source or destination in a rule) due to the message "One address, address group, or Internet service is required" 

Hi I'm trying to set up SSL offloading, but I can't see the Virtual server in the list of address to assign to the destination in the policy.What am I doing wrong? I don't have central NAT enabled.

Everything is works fantastic with the DMZ setup. DMZ => WAN (works) DMZ => DMZ (works) LAN => DMZ (works) DMZ ╪> LAN (DMZ can not see the internal network)   I'm wondering if there is a way to disable a DMZ from pinging another DMZ device. So far, they can ping each other.   I've so far disabled the administrative ping in the Fortigate. I've created the following: DMZ to DMZ DENY - From DMZ - To DMZ - Source all - Destination all - Service ALL - Action DENY  They can still ping each other.   Any help would appreciated.   Thanks

Hello,Can somebody remind me the CLI to set the log severity level in a FG unit? The handbook clearly states that:"The log severity level is defined by you when configuring the logging location", but it doesn't say how (not the first time, actually...)Thanks

Hi everyone.I am new to Fortigate firewall,  coming from Juniper SRX back ground.This is what I am trying to accomplish: End hosts--SW--trunk----Port2-Fortigate FW Port 2 should be layer 2 trunk port, accept tagged traffic for vlan 20Vlan 20 should be defined and have IP 2.2.2.2/24 How do I proceed? Additional info:Platform: VM (Fortigate-VM64, version v6.2.0 ,build 0866) Thanks and have a nice weekend!!  

Hello! I would like to access the following url: www.heise.de But I would like to block all subfolders/subdirectories, like www.heise.de/forum, www.heise.de/forum/startseite etc. The site is https, I have a Fortigate 30d with latest 5.8 fw, webfilters working. I tried everything with filters, at least that I know of. I can block of course the whole domain, but not the subdirectories to their forum. I suspect, it has something to do with the https. Reason: I want myself being blocked from posting in their forum, but still, I want to consume the news=) Any help? Thx.

Hi, guys,I am confused to Fortigate HA cluster mgmt interface.I have two Fortigate 600E devices and form a HA-pair; an IP address for their OOB mgmt interface individually, as the following requirement (no mgmt VDOM, and the following configuration through root VDOM) :1. 192.168.100.10 ( for the OOB "mgmt" interface of the primary Fortigate) 2. 192.168.100.20 ( for the OOB "mgmt" interface of the secondary Fortigate) 3. 192.168.100.100 (for the cluster IP = always towards the master unit) 4. How I can configure the above requirement5. The above IP addresses should not be overlapped any advice and recommendation, many many thanks.  

Beyond the ability to manage the FortiSwitch via the FortiGate console, what other advantages or disadvantages are there to using the FortiSwitch vs. other third party switches such as Cisco, HP, Dell, Meraki, Aruba, etc.?

Hello, We are buying Fortigate firewalls and now senior management is investigating replacing our Cisco core with Fortinet switches.  This would be for the HQ of my organization, about 700 users overall spread across 5 buildings.  We also have about 550 remote sites, we are looking at the 40F and SD-WAN for those, but that's for a different thread. The Cisco switches are 6509E models, large chassis switches that have been workhorses for a number of years but are now approaching end of life.  We are currently running a 3 tier architecture with the 6509s at the core and also a distribution layer of Cisco 3850s and then access switches of various generations at the access layer. I was looking at maybe doing a stack of Fortinet 1048E models and then collapsing the campus network from a 3 tier to a 2 tier.  We have lots of fiber so getting 10G from the core to the access switches should not be an issue, other than, we're going to have to buy a lot more GBI

We have SSL Certificate Inspection enabled (we are NOT using DPI-SSL, so we don't have the MITM invalid certificate problem).  Certain services such as Amazon Echo, credit card POS devices, and PRTG application updates error out on connection with this enabled.  If I simply remove the certificate inspection from the IP4 rules everything works.  Are there any tweaks that will make just the services we're having trouble with connect?  I know with DPI-SSL you can set exclusions, but that option doesn't seem to be available for the certificate inspection option.  As a secondary question, what exactly is the Fortigate doing during certificate inspection that breaks these services?

Hi All, I'm a new Fortigate user.I just deployed a Fortigate 40F and 60F on two different sites today. I created a site-to-site IPSec VPN connection between the 2 sites. I also create a dialup (remote) VPN connection for the FortiClient on the Fortigate 40F.All these things work perfectly, however I would also like the remote users to be able to use the site-to-site VPN connection. The subnets in question are 192.168.49.0/24 on the 40F and 192.168.48.0/24 on the 60F. I would like to be able to access the 192.168.48.0/24 subnet when connecting to the 40F using the FortiClient VPN. I configured the dialup connection to use split-tunneling so only traffic to those 2 subnets go over the VPN connection. This works as expected, I see the routes in the Windows routing table: 192.168.48.0 255.255.255.0 10.10.2.3 10.10.2.2 1 192.168.49.0 255.255.255.0 10.10.2.3 10.10.2.2 1 I can access 192.168.49.0/24 just fine, but I cannot access anything on 192.168.48.0/24. I create a pol