Solved

Hi guys, I have a 60D fortigate that i'm using for VPN and firewalling.In the address list of the User Interface, there are many default addresses related to google, microsoft, citrix, apple and so on ...(see attached file).If I remove all these addresses and only keep the one i'm creating, will I have any issues ? 

Hi forum members,I am pretty new in forinet hardware. So I bought a used fortigate 100D and fist of all, I made a hard reset with the resetbutton on the front. Unfortunately bevor I read the manuals. So it sees, that now I have to log in with putty to manage the fortigate with a consol cable. I did so with putty and now ist says "open boot device failied" (see attached picture). As far as I know, I now have to flash it right? Therefore I need the flash firmware, but I can´t find it. To be honest, it is the first time that I work with putty, so I have to learn it now. I am really thankfull for help.Alexander 

Hi Guys,  I am having an issue whereby I am unable to delete an interface in the root VDOM, it has a TACACS+ reference on the interface and under the TACACS+ settings there is zero references.  The interface reference using TACACS+. Not sure what the (6 References) mean but I can't seem to trace it. I have tried using the CLI to remove the interface, however I get a return code of -23. Does anyone perhaps know what else I can do to get this removed? Thank you

Hello,I'm looking for solution that we have a s2s VPN connection between site A to our DCWe want to add a DR on OCI ( oracle cloud) and want to connect it also by s2s VPN and to make this connection as backup.If the connection/FW on DC side will go down the VPN will change to the DR and if the connection will go up again in the DC it will go back.Adding a visio What is the best way to make it happened? 

Hi all We have a 1000D device from our provider, how is this done with the air flow on this device? Is this something which comes "out-of-the-box" or can this be changed? E.g. another fan module which changes the direction? Does someone has a link to the hardware guide which describes this behavior and what needs to be ordered? Thank youMarkus

Hi, Maybe I missed this somewhere but I can't seem to find any information about this, so I decided to ask here. I have been told that it is possible to add custom replacement messages for blocked web pages using FortiManager. I can see the option to toggle https-replacemsg under the Policies & Objects > Security Profiles > Web Filter > profile > Advanced section, but I don't see where I can edit the replacement message. So far, users are able to see the default replacement message when trying to access blocked web pages, but I would like to edit the replacement message to better suit my organization. If anybody can guide me in the right direction that would help me a ton. I'm using a FortiGate-1500D 6.2 with FortiManager 300E v6.2.7 Regards- K.

Is there any news on a forthcoming Forticlient endpoint or EMS build that's compatible for Intel-based macOS Big Sur? Many thanks, Martyn

When you've activated certificate inspection or deep SSL inspection, the acceptance of the external certificate is up to the FG. When it rejects the external certificate it the page with the warning:"This Connection is Untrusted ..." You can check this e.g. on https://self-signed.badssl.com/ However, for this page's certificate the FG always uses a certificate signed by the factory "Fortinet Untrusted CA", regardless of what you've set up for HTTPS or SSL inspection. According to support (ticket #2289811), this is not configurable. In my humble opinion, this function is broken since it urges the user to (permanently) accept a root certificate which is present - and extractable - on every Fortigate on the planet, leaving a critical vulnerability for man-in-the-middle attacks. Are there any ways around this? Is this issue addressed in 5.6?

Business has a FortiGate running 6.0.10 and a few FortiAP's. Is it possible to set up a SSID for guest internet access only that does not require a password from the guest user? No LAN access is needed or wanted via the guest SSID. When creating a new SSID it looks from the GUI that a Pre-shared Key is required. Is there a way to set up an SSID without a required password?

What would be the benefit of the DNS database set as slave? Thanks in advance.

Has anyone integrated LDAP with Fortimail for admin login?

Hi lovely guys, Can you point me to how can i create a policy to allow an external IP to SSH to a specific internal server? I have tried the below but server still can't be reached. I've tried to add the external in Policy & Object>Addresses: Name: External_SSH_Access Type: Subnet IP: xxx.xxx.xxx.xx Interface: Any And added a policy in Policy & Object>IPv4 PolicyName: SSH_Access Incoming: Wan1 (My wan port)Outgoing: Prod Network (network where Server is)Source: External_SSH_AccessDestination: Server_to_SSH (via VIP that points to WAN IP to LAN IP with port 22)Schedule: AlwaysServer: SSHAction: AcceptNAT:OffEnable this policy: On Done all these, but i the person in this External IP can't reach the server. Any ideas on what am i missing, please. You help is much appreciated.

After upgrading to version 6.4.4 of Fortigate.There are a lot of policy that are missing in the Web Interface.There are at the CLI. Is there a bug, or is it something that i missed? Example this rules is not shown in the Web Interface:config firewall policy edit 2 set status enable set name "Allow DNS against Dalbjerg-DC01" set uuid adde7da6-38de-51eb-5b56-126ab8c13002 set srcintf "ITALink" set dstintf "DAL-INSIDE" set srcaddr6 "ITALink IPv6 networks" set dstaddr6 "Host6_dalbjerg-dc01_2a05:f6c7:4296:1::10" set internet-service disable set internet-service-src disable unset reputation-minimum set rtp-nat disable set action accept set schedule "always" set schedule-timeout disable set service "DNS" set tos-mask 0x00 set anti-replay enable set utm-status disable set inspection-mode flow set profile-protocol-options "default" set ssl-ssh-profile "no-inspection" set logtraffic disable set logtraffic-start disable set auto-asic-offload enable set np-a

Hi everyone, FG61E active-active HA Since v.6.2.3 we have very high memory usage. The Fortigates go into  conserve mode all the time and i can't get the memory any lower than 77%. I disabled unrequiered features, switched some policies from proxy-based to flow-based, reduced the session timers, logging etc. Nothing helps. The memory overflows while the CPU runs on <5% most of the time. I have a customer with about 20x FG 30E. Some of these do nothing but IP-Sec VPN and nothing else yet but the memory there is also on 68% while the CPU is <5%.  What can I do to reduce my memory usage? Or is it a firmware issue? There were problems with the memory management in v6.2.0 and 6.2.2 in the past.  Also I noticed that the FortiGuard DNS Filter Server is unreachable in v6.2.3. I configured the DNS Filter IP from v.6.2.2 (on which it works) and it doesn't work on v6.2.3 either. I already have a case open with fortinet about the DNS Filter issue. &nbsp

Hello,Our security auditor has asked that I generate screen shots proving that these firewalls use stateful inspection. They also want something showing uses anti-spoofing I have a fortigate 500d v.5.6, how do I know that it has ANTI SPOOFING and STATEFUL INSPECTION enabled? Will there be any command to see it?  

Hello, Has anyone been able to implement multiple VXLANs over virtual wire pair as described in the Fortigate link below? I have tried this in the lab and the IPSec tunnel does not come up and it does not work. Has anyone made this work?  https://kb.fortinet.com/kb/documentLink.do?externalID=FD47557 I setup this in the lab and when I debug ike I get below policy errors. But I am not sure what policy I should be adding, since it is not clear what should be interface other than ipsec in the policy.  ike 0:ipsec: ignoring request to establish IPsec SA, no policy configured ike 0:ipsec:ipsec: IPsec SA connect 3 10.10.10.1->10.10.10.2:0 ike 0:ipsec: ignoring request to establish IPsec SA, no policy configured ike 0:ipsec:ipsec: IPsec SA connect 3 10.10.10.1->10.10.10.2:0 Following is my configuration------------------------------- FGT-1 --------config system interface edit "port1" set vdom "root" set ip 10.10.10.1 255.255.255.0 set allowacce

Hi everyone, May I know how can i get the Fortigate 500E to list out the disk utilization status? Can anyone help me out? tried to check in the knowledge base but couldnt find any.. Thanks. Regards,C

Did anyone make below set up work successfully with 6.2.3? I'm just testing with relatively simple set up: FG50E -- FG30E direct connection and trying to connect vlan 100 network on both ends. Likely my test environment is causing some issues. But once I drop the vlan subinterface and use it's parent interface without vlan tag, it just works end to end. Sniffing shows ARP requests arrive at local vlan100 subinterface, but never goes over to the other side.https://docs.fortinet.com...4150/vlan-inside-vxlan   

I'm hoping someone will be able to offer me some advice please, I have an issue configuring VLAN trunking, which when I enable the config I think should work, the CPU runs up to 100% on my Fortigate 60E and the device becomes unresponsive. Very Basic topology looks like this:Wired Users --> Zyxel GS1900-48HP --> Fortigate 60E --> InternetWireless Users connect first to a Cisco WAP121, which is connected to the Zyxel switch above. Current setup (Fortigate 60E):I have created a Hardware Switch called 'Inter-VLAN' in the Network | Interfaces section, and added interfaces 2 to 7 as members. I then created six VLAN sub-interfaces under the 'Inter-VLAN' switch, with VLAN IDs 20, 30, 40, 50, 60, and 70.  Each with it's own subnet, DHCP server, and DNS server. Current setup (Zyxel GS1900-48HP):Access ports are configured with the appropriate PVIDs, and are marked as 'un-tagged' on the appropriate VLAN ID.Port 11 is configured as a Trunk, has a PVID of 1, is un

I try to understand the Inter-VDOM routing example at https://docs.fortinet.com/document/fortigate/6.2.4/cookbook/335646/inter-vdom-routing In the example VDOM "Sales" connects to VDOM "root" via vdom-link "SalesVlnk".The two interfaces are "SalesVlnk0" (on VDOM "Sales" side) and "SalesVlnk1" (on VDOM "root" side).Nothing fancy here and I understand all of it (perhaps except the p2 and p3 IP addresses as they to not correspond with the picture in the example), until it comes to the policies. The firewall policies in that example puzzle me. I believe those are wrong. But I might be mistaken? Please help me understand. It seems to me that the policies are completely garbled, though. For example the Sales VDOM related ones (this is from the content of above link):To configure the firewall policies from SalesLocal to the Internet:config vdom    edit root <<< should that not be "Sales"?         con

Hello everyone - Happy New Year !!! I'm new to Fortinet/Fortigate and I might be doing something wrong - so I’m calling for your help and advices.   I'm trying to replace my Internet FAI BBox by my Fortigate 60F. The Fortigate will be plugged in ethernet directly to the FAI Fiber GPON. This is feasible with some Network and DHCP tweaks and used to worked with an OpenWRT. So my issue here is more about how to set these options up on my Fortigate rather than improving the tweaks.   Net and DHCP required tweaks are : Set 801.q VLAN 100 ; the interface mac address set to the one from the FAI BBox (MAC Spoofing) ; DHCP client must use Vendor Class identifier (option 60) set to BYGTELIAD ; the DHCP Client identifier (option 61) set to the BBox mac ;   Here are my settings (I simplified the code here, removing the next and end...)   I have an interface wan2 plugged to my FAI GPON: set macaddr xx:xx:xx:xx:xx:xx (whatever my BBox MAC is) Then I add a

HI ALl, I am new to Forticlient VPN ..we have installed Forticlient VPN verison 6.0.10 in our windows 10 machine . After entering credentials VPN trying to connect till 10% and then stops & throws unable to reach vpn. However my credentails are wroking in another laptop with same os ..dont know whats need to rectify .  could you please help on this 

Hello,sometimes I can't connect with Fortnet SSL-VPN. What means the error ras_loop(), waitResult=1 or 258?  Information    VPN    FortiSslvpn: 15884: fortissl_connect: device=ftvnic  Error    VPN    FortiSslvpn: 14652: error: ras_loop(), waitResult=1.  Information    VPN    FortiSslvpn: 13316: fortissl_connect: device=ftvnic  Error    VPN    FortiSslvpn: 12232: error: ras_loop(), waitResult=1.  Information    VPN    FortiSslvpn: 12824: fortissl_connect: device=ftvnic  Error    VPN    FortiSslvpn: 12492: error: ras_loop(), waitResult=1.  Information    VPN    FortiSslvpn: 6500: fortissl_connect: device=ftvnic  Error    VPN    FortiSslvpn: 8496: error: ras_loop(), waitResult=258.

Hi Guys, I am new to FortiNet family and trying to learn things. I am trying on a FortiGate 300D factory reset box with version 6.2.1. The configuration is simple where I have a VLAN interface which communicates to a Cisco 7201 over private IP address. Since Cisco 7201 does not support NAT, I have to SNAT my source IP to the default gateway (Router). The problem I am facing is that if I try to use FortiGate as a default gateway for internal LAN, everything works fine and I am able to do SNAT just fine. I am just not able to SNAT from the firewall itself. Have tried all sort of possible in/out interface, source/destination addresses. But my trace goes to my default gateway with private IP address without source nat. FortiGate-300D # diag sniffer packet any 'host 1.1.1.1 and icmp' 4interfaces=[any]filters=[host 1.1.1.1 and icmp]7.084324 wan out 10.99.99.39 -> 1.1.1.1: icmp: echo request7.084326 port2 out 10.99.99.39 -> 1.1.1.1: icmp: echo requestWhere as if I try to ping publi

Network with a FortiGate 60F running 6.4.4. with FortiSwitch 224E. Created a VLAN 20. Was able to browse the internet but could not access a file server on the default LAN not part of a VLAN. Pinging by IP address worked fine but I could not ping via hostname. Appeared to be a DNS issue. I found that if I set the VLAN DNS Server to Specify and listed the IP addresses of the Windows Server DNS servers, that the DNS issue was resolved. Should it be necessary in this situation to set the DNS Server to Specify and list the IP addresses of the local DNS or do I have a setting wrong under Network / DNS or elsewhere?