Solved

Hello All. Did anyone ever measured the max thoughput on the inter vdom links?Looking for this information online, but wasn't able to find it. 

hi . i have a fortigate 100e . i have a problem i add a vlan in port 2 and make a policy for that and when i connet port 2 direct to a laptop i can not get ping or see my laptop in fortigate and when i set that config direct in port 2 without vlan i can see laptop or ping that. whats problem ?? i dont know !!!!!

Hello there, im fairly new to Fortinet hardware so i figured i could ask this question in here: I've setup a site-to-site IPSEC tunnel, my problem is that one of the sites has DHCP on the WAN port. Meaning that if the FortiGate resets, it will get a new ip address and then the tunnel will go down. How do i configure an IPSEC tunnel where one of the sites gets its WAN IP via DHCP? Thanks in advance :)

Hi everyone,I'm using Fortigate 301E with os 6.4.3, I have a very strange problem, the default NPU_vdom_link didn't work at all. The traffic was ended by the NPU vdom interface, and it didn't forward to another one. I try to create two vlans attached to both NPU-vdom-link, but without luck. So I try to use traditional vdom link instead, by creating a new vdom link interface, everything works fine!!! But the traditional vdom link can't use as a SD-WAN member. Is this the bug in FortiOS 6.4.3?

HI, Why i cant change and modify the SSL/SSH Inspection part from the security prifileits says the default profile is read only?I cant do the cloud backup for Veeam software and i was trying to add the cloud site to an exception list something like that But cant modify anything on this policy ?Any idea?  

I ordered an SFP module that should be compatible with my 200D.  However,  I cannot get the interface up. Note that this is my first time ever working with fiber.  Most recently, I have tried setting the speed manually to 1000full, however this isn't working.  Is there some way to "test" this SFP module? Or anything else I should try? # config system interface # edit dmz1 # show    "set speed 1000full" # diag hardware deviceinfo nic dmz1   "status :down"   "Speed :10"   "Duplex  :half" # set speed 1000full # show   "set speed 1000full" # diag hardware deviceinfo nic dmz1   "status :down"   "Speed  :10"   "Duplex :half"  p.s. This editor is frustrating.

Hi all, First time Fortinet (30E to start with) user, and I've booted it and set it up basic, installed the license, and went to test web filtering and it's letting me through to any website on any device I try. It seems to be on:  License is until 2025:  What am I missing here?

What does enabling/disabling the NAT option in a Policy exactly do?

Hi, I need to install FortiClient to access a clients network. I have downloaded the newest version of the client but every time I try to install it gets to the point of " Starting services" then fails and rolls back the installation. The installer gives no indication of any error. The windows event log contains " Windows Installer installed the product. Product Name: FortiClient. Product Version: 5.0.1.0194. Product Language: 1033. Manufacturer: Fortinet Inc. Installation success or error status: 1603." I have full admin on my machine and I am trying to install into the standard program files folder. Anyone any ideas?

hello, we have a fgt-40f. we also use voip and it looks like that SIP ALG blocks it. on web GUI i couldn't find anywhere to disable it. tried several forum but most of them are for old firmware current firmware is v6.2.5  can anyone send a configuration how to disable it ?

Is anyone using FortiCloud Multi Tenancy service for a Managed Service Provider (MSP) to be able to create and manage multiple SubAccounts? I would like to use a FortiManager for customers FortiGate and FortiAP units but the cost is fairly high. I was told that the FortiCloud – MultiTenancy Account might be useful in lieu of the FortiManager. Are others using this? How effective is it?

Hi!   I configured a automation action on my Fortigate (6.2). The automation was configure to send a e-mail when a interface status change. The notifications is work well, but a questions is that on email not inform whic interface had the status change. Below the mensage that I recived from fortigate.   "FGT[FG200ETK189xxxxx] Automation Stitch:Interface_Status_Change is triggered. %%Interface JGS Status Change%%"   Is possible recive the interface name information?

I have a user where this file has grown to over 200GB. Is there a way to compress or delete the file to free this ungodly amount of used space for a data file?

Can someone tell me what information I can check to see if there is no compatibility problem between an FG 600D that I want to update to version 6.4.3 and my FortiAPs that are in a version v6.0 build0037?

Hi,  I was trying to set an exception to one of the FortiGuard category based filters, some of the options that show up in the cookbook are not on my page. specifically under Status URL filter the URL Filter and Content Filter Options are missing. They show up in this document, https://docs.fortinet.com/document/fortigate/6.2.4/cookbook/725397/web-content-filter, but all I see is "Block invalid URLs" and "Block Malicious URLs discovered by ForiSandbox". Anyone have any idea why?  I'm on FOrtiOS version 6.2.4 Thanks. 

I have a FGT 200D running 6.0 and have used the 'set management-ip' command there to specify a local (non-syncd) IP address so that each unit in the cluster can be directly managed/monitored. Just got a new FGT 600E and am unable to apply the same command. It's not showing up in full output as an option, or using command completion. Checking the CLI reference log it shows as valid command for 6.2. https://docs.fortinet.com/document/fortigate/6.2.6/cli-reference/10620/system-interface Is there a pre-req before I can apply this command 6.2?

I want to create a VLAN.  I do not want to create a VLAN Interface.  I do not want routing/gateway capability.  I do not want the FortiSwitch/FortiGate to take an IP address on this VLAN. Is this possible?  I'm beginning to think that in the FortiWorld it is impossible to create a Layer2-only entity. Thank you, Chris

Hi, Has anyone worked through a similar problem on SD-WAN where the self-originated traffic isn't smart enough to pick the correct interface to get out ( internet ). I know this because running diagnose sniffer packet any "port 8888" 4 0 l we can see the device is trying to use the wrong port / sdwan member to talk to forticloud on port 8888. That's whats tricky with the self originated traffic when it doesn't work. In this case we have wan1, port1 and port2 as member interfaces for sd-wan. port1 and port2 are private circuits and wan1 is the internet gateway. Looking at its very obvious which interface has the internet gateway but the device wants to use every port except the correct one for the self traffic. :( All the user / client traffic is operating as it should.

Dear expertsCould anyone tell me why I can't see any entries in the fgHwSensors table for some devices? I can see it in our 1500d and 300d but not in an 100F.  They're running the same version. 1500D and 300D: 100F: In case the images above are blocked for CORS/throttle reasons, here's a link to all three:[link]https://imgur.com/a/ud7JIDv[/link] Any ideas? Kind regards,Patrik

Hi guys So my FG-60D running 5.2.3 has been at 100% CPU and about 90% memory recently so I thought I would run the diag sys top command as shown below.  From this command I can see that the scanunitd and IPS engine it taking most of my CPU usage. I don't have vulnerability scanner but I have AV enabled on 17 different policies. I think the box is being overworked, but can I restart any processes or do you guys have any other advice? Run Time: 42 days, 19 hours and 54 minutes 62U, 0N, 37S, 1I; 439T, 40F, 189KF scanunitd 7079 R < 68.4 3.7 ipsengine 602 S < 19.2 13.1 httpsd 7717 S 2.3 4.2 httpsd 7718 S 1.9 4.2 httpsd 7737 S 1.7 4.2 I also ran get sys performance - Output below CPU states: 75% user 25% system 0% nice 0% idle CPU0 states: 75% user 25% system 0% nice 0% idle Memory states: 93% used Average network usage: 6282 kbps in 1 minute, 2754 kbps in 10 minutes, 2200 kbps in 30 minutes Average sessions: 1995 sessions in 1 minute, 2178 sessi

HiWe are running version 6.2.3 on a fortigate 301EI want to use a different SSL certificate on an existing SSL inspection policy to only inspect the headers , not full inspection.I have created the csr on the FG,  got it signed by our trusted subca and imported it back into the FG as a local certificate successfully. It is now sitting in the FG cert store under local certificates. When i select security profilesSSH / SSL Inspection and select an existing profile , the settings are Multiple clients connecting to multiple serversSSL Certificate InspectionIn the CA certificate dropdown my new certificate does not appear in the list.  When i try and create a new one then upload it states the certificate already exists which it does. Does anybody have an idea why the new certificate is not showing in the drop down many thanks in advance mac

I have a FortiGate 61E at a remote site with a VPN tunnel back to my main site. I have had a problem where my Windows clients will detect a new network, and will identify it as "Network 3". That is, when you choose a type of Network in Windows 7, you choose from Home, Public, or Work, and then it gives the network a name. So it's almost as if the Windows machine thinks that the network has changed. This happens rather randomly throughout the day, several times a week, with different computers. Yesterday I was doing some troubleshooting and I discovered that it's selectively unable to reach *certain* networks through the VPN tunnel. If I do a traceroute, it's picking up an address of 192.168.0.1 between the local gateway (the FortiGate) and the remote end of the VPN tunnel. The packets are dropping at 192.168.0.1. I do not use this IP address anywhere in my network! Oddly enough, I can browse to this IP address, and it loads a Ubee Modem DOCSIS page. I called my ISP, Spectrum (formerly

Hello.  Can FortiNAC require that a computer be domain joined before getting an IP address or being allowed network access?  If it isn't, like a contractor or a visitor, I'd like the machine placed in a locked down guest vlan with only Internet access.  Thanks everyone!

Hi, i'm using this commanddiag sniffer packet any "host x.x.x.x" 6 0 ato capture some traffic, then convert the text file using the tool fgt2eth.exe to convert it to pcap.https://kb.fortinet.com/kb/documentLink.do?externalID=FD30877 Then... when I'm going to view it in wireshark, it shows TCP-out-of-order in all the capture.I try a lot of captures with different destination and in different firewalls (models 100d, 300d, 500d) same result. A lot of TCP Out-of-Order I'm doing something wrong? is not possible that in all my tests was errors in comunication.  Same result in all my captures from CLI.

Hello, I have an internal IIS server with one site configured with the following address (for example) : https://toto.test.frThe IP server is for example : 10.0.10.1The public ip address is for example : 1.1.1.1 I created the following virtual IPname : test external ip : 1.1.1.1internal ip : 10.0.10.1Port forwarding TCP : 443 to 443 Then I created my policy enabling all from external to access to test on service HTTPS. It's working but I would like to know how to enable the ping to toto.test.fr because currently it's not working.I tried to add a new virtual ip by selecting port forwarding ICMP and added ICMP+Ping  to my policy but it doesn't work. Regards,