Solved

Trying to restore a configuration from file to a pair of 60e but keep receiving the message below. I downloaded the config directly from a production device so I *know* its good. Have tried on 2 different 60e. 2 usb drives. Factory reset both firewalls.  Firmware is the same level on the device as on the config. Google shows virtually nothing for the return code. I'm lost here.  FGT60 # exec restore image usb config.confThis operation will replace the current firmware version!Do you want to continue? (y/n)yPlease wait...Copy image config.conf from USB disk ...Get image from USB disk OK.Check image error.Command fail. Return code -28

Hi, Color me clueless.... I'd like to connect my Fortigate 100F to a Vertiv Avocent ACS 8000 Console Server. How do I go about doing this when the Fortigate uses a RJ45 console port? In advance, Thanks so much for the help. 

Hello. We have an RRAS server (Windows Server 2016) for VPN Access. It is currently using PPTP and we are working on upgrading it to L2TP for more secured encryption. We are having trouble getting the L2TP pass through the FortiGate firewall from the internet. The setup works just fine if I connect to the server directly (internally), so I know it is the firewall. Logs are showing the policy is accepting IKE connection, but the VPN connection stuck at this step(in screenshots) below. Screenshots for policy, VIPs, and Logs[link]https://ibb.co/jHcGtCn[/link] [link]https://ibb.co/096vFNS[/link] [link]https://ibb.co/5M6NTm3[/link] [link]https://ibb.co/F6vMRVQ[/link] [link]https://ibb.co/YXBPvcj[/link] FortiGate 90E, firmware v5.4.11,build8140 (GA) Thanks for helping! 

On FortiGate 5.6, I've currently got 2 1G ports linked in a LACP aggregate team to a Cisco switch. We are wanting to migrate to a single 10G link via a different switch with as little disruption as possible. The LACP interface configured directly with an IP address (no vlans) and is linked to a number of address and policy elements. Is it possible to remove the two 1G ports and add the 10G port to the aggregate interface in one operation? I assume the 10G would have to be set up as the only member of a LACP aggregate on the Cisco side. I know the guaranteed way would be to move the IP across to the 10G port and then migrate the address and policy elements, but this would be quicker.

got a fortigate 200D old firewall in my company's lab environment.i'm constructing a network topology with 200D and two switches(other brand), and these two SW are providing redundancy for end devices/servers. the topology is shown in attached figure. well... i'm a newbie on networking and not familiar with fortinet's product at all, so my questions are stupid and hope you don't mind:According to my topology, do i need to set STP on 200D to prevent network loop?i want to make the interfaces(which connected to switches) on 200D isolate the switches' broadcast and also be the gateway for redundancy.(i will also utilize L3 routing on switches for VLANs but these VLANs need to reach firewall for internet connection...)therefore if one interface(on 200D) or switch dies, the other one could still provide network traffic for end devices. is there any special settings from fortinet that i need to be aware of on 200D for my network topology?? thanks for answering my dumb question

Using FortiOS 6.0.9. Need to run backups to a cloud server destination (*.domain.com). Was going to add an IPv4 policy with this address as the destination to exempt this traffic from normal antivirus, web filtering, DNS, etc. evaluation. I see that there is a Wildcard FQDN Address list. I created the address in this section but I can not list this address as the destination in the policy. I see that Wildcard FQDN Addresses are to be used in SSL exemptions and should not be used as source or destination addresses in policies. I can't be the first person to have this as a requirement. Is there a good workaround? I think I noticed tat newer firmware versions have this ability but I was trying to wait until the 6.2 and 6.4 versions became more mature but before upgrading.

Hi, guys, I am rather new to Fortinet product; I am configuring the Fortigate 400e with FortiOS v6.4.2;  For logging traffic, I can not enable "set fortiview-local-traffic enable" as the attached. Any recommendation ?( I have only local Fortiview, no FortiAnalyzer, FortiManager, FortiCloud..) Many many thx in advance.

Hello,We have an Hub n spoke architecture.Each spoke (3) can ping networks each other (NAT disabled). When NAT enabled on spoke zone to spoke zone, spokes can't ping each other. At this time, Internet access on spoke sites pass throught their Internet connection (WAN interface on each spokes)We want to pass Internet access throught HUB to manage all Internet Policies from the HUB. Is it possible? Thanks.Regards.Waaalex. 

Hi guys, Our company is implementing SSL VPN with Client Certificate which will authenticate by our Fortigate.However, many of our company users are not able to login with client certificate. Users with administrator rights have no issue to login. The reason is due to these users do not have administrator rights or read permission to access the client certificate's private key. In Windows Group policy, as I know there is no such settings to grant certain read permission to Certificate's private key. Anyone has any experience or encountered the same challenges while do not want to grant administrator rights to normal users? Thanks! 

Hello,we have upgraded our FG300D (not connected to the internet) from 6.2.0 to 6.4.2 this morning.After the reboot, the FG asked for a configuration to join Fortiguard servers.This is impossible : the FG is placed to filter an "internal" link between to sites on the LAN (the other side is a FG (v6.2.5))Since it failed to connect to the internet, it started, but le licences widget states "unable to connect to Fortiguard servers" and it apparently tries all the time...Is there a way to desactivate this fortiguard interrogation ?Is fortigate still able to work without an internet connection ? Thanx for your help Jean-Yves

Hi guys, I would be interested in what is the best/most reliable way to ensure that traffic is sent into an IPsec tunnel.I.e. if I can see outgoing Traffic within the IPsec Monitor and I also see packets when starting a packet caputre on the VPN tunnel - does that confirm that the traffic is sent trough the tunnel? Is there any (better) option to confirm this? Best regardscust0m

hello there,please help.we using FG30E with firmware 5.6.12we have created vpn ssl with tunnel mode, and client can connect successful.we have create 3 policies (as shown video tutorial):- WAN to VPN SSL, I don't think this have problem, since client can connect to vpn ssl.- VPN SSL to LAN, I assume this has no problem, since client can access LAN after connect vpn ssl.- VPN SLL to WAN, with configuration:source: all IP, list of users vpndestination: allservice: allNAT: ONAV: ONaccept connection. fortigate restarting. client connect to vpn ssl, success.but client can't access internet (trying browsing any website). need help please. thank you

Hi,We’re using multiply Fortigate 60E, v6.2.5, firewalls on multiply locations, they are connected through a IPSEC tunnel to one location, also a Fortigate, that works fine.The main location use a SIP PBX server and other locations use Sip Phones (Gigaset N300A).The Gigaset-phone will registering fine over the IPSEC tunnel, that works great. If the tunnel is down, of course the Gigaset don’t work anymore.But if the tunnel is recovering and automatically gets up when available, the Gigaset won’t register anymore. We’ve to power down the Gigaset phone for about 10 minutes, reconnect and all works fine.In the former Cisco configuration, this problem is not there, in the new Fortigate configuration, the problem occur. In Cisco configuration it works fine, so it’s not a problem on the Gigaset phones.Is there a setting I can check for this problem? For example, if there is a power down on the main location, we’ve to reset all the Gigaset phones on other locations and that is a problem. 

Hi, experts, I found internet access issue from the Fortigate, as the attached Dashboard (WAN IP can not be detected, and ... ), Due to the internet line is configured as below(the primary IP is private):the primary IP is : 10.10.10.2/30 (peered to the upper Layer3 device )the secondary IP is : 100.100.100.100 ( for internet access ).  any advice in order for the Fortigate being able to access the internet, thx a lot ? 

Whats the procedure like for changing a Fortiswitch from a standalone to one that's managed by a Fortigate?  I have 3 Fortiswitches in production that are working as expected and would like to have them managed by our Fortigate cluster however I don't want to lose the configurations on any of the switches. Any advice would be appreciated.  Thanks in advance!

Hi,I have read many times about emac-vlan and how it is supposed to be implemented. But finally when I tried to do it, it doesnt work like expected.Topology is like this: TRUNKundo port trunk vlan 1 (no default/untagged vlan)(vlan 10) [L3SW | 10.1.10.254] <---> [10.1.10.1 | Forti vdom root]     <- this is main connection to ROOT.Vdom, with internet, MGMT int. and all(vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.1 | Forti Vdom1](vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.2 | Forti Vdom2](vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.3 | Forti Vdom2] The goal was to implement emac-vlan interfaces on vdoms1-3, but after setting vdom1 (with vlan tag 11), i cant do it on Vdom2 - getting info that vlan is used by another software switch.I have similar setup on the WAN side, difference is that I want to use two different ports for one vlan 13 - one for root, one for vdoms. And its the same story, after setting vdom1 with emac in vlan 1

Hello, folks. I'm fairly new to FortiGate and I'm in the process of configuring an 80F to replace a Cisco RV320 router. The RV320 has 4 sub-interfaces tagged with their respective VLANs:- x.x.0.1 (default), x.x.10.1 (vlan10), x.x.20.1 (vlan 20), x.x.30.1 (vlan 30) The Cisco core switch has virtual interfaces for each VLAN:- x.x.0.2 (default), x.x.10.2 (vlan10), etc.- Each VLAN interface points to a Windows server for a DHCP-helper address- The DHCP scopes for each VLAN subnet points to the respective switch virtual interface (x.x.x.2) for its gateway- The core switch has a single default route pointing to x.x.0.1 on the RV320- The core switch is connected to the RV320 by single trunk port that carries all VLANs As I'm setting up the 80F I thought it would be nice for each VLAN to have a dedicated physical port on the FortiGate to avoid having congestion on a single shared trunk port:- I removed 3 ports from "internal" and configured them as standard ports (not VLAN) each

I am running a 500D HA setup at my production site and a single 500D at my backup site. All 3 devices are running 5.6.3 build 1547. Questions: Do people upgrade just because a newer version is available or do you only upgrade for vulnerabilities or needed features? Has anyone upgraded from  from 5.6.3 -> 6.2.3 using the Fortinet upgrade path and experienced problems outside of those in the release notes?    

Hi,Firewall is in   flow mode .If I change the antivirus inspection mode to proxy mode what is pros and cons Thanks  

Hi,Can I configure EMS via my fortigate (300D) or do I need to install the EMS server software?  I am trying to avoid installing the server software. Thanks 

Hi, Experts, Any document or configuration for Fortigate firewalls ? If an Internet line has only 100Mbps, how could I tell/configure the link bandwidth to Fortigate, in order to control the bandwidth allocation for different usage, for example:1. 30Mbps for voice2. 40Mbps for SAP application3. 30Mbps for user web surfing Many thanks for your information in advance.

Traffic ShaperI have traffic shaper policy . even if i reduce the download speed speedtest shows the maximum bandwidthfor example if I change to 10 Mbps ,it shows 100 MbpsThanks 

https://docs.fortinet.com...n-and-supported-models

I'm having trouble applying a route map to stop a FortiGate 201E from advertising certain connected subnets via BGP. In my examples below I've only shown one prefix. I actually have 6 I want to stop advertising. I also want this FGT to continue advertising the default route. I've tried a prefix list with the deny action set on the rules, and applying the route map to the neighbor, like this config router prefix-list edit "ISP_allowed_eBGP" config rule edit 1 set action deny set prefix 10.10.10.184 255.255.255.248unset geunset lenext   edit 2set prefix 0.0.0.0 0.0.0.0 unset ge set le 32next end end   config router route-map edit "ISP_allowed_eBGP_route_map" config rule edit 1 set match-ip-address "ISP_allowed_eBGP" next end next end   conf router bgpconfig neighbor edit "10.10.10.189" set route-map-out "ISP_allowed_eBGP_route_map" next end end I also tried 2 cresting separate prefix lists and setting the deny action on the rules within the route map, l

hi,i have a fiber link from ISP which is connected to router or modem provided by ISP. from that 1 link is directly connected to firewall with an ip 172.x.x.x. when i select the interface in SSL VPN config i get 172.x.x.x IP. how can i config interface so ddns can work with sslvpn.i have contacted support and he said you need to config 0.0.0.0/0.0.0.0 but it doesn't work because from modem private IP is config. i cannot connect directly because its fiber link and our firewall 101F doesn't have fiber port.kindly assist.