Solved

We work with a number of offices that use some version of the 50 to 100 series FortiGate firewall. One worry I have is a hardware failure. Though I have only seen 1 failure ever of an in-production firewall, the risk is still a factor. Waiting 1 or 2 days to receive a replacement unit could be costly to the users. I realize that we could run with High Availability (HA) but this would amount to a 2x the firewall purchase and support bundle cost. Is there a way to keep a spare firewall in house and to replace a failed firewall with the spare in the event of a failure? If this is done I presume that the configuration could be imported from the last backup of the failed firewall. Could the support bundle be transferred to the replacement firewall? If not I presume that the replacement firewall could run temporarily without these services. Are there any other considerations that I am overlooking?

Hello all, Is there any way to forward select login events from the DC to the Collector Agent similar to syslog style? 

I had 3 WAN connection (ADSL modems) providing internet access to my company. I brought 4th connection which has a fiber metro connection by the switch and connected to my 4th port.1 - First set the new interface (named as metro_port). I selected role as WAN, Addressing mode as manual and IP/Netmask as ISP provided.2 - At Second step i defined Static Route. I gave destination to 0.0.0.0/0.0.0.0, interface as set up in the first step(metro_port) and gateway as ISP provided.3 - At third step i have insterted a new Policy Route in order to set my computer go out to internet over metro_port.4 - I set up a new Firewall Policy, incoming as Lan, Outgoing as metro_port, source as my computer's IP address. Selected NAT enabled. To maximize priority of this policy i dragged it to the first in list. Now unless unplugging or disabling my old WAN connections (ADLS modem connections), i cannot use new WAN connection to use internet access. I checked log tables, it doesn' even use to this policy

Hi, We are builting a virtual lab with the wonderful "Eve-ng", and for being able to restore quickly a configuration, we would like to use the "USB Device" via "execute restore config usb <file>". But we have to simulate the USB device through QEMU option. Could someone help us on this topic ? Thx.

Dear all, We are currently trying to split our compagny, and as well the network/security infrastructure. To do so, we set up VDOM on a Fortigate - FortiOS 5.6.4 (current VDOM root = the old "global" before VDOM enable, and VDOM NEW-CORE = the VDOM added to design a new infrastructure). Initially, the VDOM root has an OSPF area 0 and is peer with another Fortinet (working fine today) with the same area 0. When we tried to add the router ospf area 0 in the VDOM NEW-CORE, there was an incident : lost of the production flows on the VDOM root, as if routing was NOK after the change on the VDOM NEW-CORE. A rollback solved the issue. In summary, my question is : can we have OSPF area 0 running on multiple VDOM ? PS: Due to another CPU issue, we recently updated on FortiOS 6.2.4 Thank you in advance for your answers. Best Regards,

When I tried to import the Policy from FortiGate 400E with firmware V6.0.6 to the FortiManager the below error appeared, So can anyone help me to solve this issue, Thanks in advance. 

Hi; Can a Fortigate Firewall running version 5.2.x or 5.4.x insert an XFF header?  If yes, how exactly can this be done? Does it apply to the following models? or it will apply no matter the models?1500D, 600C, 1000C, 300D, 2000E KindlyWasfi    

Hi There,  I'm pretty new to Fortigate Firewall. I have a requirement to integrate the firewall for LDAP authentication.Initially I have tried to add the LDAP server and perform the test connectivity and it failed. Later when I checked the firewall I noticed that the LDAP server is not reachable when I use the execute ping command. I have below questions.[ol]While trying to reach out to the LDAP server does the firewall by default use the Management interface or will it refer to the routing table and use the traffic interface as per the routing?I was also trying to perform the test from the Firewall by executing the ping command with the management interface IP address as the source IP address also I noticed that the ping is enabled for the management interface. But the ping command failed from the firewall. I went on to check the switch connected to the management interface and from there I was able to reach the LDAP server by setting the source address to management VLAN interfa

After our laptops update to Windows 10 v2004, they will no longer connect to our WPA2-Enterprise FortiAP WiFi network. We have troubleshooted and checked our RADIUS/NPS settings, and they are correct. The users get authenticated, but the connection fails with this message in the FortiGate Logs: WPA-invalid-2/4-key-msgProbably wrong password entered, invalid MIC in 2/4 message of 4-way handshake from client  The laptop's event logs report "Dynamic Key exchange did not succeed withing configured time" Other laptops still on Windows 10 1909 can connect just fine. And if we roll back the Windows 10 update to 1909, it will connect again. If we take the laptop to our other office with Aruba AP's they connect just fine. So it's something to do with the Windows 10 2004 update and the FortiAP 221E Access Points. We just can't figure out how to fix it. Any ideas or suggestions would be greatly appreciated! Thanks!

Hi AllI have a filtered list of nearly 4000 devices in the Device Inventory of a 1500D FortiGate I support and wondered if there is a way to export the list Thanks in advance

a FortiGate 200D firewall on my side needs to update the firmware.currently its firmware verison is v5.0,build0318 (GA Patch 12) i tried searching for recommended upgrade path of firmware for this device in here https://docs.fortinet.com/upgrade-tool, however, not so sure about it. alright, the question is, in order to upgrade the firmware from v5.0 build0318 to v6.0.10,I had to upgrade to version 5.2.9, 5.2.11, 5.2.13, 5.4.10, 5.6.9, 5.6.11, 6.0.10 in sequence? update for like 7 times?!!what about the upgrade between v5.0 build0318 and version 5.2.9??? can i  jump from v5.0 to 5.2.9?

Just got an old fortigate 200D firewall but not familiar with it.I wanna aggregate two ports together and link them to downlink 2 switch ports. would like to know:is it doable to aggregate 2 ports together and link to switch ports (to increase bandwidth)?if so, then will the port speed be limited to the lowest automatically?(the switch port speed is 10Gb using CAT6 cable) thanks in advance

Hi, Please help me using my fortigate 100D as aggregate switch just as we do in Cisco layer 2 switch as below : interface GigabitEthernet1/0/33  switchport trunk native vlan 400  switchport trunk allowed vlan 2,3,400  switchport mode trunk  switchport nonegotiate  channel-protocol lacp  channel-group 11 mode active ! interface GigabitEthernet1/0/34  switchport trunk native vlan 400  switchport trunk allowed vlan 2,3,400  switchport mode trunk  switchport nonegotiate  channel-protocol lacp  channel-group 11 mode active and interface Port-channel11  switchport trunk native vlan 400  switchport trunk allowed vlan 2,3,400  switchport mode trunk  switchport nonegotiate I tried to do it as creating new interface 802.3ad aggregate with 2 ports but even after applying and enabling those ports, new interface shows down.  I have no idea if it is supported on FGT 100D.Please help RegardsR

Hi, Experts, I am going to set up the Forti600E HA pair. and would like to configure the active-active mode, any recommendation ? Many thanks in advance.    

Hello, Smaller devices like the 30/40/50/60 models do not have a dedicated mgmnt (oob) interface. How do i monitor the passive cluster member as it does not have such a mgmnt interface? thx, screenie

I have a FG200D and we are getting ready to receive a new Cradlepoint 3G/4G router for failover of the main office only. The plan is to connect it to WAN2. My question is this: Would it be better to use WAN LLB and set a sky high priority like 99 for WAN1 and 1 for WAN2, or would it be better to use two static routes and weight them accordingly? I mainly want to make sure WAN2 isn't going to be used unless WAN1 is absolutely down. I don't mind a small amount of traffic for health check but we are only allotted so much data per month on the fail over service without overage charges. I've seen multiple posts about this and read multiple articles, but couldn't really determine the best method from those. I've only known FortiOS 5.4, which apparently isn't the favorite for this setup since most of the failover documentation still references 5.2. Opinions and thoughts welcomed and thanks in advance. Kevin

helloi have a only one subnet that don't much with any ipv4 policy, when i check the router loockup i find the route to this subnet but when i use loockup policy to this subnet they much with poiciy id=0  knowing that i have policy from my vlan to wan with source set to any and destination set to any and all service are accepted

Good Morning Everyone, My 2 questions are hopefully very simple and probably a duplication of questions previously asked... 1. Are the FortiTokens still the valid way to handle Two-Factor Authentication with FortiGate products for SSL VPN2. I'm testing with the 2 free tokens. If access to the VPN is granted through an Active Directory group, the VPN does not ask for the FortiToken. If a user is granted access to the VPN using only their users, the FortiToken is required. Any ideas? All the best, Dan

Hi ,When you set a traffic shaper to be per policy, the FortiGate applies the traffic shaping rules defined to each security policy individually. For example, if a traffic shaper is set to per policy, with a maximum bandwidth of 1000 Kbps, any security policies that have that traffic shaper enabled get 1000 Kbps of bandwidth each. For example, if a traffic shaper is set to per policy with a maximum bandwidth of 1000 Kbps and applied to four security policies, each policy has the same maximum bandwidth of 1000 Kbps. I really got confused about the security policy mentioned here . I can see  tarffic shaping policy The same rule is apply for traffic shaping policy also ? Please help Thanks

Hi, guys, We have Fortigate 400e HA pairs, and the HA cables (two cables for HA ) are connected directly (i.e Forti400e -UTP cable- Forti400e). May I know if these two cables could be Lacp ? Also what are optimal values of the configurable setup for HA synchronization ?  Many thanks

Hi,I want to limit bandwidth  for windows update which is initiated by local LAN computers  The question is the below policy is ok ?  (source will be all and destination will be all )  Q2. If I want to use  "shared shaper"  instead of  "reverse shaper" ,What need to be done ,(Just for learning )  Q3 .  In shaper "windowsupdate"  I have  set 10Mbps .In my question If I use the same shaper  in multiple policies (for example in policy 1 and 2 ) , the 10Mbps will be divided  between policies ?  Thanks 

i am using ssl vpn with untrusted certificate, i wonder is this connection secure?can someone give me an advice?

hello allwe have 2 wan links peered with ISP for internet redundencywe are able to recive the 0.0.0.0 defult route from ISP Via BGPmy question regards a third wan link we own for CAM use , it uses a static route to the internet aswellbut i cant seem to have both 0.0.0.0 routes in the routing table in the same timeso we cannot acsess the CAM from outsidehow can i resolve this ? i have tried to put same distance and diffrent priority but the BGP route disapeers . .anyone came accross this issue ? Routing table for VRF=0 S       0.0.0.0/0 [30/0] via 192.117.0.*, port3 B    *> 0.0.0.0/0 [20/0] via 192.117.9.*, wan1, 03:22:58    

https://docs.fortinet.com/document/fortigate/6.4.1/fortios-release-notes/760203/introduction-and-supported-models Has someone tried this version already?

Hello!I'm running into a problem with our Fortigate 100E running 6.0.7. The crux of the matter is that the firewall policy contains these two entries (among others):edit 55     set srcintf "wan1"     set dstintf "any"     set srcaddr "BLOCKLIST"     set dstaddr "all"     set schedule "always"     set service "ALL"     set logtraffic all     set fsso disable next edit 46     set srcintf "wan1"     set dstintf "port1"     set srcaddr "all"     set dstaddr "DNAT_TCP_22" "DNAT_TCP_443" "DNAT_UDP_53"     set action accept     set schedule "always"     set service "PORT_TCP_22" "PORT_TCP_443" "PORT_UDP_53"     set logtraffic all     set fsso disable next&nbs