Solved

hi. i've read this articlehttps://docs.fortinet.com/document/fortigate/6.0.0/handbook/964247/dual-homed-bgp-example and at some point, there is an instruction to do an inbound policy from the isp back to the company lan. isn't that dangerous? why is it needed? isn't the only important port from the isp back to the internal network is the bgp port?

Hello, wondering if FQDN would be supported as a real server's address in a load balancing config? It seems that just IP addresses are supported but not using a FQDN? Thanks,Holger

Hi all, i have 2 FGT 800C running in HA mode Active-Active before 3 days ago i have upgraded the firmware from 5.2.4 to 5.4.2 using proper upgrade path which provided by fortinet 5.2.4 > 5.2.6 > 5.2.9 > 5.4.2, after upgrading the firmware i noticed that FGT GUI is very very slow especially when i navigate to polices page took like 3 to 5 mints to open. i have opened ticket with foritnet support and waiting for their reply, did anyone faced this issue? Note: i changed the HA mode to Active-Passive, matched HA Hash, and restarted the both units. Thank you.

i want to use a 100F in HA mode but the 2 devices will at opposite ends of a long building so i was going to run the HA over fibre but the HA ports are RJ45 (ethernet) can i use any port for HA or will i have to run Cat5/6 for the HA? 

Hi, Interface1 interface2I have created the policy source is interface 1 and destination is interface 2Why do I have to create a policy in reverse direction ( I mean source is interface 2 and destination is interface 1)Thanks 

Hello i have a problem about reset AP222E  so i try more time but i can't reset !!  So what's the problem exact and how i can resolve !!! Also this AP222E can't receive any DHCP !!! Please someone expert can reply me and help me Thanks in advance

90D has high CPU utilization almost all the time, using dia sys top, netscan runs at 95% almost all the time. Any ideas?

Good day all, we have some interface & zone that are not in use.What is the best method to delete these & also checking on if it affects anything else.  

https://docs.fortinet.com/document/fortigate/6.2.4/fortios-release-notes/760203/introduction-and-supported-models 

I've tried many times in the past to try and block IPs in our FortiGate 60E (firmware v5.6.3 build1547 (GA)) and I must say it's the most convoluted and confusing UI I've used to date. Which is why I'm here asking what I'm doing wrong. What I've typically done is create a new address and then set it to deny in the IPv4 Policy. (step1.png)Policy & Objects -> Addresses Create New -> Address Name: "45.141.84.162/32 20200805" Type: Subnet Subnet/IP Range: 45.141.84.162/32 Interface: wan1 (or all) (step2.png) Policy & Objects -> IPv4 Policy Create New Name: "Block 45.141.84.162" Incoming Interface: wan1 Outgoing Interface: internal Source: "45.141.84.162/32 20200805" Destination: all Schedule: always Service: ALL Action: DENY Enable this policy: Checked But i then still see traffic coming through as if it did nothing. I've also tried using IP ranges of 45.141.84.162-45.141.84.162 and that has done nothing as well. So far the only way I've seen to actua

Good day all, Using zones in our fortigate firewall. Is traffic within the same source & same destination zone allowed by default or it needs a rule in place? 

Fortigate 100E 6.4.1Hello guys, I am new at forum as well at Fortinet Firewall. I am working in a company at Greece. We have Fortigate 100E with 6.4.1. Before i mention my problem let me explain you my topology. We have 2 ISP on WAN 1 and WAN 2. On WAN 1 which connected to ISP1 we have a block of 16 static IPS and on WAN 2 he have ISP 2 with DSL connection, ISP modem/router in Bridge Mode and in WAN 2 on Fortigate PPPOE ( Username and password) with static IP. On my Local Network i have my LOCAL LAN ( 192.168.230.0/24) and i have created 2 VLANS ( VLAN 100, 192.168.5.1/24 and VLAN 200, 192.168.8.1/24) under my LOCAL LAN. In the VLANS i have Servers ( Mail Server, FTP Server, Web Server, Web app Server etc) My Goal is to achieve traffic from LOCAL LAN and VLAN 100 go through WAN1 ( I have setup in my WAN 1 secondary IPs so i can bind every server with one static IP ( one to one NAT) ) and i havee setup firewall policies. And VLAN 200 traffic go through WAN 2 ( PPPOE with Static) an

Hi,scenario is, we have MPLS p2p VPN and internet DSL link and DIA link. our server is on another site where we have MPLS connectivity. currently internet traffic is going through DIA link this subnet 192.168.4.0. rest of the traffic is going through MPLS which is correct. but i want to make DSL primary internet. i can do this by changing ADMINISTRATIVE DISTANCE but the problem is from outside those who are connecting through SSL vpn cannot login in. what is the solution?

All,Successfully upgrading a FortiGate 200F results in a broken FortiDDNS application.  The FortiDDNS server list no longer populates with a list of available domains which breaks the service.  Rebooting the firewall does not solve the problem.  Further, the maintenance tunnel through FortiCloud will not connect to the system.  Has anyone else experienced this issue?  Is there a solution to this? If the FortiDDNS service is important to you, then I recommend against upgrading to FortiOS 6.4.2 until this is addressed.

Hi, guys, I am rather new to Fortigate devices, after a pair of Forti400e have formed HA structure, I found them not synchronized due to the following message:login: slave's configuration is not in sync with master's, sequence:0 slave's external files are not in sync with master, sequence:1. (type APPDB) slave's external files are not in sync with master, sequence:3. (type CERT_CA) slave's external files are not in sync with master, sequence:4. (type CERT_CA) slave succeeded to sync external files with master slave's external files are not in sync with master, sequence:0. (type APPDB) slave's external files are not in sync with master, sequence:1. (type APPDB) slave's external files are not in sync with master, sequence:3. (type APN_CERT) slave's external files are not in sync with master, sequence:4. (type APN_CERT) slave succeeded to sync external files with master slave's external files are not in sync with master, sequence:0. (type APN_CERT) slave's external files are not in s

Hi, Guys, I created two SD-WAN rules as the following:------------------------------------------------------config service   edit 1       set name "Access_to_Internet"       set dst "all"       set src "all"       set priority-members 1 2 3    next    edit 2       set name "LL_Line-to-16HK-DC"       set dst "16HK_V167_10.16.7.0"       set src "VLAN329_10.32.9.0"       set priority-members 5 4 6    next    end   How can I prioritize the "ëdit 2"  for routing decision, thx a lot ? Many thanks   

I am using an evaulation vm of Fortigate 6.4.1I have enabled all traffic in one rule, and one to block an FQDN (for the sake of this example it would be facebook.com).And yet when I try to reach facebook.com through my browser it is not blocked.If i'll try to use a web filter, Facebook will be blocked.Is this because the evaluation trial of Fortigate doesn't support FQDN, or am I not configuring something properly?Thanks in advance.

Hi, guys,I am new to Fortinet products.We have two sites, I just installed Fortigate 400e HA pair at each site, and multi WAN links at each site, like SiteA has two internet lines for web surfing and then two IPLC lines connect to SiteB ( also has two internet lines ) I would like to get recommendation from your experts, how to design/configure the 400e HA pair at each site:1. Internet lines for web surfing at each site2. IPLC lines for two site communication ( with private IP subnets)    Many thx in advance.  

Hey All, Just got a 60f and putting it through the paces.  I am noticing high mem around 60% and if np does anything basically goes to conserve mode and need to reboot.  Scoured cookbook and other googles and cant seem to find a good NPU best practice.  Wondering if anyone else has played with this at all.  Using at home, about 10 policies, 2 of which do actual filtering.   Just wondering thoughts.

Hi, I am not sure where to post this thread (please correct if this is the wrong forum). Is there an API available to get forti asset information (based on contract/license/serial number related queries) ??

Is possible to do it in VPNSSL? Client certificate plus LDAP username and password for authentication. And a bit more complex, Cliente certificate match UPN with LDAP username. Cliente certificate is only valid for the user that is trying to authenticate throught VPN. https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/751987/ssl-vpn-with-ldap-integrated-certificate-authentication Thanks 

Hi all,I have worked with the Fortigate firewalls now for about 2 years in my current role, but I do not consider myself a firewall person at all.I seem to struggle to come up with a good naming scheme for my policies and also how to best create policies so:[ol]We dont have tons of policieseasier to find the policy you are after[/ol]So we have policies named like "SiteA to SiteB" allowing all services and from and to has 2 different subnets Or we have "Allow AD,DNS,NTP from DMZ to LAN"  with services "Windows AD" + "NTP" from the DMZ subnet to 2 specific domain controllers.But we also have policies named "SiteA Server Lan to Datacentre" which has 4 VLAN interfaces in the from field and 1 VPN tunnel in the To field. The problem i seem to have is coming up with a consistent naming format for my policies and we we seem to mix in regards to creating 1 policy per thing either "SiteA to SiteB" or "Allow SMTP for Server1 to Exchange".[ul]How do you name your policies?Do you create one

Hi all I am trying to send all the log message I get in Logging -> Log Access -> Logs to a syslog server. But none of them arrived. I have the syslog server configured with the IP address, the level is Debug (but also tried with Informational, there is no change. Anyway Debug should include everything above it, therefore also informational). For the Facility I tried a couple of things, such as syslog, local0, auth etc. Is there a documentation how the FortiAuthenticator sends out these log messages, with which Facility? Is it possible in the same syslog server setting to send everything I get in the log file? Thank youMarkus

Hello all. I've enabled an Automation stitch to email me whenever any other admin signs into the FGT (6.2.1) and makes any changes. Those emails look like this: FGT[FGxxxxxxxxxxxxxx] Automation Stitch:Config-Change is triggered.date=2020-06-29 time=08:25:47 logid="0100032102" type="event" subtype="system" level="alert" vd="root" eventtime=1593437147787054028 tz="-0500" logdesc="Configuration changed" user="xxxxxxxxxxxx" ui="ssh(xxxxxx)" msg="Configuration is changed in the admin session" Is it possible to have these emails include the EXACT config change made .e.g. user Andrew made a change: an interface IP address changed, or a policy was disabled?

Hello everyone, we have setup a basic wifi network (UniFi) which auth against a windows 2016R2 radius server All is working fine. The problem we are having is that the fortigate firewall is not seeing the usernames and therefore not pulling them into the correct rule set. Since users authenticate to WiFi using NPS on Win2016, FSSO does not detect them on FGT.Is it possible to get FGT to detect which user is authenticated by the radius??I tried this: https: //cookbook.fortinet.com/ssl-vpn-radius-authentication/ and unsuccessfully. But I do not know if it is right for this workaround. Thank you. Jirka