Solved

Hi Everyone, Installing policy from the Fortimanager to the Fortigate gives this weird message ... Where to find this certificate in the Fortimanager, or how to delete the certificate from the Fortigate .. Appears to be a Wifi certificate (I am pretty sure Wi-Fi features are not in use on the fortigate where the policy is being pushed to ... ) <hostname> (ca) $  delete "Entrust_Root_Certification_Authority_-_G2"Can not delete a static table entryCommand fail. Return code -61<hostname> (ca) $  end<hostname> $  end  ---> generating verification report( certificate ca )            delete "Entrust_Root_Certification_Authority_-_G2"( vpn certificate ca )            delete "Entrust_Root_Certification_Authority_-_G2"<--- done generating verification report Any suggestions, most appreciated :)  &nb

Hi all.As per subject - how do I need to proceed, to be able to use the two 40G ports (53 & 54) on a FSW1048E?In the GUI I see only up to port 52 and I would like to use 53-54 for ISL between two identical FSW1048E (running 6.0.3).Thanks,Flavio.

Hello experts, today we deployed FGT200E to part of the network. We terminated two parts of the network - vlan666 and vlan777 - both networks are WiFi and both have DHCP on FGT. DNS is Google DNS Everything works ok, only in the log we have very often a message: Deny-policy violation - dst iface unknow-0. Although it is legitimate traffic to be routed to the internet. No BGP or OSPF is used, NAT is performed on an IP pool on a public IP address. config firewall policy    edit 26        set name "UINIFI Guest->WAN"        set uuid 671a3c32-e734-51e8-b9c2-43cbdf86ab1f        set srcintf "VLAN777"        set dstintf "wan1"        set srcaddr "UNIFI Guest"        set dstaddr "all"      

Goodmorning!I have Fortniet Fortigate 310B.I buy this, because I need make a VPN connection. It is of course not a new unit, but used.  And now I have problems with connection with this unit.First: according instruction in internet I connect ethernet cable to Port 1, set the host IP:192.168.2.1, but Port 1 is inactive. No connection in this way.Second way: I connect serial cable to console port, configure COM1 to 9600/8/1/none/none, start PuTTY, PuTTY is conected to Fortinet.And now I see serial numner, and login, and a question mark.So I type: admin <Enter>, password <Enter> (without of password).I try type "admin", "Admin","ADMIN", ....always "Login incorrect".In instruction is, login: admin, password: none (just press Enter).The seller assured that the device is reset to factory settings.Factory settings are: admin/none. What I am dooing wrong?Regards! 

I am adding another building to an existing network and I am trying to create the following network setup: [1st building]cable modem ISP --> fortigate firewall --> JGS524NA --> cable to 2nd building [2nd building]cable from first building --> JGS524NA --> internal network of computers The 1st building network has been excellent and has an existing switch to expand and support the onprem devices. Now I am trying to extend this network into a second building (less than 100m) away. Here's the problem - when I plug in the cable from the first building into the new switch - its like the switch isn't even working - no lights show that the cable is plugged in. When I plug the cable directly into my laptop - it works just fine and I can get DHCP address. But when I plug that cable into the switch and attach other devices to the switch - no other device will work. Some observations:[ol]I purchased another switch - to rule out a hardware problem

   Hello  could you please help me which device is better for reporting purpose, fortianlayzer or forti cloud.  Can please give me detailed difference between FortiAnalyzer and FortiCloud

Hello,I have fortigate and fortimanager vm trial version 6.0.2. I could not add FortiGate to Fortimanager.There is no connectivity problem between fortigate and fortimanager, but I get "Probe Failed" error. FMG protocol is enabled on related interface. I checked task monitor logs on FortiManager, I saw "Cannot communicate with remote device (tunnel is down)" and in the description "2019-04-29 15:14:24:fgfmstarterror". what might be the problem? thank you,

Dear all this will be my very first post and please go easy on me :) and I hope I get good respond and thanks before! So far, any fortinet literature or cookbook or video only show that site-to-site IPSEc is created between two fortigate (site to site ipsec illustration.png), and the policy and static routing is created based on the two directly connected subnet (to fortigate).  For example, between HQ internal network (assuming 10.10.10.0/24) to Branch internal network (assuming 192.168.10.0/24), the private network is part of directly connected subnet to the fortigate physical interface.  What happen if private network  is behind another layer 3 device? for example, I want to create a VPN between 10.10."20".0/24 to 192.168."20".0/24. it means, both those .20 network are not directly connected to fortigate broadcast domain / physical interface. If I am configuring HQ FGT, Should I simply state local address as 10.10.20.0/24 and remote address as 192.

HelloCould you please help me how to block sub advertisement in a website.please find the attachedI am using fortigate 100E

Just had an interesting experience when updating an HA a-p setup. The failover unit was re-installed earlier this year due another issue. When updating firmware, it turns out the passive unit had an older version of the Internet Service Database Definitions. Given this, the unit simply replaced the services involved in the policy as some of the services didn't exist in the current version. The policy had Microsoft-Office365, Microsoft-Microsoft.Update and Microsoft-Azure defined. After the failover switch, the policy was replaced with Microsoft-Office365, Microsoft-Other and Microsoft-Other. How can I make sure this doesn't happen future wise? 

I had a client request whatsapp be opened up temporarily during this lockdown period while some of them are in the office and communicating via the app.  They had it blocked and opened it again and ensured the application policy was enabled ok and confirmed with the client it was indeed working fine. The next day it stopped working, disabled the policy and re-enabled it again and working again, next day not working.  I created a new policy with the ports whatsapp uses and tried that and working and again today not working.  What is causing this to stop every day?

Hello,  I am new to FortiClient and am using it for Anti Virus on a few Win 7 Pro computers.  When some youtube videos are attempted (i.e. [link]https://www.youtube.com/watch?v=A6DqPBJNkvk[/link] ), I get an error message in the viewer "Video unavailable This video is restricted.  Try signing in with a Google Apps account."  If Forticlient is shutdown, the video works.  If Forticlient is restarted, the video fails again.  I do not see any indication that the site is blocked in Forticlient (no notifications, 0 Sites Blocked).  I tried adding an exclusion *.youtube.com  but that didn't help either.  I cleared the Forticlient log, tried to open video, and then exported the log.  However, I do not see any blocking.  I can add the log file if that is useful to anyone.    Any suggestions to troubleshoot this issue are appreciated.Thanks,Dale Sykora 

Hi! I have a Mac running High Sierra with the latest version av FC.When connecting to VPN it takes a couple of seconds, then the icon in the menu bar disappears and nothing happens.If i open the console it says "connecting" and the button "Disconnect" but nothing happens even after waiting for minutes.  I have a client that runs 5.6.0.703 and it connects without any issues.  Have tried reinstalling, rebooting etc.

 https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/2e118d36-bde1-11e9-8977-00505692583a/FortiOS-6.2.2-New_Features_Guide.pdf

Hi All, I am new to Fortigate firewalls and I am wondering if someone of you can help me with a query. The physical interface is in a "root" VDOM and VLAN interfcae is in a "abc" VDOM. When the traffic leaves VDOM "abc" it goes directly to internet and vice versa, only the physical interfaces are in root vdom. So will need inter vdom routing between vdom "root" and "abc" ? Appreciate your commets, Thanks !

Hi! There is a network conflict between my local network and my employer's. I use 10.0.0.0/24 locally, but unfortunately they map the entire 10.0.0.0/8 range even though in practice my home network doesn't really conflict with any subrange in the 10.0.0.0/8 space they actually use. Naturally Forticlient wants to route all 10.0.0.0/8 traffic over the VPN. This means I can't access local resources such as my printer or NAS whenever I'm connected to the VPN. I've alreay spoken to IT and there's not much they can really do about that, and I can very much sympathize with their reluctance to experiment with it in current times :). However, I figured I should be able to solve the problem locally by adjusting the routing tables. Unfortunately that doesn't really seem to help. As if Forticlient overrides Windows' routing tables. There should be a way around this, right? So, here's my routing table before I connect to the VPN:Active Routes:Network Destination Netmask Gateway Inter

Hi All We are looking at utilizing the Webhook Stitch to send alerts to us, we have come accross a cookbook for setting up Slack, we however use teams. Has anyone used the Webhook automation stitch to send notifications to MS teams channel? Thanks

We are currently using version 5.6.11 on Fortigate 200E (data center) and Fortigate 80E (branch offices).  I am evaluating the benefits of upgrading FortiOS into 6.X.  Here are my questions: 1.)  What are the biggest benefits of upgrading from the 5.6.X versions into at least 6.2? 2.)  I am considering either 6.2.2, 6.2.3 or 6.4.  Of these versions, are there any which have been unstable or have displayed issues?  I would much rather be on a stable version which isn't necessarily the latest rather than one which may cause issues. Any and all input is very much appreciated.

I have read that there was a button added in FortiOS 5.6.1 for a button to enable a remote user using RDP through SSL-VPN to send a CTRL-ALT-DEL to their host PC.  I cannot see where this button (or any button for that matter) is.  Does anybody know how to access it?

Hi All Management have asked me to pull out VPN activity reports for a few users. Please can someone guide me in pulling this type of report? I have a Fortigate 500E Firewall uploading logs to Forticloud. Thanks in advancedRyan

Hi.Is it possible to do a server load balance in FortiADC where you have 2 real server in a real server pool where you run is as active/backup? iv got a website behind my ADC where i want 1 of the to be the active and the other as the backup, it's because there is a script that copies things from the active to the backup. Morten

Hello Guys, what would be a best practice to migrate Email Domains from other MailServers oder Email Security Gateways to FortiMail? i do have CSV from Postfix with 100 DOmains and want to somehow do a script that will create this domains on FortiMail and assign predefined Profiles. is that possible? or do we have to use somehof FortiMail API? Is there any guide for that or some recommendations? i see that i cannot upload scripts to FortiMail Can i use Putty > Connect to FortiMail and do Scripts directly via Putty? would appreciate your advice Thank you

Hi,We have site-to-site VPN tunnel to remote office with Fortigate VM64 on remote end, everything was worked ok. I need to add additional network (mobile VPN), from which remote office must be accessed also. I did changes (added network and policies) on both sides, but mobile VPN traffic still drops somewhere on Fortigate side. I can only see through packet capture, that packets are coming to Fortigate. What else I can do for debug the problem? Sorry, I'm not a Fortigate guru.

Hello, Fortigate vpn given to one of our support partners have been identified as having issues.Support partners remotely assist our team for our application environment, but when they want to access their own company emails they are unable to as the dns fails.What is the solution to this problem & how to implement it? Appreciate all help, thank you. 

I am trying to poke a hole to allow Spotify. I managed to set two services in a new policy, which was successful: TCP/UDP/SCTP78.31.8.0-78.31.15.255TCP 4070 TCP/UDP/SCTP193.182.8.0-193.182.15.255TCP 4070 In the policy's Destination field, do I need to limit the Destination to the same address ranges to be safe? I'm confused as to whether specifying an IP range in the Service makes specifying a destination unnecessary. Thanks.