Solved

Hi, since the Update to FortiEMS 6.2 the LDAP sync is not working anymore. It says it was synced a few seconds ago, but new devices or moved devices are not shown. LDAPS is not working i can not save the settings it says: "protocol contais invalid values: LDAPS". The test is successfull.Someone knows how to fix this? Thanks

I have a 100E appliance with minimal web filtering set up (not many categories are blocked).Today, one particular URL returns a very basic "blocked" message, and it's not our standard Blocked page.The page simply says: "Web Page Blocked! You have tried to access a web page which belongs to a category that is blocked."When I view the source code, the only other thing on the page is this: "TITLE: Fortinet Secure DNS Service Portal" This is not our standard Blocked page, like the one I see when I go to a site that I know for sure should be blocked.The URL in question DOES work outside of our firewall though, so I know the problem is internal. The web category that it belongs to (Global Religion) is set to "allow", and even if I override the site to put it in our custom Allow category, I still get the same strange blocked page. Any ideas what might be happening? We have Web Filtering and DNS Filtering turned on, and just as a test I turned off the Category filter under DNS a

Hi guys, I've set up a 100D to load balance HTTPS traffic between two real servers. So, I have one virtual server of type HTTPS, SSL offloading Client<->FortiGate and two real servers. But the problem is that users have to type in https://www.webserveraddress.dom every time they want to access my website. What I would like is to automatically redirect their HTTP requests (i.e. http://www.webserveraddress.dom) to HTTPS (i.e. https://www.webserveraddress.dom). Is there any way to do this on FGT-100D? Thanks!

i have 2 WAN How to config FortiGuard DDNS

Hello,   I'm having some trouble with NAT'ing entire subnets and am looking for suggestions and/or confirmation that I am doing it correctly. I'm trying to give each school a separate external IP address based on their subnets. I am doing the following to create the NAT rule.1)Create Address Object for the school site's subnet     -School 1 - 10.1.0.0/16     -School 2 - 10.2.0.0/16     -School 3 - 10.3.0.0/162)Create IP Pool Object for each external IP address (All 3 IP addresses are part of a Single WAN interface network)     -Set "TYPE" to overload (Per Fortinet Chat Support)3)Create IPV4 Policy     -School 1 NAT Policy:       -Incoming Interface - LAN       -Outgoing Interface - WAN       -Source: School 1 - 10.1.0.0/16       -Destination: ALL       -Schedule: Always       -Se

Hello,Does HA cable between two Fortigates devices should be cross-over? or the straight one can work normally without any issues? Please anyone have a clarification about that for both types of cables UTP and Fiber   

I had a situation arise in which I need to host a service using https on a different interface than WAN1. Typical setup with the default routing table using WAN1 and that ISP next hop router as the default gateway for 0.0.0.0/0.0.0.0, and all of that has been working fine for years. Now I have a need to host a new https service, but through an alternate ISP that is connected to a subnet that is routed through the Internal LAN connected to the Internal switch interface on the firewall. I created a new DMZ using a spare port and created a policy route for the server in that DMZ to send traffic through the Internal interface instead of WAN1. That server gets out fine, and can get Internet with no issues through the alternate ISP. It also shows a specific NAT address correctly that is set up for that ISP connection on whatismyip.com. So outbound traffic for this server on the new DMZ with the policy route works perfectly. Inbound traffic is an issue. For remote int

Hy, i have one questionWe are Using FortiMail 200E and Sandbox 1000D,at the moment we have a lot infected Emails with .doc Attachmendunder the Fortimail System->Fortisandbox its acitivated the all Office (specially .doc) are sended to the Sandbox. But sometime we have the problem, if Fortimail notice this is a Spam Mail (over the IP), then he send the email to the personal Quarantine and stops checks with AntivVirus and Sandbox. We have activiated under Security->Quarantine Controll all Re-Scan Options. Bt its possible to make thats the checks continue and not stops after AntiSpam? With best regards from Germany

Hi I have a Fortigate FG60E-DSL configured with an FTTC connection and I want to assign the WAN interface with a Public IP address. The DSL interface is configured using VDSL and a VLAN interface which is configured using PPPoE. The interface is obtaining an IP address automatically but it's changing and this means my site-to-site VPN doesn't stay connected. I've entered a usable Public IP address in the Unnumbered IP section of the WAN interface and this now shows when I go to www.whatismyip.com but the WAN IP on the interface in the dashboard is still showing the obtained IP and the obtained IP is the only IP I can access the firewall on externally. I know the Public IPs we have work because I have Virtual IPs configured for services like OWA which work. Any way I can properly assign a Public IP to the firewall to achieve what I want to do?

Hey everyone,Currently attempting to enable SSL inspection/MITM on a 80C and it doesn't seem to be working.[ul]I have a single FW rule for the outgoing NAT traffic.I don't see the FGT certificate being presented to hosts browsing HTTPS sites behind the FW. I am seeing the traffic hitting the correct policy.It doesn't have a license. It's just for testing stuff in a lab.Running v5.6.3 build1547 (GA)[/ul]Relevant configurations : Security profile : https://i.imgur.com/lT5y8aL.png FW rule with applied profile : https://i.imgur.com/u3OwQAw.png Traffic hitting the FW and the correct policy : https://i.imgur.com/Pvx5pPC.pngIs the SSL inspection feature behind the paid license? Anything else I could try to properly tshoot this?Let me know if there is anything else I can provide.Thanks!

Hello, we want to achieve a special case where our external users would use the VPN for all traffic EXCEPT some well known VoIP Gateway that we want them to access through their local breakout, IPSec VPN has the command ipv4-split-exclude but I cannot find the same feature on SSL-VPN... any idea ? Best regards Vincent

Hione site has a web facing wan ip address (site A) and the other site is behind a router (Site B)I've used the wizard to create a site-to-site VPN between both sites.Site A tunnel has a "dialup" template, Site B has a "Site to Site" template After creating both tunnels, here are the errors in "VPN Events" log:The logs on Site A shows " peer SA proposal not match local policy"The logs on Site B shows success Any help would be appreciated. Thanks

Hello everyone,  I'm a newbie/newcomer with Fortinet's products. Now I heard that upgrading to the latest version for FortiGate is not a recommendation. (from product supplier, not Fortinet)Then, I'd like to find/check more details so what that really does mean.I found that some points with Resolved/Known issues between the present and the newer version in Release NoteAnd I want to discuss detail here is related to some resolved CVEs' issues. Here my discussing matter・Currently using FortiOS version: 5.6.5・I want to upgrade to version: 5.6.8Although, I found that some CVEs (security related issues) that resolved on the 5.6.8 version of the Release Note.But hold it on, when I reversely check on the CVE-2018-13371 (risk rather high) that written in Release Note of 5.6.8,With the supported links: https://fortiguard.com/psirt/FG-IR-18-230On the part [Affected products], I saw this "FortiOS version 5.6.7 and below"so that means my FortiOS version is i

I have looked through the canned reports and don't see a way to get this information from FortiAnalyzer.  I need a report that will run daily that gives a report of all the VPN Login/Logouts or possibly list all of the VPN logins with a duration of the login. There are some pretty decent looking reports but most of them are TopN reports.  I opened a ticket with Fortinet support and was told this requires a custom data set and that support doesn't help with creating them.  Currently running v5.2.1-build0662 141212. ThanksMike  

 I'm definitely a beginner with Fortigate, but have some experience with stateful firewalls (from iptables). I'm setting up a system (Fortigate 30E) which should look like: SD-WAN (wan + lan4) -> two different internet connections, select ports forwarded to Internal (below)Local (lan3): Single computer that is a local server and responsible for most of our load (including stuff it forwards), unlimited outgoing connections via SD-WAN.Lan (lan1 & lan2): connect to some WiFi routers; unlimited outgoing connections via SD-WAN, limited to select ports to Local. My Configuration so far is outlined below. Note that I know I do not have rules to permit LAN to access anything on Local right now. What works: Internet connections to Local for selected ports only; Local accessing internet; Load balancing with SD-WAN.What Doesn't work: Lan accessing internet. Using the packet sniffer, I determined that for DNS requests going out from Lan, the returning packets from the na

I allow myself to write this post because I have a lot of difficulty in configuring vxlan over ipsec, the operation is not guaranteed (at least from my experience)　from the FortiOS version 5.6.2 vxlan can be used nativelyconsidered that the[ul]vxlan over ipsec does not support 802.1q (while internet traffic is encrypted)native vxlan supports 802.1q (instead internet traffic is not encrypted)[/ul]　I decided to make a configuration using IPSEC with loopback interface and use the native vxlan with the loopback interfaces.With this configuration, traffic with the native vxlan is encrypted with the IPSEC　attached the configuration adopted between fortigate 80E and Fortigate 90E ######################### FTG80E ###############　##creation of subnet address　config firewall address    edit "LoopBackLocal172.30.31.0"        set subnet 172.30.31.0 255.255.255.0    next    edit "LoopBackRemote172.30.30.0" &nb

Hello everyone,  I need to perform an upgrade firmware  to my FortiAPs 221C that now running on version 5.2, and I can't find any information about actions to perform if it will fail during an upgrade and won't come up after hard reset,Is it has CLI?, Can I connect to it via console and upload image with TFTP like on FortiGates?  in other words what to do if device stacked during an upgrade, OS don't boot up and hard reset doesn't help.

Hello All, I want to show a customer the advantages of FortiManager. I installed FortiManager VM and a Fortigate VM using VM Workstation.  When I try and add the Fortitgate device to the FortiManager I get "Probe Failed" message.      Both FortiManager and Fortigate are running 5.6 and are in there Trial license period. I have network connectivity to the Fortigate as I can ping it from FortiManager. I have Centralised Management on the Fortigate set to FortiManager:  When I check in the logs I can see a successful connection using TCP/541 from the FortiManager to the Fortigate. The only blocked traffic I see is on TCP/542 from the FortiManager to the Fortigate. TCP/542 is not listed in the Local In Policy. Checking the Fortinet Documentation about TCP/542, this port seems to be related to IPv6. If someone can offer some assistance as to why adding the device is failing. It would be appreciated.  

the format/syntax for creating an address object on FortiGate (5.x and 6.x) is  Name:Subnet/IP range: Do you put the IP in the name? If not then would the "Subnet/IP range:" be the place to put the actual IP? and if so would the following be correct syntax ? 192.168.10.10/32or192.168.10.10 255.255.255.255   Thanks in advance  

Hello there!I am trying to add a new network to act as a dedicated iLO network.I have configured an additional port on my Fortigate 60E router and have configured a policy route to route between this network and our Core network. Core/Server Network: 192.168.69.0 /24iLO Network: 192.168.50.0 /24 Our DHCP server lies on the 69 network and it is servicing IP Addresses to the iLO cards of our servers on the 50 network. I can ping the Router port and switch configured on the 50 network from the 69 network but cannot ping any of the iLO cards. If I plug in a laptop to the 50 network switch I can ping the iLO cards and router and the 69 network port on the fortigate but cannot get any further. Also devices on the 69 network can ping the router port and switch on the 50 network but not the devices on it. I'm wondering what I've missed here, and any help would be appreciated!Thanks.

I am hoping somebody can help me out with this.  I have a client with a fortigate 60D I have it setup with remote access ipsec vpn's using the forticlient software to for clients to connect to router.  This is at a law enforcement site so there is another router on this network that goes out to the Florida Department of Law Enforcement (FDLE).  I have the ipsec vpn connected and can see the internal network and I have route static route statements in the fortigate to route internal network to the FDLE router and that works great I just need to get the ipsec vpn clients to send certain subnet requests over the vpn besides just the internal network subnets.  So the question is how do I get the clients to send other subnets over the vpn connection along with the internal network requests? Thank youJason 

Hello, We have a 61E connected to the Internet that is getting random attempts at building an IPSEC tunnel from random IP's.  I want to block this traffic. I've followed this tech note: https://kb.fortinet.com/kb/viewContent.do?externalId=FD36318&sliceId=1 I applied this local-in-policy: FGT-61E # show firewall local-in-policy config firewall local-in-policy    edit 1        set intf "wan2"        set srcaddr "all"        set dstaddr "all"        set service "ISAKMP"        set schedule "always"    nextend However I'm still getting IPSEC connection attempts in the log.  Message meets Alert condition date=2019-08-06 time=17:49:15 devname=<MY_DEVICE> devid=<MY_ID> logid="0101037131" type="event" s

Hi, i updated my 100D from 5.6.0 to 5.6.3. Since then, I no longer have access to the Admin web Interface. I always get the message "ERR_CONNECTION_RESET".Ssh, Ping and SSL VPN web Interface are working normaly.Admin-port is 81 and admin-sport is 444. regardsTom

Hello fellas, Trying to verify if the reason push notifications from FAC (5.3.0 232) using FortiTokens (mobile) is not working is because the FAC interface is a private address and only gets NATed outbound with a PAT? Does it require a static 1 to 1 NAT so it can be reached from the internet? As no inbound connection can be initiated from the internet in its current configuration. I can't find any info on this regarding the FAC, but the instructions for Fortitoken mobile configured directly on a Fortigate says the outbound interface needs to be 'reachable from the internet.' Any help would be greatly appreciated.  Thanks in AdvanceNoel 

Hello guys For a while I used FAZ to get the information from our FGT and reports, but the cost is relevant and then some questions have arisen. The Syslog server has only the function of storing the data and FGT would not query this Syslog data, right?Can we use the Syslog server to receive the data by hosting in a database so that we can make selects to extract information and thus to stop using the FAZ? Which Syslog server would you indicate for this purpose and which can be used with FGT and other network assets? Have you ever used any tool like Power BI to extract information instead of using FAZ? Thank you for your support! Hugs