Solved

Hi all, Fortinet Support has just informed me that there is no option to add a second DHCP relay server to the interface config. I just want to ask the community if they agree? config system interface edit "lan" set vdom "root" set dhcp-relay-service enable set ip 10.90.52.1 255.255.255.0 set allowaccess ping https ssh snmp http fgfm capwap set type hard-switch set stp enable set role lan set snmp-index 4 set dhcp-relay-ip "10.90.2.92" nextend I would like a second IP address in the set dhcp-relay-ip. We are setting up a DHCP Failover as we are having a scheduled power maintenance in our head office which means the main DHCP server will be out of action for a few hours.

I have a new Fortigate 80E installed. Issue is that anyone externally should be able to access an http webpage from a security camera system on an internal network but this doesn't work at all. Internally the webpage 192.168.4.2:8282 works just fine.Source ip: any Destination IP: 100.100.100.98 Destination port: 8282should translate toSource ip: original destination ip: 192.168.4.2 Destination port: 8282 I have many other similiar and more complex translations for exchange server, webpage (port 80) on a different server, vpn that runs on an internal server. All of these work just fine. Only difference I believe is that the Security camera is on a different internal interface. The NAT rules that work are all on the main lan interface 192.168.0.0/24I ran the protocol analyzer on the wan. I could see the attempt from the source device but no response from destination. I also ran a test on the security camera interface and I see no packets mentioned from the source ip or the port 8282.I am

Hy Everbody ! I want to disable in my fortigate 90 the SSH port 22.It is necessary to create a policy or I need to disable an option ? Thank you ! 

Hi, I have a small network where all my equipment has private IP addresses (10.x.x.x) and I am using a Fortigate 300C.   I have a special need where I need to use a public IP address (e.g. A.A.A.A) to talk to an equipment that is configured just to reply to that address.  My server talks to that equipment by means of a NAT using IP Pool (with only that address A.A.A.A), and it works great.   My server is also accessible with a VIP from the Internet and it works great.   Problem is that if that particular public IP Address (A.A.A.A) tries to access my server from the Internet the Fortigate doenst seem to know how to handle it...  The packets doesnt seem to reach the server and looking through the Fortigate sniffer on that port, I just see SYN, SYN/ACK, RST. I have tried disabling the NAT, but the only thing that returns the ability of the A.A.A.A address to reach the server from the outside is to delete the IP Pool where it is defined. 

All - I have 15 FortiAP's connected to my Fortigate and whenever I get more than 6 or so computers in a conference room the wpad_ac process tanks one of the CPU's of the Fortigate and doesn't allow any more computers to be authorized to our network. I have a ticket open with Fortinet and they've said the issue is known and will be fixed in the upcoming 6.0.4 release.  They've also stated it will not be fixed in the 5.6.x code stream (which is what we're running).  They've also not offered a workaround during the interim time until 6.0.4 is ready and we go through the necessary preparation for a major OS upgrade. My question is: has anyone else had this problem and if so did you solve it?  I can't believe our setup is unique - it conforms to the standard enterprise setup using Windows NPS as the RADIUS server outlined in Fortinet's cookbook.  Also never had a problem with the setup during our 5.4 days. I'm still pressing Fortinet for some better answer

Hello All, I have a new FortiGate 300D firewall and I was wondering if this device possessed the ability to take the traffic routed to it and span port it to another device that we use. Anyone have any experience with this functionality on this device, this is my first Fortinet product. Thanks

Hello, I'm trying to summarize the amount of data used by an application, host, etc. over a given period of time. I'm sysloggging to Splunk and seeing the following problem: long running sessions are logged every 2 minutes with the cumulative amount of data (bytes sent/received/total) up to that point. So... for example an session that lasted an hour would have 30+ syslog messages.  Now say the total data in the last syslog show 8MB sent, 2MB received, and a total of 10MB.  The syslog before might be 7.5MB sent, 1.9MB received, and a total of 9.5MB.  A simple search utilizing SUM produces a result that is like 200MB for the 10MB session (because the last syslog message when the session terminated has the complete data for the session) I tried to filter based on action (action != accept), but the results are like 1/3 of the actual bandwidth so that doesn't really work. Tried the splunk fortigate app and the data model appears to have the same

Hi all!A department on the company that I work are having issues with some FortiGates. This department is charge to the maintenance of the client's fortigates. Today they had two issues with "missing policies", one with a FG200D and another with a FortiWiFi 90D. The FG200D is installed on our office and it had "missing policies" after a Firmware upgrade following the upgrade path from FortiOS 5.6.3 to 5.6.6 and finally 6.0.3. The other device is a FortiWiFi 90D owned by one of our clients and this one also had "missing policies", but in this case it happened after a power disruption. We had this type of issue on the past on other devices, but were few. The department of maintenance tells me that they are following the recommendations of FortiNet for upgrades by reading the release notes and following the upgrade paths. My concern is that this is happening more often and we are scheduling to do a firmware upgrade to a core 1000D that manage the security on our DataCenter. Missed po

Hello,We have a Fortimail unit that uses LDAP authentication for logging into the webmail for our quaratine folder. When I run an LDAP bind test on mu username and password, it tells me "Too many DNs returned by user search." So far my account is the only one I've ran across this issue on. It sounds like this is an issue with my AD. Any suggestions?

Hi there,Can one collector agent pass logon information to multiple Fortigates at the same time ?Thanks,Mahmoud

When ever I log in to my fortigate 51E I get the following pop up (cant attach image for some reason):                                                    File System Check RecommendedThe last reboot was triggered by a power disruption. The system is up and running, but the undefined disk may have issues. It is strongly recommended that you check the file system consitency before proceeding.                                            Reboot and scan disk now | Remind me later. I pressed the reboot and scan disk now option on two occasions, when I select it, the system goes offline and scanns (I assume) but when it's done and I log in again it still gives me the same pop up message. Any ideas on how to get rid of it?  

Hi! I am trying to setup a new VPN-tunnel, but I see strange messages: Invalid ESP packet detected (payload not aligned).Phase 1+2 seem to be running, but I do not get any packets from the tunnel. Debug shows:ike 0:XXX: invalid ESP 6 (payload not a multiple of block size) SPI c1acad49 seq 0000002d 36 1 xxx.xxx.xxx.xxx > yyy.yyy.yyy.yyy I already checked Phase 2 policies and everything seems to be right. Do you have any idea, what this message could mean? Thank youKPS

question #1: While in System - HA, I don't see Ports 1- 7 as choices to use for the heartbeat monitor.  Is there something I need to change before I can select those here? - image attached. I've got two Fortigate60e's and each have the same configuration, same firmware.Ports 6 and 7 are going to ports 6 & 7 on each FortiGate to be the Heartbeats.   Question #2: Also is this set up ok for HA? internet -> router -> WAN1 port of Primary_Fortigate60e -> Port 1 to internal Switchon the Backup_FortiGate60e WAN1 is going into a port on the internal switch  or do I have to have it as internet -> router -> external switch, and that splits off to each of the WAN1 for each fortigate?

Hello everyone I have a question about fortigate use sub-vlan how to communicate with switchI use EVE-LAB doing some test.Here is my topo  and here are my switch G0/4 conf:！switchport trunk encapsulation dot1q switchport trunk native vlan 999 switchport mode trunk！ PC1 ip address is 192.168.1.1/24PC2 ip address is 192.168.2.1/24 PC1 should have been able to ping 192.168.1.254PC2 should have been able to ping 192.168.2.254 But I use EVE-LAB, it is timeout .  Is it something wrong with my configuration? There is another question, Is it need to configure switchport trunk native vlan 999 on switch?Does the fortigate vlan 1 have a tag? Any body have any thought? Best Regards,Tim

Hi there, Fortigate provide DDNS for 1 ID.if I have 3 WAN connection, can I register to 3 ID different? 1 WAN connection has 1 ID ddns. if yes, how to do that? thank you

I have been trying to fiugure out what is causing this message in the event logs, there is one every 15 minutes Administrator admin login failed from http(127.0.0.1) because of invalid password Now the source is 127.0.0.1, meaning the firewall itself, but I cannot find anything that would be causing it, there was a old script setup to backup the config, deleted the script but still get the message, so it was probably not the backup script, anything else I could check? I did go through the config and searched for "admin" but nothing in there that would use that username to try and log in  

Lot of BUG FIX

Hi, I am new to Fortigate.  I have a 30E that I have been working on.  I upgraded it to the latest 6.0.3 Firmware level. I am trying to ascertain if using SSL Deep Inspection is a better option than the default without putting too high of a strain on the unit.  It might be better for Anti-Spam as I have an internal e-mail server.  I am not sure how good the Anti-spam is working yet as I am using the default SSL Inspection and did tie it to my firewall policies. For the Certificate I am just using the internally self-signed certificate and don't plan on getting one from a public CA and paying for it.  I can use Group Policy to distribute it to my machines.  I do have an internal CA.  I did do this when I was a Sophos house.  Thanks in advance for any assistance you can grant me.

Hello   I have a 60E and i recently have updated to fortiOS 5.6.6 from 5.4. Before the update i could find the industrial category in the app control section to block specific industrial traffic but in fortiOS5.6 this category is missing and i cant configure the fortigate to block this kind of traffic. The fortinet documentation says that industrial protocols are enabled to be identified (https://fortiguard.com/appcontrol?category=Industrial&deepapp=&page=1)   Thanks

We have two offices each with a Fortigate 61E running FortiOS 5.6.2. We have two MPLS connections between the two offices. The IPS are as follows: Office 1 LAN: 10.0.4.0/24 Office 2 LAN: 10.0.5.0/24 Office 1 Provider 1 MPLS: 192.168.4.2/30 Office 2 Provider 1 MPLS: 192.168.5.2/30 Office 1 Provider 2 MPLS: 172.16.4.2/30 Office 2 Provider 2 MPLS: 172.16.5.2/30 I have created static routes on both Fortigates using the Provider 1 link and there is connectivity between the two offices. I now want to use the provider 2 as a redundant link. If provider's 1 link fails I want to switch to provider 2. How would I go about achieving this?

Dear guys,We have two FortiGate 300E in an active-active cluster. HA port is up, configuration sync is OK and everything looks fine.But the slave device is unreachable. We cannot ping any interface on slave device when directly connecting the slave device to laptop. Ping reply is "destination host is unreachable".Then I enabled load-balance-all through command line, but same result.Do you have any suggestion?Thanks 

Hi, In our network we have a mix of FG200D, FG60E and FG200E firewalls all managed by a single FMG VM.  Currently we are running latest version of 5.4 across all devices and FMG. In the past we have been reluctant to move to the latest major release, at least until after a few minor releases to fix bugs.  Taking this into consideration, we are contemplating upgrading to the latest of either 5.6 or 6.0 and would like to know your experience and recommendation.  Are there issues with 6.0 making it more sensible to go the 5.6 route, at least for now? Your time is appreciated. Thank you,LarW63 

hi there, I need to set up some laptops to have pre-installed Forticlient. Is there a way to download forticlient full version (not online version), so I can easily deploy to those laptops?since my internet connection not so fast, 1 laptop need almost 1.5 hours just for install forticlient using online version. I need to set up 16 laptops. those laptops will connect to fortigate with OS 5.0 above, but before 5.2need help please. thank you

When adding a secondary node to HA, do I have to define the interfaces on secondary node? More specifically, the primary uses a LACP LAG to connect to core switches.  Do I need to define the LAG on the secondary, or will that config sync? I do have the core switch ports configged for the LAG, not sure if need to define on FGT prior to enabling HA.  Thx,Dave 

hi there, need advice and guidance.I've created virtual Ip and its grup.and already make DDNS for my WAN connection.policy also already create it. I try to enter web address (ddns ID I've registered), but page not found. Am I missing something? my internet connection is behind NAT. thank you.