Support Forum

Hi  I using proxy to update fortiguard server, but it seens like fail.following is my setting and diagnostics. config system autoupdate tunneling    set address 172.16.x.xxx        set port 80    set status enable        end config system fortiguard   set fortiguard-anycast disable   set port 8888   set protocol udp   end--------------------execute update-nowupd_daemon[1800]-Found cached action=00000001do_setup[347]-Starting SETUPupd_fds_load_default_server[920]-Addr=[208.184.237.66], weight=1787681287upd_fds_load_default_server[920]-Addr=[12.34.97.16], weight=1247489738upd_fds_load_default_server[920]-Addr=[173.243.138.71], weight=693776585upd_fds_load_default_server[939]-Resolve and add fds update.fortiguard.net ip address OK.upd_fds_load_default_server6[1046]-Resolve and add fds update.fortiguard.net ipv6 address failed.upd_comm_connect_fds[459]

Hello, i need your help.You have one FortiGate and two routers. You need the FortiGate to know routes but not advertise them to the routers. For example, you have Area 10 where Router1 advertises 192.168.0.0/24, and Area 20 where Router2 advertises 192.168.100.0/24. However, when you check Router1, it also knows about Router2's network 192.168.100.0/24. This should not happen. How can you separate these networks? Can route maps or ACLs help? Have you encountered such a situation before? Any information would be valuable to me.#fortigate #ospf #routemap #acl #routingtable #routes

gents,time to time, my fortigate have thousands of sessions see below  from screenshot. how to find root cause, how to stop these multiple sessions ? 10.100.10.25 - is our mail server. Currently I am terminating manually.    

Hi All, I got deny log from the Fortigate even I already configure to allow the connection.This application using port 1433. The details log as below : Event Action : DenyThreat Action : BlockThreat Name : Policy ViolationThreat Type : Reconnaissance Application Service : Elid06 I check on the security profile & not find any possibility that it will block by security profile. Then I change to other service TCP_1433 and the connection was success. Anyone know what is the possibility of the deny traffic. TQ    

Hi all, I have a Fortimanager managed set of Fortigates. For reasons unknown I don't see any logs of those successfully logging into the SSL VPN.  I've searched high and low but can't find anything in Fortimanager to deploy to change this behaviour? Any pointers most appreciated!CheersJonFortiManager

Is there any way to make FortiGate use the proxy function to perform client certificate authentication to a site instead of the client on the internal network? Mainly this would come in handy if multiple internal clients need to access the same site, but the remote site client requires cert authentication and I don't want to distribute the same cert+key pair to all machines.

Hi all,our current setup is FG 80f acting as a firewall and  NAT device with Layer3 switch  acting as a router for office network and intervlan routing.We would like to replace current layer3 switch with 2 switches from Forti ecosystem that can act as redundant routers.Requirements are as following:L3 switch handles intervlan routingL3 switch acts as a router for private networksL3 switch/es supports HSRP or VRRPFG80f handles NAT and traffic inspectionSwitch and future Forti AP-s are managed via FG80f   So basically i want central management for Forti network devices and L3 traffic between private networks to be handled on switches which are redundant gateway for client network devices. Is that feasible ? Regards,Drazen

Hi everyone, I'd appreciate your help.My config is reverse proxy with deployment mode: Http content routingI'd like when the user enters https://site1.domain.com to rewrite to https://site2.domain.com/folder1 which is hosted in the same configuration.I have created a rewriting rule Request Action = Rewrite HTTP HeaderObject: HTTP HostRegular expression: site1.domain.comand then belowReplacement Refer: https://site2.domain.com/folder1 But it is not working. RegardsVangelis  

Does FortiGate offer a preemptive HA option?Scenario - there is an HA failover, but the secondary unit is not functioning correctly for some reason. Preemptive HA is supposed to restore the device to its original primary/secondary setting after, for example, 15 minutes.Can this functionality be provided by the OVERRIDE feature in HA?

Hello everyone, first of all the most important information:FortiManager Platform type: VM-64FortiManger version: v7.4.3-build2487 240514 (GA)FortiGate model: 200FFortiGate version: v7.2.8 build1639 My scenario:I want to pre-configure a FortiGate 200F for which I do not yet have a serial number. To do this, I have added the device via "Add Device" => "Add Model Device" and the settings:"Link Device By" => Pre-shared Key"Device Model" FortiGate-200F"Automatically Link to Real Device" => enabled"Provisioning Templates" => Our TemplateNow I have received the FortiGate, switched it on and brought it into the FortiManager network and followed the instructions from Fortinet on how to integrate an FG with a PSK.The CLI config was as following:config system central-managementset type fortimanagerset fmg ip addressendand thenexe central-mgmt register-device fmg-serial-number pre-shared key My problem:I assume that the device in the FortiManager is then assigned to the

Greetings. Situation: I have a router fortigate 60f and fortiap 221e which distributes wifi for mobile phones that do not have a mobile network. What method or rule can I prohibit or change the geolocation point on phones. And is it possible to do something like this without using a VPN?Thank for any help.

Hello,on Fortigate 80E there are any type of SFP 2.5G compatible ? thx

hi, we have installed a new fortinet firewall, now need to create a firewall rule for connection this firewall to fortiguard for licensing, database update. Can anyone pls advise the full ip list of fortiguard? does the wildcard fqnd *.fortinet.com includes all the IP of fortinet? Thanks in advance. 

Hi everybody,we're running several Fortigate (the problem case is a 60F, running 7.4)We build GRE tunnels to zScaler for every location and set default route to zScaler.This works perfect :)On some locations we do not have a static ip address.So my problem is, I can't get it work.On zScaler site i can choose FQDN Auth, then specify a user@domain.com and a PSK.But how do i need to config it on fortigate site? thanks in advance.

We are about to install HA 600E's and will be doing web filtering (including SSL inspection), and we will also use the 600E's for SSL VPN. We will buy certs rather than relying on the default self signed. Most internal devices will be domain joined and so have the cert deployed via GPO with the exception of BYOD devices. I'm wondering what level of validation is recommended -DV, OV, or EV?Given past experience I'd like to avoid the need for intermediate certs so has anyone had experience with a CA/cert that doesn't have a requirement for intermediate certs?

Hi,   Would like to understand whether any possible additional configurations available for below scenario to work In our SDWAN setup we have 1 Hub and two spokes. Spoke1 and Spoke2 has two inet links. Hub also has two internet links. Dialup tunnels built between spoke to Hub through internet 1 and internet 2.  Now there are some live traffics between spoke 1 to spoke2 through ADVPN tunnel over inet1 (As per SDWAN rule preference). In this scenario from spoke1 perspective, spoke 2 route is learnt only through child tunnel of inet 1(Parent tunnel route on inet1 will be masked) and parent tunnel of Inet2. Similar results can be seen in spoke 2 for spoke 1 routes.Now in spoke1 , parent tunnel built over inet 1 is up but BGP neighbor with hub goes to connect state for some unknown reason. This scenario makes traffic to break - Cause - Spoke 1 will continue learning spoke 2 routes through inet 1 child tunnel and with SDWAN rule preference this child tunnel will be electe

hello I have FortiGate100F I applied wan failover (I have two lines from my ISP ) if wan1 disconnect all traffic going from wan2.Now I connect new subnet to port10 .. I need all traffic going from port 10 to wan2 not wan1  (i add policy to allow traffic from port 10 to wan2 ) when i connect my pc to port10 it take IP and DNS (already I enabled DHCP) but no Internet anyone help me please 

Hello,I would like to know what is wrong with this rule, it doesn't work at all, attacks are still coming from the countries that I have added to this rule. Thank you in advance for any suggestions. 

Hello,My application stop running and when i check on the log, the traffic denied.Where i can exclude cloudflare-CDN so the traffic will be allowed?   

Hi,  TLDR - I have a /63 prefix and I'd like to delegate a /64 to each of two interfaces. Delegation works but both interfaces get the same prefix. Where in Forti documentation would I find the correct syntax? I'm a home user looking to upgrade an old router. I played with *sense, then found FortiGate-VM. I have no experience with FG but prefer the UI. I'm continuing to play with an FG-VM, with a view to purchasing a hardware FG. Thanks to FortiNet for providing an easy way to get a VM. My ISP delegates a dynamic /62 prefix, and seems to require an ONT which then essentially limits anything downstream to a /63 (long story, and is the only available ISP). I've never used IPv6 either but I'm determined to try it out with the FG-VM. I'm trying to delegate a /64 on the FG-VM to each of two LAN interfaces. Both interfaces get the same prefix so I'm missing something. port1, my WAN interface, has the following ipv6 config - config ipv6 set ip6-allowaccess

Hi, I need help to debug IPSEC VPN between Fortigate to ForcePoint Here the ForcePoint conf : Here my fortigate conf config vpn ipsec phase1-interface edit "IPSEC_XXX" set interface "vlnk_XXX" set peertype any set net-device disable set proposal aes256-sha1 set dhgrp 5 set remote-gw 1.2.3.4 set psksecret ************ next endconfig vpn ipsec phase2-interface edit "IPSEC_XXX" set phase1name "IPSEC_XXX" set proposal aes256-sha1 set dhgrp 5 set src-subnet 10.XX.XX.0 255.255.255.0 set dst-subnet 10.XX.XX.0 255.255.255.0 next endHere my log 2024-06-19 14:27:42.549271 ike V=VIPP:2:IPSEC_VIPP:IPSEC_VIPP: created connection: 0x10111700 19 10.1.0.6->185.87.229.218:500. 2024-06-19 14:27:42.551162 ike V=VIPP:2:IPSEC_VIPP: HA start as master 2024-06-19 14:27:42.551178 ike V=VIPP:2:IPSEC_VIPP:45: initiator: main mode is sending 1st message... 2024-06-19 14:27:4

Spoiler (Highlight to read)  Esta actualización KB5039217 hace que las configuraciones del firewall o políticas de seguridad en el sistema operativo hayan cambiado, afectando la comunicación con FortiGate, es decir, no se sincroniza con el recopilador, que debe estar en el servidor del controlador de dominio (DC). Se podría resolver con los siguientes pasos: 1. Revertir la actualización 2. Verificar la configuración de seguridad 3. Actualizar el software FortiGate Pasos para revertir la actualización: 1. Vaya a Configuración > Actualización y seguridad > Actualización de Windows. 2. Haga clic en Ver historial de actualizaciones. 3. Seleccione Desinstalar actualizaciones. 4. Busque y seleccione la actualización KB5039217 y haga clic en Desinstalar.

Gents, Need your assistance here.. i have a s2s connection and i want the remote side to access my server ports through loopback interface. s2s is up and able to reach my loopback interface, however my VIPs port forwarding using loopback is not responding.. base on my diagnose sniffer shows that remote are able to reach the loopback but no ack receive as shown below.  3953.534013 TO-JED in 10.1.74.21.65027 -> 10.0.225.102.1200: syn 2896839133956.547416 TO-JED in 10.1.74.21.65027 -> 10.0.225.102.1200: syn 2896839133962.546623 TO-JED in 10.1.74.21.65027 -> 10.0.225.102.1200: syn 289683913 ----config---config system interfaceedit "Loopback102"set vdom "root"set ip 10.0.225.102 255.255.255.255set allowaccess ping https ssh http fgfmset type loopbackset role lanset snmp-index 25-----------------config firewall policyedit 66set name "ewew"set uuid 7be5d9e4-c0fc-51ee-71e4-dc872d849459set srcintf "TO-JED"set dstintf "Loopback102"set action acceptset srcaddr "JED-DM

HelloMy implementation has been leaning towards a two-tier MC-LAG design. I am reaching out to you to explore the possibility of evolving it to EVPN-VXLAN seeing that data centre designs have shifted in that direction.So I would like to find out from Fortinet the following:1. If EVPN-VXLAN is a fit for purpose solution in this case2. How mature the technology is on FortiSwitch OS3. The level of after deployment support within Fortinet.4. Please note that the FS-2048-F switches are being used for 25G connections to the servers. So the spine-leaf architecture where nothing connects to spines is out of the question,There is very little Fortinet documentation of this feature on the internet. Please also share some documentation regarding this topic.Thank you

Hi All, Below are the my queries which I want to understand what should be best practice in order to connect RMA device to primary device. 1. Earlier both devices were configured in active-active mode2. during upgradation secondary unit got failed3.  Primary unit is acting as a master device 4. RMA device has received5. now we have to configure RMA device and ensure that RMA device (Secondary unit) should be working as secondary device. Now what I know - 1. update license2. Firmware must be same likewise primary device3.  configure ha and make sure Primary device must be higher priority than secondary unit4.  primary unit priority (200) secondary unit (180)5. HA will be syncfor verification # get system ha status Primary device  firmware version is currently - 6.4.6Secondary device firmware version is currently - 6.4.6I have to upgrade from 6.4.6 to 7.0.15 Please recommend what steps should I follow, was above points are corre