Description This article describes how to make policy traffic logs
visible when a loopback and VIP objects are used in the firewall policy.
Scope FortiGate. Solution In a scenario where a Public IP has to be
translated to a private IP for SSL VPN acc...
Description This article describes that the outgoing traffic is blocked
by the implicit deny policy even if a valid firewall policy is in place.
Scope FortiOS 7.2.6+, 7.4.1+. Solution Source IP: 10.11.15.2, Interface:
port2. Destination IP: 8.8.8.8, ...
Description This article describes how to disable offloading for Intra
Zone traffic. Scope FortiGate v6.4.X, v7.0.X, v7.2.X, v7.4.X. Solution
Zone details: config system zone edit "Lab" set description '' set
intrazone allow set interface "lan" "x1" ...
Description This article describes that Asymmetric routing is
experienced when a backup tunnel on ADVPN Spoke has the same tunnel IDs
as the primary tunnel. Scope FortiGate v7.0.x, v7.2.x, v7.4.x. Solution
Example : HUB(TunnelID:10.10.10.1)----Ipsec ...
Description This article describes how to advertise a static route with
a gateway IP in the BGP or ADVPN. Scope FortiOS 6. x.x, 7. x.x. Solution
If an advertised static route in the BGP includes a gateway IP, the BGP
next hop address will point to th...
DH param 8192 is DH bit modulus group 18, which will make the encryption
keys a lot longer. That means more computation power is required for the
IPsec decryption. For more details, You can check the RFC 3526. So, if
the other side doesn't support th...
Are you accessing the objects from the downstream fortigate? Make sure
the address group and object synchronization are enabled in the fabric.
You can refer to this document :
https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/88...
if your firmware version is below 7.2.4 then you can use this document
to reset the password (console or direct acess via mgmt or any other
interface is required)
https://community.fortinet.com/t5/FortiGate/Technical-Tip-Resetting-a-lost-admin-passwo...
What type of ipsec tunnels are you creating ? Is it ADVPN HUB and spoke
or is this a site to site vpn tunnel? Yes, for the failover purposes, it
would be best to create two tunnels on each wan link i.e four tunnels
but you don’t need to create 8 poli...
You cannot upload the same configuration file between different models.
If you don’t want to use the forticonveter service then you need to
manually configure the firewall. You can refer to this document
https://community.fortinet.com/t5/FortiGate/Te...