Description This article describes different methods used for DNS probe
in SD-WAN performance SLA. Scope FortiGate. Solution When the DNS is
selected as the protocol for the performance SLA, the working is
different from the Ping protocol. Considerin...
Description This article describes why session counts are not exactly
the same as CLI session list output and GUI FortiView. Scope FortiGate.
Solution During an active session verification on FortiGate, both the
GUI FortiView and the CLI session list...
Description This article explains the reason for authentication failure,
even if the test connectivity for the LDAP user is successful. Scope
FortiGate v7.4.4 and above. Solution In case the LDAP user test
credential shows successful, but user authen...
Description This article discusses FortiGate web filter with local
category override and default FortiGuard category verdict check. Scope
FortiGate. Solution FortiGate used to fetch the category check verdict
for any URL from FortiGuard servers. In c...
Description This article describes how a DNS filter works and the
options available to apply a DNS filter profile. It can be used with a
firewall policy as well as from a DNS server recursive interface. Scope
All FortiOS. Solution FortiGate can only ...
Hi Jet06, Kindly share us the non working IKE debug while connecting to
VPN. Are you able to connect to the VPN but unable to access internal
service or VPN itself not connecting.
Hello HS08, It might be the interface index selected instead of tunnel
interface. Kindly check the below for reference:
https://community.fortinet.com/t5/FortiGate/Technical-Tip-tracert-traceroute-behavior-over-IPsec-VPN-tunnel/ta-p/192200
Regards, P...
Hi, Kindly run a packet sniffer for SNMP server IP and see what is the
source IP selected from FortiGate. If the devices are in HA and the
destination is not reachable through management interface you might need
to disable ha-direct . This will ensur...
HI, For Dialup IPSEC you need to use below option under phase1 settings:
config vpn ipsec phase1-interface edit "Dialup_IPsec" ipv4-split-include
"subnet" ------->define your split range and use that address object
here. So the traffic which matched ...
Hi, Also verify if the server accepts the connection only from a
specific outgoing interface IP. This could create problem with another
outgoing interface IP if SNAT is performed and new interface Ip is not
whitelisted on destination. Thank you. Rega...
