Questions tagged [fortigate]
firewall appliance made by fortinet - includes capwap wireless controller and fortios software
0
votes
0answers
7 views
GRE(IPv6) over IPSec(IPv4) - How to convince a Fortigate 60D to accept IPv6 addresses for the “system” interface?
Folks,
for the life of me, I can't figure out how to convince a Fortigate 60D to accept IPv6 addresses as GRE Tunnel endpoints.
This is on a Fortigate 60D running FortiOS 6.0.3.
The network setup ...
1
vote
1answer
134 views
Is it possible to have name-resolution from Fortigate and local DNS server?
Can you advise on moving to a hybrid DNS?
Currently, all our LAN machines receive their IP address from our Fortigate 60D (each machine is either allocated an IP address from the Fortigate DHCP, or ...
0
votes
0answers
43 views
Linux: Update DNS with client IP address after connecting via VPN
In this related question, the asker has a problem where clients connecting in over the VPN are not updating the DNS records with their SSLVPN Adapter IP address.
The solution is Windows turns out to ...
0
votes
0answers
431 views
Fortigate 100D firmware upgrade
model: Fortigate 100D
firmware version: v5.0,build0128
I intend to upgrade to
FortiOS 5.4.4 build 1117 (FGT_100D-v5-build1117-FORTINET.out)
Support has expired so am concerned about any gotchas in ...
0
votes
0answers
260 views
IPsec with NAT between pfSense and Fortigate - no ping or access from both sides
We have an IPsec VPN tunnel with NAT between pfSense 2.3.4 and Fortigate up and running.
The local networks are the same (overlapping), so we use NAT.
pfSense is managed by us and Fortigate by a ...
0
votes
0answers
194 views
Connecting 2 Physical Offices, Separate Subnets, FortiGate as the Gateway for each site, leased line/LAN extension in place
I have two offices, each with their own internet connection and there's also a 'LAN Extension' or leased line connecting both of these offices (essentially 2 ports in the ISP router for each site, 1 ...
0
votes
0answers
267 views
How to enforce Fortigate policy on FortiClient connected to FortiTelemetry?
My company is running a Fortigate 300E (FortiOS 5.6.2) at the office, licensed for FortiClient "Endpoint Telemetry & Compliance License Subscription for up to 600 clients").
A good number of our ...
0
votes
0answers
60 views
Can Nginx(webserver) replaced with fortigate WAF?
We are going to replace nginx nodes with fortigate waf. Would WAF have all features sets which nginx having
Rewrite rules
IPv6
SSL
Load balancing on the bases of subdomain/context
compression and ...
0
votes
0answers
35 views
connect to fortigate using FTPS
Hello I using fortigate 60 D and I want to download and upldoad file from/to it using ftp client like filezella program
but the connection is time out .
please help me how can I do that ?
0
votes
0answers
106 views
External Captive portal for fortigate firewall
I am so sorry because I asking here about fortigate
I working on external captive portal captive portal and every things go fine but when user inserted wrong username or password he must get new ...
0
votes
0answers
139 views
Fortigate Captive portal with huawei access point
I searched a lot for my problem without solution and I hop to have help from you .
I working on external captive portal with fortigate and huawei access point .
but when any user who connected to ...
0
votes
0answers
702 views
External Captive portal with fortigate Firewall
I working on external captive portal for fortigate firewall
I followed this tutorial to config my fortigate with external captive portal
http://cookbook.fortinet.com/using-an-external-captive-portal-...
0
votes
0answers
470 views
Error and logout page in external captive portal fortigate firewall
hello I wish to have answer here
I working on fortigate external captive portal and I using this tutorial
http://cookbook.fortinet.com/using-an-external-captive-portal-for-wifi-security/
my ...
1
vote
0answers
164 views
FortiGate SSL Offloading & Intrusion Protection System
We're using a FortiGate 620B (v5.2.9) for offloading SSL traffic to our website. Now we would like to activate the Intrusion Protection System (the IPS).
However in order for the IPS to work, SSL ...
0
votes
1answer
376 views
Freeradius radclient unsupported attribute
I want to send disconnect-message to NAS using radclient program but when I want to disconnect one user using this command
echo user-name=zaib | radclient -x 192.168.3.1 disconnect "muh"
the ...
0
votes
0answers
266 views
Appserv and fortigate: You don't have permission to access /
I have developed script in php for AAA authenticatıon with fortigate
When I run the script locally every things go right but when captive portal in fortigate has been activated and when I trying to ...
0
votes
1answer
934 views
Fortigate 60D slow internet speed without DMZ
I am not getting the full internet speed through LAN ports. Only around 130Mb instead of 230Mb. Only way to get 230Mb is plug into the DMZ port. All settings are default. All LAN ports are 1000Mbit ...
1
vote
1answer
120 views
Ip Configuration in Fortigate 60d
I have a fortigate 60d which bought around 3-4 years ago. Today i tried to install over of fiber internet. I connected my forti with 192.168.3.1 then i clicked wizard and entered new values and new ip ...
0
votes
2answers
3k views
Block Sweet32 attacks on a Fortigate?
I have a Fortigate product running FortiOS 5.4.x and I can't mitigate the Sweet32 vulnerability.
I've already enabled the high security algorithms and disabled the SSL3 / TLS1.0 for Beast & ...
3
votes
0answers
1k views
Set outgoing interface on Fortigate explicit proxy
I am testing the explicit proxy on a Fortigate 200D firmware 5.4
WAN1 and WAN2 are both members of the wan load balancer interface.
I need to set the proxy to use WAN1 but it it is defaulting to ...
1
vote
1answer
309 views
Possible to dump sflow data to pcap format?
I want to get the packet capture from fortiet/fortigate device, to capture all traffic from it on one of its interface. For it i have enabled sflow and sent it to another ntopng server. but on ntopng ,...
0
votes
0answers
1k views
Fortigate VPN client disconnects cause SSH connection resets
I have to use Fortigate's SSL VPN client for Windows (version 5.4.1.0840) to connect to our corporate network.
One of the most annoying things about this software is that whenever the VPN client ...
-2
votes
1answer
1k views
ForiGate 60D Error VPN id=96603 msg=“SSLVPN tunnel connection failed (Error=-12).”
i can login to vpn from web browser with same user name and password
but when i try from fortigate clinet i am getting the error
Error VPN id=96603 msg="SSLVPN tunnel connection failed (Error=-12)....
0
votes
1answer
1k views
Issues with DMZ on Fortigate 90D, second router can't reach internet
I am having issues setting up a DMZ port on my Firewall (hardware router). I am also assuming this belongs in Super User, as it seems like a basic DMZ setup. Here is the setup:
I have a Fortigate 90D ...
7
votes
1answer
259 views
Best Practice: notify email sender that their reverse lookup is broken
This probably should be a wiki, not entirely sure. Before I begin, the external server that performs scanning is a custom amavis/postfix/fortigate pipeline; it is suggested that any changes work ...
3
votes
3answers
6k views
Connecting to a FortiGate VPN from a remote Linux machine via OpenSwan
Here's the setup:
I have a FortiGate unit on a business network, which has a FortiGate VPN set up. Machines on a remote network that can run FortiClient (Windows and Mac machines) have no problem ...
0
votes
2answers
2k views
How to configure Fortigate 60D as L2PT/IPSEC client
I have a firewall Fortigate 60D and I need to create a tunnel to a L2TP/IPSEC server, so the firewall has to act as a client.
Is it possible?
I configured the L2TP/IPSEC server on a Linux Debian ...
1
vote
1answer
3k views
Does anyone know what the Fortigate SSL VPN error 6 on the linux client means?
I often get:
SSLVPN down unexpectedly with error:6
When trying to connect the 64bit/forticlientsslvpn_cli. My experience has been:
Once you start getting, no number of retries will get you ...
-1
votes
1answer
502 views
Tomcat server port access
I have changed the tomcat default port to 8091 (eg. http://localhost:8091/project) which has been set up in intranet server and is working very fine within the network.I have to provide access to the ...
0
votes
1answer
774 views
IPsec VPN between Fortigate 60C and openswan up, but no traffic
I get visual confirmation that the tunnel is working from the fortigate GUI but, it also says i don't have 1 byte of traffic, the linux server also confirms the tunnel is open but i can't ping nowhere,...
0
votes
0answers
307 views
site not reachable after firewall reboot
After rebooting my Fortigate firewall, I can no longer reach a specific website from within
the internal lan (I'd better say from a specific public ip since all the machines belonging
to the internal ...
4
votes
1answer
4k views
VPN ERROR 500 STATE_MAIN_I1, unable to start phase2
i'm trying to set up a site to site vpn to a fortigate 60c from a CentOS 7 with openswan, the error i get everytime is the following
000 #1: "office":500 STATE_MAIN_I1 (sent MI1, expecting MR1);
...
0
votes
1answer
364 views
Not able to connect to GitHub though the Firewall
We have Fortigate Firewall install on the network, What port I should open to connect to the GitHub repository using the https:// protocol.
I found a similar question , And allowed the port suggested ...
github
4
votes
0answers
1k views
VLAN ID over DHCP for Management Interface of Fortinet FortiAP
When configuring the FortiAP device it's desirable to configure the VLAN ID for the tagged management network. Accordingly to the manual it's possible to do so by "telnetting" to the FortiAP device ...
1
vote
0answers
368 views
Using airport extreme as an AP with true bridge mode (forwarding 802.1x auth)
So here is my setup. I have a Router (Fortigate) 4 airport Extreme, and a radius/ldap server on a distant server.
I want my user to authenticate with the radius or LDAP server, and be able to create ...
0
votes
0answers
3k views
Fortigate - cannot ping public IP in dual WAN ISP setup
I have a fortigate 100c that is configured with 2 WAN ISP's
LAN1 -------------- ISP 1 (static pub 1.1.1.1)
|-FORTIGATE-|
LAN2 ---------------ISP 2 (dynamic pub 10.1.1.1)
I have policy routes ...
1
vote
1answer
8k views
View logs from Fortigate SSLVPN client for windows
I have some users that have trouble when connecting to my vpn, I want to see what the errors look like on the user side, hence I enabled the debugging in the client at "Log Level -> Debug" (where you ...
1
vote
0answers
1k views
Fortigate 60D - Empty log and report
Environment:
Fortigate 60D
Forti OS 5.0
I can not see any log or report in the firewall. I have already activated forticloud and I recieve empty reports.
Is there something that we have to activate ...
1
vote
0answers
2k views
FortiGate 310B public ip pool into internal port
I have a FortiGate 310B with WAN port with /27 public IP pool from the ISP.
The WAN port is configured with primary IP 1.1.1.1/27
I would like to provide servers within the Internal port a public IP. ...
2
votes
3answers
4k views
Remotely connect to device with ip from different subnet
I have to figure out some way to remotely connect to D-LINK switch currently working on default address 10.90.90.90 (service guys have replaced broken one, but they have forgotten to do initial config)...
0
votes
1answer
336 views
Fortigate 100D - L2TP range
I need a specific number of hosts connected on Fortigate with L2TP/IPsec, about 300.
I tried to configure this range via console
config vpn l2tp ... set sip 10.0.0.1 ... eip 10.0.1.254
It says that ...
1
vote
0answers
1k views
Dynamic IP Blocking on FORTIGATE 200A Firewall
I have FORTIGATE 200A firewall protecting a IIS Server running a ASP.NET website (windows server 2008 and IIS7)
I'm not familiar with Fortigate configurations and options.
I recently had "attacks" ...
2
votes
1answer
10k views
Fortigate IPSEC VPN Issue
Have a challenging question here.
We have a Fortigate 620B which we're trying to use to route some traffic over a VPN tunnel to a customer.
We want the traffic to go out of our interface with one of ...
3
votes
1answer
3k views
Can I have an alert when a IPSEC is down in Fortigate 80C?
We have a fortigate 80c and 60D with an IPSEC VPN .
Is there a way to use the log (or other tool) to send an email alert when the tunnel is down?
I couldn't see anything on the Log & Report tab
0
votes
1answer
2k views
Fortigate Firmware Upgrade
I've two Fortigate 40C here, which are currently running on firmware "Fortigate-40C v4.0,build0639,120906 (MR3 Patch 10)". I want to upgrade to the latest MR3 release, which appears to be MR3 Patch 18....
1
vote
1answer
3k views
Avoiding split brain DNS for a Fortigate Web Proxy
How can I avoid needing a split brain DNS setup with the setup outlined below?
Background
I have what "should" be a pretty basic setup using a Fortigate 200D.
'Third leg' setup using a DMZ
...
1
vote
4answers
11k views
Get external public ip from command line in fortinet
Is there any way to know the public ip address of a fortinet? There are many services such as icanhazip.com that tell you the current ip.
In linux, I would just run:
curl http://icanhazip.com
How ...
1
vote
3answers
7k views
IPSec VPN Shrew to Fortigate
I'm trying to configure an IPSec VPN on a Fortigate 80C and connect to it using Shrew Soft VPN. I'm stuck with a negotiation failure, even though debugging on the Fortigate unit shows the same values ...
2
votes
1answer
2k views
SSL VPN on Fortigate 100D Dual ISP
I have a Fortigate 100D and have been using it with a single internet connection for some time without issue and have also been using SSL VPN to connect into the network. The SSL VPN uses 2 factor ...
2
votes
2answers
6k views
Fortigate 100d 802.3ad bonding / Link aggregation
My network is as follows:
1 x Fortigate 100d with the two WAN ports connected to:
Ethernet ISP with STATIC IP configured manually (20 Mbps symmetric) via ISP A
Ethernet ISP with STATIC IP configured ...
