Questions tagged [fortigate]
firewall appliance made by fortinet - includes capwap wireless controller and fortios software
94
questions
1
vote
0answers
40 views
routing ppp <-> wireguard interfaces
I want to connect via wireguard to a droplet that will be running openfortivpn for connecting to a 192.168.11.0/24 network. I have confirmed that only traffic to 192.168.11.* goes through fortivpn and ...
0
votes
1answer
43 views
Compare url link and url text in email body and reject as SPAM
Email body:
... <a href="url">text</a> ...
Is it possible check if text is url in email body, then compare url and text and reject as SPAM if they differ?
0
votes
0answers
19 views
Configuring FortiGate 60E with PureVPN
Am trying to make PureVPN work with Ubuntu Server 20.04 which is behind FortiGate 60E.
Any pointers on how this can be achieved? Cheers
1
vote
1answer
771 views
Azure Site-to-Site VPN and Fortigate IPSec Phase 2 error on SA re-establishment - “peer SA proposal not match local policy”
I am documenting this for posterity. After a period of IPSEC tunnel being succesfully up and working beteen Azure VPN Gateway and Fortigate 200 E firewall running FortiOS v6.4.4 build1803 (GA), the ...
-1
votes
1answer
47 views
Email Two-Factor Authentication on FortiGate
I'm currently implementing Multi-Factor Authentication on FortiGate, using mailer system and refer to this document link.
There is no options to change the subject or content of email, because ...
1
vote
1answer
85 views
Process to migrate DNS and DHCP from on-premise, Windows domain controller
Our organization has an on-premise, Windows, domain controller that we'd like eliminate in favor of a local DHCP/DNS server on either our Unify switch (first choice) or FortiGate VPN appliance (second ...
0
votes
0answers
34 views
automatically retrieve some fields from log file
My fortigate firewall send log message to my syslog server (CentOS 7). The syslog server store them to *.log file with rsyslog. Like this:
Sep 24 00:00:00 192.168.20.20 date=2020-09-24 time=01:00:00 ...
0
votes
0answers
25 views
second hand fortigate 40c: syslogd (memory as well) logs “traffic allowed” too: is this normal?
Before I move on to get an actual new device I have this older fortinet 40c that I've been struggling to set up. All I need for this segment is basic firewall so I created the necessary rules that ...
0
votes
0answers
152 views
QuickBooks - Windows Server 2016 Network Files Randomly Disappear when Browsed by QuickBooks Client
Background
We have 18 QuickBooks company files in a mult-user environment running on a new installation of Windows Server 2016. The QuickBooks Database Server Manager is installed. All of these ...
-1
votes
1answer
23 views
FortiGate 100E IPSec disconnect
I think this problem is well known that the FortiGate does not reconnect IPSec tunnels sometimes.
Is there a way to keep the tunnel open. Do I have to buy a newer product or update to a newer OS?
0
votes
0answers
266 views
FortiGate RADIUS with Azure MFA
I configured VPN FortiGate with Radius + Azure MFA, but few groups still use LDAP configuration.
Problem which appeared last time is:
If user is in radius group, did not confirm or reject MFA prompt ...
0
votes
0answers
19 views
FortiGate 201E show “7163: Unknown action” on a scheduled config backup script
I am trying to follow the following guideline to setup a scheduled auto backup script on Fortigate firewall,
https://kb.fortinet.com/kb/documentLink.do?externalID=FD39818
Example of backup script,
...
0
votes
0answers
76 views
FortiGate 201E show “7163: Unknown action” on a scheduled config backup script
I am trying to follow the following guideline to setup a scheduled auto backup script on Fortigate firewall,
https://kb.fortinet.com/kb/documentLink.do?externalID=FD39818
Example of backup script,
...
0
votes
0answers
180 views
How to connect to a forticlient vpn using another vpn client?
I am trying to make use of my raspberry pi need to connnect it to my VPN.
I have a vpn account and i usually use fortigate client in my mac to connect to it. And now im trying to connect my raspberry ...
0
votes
1answer
40 views
Working from home - VPN Routing
We have a FortiGate VPN, on which we once configured that all vpn clients (who work from home) have all their traffic go through the VPN.
However, now we want only the traffic that goes into the ...
0
votes
0answers
212 views
Inbound ESP not received by Azure network virtual appliance
We have a FortiGate-VM network virtual appliance in Azure with a site-to-site IPSec VPN connection to a business partner's Cisco ISR 4400. This connection has been working flawlessly for about a year, ...
0
votes
2answers
36 views
How to detect with app/process make specyfic dns request?
we have one computer in ours network that constantly send to 8.8.8.8 dns requests. I see this in Fortigate forward traffic log and the user of that computer have to solve reCAPTCHA a few times in hour ...
2
votes
1answer
181 views
Azure VPN Gateway (S2S) disabling Replay Detection
I'm running an Azure VPN Gateway (VpnGw1, gen1, Route-based) and trying to connect a S2S connection to a Fortigate gateway. The connection is losing connectivity every so hours and I'm wondering if I ...
1
vote
2answers
377 views
CentOS Hyper V Guest VM Not accessible from the Internet
I have a CentOS VM sitting on HyperV host with two interfaces, One interface connected to the domain Network via a switch (192.168.1.8 /24) GW 192.168.1.254.
Another interface is connected directly to ...
0
votes
1answer
40 views
Use Both ISP Public IPs Even IF one is Down In FortiGate FireWall
I have two IP's Airtel & Sify connected to My Fortigate Firewall.
Sify---------->Port1--->163.100.X.X/27
Airtel-------->Port2--->13.26.X.X/27
I have two questions:
Can I use all ...
1
vote
0answers
25 views
Can I use different log files for FortiGate rules?
Fortigate firewalls use different log files per type and device. Here is the log file name format:
<logtype> - <logdevice> - <date> T <time> . <id>.log
For example: ...
0
votes
1answer
872 views
Fortigate to Azure - working VPN suddenly stops working
I have a FortiGate 60E that I successfully used to create a VPN to an Azure virtual network (see here). It had the 6.0.4 firmware.
Recently, I updated the Fortigate firmware to 6.2.0 and the VPN came ...
0
votes
1answer
2k views
Fortigate to Azure VPN — connected but can't reach anything
I have set up an IPSec VPN between a Fortigate and Azure, according to the following instructions:
https://cookbook.fortinet.com/ipsec-vpn-microsoft-azure-56/
The VPN connected the first time, but I ...
2
votes
1answer
2k views
Is it possible to have name-resolution from Fortigate and local DNS server?
Can you advise on moving to a hybrid DNS?
Currently, all our LAN machines receive their IP address from our Fortigate 60D (each machine is either allocated an IP address from the Fortigate DHCP, or ...
0
votes
0answers
96 views
Linux: Update DNS with client IP address after connecting via VPN
In this related question, the asker has a problem where clients connecting in over the VPN are not updating the DNS records with their SSLVPN Adapter IP address.
The solution is Windows turns out to ...
0
votes
0answers
2k views
Fortigate 100D firmware upgrade
model: Fortigate 100D
firmware version: v5.0,build0128
I intend to upgrade to
FortiOS 5.4.4 build 1117 (FGT_100D-v5-build1117-FORTINET.out)
Support has expired so am concerned about any gotchas in ...
0
votes
0answers
120 views
Can Nginx(webserver) replaced with fortigate WAF?
We are going to replace nginx nodes with fortigate waf. Would WAF have all features sets which nginx having
Rewrite rules
IPv6
SSL
Load balancing on the bases of subdomain/context
compression and ...
0
votes
0answers
3k views
External Captive portal with fortigate Firewall
I working on external captive portal for fortigate firewall
I followed this tutorial to config my fortigate with external captive portal
http://cookbook.fortinet.com/using-an-external-captive-portal-...
1
vote
0answers
349 views
FortiGate SSL Offloading & Intrusion Protection System
We're using a FortiGate 620B (v5.2.9) for offloading SSL traffic to our website. Now we would like to activate the Intrusion Protection System (the IPS).
However in order for the IPS to work, SSL ...
0
votes
1answer
718 views
Freeradius radclient unsupported attribute
I want to send disconnect-message to NAS using radclient program but when I want to disconnect one user using this command
echo user-name=zaib | radclient -x 192.168.3.1 disconnect "muh"
the ...
0
votes
2answers
2k views
Fortigate 60D slow internet speed without DMZ
I am not getting the full internet speed through LAN ports. Only around 130Mb instead of 230Mb. Only way to get 230Mb is plug into the DMZ port. All settings are default. All LAN ports are 1000Mbit ...
1
vote
1answer
153 views
Ip Configuration in Fortigate 60d
I have a fortigate 60d which bought around 3-4 years ago. Today i tried to install over of fiber internet. I connected my forti with 192.168.3.1 then i clicked wizard and entered new values and new ip ...
0
votes
2answers
4k views
Block Sweet32 attacks on a Fortigate?
I have a Fortigate product running FortiOS 5.4.x and I can't mitigate the Sweet32 vulnerability.
I've already enabled the high security algorithms and disabled the SSL3 / TLS1.0 for Beast & ...
3
votes
0answers
2k views
Set outgoing interface on Fortigate explicit proxy
I am testing the explicit proxy on a Fortigate 200D firmware 5.4
WAN1 and WAN2 are both members of the wan load balancer interface.
I need to set the proxy to use WAN1 but it it is defaulting to ...
1
vote
1answer
568 views
Possible to dump sflow data to pcap format?
I want to get the packet capture from fortiet/fortigate device, to capture all traffic from it on one of its interface. For it i have enabled sflow and sent it to another ntopng server. but on ntopng ,...
0
votes
0answers
2k views
Fortigate VPN client disconnects cause SSH connection resets
I have to use Fortigate's SSL VPN client for Windows (version 5.4.1.0840) to connect to our corporate network.
One of the most annoying things about this software is that whenever the VPN client ...
-2
votes
1answer
5k views
ForiGate 60D Error VPN id=96603 msg=“SSLVPN tunnel connection failed (Error=-12).”
i can login to vpn from web browser with same user name and password
but when i try from fortigate clinet i am getting the error
Error VPN id=96603 msg="SSLVPN tunnel connection failed (Error=-12)....
0
votes
1answer
2k views
Issues with DMZ on Fortigate 90D, second router can't reach internet
I am having issues setting up a DMZ port on my Firewall (hardware router). I am also assuming this belongs in Super User, as it seems like a basic DMZ setup. Here is the setup:
I have a Fortigate 90D ...
7
votes
1answer
362 views
Best Practice: notify email sender that their reverse lookup is broken
This probably should be a wiki, not entirely sure. Before I begin, the external server that performs scanning is a custom amavis/postfix/fortigate pipeline; it is suggested that any changes work ...
3
votes
3answers
13k views
Connecting to a FortiGate VPN from a remote Linux machine via OpenSwan
Here's the setup:
I have a FortiGate unit on a business network, which has a FortiGate VPN set up. Machines on a remote network that can run FortiClient (Windows and Mac machines) have no problem ...
0
votes
2answers
4k views
How to configure Fortigate 60D as L2PT/IPSEC client
I have a firewall Fortigate 60D and I need to create a tunnel to a L2TP/IPSEC server, so the firewall has to act as a client.
Is it possible?
I configured the L2TP/IPSEC server on a Linux Debian ...
1
vote
2answers
4k views
Does anyone know what the Fortigate SSL VPN error 6 on the linux client means?
I often get:
SSLVPN down unexpectedly with error:6
When trying to connect the 64bit/forticlientsslvpn_cli. My experience has been:
Once you start getting, no number of retries will get you ...
-1
votes
1answer
783 views
Tomcat server port access
I have changed the tomcat default port to 8091 (eg. http://localhost:8091/project) which has been set up in intranet server and is working very fine within the network.I have to provide access to the ...
0
votes
1answer
1k views
IPsec VPN between Fortigate 60C and openswan up, but no traffic
I get visual confirmation that the tunnel is working from the fortigate GUI but, it also says i don't have 1 byte of traffic, the linux server also confirms the tunnel is open but i can't ping nowhere,...
0
votes
0answers
351 views
site not reachable after firewall reboot
After rebooting my Fortigate firewall, I can no longer reach a specific website from within
the internal lan (I'd better say from a specific public ip since all the machines belonging
to the internal ...
4
votes
1answer
5k views
VPN ERROR 500 STATE_MAIN_I1, unable to start phase2
i'm trying to set up a site to site vpn to a fortigate 60c from a CentOS 7 with openswan, the error i get everytime is the following
000 #1: "office":500 STATE_MAIN_I1 (sent MI1, expecting MR1);
...
0
votes
1answer
659 views
Not able to connect to GitHub though the Firewall
We have Fortigate Firewall install on the network, What port I should open to connect to the GitHub repository using the https:// protocol.
I found a similar question , And allowed the port suggested ...
github
4
votes
0answers
2k views
VLAN ID over DHCP for Management Interface of Fortinet FortiAP
When configuring the FortiAP device it's desirable to configure the VLAN ID for the tagged management network. Accordingly to the manual it's possible to do so by "telnetting" to the FortiAP device ...
1
vote
0answers
417 views
Using airport extreme as an AP with true bridge mode (forwarding 802.1x auth)
So here is my setup. I have a Router (Fortigate) 4 airport Extreme, and a radius/ldap server on a distant server.
I want my user to authenticate with the radius or LDAP server, and be able to create ...
0
votes
0answers
5k views
Fortigate - cannot ping public IP in dual WAN ISP setup
I have a fortigate 100c that is configured with 2 WAN ISP's
LAN1 -------------- ISP 1 (static pub 1.1.1.1)
|-FORTIGATE-|
LAN2 ---------------ISP 2 (dynamic pub 10.1.1.1)
I have policy routes ...
