Questions tagged [fortinet]
Fortinet is a vendor for security appliances, e.g. the FortiGate firewall.
80
questions
0
votes
1
answer
336
views
FortiClient VPN blocking some traffic, dual adapter setting, blocking access on both networks
i have two adapters, one via ethernet and a wifi one, when i connect to my work vpn i would like only one of those to be configured for the vpn and the other one to work regularly is there anyway to ...
0
votes
1
answer
627
views
Cannot delete fortigate gre tunnel
I have created a GRE tunnel on Fortigate 1100E. Now I want to remove this tunnel, but I receive this error:
Current vf=root:0.
A tunnel interface cannot be deleted directly.
Command_cli_delete:6677 ...
- 101
0
votes
0
answers
424
views
Internal Virtual Server
I've been reading about Virtuals servers with fortinet:
https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/713497/virtual-server
But it seems that only works redirecting a public IP to ...
- 113
0
votes
0
answers
4k
views
Fortigate VPN for some users: "Unable to logon to the server. Username or password may not be properly configured for this connection. (-12)"
We are using a Fortigate 60F, to which we usually connect to VPN using the Forticlient app. Everything used to work fine, but for the last two or three days, we have two users that cannot connect and ...
0
votes
1
answer
1k
views
Execute sequence of commands in fortinet
I would like to execute three commands in a fortinet firewall, the commands are:
#To enter in the config mode:
config vdom
#To select the virtual domain:
edit "name"
#To see the info I want:
...
- 33
1
vote
2
answers
502
views
Connect to en /ext host of Fortinet VPN with Ubuntu
I have used openfrotivpn many times but I have never been able to properly configure such a VPN in the network manager.
Unfortunately, now I have to connect to host [some ip]/ext (e.x. 192.168.10.10/...
- 111
4
votes
2
answers
1k
views
2 Different Public Address for High Availability
this is my first time asking a question here, and I was wondering is it possible to have two different ISP public IPs connected to a single system for high availability?
for example, if our ISP 1 ...
2
votes
1
answer
135
views
Azure run command for Fortinet virtual machine with serial console?
I'm trying to execute with Azure a .conf file that has some command lines that are executable into the Fortinet's serial console in a virtual machine with FortiOS v6.4.3 (Linux based system).
I use AZ ...
- 163
2
votes
0
answers
679
views
Fortigate and RADIUS Wifi authentication for domain and non-domain devices
We're setting up RADIUS authentication for wireless network connections through a Windows Server 2012 R2 (NPS).
We have to allow both domain computers (registered in Active directory) and non-domain ...
- 75
-1
votes
1
answer
367
views
Email Two-Factor Authentication on FortiGate
I'm currently implementing Multi-Factor Authentication on FortiGate, using mailer system and refer to this document link.
There is no options to change the subject or content of email, because ...
- 99
0
votes
1
answer
155
views
How can I set Forti VPN so that http/https are not using VPN Xubuntu?
I need to browse (ie, HTTP/HTTPS) and at the same time connected to remote network via VPN (for ssh, which works fine). Maybe my HTTP/HTTPS request are sent till remote VPN network and then got ...
- 101
0
votes
2
answers
193
views
Can SMTP retries come from different IP addresses?
I have a FortiMail with Greylisting turned on. The idea is that only after a valid SMTP retry, an email will get released.
However, it appears that for a large email provider like outlook.com, ...
- 524
3
votes
1
answer
547
views
Connecting a Nest Camera to Aruba Access Points (APs) backed by a Fortinet Firewall
I am having trouble connecting my Nest cameras to my network.
I am running Aruba 300 series Access Points and a Fortinet firewall (which is doing the routing).
The Nest cameras never connect, and ...
- 161
2
votes
1
answer
352
views
Systematically Remove an Internet Connection
We are about to deploy FortiNet FortiClient VPN to our end users however we're running into one small snag. During the installation it also creates a dial-up connection which appears in the WiFi pup-...
- 31
0
votes
0
answers
3k
views
External Captive portal with fortigate Firewall
I working on external captive portal for fortigate firewall
I followed this tutorial to config my fortigate with external captive portal
http://cookbook.fortinet.com/using-an-external-captive-portal-...
2
votes
2
answers
19k
views
LACP Trunk from Cisco to Fortinet
I am setting up a 2 ethernet trunk between a Cisco switch and Fortinet 100E firewall. So far the below is working (i can ping from Cisco 192.168.1.2 and get replies from the Fortinet 192.168.1.1):
...
- 1,140
1
vote
1
answer
456
views
Active Directory not keeping RDP alive in log so FW can allow internet
I have a Fortinet firewall that looks at my AD to recognize my domain users to grant access to the internet and for the most part it works perfectly except for when users remote into computers from ...
0
votes
1
answer
43
views
using VPN IP Address
I use FotreClient to VPN to my company
Previously I was getting same IP address as i am in the company
after few changes to the server and upgrading ForteClient now when I VPN to the company I still ...
- 101
1
vote
1
answer
180
views
Ip Configuration in Fortigate 60d
I have a fortigate 60d which bought around 3-4 years ago. Today i tried to install over of fiber internet. I connected my forti with 192.168.3.1 then i clicked wizard and entered new values and new ip ...
- 41
3
votes
0
answers
2k
views
Set outgoing interface on Fortigate explicit proxy
I am testing the explicit proxy on a Fortigate 200D firmware 5.4
WAN1 and WAN2 are both members of the wan load balancer interface.
I need to set the proxy to use WAN1 but it it is defaulting to ...
- 15.5k
1
vote
1
answer
783
views
Possible to dump sflow data to pcap format?
I want to get the packet capture from fortiet/fortigate device, to capture all traffic from it on one of its interface. For it i have enabled sflow and sent it to another ntopng server. but on ntopng ,...
- 4,279
5
votes
2
answers
12k
views
Fortinet SSL VPN Client Setup Without GUI on Linux (Ubuntu)
When I use
./forticlientsslvpn_cli --server 172.17.97.85:10443 --vpnuser forti
to connect to the vpn, (using Forticlient SSLVPN 4.4.2329-1 64bit & Forticlient SSLVPN 4.4.2327-2 64bit) it shows
...
0
votes
1
answer
2k
views
Issues with DMZ on Fortigate 90D, second router can't reach internet
I am having issues setting up a DMZ port on my Firewall (hardware router). I am also assuming this belongs in Super User, as it seems like a basic DMZ setup. Here is the setup:
I have a Fortigate 90D ...
- 101
0
votes
1
answer
2k
views
fortimail antispam has blacklisted the internal exchange mail server address
i have an exchange server for which i wanted to redirect outbound messages throught a fortimail antispam box. i created a new send connector for a test domain and used the ip of the antispam as the ...
- 472
1
vote
2
answers
6k
views
How to disconnect a forticlient VPN connection from a script?
I need to make an bash script on Linux that connects into an VPN, processes some tasks, and then disconnects.
To connect to the VPN I use the forticlient ssl vpn (like fortinet but for VPN instead). ...
- 11
10
votes
8
answers
26k
views
How to get forticlient working in OSX El Capitan
The forticlient VPN software is borked, when using split horizon, since OSX El Capitan. The problem is that DNS requests are sent out on the normal primary interface to the DNS of the VPN tunnel.
How ...
- 411
1
vote
1
answer
715
views
Use a physical cryptographic token with OpenVPN community (free) version
I am currently setting up OpenVPN to provide company access to multiple clients. Our requirement is to use certificates, password protect the client keys, as well as using dual factor (MFA) ...
- 1,063
4
votes
0
answers
2k
views
VLAN ID over DHCP for Management Interface of Fortinet FortiAP
When configuring the FortiAP device it's desirable to configure the VLAN ID for the tagged management network. Accordingly to the manual it's possible to do so by "telnetting" to the FortiAP device ...
- 5,480
2
votes
1
answer
699
views
Fortinet Ascenlink heavy packet loss
I'm working on a company with some Fortinet appliances. One of them is a Load Balancer named AscenLink. The specific model is an AscenLink AL-700.
There's a insane problem: a huge packet loss on the ...
- 5,480
1
vote
1
answer
1k
views
Banning client from surfing the net
In order to implement some egress traffic filtering so that a client can only visit specific web sites only, is it possible to configure a Fortinet FGT 60B to do some IP MAC address binding?
In a ...
- 11
1
vote
0
answers
2k
views
Fortigate 60D - Empty log and report
Environment:
Fortigate 60D
Forti OS 5.0
I can not see any log or report in the firewall. I have already activated forticloud and I recieve empty reports.
Is there something that we have to activate ...
- 121
0
votes
1
answer
105
views
Fortinet as intermediate router
I have the next scenario:
FG1(LAN A) <--IPSEC--> FG2(LAN B) <--IPSEC--> FG3(LAN C)
Basically I need that "LAN A" reach "LAN C" through FG2, I've tried with "router policy" and "router ...
1
vote
0
answers
1k
views
Dynamic IP Blocking on FORTIGATE 200A Firewall
I have FORTIGATE 200A firewall protecting a IIS Server running a ASP.NET website (windows server 2008 and IIS7)
I'm not familiar with Fortigate configurations and options.
I recently had "attacks" ...
- 145
2
votes
1
answer
13k
views
Fortigate IPSEC VPN Issue
Have a challenging question here.
We have a Fortigate 620B which we're trying to use to route some traffic over a VPN tunnel to a customer.
We want the traffic to go out of our interface with one of ...
- 107
0
votes
1
answer
802
views
PXE-T00 filename too long
I'm using a fortinet router as the dhcp server, I have option 67 defined as pxelinux.0 in hexa, it works fine for VMs and my own computer, they boot on PXE just fine.
Now I have an other computer I'd ...
- 377
1
vote
1
answer
3k
views
Avoiding split brain DNS for a Fortigate Web Proxy
How can I avoid needing a split brain DNS setup with the setup outlined below?
Background
I have what "should" be a pretty basic setup using a Fortigate 200D.
'Third leg' setup using a DMZ
...
- 15.5k
2
votes
8
answers
30k
views
Get external public IP from command line in Fortinet
Is there any way to know the public IP address of a Fortinet? There are many services such as icanhazip.com that tell you the current IP.
In Linux, I would just run:
curl http://icanhazip.com
How ...
- 718
0
votes
0
answers
269
views
FortiBalancer and IE TCP issues
We are using a Fortibalancer for our web servers (Win2012 with IIS) and we have run into a strange issue. IE users will experience timeouts (~77s) in getting a response from our servers. Packet traces ...
- 272
0
votes
0
answers
533
views
Fortigate VM Logs
I have a Fortigate VM v5.2.0
I have setup VPN like described here Fortigate IPsec VPN for iOS
I can logon with iOS and I see in Local Traffic Log the connection:
Pic1
But when I try to browse a ...
- 87
1
vote
1
answer
7k
views
How to disable SSL-VPN on FortiOS 5.0
Hearbleed issue.
Must disable SSL-VPN.
I wasnt able to find it in the GUI.
Might there happen to be a CLI command?
- 639
0
votes
1
answer
6k
views
FortiGate 80c port forward
I have a FortiGate 80c and I'm getting at a lost on how to port forward to get my OpenVPN service accessible externally.
I did setup the VirtualIP assigning tcp 1194 on the internal IP to the ...
- 375
0
votes
0
answers
2k
views
Fortigate 80C multi wan
I've Fortigate 80c and two internet lines from two separate ISPs.
I'm trying to distribute sessions between both internet lines following http://docs-legacy.fortinet.com/cb/html/index.html#page/...
- 1
0
votes
1
answer
672
views
ScreenOS Failover tunnel
I have a route-based vpn from my site (Netscreen204) to a customer site (Fortinet) . They want a second, backup tunnel in case of failure, and will be using the Fortune there too.
The only thing I ...
- 13
0
votes
0
answers
965
views
Debugging IPSEC log
A Fortigate unit and a Openswan based Linux server.
Tunnel is up but no data goes through.
This is the log from the Forti unit:
Line 204: ike 0:Brazil_VPN:2803378:19809969: responder received first ...
- 639
0
votes
2
answers
5k
views
Fortigate 224b interfaces reappearing and can't be (re)deleted
About two years ago I created a few hardware switch interfaces for testing when I first purchased this unit. I deleted them shortly thereafter and there was nothing amiss. Made changes to the ...
- 121
0
votes
1
answer
896
views
Fortigate Identity Policy and Custom Services
Is it me or is it impossible to have the user\pass portal for services there are NOT pre-defined in Fortigate?
I've been trying for a few hours to force anyone who tries to access a certain server on ...
- 639
4
votes
1
answer
5k
views
Fortigate VPN Routing issue
I have 200B Fortigate unit with 2 internet WAN connections.
I also have a remote site which I'm connected to via IPSEC VPN through WAN1.
This site has only one GW IP address.
I'd also like to setup a ...
- 639
0
votes
1
answer
4k
views
Open port 8009/tcp on Fortigate necessary?
A nmap scan of a Fortigate Firewall showed that TCP port 8009 open is. According to knowledge base articles this is only to download the client for ssl vpn. Is this port used for anything else, and if ...
- 287
0
votes
1
answer
15k
views
Fortinet multiple WAN IP to several ports
I have a 5 public IP address range. (ie: 1.1.1.1 to 1.1.1.5)
I would like to assign the first to port 1 transparently in a way that a VPN router (RV082) could connect via it and respond transparently....
- 135
0
votes
4
answers
66k
views
Fortigate bandwidth monitoring
I have a Fortigate 200B with Forti OS 5.0.
How can I watch the total bandwidth being used by my unit both incoming and outgoing?
Thanks
- 639