6 votes

How do I reset a Fortigate firewall password without resetting the firewall

Hey you could have just googled that and the first link is your answer. Here. Do some research before asking please. Here's the steps in short: connect to the fgt with a com cable, if not com port ...
user avatar
5 votes

Is Fortigate-60D a fanless model?

Yes, the Fortigate FG-60D and it's sibling FortiWifi FWF-60D are both fanless. I've seen and sold a lot of them.
user avatar
5 votes
Accepted

TCP session established even if the server isn't listening on particular port

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
user avatar
4 votes

Fortigate "remembers" bad routes

First off, this behavior is as expected. The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and ...
user avatar
4 votes

How to flush route cache in fortigate

From the CLI you can issue the following command to restart the routing service. exec router restart To restart OSPF, you can use. exec router clear ospf process
user avatar
  • 536
4 votes
Accepted

How to check the ifIndex on a Fortigate 1500D?

The following should show you the snmp-index for each interface on the Fortigate. You can also modify this field if you so choose. # config system interface (interface) # show
user avatar
  • 536
4 votes
Accepted

How can i find which cisco switch port is connnected to specific port of Fortigate?

You can check the MAC address table on the switch to see on what port you learned the MAC address of the Fortigate's management interface. It should be possible to enable LLDP on the Fortinet as of ...
user avatar
  • 15.7k
4 votes
Accepted

Can a QSFP28 port break out to 4 SFP+ ports to separate hosts?

On most devices, that is possible. Check the manual for splitting a QSFP28 port into four SFP28 or SFP+ interfaces. The datasheet specifically shows 28 10GbT and 8 SFP+ for 10G and lists a 40GbE, ...
user avatar
  • 71.7k
3 votes
Accepted

FortiGate HA (A/A) Cluster: How can I manage the slave unit from the web GUI?

Clustered Fortigate units become ONE unit in terms of L3 IP addresses, L2 MAC addresses, policies, objects etc. Only a few HA parameters along with the hostname are not mirrored from master to slave(s)...
user avatar
3 votes
Accepted

Fortigate: HTTP/HTTPS Traffic Connections Timeout

I was never able to solve this issue. It seemed to be something within the FGT kernel and without an active Fortinet subscription, my working "solution" was to upgrade to an FGT-110C running 5.2.x.
user avatar
3 votes

Fortigate user traffic quota

I've used FortiGate in the past and you can do that with UTM like M4niac said. One thing to be careful with, maybe you've already experienced this, is Forti units are slow to process changes. In my ...
user avatar
  • 93
3 votes

Fortigate user traffic quota

What version of fortios are you using? and what model de you have? FortiOs 5.0 and 5.2 (i think) have what are you looking for which includes an UTM options of client reputation (in other words, users ...
user avatar
  • 119
3 votes
Accepted

NAT port is exhausted

This message means that all high ports (>1023) are used up for outbound NATted connections. This is very rare and signifies that your FGT is processing way too many sessions. Check the number of open ...
user avatar
3 votes

How to flush route cache in fortigate

This might be a little late, but since the question still pops up on the Google search, I thought I answer it. The following command works in 6.2.7* and above, but does not show up as an argument when ...
user avatar
3 votes

In one organization having two ISP which configured on fortigate firewall ? How can we do the failover for internet?

Create 2 default routes (0.0.0.0/0) to the 2 gateway addresses of your ISPs. The secondary one should have a higher distance like 20 as the default distance in FortiOS is 10. This will guard you from ...
user avatar
3 votes
Accepted

Can Fortinet firewall's administrator decode SSL traffic to get logging information (Gmail/Skype/RDP password)?

Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection. SSL deep inspection ...
user avatar
  • 71.7k
3 votes
Accepted

Cannot Ping Firewall After Changing SFP

The speed 100 duplex full on GE1/0/8 & GE1/0/11 are most likely a problem. Setting a fixed speed/duplex mode disables autonegotiation. If the other side isn't set to exactly the same mode the ...
user avatar
  • 71.7k
3 votes

Fortigate VPN Site to Multi Site

There are a few configuration details to consider: Each branch gateway requires not only the HQ network in its IPsec SAs, but also those of the other branches. Finer graning is (somewhat) more secure ...
user avatar
  • 71.7k
3 votes

FortiGate: IPSec peer-to-peer and two remote peers

This can easily be done by using route-based tunnels and throwing BGP on top so that you can peer with both of the ASAs connections at the same time and use one of the methods that BGP supports for ...
user avatar
  • 4,661
2 votes

Routing from IPSec VPN1 to IPSec VPN2 through HQ

Considering you have the IPSec tunnels up and running, that's half the battle, the other half is getting your Fortinet HQ to act as an Internet transport "between" hubs. With the Forinet you can use ...
user avatar
  • 395
2 votes

Cisco ASA creating two identicial Tunnel IDs?

For starters, they aren't identical: 1718.1, 1718.2, 1718.3 There will be one security association ("tunnel") per ACL rule.
user avatar
  • 29.7k
2 votes

Fortigate reverse path check fail

(This question seems to be stale but might be found while searching anyway.) The debug message indicates that the Fortigate drops this traffic as being from an unknown source net. This is called the ...
user avatar
2 votes

where to NAT?where to run BGP?

You should run BGP on your Cisco routers connecting to ISP. If FW supports BGP, it should run iBGP with the routers. I would prefer doing NAT on the FW. All you have to do is make sure that the ...
user avatar
  • 352
2 votes
Accepted

How to disable unused LAN ports on Fortigate

It's look like that theinternal-switch-mode is set as switch¹ (by default). That means that all port on the internal interface are configured as they are only one: Switch mode combines FortiGate ...
user avatar
2 votes

Fortigate - Redirecting subdomains only?

I believe you would want to use a "DNS Filter" for this. It has an option to block domains via a "Static Domain Filter". In it, you can specify any combination of subdomains, which will be easier to ...
user avatar
2 votes

I have forgate 60c firewall i want to block fb andyoutube in my network in some specific Ip Range , please informe me full process?

1 step: Create Address group by clicking on policy&Objects. Expand the objects and select address when select address you can create address group by giving name like blocked users. Step: create ...
user avatar
2 votes
Accepted

Fortigate 30D IPSEC VPN could not locate phase1 configuration

I upgraded to 5.4.0 and it fixed the issue. Prior to upgrading I could reproduce the issue by rebooting the PPPoE router and the VPN would not come back up with debug showing the error "could not ...
user avatar
  • 36
2 votes

Is there anyway to set Quota for users in Fortigate?

You can set a quota via the web filter profile. The quota can be configured per category, and the category action need to be set to either Monitor / Warning / Authenticate. The quota can be a traffic ...
user avatar
  • 76

Only top scored, non community-wiki answers of a minimum length are eligible