6
votes
How do I reset a Fortigate firewall password without resetting the firewall
Hey you could have just googled that and the first link is your answer. Here.
Do some research before asking please.
Here's the steps in short:
connect to the fgt with a com cable, if not com port ...
- 394
5
votes
Accepted
TCP session established even if the server isn't listening on particular port
Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
- 2,343
5
votes
Accepted
FortiGate 100E update through SquidProxy
The easiest solution is to download the current firmware from the support webpage (https://support.fortinet.com) and import it manually over the Admin Web GUI.
That are possible over System->...
- 164
5
votes
how does OSPF work with different subnets and is it slower?
I would have expected that router A won't see routes on router C but obviously it still does receive that route. What is the explanation for that?
Propagating routes to all subnets is the main point ...
- 81.5k
4
votes
Fortigate "remembers" bad routes
First off, this behavior is as expected.
The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and ...
- 880
4
votes
How to flush route cache in fortigate
From the CLI you can issue the following command to restart the routing service.
exec router restart
To restart OSPF, you can use.
exec router clear ospf process
- 536
4
votes
Accepted
How to check the ifIndex on a Fortigate 1500D?
The following should show you the snmp-index for each interface on the Fortigate. You can also modify this field if you so choose.
# config system interface
(interface) # show
- 536
4
votes
Accepted
How can i find which cisco switch port is connnected to specific port of Fortigate?
You can check the MAC address table on the switch to see on what port you learned the MAC address of the Fortigate's management interface.
It should be possible to enable LLDP on the Fortinet as of ...
- 17k
4
votes
Accepted
Can a QSFP28 port break out to 4 SFP+ ports to separate hosts?
On most devices, that is possible. Check the manual for splitting a QSFP28 port into four SFP28 or SFP+ interfaces.
The datasheet specifically shows 28 10GbT and 8 SFP+ for 10G and lists a 40GbE, ...
- 81.5k
3
votes
Accepted
NAT port is exhausted
This message means that all high ports (>1023) are used up for outbound NATted connections. This is very rare and signifies that your FGT is processing way too many sessions. Check the number of open ...
- 880
3
votes
Accepted
FortiGate HA (A/A) Cluster: How can I manage the slave unit from the web GUI?
Clustered Fortigate units become ONE unit in terms of L3 IP addresses, L2 MAC addresses, policies, objects etc. Only a few HA parameters along with the hostname are not mirrored from master to slave(s)...
- 880
3
votes
Accepted
Fortigate: HTTP/HTTPS Traffic Connections Timeout
I was never able to solve this issue. It seemed to be something within the FGT kernel and without an active Fortinet subscription, my working "solution" was to upgrade to an FGT-110C running 5.2.x.
- 306
3
votes
How to flush route cache in fortigate
This might be a little late, but since the question still pops up on the Google search, I thought I answer it.
The following command works in 6.2.7* and above, but does not show up as an argument when ...
- 31
3
votes
In one organization having two ISP which configured on fortigate firewall ? How can we do the failover for internet?
Create 2 default routes (0.0.0.0/0) to the 2 gateway addresses of your ISPs. The secondary one should have a higher distance like 20 as the default distance in FortiOS is 10.
This will guard you from ...
- 880
3
votes
Accepted
Can Fortinet firewall's administrator decode SSL traffic to get logging information (Gmail/Skype/RDP password)?
Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection.
SSL deep inspection ...
- 81.5k
3
votes
Accepted
Cannot Ping Firewall After Changing SFP
The
speed 100
duplex full
on GE1/0/8 & GE1/0/11 are most likely a problem. Setting a fixed speed/duplex mode disables autonegotiation. If the other side isn't set to exactly the same mode the ...
- 81.5k
3
votes
Fortigate VPN Site to Multi Site
There are a few configuration details to consider:
Each branch gateway requires not only the HQ network in its IPsec SAs, but also those of the other branches. Finer graning is (somewhat) more secure ...
- 81.5k
3
votes
FortiGate: IPSec peer-to-peer and two remote peers
This can easily be done by using route-based tunnels and throwing BGP on top so that you can peer with both of the ASAs connections at the same time and use one of the methods that BGP supports for ...
- 4,690
3
votes
Accepted
how does OSPF work with different subnets and is it slower?
update: Explanation of DR/BDR mechanism in OSPF
First, I would recommend first understanding how OSPF works on point-to-point links, i.e., on the links that can connect only two routers. On such links ...
- 1,798
2
votes
Fortigate - Redirecting subdomains only?
I believe you would want to use a "DNS Filter" for this. It has an option to block domains via a "Static Domain Filter". In it, you can specify any combination of subdomains, which will be easier to ...
- 156
2
votes
Is there anyway to set Quota for users in Fortigate?
You can set a quota via the web filter profile. The quota can be configured per category, and the category action need to be set to either Monitor / Warning / Authenticate.
The quota can be a traffic ...
- 76
2
votes
Accepted
Abnormally Bandwidth utilization goes high what should I do
You should capture all network traffic from your internet connection to understand what traffic is causing it. Until you know what causes it, you cannot take effective action to stop it happening.
...
- 1,181
2
votes
Fortigate 3800 and Juniper QFX 5200 40G connectivity
The thing to watch with 40G between devices is multi-mode fibre patch leads.
Unlike regular multi-mode SFP/SFP+ where you have only two cores of fibre which are crossed over between devices, multi-...
- 9,381
2
votes
Connecting to fortigate 5.4 with vpnc (ipsec)
There's 2 things I notice:
1- You assign IP addresses to the VPN clients in the same range as for internal (LAN) hosts. When a client dials in the FGT (90D) automatically creates a host route to ...
- 880
2
votes
I have forgate 60c firewall i want to block fb andyoutube in my network in some specific Ip Range , please informe me full process?
1 step: Create Address group by clicking on policy&Objects. Expand the objects and select address when select address you can create address group by giving name like blocked users.
Step: create ...
2
votes
Accepted
Fortigate 300C : Web-Filter not working
Check the ssl inspection. If you don't configure SSL inspection the fortigate won't block HTTPS web pages
- 101
2
votes
Accepted
Fortigate 30D IPSEC VPN could not locate phase1 configuration
I upgraded to 5.4.0 and it fixed the issue. Prior to upgrading I could reproduce the issue by rebooting the PPPoE router and the VPN would not come back up with debug showing the error "could not ...
- 36
2
votes
Accepted
tidy up the IP addresses on fortigate 90d
@Nroot: your explanation is not quite right. The FGT doesn't reserve an address for a specific MAC address unless manually configured to do so. Rather, the client requests the same address as ...
- 880
Only top scored, non community-wiki answers of a minimum length are eligible