5 votes
Accepted

TCP session established even if the server isn't listening on particular port

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
Steffen Ullrich's user avatar
5 votes
Accepted

FortiGate 100E update through SquidProxy

The easiest solution is to download the current firmware from the support webpage (https://support.fortinet.com) and import it manually over the Admin Web GUI. That are possible over System->...
scherard's user avatar
  • 164
5 votes

how does OSPF work with different subnets and is it slower?

I would have expected that router A won't see routes on router C but obviously it still does receive that route. What is the explanation for that? Propagating routes to all subnets is the main point ...
Zac67's user avatar
  • 83.9k
4 votes

Fortigate "remembers" bad routes

First off, this behavior is as expected. The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and ...
user1016274's user avatar
4 votes

How to flush route cache in fortigate

From the CLI you can issue the following command to restart the routing service. exec router restart To restart OSPF, you can use. exec router clear ospf process
A-A-Ron's user avatar
  • 536
4 votes
Accepted

How to check the ifIndex on a Fortigate 1500D?

The following should show you the snmp-index for each interface on the Fortigate. You can also modify this field if you so choose. # config system interface (interface) # show
A-A-Ron's user avatar
  • 536
4 votes
Accepted

How can i find which cisco switch port is connnected to specific port of Fortigate?

You can check the MAC address table on the switch to see on what port you learned the MAC address of the Fortigate's management interface. It should be possible to enable LLDP on the Fortinet as of ...
Teun Vink's user avatar
  • 17.1k
4 votes
Accepted

Can a QSFP28 port break out to 4 SFP+ ports to separate hosts?

On most devices, that is possible. Check the manual for splitting a QSFP28 port into four SFP28 or SFP+ interfaces. The datasheet specifically shows 28 10GbT and 8 SFP+ for 10G and lists a 40GbE, ...
Zac67's user avatar
  • 83.9k
3 votes
Accepted

NAT port is exhausted

This message means that all high ports (>1023) are used up for outbound NATted connections. This is very rare and signifies that your FGT is processing way too many sessions. Check the number of open ...
user1016274's user avatar
3 votes
Accepted

FortiGate HA (A/A) Cluster: How can I manage the slave unit from the web GUI?

Clustered Fortigate units become ONE unit in terms of L3 IP addresses, L2 MAC addresses, policies, objects etc. Only a few HA parameters along with the hostname are not mirrored from master to slave(s)...
user1016274's user avatar
3 votes
Accepted

Fortigate: HTTP/HTTPS Traffic Connections Timeout

I was never able to solve this issue. It seemed to be something within the FGT kernel and without an active Fortinet subscription, my working "solution" was to upgrade to an FGT-110C running 5.2.x.
rub-a-dub-dub's user avatar
3 votes

How to flush route cache in fortigate

This might be a little late, but since the question still pops up on the Google search, I thought I answer it. The following command works in 6.2.7* and above, but does not show up as an argument when ...
Deltemir's user avatar
3 votes

In one organization having two ISP which configured on fortigate firewall ? How can we do the failover for internet?

Create 2 default routes (0.0.0.0/0) to the 2 gateway addresses of your ISPs. The secondary one should have a higher distance like 20 as the default distance in FortiOS is 10. This will guard you from ...
user1016274's user avatar
3 votes
Accepted

Can Fortinet firewall's administrator decode SSL traffic to get logging information (Gmail/Skype/RDP password)?

Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection. SSL deep inspection ...
Zac67's user avatar
  • 83.9k
3 votes
Accepted

Cannot Ping Firewall After Changing SFP

The speed 100 duplex full on GE1/0/8 & GE1/0/11 are most likely a problem. Setting a fixed speed/duplex mode disables autonegotiation. If the other side isn't set to exactly the same mode the ...
Zac67's user avatar
  • 83.9k
3 votes

Fortigate VPN Site to Multi Site

There are a few configuration details to consider: Each branch gateway requires not only the HQ network in its IPsec SAs, but also those of the other branches. Finer graning is (somewhat) more secure ...
Zac67's user avatar
  • 83.9k
3 votes

FortiGate: IPSec peer-to-peer and two remote peers

This can easily be done by using route-based tunnels and throwing BGP on top so that you can peer with both of the ASAs connections at the same time and use one of the methods that BGP supports for ...
Jesse P.'s user avatar
  • 4,690
3 votes
Accepted

how does OSPF work with different subnets and is it slower?

update: Explanation of DR/BDR mechanism in OSPF First, I would recommend first understanding how OSPF works on point-to-point links, i.e., on the links that can connect only two routers. On such links ...
Effie's user avatar
  • 1,828
2 votes

Fortigate - Redirecting subdomains only?

I believe you would want to use a "DNS Filter" for this. It has an option to block domains via a "Static Domain Filter". In it, you can specify any combination of subdomains, which will be easier to ...
greezybacon's user avatar
2 votes

I have forgate 60c firewall i want to block fb andyoutube in my network in some specific Ip Range , please informe me full process?

1 step: Create Address group by clicking on policy&Objects. Expand the objects and select address when select address you can create address group by giving name like blocked users. Step: create ...
venky boddulla's user avatar
2 votes

Is there anyway to set Quota for users in Fortigate?

You can set a quota via the web filter profile. The quota can be configured per category, and the category action need to be set to either Monitor / Warning / Authenticate. The quota can be a traffic ...
mAvbig's user avatar
  • 76
2 votes
Accepted

Abnormally Bandwidth utilization goes high what should I do

You should capture all network traffic from your internet connection to understand what traffic is causing it. Until you know what causes it, you cannot take effective action to stop it happening. ...
marctxk's user avatar
  • 1,181
2 votes

Fortigate 3800 and Juniper QFX 5200 40G connectivity

The thing to watch with 40G between devices is multi-mode fibre patch leads. Unlike regular multi-mode SFP/SFP+ where you have only two cores of fibre which are crossed over between devices, multi-...
Benjamin Dale's user avatar
2 votes

Connecting to fortigate 5.4 with vpnc (ipsec)

There's 2 things I notice: 1- You assign IP addresses to the VPN clients in the same range as for internal (LAN) hosts. When a client dials in the FGT (90D) automatically creates a host route to ...
user1016274's user avatar
2 votes
Accepted

Fortigate 300C : Web-Filter not working

Check the ssl inspection. If you don't configure SSL inspection the fortigate won't block HTTPS web pages
Roid's user avatar
  • 201
2 votes
Accepted

Fortigate 30D IPSEC VPN could not locate phase1 configuration

I upgraded to 5.4.0 and it fixed the issue. Prior to upgrading I could reproduce the issue by rebooting the PPPoE router and the VPN would not come back up with debug showing the error "could not ...
RyanW's user avatar
  • 36
2 votes
Accepted

tidy up the IP addresses on fortigate 90d

@Nroot: your explanation is not quite right. The FGT doesn't reserve an address for a specific MAC address unless manually configured to do so. Rather, the client requests the same address as ...
user1016274's user avatar
2 votes
Accepted

Fortigate Firewall cli query || show and get

As far as I can remember show is used to check parameters and options as they are set in configuration, while get is used to check runtime values. Let say you have configured an interface for ...
Daniel Yuste Aroca's user avatar

Only top scored, non community-wiki answers of a minimum length are eligible