10

I haven't used a Fortigate FW for load balancing, so I will answer some of the questions more generally. First, as to your problem, the load balancer is doing exactly as it is supposed to do and I think your servers may not be configured correctly to respond to a request on their IP address. If you were to test this behind the load balancing, you could set ...


9

In fortigate firewall in vip configuration public ip is mapped with private ip and this vip Example below Inbound traffic policy Source interface : outside interface Source address : Any Destination interface : inside interface Destination address :Vip Ports: Security profiles:on This vip we are doing destination nat It should work if you are getting error ...


7

From Network Labs blog: "In case of a Fortinet firewall, its Policy Route: CLI version: config router policy edit 1 set input-device "port4" set src 172.18.0.0 255.255.0.0 set dst 192.168.3.0 255.255.255.0 set protocol 6 set start-port 443 set end-port 443 set gateway 1.1.1.1 set output-...


6

Try with: diagnose sys tcpsock | grep 0.0.0.0


6

What you can do is SSH to the Active unit, then run: execute ha manage <x> where x is the ID of the other unit. Then run config system interface edit "port1" set status down next edit "port1" set status up end You can then log on to the switch (assuming it is logging interface UP/DOWNS) and see which interface went down.


6

Hey you could have just googled that and the first link is your answer. Here. Do some research before asking please. Here's the steps in short: connect to the fgt with a com cable, if not com port then use USB cable with fortiexplorer. Start the console. reboot the device and wait for it to ask for the username Type in the username: maintainer The ...


5

The product datasheet for the Fortigate-60 specs out the Heat Dissipation at 40BTU/h and Operating Temperature at a max of 104F. This is typical for a fanless design. See these small HP office switches with similar power rating showing Fanless designation.


5

Since policy routes are evaluated top-down, you can work around this limit by placing a more specific entry matching traffic from internal subnet A to internal subnet B. However, this should be less than comfortable if you have many different networks attached to your internal interface. In this case, I would recommend you a trick I once used: since ...


5

This is a bit of an out of the box answer, but depending on your wireless vendor, several of them offer a "remote AP" configuration that allows an AP to create a VPN tunnel back to the controller when it boots. Your remote (and temporary) users would then connect to the AP and back to the controller over VPN. You would have to come up with other solutions ...


5

You can do this in theory, but you will need a good client machine to do that and by good, I mean a good Windows installation. This is because the operating system on the machine you want to use SSL VPN client will have to deal with all the traffic, and that machine will have to somehow prove router&firewall capabilities. Step 1: you connect that ...


5

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means that you are connecting to the SIP ALG on the Fortinet Firewall. And, since this is an application level gateway and not only some packet filter rules it will ...


4

Yes! you can make it possibly as per your requirement I understand that your want web -browsing traffic ie is tcp-80 & tcp-443 outbound traffic wants to flow from secondary internet link . And primary internet link will use remaining traffic other thàn web -traffic to configure this requirement . policy - routing will have priority then default route as ...


4

Yes, the Fortigate FG-60D and it's sibling FortiWifi FWF-60D are both fanless. I've seen and sold a lot of them.


4

Yes I understand your scenario and your requirement ..to access resources on remote firewall on port RDP ie 3389 from fortigate 200d connected switch lan users For your requirement no natting required. . Please configure static route in fortigate 200D as below Ip route 10.48.1.0 255.255.255.0 points towards gateway 10.189.254.17 And for reverse traffic ...


4

First off, this behavior is as expected. The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and whether forwarding is permitted or not. After these decisions, subsequent traffic belonging to the same session is forwarded without any further decisions to make. ...


4

The following should show you the snmp-index for each interface on the Fortigate. You can also modify this field if you so choose. # config system interface (interface) # show


4

You can check the MAC address table on the switch to see on what port you learned the MAC address of the Fortigate's management interface. It should be possible to enable LLDP on the Fortinet as of FortiOS 5.2 as well according to their documentation: config system interface edit <name> set lldp-transmission enable end end You can enable ...


4

Fortigate firewall can operate three type of ha , and can provide services in two mode Mode are active - passive mode 2)active - active mode Types of hight availability (ha) device failure link failure session failure Ha interface is connected between two active -passive firewall called as cluster firewall ha cable always send heart beat request to ...


4

Aggregate interfaces Link aggregation (IEEE 802.3ad) allows you to combine two or more connected physical interfaces together to form an aggregated link. This new link has the bandwidth of all the links combined for example if we aggregate 2 links of 100mb +100mb =200mb. If a link in the group fails, traffic is automatically transferred to the remaining ...


4

On most devices, that is possible. Check the manual for splitting a QSFP28 port into four SFP28 or SFP+ interfaces. The datasheet specifically shows 28 10GbT and 8 SFP+ for 10G and lists a 40GbE, 4x10GbE, QSFP+ to 4xSFP+, passive DAC. According to the user guide, using feature auto-breakout should automatically detect a breakout cable and use split ports: ...


3

Yes ! there is a feature name "traffic shapping" in fortigate firewall . Traffic utilisation can be restricted as per our requirements we can restrict bandwidth utilisation as per users basic, We can define bandwidth utilisation per user with help of traffic shapping We can even configuration traffic shapping on specific incoming and outgoing ...


3

I've used FortiGate in the past and you can do that with UTM like M4niac said. One thing to be careful with, maybe you've already experienced this, is Forti units are slow to process changes. In my experience, you do something in the configuration and it takes a couple of minutes before actually applying. Especially when speaking of UTM features. It looks ...


3

What version of fortios are you using? and what model de you have? FortiOs 5.0 and 5.2 (i think) have what are you looking for which includes an UTM options of client reputation (in other words, users rating) not just by traffic, by malware, network applications or IPS. Hope Helps!


3

After reading the HTTP host-based load balancing in the Fortigate Load Balancing doc, I can see how you can have an atypical load-balancing configuration that could result in what you describe. However, without part of your config, we cannot be certain if this is the case for you. Fortigate FortiOS allows a Virtual Server to be created that is tied to Real ...


3

The FortiGate doesn't care which protocol is running over the port 443, so you just need to create a policy and select the corresponding interfaces/addresses and as service you can select HTTPS. If it's a policy from internal network to WAN, be sure to select NAT also


3

I was never able to solve this issue. It seemed to be something within the FGT kernel and without an active Fortinet subscription, my working "solution" was to upgrade to an FGT-110C running 5.2.x.


3

Clustered Fortigate units become ONE unit in terms of L3 IP addresses, L2 MAC addresses, policies, objects etc. Only a few HA parameters along with the hostname are not mirrored from master to slave(s). The primary's IP addresses are used for the cluster; all slave addresses are overwritten. The real MAC addresses are hidden as well. Active management of a ...


3

Option 1 Configure webfilterring inbound and outbound deny policy in firewall . And bottom configure allow policy . And configure explicitly deny policy . Option 2 Configure object for webfilterring URL should configure in object and enable deny option and configure policy in fortigate firewalls Any traffic coming towards firewall hits this security ...


3

This message means that all high ports (>1023) are used up for outbound NATted connections. This is very rare and signifies that your FGT is processing way too many sessions. Check the number of open sessions in the GUI or CLI (get sys perf stat), "average sessions" and "average sessions setup rate". Two main reasons may apply: either you've hit a ...


Only top voted, non community-wiki answers of a minimum length are eligible