Skip to main content
Share Your Experience: Take the 2024 Developer Survey
5 votes
Accepted

TCP session established even if the server isn't listening on particular port

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
Steffen Ullrich's user avatar
5 votes
Accepted

What is a "remote gateway" in FortiClient?

The FQDN of where you want the client to connect to. Like if your company VPN is vpn.companydomain.com, you would put that in there. You could also just put the IP address behind the FQDN if you know ...
Jesse P.'s user avatar
  • 4,690
5 votes
Accepted

FortiGate 100E update through SquidProxy

The easiest solution is to download the current firmware from the support webpage (https://support.fortinet.com) and import it manually over the Admin Web GUI. That are possible over System->...
scherard's user avatar
  • 164
4 votes

How to flush route cache in fortigate

From the CLI you can issue the following command to restart the routing service. exec router restart To restart OSPF, you can use. exec router clear ospf process
A-A-Ron's user avatar
  • 636
4 votes
Accepted

How to check the ifIndex on a Fortigate 1500D?

The following should show you the snmp-index for each interface on the Fortigate. You can also modify this field if you so choose. # config system interface (interface) # show
A-A-Ron's user avatar
  • 636
4 votes
Accepted

How can i find which cisco switch port is connnected to specific port of Fortigate?

You can check the MAC address table on the switch to see on what port you learned the MAC address of the Fortigate's management interface. It should be possible to enable LLDP on the Fortinet as of ...
Teun Vink's user avatar
  • 17.4k
3 votes

How to flush route cache in fortigate

This might be a little late, but since the question still pops up on the Google search, I thought I answer it. The following command works in 6.2.7* and above, but does not show up as an argument when ...
Deltemir's user avatar
3 votes

Block youtube music videos from Fortinet

In a word: no. YouTube provides no mechanisms to allow a network device like a firewall to differentiate between content types. The only method I'm aware of that sort of works is to use a proxy to set ...
Jeremy Gibbons's user avatar
3 votes
Accepted

Can Fortinet firewall's administrator decode SSL traffic to get logging information (Gmail/Skype/RDP password)?

Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection. SSL deep inspection ...
Zac67's user avatar
  • 84.8k
3 votes

What is a "remote gateway" in FortiClient?

The remote gateway is your Fortigate unit - FortiClient is the client-side software for a VPN tunnel, the other side is a Fortigate router. You can't use FortiClient to tunnel across two PCs.
Zac67's user avatar
  • 84.8k
3 votes

Difference between Port (all VLANs allowed) and Trunk

Basically, a port with all VLANs allowed is a VLAN trunk. A trunk doesn't need to allow all VLANs, however. Trunk used to be the port mode for multiple (tagged) VLANs, Cisco jargon. Other vendors use ...
Zac67's user avatar
  • 84.8k
3 votes
Accepted

What's the difference between the Three Families of Fortinet SPUs?

You will find the relevant information on this page from Fortinet: https://www.fortinet.com/products/fortigate/fortiasic Each kind of processor optimizes different features, by handling them directly ...
JFL's user avatar
  • 19.7k
2 votes

Connecting to fortigate 5.4 with vpnc (ipsec)

There's 2 things I notice: 1- You assign IP addresses to the VPN clients in the same range as for internal (LAN) hosts. When a client dials in the FGT (90D) automatically creates a host route to ...
user1016274's user avatar
2 votes

Is there anyway to set Quota for users in Fortigate?

You can set a quota via the web filter profile. The quota can be configured per category, and the category action need to be set to either Monitor / Warning / Authenticate. The quota can be a traffic ...
mAvbig's user avatar
  • 76
2 votes
Accepted

Fortigate Firewall cli query || show and get

As far as I can remember show is used to check parameters and options as they are set in configuration, while get is used to check runtime values. Let say you have configured an interface for ...
Daniel Yuste Aroca's user avatar
2 votes

Fortigate VRRP or HA config

Additionally, FortiOS HA has several advantages over VRRP: 1- it is stateful, that is, the session, routing and NAT tables are kept synchronized on the slave unit. In case of HA failover, sessions ...
user1016274's user avatar
2 votes

Fortigate 90D, web console unavailable, SSH console hangs on certain commands

It sounds like the flash filesystem (or hardware) is corrupt and needs rebuilding. This Fortigate does not have an internal disk but a flash memory storage for holding the firmware, the configuration ...
user1016274's user avatar
2 votes

Fortigate 90D SD-WAN: VPN and VoIP

The public IP is nailed to your AT&T router which will be down when it's down. BGP would be required to tell the Internet that your public IP is now accessible via another link. I don't know of ...
Ronnie Royston's user avatar
2 votes
Accepted

How do you exclude an IP range on a Fortinet router?

There are 2 ways to do this: 1- create 2 policies, one where the destination is the exclusion range, and one following it with the whole destination range. Enable SNAT just in the second policy. Note ...
user1016274's user avatar
2 votes

Cisco SG300 and Fortigate 90D integration

Since you route your VLANs on the SG300, the Fortigate can't ever see the client's MAC address. All it can see is the SG300's MAC address on VLAN 1 (which you've probably permitted so everyone gets ...
Zac67's user avatar
  • 84.8k
2 votes
Accepted

Fortigate 200e as backbone switch

The cited switches do not only have a throughput of 88 Gbps (424D) and 176 Gbps (448D) but also feature 2/4 10GE ports for uplinks. In comparison, the maximum throughput of a FGT-200E is rated at 20 ...
user1016274's user avatar
2 votes
Accepted

Stopping logging info from interrupting CLI session?

No, this is not possible in FOS. Even with multiple (ssh) terminal windows, debug info will be printed on ALL windows. Multiple terminals will only faciliate command input.
user1016274's user avatar
2 votes
Accepted

MAC Address Filtering Fortinet v6.0

I assume that you are using Fortigate firewall. You can use below codes for your work config firewall ipmacbinding setting set bindthroughfw {enable | disable} - this is enabling IPMAC binding to ...
infra's user avatar
  • 3,128
2 votes

Can CLI commands be run of a FortiGate from crontab?

The 60D is a bit tricky since it doesn't log much locally. I never understood why it can't log to a local USB stick. I'd recommend setting up a syslog server. Can more than one CLI commands be ...
Zac67's user avatar
  • 84.8k
2 votes

Difference between Port (all VLANs allowed) and Trunk

A trunk (in common usage) carries frames with 802.1q tags to identify VLAN membership. In your example above, a given frame might have any of the allowed VLAN numbers as tags and the switch will ...
rnxrx's user avatar
  • 6,114
2 votes

The authentication page for Fortinet access is not secure

You need to install a signed certificate on the Fortigate from a trusted certificate authority (CA), either public, or private and with its root certificate installed in your trust store. A self-...
Zac67's user avatar
  • 84.8k
2 votes

The authentication page for Fortinet access is not secure

This article should cover the basics of how and why you would want to obtain and install an SSL certificate on your Fortinet Fortigate firewall: https://community.fortinet.com/t5/FortiGate/Technical-...
FrameHowitzer's user avatar
1 vote

Fortigate 60D - WAN Link Traffic Division

The easiest way is to split traffic by firewall policy - just the one WAN interface for one set of policies and the other interface for another set. If you want to split traffic to different external ...
Zac67's user avatar
  • 84.8k
1 vote

Fortinet configuration translation

Assuming the edit "Mycompany... is located under config system interface, this probably indicates a VPN tunnel. Without more context it isn't possible to say if it's actually functional. Check ...
Zac67's user avatar
  • 84.8k

Only top scored, non community-wiki answers of a minimum length are eligible