5
votes
Accepted
TCP session established even if the server isn't listening on particular port
Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means ...
- 2,408
5
votes
Accepted
What is a "remote gateway" in FortiClient?
The FQDN of where you want the client to connect to. Like if your company VPN is vpn.companydomain.com, you would put that in there. You could also just put the IP address behind the FQDN if you know ...
- 4,690
5
votes
Accepted
FortiGate 100E update through SquidProxy
The easiest solution is to download the current firmware from the support webpage (https://support.fortinet.com) and import it manually over the Admin Web GUI.
That are possible over System->...
- 164
4
votes
How to flush route cache in fortigate
From the CLI you can issue the following command to restart the routing service.
exec router restart
To restart OSPF, you can use.
exec router clear ospf process
- 636
4
votes
Accepted
How to check the ifIndex on a Fortigate 1500D?
The following should show you the snmp-index for each interface on the Fortigate. You can also modify this field if you so choose.
# config system interface
(interface) # show
- 636
4
votes
Accepted
How can i find which cisco switch port is connnected to specific port of Fortigate?
You can check the MAC address table on the switch to see on what port you learned the MAC address of the Fortigate's management interface.
It should be possible to enable LLDP on the Fortinet as of ...
- 17.4k
3
votes
How to flush route cache in fortigate
This might be a little late, but since the question still pops up on the Google search, I thought I answer it.
The following command works in 6.2.7* and above, but does not show up as an argument when ...
- 31
3
votes
Block youtube music videos from Fortinet
In a word: no. YouTube provides no mechanisms to allow a network device like a firewall to differentiate between content types.
The only method I'm aware of that sort of works is to use a proxy to set ...
- 2,449
3
votes
Accepted
Can Fortinet firewall's administrator decode SSL traffic to get logging information (Gmail/Skype/RDP password)?
Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection.
SSL deep inspection ...
- 88.1k
3
votes
What is a "remote gateway" in FortiClient?
The remote gateway is your Fortigate unit - FortiClient is the client-side software for a VPN tunnel, the other side is a Fortigate router. You can't use FortiClient to tunnel across two PCs.
- 88.1k
3
votes
Difference between Port (all VLANs allowed) and Trunk
Basically, a port with all VLANs allowed is a VLAN trunk. A trunk doesn't need to allow all VLANs, however.
Trunk used to be the port mode for multiple (tagged) VLANs, Cisco jargon. Other vendors use ...
- 88.1k
3
votes
Accepted
What's the difference between the Three Families of Fortinet SPUs?
You will find the relevant information on this page from Fortinet:
https://www.fortinet.com/products/fortigate/fortiasic
Each kind of processor optimizes different features, by handling them directly ...
- 19.8k
2
votes
Connecting to fortigate 5.4 with vpnc (ipsec)
There's 2 things I notice:
1- You assign IP addresses to the VPN clients in the same range as for internal (LAN) hosts. When a client dials in the FGT (90D) automatically creates a host route to ...
- 880
2
votes
Accepted
Fortigate Firewall cli query || show and get
As far as I can remember show is used to check parameters and options as they are set in configuration, while get is used to check runtime values. Let say you have configured an interface for ...
- 2,904
2
votes
Fortigate 90D, web console unavailable, SSH console hangs on certain commands
It sounds like the flash filesystem (or hardware) is corrupt and needs rebuilding.
This Fortigate does not have an internal disk but a flash memory storage for holding the firmware, the configuration ...
- 880
2
votes
Fortigate 90D SD-WAN: VPN and VoIP
The public IP is nailed to your AT&T router which will be down when it's down. BGP would be required to tell the Internet that your public IP is now accessible via another link.
I don't know of ...
- 4,409
2
votes
Accepted
How do you exclude an IP range on a Fortinet router?
There are 2 ways to do this:
1- create 2 policies, one where the destination is the exclusion range, and one following it with the whole destination range. Enable SNAT just in the second policy. Note ...
- 880
2
votes
Cisco SG300 and Fortigate 90D integration
Since you route your VLANs on the SG300, the Fortigate can't ever see the client's MAC address. All it can see is the SG300's MAC address on VLAN 1 (which you've probably permitted so everyone gets ...
- 88.1k
2
votes
Accepted
Fortigate 200e as backbone switch
The cited switches do not only have a throughput of 88 Gbps (424D) and 176 Gbps (448D) but also feature 2/4 10GE ports for uplinks.
In comparison, the maximum throughput of a FGT-200E is rated at 20 ...
- 880
2
votes
Fortigate VRRP or HA config
Additionally, FortiOS HA has several advantages over VRRP:
1- it is stateful, that is, the session, routing and NAT tables are kept synchronized on the slave unit. In case of HA failover, sessions ...
- 880
2
votes
Accepted
Stopping logging info from interrupting CLI session?
No, this is not possible in FOS. Even with multiple (ssh) terminal windows, debug info will be printed on ALL windows. Multiple terminals will only faciliate command input.
- 880
2
votes
Accepted
MAC Address Filtering Fortinet v6.0
I assume that you are using Fortigate firewall. You can use below codes for your work
config firewall ipmacbinding setting
set bindthroughfw {enable | disable} - this is enabling IPMAC binding to ...
- 3,138
2
votes
Can CLI commands be run of a FortiGate from crontab?
The 60D is a bit tricky since it doesn't log much locally. I never understood why it can't log to a local USB stick. I'd recommend setting up a syslog server.
Can more than one CLI commands be ...
- 88.1k
2
votes
Difference between Port (all VLANs allowed) and Trunk
A trunk (in common usage) carries frames with 802.1q tags to identify VLAN membership. In your example above, a given frame might have any of the allowed VLAN numbers as tags and the switch will ...
- 6,152
2
votes
The authentication page for Fortinet access is not secure
You need to install a signed certificate on the Fortigate from a trusted certificate authority (CA), either public, or private and with its root certificate installed in your trust store.
A self-...
- 88.1k
2
votes
The authentication page for Fortinet access is not secure
This article should cover the basics of how and why you would want to obtain and install an SSL certificate on your Fortinet Fortigate firewall:
https://community.fortinet.com/t5/FortiGate/Technical-...
- 2,594
1
vote
Accepted
Do i have to configure the VLAN on my switch if its already configured in the firewall
VLAN tagging is used to pass multiple, distinct segments on a single, physical link (a VLAN trunk).
If your network is using multiple segments and you want them to connect to the firewall directly, ...
- 88.1k
1
vote
Multiple url filter list in fortigate
You can use one web filter list per policy. The policy conditions are checked for each packet and if they are all true the policy action is carried out. There's no further if this than that inside a ...
- 88.1k
Only top scored, non community-wiki answers of a minimum length are eligible