user1016274
  • Member for 6 years, 6 months
  • Last seen more than a week ago
2 answers
4 votes
830 views
Is Fortigate-60D a fanless model?
5 votes

Yes, the Fortigate FG-60D and it's sibling FortiWifi FWF-60D are both fanless. I've seen and sold a lot of them.

View answer
1 answers
2 votes
5k views
Fortigate "remembers" bad routes
4 votes

First off, this behavior is as expected. The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and ...

View answer
2 answers
0 votes
602 views
In one organization having two ISP which configured on fortigate firewall ? How can we do the failover for internet?
3 votes

Create 2 default routes (0.0.0.0/0) to the 2 gateway addresses of your ISPs. The secondary one should have a higher distance like 20 as the default distance in FortiOS is 10. This will guard you from ...

View answer
1 answers
1 votes
6k views
NAT port is exhausted
Accepted answer
3 votes

This message means that all high ports (>1023) are used up for outbound NATted connections. This is very rare and signifies that your FGT is processing way too many sessions. Check the number of open ...

View answer
3 answers
1 votes
29k views
FortiGate HA (A/A) Cluster: How can I manage the slave unit from the web GUI?
Accepted answer
3 votes

Clustered Fortigate units become ONE unit in terms of L3 IP addresses, L2 MAC addresses, policies, objects etc. Only a few HA parameters along with the hostname are not mirrored from master to slave(s)...

View answer
4 answers
6 votes
18k views
How do I pinpoint bandwidth consumers on my Fortigate?
3 votes

Some advice that comes to my mind: 1. The FG-60 is quite old, right, but it's nowhere from being overloaded. Watch the memory consumption (preferably in the CLI, get sys perf stat) - if it crosses the ...

View answer
3 answers
3 votes
5k views
Fortigate: enabling directed broadcast to broadcast conversion on last hop?
2 votes

In a way, you have given all the correct answers to your questions. Just to confirm: 1- The option set broadcast-forward enable is only effective for FGTs in Transparent Mode, not Routing/NAT mode. ...

View answer
1 answers
2 votes
60 views
Stopping logging info from interrupting CLI session?
Accepted answer
2 votes

No, this is not possible in FOS. Even with multiple (ssh) terminal windows, debug info will be printed on ALL windows. Multiple terminals will only faciliate command input.

View answer
1 answers
2 votes
470 views
HPE IRF Stack why do I need two physical ports?
2 votes

The main point of redundancy concepts such as IRF is to avoid a single-point-of-failure. For example, if the switch (2 switches in an IRF behave as if they were one switch) on the left broke down, ...

View answer
1 answers
0 votes
109 views
Setting up Hardware for HA
2 votes

Q. 1: no, the switches (A) do not need to route at all, that's what the firewalls are for. The only exception would be if the modems are located in a different subnet (but that is improbable). Q. 2:...

View answer
2 answers
2 votes
1k views
Fortigate 200e as backbone switch
Accepted answer
2 votes

The cited switches do not only have a throughput of 88 Gbps (424D) and 176 Gbps (448D) but also feature 2/4 10GE ports for uplinks. In comparison, the maximum throughput of a FGT-200E is rated at 20 ...

View answer
1 answers
2 votes
2k views
Fortigate 90D, web console unavailable, SSH console hangs on certain commands
2 votes

It sounds like the flash filesystem (or hardware) is corrupt and needs rebuilding. This Fortigate does not have an internal disk but a flash memory storage for holding the firmware, the configuration ...

View answer
2 answers
1 votes
7k views
fortigate 50e conditional forwarding
Accepted answer
2 votes

For local name resolution you need to set up 3 things: 1- a DNS zone 2- at least one A record in that zone 3- a DNS on the interface where your internal hosts are A zone in a nameserver is a ...

View answer
2 answers
1 votes
2k views
How do you exclude an IP range on a Fortinet router?
Accepted answer
2 votes

There are 2 ways to do this: 1- create 2 policies, one where the destination is the exclusion range, and one following it with the whole destination range. Enable SNAT just in the second policy. Note ...

View answer
2 answers
1 votes
2k views
Fortigate VRRP or HA config
2 votes

Additionally, FortiOS HA has several advantages over VRRP: 1- it is stateful, that is, the session, routing and NAT tables are kept synchronized on the slave unit. In case of HA failover, sessions ...

View answer
1 answers
1 votes
78 views
Firewall Details Explanation
2 votes

A stateful firewall has to keep some metadata about a connection (more cortectly: a session) like source and destination address, state, NAT port etc. In a table in RAM. This always is limited by ...

View answer
2 answers
1 votes
660 views
tidy up the IP addresses on fortigate 90d
Accepted answer
2 votes

@Nroot: your explanation is not quite right. The FGT doesn't reserve an address for a specific MAC address unless manually configured to do so. Rather, the client requests the same address as ...

View answer
1 answers
2 votes
2k views
Connecting to fortigate 5.4 with vpnc (ipsec)
2 votes

There's 2 things I notice: 1- You assign IP addresses to the VPN clients in the same range as for internal (LAN) hosts. When a client dials in the FGT (90D) automatically creates a host route to ...

View answer
1 answers
1 votes
2k views
Fortinet 60D acting as IPSec VPN Client?
2 votes

Yes, one of the ways to set up an IPsec VPN is to create a "dial-up VPN". This is exactly the same as what a (software) VPN client does. The exact configuration steps depend on the version of FortiOS ...

View answer
1 answers
5 votes
14k views
Fortigate reverse path check fail
2 votes

(This question seems to be stale but might be found while searching anyway.) The debug message indicates that the Fortigate drops this traffic as being from an unknown source net. This is called the ...

View answer
2 answers
1 votes
778 views
Fortigate 60D - WAN Link Traffic Division
Accepted answer
1 votes

Just providing 2 egress policies won't suffice. Traffic to unknown target networks has to follow the default route. But, there is only 1 default route per system/FGT (for obvious reasons). To match a ...

View answer
2 answers
2 votes
1k views
Fortigate interfaces in policies
1 votes

There is hardly ever a good or mandatory reason not to specify the interfaces in a policy. There is always a price you pay for convenience: loss of control and time while maintaining and debugging. ...

View answer
3 answers
1 votes
3k views
How to create separate network on different interfaces on Fortinet 200d and route bettwen them?
1 votes

You can split the internal switch into individual ports. The way depends on your version of FortiOS. In v5.4 you can for instance pull a single port from the switch via the GUI (network 》interfaces 》...

View answer
1 answers
0 votes
3k views
FortiGate 100A with VLAN on WAN port
Accepted answer
1 votes

For traffic to pass from the internet to the LAN you need a couple of preliminaries to allow this: 1- create an address object "myLAN" for the addresses used for your LAN hosts, like e.g. "192.168....

View answer
2 answers
1 votes
593 views
What criteria do routers use to sense a WAN outage when using VRRP?
1 votes

You're right in stating that in FortiOS the vrdst option does not actively ping the target address but decides whether an active route to this destination exists or not. In a second stage, you ...

View answer
1 answers
1 votes
3k views
Internal mapped IP of other LAN segment (fortigate)
Accepted answer
1 votes

What you are planning to do is called "Destination NAT", and in FortiOS this is done with 'Virtual IPs' (VIPs). 1- create a VIP like this name: dnat_LAN2_to_LAN1 external interface: LAN2 external ...

View answer
1 answers
1 votes
4k views
SSL VPN vs IPSec, pros and cons
1 votes

Pro IPsec VPN: you can create site-to-site VPNs, allowing multiple hosts to access a remote network at the same time in this scenario, hosts don't need any additional software to participate in the ...

View answer
4 answers
0 votes
21k views
Unblocking of skype in Fortigate
1 votes

It might well be that it's not the AC blocking Skype but the WF. 1- Do you have a valid UTM licence? If not, WF will block. 2- Enable logging on that policy. 3- Make sure it's the first policy from ...

View answer
3 answers
2 votes
111 views
Can I run an application on a managed switch?
1 votes

As a philosophy ARISTA encourages customers and partners to run standard Linux applications on their switches, publishing all necessary APIs etc. As for resources, ARISTA is making very low latency-...

View answer
2 answers
0 votes
679 views
Routing Branch Site Internet Traffic Through Headquarters
1 votes

HQ firewall: Independent of the firewall vendor, you will need an additional policy to allow traffic from the tunnel end to your WAN port (destination address 'all'). Here, you have to apply source ...

View answer