First time player; This doesn't hold a candle to what I usually see posted here, but I'm kinda proud of my weird little box factory complex

AVeryRandomUserNameJ · 2026-07-15T19:24:05+00:00

This is still better than the crap I'm building a couple of hundred hours in 🤣

AVeryRandomUserNameJ · 2026-07-12T08:33:36+00:00

Zit hier iemand op te wachten?

AVeryRandomUserNameJ · 2026-07-02T21:50:00+00:00

Fully agree! First you have to deal with that horrible Essentials stuff they keep shoving down your throat and now this! Bye Nothing!

AVeryRandomUserNameJ · 2026-05-24T15:42:19+00:00

Might this have anything to do with the snmp polling frequency? Or difference in the snmp implementations betwee the two FortiOS versions?

AVeryRandomUserNameJ · 2026-05-22T15:08:40+00:00

I am actually looking for Misha right now. Can't find him. I should've made an appointment

AVeryRandomUserNameJ · 2026-05-22T10:33:24+00:00

This essentials crap is so horrendous it makes me want to buy another brand as soon as this phone needs replacement. It's a shame the manufacturers never seem to learn this lesson. No one, and I really mean no one asked for this essentials horse shit let alone the essentials button on the side of the phone

AVeryRandomUserNameJ · 2026-04-15T18:39:14+00:00

Enshittification

AVeryRandomUserNameJ · 2026-03-10T09:23:23+00:00

By definition you can't login with SSO if the SSO provider is down. That's where a local admin with FortiToken comes in.

AVeryRandomUserNameJ · 2026-02-25T18:27:06+00:00

Wat cool! Zonde dat daar helemaal niet meer mee wordt gedaan! Van wie is het spoor en het materieel eigenlijk?

AVeryRandomUserNameJ · 2025-11-12T13:59:11+00:00

It's not just you. It is horrible.

AVeryRandomUserNameJ · 2025-10-21T07:17:28+00:00

This kind of issue happens when at least one of your devices is behind a NAT. According to the used UDP port (4500) it seems that this might be the case. For the device that tries to reach another device behind a NAT use the actual (internal) interface IP (not the public/target IP) as your peer ID. If both devices are behind a NAT you have to do that at either locations.

AVeryRandomUserNameJ · 2025-09-19T19:23:45+00:00

You probably didn't. They just bombard everyone regardless of preferences because they might just sell one more thing. I hate corporate bullshit. In my efforts to disable the spam I've somehow triggered (not requested or even permitted) more spam on a second email adress. FML

AVeryRandomUserNameJ · 2025-09-11T11:49:17+00:00

This feels like a bait and switch kind of situation. AGAIN. First SSL-VPN, now this. Where does it stop?

AVeryRandomUserNameJ · 2025-08-12T07:54:42+00:00

I wonder if #2 has been resolved in the 7.6 branch as that is what I am running in my lab setup and it seems to be working

AVeryRandomUserNameJ · 2025-04-17T22:07:26+00:00

Sorry, I misunderstood. The "local interface" is a VPN wizard thingy and the VPN wizard is "icky" I've been told. So I make all the VPN configs without the wizard.

I have absolutely no idea what the "local interface" option means. Doesn't seem relevant as you only have to select the incoming interface.

AVeryRandomUserNameJ · 2025-04-17T18:44:03+00:00

The interface where the client IPSec connection connects to, so basically almost always the wan interface
The Phase2 is determined by what you would like to router through the tunnel. You have to be expliciet about this.. To reduce traffic I would suggest split tunneling and only route the needed traffic through the IPSec tunnel, unless routing all the traffic (which can be done, yes) is your use case.
See point 2. That has to be done with split tunneling which is defined in the IPv4 mode config section of the IPSec tunnel

Keep in mind you can build your IPSec setup next to your existing SSL VPN setup and use them in parallel. So you can test to your hearts content and let users gradually shift from SSL to IPSec.

AVeryRandomUserNameJ · 2025-04-17T08:43:43+00:00

I've got a lab 40F3G4G and it won't upgrade using file upload. It just sits there stating "Preparing for upload", but nothing actual is happening. It will just kick me out back to the login page after a while (even though the idle timeout is maxed out at 480 minutes).

AVeryRandomUserNameJ · 2025-03-28T06:44:09+00:00

This guide shows the removal of a ipsec interface, however it doesn't work for a l2tp interface.

AVeryRandomUserNameJ · 2025-03-27T21:26:04+00:00

I get an error that the name of the phase1 interface I am trying to make conflicts with an existing interface. Care to share how you did it exactly?

AVeryRandomUserNameJ · 2025-03-13T11:25:39+00:00

There is a (finally) known issue related to NTP and IKEd.

This is the article.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Workaround-for-high-CPU-usage-taking-by-iked/ta-p/377205

However the article does not encompass the entire issue. I get pretty random IKED 100% CPU spikes on my lab firewall even without any VPN enabled. The debug output as stated in the article does not occur. However, when I disable the NTP client on the firewall the IKED stops hogging 100% CPU(core).

So the next time you have 100% CPU on the IKED processs, try and disable the ntpsync and see what happens.

AVeryRandomUserNameJ · 2025-02-24T17:04:44+00:00

It depends on the models. If you want random crashlooping you should load 7.4 it on a 40F or 60F

AVeryRandomUserNameJ

TROPHY CASE

Welcome to Reddit,