Solved

Hi,I am looking for a firewall  for 1500users, and 500  VDI access,500 camera recording  at 7 mbps , expecting approximately 1 gb  internet traffic Mostly collaboration application like teams  Please help to size,Ho much throughput I should I look for Thanks

I've been scratching my head on this for a few hours.  I've been playing with my ForitAP 223E and changed some settings to allow split tunneling.  After enabling the split tunneling on the AP my SSID's stopped broadcasting all together.  So, I disabled and tried restoring to the basic settings and the AP will no longer broadcast anything, at all.  I even tried, deleting the profile and creating a new one.  I've double checked and triple checked to ensure the SSID's broadcast button is enabled, the region is correct, the AP is authorized, and even shows connected in the dashboard... but no SSID's will broadcast and the AP shows offline.  I've even rebooted the Fortigate and did a factory reset on the FortiAP.  Am I missing something?  Do you think the antennas are defective?

Hi,Simply this is I need to do: I like to filter and decide about connections to a destination based on the port, protocol and the application if possible. Two things in my wish list which I elaborate by an example: 1- I need to disable RDP on any port not just 3389 which is the default.2- I wish to limit SSH connections to a server just to those who are established via Putty.exe file Any help would be appreciated. Regards,

Trying to find the CLI command to list the User Groups and their contents so my FIM can alert on changes. 'Show full-configuration', show running-config', and 'show firewall policy' do not include the user groups in their output.

Hi,I have configured the captive portal on two different wired interfaces and everything works fine.INT1 - 192.168.1.1 - LAN 192.168.1.0/24INT2 - 192.168.2.1 - LAN 192.168.2.0/24To eliminate the invalid certificate warning on the login page I uploaded the certificate and specified the portal-addr fqdn which is resolved with the firewal ip on INT1.auth.domain.local -> 192.168.1.1Being able to specify only one portal-addr, how can I reach it from clients that were on the other network 192.168.2.0/24?I tried to create a policy but I can't reach the local IP 192.168.1.1 from the 192.168.2.0/24 network.Can you give me a suggestion or analternative? Thank you.

Hi all I am somewhat stumped about this issue and I am not sure where to start looking. Problem:There is an app with automatic checks to the internet which also automatically repeats dns queries to our internal dns servers. Those queries come from five or six source ports from each of the two IP addresses (the app runs on two servers) and there are quite a lot of those requests.This app runs on a virtual machine which is connected to a fortigate 60F with 6.2.9.The query goes to that firewall and then trough a VPN to another fortigate and from there to the DNS. If the internet goes offline for MORE than about five minutes and then comes back again, the automatic queries don't get an answer anymore (as if the DNS server never gets the requests).If the internet goes offline for LESS than five minutes, then there is no issue.(I am not 100% sure about the exact amount of time). Some more info:Unfortunately I have no firewall logs from that time it happensThe customer is

Dear All,  Is there any way to create a script which run when there is a change in the routing table? I would like to make a mechanism that triggered by a bgp routing update. Shortly: when my fortigate get a /32 prefix via bgp (from a certain subnet), then I have to add manually a proxy-arp for that /32.Any advices or key-words are appreciated!Thank you very much

Hi! I've 2 Fortigate 40 with a IPSEC tunnel, working great.Then in each one, I've a SSL vpn for client pc's, they can access local lan in both sites.Problem is I need to allow access to Site 1 using SSL vpn on Site2.Tried to adapt this https://docs.fortinet.com/document/fortigate/6.2.0/cookbook/45836/ssl-vpn-to-ipsec-vpn but cant get it to work.On Site2 I created a policy to allow SSLVPN traffic to access the VPN tunnel:Income - SSLVPNOutgoing - IPSEC TunnelSource - IP range for SSL and the ssl user groupDestination - The remote subnet on Site1Tried with and without NAT, but doesnt work. Don´t I need a policy to allow in Site1 also? Tried that also, but doesnt work. Can anyone help or point another example? Thansk in advanced

Hi everyone, I'm kind of very new to FortiAuthenticator. I am working on setting up one at a customer. I am having issues with the self serve portal (not the legacy one) for the password change. I have setup both LDAPS and the FortiAuthenticator is joined to the domain (although documentation said I need only one of these, issue below was not working with only LDAPS). When trying to change the password for my test user, whatever I put as new password, it doesn't want to take it. I have tried complex, short or long password or even simple ones, I always get the error message below. If anyone have any hint, that would be greatly appreciated.

Every time I try and create a cert using the Let's Encrypt service in the Fortigate it fails. I have followed the KB's I have found and also tried through the CLI. I enabled DDNS, but no matter what I do, it just fails. The Fortigate is a 300E running 7.0.5. Is there anything special that has to done. Here is what I using and doing. I have called Fortinet support, but the person I spoke to ran into the same situation. (Yellow Highlighted area: Yeah, not so much) It used to generate logs, not sure why its not now.   

Dears ,we have two ISP connections wan1 and wan2 which are configured to use SD-WAN on fortigate 100E , we have noticed that there is internet issues over some applications like anydesk connection timeout and slowness once the SD-WAN is on , how can we troubleshoot this further? everything becomes normal again once we turn off the SD-WAN . Regards , 

I am not sure if the SFP ports of the Fortiswitch fs-148e-poe work at 1000 or support 10Gb. The datasheet indicates that the ports are GE but this other document indicates that they support SFP+ FG-TRAN-SFP+SR transceivers, which are 10GB transceivers. Can someone confirm the maximum SFP port speed of the fs-148e-poe please? Thanks a lot!   

Hey there,For those who are running and managing FortiDDoS in your corporate network, what do you think about it? I don't really care if you're running SoHo, DC or carrier-class devices, just looking for feedback about the full product.I have several questions about stability and effectiveness of it, posting it just in case someone can reply his personal experience.How stable is it as a hardware appliance ?How effective is it stopping DDoS attacks ? When successful, what was the vector attack?How often does it trigger false positives ?Cheers!

Hi, guys, Another "session clashed" found in Fortigate 400E with FortiOS v6.4.2 My NAT configuration is VIP + NAT enabled: ( 111.111.11.5 :18889 --> 10.16.6.35:18889), 100.100.11.54 is the internet user: The Fortigate eventlog is below:1: date=2022-06-12 time=22:01:54 logid="0100020085" type="event" subtype="system" level="information" vd="root" eventtime=1655085714423584374 tz="-0400" logdesc="session clash" status="clash" proto=6 msg="session clash" new_status="state=00010200 tuple-num=4 policyid=69 dir=0 act=2 hook=0 100.100.11.54:58902->111.111.11.5:18889(10.16.6.35:18889) dir=0 act=1 hook=4 100.100.11.54:58902->10.16.6.35:18889(10.16.6.254:31307) dir=1 act=2 hook=0 10.16.6.35:18889->10.16.6.254:31307(100.100.11.54:58902) dir=1 act=1 hook=4 10.16.6.35:18889->100.100.11.54:58902(111.111.11.5:18889)" old_status="state=00010200 tuple-num=4 policyid=69 dir=0 act=2 hook=0 100.100.11.54:58902->210.57.60.2:18889(10.16.6.35:18889) dir=0 act=1 hook=4 100.100

Hi,is there any one who can give me some information about /bin/foritviewd process on fortiweb devices?when I run get sys top command i see /bin/fortiviewd process consuming about 30 percent cpu.is there any risk if i kill this process?Regards.

We found "session clash" in the Fortigate model 600E with FortiOS v7.0.3, the eventlog as below: 1. Fortigate eventlog (internet IP: 100.19.44.39;  Fortigate VIP (46.96.186.1 ->10.113.1.115, currently is VIP static NAT :( 1: date=2022-06-10 time=09:48:54 eventtime=1654825734757941183 tz="+0800" logid="0100020085" type="event" subtype="system" level="information" vd="root" logdesc="Session clashed" status="clash" proto=1 msg="session clash" new_status="state=00010200 tuple-num=2 policyid=258 dir=0 act=2 hook=0 100.19.44.39:28674->46.96.186.1:8(10.113.1.115:8) dir=1 act=1 hook=4 10.113.1.115:8->100.19.44.39:0(46.96.186.1:28674)" old_status="state=00010200 tuple-num=2 policyid=258 dir=0 act=2 hook=0 100.19.44.39:28618->46.96.186.1:8(10.113.1.115:8) dir=1 act=1 hook=4 10.113.1.115:8->100.19.44.39:0(46.96.186.1:28618)"2: date=2022-06-10 time=09:47:51 eventtime=1654825671783553340 tz="+0800" logid="0100020085" type="event" subtype="system" level="information" vd

Hi team, I'm trying to connect to My ssl vpn configured in FGT from external NW but I'm facing issue while connectingIt is getting stuck in 10%Please suggest

Hi everyone, I would like to remove root vdom and remain another created vdom. I did remove all the reference on root vdom but it still unable to be removed. Is it possible to remove root vdom? Thank you.

HI all,as per diagram,the three sites are configured with BGP and all is working properly.All the networks are received trough BGP from both FGTs and from Cisco R1.Now the problem is when i configure Vlan in FGT.As per diagram,vlans configured trough cisco router as L3 device are working properly,buuut the Vlan I configured on SITE-C FGT (Vlan 50)the network is published trough BGP to all the sites,but the PC4 is only able to ping his GW but any site.I don't understand if is a bug or something not configured properly.Wireshark only give "no response found" for ping request.Either PC4 can't be pinged from any other site.Basically,all network is working proiperly,only vlans configured in FGT are not working.Thanks in advance!

Keeping Split Tunneling routing address blank in SSL-VPN portal. be able to use FQDN addressesso my collaborator's internet goes out through fortigate, or through the internet from his own home? Leaving Split Tunning blank, when checking the IP that the Client is going out to the internet, it is the Company's IP. Is internet traffic going all the way through Fortigate? https://community.fortinet.com/t5/FortiGate/Technical-Tip-Access-to-Specific-FQDN-using-Split-Tunnel-SSL-VPN/ta-p/190062?externalID=FD46248

EnvironmentFortiGate 6.4.4FortiClient EMS 7.0.4 (Cloud)FortiClient 7.0.5 So I am just starting to look at the Web Filtering module and have some questions: Q.Is there any dependency on FortiGate Firewall or can this be ran independently given a lot of my users are WFH? Q.Once configured, I see there were prompts to install the Web Filter extension for Chrome and Edge on the detected browsers.The Chrome extension was found and installed OK but when I tried the one for Edge (Chromium version) it took me to a blank Add-ons page which displayed nothing.Is this a known bug?Tried installed the native Chrome extension for Edge but I was still getting prompts. Q.Is there any work required on the ForitiGuard setup? I presume that this is part of the licence set you get with Cloud EMS. 

Hi, I have a question about FAC as below.1. I want to set Captive Portal on FAC as HTTP. but I found only HTTPS service on network setting. Can I set Captive Portal as HTTP?2. Can FAC Provide a logout page after done login page? My Network DiagramComputer (wired) > Fortigate(Point External Portal to FAC)> FAC that provide Captive Portal. Thank you.

How do i find out what is inside the custom1 list under Local Categories in Web Filter ?What URL are inside this custom1  

Hello, forum. I need help ASAP. So I decided I wanted two-factor authentication on my Fortigate-30E. I was supposed to receive an authentication code or something like that to my email but I never received it. I'm now unable to get into my fortigate (GUI and CLI) because it is requesting a Fortitoken. I went to the Fortitoken page and now have a free license but I would think the previously stated activation comes first. I don't have a license for Support and I'm not apart of any organization. I'm just a aspiring network engineer that wanted something to practice on at home. Can someone help? 

Hello,Do you have information about release date FortiOS 7.0.6? Our security team requests a fix for CVE-2022-0778. The solution is to upgrade to 7.2 or 7.0.6 https://www.fortiguard.com/psirt/FG-IR-22-059I don't want to install 7.2 in a production environment.Thank you