Solved

Fortigate_80F, v6.4.9 build1966(GA)Since this is the first time setting up a Fortigate, I'm still learning unique terminology and how things work.My objective with this new machine is to have access to AD Users and AD Security Groups at least.That would lead to setting up web filters (for example) using AD Security Groups that are set up for that purpose.  With this, we could add new Users in AD and in AD Security Groups and the information would flow to the Fortigate_80F without touching it.  Does that sound reasonable?I'm afraid I may have put the cart before the horse.  "FSSO" didn't mean anything to me at first attempt.I set up LDAPS first and that seems to be working.  But, I now realize more fully that there's this thing "FSSO".....My understanding of *that* is that Users log into the domain as usual via the DCs and are automatically recognized on the Fortigate. I can read the documentation OK but knowing just *what* to read is like not seeing the fo

Dear community, I'm woking in a company where20 users use a same windows account named : "call" Is there a way to restrict internet access to this user only with fortigate?  https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/13383/creating-a-web-filter-profile I have found that but it filter for each users and I need to restrict only this Windows user named "call" KR

Hi there, we want to establish Microsoft approach of a "mikro vm" with "application guard" and edge (+chrome+firefox). So in best case we can use one proxy for all use cases, free internet through application guard and restricted internet through default browsing.Microsoft Edge and Microsoft Defender Application Guard | Microsoft Docs When we enable ApplicationGuardTrafficIdentificationEnabled ( Microsoft Edge Browser Policy Documentation | Microsoft Docs ) the browser in the sandbox sends for his requests an additional http header "X-MS-ApplicationGuard-Initiated". So if i can believe in wireshark, yes this header is send but...it seems not to have any effect on the fortigate We tried the following rule and used as "source"a proxy address (to be honest, we tried several other things but this seems to be the right way...from my understanding)Just to mention, when we set the host in gui, after we apply, and reopen it, this field is empty again...but when we

Forget password seem like no work?

Greetings,I have a fortigate 200F, in Application Control I have blocked file transfer in Whatsapp, but it doesn't work, users can download files without problem, I even have Deep inspection enabled.If by webfilter I block whatsapp.net, the block to file transfer works, but does not allow a new synchronization of whatsapp web.Fortigate Version 7.0.5Any solution?

Hi all, On a vessel I'm working on, I've got two internet connections connected to WAN1 and WAN2. I'd like to have two VPN connections, using one of the WAN connetions each. WAN1 (Production VPN, Internet access)Fixed IP: 10.241.105.192 / 255.255.255.240Gateway: 10.241.105.193 WAN2 (Development VPN)DHCP: 94.234.190.55 / 255.255.255.240Gateway: 94.234.190.49 Production VPN: Site-to-Site VPN with vessel behind NATDevelopment VPN: Remote Access using FortiClient I have configured Static Route as this:Production VPN and general internet access for from WAN1 works as expected - But how should I get the Development VPN working on WAN2? The Incoming Interface for the Development VPN is set to WAN2. I understand I need a Gateway assiociated with WAN2, so I tried to add this as a Policy Route as below, but without success.I'm not sure if I'm doing the above correct?Is there anything else I need to configure to achive functionality of Development VPN over WAN2?&nbsp

Hi - hoping someone can help me with this seemingly simple problem. Coming from the Cisco world we are replacing two of our routers with two FortiGate firewalls in HA active-passive mode.  My knowledge of the FortiGate configuration is limited (but growing). I'm currently trying a basic configuration with 1 PC connected to 1 switch which is connected to one FortiGate with two connections. Currently only one of the two networks on the Fortigate is reachable (192.168.10.1).I've setup an identical configuration but instead using our cisco router and as you can see in the routing table it is logging the 192.168.116.0 route reachable via the two routes. The Fortigate is only showing this route via port2 even though it is also technically reach able via port1. I'm assuming this is the reason I can only reach the network from the port2 link and not the port1 ip of 192.168.20.1.  If this is the reason how can I populate the route to 192.168.116.0 via either port1 or port 2

Hi all, I've followed a guideline of Sophos to configure IPSec between Fortigate and Sophos, everything working well: the VPN is up, the user from Sophos site can ping the IP of Fortigate site, but the user of Fortigate site can not ping IP of Sophos site. the longest way I can do is to tracert to the local IP of Sophos site and reached the default gateway and done, nothing else. I've tried many ways: disable Windows firewall, checking the Sophos policies...and deep dive into google and I recognize there are some people who got the same problem with me and they can fix it in some way but no one posted the solution => I have no clue. can please help me where I was wrong? Thanks a lot.    

Hi all,I have searched for this in the forum and internet without much success so just wanted to clarify that i AM doing this the right way.I've got a WAN connection (say 1.1.1.1) and i've got an internal IP of a device on 192.168.70.50. I have added a secondary IP to that WAN interface of 1.1.1.2 and i want to route the 192.168.70.50 out of that ip (1.1.1.2) so i've added a policy route with the incoming interface as the Data Internal interface (which is what the 192.168.70.50 is connected to) and a source address of 192.168.70.50/255.255.255.255, then a destination address of 0.0.0.0/0.0.0.0 and in the outgoing interface i've selected the WAN interface and then set the gateway address as 1.1.1.2 ?I've ran packet trace and i can see packets coming INTO 1.1.1.2 to 192.168.70.50 but nothing going out.Have i configured this correctly or am i missing anything ?I'm not that familiar with Fortigate products (model is a 60E on V7 software by the way)Thanks all

Hello guys,I have very strong problem with this permormance AP .In several release i have the same issue; they reload every 2 or 3 days, in particular the AP with most connection. We have in my office 23 431F and 3 223E. The second no problem..the version is : FortiAP-431F v6.4,build0185,210903 (GA)I have the KERNEL LOG HELP ME PLEASE

   Hi, there are user's unused active connection in the SSL VPN service. (Please see image atteched) We have active the option : "Limit Users to One SSL-VPN Connection at a Time" but still unsed active connection. We have 3er party and official forticlients. Any ideas where is the problem? Thanks

Hi all, Will wild card certificate works for admin login GUI ?. Please note here im not generating any CSR and will import a wildcard cert provided by customer into fortigate local certificate and then in Settings>> Administrator settings. PFA image Pls advise

Hi all,I have a number of overly permissive rules using any services. What would be the most effecient way of extracting a report in FAZ, so I can see what services are actually hitting the rule, and design a policy around that?Thanks.  

I realized that there is a custom 1 and custom 2 setting inside my DNS and Antivrus web filter.Where can I find more info about this and can I edit the settings?  

Hello Will shutting down of the Primary-FG via GUI be a graceful shutdown and immediately issue a failover to the Secondary-FG of the HA pair? This is an FG-101F and I plan to do a: system > shutdown Reason is, I need to have only the Secondary-FG up and running as the true primary for troubleshooting purposes. Pretty new to this vendor and I want to ensure that it does fail over this way. Thank you.

Hi all,  Is it possible to achieve website control in Policy based Routing using internet service . . Below im attaching image of PBR configuration page My fortigate device version 7.0.2 Pls advise

Or where can I get the logs output?

I searched online but couldn't find exactly how to do this.We want to upload a logo image file to replace in the disclaimer page. But want to do it from TFTP or SFTP via CLI. Does anybody have the command and destination folder in the FGT's filesystem? Thanks, Toshi

{Forti OS 7.0.2}One Way Audio, Scratchy Voice and missing voice issues.Recently provisioned a new 3CX server and installed a new 60F Fortinet onsite for a customer. I setup all the usual forwarding rules and it PASSED the 3CX Firewall checker. At this point the customer was experiencing quite a lot of one-way audio and scratchy voice calls. Almost every forum says only disable SIP ALG but it didn’t help, after a week of digging and consulting with other SME’s I found a solution that worked. I applied it to 3 sites, and all are now operational. Creating a VIP - Go to Policy & Objects > Virtual IPs > Create NewFill out the information accordingly for each port required (note you can specify interface) Once you’re done add all the created VIP’s to a Group - Create a ServiceGo to Policy & Objects > Services and create a new Service and Specify your 3CX ServerCreate a VoIP priority shaper Go to Policy & Objects > Traffic Shapers and create new.Set Type

Hi All, I hope you are having a great day. Upgraded to FortiOS 7.2 and noticed there are 2 SFP ( grayed out ) under Network > Interfaces while there are no physical SFP ports. Also, I have missing "Firmware" menu under "System". Now I cannot downgrade to the previous firmware. I am new to Fortigate device. Any help/suggestions would be greatly appreciated. Thanks in advance.

Hello @All,I looking for a solution to redirect a URL like this one:User input: https://www.site.net:8080to; https://www.site.net:8080/info/faq.html I have look to this example:In my case, regular Expression is https://www.site.net:8080 and the replacement is https://www.site.net:8080/info/faq.html.If I try https://www.site.net:8080 I only get 404 not foundOn Policy / Web protection Profile, I have added the URL Rewriting. If I type that URL https://www.site.net:8080/info/faq.html everything is working. What I'm doing wrong?Many thanks for helping!TBC

Hello all,how can i access from outside over fortiweb to an internal web server without input of Login Details? We have an internal ADFS Server for Changing Passwords for the User.The User needs access to this internal Server from outside without any Logins. Is that possible? Many thanksTBC

Recently the FortiGate received attack from 114.34.160.41 and IPS successfully blocked the attack, but then caused a false alarm on SIEM. As the FortiGate sent a “Allowed – session reset” log message to SIEM, the SIEM triggered a high-alert message, which the keyword “allowed” made a confuse of the Firewall bypassed the attack. Any suggestion to prevent that? Thanks.  

Hi,it is possible on Fortigate 100F to have one vlan configured on multiple ports?Let's say I have vlan5 192.168.5.0, it is possible to attach it on port1 and port2 so then I will have on these ports the same shared vlan5 subnet ? thanks

I'm reading the FortiOS Handbook on page 1120 it says To import a separate server certificate and privat key files - GUI ......Go To System > Certificates and select ImportBut, there is no "Certificates" under System??????