Solved

Hello... I have a FortiGate 600E device... In the current design there is one internal interface that connects all internal vlans to the firewall:(10 users vlans, 1 guests WIFI vlan, 1 Servers Farm vlan)... This connection comes directly from a Cisco Nexus 9396 switch which is the default gateway for all of the vlans. Now I want to separate these vlans from each others in order to set policies between the users' vlans, WIFI vlan and server farm vlan...  What I know is that I have to setup the vlans in the internal connection of FortiGate device and make it the default gateway for them instead of the Nexus switch.. Is this the right way??And can the FortiGate 600E handle the routing instead of the Cisco Nexus device?? Any advice will be appreciated 

Hello Expert, Yesterday  i  factory reset my 524D switch.I connect the cable from laptop to the management port on the switch but was not able to login in.Upon troubleshoot I realize I  cannot  ping the interface.  The only access I have to the switch is via command line. I humbly request some guidance to enable access via the management port using the default ip (192.168.1.99) Thank youRegards

HIWe've just had our MC4200 RMA'd The new one is up and running but out of 68 APs it can only talk to two.None of the others can be pinged from the controller. They can ALL be pinged from my computer. My computer can also ping the controller and the controller can ping my computer.All the APs are on the same subnet as the controller. I can't think of any reason why the controller cannot talk to them when a computer on a different subnet can.We also have a box called an SA250 sitting under the MC4200. I have no idea what it is or what it does and I have never connected to it. I tried to get to it's web interface today (assuming it has one) and that does not work. It is also on the same subnet as the APs and the controller but the controller CAN ping this box.Since the replacement MC4200 was installed all the POE switches onsite have been rebooted which should have rebooted all the APs. I have also turned off and on one of the switch ports connected to one of the APs and watched the ping

we just bought a fortiweb and in my network, most of our servers dont use http and https ports but instead they use ports like udp and tcp 3500  , 3501 and so on. My question is the following: is fortiweb used to protect servers that don't use HTTP or HTTPS? like how described in my environment? or it is exclusively used for http and https access? because the idea to place all my services that use tcp and udp ports behind a fortiweb? because when im checking config guides on fortiweb it shows the policy configuration is always showing a http and https profiles, while many of my servers don't use http and https and use other ports for other applications like GPS and so on

Hi,I have a FortiGate 100F with a LAN interface (10.1.10.1) that uses the local Captive Portal to authenticate users to Azure AD using SAML 2.0 SSO.I also have a Wi-Fi Interface (10.1.40.1) that uses the local Captive Portal to authenticate guest users with temporary accounts created in ‘User & Authentication -> Guest Management’.The Captive Portal FQDN is -  captive.local.acme.co.ukI have setup the FortiGate DNS Server database, created a local.acme.co.uk zone and created two DNS A records for the Captive Portal for this FQDN.Captive -> 10.1.10.1Captive -> 10.1.40.1All appeared to work OK for a few days, but now the DNS resolution is selecting the wrong A record, e.g. 10.1.40.1 is being resolved when trying to connect to the Captive Portal from the LAN interface.Is there any way to force the correct FQDN to IP Address resolution? Or an alternative way of achieving Azure AD firewall authentication and Guest Wi-Fi on the same FortiGate?Thanks!

Has anyone been able to get a phone like this registered to a Fortivoice 40?  Also, same with a Grandstream gxp1630.  I am not able to register either.  Any help is appreciated..

i have made a vlan(192.168.2.1/24) for may APs under my lan switch(192.168.1.1/24)...my problem is im not able to allow or gave the vlan internet access even do i have made policy wifi vlan -> sdwani am able to ping lan address via the ap with a policy wifi vlan -> lan and lan -> wifi lanmy ap config is that all user connected to ap will be in the vlan. the AP im using is tplink eap320 and engenius ews300ap am i missing something in my configuration fg201ev7.0.5 

I'm in the process of converting a Linux firewall at the office which had evolved over many years to a Fortigate setup. I've used Fortigate for our hosting environment for a couple of years, so I'd not quite the newbie... One thing we currently have set up is that incoming SSH connections get forwarded to an internal jump host, with the exception of incoming SSH connections from one particular IP address. I had expected that I could create a VIP address with a source IP filter for that address and have that go to a special internal host, and create another VIP address without a source IP filter that forwards the SSH connection to the jumphost. However it seems that the source IP filter is not considered when deciding whether the entry is a duplicate or not. This is basically how it's done in the linux firewall with iptables: iptables -t nat -A PREROUTING -s $special_ip -d $my_ip -p tcp --dport ssh -j DNAT --to-destination $specialhostiptables -t nat -A PREROUTING&nb

Hello, So I have a question I cannot find if there is an answer to. We have a Fortigate 201E that contains a dedicated management interface.  We do NOT have that interface connected normally to any network.  We use it as a "Something has gone wrong, and I need direct access to the firewall"...The problem we had (literally this morning), was that we locked ourselves out, because most of our accounts are LDAP based, and suddenly the firewall couldn't connect to the internal network. We have a local admin account, but for some reason, we had 5 different passwords saved for that account.  This locked us out, and delayed us getting services back online because of this simple problem. I would like to have the max login attempts either disabled, or at least changed for that single interface only.  Can this be done?

Q1 How do you configure a switch virtual interface anddo vlan tagging on the firewall ports using GUI? Q2 If it is possible, pls do guide me and advice if I am supposedto use a software switch or a hardware switch? Q3 How come there can be 3 ip addresses for the physicaland virtual interfaces? Ip addresses should only be on the physicalor virtual interface, not both. (there are one physical and 2 virtual interfaces) Q4 How do you configure an interface and assign sub-interfaces to itusing GUI?

Hello,i am looking for a fast and efficient way to check if 800 or so ip addresses are contained in the fortigate blacklists.Can you help me?Thank you

Hi,SetupI use a Fortigate 60E (WAN Router) to split our internet connection to a 2nd location.On the 2nd location we also have a Fortigate 60E.I used a traffic shaper on the WAN Router to limit there speed to 100Mbit.Both run FortiOS 6.2.10 The Issue:On the 2nd location for one reason or another, 1 user can use up 100% of that 100MBit during a download.Any other device at that point will not be able to internet untill the download is done.Has anyone seen this before? it feels like the 2nd Fortigate doesn't know the line speed, even though I set the Estimated Bandwidth to 100000 kbps. I don't understand why its not balancing the connection.

Hello friends.I have a fortigate 400D, receiving 100 Mbps from my ISP (UTP cable). Now I want to connect it to fiber at the same speed (100 Mbps). I saw that it has 8xGE SFP slots that I assume supports fiber.My questions is:Is it possible to connect it to a fiber working at 100 Mbps speed?If yes, what kind of module I need? Thankx. 

Hi,   I have a query.. I have few fortigate devices which are being configured directly until now. We have lot of static routes, firewall policy, SDWAN rules, interfaces etc..  Currently I want to manage these fortigate devices through Fortimanager. How can I add a preloaded config Fortigate device into Fortimanager so that Fortimanager gets policies, configs from Fortigate and continue to save it for future changes?. Any documents available on this?. RegardsRaja

Hi,I just use these firewall from some days but I'm runnig into a problem.I try to summurize- Server A (192.168.0.230) is connected to Server OUT (192.168.100.200) through a 80E vers 6.2.6 - Server A is able to ping (even reach http/https and so on) SERVER OUT - I add server B 192.168.0.231 to the lan, I add to the rule on the firewall Server B ... but I'm not able to "ping" server OUT.There are no routes on the serversthere are no rotes on the firewall (or even I'm not able to see them)no software firewll on the serverIf I "swap" ip addresses from SERVER A to SERVER B  B will be able to reach SERVER OUT and A noIf I change server B address to somethig differnet still no working (so there shuold not be dirty entries) Can some one give me an idea to what to check?Thank you in advance, hope to be understendable.Carlo

Good Day, I'm looking for a solution to implement an HA cluster between 2 Fortigates that are installed in different server racks/server rooms. Rooms are connected with Fiberlinks over a switch stack (not Fortinet Switch). To add to that, there's 2 ISPs on site and would like to have it redundant with SD-WAN and everything. I have found 2 documents stating that both solutions are possible on their own but NOT used togetherhttps://docs.fortinet.com/document/fortigate/6.4.0/new-features/297020/fortigate-ha-between-remote-sites-over-managed-fortiswitches-6-4-2https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/759633/sd-wan-with-fgcp-ha-expertIf you have any inputs or different solutions to this, let me know!

Hello Guys I am starting to study fortigate and I have simulated some labs in GNS3 with good results, but now I am trying the following configuration1 FW2 Switch core connected by LACP to the FW. The core switches are in L3.1 ToR switch1 PC connected to Tor to vlan 101From the Core I have a response from the IP 192.168.0.17 of vlan 117 and vice versa. From the PC the IP 192.168.0.17 of the FW responds, so add the segment 10.214.1.0/24 192.168.0.18 as a static route in the FW. My problem is that the PC does not have internet access, the FW only has vlan 117 because I want to test if it is possible to go to the Internet with this configuration, because in another laboratory I had no problems when I created vlan and dhcp in fortinet, they went to internet without errors, but in this case I have not been able to achieve it I have tried creating the segment 10.214.1.0/24 in fortigate, created a policy that everything that comes from vlan 117 goes out and still the same p

Our Fortimanager(FMG) is running 6.4.7. We encountered a situation we had to add one VIP policy at only one location/FGT (so far) of this customer while all other policies (60+ of them) are the same with other locations.I kind of know the answer already but I have to ask because my current option I'm thinking is to clone the current policy package and change the name then add a VIP policy with VIP objects, which is not so smart because every time we need to add/change one thing to any other policies, we have to remember to add the same change to this policy package as well.And similar cases might grow when we add more this retail-chain customer's location (so far 100+, but expected to grow much bigger) and the number of policy packages would grow. So, I want to ask if I can somehow add one policy only for one location/FGT in one policy package. Thanks,  Toshi

Hi team, We are new using fortinet firewall but our company website: Marj3y.com is being blocked without a clear reason. I can't find anything related in the logs?Also how can I check it against viruses from the firewall console? 

Forticlient blocks access to the C:\Backup directory, prevents creating it or writing to it if it already exists.We have a commercial software that requires saving files inside the C:\BACKUP directory, if the folder does not exist it creates it. We have been using it for several years without any problems.We installed Forticlient on the computers in October-November, and it is in this month of February that we need to update that software on some computers; the updater sends an error message that it does not have access to the mentioned directory.I checked then that in all the computers that use Forticlient, it is impossible to create the directory or write inside those that have it created for some other reason (a simple manual backup inside that folder made 2 years ago).In the FEMS I have already added the exclusion in all the profiles; I have searched how to "pause protection" (I have not found it), but I deactivated all the protection modules and it still blocks the directory.The o

Good afternoon community. My case is the following, I hired a block of 8 public IP's with my ISP and I have not been able to configure it properly in my FT100e. MY ISP gives me the service through an ONT which I connect to my WAN1 in PPPoE mode and assigns a local IP of the ONT to WAN1.Configure a VLAN subinterface on my WAN1 where I configure the first usable IP of the /28 block, the others I place as secondary.Create a static route pointing to the GW that is assigned to WAN1 dynamically.Create a policy to allow LAN=>WAN1 access Under this scenario, the LAN network on my port 1 navigates without problems, but the FG100e does not ping the Internet nor can I reach the IPs of the block externally. Any help or suggestion would be greatly appreciated. Greetings.

I followed the guide below to configure explicit proxy and enable Kerberos with NTLM in fallback:Administration Guide | FortiGate / FortiOS 6.4.8 | Fortinet Documentation Library Everything works correctly. The problem is that all users authenticate through NTLM and not Kerberos:# diagnose wad user list ID: 2, IP: 10.1.100.202, VDOM: vdom1 user name : TEST31@DOMAIN duration : 7 auth_type : Session auth_method : NTLM pol_id : 1 g_id : 5 user_based : 0 expire : no LAN: bytes_in=6156 bytes_out=16149 WAN: bytes_in=7618 bytes_out=1917 I have a doubt: is it all here or is some configuration missing? I found this article on TechNet:Active Directory: Using Kerberos Keytabs to integrate non-Windows systems - TechNet Articles - United States (English) - TechNet Wiki (microsoft.com) In particular it seems to be necessary to enable Kerberos for the service user used for the keytab: <After the keytab generation, t

Hi community, Can anyone help me about the procedure how to upgrade a FortiGate 60D from 5.2.3 to 6.4.8. I have taken a look at the Upgrade Path Tool, but it doesn't show either 5.2.3 nor 6.4.8. Any ideas? Regards,Julián

Hi Everyone, I would like to seek an advice if is it possible to create 2 IP Sec VPN tunnel on fortigate firewall with 1 WAN interface ? if so is there any link or documentation that I can refer how to do so ?I attached some topology for better understanding on this thing.

Hello,FortiClient 6.2.3.0912 on windows 10 computer is configured through EMS. I cannot activate Real time protection. The reason is quite clearly esxplained in log:06.02.2020 08:42:22 Information Config Third-Party AV (Trend Micro Security Agent, ) is installed. To avoid conflicts, scheduled AV scans will not be imported.06.02.2020 08:42:22 Information Config Third-Party AV (Trend Micro Security Agent, ) is installed. To avoid conflicts, real-time AV will not be enabled.06.02.2020 08:42:22 Error Config Error in importing module: xmlav06.02.2020 08:42:22 Debug Config 'scan on registration' is disabled - delete 'on registration' vulnerability scan.06.02.2020 08:42:22 Debug Config ImportConfig: tag <\forticlient_configuration\antiexploit\exclusion_applications> value is empty. The problem is that I already uninstalled the Trend Micro Security Agent. I manually checked that all TM files are deleted from the disk. I manually checked that there are no TM keys in registry. I