Solved

Hi everyone,Im trying to manage new APs with Fortigate Wireless Controller, but without success.Firstly I enable CAPWAP and DHCP Server on Fortigate interface(Fortigate <-> FortiSwitchPOE <-> FortiAPs)Fortigate: v6.0.8 build0303 (GA)FortiAP-U231FFortiAP-23JFI made a packet capture on Fortigate Interface and i have CAPWAP Discovery Requests from FortiAPs to Fortigate.On config wireless-controller wtp-profile  I cannot see those AP models.What should i do? 

I am using multiple Fortigates of different models at work. In my 501E (FortiOS 6.4.7) I am deploying about 80 traffic shapers to manage my traffic, but on a newly acquired 100F (FortiOS 7.0.0) I can't manage to create more than 30 shapers. My Question is :- Is there a relationship between the model or FortiOS version to the number of shapers allowed ?- Is there a way to create more shapers apart from creating a new VDOM ?

I inherited cluster Fortigate-600D from previous admins, which says that the Hardware version is FortiGate-600D Low-Encryption (LENC), and Firmware version is v5. But, first of all, I don't understand why everywhere I look (web, console) shows exactly v5, and not according to the normal type v5.0.2. Secondly, when I click check for updates, it says "No new firmware versions are available" there.I could do a sequential download of each next version to gradually upgrade to the highest possible version, but first I want to be sure.

Hi Team, Who have put the sentinelone connector for fortinet? Have you a experience and recommendation for that?I have not found information in kb and technical documentation in the fortinet website. Where can i find the connector sentinelone ? Best regards, Julien 

Hi, I will migrate a juniper to a fortigate, but my customer use some of default service MS-XXX on his juniper (the definition of these services are here : http://kb.juniper.net/InfoCenter/index?page=content&id=KB12057 Is that possible to define the UUID on service on fortigate ? I didn't found this informations at the moment.. Thanks! Lucas

Sorry, probably this is a dummy question...Obviously, I'm not so good with ADVPN and I also just started learning FortiGate as I got my first FortiGate and trying to build some network.I'm not sure if it's possible and how to make split tunneling on my FortiGate. Our HQ doesn't have that good internet connection and I wouldn't like it that we have more troubles when we add all planned BO. For easier configuration, we chose to use ADVPN with BGP.Btw. We have two BO with a second WAN that uses LTE (no public IP) and at the moment that BO has configuration on some Cisco routers to combine two WANs for better connectivity.Thank you!

Hi all, I have a LAN connected to the internet using a FortiGate 60D.Clients gets an IP Address from DHCP on the the scope of 192.168.1.101-130. When a client gets an odd ip (ex. 192.168.1.101, 192.168.1.103, 192.168.1.105, etc. ....) they can connect to the internet without any problem. When a client gets an even ip (ex. 192.168.1.102, 192.168.1.104, 192.168.1.106, etc. ...) they can NOT connect to the internet. their DHCP lease looks fine. they get a default gateway and all other configuration and they can access the LAN but for some reason the FortiGate blocks them from going on the Internet. They can ping the default gateway but not any hop behind it. As a temporary solution I excluded all even numbers from the scope. Any ideas of what can cause this behavior?   

We are going to deploy the Fortigate 1500d stack and we need to find out if it can work in QinQ mode ("802.1ad" or "set vlanforward enable"), and if so, do all versions of FortiOS support it?

 Hello Everyone... I ask about the license required to deploy 2 Fortiweb VM in HA...  I already have bought one license for one VM,,, so is there a needs to buy another license for the VM that will be used in standby mode..? or not. Thanks  

Just posting this in case it helps someone else ... I upgraded our FAZ-VM from v5.6 to v6.0 and then v6.2.1 ... and found that logs were no longer being received ... they were queueing up on our Fortigate and the "test connectivity" on the FGT was failing. After some mild panic and troubleshooting, then opening a ticket with Fortinet, I discovered that you MUST have encryption enabled on the FGT in the Logging configuration.  As soon as this was done, the problem was resolved. I had read the Release Notes, however the Special Notices wording was as follows:  All OFTP connections must be encrypted for FortiAnalyzer 6.2.0 (or higher)   Prior to upgrading to FortiAnalyzer 6.2, make sure that all FortiGate devices are configured to use encryption when   communicating with FortiAnalyzer. Starting with FortiAnalyzer 6.2.0, all OFTP communications must be encrypted. It was not at all clear that OFTP meant Logging.  Not to me anyway. Hope

Good Morning, is there a way to restrict firewall access over the internet to dns hosts? RegardsKlaus

Scenario: Small office with users and no AD-Domain.Is it possible to have a local agent installed (forticlient? Anything else?) on each computer logged in with a username/password and have that information sent to the fortigate when accessing rules etc instead of manually having to log on/into the captive portal every day? The end goal is to enter the username/password once on each computer and identify the users automatically.Any input appreciated! 

I found a problem with VIP with port forwarding when several VIP  are mixed binded to different interface. I discover this problem using hairpin policy to reach service from internal machine with public ip address of the service. If the vip I want access are after another vip with bind to different interface, the next vip are not evaluated. Example. VIP1      x.y.z.w:80 -> a.b.c.d:80        ANY VIP2      x.y.z.w:81 -> a.b.c.d:81        ANY VIP3      x.y.z.w:82 -> a.b.c.d:82        ANY VIP4      x.y.z.w:83 -> a.b.c.d:83        ANY VIP5      x.y.z.w:84 -> a.b.c.d:84        WAN VIP6      x.y.z.w:85 -> a.b.c.d:85        ANY connection to x.

Hi All, I have a Fortiswitch 108f connected and authorized on a Fortigate 40f. Initially I could see all the ports no problem. After a bit of mucking around I performed a factory reset on the gate. Initially the switch ports stopped displaying occasionally but now they wont display at all. I can see them on the graphic but if I click on the port the screen to the right comes up ("Fortiswitch Ports" but its empty. If I click the "Fortiswitch Ports" from the Menu on the left - same thing - no ports are showing. Any ideas out there?

Hello,I have a problem with groups on fortiauthenticator for remote vpn users with fortitoken mobile. On Fortiauthenticator I set "Remote User Sync Rule" for sync with remote LDAP group. Users have automaticaly assigned Fortitoken mobile and add them to the user group.FAC is set as radius server in Fortigate. On Fortigate is set user group for authentication vpn users through FAC. If I don't specify group from FAC it works without problem.But if I want to use group from FAC, it don't work. User enter his name and password for access to vpn, FAC send to him fortitoken push notification, he approve it and it finished with error fortitoken timeout.On picture is what I mean.  I need set different policy for groups of vpn users.I don't know if it is fault in my setup or anything else.Can somebody help me, please?Thank youBleBla

Hi, How to connect branch office which is the firewall is behind router? Branch office WAN using local ip, while router using public ip

Hi I'm trying to get a transparent proxy working using kerberos authentication.  I believe all I'm missing is a captive portal to facilitate the kerberos authentication. When I enable the captive portal on the lan interface, I have to exempt all addresses used in other policies that traverse this interface, which seems crazy. Is this expected behavior, or am I doing something wrong? Does anyone have a good guide on setting up kerberos auth for a transparent proxy?

Hi.I switched from profile-based to policy-based and i cant find anywhere to add a explicit proxy on my firewall anymore? I have search for any features that are not available when enabling "policy-based" but i cant find any mentions of the explicit proxy feature dissapearing. Any input?

can someone explain to a dummy what this filter does /mean? set prefix 192.168.1.0 255.255.255.128set ge 32set le 32

Hi There Currently using FortiManager to manage an estate of 50 or so Gates running version 6.4.5 on all devices.  We are deploying Virtual FGTs in AWS and Azure, which will also be managed by FortiManager. We are intending to make use of SDN Fabric Connectors to allow dynamic learning of objects for policy creation in both the Public Cloud environments. Can someone confirm if we need to configure the SDN connectors on the FGTs in each cloud environment or whether we only need to configure the SDN connectors on the FortiManager (assume the latter as this is where we create the policies) Many thanks

Good afternoon!  I am a networking rookie currently working with a Fortigate 80F, and am trying to understand how NAT works. I have two computers connected to the router with static IP addresses of 192.168.1.1 (PC1) and 192.168.1.101 (PC2). I am looking to set something basic up in which I can ping a virtual IP address (let's say 192.168.50.1) on PC1, and this will translate to PC2's IP address and get a reply back from PC2. I set up a Virtual IP to do this on PC1, and still have all interfaces on the hardware switch. I didn't get any response from the ping. I also added an IPv4 policy to allow traffic from the internal switch through that pings the VIP, but this also didn't work. Am I missing something here? I'm confused as to why this isn't working. I would really appreciate any insights anyone can provide!

Hello everyone. Today in my company we have 4 fortigates and we all use local user. We’re looking to switch to AD authentication, but I need to restrict the Ips that can be accessed using users. Today as we use local user I did the restriction using Trusted hosts. How could I do the same, but for AD users?

Hi, quick query just looking to disable some policies in my test lab What is the best practice with Fortigate to disable before fully deleting policies?

We have two Fortigate-100E installed, operating in HA A-P mode. Periodically, when trying to log in using the http protocol, it fails to log in to the system. At the same time, the following error appear when trying to log in: [size="1"]# [httpsd 8077 - 1635755401] ap_invoke_handler[571] -- new request (handler='logincheck-handler', uri='/logincheck', method='POST')[/size] [size="1"][httpsd 8077 - 1635755401] ap_invoke_handler[575] -- User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:45.0) Gecko/20100101 /[/size] [size="1"][httpsd 8077 - 1635755401] ap_invoke_handler[578] -- Source: 10.197.31.42:59957 Destination: 192.168.102.30:80[/size] [size="1"][httpsd 8077 - 1635755401] logincheck_handler[288] -- entering vdom for login_attempt (vdom='root')[/size] [size="1"][httpsd 8077 - 1635755401] logincheck_handler[322] -- login attempt OK, VDOM updated to 'root'[/size] [size="1"][httpsd 8077 - 1635755401] logincheck_handler[330] -- login_attempt (method=4, vdom='root', name='admin',adm

Hi, I have small issue, Imaging you have a IPSEC tunnel in interface mode. Before the tunnel is up, someone pings an IP on the other side, and because the tunnel is not yet up, the default route sends it to wan1 (Internet), no answer of course. Then the tunnel comes up and populates the routing table, but still the pings are sent to WAN1 because the session is already established with WAN1, is there a way to re-evaluate the sessions when something happens in the routing table ?