Solved

Hi I'm new to FortiOS 6.4.5 and I've been asked to block internet access from a group of pc's on our network.Attached is the policy, the address group and the adress.What am I missing here? 

HI Mate, Anyone know could advise what is the process name in system resource for Feature Device Detection. For example, process name netscan is use for device-identification-active-scan, what about Device Detection (device-identification). Thanks.

Just wondering if anyone has tried this and has words of warning, or wisdom. Our requirement has been raised many times before, but I haven't seen a solution for pre-v6.2. We're running 6.0.12 on a 501E cluster. We want to force certain traffic to one, and only one, member of the sdwan. We have a VoIP appliance with two WAN ports (P1 & P2) and it will handle its own monitoring and failover across these ports. P1 & P2 use private IPs on FG VLANs. P1 has a VIP with a dedicated IP on ISP1. P2 has a VIP on ISP2. SD-WAN rules send P1 traffic via ISP1 and P2 traffic via ISP2, but how to stop it failing over in an outage? The vendor cannot cope with that. I'm considering using policy routes instead of SD-WAN rules to force P1 to ISP1 and P2 to ISP2, and "blackhole policy routes" later in the list to prevent "criss-crossing" during an outage. Blackhole policy routes don't exist AFAIK so my thought is to create a loopback as a dead end. Send the traffic to the loopback and have no

Hi all, I have attached a Captive Portal to my lan interface with a local group authentication. From a pc client, when I open the browser for digit any website, the Fortinet login appear (correct) I insert my username and password (correct) Fortigate accept my credentials because I can see my user from "Monitor" -> "Firewall User Monitor" (correct) the problem is now because in address bar of the browser, I can see a continuous loop of the address: http://172.16.0.X/fgtauth?092321232323cdw2http://172.16.0.X/fgtauth?021372123435ed82http://172.16.0.X/fgtauth?010032723341c889http://172.16.0.X/fgtauth?0933423487fd0fc44 and the website that I asked don't open. Also if I open another tab in Chrome, I can see the same loop with the magic token that change continually. Can I solve or debug this big problem? I haven't found any documentation about diagnostic of Captive Portal feature. thanks!Andrea      &nbs

Hi, For context, I'm not "fresh" to sysadmin, but I am "very fresh" to all things Forti-*.  I'm a month or two into a new gig with an MSP that has FortiGate and FortiAuthenticator deployments sprinked around their (our, I guess) clients.  Chatting with a previous engineer that had a hand in setting it all up, recently, he commented that he couldn't really see the point of mandating 2FA with FortiTokens since this doesn't solve the "rogue contractor with laptop" plugging in somewhere and authenticating to the file server with username and password, since it's at the point where users sign onto their laptop/desktop that has OTP authentication challenge, but if I pass credentials for a standard user to a file server from a device that isn't running the updated msgina.dll, the file server (or other resource provider) happily hands over the requested assets.  I'm betting this is a "solved problem" but I haven't seen the suggested approach in the documents I've

Hello! I created 50 accounts from guest management and when i went to print, nothing happens. The page where i can enter "Break Page After __ Users" comes up and i can type the value and press "OK" and then it just disappears. I have tried changing browser, checking that AdBlock is off but it doesn't work. Can anyone tell me what i'm missing? FortiGate 100E, v6.4.2.

Hi Guys deploying new fortiauthenticator, i have few questions if you guys could help - can I authenticate cisco switches with FAC, when I login via ssh or console that should check with FAC?- how FAC works, I have many Fortigates so FAC will be linked with FGT and users will access via Forticlient or how?i am little confused here, can we link FAC to cisco switch and do 802.1x port based or mac authentication? or need to link with FGT?

We've been using Fortigate and FortiClient managed by EMS for many years now. The Fortigate is currently on 6.0.10 and the FortiClients vary from 6.0.5 to 6.0.10. We have several hundred VPN users and most work without issues.  We've had a couple of users now report they cannot access internal resources. When we check the client, we find they can reach the host by IP, but it appears Windows isn't using the internal DNS server to resolve the host name. If we open a command prompt and type NSLookup, it connects to the internal DNS server we have defined in the SSLVPN settings. We confirmed the DNS suffix is also configured in the Fortigate SSLVPN configuration. The large majority of clients work, but it seems the list of users having issues resolving internal hosts by name is slowly growing. I'm not sure if a Windows update has suddenly caused this to start, but I am looking to the community for some suggestions? Denny

Hi, I would like to know the best way for exporting the whole fortimanager configuration, and the import it from a new unit. I have some ADOMs and I would like to migrate the whole configuration easily if possible. I suppose that creating a new BackUp and importing it in the new FortiManager unit is enough for exporting/importing all the ADOMs, right? Thanks.

Hi I have established a vpn ipsec tunnel between fortigate and a third party's cisco ftd (phase2 remote address 192.168.10.1/32), worked as expected.This week I tried to add a new remote address to the vpn 192.168.10.15/32 so I changed the remote address in phase1 to point to a group of address (192.168.10.1/32 & 192.168.10.15/32), also added that group to static route and fw rules instead of the old address (192.168.10.1/32). The problem is only one of these ip address is reachable at a time, I can ping 192.168.10.1 but I can't ping the other 192.168.10.15, but if a the remote 192.168.10.15 ping me it becomes reachable from my side for some time. How can I have this 2 ip reachable at the same time through vpn ? vpn tunnel config config vpn ipsec phase1-interface edit "MY_VPN" set type static set interface "port1" set ip-version 4 set ike-version 1 set local-gw <...> set keylife 28800 set authmethod psk set mode main set peertype any set ne

We have a fortigate 100D (5.2 firmware) Is it possible to customize the SSL VPN portal in any way?Suppose we want to place a note or message on the customers personal SSL VPN portal. How can that be achieved? 

Hi, guys, can you help me? I am having troubles with connecting to a remote vpn via IPsec. They are using public IP addresses for their terminals. (See image attached). I am done with static routes, ipv4 policies, ipsec tunnels. I've done it a couple of times but this is the first time that I am connecting our local PRIVATE IP ADDRESSES (10.10.0.0 and 10.10.70.0) to remote Public ip addresses (216.242.170.0/26) Do I need to do something? Our phase 1 and phase 2 are the same even our preshared keys These IPs are just examples.

Hello All, I have Fortigate 1100 series firewall in my organisation whose inspection mode is flow base and I want to change to proxy mode. Need to know what are the precaution need to take before proceeding so that there will be minimal disruption in my network

Can anybody explain what this ' iprope' means? ' iprope_in_check() check failed, drop' ' get firewall iprope list'

Hello, Being a network-admin-by-accident I'm facing the following issue: I have to establish a VPN connection to a Bank. On their end they have a Checkpoint, me I'm enjoying the cosy world of Fortigate. They provided me with an encryption domain, which is not part of my local network. From what I understood with Checkpoint the encryption domain would be the remote network (from Checkpoint point of view). I'll try to describe what the setup looks like: 192.168.1.1/24 (local network) -> 10.11.12.13/32 (encryption domain) -> 172.16.17.0/24 (remote network) I successfully established the tunnel: diagnose vpn tunnel list name VPN_CHECKPOINTlist ipsec tunnel by names in vd 0------------------------------------------------------name=VPN_CHECKPOINT ver=2 serial=9 1.2.3.4:0->4.3.2.1:0 dst_mtu=1500bound_if=22 lgwy=static/1 tun=intf/0 mode=auto/1 encap=none/520 options[0208]=npu frag-rfc run_state=0 accept_traffic=1 overlay_id=0proxyid_num=1 child_num=0 refc

Hello,I have a FAZ-VM running on 5.2.7. I have a problem with the different output when I test the dataset and when I generate the report. I issued the following commands but the results are the same: # diagnose sql remove hcache All hcache tables will be erased! Do you want to continue? (y/n)y Done.# diagnose sql remove query-cache Done.# diagnose sql remove tmp-table Done. What I get is attached.Is it a bug or I missed something?

Hello everyone !I would like to inquire about the FORTIAP-320B model.  This model is only connected with the computer and I don't use any internet connection  and I'm only looking to have access to the medel. After configuring my IP address, enable HTTP, and configure my password, I have access to the login page, after seeing my name and password I have directly the result that there while one second  in I go directly to the login page. I send you the photos step by step.  I configure this terminal from the KiTTY software, with a type of serial connection whose commands are on this link : https://docs.fortinet.com/document/fortiap/6.2.0/fortiwifi-and-fortiap-configuration-guide/65088/fortiap-cli-configuration-and-diagnostics-commands  would anyone have a solution and answer this problem? thank you all in advance ! 

Hi, After upgrading from 6.0.4 to 6.2 I have problems with WAN connectivity falling out. I'm getting this message in de Fortios GUI: Conserve mode activated due to high memory usage I have tried to downgrade to 6.0.4 but can't with the error message that it failed beacause it cannot download the file from fortiguard. Help.

Hello all,i would like to enable SSL Deepinspection from WAN to internal/DMZ. Called "Protecting SSL Server". Here is the Link to the Docs: https://docs.fortinet.com/document/fortigate/7.0.0/administration-guide/055107/protecting-an-ssl-serverI understand what i have to do. I have to import all servers real certificates with the private keys. I have done this successfully with an purchased from Digicert. This works perfectly for one of my DMZ Servers.But what about Let's Encrypt? I would have to change the certificate every 3 months. This means that the certificates of all servers are automatically renewed. Then I have to export them from there and import them into Fortigate. Is there no better way? Or am I understanding this wrong? FortiOS7.0 Very ThanksIPRanger

Hello all,  i'am searching for an alternate vpn/ipsec client for Android that has als an encryption higher the AES128/SHA1. There are many on the market, can you recommend one that works well with IPSEC?I already had the native Android client running a few weeks ago. I can't tell you the level of encryption, you can't set anything on the client. I had only been able to get L2TP to work. Unfortunately, surfing via the VPN was not possible via the Fortigate when the VPN was active. Unfortunately, the support team did not find a solution either. Can anyone recommend a client for me? If possible OpenSource. Very Thanks and Best RegardsFireon

Hello Community, on our FortiGate 200E (v6.4.5 build1828) are "Device Inventory" is not available.  On Dashboard is "Device Inventory" available. What's going on? Thanks!  

Hello, We have two sites with one AD Domain Controller on each side. The two sites are connected to each other with a VPN connection. Everything works fine, but I would like to set the other site's DC in our FortiGate FG-60F (FortiOS 7.0) firewall as a secondary (safety) authentication option.The problem is that the firewall can not access the other site's AD-DC, because it uses its outside IP address as source address which is not part of the IPSec settings. I checked the communication in CLI using the 'diagnose sniffer packets any' command.I would like to make SNAT to change the source address to the firewall's inside IP address.As I saw its solution would be the usage of the IP Pools. I have created an IP Pool with FortiGate's inside IP address and I used this pool in a firewall policy. The main settings of the policy:Incoming Interface: Internet (wan1)Outgoing Interface: OtherSiteVPNSource: Fortigate's outside IP addressDestination: Other site's AD-DCNAT: onIP Pool Config

Hello, i try to ping between 2 ipsec tunnel IPs, but it does not work.I have a FGT 101-E with these config:config system interfaceedit "VPN_W" set vdom "root" set ip 10.102.0.6 255.255.255.255 set allowaccess ping set type tunnel set remote-ip 10.102.0.5 255.255.255.255 set snmp-index 42 set interface "wan2" next end and a FGT 60-D with these config:config system interfaceedit "VPN_N" set vdom "root" set ip 10.102.0.5 255.255.255.255 set allowaccess ping https http set type tunnel set remote-ip 10.102.0.6 255.255.255.255 set alias "VPN-Verbindung zur N" set snmp-index 15 set interface "wan1" next end If i try to execute ping 10.102.0.6 an FGT 60-D or execute ping 10.102.0.5 on FGT 101-E, it does not work.Am i correct in the assumption, that i do not need any policy, because ping is enabled at the interface? Thanks Markus

Dear Fortinet Team, We had problem that our Routing didn't work (Please see attachment). When we tried to disable 0.0.0.0/0 then enable specified static routing, the packet didnt pass to network. The routing that we made same like Monitor --> Routing monitor. Any advice for us? Thank you.

Hi,I'd like to forward whole NTP traffic to my NTP server.I'd like to use VIP where source IP is in range from 0.0.0.0-239.255.255.255 and do portmapping 123-123 (use service NTP).        set type load-balance         set service "NTP"         set extip 0.0.0.0-239.255.255.255         set mappedip "10.20.68.192-20.121.12.194"         set arp-reply disable         set portforward enable         set mappedport 123And the problem is if any other VIP exists. For example:        set extip 10.100.200.3         set mappedip "10.20.3.35"         set extintf "any"I receive information that NTP is overlapping another VIP but if i use extip from 0.0.0.0