Solved

Hi all, We need dual access to a subnet: LAN (MPLS) and IPSEC VPN (Fortigate v6.0.7)If LAN (MPLS) fail, IPSEC VPN get UP as fail-over. Example in route:  S 192.168.1.0/24 [10/0] via 10.10.10.5, LAN (MPLS)  [10/0] is directly connected, VPNtunnel (IpsecVPN), [50/0] Exmple Link_monitor:  config system link-monitor  edit "Monitor_subnet_1"    set srcintf "LAN"    set server "192.168.1.x"    set gateway-ip 10.10.10.5    set source-ip 10.x.x.x    set update-cascade-interface disable  next That work fine, but when we add another subnet:   S 192.168.44.0/24 [10/0] via 10.10.10.5, LAN (MPLS)  [10/0] is directly connected, VPNtunnel (IpsecVPN), [50/0]  edit "Monitor_subnet_44"    set srcintf "LAN" *****    set server "192.168.44.x"    set gateway-ip 10.10.10.5    set source-ip 10.x.x.x  &

With AnyConnect it is possible to authenticate to RADIUS and let NPS handle which group-policy/tunnel-group the user should receive based on their rights in NPS. Is this possible with Fortigate SSL-VPN and is there anything special needed to configure this besides the NPS itself? I can't seem to find any documentation about this type of implementation.

Hi Team,  i am trying to configure the fsso with agent collector.Infrastructure:- 2 sites with 1 FGT40F (v6.4.7) per site- 2 AD with DC Agent- 1 Collector Agent per site (advanced mode) For some workstations, authentication is random.I am thinking of the laptop that opens the session before being connected to the company network? So I wanted to possibly do a redirect to the authentication portal if the user is not authenticated.I tried to apply the method with set auth-method always and 2 rules.But I don't get the portal. I also need to check that ports 139 and 445 are open as well. Do you have any suggestions or recommendations? Thanks for your help Julien

Hi all, I struggle through every step with these routers, very sorry for the noob questions but please be gentle, I don't really know what I'm doing here. So we were quickly exhausting our single class C network and I decided to run another line from the Fortigate 60E (is that a vlan or a subnet, not sure) to a new switch and give myself another 200+ addresses.  Main net is 192.168.1.0, and I made the new lan 192.168.3.0  I have the fortigate set as the DHCP server for this new segment and so far I've fought my way through to a point where clients pull an ip and can communicate internally and externally. I can ping from a 192.168.1 machine to a 192.168.3 machine, but if I try to remote in by machine name, it fails, so I have a dns issue for sure.  I have the new LAN dns set to our DC at 1.10 I'm also a little worried about security, as I basically just added policies to open everything up between the two LANs and between the wan and new LAN. I'll

Hi there, We're seeing a strange issue with the SNMP data from our FortiGate 1500D firewall.We're running version 6.4.4 and using SNMP V3. Basically it seems that the Octet data isn't being captured on our 10Gbps WAN link when under load.We have a 1Gbps WAN link and that graph is consistent and accurate. We also have some 100Gb switch links being monitored by our SNMP data gathering server, and those are all true as well - so I don't think it has anything to do with the link speed or throughput. When we load up the 10G link you can see the graph information is missing from our SNMP data gathering server, but not from the dashboard in the web interface of the FortiGate. Please see attached example photos.Disregard the Units on the 10Gbps link, just a formatting error from the graphing system. Here is the 1Gbps WAN link with no issues of missing or incorrect data. Here is the 10Gbps link that while under load is missing information and incorrect data rates.2

I am diving off the deep end going to TCL scripting for handling the provisioning of a series of remote FortiGates.  I've been working on the script in parts and while I was trying to figure out some of my input logic, I kept on getting script failures.  Unable to figure out the problem, I put up a very, very simple script: #!puts "Testing ..." I expect that this should just do a simple output of the one line and be done with it.  However, this does not happen: The log is here:  -------Executing time: Thu Nov 15 09:53:02 2018----------- Starting log (Run on device) ----------------End of Log-------------------------  The task history is here:NamePercentDescriptionEVO-0002-RT1(TCL-Test)0%2018-11-15 09:53:02:start installing script TCL-Test to EVO-0002-RT1EVO-0002-RT1(TCL-Test)5%2018-11-15 09:53:04:init state: start to get checksumEVO-0002-RT1(TCL-Test)30%2018-11-15 09:53:08:premagic state: start TCL script fileEVO-0002-RT1(TCL-Test)70%2018-11-15

I can't seem to block users from downloading .ZIP files in my environment. I configured the file filter, and the logs show that it works well with detecting and blocking .ZIP files over HTTP, such as some antivirus definition updates.This can't work for me as most online traffic is HTTPS and the file filter seems unable to detect when a .ZIP file is being downloaded over HTTPS.Am I missing something with configuring the file filter to detect and block when a user is downloading a .ZIP file using HTTPS?Is there another feature that I am supposed to use that I am missing? 

Hello, I have a single public IP address on my Fortigate.If I configured an IPSec tunnel using this address, will this interfere with my regular Internet bound traffic and incoming VIPs that also share this same public IP address ?Or should I ask the ISP for an additional public IP address for my IPSEC tunnel ?Thank you.

Dear community,  Trying to integrate FortiGate with Zabbix, so I can monitor the Firewall, however, not being able to find instructions on how to do it.  Can someone please provide information in regards this integration? Thank you,Laura 

Hi everyone,Im trying to manage new APs with Fortigate Wireless Controller, but without success.Firstly I enable CAPWAP and DHCP Server on Fortigate interface(Fortigate <-> FortiSwitchPOE <-> FortiAPs)Fortigate: v6.0.8 build0303 (GA)FortiAP-U231FFortiAP-23JFI made a packet capture on Fortigate Interface and i have CAPWAP Discovery Requests from FortiAPs to Fortigate.On config wireless-controller wtp-profile  I cannot see those AP models.What should i do? 

I am using multiple Fortigates of different models at work. In my 501E (FortiOS 6.4.7) I am deploying about 80 traffic shapers to manage my traffic, but on a newly acquired 100F (FortiOS 7.0.0) I can't manage to create more than 30 shapers. My Question is :- Is there a relationship between the model or FortiOS version to the number of shapers allowed ?- Is there a way to create more shapers apart from creating a new VDOM ?

I inherited cluster Fortigate-600D from previous admins, which says that the Hardware version is FortiGate-600D Low-Encryption (LENC), and Firmware version is v5. But, first of all, I don't understand why everywhere I look (web, console) shows exactly v5, and not according to the normal type v5.0.2. Secondly, when I click check for updates, it says "No new firmware versions are available" there.I could do a sequential download of each next version to gradually upgrade to the highest possible version, but first I want to be sure.

Hi Team, Who have put the sentinelone connector for fortinet? Have you a experience and recommendation for that?I have not found information in kb and technical documentation in the fortinet website. Where can i find the connector sentinelone ? Best regards, Julien 

Hi, I will migrate a juniper to a fortigate, but my customer use some of default service MS-XXX on his juniper (the definition of these services are here : http://kb.juniper.net/InfoCenter/index?page=content&id=KB12057 Is that possible to define the UUID on service on fortigate ? I didn't found this informations at the moment.. Thanks! Lucas

Sorry, probably this is a dummy question...Obviously, I'm not so good with ADVPN and I also just started learning FortiGate as I got my first FortiGate and trying to build some network.I'm not sure if it's possible and how to make split tunneling on my FortiGate. Our HQ doesn't have that good internet connection and I wouldn't like it that we have more troubles when we add all planned BO. For easier configuration, we chose to use ADVPN with BGP.Btw. We have two BO with a second WAN that uses LTE (no public IP) and at the moment that BO has configuration on some Cisco routers to combine two WANs for better connectivity.Thank you!

Hi all, I have a LAN connected to the internet using a FortiGate 60D.Clients gets an IP Address from DHCP on the the scope of 192.168.1.101-130. When a client gets an odd ip (ex. 192.168.1.101, 192.168.1.103, 192.168.1.105, etc. ....) they can connect to the internet without any problem. When a client gets an even ip (ex. 192.168.1.102, 192.168.1.104, 192.168.1.106, etc. ...) they can NOT connect to the internet. their DHCP lease looks fine. they get a default gateway and all other configuration and they can access the LAN but for some reason the FortiGate blocks them from going on the Internet. They can ping the default gateway but not any hop behind it. As a temporary solution I excluded all even numbers from the scope. Any ideas of what can cause this behavior?   

We are going to deploy the Fortigate 1500d stack and we need to find out if it can work in QinQ mode ("802.1ad" or "set vlanforward enable"), and if so, do all versions of FortiOS support it?

 Hello Everyone... I ask about the license required to deploy 2 Fortiweb VM in HA...  I already have bought one license for one VM,,, so is there a needs to buy another license for the VM that will be used in standby mode..? or not. Thanks  

Just posting this in case it helps someone else ... I upgraded our FAZ-VM from v5.6 to v6.0 and then v6.2.1 ... and found that logs were no longer being received ... they were queueing up on our Fortigate and the "test connectivity" on the FGT was failing. After some mild panic and troubleshooting, then opening a ticket with Fortinet, I discovered that you MUST have encryption enabled on the FGT in the Logging configuration.  As soon as this was done, the problem was resolved. I had read the Release Notes, however the Special Notices wording was as follows:  All OFTP connections must be encrypted for FortiAnalyzer 6.2.0 (or higher)   Prior to upgrading to FortiAnalyzer 6.2, make sure that all FortiGate devices are configured to use encryption when   communicating with FortiAnalyzer. Starting with FortiAnalyzer 6.2.0, all OFTP communications must be encrypted. It was not at all clear that OFTP meant Logging.  Not to me anyway. Hope

Good Morning, is there a way to restrict firewall access over the internet to dns hosts? RegardsKlaus

Scenario: Small office with users and no AD-Domain.Is it possible to have a local agent installed (forticlient? Anything else?) on each computer logged in with a username/password and have that information sent to the fortigate when accessing rules etc instead of manually having to log on/into the captive portal every day? The end goal is to enter the username/password once on each computer and identify the users automatically.Any input appreciated! 

I found a problem with VIP with port forwarding when several VIP  are mixed binded to different interface. I discover this problem using hairpin policy to reach service from internal machine with public ip address of the service. If the vip I want access are after another vip with bind to different interface, the next vip are not evaluated. Example. VIP1      x.y.z.w:80 -> a.b.c.d:80        ANY VIP2      x.y.z.w:81 -> a.b.c.d:81        ANY VIP3      x.y.z.w:82 -> a.b.c.d:82        ANY VIP4      x.y.z.w:83 -> a.b.c.d:83        ANY VIP5      x.y.z.w:84 -> a.b.c.d:84        WAN VIP6      x.y.z.w:85 -> a.b.c.d:85        ANY connection to x.

Hi All, I have a Fortiswitch 108f connected and authorized on a Fortigate 40f. Initially I could see all the ports no problem. After a bit of mucking around I performed a factory reset on the gate. Initially the switch ports stopped displaying occasionally but now they wont display at all. I can see them on the graphic but if I click on the port the screen to the right comes up ("Fortiswitch Ports" but its empty. If I click the "Fortiswitch Ports" from the Menu on the left - same thing - no ports are showing. Any ideas out there?

Hello,I have a problem with groups on fortiauthenticator for remote vpn users with fortitoken mobile. On Fortiauthenticator I set "Remote User Sync Rule" for sync with remote LDAP group. Users have automaticaly assigned Fortitoken mobile and add them to the user group.FAC is set as radius server in Fortigate. On Fortigate is set user group for authentication vpn users through FAC. If I don't specify group from FAC it works without problem.But if I want to use group from FAC, it don't work. User enter his name and password for access to vpn, FAC send to him fortitoken push notification, he approve it and it finished with error fortitoken timeout.On picture is what I mean.  I need set different policy for groups of vpn users.I don't know if it is fault in my setup or anything else.Can somebody help me, please?Thank youBleBla

Hi, How to connect branch office which is the firewall is behind router? Branch office WAN using local ip, while router using public ip