Solved

Hi I'm trying to get a transparent proxy working using kerberos authentication.  I believe all I'm missing is a captive portal to facilitate the kerberos authentication. When I enable the captive portal on the lan interface, I have to exempt all addresses used in other policies that traverse this interface, which seems crazy. Is this expected behavior, or am I doing something wrong? Does anyone have a good guide on setting up kerberos auth for a transparent proxy?

Hi.I switched from profile-based to policy-based and i cant find anywhere to add a explicit proxy on my firewall anymore? I have search for any features that are not available when enabling "policy-based" but i cant find any mentions of the explicit proxy feature dissapearing. Any input?

can someone explain to a dummy what this filter does /mean? set prefix 192.168.1.0 255.255.255.128set ge 32set le 32

Hi There Currently using FortiManager to manage an estate of 50 or so Gates running version 6.4.5 on all devices.  We are deploying Virtual FGTs in AWS and Azure, which will also be managed by FortiManager. We are intending to make use of SDN Fabric Connectors to allow dynamic learning of objects for policy creation in both the Public Cloud environments. Can someone confirm if we need to configure the SDN connectors on the FGTs in each cloud environment or whether we only need to configure the SDN connectors on the FortiManager (assume the latter as this is where we create the policies) Many thanks

Good afternoon!  I am a networking rookie currently working with a Fortigate 80F, and am trying to understand how NAT works. I have two computers connected to the router with static IP addresses of 192.168.1.1 (PC1) and 192.168.1.101 (PC2). I am looking to set something basic up in which I can ping a virtual IP address (let's say 192.168.50.1) on PC1, and this will translate to PC2's IP address and get a reply back from PC2. I set up a Virtual IP to do this on PC1, and still have all interfaces on the hardware switch. I didn't get any response from the ping. I also added an IPv4 policy to allow traffic from the internal switch through that pings the VIP, but this also didn't work. Am I missing something here? I'm confused as to why this isn't working. I would really appreciate any insights anyone can provide!

Hello everyone. Today in my company we have 4 fortigates and we all use local user. We’re looking to switch to AD authentication, but I need to restrict the Ips that can be accessed using users. Today as we use local user I did the restriction using Trusted hosts. How could I do the same, but for AD users?

Hi, quick query just looking to disable some policies in my test lab What is the best practice with Fortigate to disable before fully deleting policies?

We have two Fortigate-100E installed, operating in HA A-P mode. Periodically, when trying to log in using the http protocol, it fails to log in to the system. At the same time, the following error appear when trying to log in: [size="1"]# [httpsd 8077 - 1635755401] ap_invoke_handler[571] -- new request (handler='logincheck-handler', uri='/logincheck', method='POST')[/size] [size="1"][httpsd 8077 - 1635755401] ap_invoke_handler[575] -- User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:45.0) Gecko/20100101 /[/size] [size="1"][httpsd 8077 - 1635755401] ap_invoke_handler[578] -- Source: 10.197.31.42:59957 Destination: 192.168.102.30:80[/size] [size="1"][httpsd 8077 - 1635755401] logincheck_handler[288] -- entering vdom for login_attempt (vdom='root')[/size] [size="1"][httpsd 8077 - 1635755401] logincheck_handler[322] -- login attempt OK, VDOM updated to 'root'[/size] [size="1"][httpsd 8077 - 1635755401] logincheck_handler[330] -- login_attempt (method=4, vdom='root', name='admin',adm

Hi, I have small issue, Imaging you have a IPSEC tunnel in interface mode. Before the tunnel is up, someone pings an IP on the other side, and because the tunnel is not yet up, the default route sends it to wan1 (Internet), no answer of course. Then the tunnel comes up and populates the routing table, but still the pings are sent to WAN1 because the session is already established with WAN1, is there a way to re-evaluate the sessions when something happens in the routing table ?

hiwe have just added a second internet connection (wan2), which we want to use only for wifi (wifi is on a vlan)to do so, I have configured a policy to authorise the traffic coming from wifi vlan to wan2however i had a conflit in the networkPlease help me to configure correctly the seconde internet wan2 and dedicate it only for wifi vlan 

Hi All. I apologize if this has been asked. I tried the KB but did not see this exact thread.So I would like to replace the default certificate on the Fortigate since it is considered best practice.Right now, we do not use the SSL VPN, only for Administration and only on the LAN. So I cannot get a cert from a public CA because the Fortinet is not resolving externally. How have others went about replacing the cert? Use AD cert? Thanks.

The unit is set up with FortiOS 5.2.2 and has the wan1 port connected to the ISP with PPPoE (1Gb subscription).If I connect the laptop or computer directly with PPPoE to the ISP I get ~800 Mb throughput (tested with speedtest, ISP's own speedtest and torrents). When I connect the Fortigate unit the throughput is capped at ~190 Mb (~140 with 5.2.5) and the unit stops responding (CPU 100%).I tried the following configurations:- internal lan in switch mode or in interface mode (hardware switch)- tried with firmwares 5.0.10 and 5.2.1The MTU for the PPPoE is 1492 so I also tried with mtu-overrride 1492 and still the sameThe unit behaves the same in every situation high cpu and capped througput.All the UTM features are turned off. All the tests are done with the basic configuration, just a policy from internal to wan1..Also another strange thing is that when I test with the download limited ~100Mb so that the unit doesn't completely freeze I can see from the top command that the CPU is 50% h

Hello Fortinet community,I try to connect a FortiAP (FAP221E) to a Fortigate 60F, working as the controller through a VPN IPsec connection.I changed the AC Discovery Type to manual on the AP, with the IP of the controller. The AP is well displayed in the Managed Forti APs list on the controller, i can authorize it, but it still stay offline.Can you please help me to understand (and solve of course) what happens and why the AP stays offline ?Thank you.BR,David.

Hi, I don't know i this is possible, but I am trying to setup a schedule that blocks only facebook and social media traffic at certain times for specific users, but allows all other services during those times. for example: users have access to allowed internet services but are only allowed to access facebook between 8:00-9:00am in the mornings and 12:00-13:00 in the afternoons. I have setup schedules and schedule groups and we use FortiSSO for user authentication however I cant seem to get it working as when I enable the schedule it blocks all internet access except for those times. Thanks in advance :) 

Hi to all, I have a problem with my fortinet firewall suddenly cannot access the web interface. I tried this link but cannot see the httpd service. How can I restart the httpd without restarting the firewall. Any help will do. Thanks rodz

Hi guys,I configured an infrastructure with 2 FortiGate Active-Passive and 2 FortiSwitch 1024D. The MCLAG is active and the network work. But I have a question.In a second moment I see this document.Is it necessary replicate the configuration of MCLAG on configuration of FortiGate? config switch-controller managed-switchedit "<switch-id>"config portsedit "<trunk name>"set type trunkset mode {static | lacp-passive | lacp-active}set bundle {enable | disable}set members "<port>,<port>"set mclag {enable | disable}nextendnext  

I need to connect my FS-124F or FS-148F Switch to a Broadcom 57416 SFP+ Network card. This will be for a future server purchase but i currently have servers at my location using the same NIC which has an open SFP+ port (the other is using a Dell twinax/Dac cable connecting back to a Dell switch) and want to test with a spare FS-148F ahead of my project start. I have tried 2 different aftermarket Twinax/Dac cable brands with no luck linking. One was 7m and other was 5m . Has anyone had any luck with a particular aftermarket DAC cable to link between the FS-124F or FS-148F with the Broadcom network card? I know FOrtinet lists a 7m DAC cable but not sure if those are just to interconnect Fortinet switches or they are generic enough to connect to Broadcom nic...plus the Fortinet branded cables are outrageously expensive...

Do u know if it's possible to use a Let's Encrypt-generated certificate into the FortiGate for the VPN Portal?

Hi, guys, The company Fortigate is configured the SSL-VPN Settings 'Limit access to specific hosts'. But boss wants to SSLVPN to company from anywhere, is it possible to configure the specific user exclusive to this limit ? Any advice ? Many thanks    

Hi ALL, We have a FG100D which is temporary set as internal firewall, I saw Fortinet has a guideline of how to manually update the signature for AV, IDP... but actually I can found the browse button to select the downloaded files. My FG100D is installed with the latest version of it (v6.2.4 Build 1112), there has no any way to upload the files for manually updating the db in FortiGuard page, does anyone know the proper way to do so? Many thanks! 

I have  Fortigate VM Eval 6.2.3 with these configsconfig system interface edit "port4"    set vdom "root"    set type physical    config ipv6    set ip6-address 2001::1/124    set ip6-allowaccess ping https ssh fgfm    end    next endconfig system dhcp6 server edit 1    set dns-service default    set domain "domain.com"    set subnet 2001::/124    set interface "port4"    config ip-range    edit 1    set start-ip 2001::    set end-ip 2001::f    next    end    next end GOAL:-set up dhcp6 server in fortigate QUESTIONS:1. how do I know my local ipv6 address using CLII can't see using "show sys int ?"2. where in dhcp6 server stated my gateway ipv6 address. tq

Hello, We are suffering the following issue: We have a Fortigate 100E and was working ok until some users reporting us that they can't access to a web of a bank, we did everything, tried with DNS of fortigate and google and others, even let the navegation without inspection or any shield and nothing worked to access to the page. Finally we created a Policy Route to give access to the web site and this worked but with the pass of the days it has growing the amount of web sites with issue to access. We thought that adding the sites to the Policy Routes it was enought but isn't. We have no access for example to Bank of America in no way. Its like if simply that's sites doesn't exist to the fortigate and every day added one more to that issue. Thanks in advance for your support. 

Hi guys! On our FortiWiFi unit, we're having trouble getting DNS resolving across two internal subnets. Internet works fine on the WiFi and the LAN, and we can access the LAN subnet from the WiFi and vice versa, but cannot resolve DNS. I've tried searching through the Cookbook, watching videos, but can't find any clear guide as to how to set this up. Our FortiWiFi is running firmware v5.6.2, and I've already enabled DNS Server from the Features. Port1 (LAN) = 10.0.0.1/24 WiFi = 192.168.0.1/24 We're not running a corporate domain in our office, and have no on-prem servers (only small, no need). I've tried setting up the DNS Server a few different ways, but cannot get this to work. I know I can add entries in there manually, but that won't be practical to manage, as IP addresses and Hostnames will change. Can someone please assist? Kind regards,Stuart Mitchell

Hi, everybody It seems that I have successfully enabled synchronization of the cluster that was working offline before me, and all the settings were duplicated manually. But when it worked and I see that they are both in a cluster from the main server interface, the backup server page became unavailable to me. I just didn't find confirmation that this is how it should be and in general I recently started working with it. Is this normal? 

Hello all, I have a primary non-Fortinet router that I would like to place a Fortigate 50E behind. My goal is to configure the FortiGate as a site-to-site VPN endpoint/server to utilize the route when needing VPN services. My reasoning for not using the Fortigate as the main firewall is that this is a secondary appliance and I already have an established primary router of which I am very happy using. I do not want to reconfigure my entire network with all of its VLANs, Rules, Services, etc. to be able to use a proprietary VPN appliance. I believe that to be a reasonable enough use case. Currently, I have the following interfaces configured:[ul]WAN interface for the 50E plugged into a standard upstream untagged VLAN (#100) with access to the internet.LAN interface for the 50E plugged into a second standard untagged VLAN (#200) of which the computer(s) that will need the VPN is a member. The LAN interface is how I am reaching the management interface for the FortiGate.[/ul]My c