Solved

Hi!I'm setting up SSL VPN on FortiGate as described here: http://cookbook.fortinet.com/ssl-vpn-using-ldap-integrated-certificates/. It works but users can connect using just a certificate. To add username/password authentication I've changed VPN usergroup by removing remote LDAP server and adding remote RADIUS server. RADIUS (MS NPS) verifies username/password with ms-chap-v2 in AD, so now it looks like we have certificate + username/password authentication. But here is a situation: User A can use their username/password and User B's certificate and still get successfully authenticated due to the fact that certificate is only checked for validity and trust (issued by same CA). So is it possible to set up SSL VPN with certificate + username/password authentication AND strict checking that certificate CN/UPN matches the username given by user? Thanks for any clues.

Hi all Need help in Fortigate behavior on OSPF routing In the attached image - What will happen if traffic from 0.x is send to server1 via wan2 but return traffic from server1 is send via wan1 ? Thank you

lot of Bug Fixes but WAD Memory Leak (712584) still persists witch keeps me from updating.What do you think?

Hiho, I have an adom which used to bei v6.2 before. As long as it was 6.2 all worked fine even after upgrading the FortiManager to v6.4. Once I upgraded the adom (and the global adom as it provides objects that are used in that adom) to v.6.4 I cannot deploy the policy package anymore. FMG just says deployment has failed but it doesn't let me know why or at which point :(Installation log does not show any error.And the usuall cli debug levels don't show any error too. Also there is much less debug info in 6.4 than there used to be in 6.2.There is almost no debugging output written during the deployment process even with several debuglevels set to 255: I also opened a ticket with TAC but even they did not yet provide a solution or hint.Does anyone have some idea how further debugging in 6.4 could be done to maybe find the problem? cheersSebastian

I am new to Fortinet but I have a strong Cisco background. We are looking at replacing our Cisco 891W with a Fortigate 60D. I am working in a lab trying to get the device configured. In Cisco I can set the DHCP on the VLAN and all devices being tagged for that VLAN can gets its IP from the VLAN DHCP, this does not seem to work on the 60D. I have attached a screenshot of the interfaces. When the DHCP is configured on the interface I can get an IP on a connected PC but the VLAN tag is not added to the packets. When I configure the DHCP on the VLAN the PC cannot get an IP. I can see the DHCP request from the PC, using WireShark, and the 60D shows the DHCP request on it, but the DHCP packet is not tagged with the VLAN and there is no IP return. Looking at the picture of the interfaces, I have attached, it shows that the Voice VLAN is a subinterface to the internal2 interface. Should the DHCP packet get the VLAN tag added to it since the PC is connected to the internal2 port? I am assu

Hello all,  I'am using here fortiswitch 448E. I also have Fortiap's running here. So the goal is that a magic package can send to an other vlan to wakeup some clients. So far I have not found anything that solves this.  On my old HP switch I had to set these options:ip directed-broadcastip forward-protocol udp 10.10.3.255 65535Are there similar options for the Fortiswitch?

Hi, Is it possible to execute the backup automatically with the variable "hostname" as backupname.cfg ?  I need to backup a lot off Fortigate to the same destination, so i need a different name for the backup file.  I can do this manually, but i want to create a cli script to send to to all Fortigates.

Hi,I have imported 2 FGT with their policy package in one ADOM. The policy and other was already configured.In this scenario there is 2 different policy package, one for FGT. The physical interface or zone of FGTs are different name from each other. How do I configured a shared policy for web navigation unique for both?

Hi all, We have an FortiWLC-50D-VM that controls some FAP-U421EV AP's. We would like to migrate these AP's from the FortiWLC to the Fortigate for wifi control. Does anyone have some commands for how I can remotely migrate the AP's from the WLC to the Fortigate via the CLI  (for some reason the gui does not work on our WLC) Thanks

Hi all,I'm new in forum anybody encountered the issues, I can ping google/yahoo but unable to browse?

Hello,I have WAN network with multiple IP ( subnet )The wan ip is the x.x.x.228 but but .229 - .232 are available.I already used different wan IP with VIP to map service for a specific public addressto internal address without problem. Now I set up a site2site IPsec tunnel and I can't use x.x.x.228 as public IP.I want my tunnel use x.x.x.229 instead of x.x.x.228 as incoming and outgoing IP I tried to use IP pool ( 1-to-1 to x.x.x.229) and use NAT on outgoing ( local vpn address-> vpn interface )vpn policy without success Which is the best way to manage this situation ?Do I need to set something on incoming policy ( vpn interface -> local vpn address ) ? Thank youGiuseppe 

Hi, I have a site-to-site vpn set up between 2 fortigates: Site A Fortigate 300E and site B Fortigate 60F, and I was able to fill the vpn and the communication between both sites. When I connect to a computer at site A from site B I can do it without problems through the IP, but for security reasons I want them to be able to communicate through the host name. In site A all my computers belong to a domain (mycompany.com.mx) but in my site B the computers are not within a domain. Is it possible to get site B computers to access site A computers by hostname and not just by IP? I hope you can help me Thank you

Look at this list https://www.hikvision.com/content/dam/hikvision/en/support/download/vms/ivms-5200-mobile-/ports-list1/iVMS-5200%20Mobile%20Surveillance%20V1.1.2_Port%20List.pdf This is surveillance system hikvision. Is this secure to open so much ports? Any experience from someone?

Hey =)    Unfortunately, I have problem with my VPN configuration.  Error Forticlient stopt by 80% I have already implemented all the suggested solutions including Internet Explorer Settings or configuration enabled TLSv1.1 etc. it says in the log "diag debug app fnbamd -1". invalid auth params for user 'vpn_test'. The user "vpn_test" is a local user and I didn't add any SSO or PKI or Domain My Forti is a FGT60D v6.0.13 build0443 (GA) FortiClient is 6.2.0 Who can help me please, I am at the end of my knowledge

We have a client that has a new Fortigate 100F that they (and in turn we) need assistance to setup properly, since they're our only client using DMZ. We need 2 address available publicly. x.y.z.194, which we've set as the WAN1 address and added a VIP that's mapped to their 192.168.x.x mail server on the necessary ports. We also have a web server connected to the DMZ with a configured address of x.y.z.195. What do we have to configure to make the web server accessible on http and https from the internet properly. I assume we'll need policy routes to allow traffic from the WAN to the DMZ, but I'm not sure how the DMZ port needs to be configured, or what other items need to be set. Unfortunately we can't do much testing since the fortigate needs to be configured before replacing their current (non fortigate) firewall, so we're trying to get this as close to correct as possible

I am currently running 5.6.12 on my 100D.  Now that 6.4 is out, even if it is not for the 100D, I am wondering is it time to upgrade to 6.0.9?  or is 6.2.3 better?  I would follow the upgrade path.  I have read about some memory leak issues in the 6.x series, are they fixed in 6.0.9 and/or 6.2.3 or do I have to contact support to get the latest IPS engine?  IPsec VPNs are a big thing for me so I need stability for that.  My fortigate connects via fortigate to fotigate VPN to a unit running 5.6.10 I think.  I have no control that unit.  Would there be any problems with connecting from a 6.2.3 to a 5.6.10 unit?

Hi Guys, Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries?  Multiple IP's from several countries are trying to bruteforce the VPN.  We don't have any VPN users needing access from outside the country. Many thanks, IM  

Hey everyone,If I want to create a DNAT entry to map External IP: 1.1.1.1 to a group of 20 Mapped IP addresses (not in a range or subnet, for eg, 1.1.1.10, 1.1.1.20, 1.1.1.30, etc), how can I achieve this on the Fortigate? I don't see an option to add multiple mapped hosts or group in a single rule. Is this possible in any way, as other FWs do have this capability. Thanks!

Hi, My area of technology is not security, but I have a project that I'm working on at home and I purchased a used Fortigate 60D which I have registered.  On Port 7, I have a WAP with DHCP serving my basic household needs and that is great.   I would like to ask for general guidance on designing a specific, but common, setup.  I have three (3) computers that I want to use.  Computers 1 and 2 are Internet facing specifically using ports 443, 6000, 3001.  The third (3) data server needs to be shielded from external access by the web, but communicate on the subnet via port 3000 to Computers 1 & 2. The first question I have is: Do I use the DMZ with port forwarding for Computers 1 & 2?  Can you suggest a general plan of attack for this design? The second question I have is: Prior to my own hardware, I use AWS with private and public IPs.  I was successful with AW$, but I don't know how to mimic this.  I've just starte

Hi all,I have a FortiGate firewall that reduces my 250MBps Internet to about 22Mbps. I have tested the network without the firewall and i get a speed of about 240 Upload and Download.PLease help out! My device is a Fortigate 60E and possibly have Features turned-on i.e Application Control, Web Filter, SSL Protection.  Kindly advise the best Fortigate Firewall Model that Give me a good ThroughPut Bandwith nearly to 250Mbps with all the Important Features turned on. I heard about FortiGate 80F. 

System link-monitor is not working as expected. When the gateway ping comes back up, the routes remains down anyway. I have to disable and re-enable link-monitor for that interface.I have an open case with Fortinet

I want to create a VPN ipsec with forticlient  with the firewall "fortigate 90D" for my company. My problem is that I don't know the remote gateway of my firewall. Where is it? Thank's (Sorry for my english)

Hi, I have a IPSec VPN setup with our FGT 60 device. It works fine for one country and doesn't connect from other. I haven't applied any geo restrictions on the device and wondering what could be the reason for such behavior. Attached is VPN setup config and interface settings. There no address object setting for the interface. Note:1.I am able to ping public IP successfully from both locations.2.I am using public IP directly as gateway and there is no name resolution involved. Any suggestions and advice is appreciated! Thanks,Mirza 

We need the ability to see the external IP address of clients that are browsing sites that we are hosting behind the Fortigate firewall.   Here is a brief overview of our setup    [image][/image]   What we need to be able to do is see the actual external IP address (1.2.3.4) of customers that are browsing web sites that we are hosting internally.    As of right now, if a customer is browsing a site that is internet facing, if we view the logs on our load balancer, all external traffic looks like it is coming from the Fortigate firewall (10.50.1.1).  Here is an example log output from our HAProxy load balancer    Mar 10 00:04:03 haproxy2 haproxy[2166293]: 10.50.1.1:62232 [10/Mar/2021:00:04:03.640] localhost~ titu_cluster/titu11 0/0/0/2/3 200 64577 - - ---- 28/28/3/63/0 0/0 "GET /images/base_models/18865.jpg HTTP/1.1" Mar 10 00:04:03 haproxy2 haproxy[2166293]: 10.50.1.1:62235 [10/Mar/2021:00:04:03.639] localhost~ titu_cluster/titu12

Hi, We have FortiMail in our setup which was installed by a 3rd party. In the message logs, the Client IP is showing our Router's private IP. Is there a setting in FortiMail to use the originating IP of the email? Below are screenshots of the logs and a sample of one of the spam message headers. Thank you,