Solved

Hello all,I have a faulty VPN configuration on an IPsec connection between a Fortigate and a Sophos XG to which I cannot find a solution. I have connected several subnets via the VPN: Fortigate: xx.xx.11.0/24xx.xx.6.0/24XG: xx.xx.100.0/24xx.xx.2.0/24xx.xx.0.0/26The connection is established and also works. However, an error is displayed on the Fortigate. The SAs between the firewalls are displayed with the following notation UP: Source: xx.xx.11.0-xx.xx.11.255 Destination: xx.xx.100.0-xx.xx.100.255, xx.xx.2.0-xx.xx.2.255, xx.xx.0.0-xx.xx.0.62 ....The same SAs are displayed with a different notation than DOWN: Source: xx.xx.11.0/255.255.255.0 Destination: xx.xx.10.0/255.255.255.0, xx.xx.2.0/255.255.255.0,xx.xx.0.0/255.255.255.192On the Sophos XG, all SAs are displayed UP.Does anyone have an idea how I can eliminate this error? This permanently reports a faulty VPN tunnel to our monitoring system. Best regards Felix

Hello,        I would like to resolve internal hostnames on my network, and I read on this Forums that it would suffice to set your internal DNS as the primary DNS server on the Fortigate unit in network configuration. BUT, I would also like to have the Fortigate be the first DNS uplink for my internal DNS server, so I could use Fortiguard DNS servers to monitor and block bad hosts (malware, C&C, etc) out there. So, what would be the recommended practice to having both internal hostnames correctly resolved AND funnel all DNS traffic through Fortinet DNS service (assuming there actually is a way to do this)? PLAN B: is there a way to pre-load all my internal hostnames (a la \windows\system32\drivers\etc\hosts) on my Fortigate unit? Is there an editable HOSTS file of some sort? 

Hi all! We have a working SSL VPN that lets outside users access our internal LAN. But I want to restrict access to specific local addresse. Ie I dont want any VPN users to access 192.168.0.20.How do I block a specific local IP?

Dear all, Do you know how to disable "save password" on Fortinet VPN client ?  I would appreciate your help on this matter. Best regards, Miguel Laruccia   

Hello, In the standalone Fortiswitch, we can configure the following VLAN settings in a port: Native VLAN, Allowed VLAN list and Untagged VLAN list. This configuration is available only in the standalone switch; when the switch is managed by a FortiGate, the only settings available are the Native VLAN and the Allowed VLAN list. Can somebody explain to me why should someone need to set the Untagged VLAN list? It seems to me that the Native VLAN alone should be sufficient. What additional functionality does the Untagged VLAN list provides to the port consifuration, that is not covered by the Native VLAN? Thanks

Hello, I have a wifi printer Samsung ML-2165w  and it can't connect to the network provided by FortiAP 221e. I've tried to disable many options but all attempts were unfortunated. Even can't connect to open network. Printer can connect to other access points successfully. Could you please advice something?  Below is a log from dmesg.Thank you [11257.519816] [957.510] cpu1 wmi_event_debug: dev=wifi1 event_id=0x9028(WMI_PEER_STA_PS_STATECHG_EVENTID)[11257.643880] [957.630] cpu0 vap-01(wlan01): [00:15:99:ea:95:29] recv auth frame with algorithm 0 seq 1[11257.643935] [957.630] cpu0 wmi_cmd_debug: ol_alloc_cookie dev=wifi0 cookie=cdc40e04 seq=139143 in_use=1 cmd_id=0x9022(WMI_PEER_CREATE_CMDID) if_id=1 vap=wlan01 peer_macaddr=00:15:99:ea:95:29[11257.644015] [957.630] cpu0 vap-01(wlan01): [00:15:99:ea:95:29] ieee80211_alloc_node: vap=0xc6ae8000, nodecount=2, ni=0xcc7c0000 ref=2, ni_bss_node=0xcc7c0000 bss_ref=2[11257.644186] wireless_send_event:790 mlmsg cmd=0x8C02 event_len=18 sk

Hi!I'm setting up SSL VPN on FortiGate as described here: http://cookbook.fortinet.com/ssl-vpn-using-ldap-integrated-certificates/. It works but users can connect using just a certificate. To add username/password authentication I've changed VPN usergroup by removing remote LDAP server and adding remote RADIUS server. RADIUS (MS NPS) verifies username/password with ms-chap-v2 in AD, so now it looks like we have certificate + username/password authentication. But here is a situation: User A can use their username/password and User B's certificate and still get successfully authenticated due to the fact that certificate is only checked for validity and trust (issued by same CA). So is it possible to set up SSL VPN with certificate + username/password authentication AND strict checking that certificate CN/UPN matches the username given by user? Thanks for any clues.

Hi all Need help in Fortigate behavior on OSPF routing In the attached image - What will happen if traffic from 0.x is send to server1 via wan2 but return traffic from server1 is send via wan1 ? Thank you

lot of Bug Fixes but WAD Memory Leak (712584) still persists witch keeps me from updating.What do you think?

Hiho, I have an adom which used to bei v6.2 before. As long as it was 6.2 all worked fine even after upgrading the FortiManager to v6.4. Once I upgraded the adom (and the global adom as it provides objects that are used in that adom) to v.6.4 I cannot deploy the policy package anymore. FMG just says deployment has failed but it doesn't let me know why or at which point :(Installation log does not show any error.And the usuall cli debug levels don't show any error too. Also there is much less debug info in 6.4 than there used to be in 6.2.There is almost no debugging output written during the deployment process even with several debuglevels set to 255: I also opened a ticket with TAC but even they did not yet provide a solution or hint.Does anyone have some idea how further debugging in 6.4 could be done to maybe find the problem? cheersSebastian

I am new to Fortinet but I have a strong Cisco background. We are looking at replacing our Cisco 891W with a Fortigate 60D. I am working in a lab trying to get the device configured. In Cisco I can set the DHCP on the VLAN and all devices being tagged for that VLAN can gets its IP from the VLAN DHCP, this does not seem to work on the 60D. I have attached a screenshot of the interfaces. When the DHCP is configured on the interface I can get an IP on a connected PC but the VLAN tag is not added to the packets. When I configure the DHCP on the VLAN the PC cannot get an IP. I can see the DHCP request from the PC, using WireShark, and the 60D shows the DHCP request on it, but the DHCP packet is not tagged with the VLAN and there is no IP return. Looking at the picture of the interfaces, I have attached, it shows that the Voice VLAN is a subinterface to the internal2 interface. Should the DHCP packet get the VLAN tag added to it since the PC is connected to the internal2 port? I am assu

Hello all,  I'am using here fortiswitch 448E. I also have Fortiap's running here. So the goal is that a magic package can send to an other vlan to wakeup some clients. So far I have not found anything that solves this.  On my old HP switch I had to set these options:ip directed-broadcastip forward-protocol udp 10.10.3.255 65535Are there similar options for the Fortiswitch?

Hi, Is it possible to execute the backup automatically with the variable "hostname" as backupname.cfg ?  I need to backup a lot off Fortigate to the same destination, so i need a different name for the backup file.  I can do this manually, but i want to create a cli script to send to to all Fortigates.

Hi,I have imported 2 FGT with their policy package in one ADOM. The policy and other was already configured.In this scenario there is 2 different policy package, one for FGT. The physical interface or zone of FGTs are different name from each other. How do I configured a shared policy for web navigation unique for both?

Hi all, We have an FortiWLC-50D-VM that controls some FAP-U421EV AP's. We would like to migrate these AP's from the FortiWLC to the Fortigate for wifi control. Does anyone have some commands for how I can remotely migrate the AP's from the WLC to the Fortigate via the CLI  (for some reason the gui does not work on our WLC) Thanks

Hi all,I'm new in forum anybody encountered the issues, I can ping google/yahoo but unable to browse?

Hello,I have WAN network with multiple IP ( subnet )The wan ip is the x.x.x.228 but but .229 - .232 are available.I already used different wan IP with VIP to map service for a specific public addressto internal address without problem. Now I set up a site2site IPsec tunnel and I can't use x.x.x.228 as public IP.I want my tunnel use x.x.x.229 instead of x.x.x.228 as incoming and outgoing IP I tried to use IP pool ( 1-to-1 to x.x.x.229) and use NAT on outgoing ( local vpn address-> vpn interface )vpn policy without success Which is the best way to manage this situation ?Do I need to set something on incoming policy ( vpn interface -> local vpn address ) ? Thank youGiuseppe 

Hi, I have a site-to-site vpn set up between 2 fortigates: Site A Fortigate 300E and site B Fortigate 60F, and I was able to fill the vpn and the communication between both sites. When I connect to a computer at site A from site B I can do it without problems through the IP, but for security reasons I want them to be able to communicate through the host name. In site A all my computers belong to a domain (mycompany.com.mx) but in my site B the computers are not within a domain. Is it possible to get site B computers to access site A computers by hostname and not just by IP? I hope you can help me Thank you

Look at this list https://www.hikvision.com/content/dam/hikvision/en/support/download/vms/ivms-5200-mobile-/ports-list1/iVMS-5200%20Mobile%20Surveillance%20V1.1.2_Port%20List.pdf This is surveillance system hikvision. Is this secure to open so much ports? Any experience from someone?

Hey =)    Unfortunately, I have problem with my VPN configuration.  Error Forticlient stopt by 80% I have already implemented all the suggested solutions including Internet Explorer Settings or configuration enabled TLSv1.1 etc. it says in the log "diag debug app fnbamd -1". invalid auth params for user 'vpn_test'. The user "vpn_test" is a local user and I didn't add any SSO or PKI or Domain My Forti is a FGT60D v6.0.13 build0443 (GA) FortiClient is 6.2.0 Who can help me please, I am at the end of my knowledge

We have a client that has a new Fortigate 100F that they (and in turn we) need assistance to setup properly, since they're our only client using DMZ. We need 2 address available publicly. x.y.z.194, which we've set as the WAN1 address and added a VIP that's mapped to their 192.168.x.x mail server on the necessary ports. We also have a web server connected to the DMZ with a configured address of x.y.z.195. What do we have to configure to make the web server accessible on http and https from the internet properly. I assume we'll need policy routes to allow traffic from the WAN to the DMZ, but I'm not sure how the DMZ port needs to be configured, or what other items need to be set. Unfortunately we can't do much testing since the fortigate needs to be configured before replacing their current (non fortigate) firewall, so we're trying to get this as close to correct as possible

I am currently running 5.6.12 on my 100D.  Now that 6.4 is out, even if it is not for the 100D, I am wondering is it time to upgrade to 6.0.9?  or is 6.2.3 better?  I would follow the upgrade path.  I have read about some memory leak issues in the 6.x series, are they fixed in 6.0.9 and/or 6.2.3 or do I have to contact support to get the latest IPS engine?  IPsec VPNs are a big thing for me so I need stability for that.  My fortigate connects via fortigate to fotigate VPN to a unit running 5.6.10 I think.  I have no control that unit.  Would there be any problems with connecting from a 6.2.3 to a 5.6.10 unit?

Hi Guys, Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries?  Multiple IP's from several countries are trying to bruteforce the VPN.  We don't have any VPN users needing access from outside the country. Many thanks, IM  

Hey everyone,If I want to create a DNAT entry to map External IP: 1.1.1.1 to a group of 20 Mapped IP addresses (not in a range or subnet, for eg, 1.1.1.10, 1.1.1.20, 1.1.1.30, etc), how can I achieve this on the Fortigate? I don't see an option to add multiple mapped hosts or group in a single rule. Is this possible in any way, as other FWs do have this capability. Thanks!

Hi, My area of technology is not security, but I have a project that I'm working on at home and I purchased a used Fortigate 60D which I have registered.  On Port 7, I have a WAP with DHCP serving my basic household needs and that is great.   I would like to ask for general guidance on designing a specific, but common, setup.  I have three (3) computers that I want to use.  Computers 1 and 2 are Internet facing specifically using ports 443, 6000, 3001.  The third (3) data server needs to be shielded from external access by the web, but communicate on the subnet via port 3000 to Computers 1 & 2. The first question I have is: Do I use the DMZ with port forwarding for Computers 1 & 2?  Can you suggest a general plan of attack for this design? The second question I have is: Prior to my own hardware, I use AWS with private and public IPs.  I was successful with AW$, but I don't know how to mimic this.  I've just starte