Solved

hi guys i am new in fortigate world, what is different between these two way of publishing a service :1- publish a server with using filtering \services\HTTP2- publishing a server using port forwarder are both work the same way and manner ?is there any technical benefit between them ?

Hi guys, I would like to know why I cannot set my security profiles on my security policies... I cannot found why or how to solve it. When I set a security profile like anti virus or web filter or application control or ips (default or new created ones), I receive a message that it conflicts with the system settings.. I do have license for that because on the status dashboard those are green marked. Can someone help me? :) Thanks and much appreciated. kr, 

Hi guys,  We have Forti400E HA pairs topology ( with FortiOS V6.4.2 ) in the production network, and intend to change the interface MAC add; do we need to change the same mac add for both devices at the same time, or just change the MAC add in primary/master Forti400E ( it will synch the mac add to the secondary/slave Forti400E ) ? Thanks so much for your advice  

Hello I have IPsec Tunnel  wrong named.unfortunately there are more than 300 policy that matching this IPsec Tunnel (and Interface)Its really disturbing daily.Is there a way to change it from command line or GUI whithout rebuild all policy?I'm on HA cluster FG-401-E that run 3 VDOM FortiOS 6.4.2Thank you for your help

Hi, I am getting the following log every around 15 minutes on my 50E. Administrator admin login failed from http(127.0.0.1) because of invalid password Any has any idea on what is this could be? Thanks

We are moving our SSL VPN tunnel users from Pulse Secure to FortiGate (6.0.6). In Pulse Secure, we can limit access based on the remote user's MAC address. I found https://kb.fortinet.com/k....do?externalID=FD41648 which describes how to configure that for SSL VPNweb mode, but a number of our SSL VPN users will be using tunnel mode exclusively. Is there a way to configure a mac-addr-check in tunnel mode via a host check option? If not, is there another way to limit access based on some other unique feature of a remote device? Kind regards, Herta

100D's in HA: The internal network is set for 10.4.1.x/24We also have other internal networks from 10.1.1.x to 10.8.1.x that can all talk to our primary 10.4.1.x subnetOur other networks are each on their own VLAN which is all handled by our core switch. Currently, our Aruba 5406 does all the routing from the other subnets.ip default-gateway 10.4.1.9 (FortiGate) ip route 0.0.0.0 0.0.0.0 10.4.1.9 In order for the firewall to be able to communicate to the other local subnet for AP discovery with FortiManager:[ol]Should we just change the subnet on the internal interface from /24 to /12 : 10.0.0.1 - 10.15.255.254Or would it be better to create some kind of loopback interface?[/ol]We just received two new 600E's that we'll be upgrading to soon as well. TIA

Hello all,I want to let subnet 10.0.0.0/8 out to the internet, however, i want to filter out 10.1.100.0/24. How do I do it in my 100F? Sorry, moved to Fortigate from a different product. 

Hey community, I am relatively new to the platform and I have been given FAZ as the main product I will be working on. I have looked in the forums and on a lot of other websites like fortiguru but I cannot find an answer.  Is there a way to use an event handler so that if a Firewall stops sending traffic for a couple of hours to send an alert via email to a group of people? I see you cannot put a 0 in the value field of a handler so I cannot do something like if 0 alerts for "firewall" for the past 1 hours, send an alert.  Any suggestions would be helpful. Thanks!

Trying to restore a configuration from file to a pair of 60e but keep receiving the message below. I downloaded the config directly from a production device so I *know* its good. Have tried on 2 different 60e. 2 usb drives. Factory reset both firewalls.  Firmware is the same level on the device as on the config. Google shows virtually nothing for the return code. I'm lost here.  FGT60 # exec restore image usb config.confThis operation will replace the current firmware version!Do you want to continue? (y/n)yPlease wait...Copy image config.conf from USB disk ...Get image from USB disk OK.Check image error.Command fail. Return code -28

Hi, Color me clueless.... I'd like to connect my Fortigate 100F to a Vertiv Avocent ACS 8000 Console Server. How do I go about doing this when the Fortigate uses a RJ45 console port? In advance, Thanks so much for the help. 

Hello. We have an RRAS server (Windows Server 2016) for VPN Access. It is currently using PPTP and we are working on upgrading it to L2TP for more secured encryption. We are having trouble getting the L2TP pass through the FortiGate firewall from the internet. The setup works just fine if I connect to the server directly (internally), so I know it is the firewall. Logs are showing the policy is accepting IKE connection, but the VPN connection stuck at this step(in screenshots) below. Screenshots for policy, VIPs, and Logs[link]https://ibb.co/jHcGtCn[/link] [link]https://ibb.co/096vFNS[/link] [link]https://ibb.co/5M6NTm3[/link] [link]https://ibb.co/F6vMRVQ[/link] [link]https://ibb.co/YXBPvcj[/link] FortiGate 90E, firmware v5.4.11,build8140 (GA) Thanks for helping! 

On FortiGate 5.6, I've currently got 2 1G ports linked in a LACP aggregate team to a Cisco switch. We are wanting to migrate to a single 10G link via a different switch with as little disruption as possible. The LACP interface configured directly with an IP address (no vlans) and is linked to a number of address and policy elements. Is it possible to remove the two 1G ports and add the 10G port to the aggregate interface in one operation? I assume the 10G would have to be set up as the only member of a LACP aggregate on the Cisco side. I know the guaranteed way would be to move the IP across to the 10G port and then migrate the address and policy elements, but this would be quicker.

got a fortigate 200D old firewall in my company's lab environment.i'm constructing a network topology with 200D and two switches(other brand), and these two SW are providing redundancy for end devices/servers. the topology is shown in attached figure. well... i'm a newbie on networking and not familiar with fortinet's product at all, so my questions are stupid and hope you don't mind:According to my topology, do i need to set STP on 200D to prevent network loop?i want to make the interfaces(which connected to switches) on 200D isolate the switches' broadcast and also be the gateway for redundancy.(i will also utilize L3 routing on switches for VLANs but these VLANs need to reach firewall for internet connection...)therefore if one interface(on 200D) or switch dies, the other one could still provide network traffic for end devices. is there any special settings from fortinet that i need to be aware of on 200D for my network topology?? thanks for answering my dumb question

Using FortiOS 6.0.9. Need to run backups to a cloud server destination (*.domain.com). Was going to add an IPv4 policy with this address as the destination to exempt this traffic from normal antivirus, web filtering, DNS, etc. evaluation. I see that there is a Wildcard FQDN Address list. I created the address in this section but I can not list this address as the destination in the policy. I see that Wildcard FQDN Addresses are to be used in SSL exemptions and should not be used as source or destination addresses in policies. I can't be the first person to have this as a requirement. Is there a good workaround? I think I noticed tat newer firmware versions have this ability but I was trying to wait until the 6.2 and 6.4 versions became more mature but before upgrading.

Hi, guys, I am rather new to Fortinet product; I am configuring the Fortigate 400e with FortiOS v6.4.2;  For logging traffic, I can not enable "set fortiview-local-traffic enable" as the attached. Any recommendation ?( I have only local Fortiview, no FortiAnalyzer, FortiManager, FortiCloud..) Many many thx in advance.

Hello,We have an Hub n spoke architecture.Each spoke (3) can ping networks each other (NAT disabled). When NAT enabled on spoke zone to spoke zone, spokes can't ping each other. At this time, Internet access on spoke sites pass throught their Internet connection (WAN interface on each spokes)We want to pass Internet access throught HUB to manage all Internet Policies from the HUB. Is it possible? Thanks.Regards.Waaalex. 

Hi guys, Our company is implementing SSL VPN with Client Certificate which will authenticate by our Fortigate.However, many of our company users are not able to login with client certificate. Users with administrator rights have no issue to login. The reason is due to these users do not have administrator rights or read permission to access the client certificate's private key. In Windows Group policy, as I know there is no such settings to grant certain read permission to Certificate's private key. Anyone has any experience or encountered the same challenges while do not want to grant administrator rights to normal users? Thanks! 

Hello,we have upgraded our FG300D (not connected to the internet) from 6.2.0 to 6.4.2 this morning.After the reboot, the FG asked for a configuration to join Fortiguard servers.This is impossible : the FG is placed to filter an "internal" link between to sites on the LAN (the other side is a FG (v6.2.5))Since it failed to connect to the internet, it started, but le licences widget states "unable to connect to Fortiguard servers" and it apparently tries all the time...Is there a way to desactivate this fortiguard interrogation ?Is fortigate still able to work without an internet connection ? Thanx for your help Jean-Yves

Hi guys, I would be interested in what is the best/most reliable way to ensure that traffic is sent into an IPsec tunnel.I.e. if I can see outgoing Traffic within the IPsec Monitor and I also see packets when starting a packet caputre on the VPN tunnel - does that confirm that the traffic is sent trough the tunnel? Is there any (better) option to confirm this? Best regardscust0m

hello there,please help.we using FG30E with firmware 5.6.12we have created vpn ssl with tunnel mode, and client can connect successful.we have create 3 policies (as shown video tutorial):- WAN to VPN SSL, I don't think this have problem, since client can connect to vpn ssl.- VPN SSL to LAN, I assume this has no problem, since client can access LAN after connect vpn ssl.- VPN SLL to WAN, with configuration:source: all IP, list of users vpndestination: allservice: allNAT: ONAV: ONaccept connection. fortigate restarting. client connect to vpn ssl, success.but client can't access internet (trying browsing any website). need help please. thank you

Hi,We’re using multiply Fortigate 60E, v6.2.5, firewalls on multiply locations, they are connected through a IPSEC tunnel to one location, also a Fortigate, that works fine.The main location use a SIP PBX server and other locations use Sip Phones (Gigaset N300A).The Gigaset-phone will registering fine over the IPSEC tunnel, that works great. If the tunnel is down, of course the Gigaset don’t work anymore.But if the tunnel is recovering and automatically gets up when available, the Gigaset won’t register anymore. We’ve to power down the Gigaset phone for about 10 minutes, reconnect and all works fine.In the former Cisco configuration, this problem is not there, in the new Fortigate configuration, the problem occur. In Cisco configuration it works fine, so it’s not a problem on the Gigaset phones.Is there a setting I can check for this problem? For example, if there is a power down on the main location, we’ve to reset all the Gigaset phones on other locations and that is a problem. 

Hi, experts, I found internet access issue from the Fortigate, as the attached Dashboard (WAN IP can not be detected, and ... ), Due to the internet line is configured as below(the primary IP is private):the primary IP is : 10.10.10.2/30 (peered to the upper Layer3 device )the secondary IP is : 100.100.100.100 ( for internet access ).  any advice in order for the Fortigate being able to access the internet, thx a lot ? 

Whats the procedure like for changing a Fortiswitch from a standalone to one that's managed by a Fortigate?  I have 3 Fortiswitches in production that are working as expected and would like to have them managed by our Fortigate cluster however I don't want to lose the configurations on any of the switches. Any advice would be appreciated.  Thanks in advance!

Hi,I have read many times about emac-vlan and how it is supposed to be implemented. But finally when I tried to do it, it doesnt work like expected.Topology is like this: TRUNKundo port trunk vlan 1 (no default/untagged vlan)(vlan 10) [L3SW | 10.1.10.254] <---> [10.1.10.1 | Forti vdom root]     <- this is main connection to ROOT.Vdom, with internet, MGMT int. and all(vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.1 | Forti Vdom1](vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.2 | Forti Vdom2](vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.3 | Forti Vdom2] The goal was to implement emac-vlan interfaces on vdoms1-3, but after setting vdom1 (with vlan tag 11), i cant do it on Vdom2 - getting info that vlan is used by another software switch.I have similar setup on the WAN side, difference is that I want to use two different ports for one vlan 13 - one for root, one for vdoms. And its the same story, after setting vdom1 with emac in vlan 1