Solved

Hi,I'm trying to run a traceroute from the CLI and also windows pc but unfortunately it does not give me the full hops for troubleshooting.From the policy settings, I've enabled the below configs: From the interface: Traceroute from CLI Is there something blocking this or have i missed something?

Good Day, I am new to the forums so forgive me if this is not posted in the proper spot. I am trying to enable the Dynamic Threat Detection part of the client. I can install the client as a standalone and it is enabled. But when we connect it to our EMS the feature is no longer enabled. I have looked through every screen that I can find and have had no luck finding where to enable it again. Can someone give me some guidance as to where to enable this feature? Thanks in advance. Fraser

I need a small /124 network for routing topology so I can use my IPv6 assigned by my service provider. Since these are Global Unicast addresses, I want to assign them to my servers; however, I need a transient network that is connected to my edge router and the devices down stream, since my IPv6 network is not all Global Public addresses. Due to the latter, does Fortigate distinguish differences (i know some vendors do) for routing between Link Local and unique Local?

I am reading over the documentation https://help.fortinet.com/fweb/561/Content/FortiWeb/fortiweb-admin/planning_topology.htm and I need the benefits of Reverse Proxy; however, I do not understand how the One-Arm reverse proxy works. If everything is on the same network segment, then layer 2 frame will just forward out the interface it was seen from. However, there is some warnings about Inline Reverse Proxy, and non HTTP/HTTPS traffic. Does the One-Arm Reverse proxy works when protect servers will be on a different subnet. I imagined this would be installed In-line and create rules that ignore the policy engine when (a)specific server was in destination with (b)specific traffic port. The latter would be no different then forwarding traffic around the unit, but the link to documentation says something about Performance and security. The One-Arm deployment seems like a number policy routes or virtual port forwarding would need to be created. Again, just even sure what the default ga

Hi friends,I have a scenario where one Fortigate firewall in behind the NAT, means Its WAN interface has private IP which is then NATed with some higher level network device to one Public IP, from internet using the Public IP I can access firewall web interface, but when I configure an IPSec remote access VPN, and try to connect with forticlient VPN and using the firewall's public IP, forticlient is not able to connect with firewall. I have tried from windows and android but same problem, if some one have any idea for solving this issue then kindly guide me.Thanks

According to FortiOS Handbook (Version 5.4), to create guest user account I need to create a guest type user group, then create user under guest management. My environment (school) would like to specify username instead of using autogenerated user0xx. Therefore I have to create a new one/change after auto-generated guest account. I found this process tedious when I have to create/edit a bunch of users a day.  The handbook didn't state the way to create guest user account under command line. Is it possible to do so under CLI?

Hi all,  I hope you can help me, I am kind of new with Fortigate and networks, I was asked to disable internet access in our Domain Controller, so I thought "that is easy", so I configured a Rule to block  internal interface - DC IP address to reach wan1 (internet). and it worked, but the thing now is that all domain computers are not able to access internet neither, any suggestion? best regards

I have a remote user that for an unknown reason started to have issues connecting remotely. No changes were done on the Fortigate. According to the user not no changes on the remote user side network (same ISP, same router). Previous to the issue they had been connecting without any issues since it was setup months ago on a daily basis. FortiClient connects but I lose Internet access and I cant ping the devices at the main office. I also noticed that I dont get an IP assigned. I already restarted the Fortigate and deleted and recreated the FortiClient VPN. Office/Fortigate network/subnet is 10.10.10.0Remote sites network/subnet is 10.0.0.0 I have experience issues in the past with overlapping subnets with FortiClient, but in those cases the device connecting remotely didnt loose Internet access, it just had issues accessing some devices at the office if some IP overlapped. They have been working fine for months Could it be issues with the subnets? Somethin

Forgive if this is loaded somewhere else. I'm running into a snag here.  I am currently on Spectrum and getting a /128 from them.  According to my WAN1 interface.   I am trying to get the DHCP to passthrough to my clients on a vlan, anyone have any luck with this?

Hello guys !I'm new to the VPN environnement, and trying to configure a site-to-site VPN tunnel between two Fortigate 60D.At the step "Pre-shared-key", I don't know if it's a specific key to the device (in that case where can i find it ?) or it's a secret word that i can randomly create and share between the two fortigates.I know that the PSK must be shared before any login/pasword authentification, but my question is:Where to get the PSK from ? Or I can create it myself ? Thanks !

Hello all. A lot of remote access IPsec clients see random phase2 down messages. I was wondering how do i go about getting to the root cause of each phase2 down instance? I'd like to know if it was just due to DPD deciding FGT can't see the client for a period of time so it yanks the tunnel down or whatever else might cause it. Usually when DPD's the culprit, I see log messages about it prior to the phase2 down message. Can anyone point me in the right direction? 

Goodday everyone, In one of the ipsec vpn, both phase1 and phase2 configuration show "set proposal "aes256-sha1 aes256-md5".what is the need for two authentication & encryption methods for a single ipsec connection and how will this work?   

Hi there, I'm getting something odd happening which I've never seen before, I am intermittently getting DNS queries answered with a 198.18.x.y address. Using Fortiguard or local DNS servers doesn't make any difference to the behaviour. It happens with both local clients and through the CLI on the box. For instance:  Have to say I've no seen that before! Any ideas? Thanks, Jon

HelloI Have one client using vpn site-to-site with my company, now another customer has appeared in which the network segment is the same as that of the first customer, that is, both have the 10.1.0.0/16 network "Phase 2 Selectors - Remote Address" . How would you handle the ipsec tunnel for this other customer? Thanks all

If a FortiWiFi is in place and the FortiWiFi wireless is in use, can one or more FortiAP‘s be added using wireless provided by the FortiWiFi wireless as well as the FortiAP wireless? Can this arrangement function as it does with 2 or more FortiAP’s including roaming and the same SSID’s on all access points?

Hi everyone!  I need your precious help about this scenario, please see attached diagram below. What do you recommend as being the best way to configure HA on these 2 Fortigates to work properly?Active-Active or active-passiveEach one of the Firewalls is connected to ISP through only 1 link and the ISP is the same but has configured VRRP between ISPRouter1 and ISPRouter2.  Thank you so much!  Regards!

Hi,we have a problem with forticlient, the traffic to a site stops every hour for 2 minutes. They are all IPSEC and the connection does not drop. This does not occur on locale site network but only for remote connection. I saw that I can't change the values of the standard vpn configuration from the fortigate. Some idea?Tnx

We see many false positives in the compromised hosts list, to the point where it makes the list almost useless. Most of them seem to be legitimate web advertising that is detected as Malware CnC. The most common of these is assets.ubembed.com and <randomstring>.js.ubembed.com. Is there some workaround to whitelist these or otherwise reduce the number of false positives?

So i'm completely new to Fortinet and have a new 60F and S124EP switch for my lab. The 60F is connected to Forticloud and the S124EP is connected to the 60F using FortiLink. I'm looking at building out a few VLAN's and having a hard time understanding the best place for the gateway to live for these. Should everything be built on the Fortiswitch and have that do DHCP and everything or should all the VLAN interfaces be built on the 60F? Suggestions? Advantages one way or another?

Hi, Fortinet guys, I am fully new to Fortinet products. Recently, my company purchased a pair of Fortigate 400E to set up HA structure. May I know if the Fortigate 400E:1. Active-active mode is good deployment for Fortigate 400E ?1. Supports "FGCP HA with 802.3ad aggregated interfaces" ?2. Which 2 interfaces are used/good to be deployed Heartbeat interfaces ? Many thanks in advance. 

Greetings.  Here is my situation, and I would like some suggestions. We have 2 branch offices.  Branch office 1 has a FortiGate 100F, and 2 internet connections, different ISP's (WAN1 and WAN2 respectively). Branch office 2 also has a FortiGate 100F, but only ONE internet connection (WAN1). I would like to accomplish the following: 1. Branch 1 failover internet connection - when WAN1 goes down, traffic is pushed over to WAN2. When WAN1 is restored, traffic jumps back over to WAN1.  Essentially make WAN2 a backup connection...only activated if WAN1 fails. 2. Site-to-site VPN connection between the 2 sites, but with redundancy.   So, if 1 of the 2 internet connections goes down at branch office 1, the site-to-site VPN will not be disrupted. What is the best way to accomplish this?  SD-WAN..priorities....CLI magic? I'd appreciate some assistance! Thank you for your time!  

Does anyone know that FortiOS 6.0.10 supports FAP-231E? When will this version 6.0.10 be released?Thanks！

Hello every one,My cisco AP ( cisco 2802iS K9) can not assign form DHCP server ( user FOrtinet300d), i refer on Cisco comunity .need enable DHCP option 43 on DHCP server,how to enable DHCP option 43 and input correct value on Fortinet DHCP ? thanks so much 

Trying to learn more about the FortiSwitch. I see that when using multiple FortiSwitch switches it is common to use ISL between the switches. Will this restrict connection speed between switches? In other words what bandwidth does this ISL support?

Is there any way to block fake "Client" field just like the one on the attachment? In the attachment, there is "Header from" field pointing to an appropriate (trusted) sender, but the "Client" field displays unwanted and potentially dangerous sender. If there a method to block such fake senders?