Solved

Hey Comm, my problem is, that on windows i can configure the forticlient very good, but on mac i can't configure the vpn connection correctly, because i don't have the advanced settings for IPsec, Phase1 and Phase2. So the client can't connect to our firewall. Is there any trick to get these settings? I have tried many other forticlient versions but in no version the advanced settings are displayed.  thanks!    

Hi, I was trying to find information about MAC address table size for some FortiGates (more specifically 100F, 200F, 500E and 600E). This information is not available on the datasheet and I'm wondering if there any other source available that could have this?

Hi! I already have a working setup where i have 2 WAN, one LAN and one DMZ set up. I have a VPN SSL Tunnel set up on WAN1. My situation is that my WAN1 is a 6mb connection and my WAN2 is a 50mb connection. VPN gets in via WAN1 connection. Users can login and work ok. So policy are set up ok. Now with new COVID protocols and many users working from home that 6mb connection isnt enougth. Trying to set up the VPN to listen on WAN2 but i cant get it to the Fortinet login (portmapping the public WAN2 ip and nothing listening on port 443). Got one default route for WAN1. No default route for WAN2. Some computers gets internet from WAN1 and other computers get internet from WAN2 (through a proxy). Both cases have internet and can reach the internet with the correct configuration. Is there a way to troubleshoot why i am not getting the login screen even if fortigate is teeling me that is listening on the interface?

[style="vertical-align: inherit;"][style="vertical-align: inherit;"]Caro, [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]tenho o seguinte problema. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Configure a conexão VPN site a site com dois fortigate HQ FG 80E e Branch 60E. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]A VPN funciona perfeitamente, as máquinas de ambos os lados se comunicam com sucesso. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Porém, as caixas Fortigate não respondem ao ping em si no modo CLI, eu executo o comando em ambas as caixas com "execute ping + ip".[/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Mostra a mensagem[/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]FILIAL # executa ping 192.168.254.99 <- IP HQ FG 80E [/style]

Hi, I am deciding to buy a Fortigate 60F or 80F for my network.My ISP has 2 separated network(from the same fibre) like most dedicated internet. The dedicated one is 1 gbps, the dhcp one is like 300 or sth. I think the best solution for it would be buying two separated firewall for each room but I kind of want to know that if I could simply plug both cable from the modem into the same firewall and have them running as two separated network. Does it require a Vlan setup to separate them? How does the failover gonna works in above case? Thank you very much.

Hi, I am deciding to buy a Fortigate 60E or a 80F for my network.My ISP has 2 separated network(from the same fibre) like most dedicated internet. The dedicated one is 1 gbps, the dhcp one is like 300 mbps. I think the best solution for it would be buying two separated firewall for each room but I kind of want to know that if I could simply plug both cable from the modem into the same firewall and have them running as two separated network. Does it require a Vlan setup to separate them? How does the failover gonna works in above case? Thank you very much.

In reviewing specs of the FortiGate 40F vs. the 50E the 40F looks very capable. Is there any reason to purchase the 50E over the 40F? Are there any issues with the 40F that I should know about? Thanks.

As part of an office move we are upgrading from a FortiGate 30E to a FortiWiFi-60F security appliance. Is it possible to save the 30E settings (users, network, VPN, etc.) and restore them to the 60F? (Obviously settings that don't exist on the 30E such as WiFi would still need to be set up manually.) Or is it necessary to copy the settings by hand?

hi guys i am new in fortigate world, what is different between these two way of publishing a service :1- publish a server with using filtering \services\HTTP2- publishing a server using port forwarder are both work the same way and manner ?is there any technical benefit between them ?

Hi guys, I would like to know why I cannot set my security profiles on my security policies... I cannot found why or how to solve it. When I set a security profile like anti virus or web filter or application control or ips (default or new created ones), I receive a message that it conflicts with the system settings.. I do have license for that because on the status dashboard those are green marked. Can someone help me? :) Thanks and much appreciated. kr, 

Hi guys,  We have Forti400E HA pairs topology ( with FortiOS V6.4.2 ) in the production network, and intend to change the interface MAC add; do we need to change the same mac add for both devices at the same time, or just change the MAC add in primary/master Forti400E ( it will synch the mac add to the secondary/slave Forti400E ) ? Thanks so much for your advice  

Hello I have IPsec Tunnel  wrong named.unfortunately there are more than 300 policy that matching this IPsec Tunnel (and Interface)Its really disturbing daily.Is there a way to change it from command line or GUI whithout rebuild all policy?I'm on HA cluster FG-401-E that run 3 VDOM FortiOS 6.4.2Thank you for your help

Hi, I am getting the following log every around 15 minutes on my 50E. Administrator admin login failed from http(127.0.0.1) because of invalid password Any has any idea on what is this could be? Thanks

We are moving our SSL VPN tunnel users from Pulse Secure to FortiGate (6.0.6). In Pulse Secure, we can limit access based on the remote user's MAC address. I found https://kb.fortinet.com/k....do?externalID=FD41648 which describes how to configure that for SSL VPNweb mode, but a number of our SSL VPN users will be using tunnel mode exclusively. Is there a way to configure a mac-addr-check in tunnel mode via a host check option? If not, is there another way to limit access based on some other unique feature of a remote device? Kind regards, Herta

100D's in HA: The internal network is set for 10.4.1.x/24We also have other internal networks from 10.1.1.x to 10.8.1.x that can all talk to our primary 10.4.1.x subnetOur other networks are each on their own VLAN which is all handled by our core switch. Currently, our Aruba 5406 does all the routing from the other subnets.ip default-gateway 10.4.1.9 (FortiGate) ip route 0.0.0.0 0.0.0.0 10.4.1.9 In order for the firewall to be able to communicate to the other local subnet for AP discovery with FortiManager:[ol]Should we just change the subnet on the internal interface from /24 to /12 : 10.0.0.1 - 10.15.255.254Or would it be better to create some kind of loopback interface?[/ol]We just received two new 600E's that we'll be upgrading to soon as well. TIA

Hello all,I want to let subnet 10.0.0.0/8 out to the internet, however, i want to filter out 10.1.100.0/24. How do I do it in my 100F? Sorry, moved to Fortigate from a different product. 

Hey community, I am relatively new to the platform and I have been given FAZ as the main product I will be working on. I have looked in the forums and on a lot of other websites like fortiguru but I cannot find an answer.  Is there a way to use an event handler so that if a Firewall stops sending traffic for a couple of hours to send an alert via email to a group of people? I see you cannot put a 0 in the value field of a handler so I cannot do something like if 0 alerts for "firewall" for the past 1 hours, send an alert.  Any suggestions would be helpful. Thanks!

Trying to restore a configuration from file to a pair of 60e but keep receiving the message below. I downloaded the config directly from a production device so I *know* its good. Have tried on 2 different 60e. 2 usb drives. Factory reset both firewalls.  Firmware is the same level on the device as on the config. Google shows virtually nothing for the return code. I'm lost here.  FGT60 # exec restore image usb config.confThis operation will replace the current firmware version!Do you want to continue? (y/n)yPlease wait...Copy image config.conf from USB disk ...Get image from USB disk OK.Check image error.Command fail. Return code -28

Hi, Color me clueless.... I'd like to connect my Fortigate 100F to a Vertiv Avocent ACS 8000 Console Server. How do I go about doing this when the Fortigate uses a RJ45 console port? In advance, Thanks so much for the help. 

Hello. We have an RRAS server (Windows Server 2016) for VPN Access. It is currently using PPTP and we are working on upgrading it to L2TP for more secured encryption. We are having trouble getting the L2TP pass through the FortiGate firewall from the internet. The setup works just fine if I connect to the server directly (internally), so I know it is the firewall. Logs are showing the policy is accepting IKE connection, but the VPN connection stuck at this step(in screenshots) below. Screenshots for policy, VIPs, and Logs[link]https://ibb.co/jHcGtCn[/link] [link]https://ibb.co/096vFNS[/link] [link]https://ibb.co/5M6NTm3[/link] [link]https://ibb.co/F6vMRVQ[/link] [link]https://ibb.co/YXBPvcj[/link] FortiGate 90E, firmware v5.4.11,build8140 (GA) Thanks for helping! 

On FortiGate 5.6, I've currently got 2 1G ports linked in a LACP aggregate team to a Cisco switch. We are wanting to migrate to a single 10G link via a different switch with as little disruption as possible. The LACP interface configured directly with an IP address (no vlans) and is linked to a number of address and policy elements. Is it possible to remove the two 1G ports and add the 10G port to the aggregate interface in one operation? I assume the 10G would have to be set up as the only member of a LACP aggregate on the Cisco side. I know the guaranteed way would be to move the IP across to the 10G port and then migrate the address and policy elements, but this would be quicker.

got a fortigate 200D old firewall in my company's lab environment.i'm constructing a network topology with 200D and two switches(other brand), and these two SW are providing redundancy for end devices/servers. the topology is shown in attached figure. well... i'm a newbie on networking and not familiar with fortinet's product at all, so my questions are stupid and hope you don't mind:According to my topology, do i need to set STP on 200D to prevent network loop?i want to make the interfaces(which connected to switches) on 200D isolate the switches' broadcast and also be the gateway for redundancy.(i will also utilize L3 routing on switches for VLANs but these VLANs need to reach firewall for internet connection...)therefore if one interface(on 200D) or switch dies, the other one could still provide network traffic for end devices. is there any special settings from fortinet that i need to be aware of on 200D for my network topology?? thanks for answering my dumb question

Using FortiOS 6.0.9. Need to run backups to a cloud server destination (*.domain.com). Was going to add an IPv4 policy with this address as the destination to exempt this traffic from normal antivirus, web filtering, DNS, etc. evaluation. I see that there is a Wildcard FQDN Address list. I created the address in this section but I can not list this address as the destination in the policy. I see that Wildcard FQDN Addresses are to be used in SSL exemptions and should not be used as source or destination addresses in policies. I can't be the first person to have this as a requirement. Is there a good workaround? I think I noticed tat newer firmware versions have this ability but I was trying to wait until the 6.2 and 6.4 versions became more mature but before upgrading.

Hi, guys, I am rather new to Fortinet product; I am configuring the Fortigate 400e with FortiOS v6.4.2;  For logging traffic, I can not enable "set fortiview-local-traffic enable" as the attached. Any recommendation ?( I have only local Fortiview, no FortiAnalyzer, FortiManager, FortiCloud..) Many many thx in advance.

Hello,We have an Hub n spoke architecture.Each spoke (3) can ping networks each other (NAT disabled). When NAT enabled on spoke zone to spoke zone, spokes can't ping each other. At this time, Internet access on spoke sites pass throught their Internet connection (WAN interface on each spokes)We want to pass Internet access throught HUB to manage all Internet Policies from the HUB. Is it possible? Thanks.Regards.Waaalex.