Solved

Hi There,  I'm pretty new to Fortigate Firewall. I have a requirement to integrate the firewall for LDAP authentication.Initially I have tried to add the LDAP server and perform the test connectivity and it failed. Later when I checked the firewall I noticed that the LDAP server is not reachable when I use the execute ping command. I have below questions.[ol]While trying to reach out to the LDAP server does the firewall by default use the Management interface or will it refer to the routing table and use the traffic interface as per the routing?I was also trying to perform the test from the Firewall by executing the ping command with the management interface IP address as the source IP address also I noticed that the ping is enabled for the management interface. But the ping command failed from the firewall. I went on to check the switch connected to the management interface and from there I was able to reach the LDAP server by setting the source address to management VLAN interfa

After our laptops update to Windows 10 v2004, they will no longer connect to our WPA2-Enterprise FortiAP WiFi network. We have troubleshooted and checked our RADIUS/NPS settings, and they are correct. The users get authenticated, but the connection fails with this message in the FortiGate Logs: WPA-invalid-2/4-key-msgProbably wrong password entered, invalid MIC in 2/4 message of 4-way handshake from client  The laptop's event logs report "Dynamic Key exchange did not succeed withing configured time" Other laptops still on Windows 10 1909 can connect just fine. And if we roll back the Windows 10 update to 1909, it will connect again. If we take the laptop to our other office with Aruba AP's they connect just fine. So it's something to do with the Windows 10 2004 update and the FortiAP 221E Access Points. We just can't figure out how to fix it. Any ideas or suggestions would be greatly appreciated! Thanks!

Hi AllI have a filtered list of nearly 4000 devices in the Device Inventory of a 1500D FortiGate I support and wondered if there is a way to export the list Thanks in advance

a FortiGate 200D firewall on my side needs to update the firmware.currently its firmware verison is v5.0,build0318 (GA Patch 12) i tried searching for recommended upgrade path of firmware for this device in here https://docs.fortinet.com/upgrade-tool, however, not so sure about it. alright, the question is, in order to upgrade the firmware from v5.0 build0318 to v6.0.10,I had to upgrade to version 5.2.9, 5.2.11, 5.2.13, 5.4.10, 5.6.9, 5.6.11, 6.0.10 in sequence? update for like 7 times?!!what about the upgrade between v5.0 build0318 and version 5.2.9??? can i  jump from v5.0 to 5.2.9?

Just got an old fortigate 200D firewall but not familiar with it.I wanna aggregate two ports together and link them to downlink 2 switch ports. would like to know:is it doable to aggregate 2 ports together and link to switch ports (to increase bandwidth)?if so, then will the port speed be limited to the lowest automatically?(the switch port speed is 10Gb using CAT6 cable) thanks in advance

Hi, Please help me using my fortigate 100D as aggregate switch just as we do in Cisco layer 2 switch as below : interface GigabitEthernet1/0/33  switchport trunk native vlan 400  switchport trunk allowed vlan 2,3,400  switchport mode trunk  switchport nonegotiate  channel-protocol lacp  channel-group 11 mode active ! interface GigabitEthernet1/0/34  switchport trunk native vlan 400  switchport trunk allowed vlan 2,3,400  switchport mode trunk  switchport nonegotiate  channel-protocol lacp  channel-group 11 mode active and interface Port-channel11  switchport trunk native vlan 400  switchport trunk allowed vlan 2,3,400  switchport mode trunk  switchport nonegotiate I tried to do it as creating new interface 802.3ad aggregate with 2 ports but even after applying and enabling those ports, new interface shows down.  I have no idea if it is supported on FGT 100D.Please help RegardsR

Hi, Experts, I am going to set up the Forti600E HA pair. and would like to configure the active-active mode, any recommendation ? Many thanks in advance.    

Hello, Smaller devices like the 30/40/50/60 models do not have a dedicated mgmnt (oob) interface. How do i monitor the passive cluster member as it does not have such a mgmnt interface? thx, screenie

I have a FG200D and we are getting ready to receive a new Cradlepoint 3G/4G router for failover of the main office only. The plan is to connect it to WAN2. My question is this: Would it be better to use WAN LLB and set a sky high priority like 99 for WAN1 and 1 for WAN2, or would it be better to use two static routes and weight them accordingly? I mainly want to make sure WAN2 isn't going to be used unless WAN1 is absolutely down. I don't mind a small amount of traffic for health check but we are only allotted so much data per month on the fail over service without overage charges. I've seen multiple posts about this and read multiple articles, but couldn't really determine the best method from those. I've only known FortiOS 5.4, which apparently isn't the favorite for this setup since most of the failover documentation still references 5.2. Opinions and thoughts welcomed and thanks in advance. Kevin

helloi have a only one subnet that don't much with any ipv4 policy, when i check the router loockup i find the route to this subnet but when i use loockup policy to this subnet they much with poiciy id=0  knowing that i have policy from my vlan to wan with source set to any and destination set to any and all service are accepted

Good Morning Everyone, My 2 questions are hopefully very simple and probably a duplication of questions previously asked... 1. Are the FortiTokens still the valid way to handle Two-Factor Authentication with FortiGate products for SSL VPN2. I'm testing with the 2 free tokens. If access to the VPN is granted through an Active Directory group, the VPN does not ask for the FortiToken. If a user is granted access to the VPN using only their users, the FortiToken is required. Any ideas? All the best, Dan

Hi ,When you set a traffic shaper to be per policy, the FortiGate applies the traffic shaping rules defined to each security policy individually. For example, if a traffic shaper is set to per policy, with a maximum bandwidth of 1000 Kbps, any security policies that have that traffic shaper enabled get 1000 Kbps of bandwidth each. For example, if a traffic shaper is set to per policy with a maximum bandwidth of 1000 Kbps and applied to four security policies, each policy has the same maximum bandwidth of 1000 Kbps. I really got confused about the security policy mentioned here . I can see  tarffic shaping policy The same rule is apply for traffic shaping policy also ? Please help Thanks

Hi, guys, We have Fortigate 400e HA pairs, and the HA cables (two cables for HA ) are connected directly (i.e Forti400e -UTP cable- Forti400e). May I know if these two cables could be Lacp ? Also what are optimal values of the configurable setup for HA synchronization ?  Many thanks

Hi,I want to limit bandwidth  for windows update which is initiated by local LAN computers  The question is the below policy is ok ?  (source will be all and destination will be all )  Q2. If I want to use  "shared shaper"  instead of  "reverse shaper" ,What need to be done ,(Just for learning )  Q3 .  In shaper "windowsupdate"  I have  set 10Mbps .In my question If I use the same shaper  in multiple policies (for example in policy 1 and 2 ) , the 10Mbps will be divided  between policies ?  Thanks 

i am using ssl vpn with untrusted certificate, i wonder is this connection secure?can someone give me an advice?

hello allwe have 2 wan links peered with ISP for internet redundencywe are able to recive the 0.0.0.0 defult route from ISP Via BGPmy question regards a third wan link we own for CAM use , it uses a static route to the internet aswellbut i cant seem to have both 0.0.0.0 routes in the routing table in the same timeso we cannot acsess the CAM from outsidehow can i resolve this ? i have tried to put same distance and diffrent priority but the BGP route disapeers . .anyone came accross this issue ? Routing table for VRF=0 S       0.0.0.0/0 [30/0] via 192.117.0.*, port3 B    *> 0.0.0.0/0 [20/0] via 192.117.9.*, wan1, 03:22:58    

https://docs.fortinet.com/document/fortigate/6.4.1/fortios-release-notes/760203/introduction-and-supported-models Has someone tried this version already?

Hello!I'm running into a problem with our Fortigate 100E running 6.0.7. The crux of the matter is that the firewall policy contains these two entries (among others):edit 55     set srcintf "wan1"     set dstintf "any"     set srcaddr "BLOCKLIST"     set dstaddr "all"     set schedule "always"     set service "ALL"     set logtraffic all     set fsso disable next edit 46     set srcintf "wan1"     set dstintf "port1"     set srcaddr "all"     set dstaddr "DNAT_TCP_22" "DNAT_TCP_443" "DNAT_UDP_53"     set action accept     set schedule "always"     set service "PORT_TCP_22" "PORT_TCP_443" "PORT_UDP_53"     set logtraffic all     set fsso disable next&nbs

hi. i've read this articlehttps://docs.fortinet.com/document/fortigate/6.0.0/handbook/964247/dual-homed-bgp-example and at some point, there is an instruction to do an inbound policy from the isp back to the company lan. isn't that dangerous? why is it needed? isn't the only important port from the isp back to the internal network is the bgp port?

Hello, wondering if FQDN would be supported as a real server's address in a load balancing config? It seems that just IP addresses are supported but not using a FQDN? Thanks,Holger

Hi all, i have 2 FGT 800C running in HA mode Active-Active before 3 days ago i have upgraded the firmware from 5.2.4 to 5.4.2 using proper upgrade path which provided by fortinet 5.2.4 > 5.2.6 > 5.2.9 > 5.4.2, after upgrading the firmware i noticed that FGT GUI is very very slow especially when i navigate to polices page took like 3 to 5 mints to open. i have opened ticket with foritnet support and waiting for their reply, did anyone faced this issue? Note: i changed the HA mode to Active-Passive, matched HA Hash, and restarted the both units. Thank you.

i want to use a 100F in HA mode but the 2 devices will at opposite ends of a long building so i was going to run the HA over fibre but the HA ports are RJ45 (ethernet) can i use any port for HA or will i have to run Cat5/6 for the HA? 

Hi, Interface1 interface2I have created the policy source is interface 1 and destination is interface 2Why do I have to create a policy in reverse direction ( I mean source is interface 2 and destination is interface 1)Thanks 

Hello i have a problem about reset AP222E  so i try more time but i can't reset !!  So what's the problem exact and how i can resolve !!! Also this AP222E can't receive any DHCP !!! Please someone expert can reply me and help me Thanks in advance

90D has high CPU utilization almost all the time, using dia sys top, netscan runs at 95% almost all the time. Any ideas?