Solved

Hello,We have an Hub n spoke architecture.Each spoke (3) can ping networks each other (NAT disabled). When NAT enabled on spoke zone to spoke zone, spokes can't ping each other. At this time, Internet access on spoke sites pass throught their Internet connection (WAN interface on each spokes)We want to pass Internet access throught HUB to manage all Internet Policies from the HUB. Is it possible? Thanks.Regards.Waaalex. 

Hi guys, Our company is implementing SSL VPN with Client Certificate which will authenticate by our Fortigate.However, many of our company users are not able to login with client certificate. Users with administrator rights have no issue to login. The reason is due to these users do not have administrator rights or read permission to access the client certificate's private key. In Windows Group policy, as I know there is no such settings to grant certain read permission to Certificate's private key. Anyone has any experience or encountered the same challenges while do not want to grant administrator rights to normal users? Thanks! 

Hello,we have upgraded our FG300D (not connected to the internet) from 6.2.0 to 6.4.2 this morning.After the reboot, the FG asked for a configuration to join Fortiguard servers.This is impossible : the FG is placed to filter an "internal" link between to sites on the LAN (the other side is a FG (v6.2.5))Since it failed to connect to the internet, it started, but le licences widget states "unable to connect to Fortiguard servers" and it apparently tries all the time...Is there a way to desactivate this fortiguard interrogation ?Is fortigate still able to work without an internet connection ? Thanx for your help Jean-Yves

Hi guys, I would be interested in what is the best/most reliable way to ensure that traffic is sent into an IPsec tunnel.I.e. if I can see outgoing Traffic within the IPsec Monitor and I also see packets when starting a packet caputre on the VPN tunnel - does that confirm that the traffic is sent trough the tunnel? Is there any (better) option to confirm this? Best regardscust0m

hello there,please help.we using FG30E with firmware 5.6.12we have created vpn ssl with tunnel mode, and client can connect successful.we have create 3 policies (as shown video tutorial):- WAN to VPN SSL, I don't think this have problem, since client can connect to vpn ssl.- VPN SSL to LAN, I assume this has no problem, since client can access LAN after connect vpn ssl.- VPN SLL to WAN, with configuration:source: all IP, list of users vpndestination: allservice: allNAT: ONAV: ONaccept connection. fortigate restarting. client connect to vpn ssl, success.but client can't access internet (trying browsing any website). need help please. thank you

Hi,We’re using multiply Fortigate 60E, v6.2.5, firewalls on multiply locations, they are connected through a IPSEC tunnel to one location, also a Fortigate, that works fine.The main location use a SIP PBX server and other locations use Sip Phones (Gigaset N300A).The Gigaset-phone will registering fine over the IPSEC tunnel, that works great. If the tunnel is down, of course the Gigaset don’t work anymore.But if the tunnel is recovering and automatically gets up when available, the Gigaset won’t register anymore. We’ve to power down the Gigaset phone for about 10 minutes, reconnect and all works fine.In the former Cisco configuration, this problem is not there, in the new Fortigate configuration, the problem occur. In Cisco configuration it works fine, so it’s not a problem on the Gigaset phones.Is there a setting I can check for this problem? For example, if there is a power down on the main location, we’ve to reset all the Gigaset phones on other locations and that is a problem. 

Hi, experts, I found internet access issue from the Fortigate, as the attached Dashboard (WAN IP can not be detected, and ... ), Due to the internet line is configured as below(the primary IP is private):the primary IP is : 10.10.10.2/30 (peered to the upper Layer3 device )the secondary IP is : 100.100.100.100 ( for internet access ).  any advice in order for the Fortigate being able to access the internet, thx a lot ? 

Whats the procedure like for changing a Fortiswitch from a standalone to one that's managed by a Fortigate?  I have 3 Fortiswitches in production that are working as expected and would like to have them managed by our Fortigate cluster however I don't want to lose the configurations on any of the switches. Any advice would be appreciated.  Thanks in advance!

Hi,I have read many times about emac-vlan and how it is supposed to be implemented. But finally when I tried to do it, it doesnt work like expected.Topology is like this: TRUNKundo port trunk vlan 1 (no default/untagged vlan)(vlan 10) [L3SW | 10.1.10.254] <---> [10.1.10.1 | Forti vdom root]     <- this is main connection to ROOT.Vdom, with internet, MGMT int. and all(vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.1 | Forti Vdom1](vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.2 | Forti Vdom2](vlan 11) [L3SW | 10.1.11.254] <---> [10.1.11.3 | Forti Vdom2] The goal was to implement emac-vlan interfaces on vdoms1-3, but after setting vdom1 (with vlan tag 11), i cant do it on Vdom2 - getting info that vlan is used by another software switch.I have similar setup on the WAN side, difference is that I want to use two different ports for one vlan 13 - one for root, one for vdoms. And its the same story, after setting vdom1 with emac in vlan 1

Hello, folks. I'm fairly new to FortiGate and I'm in the process of configuring an 80F to replace a Cisco RV320 router. The RV320 has 4 sub-interfaces tagged with their respective VLANs:- x.x.0.1 (default), x.x.10.1 (vlan10), x.x.20.1 (vlan 20), x.x.30.1 (vlan 30) The Cisco core switch has virtual interfaces for each VLAN:- x.x.0.2 (default), x.x.10.2 (vlan10), etc.- Each VLAN interface points to a Windows server for a DHCP-helper address- The DHCP scopes for each VLAN subnet points to the respective switch virtual interface (x.x.x.2) for its gateway- The core switch has a single default route pointing to x.x.0.1 on the RV320- The core switch is connected to the RV320 by single trunk port that carries all VLANs As I'm setting up the 80F I thought it would be nice for each VLAN to have a dedicated physical port on the FortiGate to avoid having congestion on a single shared trunk port:- I removed 3 ports from "internal" and configured them as standard ports (not VLAN) each

I am running a 500D HA setup at my production site and a single 500D at my backup site. All 3 devices are running 5.6.3 build 1547. Questions: Do people upgrade just because a newer version is available or do you only upgrade for vulnerabilities or needed features? Has anyone upgraded from  from 5.6.3 -> 6.2.3 using the Fortinet upgrade path and experienced problems outside of those in the release notes?    

Hi,Firewall is in   flow mode .If I change the antivirus inspection mode to proxy mode what is pros and cons Thanks  

Hi,Can I configure EMS via my fortigate (300D) or do I need to install the EMS server software?  I am trying to avoid installing the server software. Thanks 

Hi, Experts, Any document or configuration for Fortigate firewalls ? If an Internet line has only 100Mbps, how could I tell/configure the link bandwidth to Fortigate, in order to control the bandwidth allocation for different usage, for example:1. 30Mbps for voice2. 40Mbps for SAP application3. 30Mbps for user web surfing Many thanks for your information in advance.

Traffic ShaperI have traffic shaper policy . even if i reduce the download speed speedtest shows the maximum bandwidthfor example if I change to 10 Mbps ,it shows 100 MbpsThanks 

https://docs.fortinet.com...n-and-supported-models

I'm having trouble applying a route map to stop a FortiGate 201E from advertising certain connected subnets via BGP. In my examples below I've only shown one prefix. I actually have 6 I want to stop advertising. I also want this FGT to continue advertising the default route. I've tried a prefix list with the deny action set on the rules, and applying the route map to the neighbor, like this config router prefix-list edit "ISP_allowed_eBGP" config rule edit 1 set action deny set prefix 10.10.10.184 255.255.255.248unset geunset lenext   edit 2set prefix 0.0.0.0 0.0.0.0 unset ge set le 32next end end   config router route-map edit "ISP_allowed_eBGP_route_map" config rule edit 1 set match-ip-address "ISP_allowed_eBGP" next end next end   conf router bgpconfig neighbor edit "10.10.10.189" set route-map-out "ISP_allowed_eBGP_route_map" next end end I also tried 2 cresting separate prefix lists and setting the deny action on the rules within the route map, l

hi,i have a fiber link from ISP which is connected to router or modem provided by ISP. from that 1 link is directly connected to firewall with an ip 172.x.x.x. when i select the interface in SSL VPN config i get 172.x.x.x IP. how can i config interface so ddns can work with sslvpn.i have contacted support and he said you need to config 0.0.0.0/0.0.0.0 but it doesn't work because from modem private IP is config. i cannot connect directly because its fiber link and our firewall 101F doesn't have fiber port.kindly assist.

We work with a number of offices that use some version of the 50 to 100 series FortiGate firewall. One worry I have is a hardware failure. Though I have only seen 1 failure ever of an in-production firewall, the risk is still a factor. Waiting 1 or 2 days to receive a replacement unit could be costly to the users. I realize that we could run with High Availability (HA) but this would amount to a 2x the firewall purchase and support bundle cost. Is there a way to keep a spare firewall in house and to replace a failed firewall with the spare in the event of a failure? If this is done I presume that the configuration could be imported from the last backup of the failed firewall. Could the support bundle be transferred to the replacement firewall? If not I presume that the replacement firewall could run temporarily without these services. Are there any other considerations that I am overlooking?

Hello all, Is there any way to forward select login events from the DC to the Collector Agent similar to syslog style? 

I had 3 WAN connection (ADSL modems) providing internet access to my company. I brought 4th connection which has a fiber metro connection by the switch and connected to my 4th port.1 - First set the new interface (named as metro_port). I selected role as WAN, Addressing mode as manual and IP/Netmask as ISP provided.2 - At Second step i defined Static Route. I gave destination to 0.0.0.0/0.0.0.0, interface as set up in the first step(metro_port) and gateway as ISP provided.3 - At third step i have insterted a new Policy Route in order to set my computer go out to internet over metro_port.4 - I set up a new Firewall Policy, incoming as Lan, Outgoing as metro_port, source as my computer's IP address. Selected NAT enabled. To maximize priority of this policy i dragged it to the first in list. Now unless unplugging or disabling my old WAN connections (ADLS modem connections), i cannot use new WAN connection to use internet access. I checked log tables, it doesn' even use to this policy

Hi, We are builting a virtual lab with the wonderful "Eve-ng", and for being able to restore quickly a configuration, we would like to use the "USB Device" via "execute restore config usb <file>". But we have to simulate the USB device through QEMU option. Could someone help us on this topic ? Thx.

Dear all, We are currently trying to split our compagny, and as well the network/security infrastructure. To do so, we set up VDOM on a Fortigate - FortiOS 5.6.4 (current VDOM root = the old "global" before VDOM enable, and VDOM NEW-CORE = the VDOM added to design a new infrastructure). Initially, the VDOM root has an OSPF area 0 and is peer with another Fortinet (working fine today) with the same area 0. When we tried to add the router ospf area 0 in the VDOM NEW-CORE, there was an incident : lost of the production flows on the VDOM root, as if routing was NOK after the change on the VDOM NEW-CORE. A rollback solved the issue. In summary, my question is : can we have OSPF area 0 running on multiple VDOM ? PS: Due to another CPU issue, we recently updated on FortiOS 6.2.4 Thank you in advance for your answers. Best Regards,

When I tried to import the Policy from FortiGate 400E with firmware V6.0.6 to the FortiManager the below error appeared, So can anyone help me to solve this issue, Thanks in advance. 

Hi; Can a Fortigate Firewall running version 5.2.x or 5.4.x insert an XFF header?  If yes, how exactly can this be done? Does it apply to the following models? or it will apply no matter the models?1500D, 600C, 1000C, 300D, 2000E KindlyWasfi