Solved

I hope I didn't get bamboozled on this rather expensive home firewall. The specs show that the WiFi supports 802.11 a/b/g/n/ac but it looks like there's only one radio in the unit so you have to pick between either 2.4 -or- 5 GHz. Is this correct or am I simply doing something wrong? 

 Why "all and guest group" in the source , What if we give "guest group  " only Thanks

Questions to those in the know: 1. In the printout: FG60C (global) # diagnose test application urlfilter 3 Saving to file [/tmp/urcCache.txt] Cache Contents: -=-=-=-=-=-=-=- Cache Mode:   TTL Cache DB Ver: 17.53220 Domain  |IP       DB Ver T URL 1e000000|00000000 17.53219 P B[link]https://vuexcasht3.ad.vu.edu.au/[/link] : what does the "T" indicator show and what values (such a "P", above) can be shown? Also, what does "B" prepending the URL show? 2. is it possible to (regexp or otherwise) filter printout generated by "diagnose test application urlfilter 3" for specific URL? (Currently, I'm forced to use grep on /tmp/urcCache.txt). 3. What is the difference between "diagnose test application urlfilter 3" and "diagnose test application urlfilter 16" 4. When I issue the command, I get an incomplete printout, eg. FG60C (global) # diagnose test application urlfilter 16 Saving to file [/tmp/urcCache.txt] Cache Contents: -=-=

Hi there,I use FG60D, and wanna use VPN web portal.what I've done:- create web tunnel- set AV check- create user and group, then add to portal mapping on menu vpn ssl setting I can reach web portal over web browser, directly, using assigned port.but I can't login, permission denied.am I missed something? unlucky for me, tried to search over forum and fortigate help, but can't find about complete guidance. also, Can I disable this feature, in the future? I mean outside can't reach web portal. please help. thank you.

Hello Everyone if i need my exchange-OWA accessable from Outside i need to create a Virtual IP.eg my public IP is 123.123.123.123 and my internal Exchange IP is 192.168.1.1 So i want that 123.123.123.123 Port 443 maps to 192.168.1.1 Port 443. And here is my question:As far as i can see i have to possibilities to reach my goal. *********************************************Possibility 1) on VIP i configureExternal IP Address/Range: 123.123.123.123Mapped IP Address/Range: 192.168.1.1 On Port Forwarding i configureExternal Service Port: 443Map to Port: 443*********************************************   *********************************************Possibility 2) on VIP i configureExternal IP Address/Range: 123.123.123.123Mapped IP Address/Range: 192.168.1.1And under "Optional Filters" i configure a Service like "HTTPS".*********************************************  Both possibilities work.Buth i guess there is something i don't understand?&n

https://docs.fortinet.com/document/fortigate/6.0.10/fortios-release-notes/760203/introduction

Hi guys, I hope someone can help me. Following scenario: Our customer has a Fortigate 100E unit with Build v5.6.5 installed (I know its outdated), running in "proxy mode" with explicity proxy settings and needs port opening for SMTP, SMTPs, HTTP and HTTPs directly to the Exchange Server for connectivity with O365. I created a Virtual IP 'Public IP -> Exchange Server' with the mentioned services and the fitting policy that allows all Microsoft IPs plus our public ip to access the virtual ip object with all services. As soon as I enable the rule telnet to port 25 is working but the internet connectivity from the exchange server doesn't work. As soon as I disable the rule I can surf through internet and can make a traceroute to www.google.com for example. I also created a explicity proxy rule but the exchange doesn't use the firewall as a proxy. I hope someone had the same behaviour and did found a solution. Thanks in advance!

Hi,I'm trying to run a traceroute from the CLI and also windows pc but unfortunately it does not give me the full hops for troubleshooting.From the policy settings, I've enabled the below configs: From the interface: Traceroute from CLI Is there something blocking this or have i missed something?

Good Day, I am new to the forums so forgive me if this is not posted in the proper spot. I am trying to enable the Dynamic Threat Detection part of the client. I can install the client as a standalone and it is enabled. But when we connect it to our EMS the feature is no longer enabled. I have looked through every screen that I can find and have had no luck finding where to enable it again. Can someone give me some guidance as to where to enable this feature? Thanks in advance. Fraser

I need a small /124 network for routing topology so I can use my IPv6 assigned by my service provider. Since these are Global Unicast addresses, I want to assign them to my servers; however, I need a transient network that is connected to my edge router and the devices down stream, since my IPv6 network is not all Global Public addresses. Due to the latter, does Fortigate distinguish differences (i know some vendors do) for routing between Link Local and unique Local?

I am reading over the documentation https://help.fortinet.com/fweb/561/Content/FortiWeb/fortiweb-admin/planning_topology.htm and I need the benefits of Reverse Proxy; however, I do not understand how the One-Arm reverse proxy works. If everything is on the same network segment, then layer 2 frame will just forward out the interface it was seen from. However, there is some warnings about Inline Reverse Proxy, and non HTTP/HTTPS traffic. Does the One-Arm Reverse proxy works when protect servers will be on a different subnet. I imagined this would be installed In-line and create rules that ignore the policy engine when (a)specific server was in destination with (b)specific traffic port. The latter would be no different then forwarding traffic around the unit, but the link to documentation says something about Performance and security. The One-Arm deployment seems like a number policy routes or virtual port forwarding would need to be created. Again, just even sure what the default ga

Hi friends,I have a scenario where one Fortigate firewall in behind the NAT, means Its WAN interface has private IP which is then NATed with some higher level network device to one Public IP, from internet using the Public IP I can access firewall web interface, but when I configure an IPSec remote access VPN, and try to connect with forticlient VPN and using the firewall's public IP, forticlient is not able to connect with firewall. I have tried from windows and android but same problem, if some one have any idea for solving this issue then kindly guide me.Thanks

According to FortiOS Handbook (Version 5.4), to create guest user account I need to create a guest type user group, then create user under guest management. My environment (school) would like to specify username instead of using autogenerated user0xx. Therefore I have to create a new one/change after auto-generated guest account. I found this process tedious when I have to create/edit a bunch of users a day.  The handbook didn't state the way to create guest user account under command line. Is it possible to do so under CLI?

Hi all,  I hope you can help me, I am kind of new with Fortigate and networks, I was asked to disable internet access in our Domain Controller, so I thought "that is easy", so I configured a Rule to block  internal interface - DC IP address to reach wan1 (internet). and it worked, but the thing now is that all domain computers are not able to access internet neither, any suggestion? best regards

I have a remote user that for an unknown reason started to have issues connecting remotely. No changes were done on the Fortigate. According to the user not no changes on the remote user side network (same ISP, same router). Previous to the issue they had been connecting without any issues since it was setup months ago on a daily basis. FortiClient connects but I lose Internet access and I cant ping the devices at the main office. I also noticed that I dont get an IP assigned. I already restarted the Fortigate and deleted and recreated the FortiClient VPN. Office/Fortigate network/subnet is 10.10.10.0Remote sites network/subnet is 10.0.0.0 I have experience issues in the past with overlapping subnets with FortiClient, but in those cases the device connecting remotely didnt loose Internet access, it just had issues accessing some devices at the office if some IP overlapped. They have been working fine for months Could it be issues with the subnets? Somethin

Forgive if this is loaded somewhere else. I'm running into a snag here.  I am currently on Spectrum and getting a /128 from them.  According to my WAN1 interface.   I am trying to get the DHCP to passthrough to my clients on a vlan, anyone have any luck with this?

Hello guys !I'm new to the VPN environnement, and trying to configure a site-to-site VPN tunnel between two Fortigate 60D.At the step "Pre-shared-key", I don't know if it's a specific key to the device (in that case where can i find it ?) or it's a secret word that i can randomly create and share between the two fortigates.I know that the PSK must be shared before any login/pasword authentification, but my question is:Where to get the PSK from ? Or I can create it myself ? Thanks !

Hello all. A lot of remote access IPsec clients see random phase2 down messages. I was wondering how do i go about getting to the root cause of each phase2 down instance? I'd like to know if it was just due to DPD deciding FGT can't see the client for a period of time so it yanks the tunnel down or whatever else might cause it. Usually when DPD's the culprit, I see log messages about it prior to the phase2 down message. Can anyone point me in the right direction? 

Goodday everyone, In one of the ipsec vpn, both phase1 and phase2 configuration show "set proposal "aes256-sha1 aes256-md5".what is the need for two authentication & encryption methods for a single ipsec connection and how will this work?   

Hi there, I'm getting something odd happening which I've never seen before, I am intermittently getting DNS queries answered with a 198.18.x.y address. Using Fortiguard or local DNS servers doesn't make any difference to the behaviour. It happens with both local clients and through the CLI on the box. For instance:  Have to say I've no seen that before! Any ideas? Thanks, Jon

HelloI Have one client using vpn site-to-site with my company, now another customer has appeared in which the network segment is the same as that of the first customer, that is, both have the 10.1.0.0/16 network "Phase 2 Selectors - Remote Address" . How would you handle the ipsec tunnel for this other customer? Thanks all

If a FortiWiFi is in place and the FortiWiFi wireless is in use, can one or more FortiAP‘s be added using wireless provided by the FortiWiFi wireless as well as the FortiAP wireless? Can this arrangement function as it does with 2 or more FortiAP’s including roaming and the same SSID’s on all access points?

Hi everyone!  I need your precious help about this scenario, please see attached diagram below. What do you recommend as being the best way to configure HA on these 2 Fortigates to work properly?Active-Active or active-passiveEach one of the Firewalls is connected to ISP through only 1 link and the ISP is the same but has configured VRRP between ISPRouter1 and ISPRouter2.  Thank you so much!  Regards!

Hi,we have a problem with forticlient, the traffic to a site stops every hour for 2 minutes. They are all IPSEC and the connection does not drop. This does not occur on locale site network but only for remote connection. I saw that I can't change the values of the standard vpn configuration from the fortigate. Some idea?Tnx

We see many false positives in the compromised hosts list, to the point where it makes the list almost useless. Most of them seem to be legitimate web advertising that is detected as Malware CnC. The most common of these is assets.ubembed.com and <randomstring>.js.ubembed.com. Is there some workaround to whitelist these or otherwise reduce the number of false positives?