Solved

Hi! I have a Mac running High Sierra with the latest version av FC.When connecting to VPN it takes a couple of seconds, then the icon in the menu bar disappears and nothing happens.If i open the console it says "connecting" and the button "Disconnect" but nothing happens even after waiting for minutes.  I have a client that runs 5.6.0.703 and it connects without any issues.  Have tried reinstalling, rebooting etc.

 https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/2e118d36-bde1-11e9-8977-00505692583a/FortiOS-6.2.2-New_Features_Guide.pdf

Hi All, I am new to Fortigate firewalls and I am wondering if someone of you can help me with a query. The physical interface is in a "root" VDOM and VLAN interfcae is in a "abc" VDOM. When the traffic leaves VDOM "abc" it goes directly to internet and vice versa, only the physical interfaces are in root vdom. So will need inter vdom routing between vdom "root" and "abc" ? Appreciate your commets, Thanks !

Hi! There is a network conflict between my local network and my employer's. I use 10.0.0.0/24 locally, but unfortunately they map the entire 10.0.0.0/8 range even though in practice my home network doesn't really conflict with any subrange in the 10.0.0.0/8 space they actually use. Naturally Forticlient wants to route all 10.0.0.0/8 traffic over the VPN. This means I can't access local resources such as my printer or NAS whenever I'm connected to the VPN. I've alreay spoken to IT and there's not much they can really do about that, and I can very much sympathize with their reluctance to experiment with it in current times :). However, I figured I should be able to solve the problem locally by adjusting the routing tables. Unfortunately that doesn't really seem to help. As if Forticlient overrides Windows' routing tables. There should be a way around this, right? So, here's my routing table before I connect to the VPN:Active Routes:Network Destination Netmask Gateway Inter

Hi All We are looking at utilizing the Webhook Stitch to send alerts to us, we have come accross a cookbook for setting up Slack, we however use teams. Has anyone used the Webhook automation stitch to send notifications to MS teams channel? Thanks

We are currently using version 5.6.11 on Fortigate 200E (data center) and Fortigate 80E (branch offices).  I am evaluating the benefits of upgrading FortiOS into 6.X.  Here are my questions: 1.)  What are the biggest benefits of upgrading from the 5.6.X versions into at least 6.2? 2.)  I am considering either 6.2.2, 6.2.3 or 6.4.  Of these versions, are there any which have been unstable or have displayed issues?  I would much rather be on a stable version which isn't necessarily the latest rather than one which may cause issues. Any and all input is very much appreciated.

I have read that there was a button added in FortiOS 5.6.1 for a button to enable a remote user using RDP through SSL-VPN to send a CTRL-ALT-DEL to their host PC.  I cannot see where this button (or any button for that matter) is.  Does anybody know how to access it?

Hi All Management have asked me to pull out VPN activity reports for a few users. Please can someone guide me in pulling this type of report? I have a Fortigate 500E Firewall uploading logs to Forticloud. Thanks in advancedRyan

Hi.Is it possible to do a server load balance in FortiADC where you have 2 real server in a real server pool where you run is as active/backup? iv got a website behind my ADC where i want 1 of the to be the active and the other as the backup, it's because there is a script that copies things from the active to the backup. Morten

Hello Guys, what would be a best practice to migrate Email Domains from other MailServers oder Email Security Gateways to FortiMail? i do have CSV from Postfix with 100 DOmains and want to somehow do a script that will create this domains on FortiMail and assign predefined Profiles. is that possible? or do we have to use somehof FortiMail API? Is there any guide for that or some recommendations? i see that i cannot upload scripts to FortiMail Can i use Putty > Connect to FortiMail and do Scripts directly via Putty? would appreciate your advice Thank you

Hi,We have site-to-site VPN tunnel to remote office with Fortigate VM64 on remote end, everything was worked ok. I need to add additional network (mobile VPN), from which remote office must be accessed also. I did changes (added network and policies) on both sides, but mobile VPN traffic still drops somewhere on Fortigate side. I can only see through packet capture, that packets are coming to Fortigate. What else I can do for debug the problem? Sorry, I'm not a Fortigate guru.

Hello, Fortigate vpn given to one of our support partners have been identified as having issues.Support partners remotely assist our team for our application environment, but when they want to access their own company emails they are unable to as the dns fails.What is the solution to this problem & how to implement it? Appreciate all help, thank you. 

I am trying to poke a hole to allow Spotify. I managed to set two services in a new policy, which was successful: TCP/UDP/SCTP78.31.8.0-78.31.15.255TCP 4070 TCP/UDP/SCTP193.182.8.0-193.182.15.255TCP 4070 In the policy's Destination field, do I need to limit the Destination to the same address ranges to be safe? I'm confused as to whether specifying an IP range in the Service makes specifying a destination unnecessary. Thanks.

Hi All, I have a fortiwifi 60d installed with a client and he is asking me whether I can disable the local wifi radio outside of office hours, so that all functionalities remain unchanged but only the wifi radio is disabled at night and during weekends. Can this be arranged ? Tks, Kris.

Dear community, I need your help, I created an aggregate interface (Port1 and port2) with multiple VLANs for internal network, there is no ip address on aggregate interface when connected those ports (Port1 and port2) to a cisco switch (Interface g1/0/1 and g1/0/2) the link doesn't come up, so the fortiGate can't communicate with the internal network (Cisco switch) On Cisco switch : - interface g1/0/1 :switchport trunk native vlan 99switchport mode trunkend - interface g1/0/2 :Switchport mode trunkend Interface vlan 99 : 192.168.254.251/29ip route 0.0.0.0 0.0.0.0 192.168.254.254 On fortigate (Aggregate interface) i have multiple VLANs, vlan 1, vlan 100, vlan 110, vlan99 ...etc, - Sub-interface of VLAN 99 : 192.168.254.254/29 Any help please,Thanks

We're configuring our first/new FortiGate device and need to connect in users on the LDAP/RADIUS and SSO pages. There is no local server, AD, or domain controller presence in the organization, as they exclusively use Office 365, so we are trying to configure the FortiGate to connect to Office 365 or Azure for the LDAP/RADIUS and SSO configuration. We've been scouring the documentation/help at Fortinet and at Microsoft but to no avail.  We will face a similar challenge next week with an org that has only G-Suite users and no local servers either.

Would anyone have a mental model to offer for what the SSL VPN feature is doing when it is 'checking rules'?  I'm trying to spin up an SSL VPN service, using the heavy FortiClient, the client sees "Permission denied".  The relevant output of "diagnose debug application sslvpn -1" looks as follows: [...]2020-03-30 09:04:15 [22521:root:2]sslvpn_auth_check_usrgroup:2039 forming user/group list from policy. 2020-03-30 09:04:15 [22521:root:2]sslvpn_auth_check_usrgroup:2145 got user (0) group (1:0). 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1642 validating with SSL VPN authentication rules (1), realm (). 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1690 checking rule 1 cipher. 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1698 checking rule 1 realm. 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1709 checking rule 1 source intf. 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:

Hi we have been running a couple of sites using FortiGate sd-wan in a hub-spoke topology. We randomly get complaints from users about application sessions being kicked out users has to restart the application (web,erp). I see there is often sdwan member changes in the logs such as the attached. My question when the link does meet the success criteria of a specific sla and it is moved out of the sd-wanr rule . what happens to the existing sessions that were running on the link is it going to time out will it be dropped by fortigate. I tested this out some months ago, I noticed an ICMP packet recovered but a rdp session would get stuck if the link failed and even if the other link is ready to take the session.   

Hello everyone, We have a clientless ssl vpn on fortigate 300E.There are few applications that users access which listen on varied ports tcp-42180 & 51050.How do these be configured on ssl portal as bookmark for a user to access. Portal only gives http/s, rdp etc as available options. Please help. Thank you in advance.

I have used the FortiGate for SSL-VPN only.  I would like the fortiGate send only log "User access Fortigate and User login SSL-VPN". to a syslog. What should I do?  DetailsFortiGate 101FFirmware 6.2.3

Hi all I'm trying to configure SSL VPN connection on my new Fortigate 60D (formware 5.2.1) and I want to enable split tunnel SSl VPN is already working (using Forticlient) but users cannot browse internet when connected to the office I select VPN - SSL - Portals - double click on "tunnel-access"; if I check "Enable split tunneling" I need to insert a "routing address" What to I need to insert ? I read some docs (for example : http://docs.fortinet.com/...1/fortigate-sslvpn.pdf but there is no detail about "routing address"...) I have already created the  "static route" with device "ssl.root" and the firewall policy (ssl.root to wan1) but it still does not work so I suppose I need to enable the "split tunneling" Thank you Corrado

Hi We are running a FortiGate 60E using a single WAN-Connection (set of public IPs) and a straight C-Class private LAN. We have some services in our LAN that my colleagues and me are using every day. Basically everything works just nicely. I have set up a dialup VPN Tunnel (IPsec) to provide access from remote networks. This VPN Tunnel is set to have "Enable IPv4 Split Tunnel" checked as normally we would like have internet traffic not to take the VPN route, but to go there directly. This tunnel works great and we are happy with bandwith and performance. Now in addition to that, we need to have a VPN-Tunnel with "IPv4 Split Tunnel" disabled. In some cases we need to have all traffic go through that tunnel and for internet traffic we'd like to have a different public IP address being used than the one generally defined for WAN1. So appart from the "Split Tunnel" feature and a different Client Address Range, there should not be a difference. But the thing is, this second dialup VPN tu

Hi community we have a FortiGate 200D with ~30 SSL VPN Users. We have a problem that we're unable to find the cause of. All connected users are getting disconnected all at once several times during the day. It's not possible for them to work like this. I want to upgrade the firmware of our firewall, to see if the problem can be solved by that. In the known issues of the version 6.0.9 it says that it also has the problem with the random disconnects. I want to avoid those problems and have a stable infrastructure, so I'm tempted to try version 6.0.8. In the known issues section of 6.0.8 there's no mention of RDP Problems. I wanted to ask if those issues are exclusive to 6.0.9 or is version 6.0.8 also affected by them? Thank you.

Hello everyone, how does the fortigate ip pool work for users.We have a object (vpn-pool) defined as 192.168.100.0/24. This is then applied to the Ip policy along with groups.users get IP from 192.68.100.x once connected. Query on this - 1) how does it keep track of what ip's are in use, is there any command to check this?2) why do users get subsequent ip's as ip and gateway (example, 192.168.100.1 as IP & gateway as 100.2 on ipconfig)3) Is it possible to do a static IP reservation on this?4) what is different between this pool and the actual dhcp function within fortigate? Appreciate all inputs. 

Without going into the depths of the setup we have a bunch of virtual Fortigates clustered and only the cluster IP is visible to our monitoring platform - Solarwinds. I'm trying to understand / workout the best way of doing this, and am looking for ideas, or even solutions. I have found this OID: 1.3.6.1.4.1.12356.101.13 but when running it against our tool it gives a result of "2" which is utterly menaingless to me. So, I can monitor / alert on the traps or specific OID's and need some assistance in trying to identify which are the best and helping me understand the output. OIDs I can or should use please?What output do they give (if not obvious)? Alternatively - what SNMP trap(s) can I use? If it makes a difference then all FWs are running OSv6.2