Solved

Dear all this will be my very first post and please go easy on me :) and I hope I get good respond and thanks before! So far, any fortinet literature or cookbook or video only show that site-to-site IPSEc is created between two fortigate (site to site ipsec illustration.png), and the policy and static routing is created based on the two directly connected subnet (to fortigate).  For example, between HQ internal network (assuming 10.10.10.0/24) to Branch internal network (assuming 192.168.10.0/24), the private network is part of directly connected subnet to the fortigate physical interface.  What happen if private network  is behind another layer 3 device? for example, I want to create a VPN between 10.10."20".0/24 to 192.168."20".0/24. it means, both those .20 network are not directly connected to fortigate broadcast domain / physical interface. If I am configuring HQ FGT, Should I simply state local address as 10.10.20.0/24 and remote address as 192.

HelloCould you please help me how to block sub advertisement in a website.please find the attachedI am using fortigate 100E

Just had an interesting experience when updating an HA a-p setup. The failover unit was re-installed earlier this year due another issue. When updating firmware, it turns out the passive unit had an older version of the Internet Service Database Definitions. Given this, the unit simply replaced the services involved in the policy as some of the services didn't exist in the current version. The policy had Microsoft-Office365, Microsoft-Microsoft.Update and Microsoft-Azure defined. After the failover switch, the policy was replaced with Microsoft-Office365, Microsoft-Other and Microsoft-Other. How can I make sure this doesn't happen future wise? 

I had a client request whatsapp be opened up temporarily during this lockdown period while some of them are in the office and communicating via the app.  They had it blocked and opened it again and ensured the application policy was enabled ok and confirmed with the client it was indeed working fine. The next day it stopped working, disabled the policy and re-enabled it again and working again, next day not working.  I created a new policy with the ports whatsapp uses and tried that and working and again today not working.  What is causing this to stop every day?

Hello,  I am new to FortiClient and am using it for Anti Virus on a few Win 7 Pro computers.  When some youtube videos are attempted (i.e. [link]https://www.youtube.com/watch?v=A6DqPBJNkvk[/link] ), I get an error message in the viewer "Video unavailable This video is restricted.  Try signing in with a Google Apps account."  If Forticlient is shutdown, the video works.  If Forticlient is restarted, the video fails again.  I do not see any indication that the site is blocked in Forticlient (no notifications, 0 Sites Blocked).  I tried adding an exclusion *.youtube.com  but that didn't help either.  I cleared the Forticlient log, tried to open video, and then exported the log.  However, I do not see any blocking.  I can add the log file if that is useful to anyone.    Any suggestions to troubleshoot this issue are appreciated.Thanks,Dale Sykora 

Hi! I have a Mac running High Sierra with the latest version av FC.When connecting to VPN it takes a couple of seconds, then the icon in the menu bar disappears and nothing happens.If i open the console it says "connecting" and the button "Disconnect" but nothing happens even after waiting for minutes.  I have a client that runs 5.6.0.703 and it connects without any issues.  Have tried reinstalling, rebooting etc.

 https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/2e118d36-bde1-11e9-8977-00505692583a/FortiOS-6.2.2-New_Features_Guide.pdf

Hi All, I am new to Fortigate firewalls and I am wondering if someone of you can help me with a query. The physical interface is in a "root" VDOM and VLAN interfcae is in a "abc" VDOM. When the traffic leaves VDOM "abc" it goes directly to internet and vice versa, only the physical interfaces are in root vdom. So will need inter vdom routing between vdom "root" and "abc" ? Appreciate your commets, Thanks !

Hi! There is a network conflict between my local network and my employer's. I use 10.0.0.0/24 locally, but unfortunately they map the entire 10.0.0.0/8 range even though in practice my home network doesn't really conflict with any subrange in the 10.0.0.0/8 space they actually use. Naturally Forticlient wants to route all 10.0.0.0/8 traffic over the VPN. This means I can't access local resources such as my printer or NAS whenever I'm connected to the VPN. I've alreay spoken to IT and there's not much they can really do about that, and I can very much sympathize with their reluctance to experiment with it in current times :). However, I figured I should be able to solve the problem locally by adjusting the routing tables. Unfortunately that doesn't really seem to help. As if Forticlient overrides Windows' routing tables. There should be a way around this, right? So, here's my routing table before I connect to the VPN:Active Routes:Network Destination Netmask Gateway Inter

Hi All We are looking at utilizing the Webhook Stitch to send alerts to us, we have come accross a cookbook for setting up Slack, we however use teams. Has anyone used the Webhook automation stitch to send notifications to MS teams channel? Thanks

We are currently using version 5.6.11 on Fortigate 200E (data center) and Fortigate 80E (branch offices).  I am evaluating the benefits of upgrading FortiOS into 6.X.  Here are my questions: 1.)  What are the biggest benefits of upgrading from the 5.6.X versions into at least 6.2? 2.)  I am considering either 6.2.2, 6.2.3 or 6.4.  Of these versions, are there any which have been unstable or have displayed issues?  I would much rather be on a stable version which isn't necessarily the latest rather than one which may cause issues. Any and all input is very much appreciated.

I have read that there was a button added in FortiOS 5.6.1 for a button to enable a remote user using RDP through SSL-VPN to send a CTRL-ALT-DEL to their host PC.  I cannot see where this button (or any button for that matter) is.  Does anybody know how to access it?

Hi All Management have asked me to pull out VPN activity reports for a few users. Please can someone guide me in pulling this type of report? I have a Fortigate 500E Firewall uploading logs to Forticloud. Thanks in advancedRyan

Hi.Is it possible to do a server load balance in FortiADC where you have 2 real server in a real server pool where you run is as active/backup? iv got a website behind my ADC where i want 1 of the to be the active and the other as the backup, it's because there is a script that copies things from the active to the backup. Morten

Hello Guys, what would be a best practice to migrate Email Domains from other MailServers oder Email Security Gateways to FortiMail? i do have CSV from Postfix with 100 DOmains and want to somehow do a script that will create this domains on FortiMail and assign predefined Profiles. is that possible? or do we have to use somehof FortiMail API? Is there any guide for that or some recommendations? i see that i cannot upload scripts to FortiMail Can i use Putty > Connect to FortiMail and do Scripts directly via Putty? would appreciate your advice Thank you

Hi,We have site-to-site VPN tunnel to remote office with Fortigate VM64 on remote end, everything was worked ok. I need to add additional network (mobile VPN), from which remote office must be accessed also. I did changes (added network and policies) on both sides, but mobile VPN traffic still drops somewhere on Fortigate side. I can only see through packet capture, that packets are coming to Fortigate. What else I can do for debug the problem? Sorry, I'm not a Fortigate guru.

Hello, Fortigate vpn given to one of our support partners have been identified as having issues.Support partners remotely assist our team for our application environment, but when they want to access their own company emails they are unable to as the dns fails.What is the solution to this problem & how to implement it? Appreciate all help, thank you. 

I am trying to poke a hole to allow Spotify. I managed to set two services in a new policy, which was successful: TCP/UDP/SCTP78.31.8.0-78.31.15.255TCP 4070 TCP/UDP/SCTP193.182.8.0-193.182.15.255TCP 4070 In the policy's Destination field, do I need to limit the Destination to the same address ranges to be safe? I'm confused as to whether specifying an IP range in the Service makes specifying a destination unnecessary. Thanks.

Hi All, I have a fortiwifi 60d installed with a client and he is asking me whether I can disable the local wifi radio outside of office hours, so that all functionalities remain unchanged but only the wifi radio is disabled at night and during weekends. Can this be arranged ? Tks, Kris.

Dear community, I need your help, I created an aggregate interface (Port1 and port2) with multiple VLANs for internal network, there is no ip address on aggregate interface when connected those ports (Port1 and port2) to a cisco switch (Interface g1/0/1 and g1/0/2) the link doesn't come up, so the fortiGate can't communicate with the internal network (Cisco switch) On Cisco switch : - interface g1/0/1 :switchport trunk native vlan 99switchport mode trunkend - interface g1/0/2 :Switchport mode trunkend Interface vlan 99 : 192.168.254.251/29ip route 0.0.0.0 0.0.0.0 192.168.254.254 On fortigate (Aggregate interface) i have multiple VLANs, vlan 1, vlan 100, vlan 110, vlan99 ...etc, - Sub-interface of VLAN 99 : 192.168.254.254/29 Any help please,Thanks

We're configuring our first/new FortiGate device and need to connect in users on the LDAP/RADIUS and SSO pages. There is no local server, AD, or domain controller presence in the organization, as they exclusively use Office 365, so we are trying to configure the FortiGate to connect to Office 365 or Azure for the LDAP/RADIUS and SSO configuration. We've been scouring the documentation/help at Fortinet and at Microsoft but to no avail.  We will face a similar challenge next week with an org that has only G-Suite users and no local servers either.

Would anyone have a mental model to offer for what the SSL VPN feature is doing when it is 'checking rules'?  I'm trying to spin up an SSL VPN service, using the heavy FortiClient, the client sees "Permission denied".  The relevant output of "diagnose debug application sslvpn -1" looks as follows: [...]2020-03-30 09:04:15 [22521:root:2]sslvpn_auth_check_usrgroup:2039 forming user/group list from policy. 2020-03-30 09:04:15 [22521:root:2]sslvpn_auth_check_usrgroup:2145 got user (0) group (1:0). 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1642 validating with SSL VPN authentication rules (1), realm (). 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1690 checking rule 1 cipher. 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1698 checking rule 1 realm. 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:1709 checking rule 1 source intf. 2020-03-30 09:04:15 [22521:root:2]sslvpn_validate_user_group_list:

Hi we have been running a couple of sites using FortiGate sd-wan in a hub-spoke topology. We randomly get complaints from users about application sessions being kicked out users has to restart the application (web,erp). I see there is often sdwan member changes in the logs such as the attached. My question when the link does meet the success criteria of a specific sla and it is moved out of the sd-wanr rule . what happens to the existing sessions that were running on the link is it going to time out will it be dropped by fortigate. I tested this out some months ago, I noticed an ICMP packet recovered but a rdp session would get stuck if the link failed and even if the other link is ready to take the session.   

Hello everyone, We have a clientless ssl vpn on fortigate 300E.There are few applications that users access which listen on varied ports tcp-42180 & 51050.How do these be configured on ssl portal as bookmark for a user to access. Portal only gives http/s, rdp etc as available options. Please help. Thank you in advance.

I have used the FortiGate for SSL-VPN only.  I would like the fortiGate send only log "User access Fortigate and User login SSL-VPN". to a syslog. What should I do?  DetailsFortiGate 101FFirmware 6.2.3