Solved

Hi, I want to replace 100D model with 100E model in FortiManager. I was thinking that an easy method would be to use this kb: https://kb.fortinet.com/kb/documentLink.do?externalID=FD34527 which is for same model replacement. TAC told me that it won't work, but was wondering if anyone in this forum has experience with this? Having to remap interfaces, and add the device in VPN manager will take manual work that i would like to avoid. Thank you, 1984  

Hi all,  Would like to know whether there's a workaround for this.  Currently a /29 WAN subnet is created on a WAN 1. e.g. 202.188.1.130/29. Gateway is 202.188.1.129.I want to separate a particular IP out e.g. 202.188.1.132 and connect it to another port e.g. Port 15 for SSL-VPN purpose. By default, under the SSL-VPN settings, the box will only listen on the WAN 1 IP i.e. 202.188.1.130:443. How can I make the box to listen to 202.188.1.132 for the SSL-VPN.  Thank you in advance for your guidance.     

Does anyone know if LACP is supported on the 61e?The doc shows "Link Aggregation Control Protocol (LACP) is now supported on FortiGate and FortiWiFi 90E, 80E, 60E, 50E, and 30E devices." Not sure why it's limited to these model numbers and not the "odd numbered" units.I can't find the option available in a 61e after a firmware update. Does anyone have any insight? Thanks!

If I have disk logging disabled and I'm forwarding all logs to a FAZ that is unavailable, what is the negative effect on a FortiGate that has 100s or 1000s of logs building up in the queue? Will this potentially cause memory issues? Thanks!

Hi guys, I haven't implemented this thing before. So please tell me if it is possible to implement like below:Our Fortigate at HQ has two FTTH WAN lines (WAN1, WAN2). I have configured two default routes with the same distance but different priority (we has some DMZ servers, so we want access to these servers by VIP on both two WAN link). At the branch, we just have one FTTH WAN (WAN1). Currently, we just have IPSEC VPN site-to-site-tunnel from WAN1 of the Branch Firewall to WAN1 of HQ Firewall named it "VPN tunnel 1". Is it possible to create another IPSEC VPN site-to-site tunnel, eg: from WAN1 of the Branch Firewall to WAN2 of HQ Firewall. I attached sample topology for refer. Thanks for reading.

Hi Everyone! Good day! I was trying to work with this scenario and anyone could help me if this is possible? See attached test.jpg. I have a FortiGate, a core switch, distribution switch and client pc. The goal is that FortiGate must act as the DHCP server of all the VLANS (10,20,30). I've already tried to create vlans on the FortiGate (same vlans from the core switch) and enabled dhcp. I already tried to allow all vlans from the core switch (trunk) going to the firewall. The result, the test client in vlan 30 can obtain IP from the firewall, but cannot access internet even firewall policy was already configured on the firewall (virtual interface (vlan30) to WAN)). Best Regards, Kulas

HI, I'm using POSTMAN (REST API) to login my Fortios FW,I can get the policy (ipv4)I can get the address objectsI can get the static route from POSTMAN(REST API) But I can't found any url to get the interface IP address.Is there any document talk about it? Also, except the document below,http://www.tuncaybas.com/FOS_JSON_REST_API_523.pdfI can't found any other document talk about the REST API to FORTIOS.Is there any document for other version of FORTIOS? Many Thanks!

Hello gyus,on our FAZ-VM-BASE I found message "Log rate (xxx logs/second) exceeds the peak limit (50 logs/second) over the last 30 minutes." I think, that licensing on VM is about logs/day and storage and limit logs/sec is only for HW FAZ (according to data sheet).So what exactly this message means? Is only information about amount of peak of logs or some limits for this VM?Many thanks  

Hi ,how to verify that auto save is enabled code 5.2.xWhen I click revision ,I can see " you have unsaved changes ,save now " What does it mean ,How can I see pending configuration to be saved Thanks 

Hey, I just start working with Fortigate 60D routers, everything was fine but now our company need to setup some routes to make all locations visible to each other. For example: Office1 with IP 10.0.1.1 connected to MAIN location 10.0.0.1 with side-to-side vpnOffice2 with IP 10.0.2.1 connected to MAIN location 10.0.0.1 with side-to-side vpnI need to forward traffic from Office1 to Office2. That's mean Office1 should see all network at MAIN location + Office2. And Office2 need to see MAIN location + Office1.  I tried:1. Setup policies at MAIN location to allow traffic from Office1 to Office2. 2. Setup static route at Office13. Setup Policy Routes at MAIN location and Office1 location. 4. Setup Phase2 on VPN at Office1 with MAIN + Office2 network. And Office1 still can't see Office2. Can anyone who did it before, help me with that, please. What I need to setup to make Office1 visible to Office2?  Thank you for any help! 

Hi all, Does anybody know if FortiGate can be configured to do this?[ul]When a client opens a TCP connection to predefined port (typically, HTTPS), respond to the TCP handshake on behalf of a server.Accept the "Client Hello" TLS message from the client,Read the server's hostname specified in the SNI field of the "Client Hello".Check the hostname against "destination" of the firewall policies - maybe by performing its own DNS resolution to see if the IP falls into allowed ranges, or maybe by textual comparison if the destination is set as some regexp object?Make a Allow/Block decision based on the result?[/ul]Today, when virtually any TLS client supports the SNI field, this would be very useful feature. Thanks,Vladimir.

Does anyone know if the following FortiGate model supports 802.3ad LAG and LACP? My switches do support LACP and would like to avoid non-LACP aggregation. 400, 500, 600, 601E  Thank you,

How to completely disable Wifi on FortiWifi60? Disable interface WLAN don' t interrupt WIFI! Thanks

Hi All, I'm having a bit of an issue understanding the Forti route-maps and prefix lists.  Whilst I concur there are many examples and documentation, there's no real clear explanation of what it all does and how it works... Sorry if I am missing this after my 20+ years in the networking field, maybe I'm just getting too old. In any case, given the below:config router prefix-list edit "RFC1918"   set comments "Matches RFC1918 Addresses"   config rule     edit 1       set prefix 10.0.0.0 255.0.0.0       unset ge       unset le     next     edit 2       set prefix 172.16.0.0 255.240.0.0       unset ge       unset le     next     edit 3       set prefix 192.168.0.0 255.255.0.0       unset ge       unset le     next   end   next end config router route-map &n

Hello, I have a cluster of 100E Box on version 6.2.2 but I have face some problem as follow 1 - WEB GUI unstable, somtetimes it stop to work 2 - Out of Sync HA 3 - Two times the HA link went down and occurred the cluster failover So I wonder if this version 6.2 it´s an stable and recommend version. any tip about is welcome. thanks.

HiI want to monitor each WAN Interface Traffic via SNMP, to get output similar to the value in Interface History Widget only via SNMPIs there any way to get Wan1 and Wan2 Current Bandwidth?I looked in to Fortigate MIB and the only Bandwidth MIB I Found is "fgHaStatsNetUsage" - Network Usage of Cluster (HA)I dont Think this is the one I need,any ideas?

I have posted this question to r/Fortinet and to spiceworks, and so far no one has an answer for me. First, I should state that I am a huge fan of Fortinet. We manage and recommend many of their products. Their firewalls are miles better in value and features than any I have seen. The APs though....  To summarize, all APs we have in production max out at around 220Mbps to the end clients (maybe 60 APs at different clients). I haven't tested the 421 series, but all others (regardless of model or release date) offer the exact same throughput.  We have had 4 tickets open with support for APs that simply cannot produce bandwidths to the specifications of the devices. I have gone through the support calls, and even brought out an exact same spec AP from another manufacturer (6 antenna wave 2, 802.11ac max speed 1.3 Gbps release date 2012) to compare to their FAP321C. They cant help. It's maddening. They go through the checklist, and we see no improvement. I see

Hello to all dear friends! I'm running out of ideas to do a job that is simple but it puts me in trouble.I would like to understand with you which best practices i can use. In practice, i have a Fortigate 100d with a local network 192.168.1.0/24 on port 1 , which is the main network. To make my users work in terminal servers, a tenant is asking me to create a VPN with another network behind a watchguard in subnet: 10.150.5.0/24 where is the server we need to reach. I have to deny everything that can come from the other network (10.150.5.0/24) to mine.  I'm running out of ideas or best practices ... can you help me ?thank you all.

Hello, I would like to request information from my Fortigate via the SNMP protocol, so I configured the protocol, community etc. on the web interface, then activated the protocol on an internal interface to make it operational.However, I have no answer from my Fortigate during the requests: Timeout,... Thank you for your help.

<<Photo attached>> well , basically i had that 60d for a really long time , and after couple years it was in the storage i need it. the problem i cant seem to be able to configure it because i cant access it. when plugged into power the 3 lines near the logo light up, and the PWR light also lights up. everything else isn't. so i think its been reset or something because there's no IP or anything when connecting to any of the interfaces. So i thought maybe i should reset it again. no response when trying to reset using a little pin. connecting a usb mgmt port and using fortiexplorer , but there's no devices recognized, the sound of the usn connection is there so the unit is workinbg but i am doing something wrong , and was hoping that someone can point me into the right direction since i never encountered a completely blank forti unit. any help appreciated.  

I just wanted to know about following things in forticlient:- 1) What are the tick marks for every category? 2) When setting up for the first time and the web filter/parental contol is enabled, what all is blocked? 3) What is the difference between tick marks and the option to block, allow etc.

Hello Guys ,I need someone show me how can i do Export rules from Fortigate 300d to Excel Sheet  .We dont have a Fortimanager to do this export .Any idea please ? Regards

Hi,I was wondering if anyone has any experience in creating a custom alert in Fortimail upon high SMTP Auth Failures.I checked the guide, but i couldn't figure out of this was possible at all.I found how to create custom alerts, but i can't seem to figure out if this can be applied to high SMTP auth failures.What i would like to do is get an alert when smtp auth failures are high from ip x.x.x.x Thanks p

Hello Guys, First of all I want to say that I am glad to participate in this Forum discussions.I have a question regarding FortiGate VDOMs use cases I am working for a client which use FortiGates for firewall solution.With the current setup they split FortGate into Multiple VDOMs.Usually they are doing this when site have Two Internet service providers. root VDOM - Internal Netoworkfw1 VDOM - Primary Internet providerfw2 VDOM - Secondary Internet provider Inter-vdom links between root-fw1 and root-fw2 two default routes on the root VDOM (towards fw1 and fw2 VDOMs)one with lower priority towards the preferred LINE.They are utilizing the secondary provider by configuring static routes on root vdom which are pointing to fw2 VDOM (Some kind of a load-sharing). In NSE self study guide I've learned that usually you would need to split FortiGate box when you are managed security service provider and you want assign different VDOMs to different customers.But why a

I have to create an ipsec ssl tunnel with a customer.Everything seems fine, both phase 1 and phase 2 are up.But, they asked me to SNAT an internal IP.Tried to recreate the VPN in policy mode with the same settings - not working.In phase 2 local subnet is 172.16.5.0/24 and remote is 10.1.43.0/24They are expectig traffic from 172.16.5.170 to 10.1.43.5 using source nat 10.252.13.1.Quote:"As per the IDD traffic should be coming to our firewall from 10.252.13.0/27 subnet. Hence pls configure the source NAT at your end.Source Address: 172.16.5.170Destination Address: 10.1.43.5Source NAT: 10.252.13.1" How should I do this? Thank you!