Solved

If you don't create your SDWAN interfaces upfront you have to un-associate the interfaces with every policy to do so. This is a major PITA and wasn't an problem on Sonicwall. Time to step up the FG game here and make a wizard or utility or amend the OS to allow this to happen. This is very frustrating. Does anyone have any clever ideas? I was going to download the config edit it and re-upload it. However that sounds like I might open a can of worms. I called support, no known work-arounds. 

Hi all,I'm proposing the following setup for a small office with a Fortigate 80e. Is this the best way to do it?  They have two Cisco 2960x switches connected with fibre and one Fortigate with a WAN connection.  They need 2 VLANS which I have created on the switches and require one DHCP scope for each VLAN to have them separated and not accessible between each VLAN.  Should I connect each vlan to the FG80e separate lan port? IE VLAN 1 to LAN port 1 on the FG and VLAN2 to lan port 2 on the FG? Or should I only use one LAN por on the FGt and add each VLAN to that port? Whats the best practice here?  Thanks,Rob

Hi there,we recently upgraded our Fortigate from FortiOS 5.6.7 to 6.0.3 but have now problems with several "chat" applications, such as facebook web messenger, whatsapp web and so on. What we have in place- Explicit proxy- Proxy is authentication enabled- HTTPS Deep Inspection is enabled When we analyze the connection in the browsers, we see always that "wss://" connections are broken, such aswss://web.whatsapp.com/wsTherefor it is not possible to start web socket based applications It works when we exclude the domain web.whatsapp.com from deep inspection, but we cant do this for all domains world wide and we never had this problem with 5.6.x. So does anyone know how to resolve this in FortiOS 6.x? Any help is appreciated

I did not find it.and more question - trunk and  Aggregate is the same ?  

.

Hi Everyone, Does anyone know how Fortinet behaves when the FW acts as DHCP relay? I am trying to design a scenario whereas the clients in the branch need to go through VPN tunnel to get to the DHCP server in our HQ. We have a route advertised from HQ branch via OSPF to the branch about how to get to the server, also the branch advertises the route back to HQ, after that the closest route match in the branch will be default route which will go to internet (Which obviously there is no server available, since our server is within private range in HQ) Our concern is what happens if a client requests a DHCP address when the tunnel is down for any reason? I understand that clients won't be able to get an address, but specifically what happens when the tunnel re-establishes?  1. Does the FW maintains the connection from when the tunnel was down, then the clients will be matching the same connection which points to towards the default route, when the tunnel is back up? If

Hi all, we are getting reports from our forticloud, these include reports on possible "high-risk application use" / "Applications by Active Users" The issue is, they only indicate a number or in some reports are blank under the "user" column.  What components do we need the Fortigate so we need configure to be able to track actual user names in these reports?  See attached screenshot. 

Dear all, Im using fortigate 60E with 5.6 firmware. All users can work only for few minutes & the VPN suddenly gets disconnected. No error comes in. I have installed forticlient 5.6 aas well, but it also give same results

We have fortigate 300E ( india office) & 100D (US office) both are connected via IPSEC tunnel. Link speed US  office 10 Mbps down / 3 mbps UP Link speed India office 20 mbps down / 8 mbps now issue is on IPSEC tunnel when i copy file from India office  to US office it give me speed around 1 Mbps But in reverse it gave only 100-120 kbps On SSL-VPN tunnel its even worse when i copy file from SSL-client to US office it give me speed around 800 kbps But in reverse it gave only 30-50 kbps max can anyone suggest me something how can i increase the speed of data transfer from US to india or US to SSL use Thanks in advance  

Hello,I'm new to this forum and discovered fortinet since a few month now and i have several questions about it.We have a licensed Fortigate-90D with firmware 5.2.5 which is quite old, with IPS and UTM enabled.We have around a total of 1200-1300 sessions, and 5 to 15 new session per secondWe have a contracted provider which is supposed to care about anything but : - the firewall is not updated since at least 2 years- cpu load is stuck to 99% since at least 6 months (httpsd is eating 95%), and it's been 4 months i entered the company, the provider just said "change firewall, it's too old" So here is my questions :- We have a 4Mb link which barely goes to 2Mb bandwitdh usage but we have performance issues and disconnections, do the 99% cpu load could be a bottleneck ?- Does upgrading to 5.4.x, 5.6.x or 6.x have performances impact ?- What do you recommend to resolve my cpu load issue ? Thanks for your attention :)

Curious how these compare? Are both versions being widely used? Thanks in advance,

We manage quite a few fortigate's, over time life cycles of the Firewall vs. AP's with some of our clients got staggered. So for example, we have some FortiGate 60E's running FortiAP321C's.....not ideal I know, just the situation that we're in. What that above scenario seems to have created:Fortigate 60E - Latest firmware supported is 6.2.0+FortiAP 321C - Latest Firmware revision is 6.0.0 (Can't go to 6.2.0).  The general consensus among colleagues and myself is we try to follow is matching the FortiAP/Fortigate Firmware, no exceptions. However I can't seem to find any official Fortinet documentation suggesting they need to match. A lot of here-say, and in most cases people are not in this staggered situation we're in. Is it a sin to exceed the capable maximum FortiAP firmware revision with the Fortigate leaving the AP stuck on an older release?  What is the best practice in this scenario? Do we:A) Keep our 60E's one major firmware revision behind and stay

Hi,We have Fortigate with proxy-based inspection mode (FW:5.4.10)When web-filter module blocks a website, client have information in his browser.But when application control module blocks a website it is just blank (white) and after a while - this site is unavailable . Is it possible to change it?  

Hi Guys, I have issue with resolving a hostname using iPhone built in ipsec vpn. I was connected and was able to ping the ip address of the network but if we are accessing via hostname, it was not being resolve. I already configured the internal DNS in the phase-1 field but no success. Tried testing it in laptop using Cisco VPN Client and it works, the hostname was resolved. Please let me know what configuration I missed so that I can make it work. Thanks in Advance! Raquel

Hi, since the Update to FortiEMS 6.2 the LDAP sync is not working anymore. It says it was synced a few seconds ago, but new devices or moved devices are not shown. LDAPS is not working i can not save the settings it says: "protocol contais invalid values: LDAPS". The test is successfull.Someone knows how to fix this? Thanks

I have a 100E appliance with minimal web filtering set up (not many categories are blocked).Today, one particular URL returns a very basic "blocked" message, and it's not our standard Blocked page.The page simply says: "Web Page Blocked! You have tried to access a web page which belongs to a category that is blocked."When I view the source code, the only other thing on the page is this: "TITLE: Fortinet Secure DNS Service Portal" This is not our standard Blocked page, like the one I see when I go to a site that I know for sure should be blocked.The URL in question DOES work outside of our firewall though, so I know the problem is internal. The web category that it belongs to (Global Religion) is set to "allow", and even if I override the site to put it in our custom Allow category, I still get the same strange blocked page. Any ideas what might be happening? We have Web Filtering and DNS Filtering turned on, and just as a test I turned off the Category filter under DNS a

Hi guys, I've set up a 100D to load balance HTTPS traffic between two real servers. So, I have one virtual server of type HTTPS, SSL offloading Client<->FortiGate and two real servers. But the problem is that users have to type in https://www.webserveraddress.dom every time they want to access my website. What I would like is to automatically redirect their HTTP requests (i.e. http://www.webserveraddress.dom) to HTTPS (i.e. https://www.webserveraddress.dom). Is there any way to do this on FGT-100D? Thanks!

i have 2 WAN How to config FortiGuard DDNS

Hello,   I'm having some trouble with NAT'ing entire subnets and am looking for suggestions and/or confirmation that I am doing it correctly. I'm trying to give each school a separate external IP address based on their subnets. I am doing the following to create the NAT rule.1)Create Address Object for the school site's subnet     -School 1 - 10.1.0.0/16     -School 2 - 10.2.0.0/16     -School 3 - 10.3.0.0/162)Create IP Pool Object for each external IP address (All 3 IP addresses are part of a Single WAN interface network)     -Set "TYPE" to overload (Per Fortinet Chat Support)3)Create IPV4 Policy     -School 1 NAT Policy:       -Incoming Interface - LAN       -Outgoing Interface - WAN       -Source: School 1 - 10.1.0.0/16       -Destination: ALL       -Schedule: Always       -Se

Hello,Does HA cable between two Fortigates devices should be cross-over? or the straight one can work normally without any issues? Please anyone have a clarification about that for both types of cables UTP and Fiber   

I had a situation arise in which I need to host a service using https on a different interface than WAN1. Typical setup with the default routing table using WAN1 and that ISP next hop router as the default gateway for 0.0.0.0/0.0.0.0, and all of that has been working fine for years. Now I have a need to host a new https service, but through an alternate ISP that is connected to a subnet that is routed through the Internal LAN connected to the Internal switch interface on the firewall. I created a new DMZ using a spare port and created a policy route for the server in that DMZ to send traffic through the Internal interface instead of WAN1. That server gets out fine, and can get Internet with no issues through the alternate ISP. It also shows a specific NAT address correctly that is set up for that ISP connection on whatismyip.com. So outbound traffic for this server on the new DMZ with the policy route works perfectly. Inbound traffic is an issue. For remote int

Hy, i have one questionWe are Using FortiMail 200E and Sandbox 1000D,at the moment we have a lot infected Emails with .doc Attachmendunder the Fortimail System->Fortisandbox its acitivated the all Office (specially .doc) are sended to the Sandbox. But sometime we have the problem, if Fortimail notice this is a Spam Mail (over the IP), then he send the email to the personal Quarantine and stops checks with AntivVirus and Sandbox. We have activiated under Security->Quarantine Controll all Re-Scan Options. Bt its possible to make thats the checks continue and not stops after AntiSpam? With best regards from Germany

Hi I have a Fortigate FG60E-DSL configured with an FTTC connection and I want to assign the WAN interface with a Public IP address. The DSL interface is configured using VDSL and a VLAN interface which is configured using PPPoE. The interface is obtaining an IP address automatically but it's changing and this means my site-to-site VPN doesn't stay connected. I've entered a usable Public IP address in the Unnumbered IP section of the WAN interface and this now shows when I go to www.whatismyip.com but the WAN IP on the interface in the dashboard is still showing the obtained IP and the obtained IP is the only IP I can access the firewall on externally. I know the Public IPs we have work because I have Virtual IPs configured for services like OWA which work. Any way I can properly assign a Public IP to the firewall to achieve what I want to do?

Hey everyone,Currently attempting to enable SSL inspection/MITM on a 80C and it doesn't seem to be working.[ul]I have a single FW rule for the outgoing NAT traffic.I don't see the FGT certificate being presented to hosts browsing HTTPS sites behind the FW. I am seeing the traffic hitting the correct policy.It doesn't have a license. It's just for testing stuff in a lab.Running v5.6.3 build1547 (GA)[/ul]Relevant configurations : Security profile : https://i.imgur.com/lT5y8aL.png FW rule with applied profile : https://i.imgur.com/u3OwQAw.png Traffic hitting the FW and the correct policy : https://i.imgur.com/Pvx5pPC.pngIs the SSL inspection feature behind the paid license? Anything else I could try to properly tshoot this?Let me know if there is anything else I can provide.Thanks!

Hello, we want to achieve a special case where our external users would use the VPN for all traffic EXCEPT some well known VoIP Gateway that we want them to access through their local breakout, IPSec VPN has the command ipv4-split-exclude but I cannot find the same feature on SSL-VPN... any idea ? Best regards Vincent