Solved

This is my internal interface connected to cisco 4500 switch gig port. Why is the download smaller than  upload ?

I'm using Fortigate 200Es in a NSA Commercial Solutions for Classified (CSFC).  It details some pretty standard requirements for the overall operation of a network (e.g. time sync, syslog, etc.).  I'm not all too familiar with Fortigates (most of my experience is Sidewinders (I know, I'm dating myself)).  I'm making the following assumptions based on my experience and what I've read: 1.  Each port is it's own security boundary 2.  The OS native services (ntp/syslog) are associated with the Management interface(s) by design3.  The Management interface(s) is/are meant for OOB management (e.g., walk up and plug a laptop into it) I have a management network on Port 2 between two firewalls (home and forward).  There is a tunnel to port 2 on each 200E (IPSEC, Phase 1 using cert auth, etc.).  On the 'home' side, I have servers for syslog, file server, ntp and am trying to find the best way (the Fortigate approved way) to get the Fortigates on

Hi there,I've set up a Virtual Server on a 60D for Load Balancing purposes. That works fine so far, but creating a virtual IP with port forwarding mapped to the Virtual Server doesn't...Configuring the port forwarding to one of the real servers instead of the virtual server works just fine though. The setup with some imaginary IPs for illustration purposes:Virtual Server: 192.168.1.10 Real Server #1: 192.168.1.11 Real Server #2: 192.168.1.12 Virtual IP VIP_1: 123.45.67.89 --> 192.168.1.10(TCP: 30001 --> 30000) | Interface: wan1 Virtual IP VIP_2: 123.45.67.89 --> 192.168.1.12(TCP: 30002 --> 30000) | Interface: wan1"telnet 123.45.67.89 30002" succesfully establishes a connection. But "telnet 123.45.67.89 30001" times out. So VIP_2 works just fine, VIP_1 doesn't. Any ideas how I could debug this or what the issue might be?Or is this scenario simply not supported? Would there be any workarounds in that case?

New to FortiSwitch. Beyond the fact that you can manage the FortiSwitch via the FortiGate, what other differences are there between Cisco small business switches and FortiSwitch? What FortiSwitch would be comparable to the Cisco SG 250 and SG 350 switches?

Good day!Does anybody use port forwarding from 1 external ip to several internal hosts?For example, I have IP 1.1.1.1 on wan1 and want to translate port 21 to 192.168.1.2:21, port 25 to 192.168.1.3:25port 80 to 192.168.1.4:80.First virtual IP was created without any problem. But when I try to add second VIP with my 1.1.1.1 external IP, I catch this error: "Conflicts with the External IP of another VIP". I've created only 2 VIPs on wan1 at all - first 1.1.1.1:21 -> 192.168.1.2:21 and second 0.0.0.0:25 -> 192.168.1.2:25. Third VIP I cannot create.Another vendors, such as Cisco or Zyxel, can translate too much external ports to different local hosts and ports.I'm guess, that Fortigate can do the same. But I haven't find any manual for this.Only 1 external IP to 1 internal IP. Thanks in advance for your help.

Has anyone successfully setup and used the FortiAuthenticator as the IdP for Azure AD?We're following the Microsoft guidelines here https://docs.microsoft.com/en-us/azure/active-directory/hybrid/how-to-connect-fed-saml-idp and having issues with the final steps. The user login page is redirected to the FortiAuthenticator, successfully authenticated and then passed back to Microsoft where we are getting "Message: AADSTS50107: Requested federation realm object 'http://{Our-FA-URL}/saml-idp/{Our-IDP-Prefix}/metadata/' does not exist. The FA logs show;SAML request from SP 'Office365_GCC' failed: SAML assertion request validation error: Issuer 'urn:federation:microsoftonline.us' does not match SP config

Hi All,I've just joined the forums and hoping to get some feedback please.  We are currently running FortiOS 5.6.5, but are hitting a bug where the CPU gradually increases. This bug is reported as being fixed in 5.6.6 which was released last month.  If anyone has already installed 5.6.6, is it stable? Or are there any issues that we should be aware of before upgrading please?Thanks.Phil

ANY UPDATE FORTINET ??????  HELLLOOOOO

This problem persist to me:  "memory traffic log is 95% full", although if i make this commands: config log memory setting           set diskfull overwrite Any idea? Thanks!

I was trying to do SD WAN cofiguration in fortinet VM(6.0) in gns3 before going live in production. But i cant add members to SDWAN, it shows error FAILED DEPENDENCY. What could be the reason?. I also checked whether the interface adding is there in any policy. I can add one interface to SDWAN,when adding second one it shows failed dependency error.

Hello, we are currently in the process of buying a FG-500E. I have a question regarding groups and web filter profile usage: We are planning on using agent-based FSSO and creating multiple AD-Groups that can be assigned to users to manage their internet access. A user can be a member of multiple groups. I can create multiple authentication rules, each of them having different Web Filter policies. Authentication Rule 1: group A - Webfilter Profile A (full access)Authentication Rule 2: group B - Webfilter Profile B (allow test.de)Authentication Rule 3: group C - Webfilter Profile C (allow testing.de)Authentication Rule 4: group D (normal user)  - Webfilter Profile D (restricted access (deny test.de + deny testing.de + allow fortinet.com)) If a user is in group A and group D, only Authentication Rule 1 is used. If a user is only in group D, only Authentication Rule 4 is used. What happens, if a user is in group B and D? Will he have access

Hello, I'm using FortiGate to decrypt web server traffic, how to know if the traffic is really decrypted from the FortiGate log itself ?

Hi, is anyone has experience with XML API ?  I don't know why, but all my request are not able to execute because I have an error "<errorCode>11</errorCode><errorMsg>No permission for the resource</errorMsg>". This is what I done :1) create user with super_admin profile2) enable web service on interface3) download wsdl from fortimanager4) create a request as : URL : [link]https://fmgIP:8080/FortiManagerWSxml[/link]<soapenv:Envelope xmlns:soapenv="http://schemas.xmlsoap.org/soap/envelope/" xmlns:r20="http://r200806.ws.fmg.fortinet.com/">   <soapenv:Header/>   <soapenv:Body>      <r20:addCliGlobalSystemAdminUser>            <!--Optional:-->  <servicePass>            <!--Optional:-->   <userID&g

Anyone out there running a large FGT, like 600E, in the Fortinet "Enterprise/Office Closet" topology with FSW 1000+ at the distribution layer (MDF), and 35 FSW's broken up between multiple IDF's and data center top-of-rack switches, all using Fortilink?  Trying to understand how practical is would be manage that number of switches entirely through FortiGate interface. Thanks!

Hello, I have 3 fortigates A, B and C.The fortigate B connects to the A and C fortigade with IPSEC vpn. In fortigate A I have internal network 10.0.10.0/24 In fortigate B I have internal network 10.0.20.0/24 In C fortigate I have internal network 10.0.30.0/24The network 10.0.20 accesses the networks 10.0.10 and 10.0.30, but I need to make the network 10.0.10 access the network 10.0.30, passing through the fortigate B. Making vpn between Fortigates A and C is not an option.How do I do this? TKS for all. 

Helloi have fortigate 80c and hp switch 1910.my network (internal 1 ) working with 172.26.30.254/255.255.255.0.now i created on hp switch vlan 100 with interface 172.26.0.1/255.255.0.0.how can i connect vlan 100 to my fortigate ?       

I'm having some routing issues with an MPLS circuit that terminates on an interface to my Fortinet. MPLS Fortinet Interface IP:10.200.66.1AT&T MPLS HSRP Router IP:10.200.67.2I've added a static route for 198.105.206.0/24 to HSRP 10.200.67.1.  I've created a security policy for my internal/trusted zone to MPLS to allow everything. I can't ping anything on the other end but the LAN. I don't maintain the AT&T Cisco router or any of the config.  I was told by the vendor to add their public blocks via static route and point to HSRP of the cisco router.  I'm at a loss here.Here is traceroute that shows it makes it to AT&T MPLS router but nowhere else:Tracing route to ts099.scl.five9.com [198.105.206.150] over a maximum of 30 hops:   1   1 ms   <1 ms   1 ms 10.200.32.1   2   <1 ms   2 ms   3 ms 192.168.53.1   3   <1 ms   <1 ms   <1 ms bedfordfortigate.daystartv.internal [10.200.106

Hi all, A weird one. I've added a URL in the web filter and DNS filter and set it to allow. However the URL still gets blocked. I've also added a web rating override to make it unrated and still no luck. I'm not sure if this is a bug (couldn't find evidence of one), or if I'm missing something. Web Page Blocked!You have tried to access a web page which is in violation of your internet usage policy.URL: ***** Category: Spam URLs User name: Group name: Any help is appreciated.

We run a Loadbalancer (SD-WAN) on our FGT that balances internet traffic. We also have several IPSec Tunnels. Those have to be connected to a specific wan interface and cannot use SD-WAN.I set the Loadbalancer volume based and it is set o not use all avaiable bandwith.Thus big downloads affect the performance on ipsec. Since I cannot use SD-WAN rules here - is there a way to priorize ipsec traffc before internet traffic?

Hello, I have a scenario where a Server A (IP x.x.x.x) on port 10 of FG 500D (5.2) is configured to send TCP and UDP traffic to Server B (IP y.y.y.y) on Port 11. Using static routes I am able to successfully test connectivity between Servers A and B (no static NAT for server B currently) I want (but not sure how) to achieve the following, - Intercept the incoming TCP / UDP stream from Server A- change (or NAT) the source IP x.x.x.x of Server A to an IP (y.y.y.a) in the same subnet as Server B- Manipulate the original packet destination address. I want the TCP stream to retain the destination as Server B (y.y.y.y) but send UDP traffic to a Server C (y.y.y.c) in the same network as Server B So at the end I would expect Server B to receive TCP traffic from source IP a.a.a.a and Server C to receive UDP traffic from source a.a.a.aI created an IP pool and applied a policy to perform the source NAT, and was able to see that the source IP is being change as t

Hi there.Anybody can help understanding how to use the global database for webfilter profiles?I want to have some sort of "repository" in the global database, where I store my different webfilter profiles. Then I'd like to be able to pick/use them in the policy packages in each individual ADOM.Is this possible? If so, how? Thanks,Flavio.

Is it possible to utilize two factor authentication (2FA) on the support.fortinet.com website? Or, is it possible to use 2FA on the Cloud Management pages. This would increase security?

Hello All, I use two FG 200 A and the menu system is missing ... My question is : It's possible my account is not with the privilege for this menu but it s good for administration ? Thank you in advance for your help. Zipe.

Hi,What is the logic behind of using server ip ( behind or beyond  the router ) 

Hello!I`m using Fortigate 60C with OS6.0 and got issue with SIP - I made everything from https://kb.fortinet.com/kb/documentLink.do?externalID=FD36405 but when I type set sip-helper disable (first of course i`m typing config system settings) it isn`t showing on system settings (show system settings), I got only:config system settings set v4-ecmp-mode weight-based set sip-nat-trace disable set default-voip-alg-mode kernel-helper-based set gui-(...) And I add set sip-helper disable plenty times but with no-show effect. Is this normal? How can I check if sip-helper is disabled or not? Thanks in advance