Solved

Hi,How the packet size  impact throughput .Why do we require higher throughput when the packet size is small. How do we identify the packet size during the poc time ?which service will be using the smaller packet size ? Thanks

HiI was wandering how can i get raport about end-systems like smartphones/hosts etc. that were connected to my device last day/ last week/last montIn my Analyzer i can only generate report about "TOP" users TOP sites etc. but i need to know how many end-systems were use my FG to connect to the internet.I have about 500 fortigates to report about "how many end systems were using my FG to connect to the internet", my devices are like FG80C and FW80CM Can anybody help me?Regards Marek

Hello everybody Whenever I try to connect to VPN I get Error 104. So far I was not able to find out why this occurs. I have looked at the logs but still am unable to find a solution. Can you help me? I have tried to allow Forticlient in System -> Security & Privacy but it do not get a message to allow it there. Also I have tried different versions of the Forticlient which always returned the same error 104. Detailed Information:I am on macOS Mojave 10.14.5 with FortiClient VPN 6.2.0.614 fortiagent.log:20190611 11:26:13.093 [FctMiscAgent:INFO] AppDelegate:451 FctMiscAgent started up20190611 11:26:18.994 [FctMiscAgent:INFO] AppDelegate:415 Config File fctsysconf.plist changed, reload config!20190611 11:26:36.024 [FctMiscAgent:INFO] AppDelegate:415 Config File fctsysconf.plist changed, reload config!20190611 11:26:38.420 [FctMiscAgent:INFO] AppDelegate:415 Config File fctsysconf.plist changed, reload config!20190611 11:26:53.908 [fctgui:INFO] FCTVpnConnection:56

Hello everyone,I'm looking for a script to generate policy text file (CLI fromat) from CSV file. Thanks

Hi,On my FortiGate 100D I have Hardware Switch with just one physical interface attached to it and many virtual interfaces (VLANs) on that switch.I would like to change it to Aggregate port because I want to connect it to the switch stack where I can configure link aggregation group too.I discover there is no possibility to change interface type in gui. I realize I should delete all rules which using those virtual interfaces, delete virtual interfaces under hardware switch and then recreate everything under Aggregation interface. But what if I replaced "set type hard-switch" to "set type aggregate" of interface in the configuration file as well as delete "config system virtual-switch" entry and then I would restore this configuration? Is this possible? Or maybe it is possible to force change interface type via CLI?

Hi all, We are currently facing an issue with upgrading the firmware to a recent firmware. Currently, the Firewall is running FortiOS v5.4.10 build1220 (GA). Using the upgrade path tool, I need to do the following;VersionBuild Number5.4.1012205.6.916736.0.50268 So, as usual, I upload at the firmware then select FGT_60D-v5-build1673-FORTINET.out and then the firewall appeared to hang ('rebooting screen for 40+ minutes - excluding time to actually do the backup, firmware upload, etc). The firewall had to be manually restarted after 1+ hour of waiting for a response.  What can I do as its happening for 3 times now? Thank you.    

Hello, Our sister concern are deploying fortinet based vpn. It was found that users can connect to the vpn & access local resources.However, they are unable to access internet via our corporate proxy.  Split tunnel is not enabled & client version is 5.6.  appreciate all inputs.

Hello,i have a lot of clashany suggestion FGT500D $ diagnose sys session statmisc info: session_count=15502 setup_rate=246 exp_count=626 clash=17417memory_tension_drop=0 ephemeral=0/589824 removeable=0npu_session_count=3414nturbo_session_count=480delete=83073, flush=1, dev_down=0/0 ses_flush_filters=0flush_work_num=0TCP sessions:538 in NONE state4437 in ESTABLISHED state44 in SYN_SENT state4 in SYN_RECV state3 in FIN_WAIT state534 in TIME_WAIT state423 in CLOSE state72 in CLOSE_WAIT statefirewall error stat:error1=00000000error2=00000000error3=00000000error4=00000000tt=00000000cont=1ef546cdids_recv=30d613e7url_recv=00000000av_recv=8b78184bfqdn_count=00000039global: ses_limit=0 ses6_limit=0 rt_limit=0 rt6_limit=0

In the past 2-3 years many of my Fortigate devices have lost features due to the removal of internal storage. WAN Acceleration, web cache, logging.. From 90D, 60D, 94D and so on. Many new units also don't come with internal storage 50E. Fortinet, please consider allowing at least logging to a user provided USB device. We could use a USB flash drive or external HD. I understand maybe all 500GB on that HD may not be accessable for logging on say a 30D but something reasonable the device could support would be great!-It costs Fortinet nothing, and could save Fortinet money.-Assists in troubleshooting problems with TAC.-Reduces RMA on devices as only user replaceable USB flash is being used, not affecting internal storage with read/write cycles. -Build loyalty with users like myself by restoring features the unit was sold with.Users please speak with your sales rep and maybe comment in this post if you'd like to see this feature added.

Hi,In setting up a  fortinet based multifactor setup, fortigate firewall is used along with Active directory.Now, to enable the second factor (token) what configuration is required on fortigate considering that an AD is being used. We have tried looking at documents available online, but all of them indicate two factor with local username password & none with an AD being used.Please help  with some links or help regarding configuraing this for second factor (token) authentication with AD radius.  

Many Bugfixes but no TLS 1.3 mentioned. https://docs.fortinet.com.../fortios-release-notes

Hi Everyone,  We have a SSL VPN for our corporate users on a Fortigate 5001V (daily average users 10-15).  Everyone internet speed slows down as soon as they connect to vpn.  Below are some examples of speed test without and with vpn.  Please let me know if this is normal expected behavior slow down or if there is something that we can do to improve the situation.  I can also provide tracert if need be.  We do have a manage network so I do not full cli access to the blade, but I can pass any recommendation to our manage provider company: The issue is more significant and a pain point when users map a server shared folder and they try to save or dowload the file.  The VPN blade is in the west coast and most share folders are also in the west coast.  I do expect some slowness while updating huge excel files in the NY shares drive folders.  Our typical time from vpn or from mpls is always consistent at 75ms from LA to NY (while on vpn

Trying to setup user based content filtering (user hits a login page before they can browse, their credentials determines level of filtering). Per https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/345944/creating-the-employee-user-and-policy, I need to set SSL profile deep inspection under the security profile. I actually can't change ANY of the security profiles under IPv4 policy (firewall). They're greyed out. Why?

Just took over IT for a new company, never used Fortinet before, limited networking experience. Device is a FortiWifi 61E. Previous tech used generic consumer routers as APs, not sure why. My goal is to configure a Guest Wifi with internet access but no access to other devices separate, and a bridged network so that I can join devices to our domain over Wifi when needed. I've tried a bunch of stuff, nothing's worked. I've been trying to just to get a test network up, no matter what I try I never get and SSID to broadcast. I've dug through the CLI a bit, but still can't find a problem. Here is what I think is relevant, let me know if I'm missing something. Any help would be appreciated.  config wireless-controller inter-controller     set inter-controller-mode disable     set inter-controller-key [Nope]     set inter-controller-pri primary     set fast-failover-max 10     set fast-failover-wait 10 end config wireless-

Hi All, Appreciate for the help and advice .Based on diagram below firewall is connected with 3 access switch using trunk port with all client and switch pointing to VLAN 3 interface (IP 10.101.3.254). Layer 3 switch with IP routing enable will able to performed/automatic routing table to all VLAN interface and connection. However,  does manual routing is required and firewall policy for each connectivity to VLAN e.g. VLAN 1 > 2,3,4,5,6,7,8,9,10,11,12 and vice versa in order for all to communicate and use VLAN 3 interface (IP 10.101.3.254) as gateway ?. Appreciate if anyone can guide us or provide sample of configuration of the method of deployment for our reference. Thanks   

Hello , i have setup 2 FGT 200's in HA mode , active/standbyour wan 1 connection is 200 Mbps download  When i run a speed test i am only getting about half. AKA 100 Mbps download i have the WAN connection and the 2 FGT WAN ports connected to a Cisco switch with the 3 switch-ports in isolated vlan .  did i miss anything? Does that sound like the correct configuration?

our fortigate 90E did not last longer than 4 months of service when suddenly stops working. It is not booting up and the STA led not lighting...The PuTTY display (attached here with) shows where it stops booting up. Please help! Thanks much. Biftu  

Hi,what is the difference between nating using VIP or normal nat Thanks

Hi Everyone, In order to test some functionality end user would require to be able to select either 2.4Ghz or 5Ghz band. Therefore what I was thinking to do is create 2 ssid wich each one will be bind to their own band.   ssid 1: mynetwork --> 2.5Ghz band onlyssid 2: mynetwork --> 5Ghz band only Preferably I would like that these 2 ssid are within the same subnet. I know that this could probably be done very easy using bridge mode, but due to the infrastructure, it would be much less pain if I can do it in tunnel mode.  Is this somehting doable to have 2 different ssid belonging to the same subnet in tunnel mode? 

I noticed when I do a speed test my upload speed is always greater than my download. I'm new to FortiGate pls help me with a  solution. 

Hi guys, I'm configuring sd-wan with LB and when i tried to confiugre the static route i get the error attached.i've check from the interfaces that the 2 wan aren't in use in any rules right now but i still get this error.I've follow this guide: https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/990932/redundant-internet-with-sd-wanPlease anyone could help me to understand this error? Thank you very much!Michele. 

Good Day I was wondering if anybody can help me as I am new to fortigate I have two fortigates, one at hq and one at branch HQ public ip 41.138.x.xLocal Lan : 192.168.1.0/24 Remote site public ip 86.179.x.xLocal Lan : 192.168.1.0/24VLAN20 : 192.168.20.0/24 I have setup an IPSEC vpn between the two site with phase 2 selectors of 0.0.0.0/0 Now I need to route all internet traffic from vlan 20 over the VPN tunnel so that it looks like vlan20 is coming from my HQ's public IP.  Can someone perhaps guide me how to setup static routes and which policies i should create to route all traffic from vlan20 over the tunnel. The local lan on the remote gate does not need to go through tunnel Many thanks in advance

Hi,I have a strange issue regarding ospf . I had a connected interface in one vdom (vdom B) , Later I removed this interface from the VDOM and assigned  to another device (R1) and advertised in ospf . Now this ip address can see in the routing table of vdom A but not on B .(it s not even seen  in the OSPF database of VDOM B. R1--------vdomA------vdom b.What could be the problem . Thanks

I'm trying to test a VIP on a Fortigate 310B v.5.2.2 but I am getting "A duplicate Entry Already Exists" I don't even want to apply the VIP to a policy at the moment I just want the VIP in place to make an IP change. Is there a way to crate a VIP when there is a duplicate external IP? Thanks 

Hello, I need to connect an ADSL modem to my fortigate 310B, I currently have 2 dedicated links and that's where my traffic comes out with a load balancing. But I need this ADSL to send some of my users through that link. Is this what I'm trying to do? Until now what I am, I connected the modem to a port of the fortigate, but it does not give an exit to internte, I suppose it is for lack of some rules or route? Thank you....