Solved

Trying to setup user based content filtering (user hits a login page before they can browse, their credentials determines level of filtering). Per https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/345944/creating-the-employee-user-and-policy, I need to set SSL profile deep inspection under the security profile. I actually can't change ANY of the security profiles under IPv4 policy (firewall). They're greyed out. Why?

Just took over IT for a new company, never used Fortinet before, limited networking experience. Device is a FortiWifi 61E. Previous tech used generic consumer routers as APs, not sure why. My goal is to configure a Guest Wifi with internet access but no access to other devices separate, and a bridged network so that I can join devices to our domain over Wifi when needed. I've tried a bunch of stuff, nothing's worked. I've been trying to just to get a test network up, no matter what I try I never get and SSID to broadcast. I've dug through the CLI a bit, but still can't find a problem. Here is what I think is relevant, let me know if I'm missing something. Any help would be appreciated.  config wireless-controller inter-controller     set inter-controller-mode disable     set inter-controller-key [Nope]     set inter-controller-pri primary     set fast-failover-max 10     set fast-failover-wait 10 end config wireless-

Hi All, Appreciate for the help and advice .Based on diagram below firewall is connected with 3 access switch using trunk port with all client and switch pointing to VLAN 3 interface (IP 10.101.3.254). Layer 3 switch with IP routing enable will able to performed/automatic routing table to all VLAN interface and connection. However,  does manual routing is required and firewall policy for each connectivity to VLAN e.g. VLAN 1 > 2,3,4,5,6,7,8,9,10,11,12 and vice versa in order for all to communicate and use VLAN 3 interface (IP 10.101.3.254) as gateway ?. Appreciate if anyone can guide us or provide sample of configuration of the method of deployment for our reference. Thanks   

Hello , i have setup 2 FGT 200's in HA mode , active/standbyour wan 1 connection is 200 Mbps download  When i run a speed test i am only getting about half. AKA 100 Mbps download i have the WAN connection and the 2 FGT WAN ports connected to a Cisco switch with the 3 switch-ports in isolated vlan .  did i miss anything? Does that sound like the correct configuration?

our fortigate 90E did not last longer than 4 months of service when suddenly stops working. It is not booting up and the STA led not lighting...The PuTTY display (attached here with) shows where it stops booting up. Please help! Thanks much. Biftu  

Hi,what is the difference between nating using VIP or normal nat Thanks

Hi Everyone, In order to test some functionality end user would require to be able to select either 2.4Ghz or 5Ghz band. Therefore what I was thinking to do is create 2 ssid wich each one will be bind to their own band.   ssid 1: mynetwork --> 2.5Ghz band onlyssid 2: mynetwork --> 5Ghz band only Preferably I would like that these 2 ssid are within the same subnet. I know that this could probably be done very easy using bridge mode, but due to the infrastructure, it would be much less pain if I can do it in tunnel mode.  Is this somehting doable to have 2 different ssid belonging to the same subnet in tunnel mode? 

I noticed when I do a speed test my upload speed is always greater than my download. I'm new to FortiGate pls help me with a  solution. 

Hi guys, I'm configuring sd-wan with LB and when i tried to confiugre the static route i get the error attached.i've check from the interfaces that the 2 wan aren't in use in any rules right now but i still get this error.I've follow this guide: https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/990932/redundant-internet-with-sd-wanPlease anyone could help me to understand this error? Thank you very much!Michele. 

Good Day I was wondering if anybody can help me as I am new to fortigate I have two fortigates, one at hq and one at branch HQ public ip 41.138.x.xLocal Lan : 192.168.1.0/24 Remote site public ip 86.179.x.xLocal Lan : 192.168.1.0/24VLAN20 : 192.168.20.0/24 I have setup an IPSEC vpn between the two site with phase 2 selectors of 0.0.0.0/0 Now I need to route all internet traffic from vlan 20 over the VPN tunnel so that it looks like vlan20 is coming from my HQ's public IP.  Can someone perhaps guide me how to setup static routes and which policies i should create to route all traffic from vlan20 over the tunnel. The local lan on the remote gate does not need to go through tunnel Many thanks in advance

Hi,I have a strange issue regarding ospf . I had a connected interface in one vdom (vdom B) , Later I removed this interface from the VDOM and assigned  to another device (R1) and advertised in ospf . Now this ip address can see in the routing table of vdom A but not on B .(it s not even seen  in the OSPF database of VDOM B. R1--------vdomA------vdom b.What could be the problem . Thanks

I'm trying to test a VIP on a Fortigate 310B v.5.2.2 but I am getting "A duplicate Entry Already Exists" I don't even want to apply the VIP to a policy at the moment I just want the VIP in place to make an IP change. Is there a way to crate a VIP when there is a duplicate external IP? Thanks 

Hello, I need to connect an ADSL modem to my fortigate 310B, I currently have 2 dedicated links and that's where my traffic comes out with a load balancing. But I need this ADSL to send some of my users through that link. Is this what I'm trying to do? Until now what I am, I connected the modem to a port of the fortigate, but it does not give an exit to internte, I suppose it is for lack of some rules or route? Thank you....

Hrm. Upgraded a little 60D dev firewall to 5.2 to give it a test drive. One of the first things I' ve noticed is that the packet capture menu that used to be under System > Network isn' t there any longer. I checked the 5.2 docs -- and it looks like that' s where it' s still *supposed* to be. Also checked the admin profile to make sure the super_admin profile still had " packet capture configuration" permissions (it does). Bug? Or am I just missing something.

Does anyone else also having the issue that the WAN IP is never showing up in the System Information Widget with 5.6.2?  ThxWayne

Hello, all: This question is against the very grain of my soul, but I have to ask. In all cases (except this one), I setup very strict security rules to keep the networks I manage safe: very limited ports and services allowed, using web and DNS filters, etc. I am asked to put in a Fortigate without knowing very little about the network. As best I can describe what I am being told, it should have the look and feel of two residential networks sharing one ISP. I can't make any other assumptions. I really cannot rule out things like custom apps or communications that have the look/feel of a game potentially. I've started by just allowing all services in the IP4 policies, with AV, default DNS and SSL set (see attachment)  I will not have any easy access to this location should I need to adjust or correct for anything. And the location owner would be very demanding in something being addressed with all haste (this is as diplomatically as I can put that). They ha

Good day Al We will be peering at out NAP provider over the next few days and they required the following to be configured on out layer 3 interface. no ip redirectsno ip proxy-arpno ip directed-broadcastno mop enable What the equivalent commands for the Fortigate, the above commands are for a Cisco. Thanks

Hi Guys, I need to configure a Fortigate 30D with the configuration steps in the link below (80CM): http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&externalId=FD33377 I don't need the IPTV feature, just internet. Are the steps straight forward as the link? or do I need CLI to program. Currently the 30D is not with me, thus I cant test. Thanks for your help. Ken

Hello!We have a fortgate 100D with FortiOS v5.6.9 build1673 (GA) In the Web Filter "Bandwidth Consuming" is "Streaming Media and Download" blocked. In the URL Filter I allowed youtube, but I always get the message "Web Page Blocked"! How do I unlock youtube?

Hello , I want create a report in Forti Analyser to see if a policy is used or hit, so that i can remove the unused policies. Kind Regards, Vincent 

Does anyone know how to view ciphers for access to HA cluster from client ?I configured below. and I would like to know whether what kind of ciphers it can be avairable.config system global   set strong-crypto enableconfig system global     set admin-https-ssl-versions tlsv1-2 thank you

Hi All Currently one of my client provide us an information of network diagram which include multiple and used Fortigate as gateway and routing for vlan as show from screenshot. My question is does different VLAN able to act as gateway without any interface IP for each VLAN connectivity? 

60E on 6.0.4.  I am using the FGT as DHCP server.  The FGT itself has timezone and offset (-5 hours Eastern) and reflects the correct time in the dashboard.  The DHCP server on the FGT is defined with "set timezone-option specify" and "set timezone 12" where "12" corresponds to -5 Eastern per "set timezone ?". The problem is, the FGT DHCP server is sending out option 2 time offset of -14400s which is -4  hours.  I've confirmed this with a packet capture made on the FGT and viewed in WireShark.  It should be sending -18000s or -5 hours. If I set the DHCP server to "set timezone-option default" I still have the same problem, the time offset is still -4 Anyone seen this issue before?

1. You will still get spam and no matter what you do it just keeps coming.2. You call support and report said SPAM and they either blame you, tell you that you need another license, or change a setting that breaks something else.3. You will spend a lot of your companies money and after they have the product a while you will be fired for incompetence.4. You could burn the money and have the same results.5. Because it like everything else Fortinet will sound great in sales meetings and fail to perform. Case in point is my wireless that still cannot handle streaming media or my Fortiswitch that failed after trying to update the firmware brand new out of the box (thanks for shipping old junk)6. Cisco If I am wrong I would love to retract my statements but 6 months into my job and I have to monitor the fortimail every day for hours while valid email gets held up and SPAM walks right through it. If anyone has any suggestions I would love to hear them because I am about ready to rip my g

Hi all, We are in the process of migrating a multi-tenant network from an old Sonicwall and looking for better alternatives. I really want to give Fortigates a go but i'm unsure whether it will satisfy our requirements, could not find config examples online. The public subnets we are given by the ISP are: Public main WAN subnet 1: 1.0.0.0/29Public ISP routed subnet 2: 2.0.0.0/30Public ISP routed subnet 3: 3.0.0.0/30 I've assigned subnets 2 & 3 to tenants' 2 & 3 gateway device, for example tenant 3 has a Draytek sitting behind the Sonicwall with a public IP address of 3.0.0.2 on it (3.0.0.1 is the Sonicwall). We needs to be able to do his own NAT. The way I've done this on the Sonicwall is shown here: http://help.sonicwall.com/help/sw/eng/6500/25/9/0/content/Ch27_Network_Interfaces.031.39.html Is there any way of doing this on the Fortigate and have a public subnet assigned to an internal host/VLAN/interface while bypassing the WAN interfa