Solved

Hrm. Upgraded a little 60D dev firewall to 5.2 to give it a test drive. One of the first things I' ve noticed is that the packet capture menu that used to be under System > Network isn' t there any longer. I checked the 5.2 docs -- and it looks like that' s where it' s still *supposed* to be. Also checked the admin profile to make sure the super_admin profile still had " packet capture configuration" permissions (it does). Bug? Or am I just missing something.

Does anyone else also having the issue that the WAN IP is never showing up in the System Information Widget with 5.6.2?  ThxWayne

Hello, all: This question is against the very grain of my soul, but I have to ask. In all cases (except this one), I setup very strict security rules to keep the networks I manage safe: very limited ports and services allowed, using web and DNS filters, etc. I am asked to put in a Fortigate without knowing very little about the network. As best I can describe what I am being told, it should have the look and feel of two residential networks sharing one ISP. I can't make any other assumptions. I really cannot rule out things like custom apps or communications that have the look/feel of a game potentially. I've started by just allowing all services in the IP4 policies, with AV, default DNS and SSL set (see attachment)  I will not have any easy access to this location should I need to adjust or correct for anything. And the location owner would be very demanding in something being addressed with all haste (this is as diplomatically as I can put that). They ha

Good day Al We will be peering at out NAP provider over the next few days and they required the following to be configured on out layer 3 interface. no ip redirectsno ip proxy-arpno ip directed-broadcastno mop enable What the equivalent commands for the Fortigate, the above commands are for a Cisco. Thanks

Hi Guys, I need to configure a Fortigate 30D with the configuration steps in the link below (80CM): http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&externalId=FD33377 I don't need the IPTV feature, just internet. Are the steps straight forward as the link? or do I need CLI to program. Currently the 30D is not with me, thus I cant test. Thanks for your help. Ken

Hello!We have a fortgate 100D with FortiOS v5.6.9 build1673 (GA) In the Web Filter "Bandwidth Consuming" is "Streaming Media and Download" blocked. In the URL Filter I allowed youtube, but I always get the message "Web Page Blocked"! How do I unlock youtube?

Hello , I want create a report in Forti Analyser to see if a policy is used or hit, so that i can remove the unused policies. Kind Regards, Vincent 

Does anyone know how to view ciphers for access to HA cluster from client ?I configured below. and I would like to know whether what kind of ciphers it can be avairable.config system global   set strong-crypto enableconfig system global     set admin-https-ssl-versions tlsv1-2 thank you

Hi All Currently one of my client provide us an information of network diagram which include multiple and used Fortigate as gateway and routing for vlan as show from screenshot. My question is does different VLAN able to act as gateway without any interface IP for each VLAN connectivity? 

60E on 6.0.4.  I am using the FGT as DHCP server.  The FGT itself has timezone and offset (-5 hours Eastern) and reflects the correct time in the dashboard.  The DHCP server on the FGT is defined with "set timezone-option specify" and "set timezone 12" where "12" corresponds to -5 Eastern per "set timezone ?". The problem is, the FGT DHCP server is sending out option 2 time offset of -14400s which is -4  hours.  I've confirmed this with a packet capture made on the FGT and viewed in WireShark.  It should be sending -18000s or -5 hours. If I set the DHCP server to "set timezone-option default" I still have the same problem, the time offset is still -4 Anyone seen this issue before?

1. You will still get spam and no matter what you do it just keeps coming.2. You call support and report said SPAM and they either blame you, tell you that you need another license, or change a setting that breaks something else.3. You will spend a lot of your companies money and after they have the product a while you will be fired for incompetence.4. You could burn the money and have the same results.5. Because it like everything else Fortinet will sound great in sales meetings and fail to perform. Case in point is my wireless that still cannot handle streaming media or my Fortiswitch that failed after trying to update the firmware brand new out of the box (thanks for shipping old junk)6. Cisco If I am wrong I would love to retract my statements but 6 months into my job and I have to monitor the fortimail every day for hours while valid email gets held up and SPAM walks right through it. If anyone has any suggestions I would love to hear them because I am about ready to rip my g

Hi all, We are in the process of migrating a multi-tenant network from an old Sonicwall and looking for better alternatives. I really want to give Fortigates a go but i'm unsure whether it will satisfy our requirements, could not find config examples online. The public subnets we are given by the ISP are: Public main WAN subnet 1: 1.0.0.0/29Public ISP routed subnet 2: 2.0.0.0/30Public ISP routed subnet 3: 3.0.0.0/30 I've assigned subnets 2 & 3 to tenants' 2 & 3 gateway device, for example tenant 3 has a Draytek sitting behind the Sonicwall with a public IP address of 3.0.0.2 on it (3.0.0.1 is the Sonicwall). We needs to be able to do his own NAT. The way I've done this on the Sonicwall is shown here: http://help.sonicwall.com/help/sw/eng/6500/25/9/0/content/Ch27_Network_Interfaces.031.39.html Is there any way of doing this on the Fortigate and have a public subnet assigned to an internal host/VLAN/interface while bypassing the WAN interfa

Hello, I wonder what does FDS stand for from output of diagnose sys top?  regards,

Hello everyone ! I am on version 6.2.0 of FortiOS. I created the SD-WAN interface and added the 3 existing interfaces, the internet link, the vpn and the link mpls. I created the required policies with NAT. I am having a problem on the MPLS link that I do not want to NAT because it is in my internal network. Is it possible to NAT on the internet links but not on the MPLS interface? [&o] Thanks in advance and have a good day!

Hello All, I am trying to understand if it is possible to export all configuration related with NATs, for example the Virtual IPs and IP pools.From Fortimanager can only export Firewall rules. Thanks in advance

We have a FortiWiFi serving about 8 users running FortiOS 6.04. The bandwidth at the location is fast: 300/20. The firewall is set to Proxy. We noticed on about 4 different occasions that when trying to download a file from a remote server (connected via WAN1) that the download would take an exceptional long time or would fail. This occurred on multiple computer on the network, different browsers, different source servers, over a number of days. This happened even when no other activity was taking place on the network at the time. We finally did some testing. We noticed that when downloading with AV and Web Filter security profiles Off in the IPv4 Policy that the download speed was about 18 Mb/s. With either AV and Web Filter security profiles On in the IPv4 Policy the download speed was initially 1 Mb/s. After about a minute though the speed would fall from 1 Mb/s all the way down to 5 Kb/s. We further isolated the performance impact to the HTTP inspection in the AV Profile.

Has anyone used a Netgear 4G LTE Modem (LB2120) as a backup WAN connection on a FortiGate. The primary WAN 1 connection will be a fiber connection. Would like a fail-over WAN 2 connection using SD-WAN in the event the fiber connection fails. Are there other alternatives to this that should instead be considered?

Sorry for so many questions below. I am kind of a newbie concerning security certificates. [ol]Are purchased (CA) security certificates a good idea when doing deep packet (SSL) inspection on a FortiGate?What benefit does a purchased (CA) security certificate offer over the built in certificate?What are the benefits of a commercial certificate (CA) over a self-signed certificate?Are all purchased (CA) certificates the same and are they all compatible with the FortiGate?If a business has a website that is externally hosted and a FortiGate and they would like a security certificate to apply to both the website and the local network (FortiGate), would this involve a different certificate?Any recommendations on where to get commercial (CA) certificates?[/ol]Thanks in advance for any help folks can provide. 

I have two networks 172.20.1.0/24 & 172.20.2.0/24 both behind NAT routers with 60E's connected to those routers. I have configured SITE to SITE ipsec for the corporate network on a static IP 100D routing  172.18.0.0/16 for both SITES and this works fine. But now I would like to ping SITE 1 172.20.1.1 from SITE 2 172.20.2.1 and I'm not sure if I can config something up on the PHASE2 connectors at each site to allow the packets to flow between the two NATed routers via the static IP Router.  See diagram attached

Hi everyone, We have a website blocked by AntiVirus. But We want to access the website no matter the warning.How can I change the AntiVirus-configuration to allow this website?

The environment is this: FortiGate 60E (5.6.2)FortiAP-224D (5.6)HP LaserJet m425dn (running latest firmware)Mac OSX 10.12.6 The printer is connected to the "internal" switch on the FortiGate.  The FortiAP is also connected and being managed via the FortiGate.  IPv4 policies are in place to allow all traffic to and from the wireless network to the internal switch.  No restrictions should be in place preventing any traffic from going to and from the subnets. I have also created a multicast policy that allows Bonjour from internal to wireless and wireless to internal. My Mac clients are losing connection to the printer shortly after connecting to it.  For example, if you use the HP Utility, you can discover and add the printer to the client, however when going to print, the client loses connection.  I don't have any Windows systems to test against at this time. The printer responds to ping (and they could telnet) from wireless clients, but

Hi, I have installed fortigate VM 64 bit running VMware. I have enabled 2 interfaces WAN & LAN & enabled management access on both the interfaces. I have assigned static IP address to both the interfaces. The WAN interface VM NIC mode is set to Nat & the Lan interface of the fortigate VM NIC is set to host mode. From the fortigate firewall I am able to ping the internet & the lan guest VM as well. But i am not able to access internet from the internal guest VM though I have a policy with nat enabled & allowed all services. Any guesses or ideas to get this working would be really helpful. Regards Sebastan

Hi,Is it possible to aggregate the A and B interfaces on this model ? They are dedicated to one asic each..

lots of bugfixes https://docs.fortinet.com...release-notes/download

Hi,I can see that it is possible to configure and import explicit proxy policy but can't find the proxy addresses? are they supported in FortiManager? Thanks,Rafal