Solved

Hello, I wonder what does FDS stand for from output of diagnose sys top?  regards,

Hello everyone ! I am on version 6.2.0 of FortiOS. I created the SD-WAN interface and added the 3 existing interfaces, the internet link, the vpn and the link mpls. I created the required policies with NAT. I am having a problem on the MPLS link that I do not want to NAT because it is in my internal network. Is it possible to NAT on the internet links but not on the MPLS interface? [&o] Thanks in advance and have a good day!

Hello All, I am trying to understand if it is possible to export all configuration related with NATs, for example the Virtual IPs and IP pools.From Fortimanager can only export Firewall rules. Thanks in advance

We have a FortiWiFi serving about 8 users running FortiOS 6.04. The bandwidth at the location is fast: 300/20. The firewall is set to Proxy. We noticed on about 4 different occasions that when trying to download a file from a remote server (connected via WAN1) that the download would take an exceptional long time or would fail. This occurred on multiple computer on the network, different browsers, different source servers, over a number of days. This happened even when no other activity was taking place on the network at the time. We finally did some testing. We noticed that when downloading with AV and Web Filter security profiles Off in the IPv4 Policy that the download speed was about 18 Mb/s. With either AV and Web Filter security profiles On in the IPv4 Policy the download speed was initially 1 Mb/s. After about a minute though the speed would fall from 1 Mb/s all the way down to 5 Kb/s. We further isolated the performance impact to the HTTP inspection in the AV Profile.

Has anyone used a Netgear 4G LTE Modem (LB2120) as a backup WAN connection on a FortiGate. The primary WAN 1 connection will be a fiber connection. Would like a fail-over WAN 2 connection using SD-WAN in the event the fiber connection fails. Are there other alternatives to this that should instead be considered?

Sorry for so many questions below. I am kind of a newbie concerning security certificates. [ol]Are purchased (CA) security certificates a good idea when doing deep packet (SSL) inspection on a FortiGate?What benefit does a purchased (CA) security certificate offer over the built in certificate?What are the benefits of a commercial certificate (CA) over a self-signed certificate?Are all purchased (CA) certificates the same and are they all compatible with the FortiGate?If a business has a website that is externally hosted and a FortiGate and they would like a security certificate to apply to both the website and the local network (FortiGate), would this involve a different certificate?Any recommendations on where to get commercial (CA) certificates?[/ol]Thanks in advance for any help folks can provide. 

I have two networks 172.20.1.0/24 & 172.20.2.0/24 both behind NAT routers with 60E's connected to those routers. I have configured SITE to SITE ipsec for the corporate network on a static IP 100D routing  172.18.0.0/16 for both SITES and this works fine. But now I would like to ping SITE 1 172.20.1.1 from SITE 2 172.20.2.1 and I'm not sure if I can config something up on the PHASE2 connectors at each site to allow the packets to flow between the two NATed routers via the static IP Router.  See diagram attached

Hi everyone, We have a website blocked by AntiVirus. But We want to access the website no matter the warning.How can I change the AntiVirus-configuration to allow this website?

The environment is this: FortiGate 60E (5.6.2)FortiAP-224D (5.6)HP LaserJet m425dn (running latest firmware)Mac OSX 10.12.6 The printer is connected to the "internal" switch on the FortiGate.  The FortiAP is also connected and being managed via the FortiGate.  IPv4 policies are in place to allow all traffic to and from the wireless network to the internal switch.  No restrictions should be in place preventing any traffic from going to and from the subnets. I have also created a multicast policy that allows Bonjour from internal to wireless and wireless to internal. My Mac clients are losing connection to the printer shortly after connecting to it.  For example, if you use the HP Utility, you can discover and add the printer to the client, however when going to print, the client loses connection.  I don't have any Windows systems to test against at this time. The printer responds to ping (and they could telnet) from wireless clients, but

Hi, I have installed fortigate VM 64 bit running VMware. I have enabled 2 interfaces WAN & LAN & enabled management access on both the interfaces. I have assigned static IP address to both the interfaces. The WAN interface VM NIC mode is set to Nat & the Lan interface of the fortigate VM NIC is set to host mode. From the fortigate firewall I am able to ping the internet & the lan guest VM as well. But i am not able to access internet from the internal guest VM though I have a policy with nat enabled & allowed all services. Any guesses or ideas to get this working would be really helpful. Regards Sebastan

Hi,Is it possible to aggregate the A and B interfaces on this model ? They are dedicated to one asic each..

lots of bugfixes https://docs.fortinet.com...release-notes/download

Hi,I can see that it is possible to configure and import explicit proxy policy but can't find the proxy addresses? are they supported in FortiManager? Thanks,Rafal

Hi,if we have multiple vdoms and  port1 (physical interfaces ) assigned to vdom  root .In vdom root  we have under port1 multiple vlans are added and this interface is connected a cisco switch ( trunk port) .Now if I want to add another vlan under port1 , how can i do this ? Do I need to add from  interfaces under global  or  from interfaces  vdom root and add ? Thanks   

We are facing spam emails with only one image in the body.I've tryed to use the Security-->Other-->File Signiture, uploading the sha1 of the image ... but sadly this is used only in antivirus profile ... and from the documentation:"Because not all attachment files are virus carriers, FortiMail file signature check only supports the following file types: .7z, .bat, .cab, .dll, .doc, .docm, .dotm, exe, .gz, .hta, .inf, .jar, .js, .jse, .msi, .msp, pdf, .pif, .potm, .ppam, .ppsm, .ppt, .pptm, .pptx, .reg, .scr, .sldm, .swf, .tar, .vbe, .ws, .wsc, .wsf, .wsh, .xlam, .xls, .xlsm, .xlsx, .xltm, .Z, and .zip files." No image supported and no way to add more file types :( Any ideas? I'm using a 300D with v6.0,build126,181026 (6.0.3 GA) THX,Luca

We have a need to install a FortiGate and a WAP in a small medical office. Is this FortiAP 221E well suited for this or is there a different FortiAP or a different WAP altogether that would be best?

Hi guys, Today I was configuring a new FortiGate 100E. It was running version 5.6.3. When I wanted create a new policy, I wasn't able to select a source address, the source field got spinning like this:  For the others field I didn't have the problem, only for the source field. After rebooting the firewall kept the same. I downgraded to version 5.6.2 and the problem continues. What do you recommend? Have you experienced this sometime? Please help! Regards,Julián 

Hello.sorry for my bad english.I have fortigate 200d and i need set up transit vlanI move virtual server from my network to provider, and he can't give me l2 network, only trasnit l3Now i need set up transit vlan where i route my vlan, and i don't understand how i must create it.Cable from provider plug in physical interface on fortigate, i set ip of transit vlan on it and create vlan with tag.see attach  

Hi,I want to restrict management  access  . I mean only certain ip  should access the management interface  Thanks

Hello all,I am having some issues with WEB Filtering and SSL Inspection / Deep Inspection.So the first behaviour is, when using "Certificate Inspection" and "Inspect All Ports" IS NOT ticked, and I try to browse lets say a gambling site I get the "Web Page Blocked" splash screen by the Fortigate, so no problem, expected behaviour. Now the same thing but with "Inspect All Ports" ticked and trying to browse the same website the Website is allowed.  Now lets try the same but with "Deep Inspection" instead of "Certificate Inspection"Any options with "Inspect all Ports" enabled or disabled result on "This Page can't be displayed". So Conclusion:"Certificate Inspection":Inspect All Ports Ticked = Gambling Page is not blocked, normal access to page. Inspect all Ports is not Ticket and HTTPS = 443 = Fortigate Splash Screen "Web Page is Blocked" as Expected. Deep Inpection: "This Page can't be displayed". Finnally any sites I visit that are HTTP and not HTTPS I do get the Fo

We will soon have a 2nd line out of the Office. We are in a country with internet restrictions, so for these restricted sites like google, youtube, amazon etc. I want to route them over the 2nd line out which will connect to a sister office - in a country with no internet restrictions. I know policy / static based routing is all IP / Mask based. Looking around I found this link, where from a quick read it appears to be blocking the sites in one interface therefor sending them out the 2nd interface. Is this the only way to achieve something like this on the Fortios? Versions 5.4 / 5.6. Is there another way or a better way? Surely this must be done by others who are smarter than me! O0

Dear All, I'm new to Fortigate and new to the forum. Anyway, I have a problem configuring policies for blocking unwanted access from some external/malicious IP addresses.Here's what I did. config firewall policy    edit 4        set uuid 10be693f-5610-45a9-bebc-c27bd394177f        set srcintf "any"        set dstintf "any"        set srcaddr "group-blacklist"        set dstaddr "all"        set schedule "always"        set service "ALL"        set logtraffic all    nextend  I have put the policy on top of the list. However, when I tried accessing my FW from blocked IP address, it still can go through and no

Hi Everyone, Windows AD server with nested groups (groups of groups of persons). Trying to get FortiAuthenticator to add users via that group (and ultimately, sync users back too).  i have tried a bunch of things (and even enlisted support's help) and after several hours of work, they seemed frustrated and came back with a "it's not supported".  But, I found recent KB for Fortigate to rework the query to support finding users in nested groups. https://kb.fortinet.com/kb/viewContent.do?externalId=FD41657&sliceId=1 I also tracked a MS article speaking to the same: https://docs.microsoft.com/en-us/windows/desktop/adsi/search-filter-syntax So i have tried changing the query to align with that (experimenting with the queries in Authentication->Remote Auth Servers->LDAP, Import users by Group Membership, but not having any success.  It does find any user within a specific group, but not nested groups. Hoping to if someone knows if this i

I am missing something, I must be. In 5.6 OS, Security Profiles > Web Filter and I can see the default (or other) profile and I had a option for users who where allowed to bypass a block, via user account locally. On 6.0.4, I no longer have that option.  Only see FortiGuard category based filter, Static URL filter and Rating Options. What am I missing?  Brand new 61E I am setting up for a test lab, but my 200E has the prompt in both 6.0 and 5.6

I'm using a 61e at home and would like to get web filtering set up to monitor my child's internet usage and to block certain categories.  So I would like to both block and be able to see what sites were visited.  I would also like to have a separate filter for everyone else that blocks categories I want to block.  On that one I just want to pick malicious categories, etc. but don't need logging.   When I go to Security Profiles > Web Filter, I don't seem to have the plus icon to create a new profile.  I can only edit the default one.