Solved

Hi,if we have multiple vdoms and  port1 (physical interfaces ) assigned to vdom  root .In vdom root  we have under port1 multiple vlans are added and this interface is connected a cisco switch ( trunk port) .Now if I want to add another vlan under port1 , how can i do this ? Do I need to add from  interfaces under global  or  from interfaces  vdom root and add ? Thanks   

We are facing spam emails with only one image in the body.I've tryed to use the Security-->Other-->File Signiture, uploading the sha1 of the image ... but sadly this is used only in antivirus profile ... and from the documentation:"Because not all attachment files are virus carriers, FortiMail file signature check only supports the following file types: .7z, .bat, .cab, .dll, .doc, .docm, .dotm, exe, .gz, .hta, .inf, .jar, .js, .jse, .msi, .msp, pdf, .pif, .potm, .ppam, .ppsm, .ppt, .pptm, .pptx, .reg, .scr, .sldm, .swf, .tar, .vbe, .ws, .wsc, .wsf, .wsh, .xlam, .xls, .xlsm, .xlsx, .xltm, .Z, and .zip files." No image supported and no way to add more file types :( Any ideas? I'm using a 300D with v6.0,build126,181026 (6.0.3 GA) THX,Luca

We have a need to install a FortiGate and a WAP in a small medical office. Is this FortiAP 221E well suited for this or is there a different FortiAP or a different WAP altogether that would be best?

Hi guys, Today I was configuring a new FortiGate 100E. It was running version 5.6.3. When I wanted create a new policy, I wasn't able to select a source address, the source field got spinning like this:  For the others field I didn't have the problem, only for the source field. After rebooting the firewall kept the same. I downgraded to version 5.6.2 and the problem continues. What do you recommend? Have you experienced this sometime? Please help! Regards,Julián 

Hello.sorry for my bad english.I have fortigate 200d and i need set up transit vlanI move virtual server from my network to provider, and he can't give me l2 network, only trasnit l3Now i need set up transit vlan where i route my vlan, and i don't understand how i must create it.Cable from provider plug in physical interface on fortigate, i set ip of transit vlan on it and create vlan with tag.see attach  

Hi,I want to restrict management  access  . I mean only certain ip  should access the management interface  Thanks

Hello all,I am having some issues with WEB Filtering and SSL Inspection / Deep Inspection.So the first behaviour is, when using "Certificate Inspection" and "Inspect All Ports" IS NOT ticked, and I try to browse lets say a gambling site I get the "Web Page Blocked" splash screen by the Fortigate, so no problem, expected behaviour. Now the same thing but with "Inspect All Ports" ticked and trying to browse the same website the Website is allowed.  Now lets try the same but with "Deep Inspection" instead of "Certificate Inspection"Any options with "Inspect all Ports" enabled or disabled result on "This Page can't be displayed". So Conclusion:"Certificate Inspection":Inspect All Ports Ticked = Gambling Page is not blocked, normal access to page. Inspect all Ports is not Ticket and HTTPS = 443 = Fortigate Splash Screen "Web Page is Blocked" as Expected. Deep Inpection: "This Page can't be displayed". Finnally any sites I visit that are HTTP and not HTTPS I do get the Fo

We will soon have a 2nd line out of the Office. We are in a country with internet restrictions, so for these restricted sites like google, youtube, amazon etc. I want to route them over the 2nd line out which will connect to a sister office - in a country with no internet restrictions. I know policy / static based routing is all IP / Mask based. Looking around I found this link, where from a quick read it appears to be blocking the sites in one interface therefor sending them out the 2nd interface. Is this the only way to achieve something like this on the Fortios? Versions 5.4 / 5.6. Is there another way or a better way? Surely this must be done by others who are smarter than me! O0

Dear All, I'm new to Fortigate and new to the forum. Anyway, I have a problem configuring policies for blocking unwanted access from some external/malicious IP addresses.Here's what I did. config firewall policy    edit 4        set uuid 10be693f-5610-45a9-bebc-c27bd394177f        set srcintf "any"        set dstintf "any"        set srcaddr "group-blacklist"        set dstaddr "all"        set schedule "always"        set service "ALL"        set logtraffic all    nextend  I have put the policy on top of the list. However, when I tried accessing my FW from blocked IP address, it still can go through and no

Hi Everyone, Windows AD server with nested groups (groups of groups of persons). Trying to get FortiAuthenticator to add users via that group (and ultimately, sync users back too).  i have tried a bunch of things (and even enlisted support's help) and after several hours of work, they seemed frustrated and came back with a "it's not supported".  But, I found recent KB for Fortigate to rework the query to support finding users in nested groups. https://kb.fortinet.com/kb/viewContent.do?externalId=FD41657&sliceId=1 I also tracked a MS article speaking to the same: https://docs.microsoft.com/en-us/windows/desktop/adsi/search-filter-syntax So i have tried changing the query to align with that (experimenting with the queries in Authentication->Remote Auth Servers->LDAP, Import users by Group Membership, but not having any success.  It does find any user within a specific group, but not nested groups. Hoping to if someone knows if this i

I am missing something, I must be. In 5.6 OS, Security Profiles > Web Filter and I can see the default (or other) profile and I had a option for users who where allowed to bypass a block, via user account locally. On 6.0.4, I no longer have that option.  Only see FortiGuard category based filter, Static URL filter and Rating Options. What am I missing?  Brand new 61E I am setting up for a test lab, but my 200E has the prompt in both 6.0 and 5.6

I'm using a 61e at home and would like to get web filtering set up to monitor my child's internet usage and to block certain categories.  So I would like to both block and be able to see what sites were visited.  I would also like to have a separate filter for everyone else that blocks categories I want to block.  On that one I just want to pick malicious categories, etc. but don't need logging.   When I go to Security Profiles > Web Filter, I don't seem to have the plus icon to create a new profile.  I can only edit the default one.  

Hi,  I have a existing IPsec tunnel between head office (FG60E) and remote office (FG60D) for file sharing. At the moment existing tunnel is working fine from both side. Both device has v5.6.2 build1486   Now I got a requirement to route all the internet traffic from remote office device to head office device through existing tunnel.    I followed this configuration [link=https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-ipsecvpn/Internet_Browsing_Config/Config_Overview.htm]https://help.fortinet.com...ig/Config_Overview.htm[/link] but internet is not working   1. Create one security policy        2. Edit the default route in remote device to traffic internet through IPsec Interface Once I change the default route in remote device, all the traffic pass through VPN interface but internet is not working maybe not passing through head office device.  I am not expert the firewall, Any guidance appreciated  Thanks.

Hi I'm still very new to Fortigate stuff and firewalls in general and feel like I'm missing something very basic here. It is possible to create a group of specific IPs (not ranges) that I can add to at will and then use those in allow or deny rules.  At the moment the closest thing I can find is and address group, but that requires me to create an address for each IP that I'd want to add to the group.   At the moment I have a little over 26 IP's I'd like to add to the address and block all traffic with them, so creating an object for each on just to add to a group seems a little onerious, which makes me think I'm missing something very simple. As I'm a newb to all this, I do all my managerment though the web interface.

Hi all We soon will start with Fortinet NGFW devices in our company. We have an internal discussions about how to protect the inside -> out traffic which pass this new Fortinet. Until now, we had a Cisco device with "ip inspect" or "ZBFW" enabled. But this was not a NGFW with addtional security features, therefore we had an access list on the inside interface which just allowed the well-known traffic to the Internet. And in general, this was the source address of the proxy server plus several applications which needed a direct access. Now it comes to the question, do we still need this ACL on the inside interface? There are NGFW features now which protects and controls the traffic. And is an ACL still the correct way as this "only" goes on destination IP addresses/Ports and not on applications? Is it worth to do this additional work to have another security layer from inside -> out? I am wondering how other companies handles this topic, if it is good enough to have

Hi Everyone, How to enable the port forwarding for 5000 Synology and port 9999 CCTV ?My company subscribed dynamic IP from ISP.Last Friday, the vendor installed Fortigate 100E and he say only Static IP able to set port forwarding..Could someone save my life?Thank you.

Dear, I'm new to creating posts here and I have a question with wifi. Is it possible to disconnect a wifi user using username, MAC address or IP?

Hi all, Good day!The client wants a policy that they can access Facebook but for viewing only. They cannot do Comments, File/Status Upload and Play Videos but they can use  Facebook Messenger (App) and Messeger.com (Web). I already achieve the client's requirements but it requires to install the certificate generated from the FortiGate to avoid the Certificate Error. I just wanna confirm if this requirement of the client can achieve without using Deep Packet Inspection on the FortiGate? or is there a firmware version of the Fortigate that can achieve the same result but doesn't require Deep Packet Inspection? Best regards,

I'm replacing two FG500Ds with FG501Es.  Of course the interface names have changed between models.  All the cutting and pasting is just nonsense.  Fortunately I'm able to get one of my FG500Ds on 6.0.3 and use that config as a template for the FG501Es so I'm not crossing firmware versions which is impossible.Please Fortinet, build a converter tool for you customers.  As long as you are moving from FG to FG this should be free.  IT SHOULD ALSO DETAIL ERRORS WHEN FOUND IN THE CONFIG, PLEASE.  At the very least, having an app that would review the config and provide output/flag/warning to let you know what wouldn't work on the new system would be so helpful.  It is frustrating trying to use the Advanced/Script interface when it only shows Fail or Succeed but NO OTHER INFO?  How do I know what failed?  "diag debug config-error-log read" shows nothing.  That being said, it is really interesting when you dig into the config.  You f

Hi Pros, I'm facing with a strange issue with iPhones and Macs. We use Radius/WPA2 Enterprise Auth. for our SSID. If I connect the first time, the device get authenticated, but if I change the SSID and want connect back, it fails with wrong password. On the radius server (Win), the Eventlog says ok (see Attachement) and debug looks ok too. 2019-03-1814:41:35 16495.283 b0:19:c6:b5:57:58 <eh> send 1/4 msg of 4-Way Handshake2019-03-18 14:41:35 16495.283 b0:19:c6:b5:57:58 <eh> send IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=117 replay cnt 12019-03-18 14:41:35 16495.283 b0:19:c6:b5:57:58 <eh> IEEE 802.1X (EAPOL 121B) ==> b0:19:c6:b5:57:58 ws (0-10.0.0.14:5246) rId 0 wId 4 4a:5b:0e:39:31:3b2019-03-18 14:41:35 16495.286 b0:19:c6:b5:57:58 <eh> IEEE 802.1X (EAPOL 121B) <== b0:19:c6:b5:57:58 ws (0-10.0.0.14:5246) rId 0 wId 4 4a:5b:0e:39:31:3b2019-03-18 14:41:35 16495.286 b0:19:c6:b5:57:58 <eh> recv IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=117 2

Good Day experts, So my idea is to have a webserver (hosted as VM via Windows HyperV) on my machine on the internal network, to be accessible via VLAN from DMZ interface on our Fortigate E61 FortiOS v6.0.4 build0231 (GA). For the moment being, I know this sounds bad, but we're limited to the infrastructure currently available until we have this cloud hosted. We have the above mentioned fortigate unit and an ubiquity unifi managed switch between the internet and my local machine. My machine also has 2 NICs (one ethernet, the other Wifi) I want to make said webserver accessible via the fortigate's DMZ port (on VLAN 20), which then goes to the same unifi switch as mentioned above (again, over VLAN 20) then to my local machine's ethernet NIC which is used exclusively by the VM for traffic. These are the steps I have already taken:[ol]Created a virtual interface on my internal (Interface 1: 192.168.1.1) port addressed 192.168.2.1 255.255.255.0.Created a Virtual

Greetings. This is my first time posting here. My company has been using FortiAP 21C since I've started with the company. We've bought 2 FortiAP 221E and wanted them to start using them. The problem is that when I want to enter the default settings, I believe is 192.168.1.2, this doesn't seem to work with any of them. I've tried X.X.1.99 and X.X.2.1, other default settings but with no success. I can do fine with other AP (25D and 221C), but with these ones, they don't want to cooperate. I have also pressed the botton with a clip to restart it, and nothing. The LEDs that are turning on are the ethernet port: amber blinking, and the power (green). Any tips? Thanks in advance.

I have correctly set up fortiAnalyzer which connected to FortiGate and I got a log in log view without a problem. But in Fortiview I had a critical issue.Just I got a chart in Fortiview for less than 1 hour when the increase to 12 hours or more I got the error " No Data" This is the FortiAnalyzer info:FAZVM64-HVv6.0.4Administrative Domain: Off

We have a FG-3240C. We just received a replacement power supply SP-FG3000D-PS.Is there any documentation on how to remove bad power supply and install the new one?

Hi have an issue of with setting up an IPSEC VPN between two site.  WAN to WAN it works fine but LAN to LAN we have an issue. Config file removed