Solved

Hi,  I have a existing IPsec tunnel between head office (FG60E) and remote office (FG60D) for file sharing. At the moment existing tunnel is working fine from both side. Both device has v5.6.2 build1486   Now I got a requirement to route all the internet traffic from remote office device to head office device through existing tunnel.    I followed this configuration [link=https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-ipsecvpn/Internet_Browsing_Config/Config_Overview.htm]https://help.fortinet.com...ig/Config_Overview.htm[/link] but internet is not working   1. Create one security policy        2. Edit the default route in remote device to traffic internet through IPsec Interface Once I change the default route in remote device, all the traffic pass through VPN interface but internet is not working maybe not passing through head office device.  I am not expert the firewall, Any guidance appreciated  Thanks.

Hi I'm still very new to Fortigate stuff and firewalls in general and feel like I'm missing something very basic here. It is possible to create a group of specific IPs (not ranges) that I can add to at will and then use those in allow or deny rules.  At the moment the closest thing I can find is and address group, but that requires me to create an address for each IP that I'd want to add to the group.   At the moment I have a little over 26 IP's I'd like to add to the address and block all traffic with them, so creating an object for each on just to add to a group seems a little onerious, which makes me think I'm missing something very simple. As I'm a newb to all this, I do all my managerment though the web interface.

Hi all We soon will start with Fortinet NGFW devices in our company. We have an internal discussions about how to protect the inside -> out traffic which pass this new Fortinet. Until now, we had a Cisco device with "ip inspect" or "ZBFW" enabled. But this was not a NGFW with addtional security features, therefore we had an access list on the inside interface which just allowed the well-known traffic to the Internet. And in general, this was the source address of the proxy server plus several applications which needed a direct access. Now it comes to the question, do we still need this ACL on the inside interface? There are NGFW features now which protects and controls the traffic. And is an ACL still the correct way as this "only" goes on destination IP addresses/Ports and not on applications? Is it worth to do this additional work to have another security layer from inside -> out? I am wondering how other companies handles this topic, if it is good enough to have

Hi Everyone, How to enable the port forwarding for 5000 Synology and port 9999 CCTV ?My company subscribed dynamic IP from ISP.Last Friday, the vendor installed Fortigate 100E and he say only Static IP able to set port forwarding..Could someone save my life?Thank you.

Dear, I'm new to creating posts here and I have a question with wifi. Is it possible to disconnect a wifi user using username, MAC address or IP?

Hi all, Good day!The client wants a policy that they can access Facebook but for viewing only. They cannot do Comments, File/Status Upload and Play Videos but they can use  Facebook Messenger (App) and Messeger.com (Web). I already achieve the client's requirements but it requires to install the certificate generated from the FortiGate to avoid the Certificate Error. I just wanna confirm if this requirement of the client can achieve without using Deep Packet Inspection on the FortiGate? or is there a firmware version of the Fortigate that can achieve the same result but doesn't require Deep Packet Inspection? Best regards,

I'm replacing two FG500Ds with FG501Es.  Of course the interface names have changed between models.  All the cutting and pasting is just nonsense.  Fortunately I'm able to get one of my FG500Ds on 6.0.3 and use that config as a template for the FG501Es so I'm not crossing firmware versions which is impossible.Please Fortinet, build a converter tool for you customers.  As long as you are moving from FG to FG this should be free.  IT SHOULD ALSO DETAIL ERRORS WHEN FOUND IN THE CONFIG, PLEASE.  At the very least, having an app that would review the config and provide output/flag/warning to let you know what wouldn't work on the new system would be so helpful.  It is frustrating trying to use the Advanced/Script interface when it only shows Fail or Succeed but NO OTHER INFO?  How do I know what failed?  "diag debug config-error-log read" shows nothing.  That being said, it is really interesting when you dig into the config.  You f

Hi Pros, I'm facing with a strange issue with iPhones and Macs. We use Radius/WPA2 Enterprise Auth. for our SSID. If I connect the first time, the device get authenticated, but if I change the SSID and want connect back, it fails with wrong password. On the radius server (Win), the Eventlog says ok (see Attachement) and debug looks ok too. 2019-03-1814:41:35 16495.283 b0:19:c6:b5:57:58 <eh> send 1/4 msg of 4-Way Handshake2019-03-18 14:41:35 16495.283 b0:19:c6:b5:57:58 <eh> send IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=117 replay cnt 12019-03-18 14:41:35 16495.283 b0:19:c6:b5:57:58 <eh> IEEE 802.1X (EAPOL 121B) ==> b0:19:c6:b5:57:58 ws (0-10.0.0.14:5246) rId 0 wId 4 4a:5b:0e:39:31:3b2019-03-18 14:41:35 16495.286 b0:19:c6:b5:57:58 <eh> IEEE 802.1X (EAPOL 121B) <== b0:19:c6:b5:57:58 ws (0-10.0.0.14:5246) rId 0 wId 4 4a:5b:0e:39:31:3b2019-03-18 14:41:35 16495.286 b0:19:c6:b5:57:58 <eh> recv IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=117 2

Good Day experts, So my idea is to have a webserver (hosted as VM via Windows HyperV) on my machine on the internal network, to be accessible via VLAN from DMZ interface on our Fortigate E61 FortiOS v6.0.4 build0231 (GA). For the moment being, I know this sounds bad, but we're limited to the infrastructure currently available until we have this cloud hosted. We have the above mentioned fortigate unit and an ubiquity unifi managed switch between the internet and my local machine. My machine also has 2 NICs (one ethernet, the other Wifi) I want to make said webserver accessible via the fortigate's DMZ port (on VLAN 20), which then goes to the same unifi switch as mentioned above (again, over VLAN 20) then to my local machine's ethernet NIC which is used exclusively by the VM for traffic. These are the steps I have already taken:[ol]Created a virtual interface on my internal (Interface 1: 192.168.1.1) port addressed 192.168.2.1 255.255.255.0.Created a Virtual

Greetings. This is my first time posting here. My company has been using FortiAP 21C since I've started with the company. We've bought 2 FortiAP 221E and wanted them to start using them. The problem is that when I want to enter the default settings, I believe is 192.168.1.2, this doesn't seem to work with any of them. I've tried X.X.1.99 and X.X.2.1, other default settings but with no success. I can do fine with other AP (25D and 221C), but with these ones, they don't want to cooperate. I have also pressed the botton with a clip to restart it, and nothing. The LEDs that are turning on are the ethernet port: amber blinking, and the power (green). Any tips? Thanks in advance.

I have correctly set up fortiAnalyzer which connected to FortiGate and I got a log in log view without a problem. But in Fortiview I had a critical issue.Just I got a chart in Fortiview for less than 1 hour when the increase to 12 hours or more I got the error " No Data" This is the FortiAnalyzer info:FAZVM64-HVv6.0.4Administrative Domain: Off

We have a FG-3240C. We just received a replacement power supply SP-FG3000D-PS.Is there any documentation on how to remove bad power supply and install the new one?

Hi have an issue of with setting up an IPSEC VPN between two site.  WAN to WAN it works fine but LAN to LAN we have an issue. Config file removed

hi, seems a silly question, but why can't I see EIGRP in "Network" menu of FG200E? The only options are "RIP", "OSPF" and "BGP".Thanks

Hi together,after updating my 60E FortiOS to 5.6.3 no DHCP Server under Network / Edit Interface is shown.At "internal" Network it is shown - but not at additonal Network "dmz".Configuring whithin CLI is working w/o any problem - but it is not shown in GUI. ThanksGreetsRobert

Hi Guys,Thanks for the Forum it is super helpful and has helped me with other problems that I have had.For this particular problem I have spent quite a bit of time reading through the posts on the fortinet forum and the various cookbooks to find out what I am doing incorrect that this does not work. Unfortunately I do not have a team that is able to work with me on this and I am doing it by myself so thought that maybe someone can critique my config and spot what I am missing and hopefully point me in the right direction. I have a FG 100E it is OS 5.4.1 I have my main subnet as 12.12.12.228/30 Then I have additional subnet as 5.5.5.224/29 The modem only has one port connecting to WAN1. The FG has WAN1 with IP Address 12.12.12.230 I have tried the following recipe and others similar to: https://cookbook.fortinet...re-port-forwarding-54/ The closest that I can get is online websites saying that port 22 is open for 5.5.5.228. But if I try to SSH into this I do not get connection and

Hello, In new FortiOS 6.2 it seems that in firewall policies, the "Device" option seems not be available as source. Is this not supported any more in 6.2? Is it a bug? Is it something else? Has anybody experienced such thing and can help with an answer? Thanks

This error appears to our customers who used Forticlient to connect VPN.based on each customer I upgrade and downgrade the clients in  customers PC based on the situation of each customer , the issue solved temporary but it repeating again from time to time and i am repeating the same steps to solve the issue.kindly advice me if there is any permanent solution. on the other hand, another issue appears like the "Client connecting and disconnecting". I solved by remove the current client and install new ,and restart the PC, then it solved, but all this solutions are temporary and I am searching for better solutions.kindly advicethanks 

Hi,How can i create a trunk between to fortigate firewall  Thanks

Hello,I know that the TCP port used in SSL VPN is the 443 which is the port that identify HTTPS.Furthermore I know that I can achieve the SSL VPN tunnel via a web browser HTTPS enabled.So I ask if in SSL VPN, HPPS protocol is the only used application layer protocol also for non HTTP operations, such as search and open files, computer remote control (VNC), RDP sessions and so on.Thank you.   

Hello, New to Fortigate.  I have a customer that is having issues with their webfiltering.  They have had the product for some time, but have not gotten the webfiltering to work.  I can see that the webfiltering is on and licensed.  However, it is not blocking sites that are identified.  Does each machine have to have the FortiClient installed in order for the webfiltering to take place? athometechs

Hi,I'm trying to announce a default prefix from BGP.  My goal is that all BGP traffic will flow to my datacenter Fortigate, unless the network is announced somewhere else.  We're moving from Cisco to Fortigate... the command for Cisco was just 'network 0.0.0.0'.  I tried the following, but got the returned error code: FG (bgp) # config networkFG (network) # edit 1FG (1) # set prefix 0.0.0.0/0  (I also tried /32 and 0.0.0.0)The prefix 0.0.0.0/0 is not allowednode_check_object fail! for prefix 0.0.0.0/0 What is the equivalent or how can I accomplish this for the Fortigate.  Thanks.

Hello,  I've got a Fortigate 30E Firewall and I need to create some reservations on one of my VLANS. The idea is to use DHCP reservations as a sort of ACL so only hosts with known MAC addresses can get access to this VLAN. Previously I was using watchguard and I could set DHCP range to for exapmle: 192.168.1.200 - 192.168.1.200 and make reservations up to 192.168.1.254.In FortiOS I can't do it this way and the IP range of DHCP has to be exactly the same as number of reserved addresses, it creates some issues, because in my network it looks like this: 192.168.1.129/25 192.168.1.130-140 - warehouse workstations192.168.1.141-150 - warehouse printers192.168.1.151-160 - office workstations192.168.1.161-170 - office printers and so on So, when I was adding for example an office workstation I could make a reservation for address 192.168.1.155 and I didn't have to block unused addresses. Now I can't split it nicely, but I have to make a stack of addresse

Hi , I have the following Nat enabled policy Incoming interface is 10.1.1.1/24 Outgoing interface ip 4.4.4.4/24 And route  to  destination 8.8.8.8  via  gateway 10.1.1.1   If I ping 8.8.8.8 from source 10.2.2.2/24 . What will be the source ip? What if I ping 10.1.1.1 , the host 8.8.8.8 will reply? Thanks

Hi,When we need to use  software and hardware switch , what are the use case scenario. I saw most of the implementation does not  added any sort of switch in fortigate . Thanks