Solved

hi, seems a silly question, but why can't I see EIGRP in "Network" menu of FG200E? The only options are "RIP", "OSPF" and "BGP".Thanks

Hi together,after updating my 60E FortiOS to 5.6.3 no DHCP Server under Network / Edit Interface is shown.At "internal" Network it is shown - but not at additonal Network "dmz".Configuring whithin CLI is working w/o any problem - but it is not shown in GUI. ThanksGreetsRobert

Hi Guys,Thanks for the Forum it is super helpful and has helped me with other problems that I have had.For this particular problem I have spent quite a bit of time reading through the posts on the fortinet forum and the various cookbooks to find out what I am doing incorrect that this does not work. Unfortunately I do not have a team that is able to work with me on this and I am doing it by myself so thought that maybe someone can critique my config and spot what I am missing and hopefully point me in the right direction. I have a FG 100E it is OS 5.4.1 I have my main subnet as 12.12.12.228/30 Then I have additional subnet as 5.5.5.224/29 The modem only has one port connecting to WAN1. The FG has WAN1 with IP Address 12.12.12.230 I have tried the following recipe and others similar to: https://cookbook.fortinet...re-port-forwarding-54/ The closest that I can get is online websites saying that port 22 is open for 5.5.5.228. But if I try to SSH into this I do not get connection and

Hello, In new FortiOS 6.2 it seems that in firewall policies, the "Device" option seems not be available as source. Is this not supported any more in 6.2? Is it a bug? Is it something else? Has anybody experienced such thing and can help with an answer? Thanks

This error appears to our customers who used Forticlient to connect VPN.based on each customer I upgrade and downgrade the clients in  customers PC based on the situation of each customer , the issue solved temporary but it repeating again from time to time and i am repeating the same steps to solve the issue.kindly advice me if there is any permanent solution. on the other hand, another issue appears like the "Client connecting and disconnecting". I solved by remove the current client and install new ,and restart the PC, then it solved, but all this solutions are temporary and I am searching for better solutions.kindly advicethanks 

Hi,How can i create a trunk between to fortigate firewall  Thanks

Hello,I know that the TCP port used in SSL VPN is the 443 which is the port that identify HTTPS.Furthermore I know that I can achieve the SSL VPN tunnel via a web browser HTTPS enabled.So I ask if in SSL VPN, HPPS protocol is the only used application layer protocol also for non HTTP operations, such as search and open files, computer remote control (VNC), RDP sessions and so on.Thank you.   

Hello, New to Fortigate.  I have a customer that is having issues with their webfiltering.  They have had the product for some time, but have not gotten the webfiltering to work.  I can see that the webfiltering is on and licensed.  However, it is not blocking sites that are identified.  Does each machine have to have the FortiClient installed in order for the webfiltering to take place? athometechs

Hi,I'm trying to announce a default prefix from BGP.  My goal is that all BGP traffic will flow to my datacenter Fortigate, unless the network is announced somewhere else.  We're moving from Cisco to Fortigate... the command for Cisco was just 'network 0.0.0.0'.  I tried the following, but got the returned error code: FG (bgp) # config networkFG (network) # edit 1FG (1) # set prefix 0.0.0.0/0  (I also tried /32 and 0.0.0.0)The prefix 0.0.0.0/0 is not allowednode_check_object fail! for prefix 0.0.0.0/0 What is the equivalent or how can I accomplish this for the Fortigate.  Thanks.

Hello,  I've got a Fortigate 30E Firewall and I need to create some reservations on one of my VLANS. The idea is to use DHCP reservations as a sort of ACL so only hosts with known MAC addresses can get access to this VLAN. Previously I was using watchguard and I could set DHCP range to for exapmle: 192.168.1.200 - 192.168.1.200 and make reservations up to 192.168.1.254.In FortiOS I can't do it this way and the IP range of DHCP has to be exactly the same as number of reserved addresses, it creates some issues, because in my network it looks like this: 192.168.1.129/25 192.168.1.130-140 - warehouse workstations192.168.1.141-150 - warehouse printers192.168.1.151-160 - office workstations192.168.1.161-170 - office printers and so on So, when I was adding for example an office workstation I could make a reservation for address 192.168.1.155 and I didn't have to block unused addresses. Now I can't split it nicely, but I have to make a stack of addresse

Hi , I have the following Nat enabled policy Incoming interface is 10.1.1.1/24 Outgoing interface ip 4.4.4.4/24 And route  to  destination 8.8.8.8  via  gateway 10.1.1.1   If I ping 8.8.8.8 from source 10.2.2.2/24 . What will be the source ip? What if I ping 10.1.1.1 , the host 8.8.8.8 will reply? Thanks

Hi,When we need to use  software and hardware switch , what are the use case scenario. I saw most of the implementation does not  added any sort of switch in fortigate . Thanks

Our client has asked for a report that would show a list of the top users (or IPs) that have visited specific web filter categories.  I do not see any of the system datasets that have the combination of these fields.   It could be as simple as this: User              Category             Count10.0.0.3         Hacking                1210.0.0.5         Proxy Avoidance    810.0.0.3         Proxy Avoidance    510.0.0.4         Discrimination       2 Thanks! 

Hi,I have 2 Fortinet device 60E and 60D. I have been trying to create a VPN tunnel between the device.   I followed this cookbook article https://cookbook.fortinet.com/site-site-ipsec-vpn-two-fortigates-56/ and both my devices are behind the NAT So, I had to change the NAT setting beside I followed every single step mentioned in this article.  In the end tunnel is NOT UP so, I tried to converted the tunnel to custom and disabled NAT-T, then tunnel is UP but traffic is not passing. Not sure where to look for issue. Any guidance highly appreciate. Both devices have v5.6.2 build1486 (GA) firmware.   Thanks.

Hi everyone, I use fortigate 300D build the ipsec-vpn tunnel between Site A and Site BSite A has two subnets, one is 10.80.0.0/24 the other one is 10.80.102.0/24Site B has one subnet, 10.0.0.0/24 host 10.80.0.100 can ping host 10.0.0.98 here is the problem  At the beginning, 10.80.102.32 can't ping 10.0.0.98 ,but 10.0.0.98 can ping 10.80.102.32When I use host 10.0.0.98 ping host 10.80.102.32  first,then host 10.80.102.32 can ping host 10.0.0.98 After I use  "Ctrl + C"in cmd to stop the ping on host 10.0.0.98, then 10.80.102.32 can't ping 10.0.0.98 again.. Can someone please assist in directing me in the correct direction? I don't know where the problem is.. Thanks  

Hi, I have 2 Fortinet device 60E and 60D. I have been trying to create a VPN tunnel between the device. I followed this cookbook article https://cookbook.fortinet.com/site-site-ipsec-vpn-two-fortigates-56/ and both my devices are behind the NAT So, I had to change the NAT setting beside I followed every single step mentioned in this article.  In the end tunnel is NOT UP so, I tried to converted the tunnel to custom and disabled NAT-T, then tunnel is UP but traffic is not passing.Not sure where to look for issue. Any guidance highly appreciate. Both devices have v5.6.2 build1486 (GA) firmware.   Thanks.

Hi, I'm thinking of buying a FG 60E to replace a pfSense firewall on top of VMWare. I have some experience with Fortigate and I was very pleased by the possibilities, but that was in a simpler environment. The pfSense is currently connected to almost 20 VLAN's and serving as DHCP server in all these networks. Can I do the same with the FortiGate? And are there any pitfalls? Thanks in advance  

I have a problem. I have selected "Traffic Shaping" in System -> Future select. And i created a new traffic shaping policy. Everything is ok. But when i enter "Policy & Objects" and select one policy(click edit), Traffic shaping options do not showing under "Security Profiles" menu (please look attechment)How i resolve this problem?

Hello,We have just connected new Sharp Printer (mx-4071) to our network. Everything works fine, but we can't get access to it by AirPrint from subnets. I can ping them/access the configuration site, but the AirPrint doesn't find them. Do you have any advice how should I change it? My network "administrator" tells me that he can't do anything in Fortigate and I need to change sth in AirPort's express. I'm attaching simple schematic of my connections. 

Hello, I'm exchanging my WatchGuard router to FortiGate 60E with 1 to 1 setting if possible and I'm not sure how to implement my NAT settings on FortiGate: Dynamic DNS pool and 1-to-1 NAT: NAT settings in example policy:  And this is how it looks in my FG GUI:   My second concern is the Incoming interface in my policies. I have like 6 VPN site-to-site tunnels and do I have to add every tunnel and VLAN as incoming interface or I can just set it to 'any' and restrict access to specific source and service. It worries me because NAT in this specific policy is turned off and 'any' includes WAN interface. Whats the best way to handle it? Thank you in advance for your answers!

Fortigate 1500DFirmwarev6.0.4 build0231 (GA)Mode NAT (Flow-based)System  Hello, When I install a new policy, the firewall drops the estabilished connections packets affected by the new rule.E.g. If I have a nfs connection, after policy applying, I have to restart it. It happens the same with database connections. Is there any workaround to avoid restart systems? Thank youRafa

hi,I am trying to setup a FortiWiFi 40C to work with our network. I hope this is even the correct subforum. We have an adsl-modem connected to WAN1 of the FortiWiFi, a large switch on LAN1 for alle the client-PCs and a bintec elmeg hybird 300 PBX system for VoiP on LAN2.Our ISP has given us 4 public IP Adresses as well as a gateway IP.The Gateway IP is public.97, useable addresses are public.98 to public.102. Only public.98 is allowed for SIP-login for VoiP though.What I am trying to achieve is to route all traffic for public.98 to the PBX on LAN2, and let the clients access the internet with public.99. For remote access to our NAS i would also need public.100 forwarded to the NASes IP on LAN1, but this is secondary. Right now I configured the WAN-Interface to connect to the modem with PPPoE which works fine, but all clients now have public.97 as public IP. Can somebody point me in the right direction what I have to configure? [strike]*edit: We had a working setup with a

Recently upgraded to said version.  Noticed that while creating a new policy using GUI, unable to see the '+' symbol while adding multiple interfaces (from/to). Also tried pressing ctrl button while doing the selection.   However, existing policies that have multiple interfaces remain.  So I tried using CLI and by comparing existing policies, able to use CLI to add the multiple interfaces. And this shows up on the GUI.  Hence, would like to confirm, whether is this a bug, or simply a removal of the existing feature.Would upgrading to v6 bring this back?  Thanks for your time.  

anyone else got this "issue" ? [&:] Regards, Jan

We're configuring our Internet circuit for BGP.  I've been instructed by our Network Provider to set our community to 100:999.  The 999 will allow for a subnet smaller than /24 to be announced.  What is the command or process to do this on the Fortigate 500e?I believe it would be the Cisco equivalent of 'set community 100:999'Thanks!