Solved

Sorry for so many questions below. I am kind of a newbie concerning security certificates. [ol]Are purchased (CA) security certificates a good idea when doing deep packet (SSL) inspection on a FortiGate?What benefit does a purchased (CA) security certificate offer over the built in certificate?What are the benefits of a commercial certificate (CA) over a self-signed certificate?Are all purchased (CA) certificates the same and are they all compatible with the FortiGate?If a business has a website that is externally hosted and a FortiGate and they would like a security certificate to apply to both the website and the local network (FortiGate), would this involve a different certificate?Any recommendations on where to get commercial (CA) certificates?[/ol]Thanks in advance for any help folks can provide. 

I have two networks 172.20.1.0/24 & 172.20.2.0/24 both behind NAT routers with 60E's connected to those routers. I have configured SITE to SITE ipsec for the corporate network on a static IP 100D routing  172.18.0.0/16 for both SITES and this works fine. But now I would like to ping SITE 1 172.20.1.1 from SITE 2 172.20.2.1 and I'm not sure if I can config something up on the PHASE2 connectors at each site to allow the packets to flow between the two NATed routers via the static IP Router.  See diagram attached

Hi everyone, We have a website blocked by AntiVirus. But We want to access the website no matter the warning.How can I change the AntiVirus-configuration to allow this website?

The environment is this: FortiGate 60E (5.6.2)FortiAP-224D (5.6)HP LaserJet m425dn (running latest firmware)Mac OSX 10.12.6 The printer is connected to the "internal" switch on the FortiGate.  The FortiAP is also connected and being managed via the FortiGate.  IPv4 policies are in place to allow all traffic to and from the wireless network to the internal switch.  No restrictions should be in place preventing any traffic from going to and from the subnets. I have also created a multicast policy that allows Bonjour from internal to wireless and wireless to internal. My Mac clients are losing connection to the printer shortly after connecting to it.  For example, if you use the HP Utility, you can discover and add the printer to the client, however when going to print, the client loses connection.  I don't have any Windows systems to test against at this time. The printer responds to ping (and they could telnet) from wireless clients, but

Hi, I have installed fortigate VM 64 bit running VMware. I have enabled 2 interfaces WAN & LAN & enabled management access on both the interfaces. I have assigned static IP address to both the interfaces. The WAN interface VM NIC mode is set to Nat & the Lan interface of the fortigate VM NIC is set to host mode. From the fortigate firewall I am able to ping the internet & the lan guest VM as well. But i am not able to access internet from the internal guest VM though I have a policy with nat enabled & allowed all services. Any guesses or ideas to get this working would be really helpful. Regards Sebastan

Hi,Is it possible to aggregate the A and B interfaces on this model ? They are dedicated to one asic each..

lots of bugfixes https://docs.fortinet.com...release-notes/download

Hi,I can see that it is possible to configure and import explicit proxy policy but can't find the proxy addresses? are they supported in FortiManager? Thanks,Rafal

Hi,if we have multiple vdoms and  port1 (physical interfaces ) assigned to vdom  root .In vdom root  we have under port1 multiple vlans are added and this interface is connected a cisco switch ( trunk port) .Now if I want to add another vlan under port1 , how can i do this ? Do I need to add from  interfaces under global  or  from interfaces  vdom root and add ? Thanks   

We are facing spam emails with only one image in the body.I've tryed to use the Security-->Other-->File Signiture, uploading the sha1 of the image ... but sadly this is used only in antivirus profile ... and from the documentation:"Because not all attachment files are virus carriers, FortiMail file signature check only supports the following file types: .7z, .bat, .cab, .dll, .doc, .docm, .dotm, exe, .gz, .hta, .inf, .jar, .js, .jse, .msi, .msp, pdf, .pif, .potm, .ppam, .ppsm, .ppt, .pptm, .pptx, .reg, .scr, .sldm, .swf, .tar, .vbe, .ws, .wsc, .wsf, .wsh, .xlam, .xls, .xlsm, .xlsx, .xltm, .Z, and .zip files." No image supported and no way to add more file types :( Any ideas? I'm using a 300D with v6.0,build126,181026 (6.0.3 GA) THX,Luca

We have a need to install a FortiGate and a WAP in a small medical office. Is this FortiAP 221E well suited for this or is there a different FortiAP or a different WAP altogether that would be best?

Hi guys, Today I was configuring a new FortiGate 100E. It was running version 5.6.3. When I wanted create a new policy, I wasn't able to select a source address, the source field got spinning like this:  For the others field I didn't have the problem, only for the source field. After rebooting the firewall kept the same. I downgraded to version 5.6.2 and the problem continues. What do you recommend? Have you experienced this sometime? Please help! Regards,Julián 

Hello.sorry for my bad english.I have fortigate 200d and i need set up transit vlanI move virtual server from my network to provider, and he can't give me l2 network, only trasnit l3Now i need set up transit vlan where i route my vlan, and i don't understand how i must create it.Cable from provider plug in physical interface on fortigate, i set ip of transit vlan on it and create vlan with tag.see attach  

Hi,I want to restrict management  access  . I mean only certain ip  should access the management interface  Thanks

Hello all,I am having some issues with WEB Filtering and SSL Inspection / Deep Inspection.So the first behaviour is, when using "Certificate Inspection" and "Inspect All Ports" IS NOT ticked, and I try to browse lets say a gambling site I get the "Web Page Blocked" splash screen by the Fortigate, so no problem, expected behaviour. Now the same thing but with "Inspect All Ports" ticked and trying to browse the same website the Website is allowed.  Now lets try the same but with "Deep Inspection" instead of "Certificate Inspection"Any options with "Inspect all Ports" enabled or disabled result on "This Page can't be displayed". So Conclusion:"Certificate Inspection":Inspect All Ports Ticked = Gambling Page is not blocked, normal access to page. Inspect all Ports is not Ticket and HTTPS = 443 = Fortigate Splash Screen "Web Page is Blocked" as Expected. Deep Inpection: "This Page can't be displayed". Finnally any sites I visit that are HTTP and not HTTPS I do get the Fo

We will soon have a 2nd line out of the Office. We are in a country with internet restrictions, so for these restricted sites like google, youtube, amazon etc. I want to route them over the 2nd line out which will connect to a sister office - in a country with no internet restrictions. I know policy / static based routing is all IP / Mask based. Looking around I found this link, where from a quick read it appears to be blocking the sites in one interface therefor sending them out the 2nd interface. Is this the only way to achieve something like this on the Fortios? Versions 5.4 / 5.6. Is there another way or a better way? Surely this must be done by others who are smarter than me! O0

Dear All, I'm new to Fortigate and new to the forum. Anyway, I have a problem configuring policies for blocking unwanted access from some external/malicious IP addresses.Here's what I did. config firewall policy    edit 4        set uuid 10be693f-5610-45a9-bebc-c27bd394177f        set srcintf "any"        set dstintf "any"        set srcaddr "group-blacklist"        set dstaddr "all"        set schedule "always"        set service "ALL"        set logtraffic all    nextend  I have put the policy on top of the list. However, when I tried accessing my FW from blocked IP address, it still can go through and no

Hi Everyone, Windows AD server with nested groups (groups of groups of persons). Trying to get FortiAuthenticator to add users via that group (and ultimately, sync users back too).  i have tried a bunch of things (and even enlisted support's help) and after several hours of work, they seemed frustrated and came back with a "it's not supported".  But, I found recent KB for Fortigate to rework the query to support finding users in nested groups. https://kb.fortinet.com/kb/viewContent.do?externalId=FD41657&sliceId=1 I also tracked a MS article speaking to the same: https://docs.microsoft.com/en-us/windows/desktop/adsi/search-filter-syntax So i have tried changing the query to align with that (experimenting with the queries in Authentication->Remote Auth Servers->LDAP, Import users by Group Membership, but not having any success.  It does find any user within a specific group, but not nested groups. Hoping to if someone knows if this i

I am missing something, I must be. In 5.6 OS, Security Profiles > Web Filter and I can see the default (or other) profile and I had a option for users who where allowed to bypass a block, via user account locally. On 6.0.4, I no longer have that option.  Only see FortiGuard category based filter, Static URL filter and Rating Options. What am I missing?  Brand new 61E I am setting up for a test lab, but my 200E has the prompt in both 6.0 and 5.6

I'm using a 61e at home and would like to get web filtering set up to monitor my child's internet usage and to block certain categories.  So I would like to both block and be able to see what sites were visited.  I would also like to have a separate filter for everyone else that blocks categories I want to block.  On that one I just want to pick malicious categories, etc. but don't need logging.   When I go to Security Profiles > Web Filter, I don't seem to have the plus icon to create a new profile.  I can only edit the default one.  

Hi,  I have a existing IPsec tunnel between head office (FG60E) and remote office (FG60D) for file sharing. At the moment existing tunnel is working fine from both side. Both device has v5.6.2 build1486   Now I got a requirement to route all the internet traffic from remote office device to head office device through existing tunnel.    I followed this configuration [link=https://help.fortinet.com/fos60hlp/60/Content/FortiOS/fortigate-ipsecvpn/Internet_Browsing_Config/Config_Overview.htm]https://help.fortinet.com...ig/Config_Overview.htm[/link] but internet is not working   1. Create one security policy        2. Edit the default route in remote device to traffic internet through IPsec Interface Once I change the default route in remote device, all the traffic pass through VPN interface but internet is not working maybe not passing through head office device.  I am not expert the firewall, Any guidance appreciated  Thanks.

Hi I'm still very new to Fortigate stuff and firewalls in general and feel like I'm missing something very basic here. It is possible to create a group of specific IPs (not ranges) that I can add to at will and then use those in allow or deny rules.  At the moment the closest thing I can find is and address group, but that requires me to create an address for each IP that I'd want to add to the group.   At the moment I have a little over 26 IP's I'd like to add to the address and block all traffic with them, so creating an object for each on just to add to a group seems a little onerious, which makes me think I'm missing something very simple. As I'm a newb to all this, I do all my managerment though the web interface.

Hi all We soon will start with Fortinet NGFW devices in our company. We have an internal discussions about how to protect the inside -> out traffic which pass this new Fortinet. Until now, we had a Cisco device with "ip inspect" or "ZBFW" enabled. But this was not a NGFW with addtional security features, therefore we had an access list on the inside interface which just allowed the well-known traffic to the Internet. And in general, this was the source address of the proxy server plus several applications which needed a direct access. Now it comes to the question, do we still need this ACL on the inside interface? There are NGFW features now which protects and controls the traffic. And is an ACL still the correct way as this "only" goes on destination IP addresses/Ports and not on applications? Is it worth to do this additional work to have another security layer from inside -> out? I am wondering how other companies handles this topic, if it is good enough to have

Hi Everyone, How to enable the port forwarding for 5000 Synology and port 9999 CCTV ?My company subscribed dynamic IP from ISP.Last Friday, the vendor installed Fortigate 100E and he say only Static IP able to set port forwarding..Could someone save my life?Thank you.

Dear, I'm new to creating posts here and I have a question with wifi. Is it possible to disconnect a wifi user using username, MAC address or IP?