Solved

Dear, I'm new to creating posts here and I have a question with wifi. Is it possible to disconnect a wifi user using username, MAC address or IP?

Hi all, Good day!The client wants a policy that they can access Facebook but for viewing only. They cannot do Comments, File/Status Upload and Play Videos but they can use  Facebook Messenger (App) and Messeger.com (Web). I already achieve the client's requirements but it requires to install the certificate generated from the FortiGate to avoid the Certificate Error. I just wanna confirm if this requirement of the client can achieve without using Deep Packet Inspection on the FortiGate? or is there a firmware version of the Fortigate that can achieve the same result but doesn't require Deep Packet Inspection? Best regards,

I'm replacing two FG500Ds with FG501Es.  Of course the interface names have changed between models.  All the cutting and pasting is just nonsense.  Fortunately I'm able to get one of my FG500Ds on 6.0.3 and use that config as a template for the FG501Es so I'm not crossing firmware versions which is impossible.Please Fortinet, build a converter tool for you customers.  As long as you are moving from FG to FG this should be free.  IT SHOULD ALSO DETAIL ERRORS WHEN FOUND IN THE CONFIG, PLEASE.  At the very least, having an app that would review the config and provide output/flag/warning to let you know what wouldn't work on the new system would be so helpful.  It is frustrating trying to use the Advanced/Script interface when it only shows Fail or Succeed but NO OTHER INFO?  How do I know what failed?  "diag debug config-error-log read" shows nothing.  That being said, it is really interesting when you dig into the config.  You f

Hi Pros, I'm facing with a strange issue with iPhones and Macs. We use Radius/WPA2 Enterprise Auth. for our SSID. If I connect the first time, the device get authenticated, but if I change the SSID and want connect back, it fails with wrong password. On the radius server (Win), the Eventlog says ok (see Attachement) and debug looks ok too. 2019-03-1814:41:35 16495.283 b0:19:c6:b5:57:58 <eh> send 1/4 msg of 4-Way Handshake2019-03-18 14:41:35 16495.283 b0:19:c6:b5:57:58 <eh> send IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=117 replay cnt 12019-03-18 14:41:35 16495.283 b0:19:c6:b5:57:58 <eh> IEEE 802.1X (EAPOL 121B) ==> b0:19:c6:b5:57:58 ws (0-10.0.0.14:5246) rId 0 wId 4 4a:5b:0e:39:31:3b2019-03-18 14:41:35 16495.286 b0:19:c6:b5:57:58 <eh> IEEE 802.1X (EAPOL 121B) <== b0:19:c6:b5:57:58 ws (0-10.0.0.14:5246) rId 0 wId 4 4a:5b:0e:39:31:3b2019-03-18 14:41:35 16495.286 b0:19:c6:b5:57:58 <eh> recv IEEE 802.1X ver=2 type=3 (EAPOL_KEY) data len=117 2

Good Day experts, So my idea is to have a webserver (hosted as VM via Windows HyperV) on my machine on the internal network, to be accessible via VLAN from DMZ interface on our Fortigate E61 FortiOS v6.0.4 build0231 (GA). For the moment being, I know this sounds bad, but we're limited to the infrastructure currently available until we have this cloud hosted. We have the above mentioned fortigate unit and an ubiquity unifi managed switch between the internet and my local machine. My machine also has 2 NICs (one ethernet, the other Wifi) I want to make said webserver accessible via the fortigate's DMZ port (on VLAN 20), which then goes to the same unifi switch as mentioned above (again, over VLAN 20) then to my local machine's ethernet NIC which is used exclusively by the VM for traffic. These are the steps I have already taken:[ol]Created a virtual interface on my internal (Interface 1: 192.168.1.1) port addressed 192.168.2.1 255.255.255.0.Created a Virtual

Greetings. This is my first time posting here. My company has been using FortiAP 21C since I've started with the company. We've bought 2 FortiAP 221E and wanted them to start using them. The problem is that when I want to enter the default settings, I believe is 192.168.1.2, this doesn't seem to work with any of them. I've tried X.X.1.99 and X.X.2.1, other default settings but with no success. I can do fine with other AP (25D and 221C), but with these ones, they don't want to cooperate. I have also pressed the botton with a clip to restart it, and nothing. The LEDs that are turning on are the ethernet port: amber blinking, and the power (green). Any tips? Thanks in advance.

I have correctly set up fortiAnalyzer which connected to FortiGate and I got a log in log view without a problem. But in Fortiview I had a critical issue.Just I got a chart in Fortiview for less than 1 hour when the increase to 12 hours or more I got the error " No Data" This is the FortiAnalyzer info:FAZVM64-HVv6.0.4Administrative Domain: Off

We have a FG-3240C. We just received a replacement power supply SP-FG3000D-PS.Is there any documentation on how to remove bad power supply and install the new one?

Hi have an issue of with setting up an IPSEC VPN between two site.  WAN to WAN it works fine but LAN to LAN we have an issue. Config file removed

hi, seems a silly question, but why can't I see EIGRP in "Network" menu of FG200E? The only options are "RIP", "OSPF" and "BGP".Thanks

Hi together,after updating my 60E FortiOS to 5.6.3 no DHCP Server under Network / Edit Interface is shown.At "internal" Network it is shown - but not at additonal Network "dmz".Configuring whithin CLI is working w/o any problem - but it is not shown in GUI. ThanksGreetsRobert

Hi Guys,Thanks for the Forum it is super helpful and has helped me with other problems that I have had.For this particular problem I have spent quite a bit of time reading through the posts on the fortinet forum and the various cookbooks to find out what I am doing incorrect that this does not work. Unfortunately I do not have a team that is able to work with me on this and I am doing it by myself so thought that maybe someone can critique my config and spot what I am missing and hopefully point me in the right direction. I have a FG 100E it is OS 5.4.1 I have my main subnet as 12.12.12.228/30 Then I have additional subnet as 5.5.5.224/29 The modem only has one port connecting to WAN1. The FG has WAN1 with IP Address 12.12.12.230 I have tried the following recipe and others similar to: https://cookbook.fortinet...re-port-forwarding-54/ The closest that I can get is online websites saying that port 22 is open for 5.5.5.228. But if I try to SSH into this I do not get connection and

Hello, In new FortiOS 6.2 it seems that in firewall policies, the "Device" option seems not be available as source. Is this not supported any more in 6.2? Is it a bug? Is it something else? Has anybody experienced such thing and can help with an answer? Thanks

This error appears to our customers who used Forticlient to connect VPN.based on each customer I upgrade and downgrade the clients in  customers PC based on the situation of each customer , the issue solved temporary but it repeating again from time to time and i am repeating the same steps to solve the issue.kindly advice me if there is any permanent solution. on the other hand, another issue appears like the "Client connecting and disconnecting". I solved by remove the current client and install new ,and restart the PC, then it solved, but all this solutions are temporary and I am searching for better solutions.kindly advicethanks 

Hi,How can i create a trunk between to fortigate firewall  Thanks

Hello,I know that the TCP port used in SSL VPN is the 443 which is the port that identify HTTPS.Furthermore I know that I can achieve the SSL VPN tunnel via a web browser HTTPS enabled.So I ask if in SSL VPN, HPPS protocol is the only used application layer protocol also for non HTTP operations, such as search and open files, computer remote control (VNC), RDP sessions and so on.Thank you.   

Hello, New to Fortigate.  I have a customer that is having issues with their webfiltering.  They have had the product for some time, but have not gotten the webfiltering to work.  I can see that the webfiltering is on and licensed.  However, it is not blocking sites that are identified.  Does each machine have to have the FortiClient installed in order for the webfiltering to take place? athometechs

Hi,I'm trying to announce a default prefix from BGP.  My goal is that all BGP traffic will flow to my datacenter Fortigate, unless the network is announced somewhere else.  We're moving from Cisco to Fortigate... the command for Cisco was just 'network 0.0.0.0'.  I tried the following, but got the returned error code: FG (bgp) # config networkFG (network) # edit 1FG (1) # set prefix 0.0.0.0/0  (I also tried /32 and 0.0.0.0)The prefix 0.0.0.0/0 is not allowednode_check_object fail! for prefix 0.0.0.0/0 What is the equivalent or how can I accomplish this for the Fortigate.  Thanks.

Hello,  I've got a Fortigate 30E Firewall and I need to create some reservations on one of my VLANS. The idea is to use DHCP reservations as a sort of ACL so only hosts with known MAC addresses can get access to this VLAN. Previously I was using watchguard and I could set DHCP range to for exapmle: 192.168.1.200 - 192.168.1.200 and make reservations up to 192.168.1.254.In FortiOS I can't do it this way and the IP range of DHCP has to be exactly the same as number of reserved addresses, it creates some issues, because in my network it looks like this: 192.168.1.129/25 192.168.1.130-140 - warehouse workstations192.168.1.141-150 - warehouse printers192.168.1.151-160 - office workstations192.168.1.161-170 - office printers and so on So, when I was adding for example an office workstation I could make a reservation for address 192.168.1.155 and I didn't have to block unused addresses. Now I can't split it nicely, but I have to make a stack of addresse

Hi , I have the following Nat enabled policy Incoming interface is 10.1.1.1/24 Outgoing interface ip 4.4.4.4/24 And route  to  destination 8.8.8.8  via  gateway 10.1.1.1   If I ping 8.8.8.8 from source 10.2.2.2/24 . What will be the source ip? What if I ping 10.1.1.1 , the host 8.8.8.8 will reply? Thanks

Hi,When we need to use  software and hardware switch , what are the use case scenario. I saw most of the implementation does not  added any sort of switch in fortigate . Thanks

Our client has asked for a report that would show a list of the top users (or IPs) that have visited specific web filter categories.  I do not see any of the system datasets that have the combination of these fields.   It could be as simple as this: User              Category             Count10.0.0.3         Hacking                1210.0.0.5         Proxy Avoidance    810.0.0.3         Proxy Avoidance    510.0.0.4         Discrimination       2 Thanks! 

Hi,I have 2 Fortinet device 60E and 60D. I have been trying to create a VPN tunnel between the device.   I followed this cookbook article https://cookbook.fortinet.com/site-site-ipsec-vpn-two-fortigates-56/ and both my devices are behind the NAT So, I had to change the NAT setting beside I followed every single step mentioned in this article.  In the end tunnel is NOT UP so, I tried to converted the tunnel to custom and disabled NAT-T, then tunnel is UP but traffic is not passing. Not sure where to look for issue. Any guidance highly appreciate. Both devices have v5.6.2 build1486 (GA) firmware.   Thanks.

Hi everyone, I use fortigate 300D build the ipsec-vpn tunnel between Site A and Site BSite A has two subnets, one is 10.80.0.0/24 the other one is 10.80.102.0/24Site B has one subnet, 10.0.0.0/24 host 10.80.0.100 can ping host 10.0.0.98 here is the problem  At the beginning, 10.80.102.32 can't ping 10.0.0.98 ,but 10.0.0.98 can ping 10.80.102.32When I use host 10.0.0.98 ping host 10.80.102.32  first,then host 10.80.102.32 can ping host 10.0.0.98 After I use  "Ctrl + C"in cmd to stop the ping on host 10.0.0.98, then 10.80.102.32 can't ping 10.0.0.98 again.. Can someone please assist in directing me in the correct direction? I don't know where the problem is.. Thanks  

Hi, I have 2 Fortinet device 60E and 60D. I have been trying to create a VPN tunnel between the device. I followed this cookbook article https://cookbook.fortinet.com/site-site-ipsec-vpn-two-fortigates-56/ and both my devices are behind the NAT So, I had to change the NAT setting beside I followed every single step mentioned in this article.  In the end tunnel is NOT UP so, I tried to converted the tunnel to custom and disabled NAT-T, then tunnel is UP but traffic is not passing.Not sure where to look for issue. Any guidance highly appreciate. Both devices have v5.6.2 build1486 (GA) firmware.   Thanks.