Solved

Hi everyone! Is it possible to use Kerberos for user authentication in Flow mode?If so, what other parts should i config?1) LDAP - done2) Goups - done3) Keytab - done4) Policy - done (in GUI)

Hello all! I am working on a 60E with three FortiAPs.   I am looking to create a special guest wifi network that has a separate subnet, but be able to access one or more printers on the local LAN.  Is this possible?  Creating the guest wifi if easy, but I cannot seem to get a policy to work. Thank you, Kelly 

We currently have a working VPN tunnel with multiple vendors using our outside interface's IP address for our Peer IP.  We would like to dynamically NAT our outbound traffic to a SINGLE IP address in our Public IP block and also have remote VPN connections use this IP for their Peer Address also.  Is this possible?Example: Currently our outside interface's IP is 1.1.1.1, which VPN partners connect to for their peer.  We would like to dynamically NAT all traffic to use 2.2.2.2, which is in a /26 block of public IPs.  We would request that our VPN partners use 2.2.2.2 for their peer IP... that way when we fail over to the DR site, we wouldn't need to reconfigure the tunnel with another public IP address.  Is this possible?  Thanks

Hello,I noticed that in the new dashboard for 5.6.0, the option for Backup config is missing (restore, revisions and other options also). I couldn't find also a way to insert it in the dashboard. The only way I found to take a backup was to manually insert the URL https://a.b.c.d/ng/system/config/backup.Do you know how I can insert these options in the dashboard?ThanksAndreas

I've 2 wan link... server network configure on wan1 and user network configured on WAN2. .. User network going to WAN2 using policy route where Server subnet going thru static route to WAN1. I've configure VIP on WAN1.. but  users on user subnet they want to access the server using public vip ip... How can we achieve this.  

Hi,I have a Fortigate 100E with OS v 6.0.0 installed and setup radius with a windows 2012 server.The radius server is found but when I test the credentials from the fortigate it failes with "Invalid credentials"I have set this up before with an older OS version and that is working just fine. I checked all of the settings between these 2 configurations and they are the same. Any ideas why radius authentication is not working?

Hello,  I have some difficulties with sending traffic between an interface and VLAN: Physical interface:   12.155.16.128 / 255.255.255.192VLAN:                    12.155.16.192 / 255.255.255.192 I created IPv4 policies between them, normally with just VLANs it works fine, but not really between an interface and a VLAN. I tried to switch on and off NAT in these policies, but with no luck.  Funny thing is that I have a site-to-site VPN tunnel connected to this location and I can reach hosts on this physical interface and VLAN just fine. Thank you for your help in advance!

Hello,  In all of my locations I'm using managed switches, so I only have to create VLAN interfaces for one of the ports and switch sends tagged traffic to one of the virtual interfaces. Now I have one exception and I need to configure everything without a switch. I need to connect my FortiGate 30E to an Access point with 3 different SSIDs (3 VLANs), a printer and VoIP telephone, so I need 4 VLANs + WAN to do this. With a switch, I'd just create some VLANs on specific ports and switch would do the magic with tagged and untagged ports. I can see that there are:-Loopback interface-Hardware switch-Software switch-WiFi SSID-PPPoE-EMAC VLAN I couldn't find a cookbook on Forti youtube that explains what's the difference between them. Can you guys give me a clue how to do this?

Hello, I'm in charge for a new VPN projet between with our Headquarter and some branch office.For one of our branch office, I have 10 users, but 4 WAN, 2 FTTH(fail over), one 4G and 1 SDSL for VoIP, and I want to connect my ERPbox who manage the printers in my ERP who is hosting in a datacenter. So, in the future I have 5 WAN to manage with the fortigate. Someone can ensure that the Fortigate 60E it's OK for 5 WAN ? Regards,

Hi Folks, I need to upgrade Fortigate firmware from 5.4.1 -> 6.0.2 I have the upgrade path 5.4.1->5.4.3->5.4.5->5.6.2->5.6.6->6.0.2 build 0163 Just looking for some one experience going from 5.4.1 -> 6.0.2 build. Is it ok to upgrade or should go with 5->6 or should I take a  while after every patch upgrade? ThanksA  

Hello Guys, when we enable Machine Learning with Anomaly detection in layer1 and threat detection in layer2 what is actualy the scan Sequenz when we also have the Protection Profile with Standard Signatures applied to Server Policy? Will the standard pattern be checken in 1st place and then machine learning? or will it beginn with machine Learning > anomalitie > Threat Detection > standard patters from protection profile? Another question: who is using Machine Learning in Production environment? is that realy i kind of Fire and Forget setup now? Thank you

Hi,I have two FortiGates and I created an IPsec tunnel between them via IPsec Wizard.The VPN is working well, but I cannot ping from Fortigate B CLI to a host in the other network.The ideea is that in network A I have a FortiAnalizer and I want to send logs from Fortigate B to it. Please help!Thanks!Kind regards,

We need to provide a secondary ISP connection to a location with a FortiWiFi for redundancy. I have a few questions if someone can share some insight. 1. How does the FortiExtender-40D-NAM connect to the FortiGate, US. or Ethernet? 2. Is the wireless service/SIM card provioby Fortinet or by the customer? 3. Is this the best / most cost effective solution available? If not, what else is worth considering?

Hi guys,I have an issue about fortigate rules.First of all i'm using fortigate in our edge network and before that was mikrotik routerboard.Mikrotik had a feature that was usable for me. now i have 3 internet connections links for typical solution. for specific issue i marked packets from each interface by mangle an and for backing route to packet's source sent it to the interface that it came.i'm searching for similar approach to solve this issue . anybody have idea for that.Thanks,

HiWe're currently comparing Forticlient and Z-scaler for client security. Was hoping to hear some stories from real users/admins.We have around 50.000 users all around the globe and I was wondering:[ul]How's the management platform, is it easy to understand and manage?Has there been any serious bugs or annoyances?Any weaknesses/limitations in the product that we should know about?How long does it take from updating the policy to it reaching the client?Which method do you use to authenticate the clients when they are outside the office? Is there any issues with said method?We have a bunch of local security products already and it would take considerable political efforts before we can replace them. Would you consider the client to be heavy if only using it for Web filtering/Sandbox:ing?Anything else I should be aware of?[/ul]I know these are very generic questions but I am grateful for any input. Thank you! Kind regards,Patrik

Hi All,As show below pictureFortigate 1 port 1 connects to Cisco switch G1/0/1Fortigate 1 port 2 connects to Cisco switch G2/0/1Fortigate 2 port 1 connects to Cisco switch G1/0/2Fortigate 2 port 2 connects to Cisco switch G2/0/2 My questions are1) My fortigates work on Active-Active mode, port 1 and port 2 are set as  1 802.3ad aggragate port. What should I configure my switch ports? All the four ports in one channel group? Or G1/0/1 and G2/0/1 in one channel group, G1/0/2 and G2/0/2 in other channel group? 2)  If my fortigates work on Active-Passive mode, port 1 and port 2 are set as  1 802.3ad aggragate port. What should I configure my switch ports? All the four ports in one channel group? Or G1/0/1 and G2/0/1 in one channel group, G1/0/2 and G2/0/2 in other channel group? Thanks in advance!  Best regards

Hi all,I am new to Fortinet products,  in particular the Fortigate60E running OS6.0.0 build 0076.  My client who has this device is looking to setup Backstop CRM and they require port 443 be open to their addresses for their program to run properly.  This is the info posted on their webquestionaire Permit your firewall to allow the following Backstop IP addresses US Office Network IP: 38.98.151.64/28 US Production Network IP: 64.27.172.240/28, 216.34.179.0/25 Port: 443[/ul]I was told opening traffic to incoming traffic is most important but if it can be setup to allow traffic both to and from those addresses on port 443 that would be optimal. Tried poking around but it is not obvious how to accomplish this.   Andrew Bernstein 

Hi! I am running tunnel mode ssl vpn without adding static route of my SSL VPN subnet pointing to ssl.root and everything works fine. whats the use of setting up this static route? thanks

Hello guys, I am facing the following challenge and can't get any further. I hope you can help me. I want to connect a VPN between a virtual server (hosted Windows Server 2016) and a data center.The virtual server has no VPN capability. With FortiClient I was able to establish the connection to the data center via IPSec,but it takes the IP of the data center when it goes out to the Internet. What do I have to change or how do I get it that he keeps his IP? Or is there another way, I have a FortiGate 50E in the datacenter. Thank you very much for your help.

All, we recently recieved new Fortigate appliances with FortiOS 6.0 installed.  We were not able to add them into the FortiManager because they are newer than the FortiManager itself. If I upgrade the FortiManager, will I lose connection to my existing appliances that are running older versions of FortiOS?   FortiManager Version: v5.6.6-build1750 181002 (GA) All of my current appliances: FortiGate 5.6.6,build1630 (GA) so what is the upgrade path to 6.0 when using FortiManager?

I'm now about to purchase a 60D with licensing until the end of the year.I'd like to wipe the device for security purposes.How would I re-register the device afterwards, and transfer the license to our business account? 

Hello, I need update my box FGT1500D from 5.4.5 to 6.0.4 version. So I wonder how is better way to reach this ?I think I have to format my box upload 6.0.4 firmware and reconfigure all from zero. but, at the support page tips to do step-by-step from 5.4.5 >5.6.2>5.6.6>6.0.4 by Web interface.Anyone update from 5.4 version to 6.0 version ? How Have you done ?

Hi All,We are using Fortinet 300E and another for fail over, i just want to know how to add a lease line which we bought only for to access a application from outside but it should not effect the current setup or effecting our LAn or WAN.We already have two line. Please help.

our antivirus guy will send me alerts from symantec. sometimes it gets these hits[Somebody is scanning your computer. Your computer's TCP ports: 10000, 8910, 70, 32774 and 59906 have been scanned from xxx.xx.1.2.]   xxx.xx.1.2 is the firewall. If i put the host ip that is affected in the forwarded traffic in fortiview I do not see the event listed at the time. is this just some wild traffic from the firewall or could it be something to worry about?

I've also posted this in the VPN section as I'm not sure if the problem is with the SSLVPN config or LDAP... I've got three 80C's in three offices around the world.  All are configured identically as far as SSL VPN goes and all were working in the past.  They all authenticate against the same LDAP server where users who are members of the "VPN Users" group are allowed to log in.  I recently upgraded the firmware on one firewall from 5.4.4 to 5.4.6 and it appears it's been since this time that I can no longer log in to that firewall while the other two still work fine.  When I try on this firewall, I get a "Permission denied" error and the logs on the firewall also show the permission is denied with a "SSL user failed to log in" message. If I run a tcpdump on the directory server, I see some initial back and forth which I assume is the handshake, then I see a couple of packets from the firewall that get responded to via the directory server as ICMP host unr