Solved

Our client has asked for a report that would show a list of the top users (or IPs) that have visited specific web filter categories.  I do not see any of the system datasets that have the combination of these fields.   It could be as simple as this: User              Category             Count10.0.0.3         Hacking                1210.0.0.5         Proxy Avoidance    810.0.0.3         Proxy Avoidance    510.0.0.4         Discrimination       2 Thanks! 

Hi,I have 2 Fortinet device 60E and 60D. I have been trying to create a VPN tunnel between the device.   I followed this cookbook article https://cookbook.fortinet.com/site-site-ipsec-vpn-two-fortigates-56/ and both my devices are behind the NAT So, I had to change the NAT setting beside I followed every single step mentioned in this article.  In the end tunnel is NOT UP so, I tried to converted the tunnel to custom and disabled NAT-T, then tunnel is UP but traffic is not passing. Not sure where to look for issue. Any guidance highly appreciate. Both devices have v5.6.2 build1486 (GA) firmware.   Thanks.

Hi everyone, I use fortigate 300D build the ipsec-vpn tunnel between Site A and Site BSite A has two subnets, one is 10.80.0.0/24 the other one is 10.80.102.0/24Site B has one subnet, 10.0.0.0/24 host 10.80.0.100 can ping host 10.0.0.98 here is the problem  At the beginning, 10.80.102.32 can't ping 10.0.0.98 ,but 10.0.0.98 can ping 10.80.102.32When I use host 10.0.0.98 ping host 10.80.102.32  first,then host 10.80.102.32 can ping host 10.0.0.98 After I use  "Ctrl + C"in cmd to stop the ping on host 10.0.0.98, then 10.80.102.32 can't ping 10.0.0.98 again.. Can someone please assist in directing me in the correct direction? I don't know where the problem is.. Thanks  

Hi, I have 2 Fortinet device 60E and 60D. I have been trying to create a VPN tunnel between the device. I followed this cookbook article https://cookbook.fortinet.com/site-site-ipsec-vpn-two-fortigates-56/ and both my devices are behind the NAT So, I had to change the NAT setting beside I followed every single step mentioned in this article.  In the end tunnel is NOT UP so, I tried to converted the tunnel to custom and disabled NAT-T, then tunnel is UP but traffic is not passing.Not sure where to look for issue. Any guidance highly appreciate. Both devices have v5.6.2 build1486 (GA) firmware.   Thanks.

Hi, I'm thinking of buying a FG 60E to replace a pfSense firewall on top of VMWare. I have some experience with Fortigate and I was very pleased by the possibilities, but that was in a simpler environment. The pfSense is currently connected to almost 20 VLAN's and serving as DHCP server in all these networks. Can I do the same with the FortiGate? And are there any pitfalls? Thanks in advance  

I have a problem. I have selected "Traffic Shaping" in System -> Future select. And i created a new traffic shaping policy. Everything is ok. But when i enter "Policy & Objects" and select one policy(click edit), Traffic shaping options do not showing under "Security Profiles" menu (please look attechment)How i resolve this problem?

Hello,We have just connected new Sharp Printer (mx-4071) to our network. Everything works fine, but we can't get access to it by AirPrint from subnets. I can ping them/access the configuration site, but the AirPrint doesn't find them. Do you have any advice how should I change it? My network "administrator" tells me that he can't do anything in Fortigate and I need to change sth in AirPort's express. I'm attaching simple schematic of my connections. 

Hello, I'm exchanging my WatchGuard router to FortiGate 60E with 1 to 1 setting if possible and I'm not sure how to implement my NAT settings on FortiGate: Dynamic DNS pool and 1-to-1 NAT: NAT settings in example policy:  And this is how it looks in my FG GUI:   My second concern is the Incoming interface in my policies. I have like 6 VPN site-to-site tunnels and do I have to add every tunnel and VLAN as incoming interface or I can just set it to 'any' and restrict access to specific source and service. It worries me because NAT in this specific policy is turned off and 'any' includes WAN interface. Whats the best way to handle it? Thank you in advance for your answers!

Fortigate 1500DFirmwarev6.0.4 build0231 (GA)Mode NAT (Flow-based)System  Hello, When I install a new policy, the firewall drops the estabilished connections packets affected by the new rule.E.g. If I have a nfs connection, after policy applying, I have to restart it. It happens the same with database connections. Is there any workaround to avoid restart systems? Thank youRafa

hi,I am trying to setup a FortiWiFi 40C to work with our network. I hope this is even the correct subforum. We have an adsl-modem connected to WAN1 of the FortiWiFi, a large switch on LAN1 for alle the client-PCs and a bintec elmeg hybird 300 PBX system for VoiP on LAN2.Our ISP has given us 4 public IP Adresses as well as a gateway IP.The Gateway IP is public.97, useable addresses are public.98 to public.102. Only public.98 is allowed for SIP-login for VoiP though.What I am trying to achieve is to route all traffic for public.98 to the PBX on LAN2, and let the clients access the internet with public.99. For remote access to our NAS i would also need public.100 forwarded to the NASes IP on LAN1, but this is secondary. Right now I configured the WAN-Interface to connect to the modem with PPPoE which works fine, but all clients now have public.97 as public IP. Can somebody point me in the right direction what I have to configure? [strike]*edit: We had a working setup with a

Recently upgraded to said version.  Noticed that while creating a new policy using GUI, unable to see the '+' symbol while adding multiple interfaces (from/to). Also tried pressing ctrl button while doing the selection.   However, existing policies that have multiple interfaces remain.  So I tried using CLI and by comparing existing policies, able to use CLI to add the multiple interfaces. And this shows up on the GUI.  Hence, would like to confirm, whether is this a bug, or simply a removal of the existing feature.Would upgrading to v6 bring this back?  Thanks for your time.  

anyone else got this "issue" ? [&:] Regards, Jan

We're configuring our Internet circuit for BGP.  I've been instructed by our Network Provider to set our community to 100:999.  The 999 will allow for a subnet smaller than /24 to be announced.  What is the command or process to do this on the Fortigate 500e?I believe it would be the Cisco equivalent of 'set community 100:999'Thanks!

We are migrating our Internet circuit to BGP from static.  We already have an MPLS connection using BGP routing.  How do I announce our public IP block from the Internet circuit only?Example: Our MPLS circuit is 1.1.1.1 and we're announcing internal networks (but this seems to be global and not specific to any neighbor).  Our Internet circuit will be 2.2.2.2 with local-as 65001.  The 'config network' command seems to be global, so how can I 'config network' and add a prefix of our public IP block 3.3.3.1/26 only for the Internet neighbor?

Hi All, Please forgive me if this topic has been covered before. Either my lack of knowledge or my inability to use the right search keywords prevented me finding it. My question is this: Is it possible for an SSL-VPN user connected via split tunneling to connect to another user using the same connection? An example of this would be: User 1 is connected via vpn at home.User 2 is connected via vpn at home.User 2 calls User 1 and asks for remote assistance.User 1 is willing, but the connection cannot be made. Both remote users can successfully route to company resources and LAN workstations. LAN connected workstations can successfully connect to the remote users. Here is a bit of info about our infrastructure and I've also attached a drawing to help clarify what is happening:Firewall: Fortigate 300DNetwork: AT&T MPLS / Cisco Any help or insight that can be provided would be very much appreciated and earn my eternal gratitude. Thanks, Wayne

Hi everyone! Is it possible to use Kerberos for user authentication in Flow mode?If so, what other parts should i config?1) LDAP - done2) Goups - done3) Keytab - done4) Policy - done (in GUI)

Hello all! I am working on a 60E with three FortiAPs.   I am looking to create a special guest wifi network that has a separate subnet, but be able to access one or more printers on the local LAN.  Is this possible?  Creating the guest wifi if easy, but I cannot seem to get a policy to work. Thank you, Kelly 

We currently have a working VPN tunnel with multiple vendors using our outside interface's IP address for our Peer IP.  We would like to dynamically NAT our outbound traffic to a SINGLE IP address in our Public IP block and also have remote VPN connections use this IP for their Peer Address also.  Is this possible?Example: Currently our outside interface's IP is 1.1.1.1, which VPN partners connect to for their peer.  We would like to dynamically NAT all traffic to use 2.2.2.2, which is in a /26 block of public IPs.  We would request that our VPN partners use 2.2.2.2 for their peer IP... that way when we fail over to the DR site, we wouldn't need to reconfigure the tunnel with another public IP address.  Is this possible?  Thanks

Hello,I noticed that in the new dashboard for 5.6.0, the option for Backup config is missing (restore, revisions and other options also). I couldn't find also a way to insert it in the dashboard. The only way I found to take a backup was to manually insert the URL https://a.b.c.d/ng/system/config/backup.Do you know how I can insert these options in the dashboard?ThanksAndreas

I've 2 wan link... server network configure on wan1 and user network configured on WAN2. .. User network going to WAN2 using policy route where Server subnet going thru static route to WAN1. I've configure VIP on WAN1.. but  users on user subnet they want to access the server using public vip ip... How can we achieve this.  

Hi,I have a Fortigate 100E with OS v 6.0.0 installed and setup radius with a windows 2012 server.The radius server is found but when I test the credentials from the fortigate it failes with "Invalid credentials"I have set this up before with an older OS version and that is working just fine. I checked all of the settings between these 2 configurations and they are the same. Any ideas why radius authentication is not working?

Hello,  I have some difficulties with sending traffic between an interface and VLAN: Physical interface:   12.155.16.128 / 255.255.255.192VLAN:                    12.155.16.192 / 255.255.255.192 I created IPv4 policies between them, normally with just VLANs it works fine, but not really between an interface and a VLAN. I tried to switch on and off NAT in these policies, but with no luck.  Funny thing is that I have a site-to-site VPN tunnel connected to this location and I can reach hosts on this physical interface and VLAN just fine. Thank you for your help in advance!

Hello,  In all of my locations I'm using managed switches, so I only have to create VLAN interfaces for one of the ports and switch sends tagged traffic to one of the virtual interfaces. Now I have one exception and I need to configure everything without a switch. I need to connect my FortiGate 30E to an Access point with 3 different SSIDs (3 VLANs), a printer and VoIP telephone, so I need 4 VLANs + WAN to do this. With a switch, I'd just create some VLANs on specific ports and switch would do the magic with tagged and untagged ports. I can see that there are:-Loopback interface-Hardware switch-Software switch-WiFi SSID-PPPoE-EMAC VLAN I couldn't find a cookbook on Forti youtube that explains what's the difference between them. Can you guys give me a clue how to do this?

Hello, I'm in charge for a new VPN projet between with our Headquarter and some branch office.For one of our branch office, I have 10 users, but 4 WAN, 2 FTTH(fail over), one 4G and 1 SDSL for VoIP, and I want to connect my ERPbox who manage the printers in my ERP who is hosting in a datacenter. So, in the future I have 5 WAN to manage with the fortigate. Someone can ensure that the Fortigate 60E it's OK for 5 WAN ? Regards,

Hi Folks, I need to upgrade Fortigate firmware from 5.4.1 -> 6.0.2 I have the upgrade path 5.4.1->5.4.3->5.4.5->5.6.2->5.6.6->6.0.2 build 0163 Just looking for some one experience going from 5.4.1 -> 6.0.2 build. Is it ok to upgrade or should go with 5->6 or should I take a  while after every patch upgrade? ThanksA