Solved

Hi Everyone,  I have a 200E deployed and we have two separate static ISP connections coming in from the same provider, utilizing the same GW. I have two LANS set up, with identical static routes[ul]0.0.0.0/0 - GW - WAN10.0.0.0/0 - GW - WAN2[/ul]And IPV4 policies[ul]Lan1 - Wan1 - all -all -always -all -accept -NAT - Use Outgoing InterfaceLan2 - Wan2 - all -all -always -all -accept -NAT - Use Outgoing Interface[/ul] Issue is that  I can only get to the internet on one of LAN1-WAN1 network, the secondary LAN wont connect/ping to the internet.

Hi !, I'am french and I'am sorry I do not speak very well English. I have a Fortigate 30E in 6.0.4 release. I would like to remove my operator modem to replace it with my Fortigate.I have a ADSL2+ line with French Operator. I have a phone jack with an adsl filter and a RJ11 to RJ45 cable connector. It's possible to connect the RJ45 on the wan port of my fortigate ? I have the information about my ADSL line (IP, Gateway, Protocole...) When I connect the cable rj45 on the wan port of my fortigate, no led flashes, everything must be configured for the port to flash? Look at the pictures, https://ibb.co/9HzdhYkThanks ! 

Hi guys, Newbie in Fortinet wireless. I have been browsing and saw that there are three options for managing FortiAPs, namely: FortiGate, FortiWLC and FortiCloud.[ol]I don't want to know deep details, but, what are the main differences between them? The Fortinet documentation doesn't mention these main differences, just says FortiWLC is desired for complex designs.Does the three controllers above support the same FortiAPs models?Do I need to change the firmware of the FortiAP depending on the controller I will use?If I am managing my FortiAPs through FortiCloud and my subscription expires, will the FortiAPs stop functioning?Do the FortiAPs recognize layer 7 applications when managed by three controllers above?[/ol]Regards,Julián

Hi,  I am finding the new 5.4 documentation little confusing. So I am not sure if can we use mix of security profiles in flow & proxy mode. Like we would like to use App-Control,IPS in Flow mode but web-filtering & AV scanning in proxy mode for maximum security.  Is this configuration supported.  Kindly please let me know.  Regards Sebastan

Hi there,for example i have this (after upgrading 5.4 to 5.6)    edit "auth-rule4pol7"        set srcaddr "Inside-Network-Clients" "Inside-Network-Server" "VPNs"        set ip-based disable        set active-auth-method "auth-sch4pol7"    next    edit "auth-rule4pol3"        set srcaddr "Inside-Network-Clients" "Inside-Network-Server" "VPNs"        set ip-based disable        set active-auth-method "auth-sch4pol3"So basically both has the same criteria...so both may fit. Now i have watched at my previous explicit Proxy rules, there is not mentioned which authentication rule will be used. So how do i prioritise the authentication rule over another one? Or how do i say this Proxy policy should use this rule like it was in 5.4? Hope

Hi Guys, i need help because after i've connected a second wan internet connection to split and force my guest lan to navigate with the new line and divide traffic with administrative lan, the forwarding traffic outside from my office stopped work. After that my fw stopped to route the internal lan  traffic to outside. My settings are these:wan1: 10.0.0.200 gw: 10.0.0.1lan2 (configured as wan interface): fw address 192.168.1.200 gw: 192.168.1.1 Lan1 (internal lan): 192.168.0.xlan3 (guest lan): 192.168.100.x Static routes:0.0.0.0/0 to wan1 10.0.0.1 (ip modem) - distance 10.0.0.0.0/0 to lan2 192.168.1.1 (ip modem) - distance 10. address configuration:i've define an address corresponding to my lan3 ip range "LANGUEST" = 192.168.100.0/24 Policy Routes:From:lan3("LANGUEST") to --> lan2 (wan guest) ALL | always | ALL --> acceptimplicit deny allFrom:lan1(internal) to --> wan1 ALL | always | ALL --> AcceptFrom:lan1(internal to --> lan2 (wan gue

hello guys,here i am searching for what is the best windows antivirus software for windows 10 ? for your windows 10 operating system. in the latest version you need to protect your operating system. so i want to discuss with which antivirus software you have and what's your opinion to other which antivirus you provide them. also i am using he bit-defender antivirus for my windows 10 operating system and now switch to the other antivirus software. so i just want to know which antivirus is best and which is similar to the bit-defender antivirus. i using the bit-defender antivirus since 2 years now and going to buy new antivirus program. so if you know about the answer of this question please answer this question. this answer is suggest me which antivirus which my windows 10 operating system.i also tried the malware-bytes. it's really hard to find the best antivirus software when you using the bit-defender. 

I have a report that I want to filter to specific networks that have been identified using the Address Group feature. I used filters Log messages that match any of the conditions - Log Field: Address Group (adgroup) equal to Business Networks I expected this to be as simple as that, but my reports still show IP addresses that are not in the Business Networks address group. What am I missing?Device is FortiGate-200EFortiAnalyzer is the latest version 

Dear Concern, We have a fortigate 300C over which we are able to receive broadcast on physical interfaces from our server on specific UDP ports. We have our clients connecting to us on our Fortigate via public network (Internet). Client connect us on on Dialup ipsec tunnel using Forti client from their respective end points and we want to forward the same broadcast information to them. When the VPN is connected clients are not able to receive real time broadcast on their systems. When the same client IP is connected directly without VPN on firewall, broadcast starts forwarding but on VPN the numbers are stuck unless we close the application from client and restart it. Upon restart the numbers that appear on the screen are different from the previous one which means that the numbers have refreshed. We have enabled broadcast forward on tunnel and physical interface but still no luck. Please suggest any way we can receive broadcast with dst IP 255.255.255.255 from appl

I have got FortiClient to connect to my enterprise VPN, but I can not connect through my router. The error message is: VPN has "trouble connecting with the remote gateway, retrying now..." The connection through a mobile phone net is successful. Are there any settings, I should do on the router?Thanks

Hi, this seems like a real noob question, however I can't seem to find a simple answer.I understand that Forticlient is end point protection that requires licensing.Is it safe to assume you can simply use Forticlient software as the VPN client without any special licensing - should you desire it?

Hello. We are trying to achieve the following: traffic between hosts (a bunch of VMs, actually) has to be proctected by a firewall, but these hosts are located in the same L2 VLAN and use a matching L3 addressing subnet. The problem is not that we simply need to isolate the hosts that belong to the same VLAN (Private VLANs could be used for this purpose), they still need to communicate with each other and we need to firewall all of their communication. Further segmentation of the VLAN (into smaller networks) is just not feasible. Does anyone have an idea how to do this the best way in the Fortigate world? Would any features of the "new" Security Fabric be of any use here? Thanks for your help!

in my organization more than 4000 thin clients  hp t5570e with Windows Embedded installed i really need to block their traffic to WAN  Desirably all traffic  what is the best practicy of doing thatby OS, hostnmae (all of theor hostname starts with HP-XXXXXXXXXXXXX), or by mac address (mac also statc like ab:cd-ef:xx:xx)any help would be greatly appreciated 

I'm not sure how to ask this in a simple way, but here's my attempt: if I'm using VDOMs, and providing WAN access to all of my VDOMs via the root VDOM's WAN, should the root VDOM have a minimal configuration? More Details ------------- For years I had a simple network topology, so I didn't enable VDOMs in my Fortigate. I recently started segmenting my network to set up a VLAN for manufacturing/IOT devices in addition to my existing main business network. In order to share the same internet connection on the Fortigate between several VLANs, I enabled VDOMs. I (essentially) followed the directions found here https://cookbook.fortinet.com/inter-vdom-communication-with-static-routing-56/ for enabling VDOMs and sharing a WAN interface. However, instead of three VDOM's, I have two. The root VDOM "inherited" all of the configuration that was in place before I enabled VDOMs, and I still have my main business network connected to the root VDOM. My second VDOM is for the manufactu

All,In setting up a fortigate unit for remote users to access local lan of our enterprise, 3 vdom has been used with vdoms serving 3 causes - vpn termination, secure vdom & root. vpn vdom has virtual links created to vpn vdom & secure vdom. Question is:-1) for users authentication with radius, will it be using vpn vdom or root vdom? 2) If vpn vdom , how will the routes be towards the inside to reach authentication server? please help. thank you.

Have the way the Fortigate interprets regular expressions changed between FortiOS release 5.4 an 5.6 ???   \.ru\b  worked in 5.4 to match all domains under the top-domain .ru, it does not work in 5.6.4   if I add \.ru\b  in the Static URL filter via GUI the regexp as show in the CLI is \\.ru\\b and it does not match

Hello there,I can't connect to F.W via GUI or CLI(i don't have the cable),can I reset to factory settings in a physical way?

Hi, Just want to make sure. If I implement active-active HA of Fortigate, does it increase the throughput? Let says, 1 unit fortigate has 4Gbps throughput for threat protection (FGT-1200D). When I configure A-A HA, can the cluster of 2 units FGT handle up to 8Gbps threat protection throughput? Thank you

Hi Guys, We are currently deploying a FortiAnalyzer 400E unit for our customer. There are currently two HA core switches in the environment. Our initial design was to connect to one of core switches. Does FAZ 400E support LAG (link aggregation) to support connectivity to both core switches? Thanks for your help!

Hello there, we have the FortiClient with FortiClient Enterprise Manager in use. I am new to FortClient and asked me, how can I work with the quarantaine files? In the EWS I couldn't see an option for that and on the client I can't delete the files. Is the a main configuration for that, or I am blind to see? FortiClient 5.4.2.0860FortiClient EMS 1.0.1.0077 Thanks. Regards, Rolf

Hello! Who can make sense of these two pieces of information? FortiOS Handbook: Authentication for FortiOS 5.2, PDF file, page 28:password-expiry-warning and password-renewal In SSLVPN, when an LDAP user is connecting to the LDAP server it is possible for them to receive any pending password expiry or renewal warnings. When the password renewal or expiry warning exists, SSLVPN users will see a prompt allowing them to change their password. password-expiry-warning allows FortiOS to detect from the LDAP server when a password is expiring or has expired using server controls or error codes. password-renewal allows FortiOS to perform the online LDAP password renewal operations the LDAP server expects. Fortigate-cli-5.2.pdf, page 720:FortiGate LDAP support does not extend to proprietary functionality, such as notification of password expiration, that is available from some LDAP servers. FortiGate LDAP support does not supply information to the user about why authentication failed.

Hy guys!I'm looking for a way to change the PSK of a wireless service, deployed from our FortiWLM 8.4 solution. I'm using this to generate a random password every day for our guest Wifi.I can do this on the WLC (controller) but only if the complete wireless service is configured there (ownership), but not on WLM. 

https://forum.fortinet.com/tm.aspx?m=116066 i have see above thread for changing switch mode to interface mode, but cant find the line  " set internal-switch-mode switch" and change that to " set internal-switch-mode interface" in Firmware Version v5.0,build0252, anyone help? thanks. Current situation:i am using FortiWIFI 90D, start with switch mode, with "internal" ip:192.168.0.x/24, now want to add a subnet 192.168.2.x/24, how can i do?1. i try add a static route 192.168.2.x/24, with gateway 0.0.0.0, device:internal2. create policy Incoming Interface:internal (LAN) Source Address:all Outgoing Interface:internal (LAN) Destination Address:all Schedule:always Service:ALL Action:ACCEPT but didn't work, and i try add a router with WAN IP: 192.168.0.10, internal ip:192.168.2.1, dhcp enabled:192.168.2.100-200, all subnet pc can go internet, can ping 192.168.0.x/24 , but 192.168.0.x/24 can't ping 192.168.2.x/24 network, i want to set both 192.168.0.x/24 and 192.

I have a rule on my Fortigate (FortiGate 1000D) to block some countries (geoip blocking) But rule seems not working.Can someone help me to find out why? FortiFw (25) # showconfig firewall policy    edit 25        set name "GeoIP Block"        set uuid d40a24de-1cad-51e9-5df4-b01121de63c3        set srcintf "port9"        set dstintf "port10"        set srcaddr "Blocked Countries"        set dstaddr "all"        set schedule "always"        set service "ALL"        set logtraffic all        set fsso disable    nextendFortiFw (25) #    

The brief overview is we have someone attempting to, I assume compromise, phones in our VOIP system from an IP originating in the Russian Federation. I have attempted to block their IP, the /24 range of IPs, ports used and i'm still seeing packets on the internal interface from their IP. I cannot for the life of me figure out why this is happening and isn't being blocked, it's even using a rule configured for outbound communication to get in, according to FortiView. So I suppose the first question is, will the packet capturer, "diag sniffer packet internal 'net 185.22.155.0/24' 6" show packets that are dropped? I typically set it up so I have one set on wan1 and a separate one set on internal to see if the packet is actually getting to internal from wan1. So if I'm seeing a packet from wan 1 with src=185.22.155.18 and dst =8.27.x.x. then at the same time one on the internal showing src=8.27.x.x and dst=192.168.x.x that, to me, means the packet is getting through. As a note I also