Solved

Hi, I'm thinking of buying a FG 60E to replace a pfSense firewall on top of VMWare. I have some experience with Fortigate and I was very pleased by the possibilities, but that was in a simpler environment. The pfSense is currently connected to almost 20 VLAN's and serving as DHCP server in all these networks. Can I do the same with the FortiGate? And are there any pitfalls? Thanks in advance  

I have a problem. I have selected "Traffic Shaping" in System -> Future select. And i created a new traffic shaping policy. Everything is ok. But when i enter "Policy & Objects" and select one policy(click edit), Traffic shaping options do not showing under "Security Profiles" menu (please look attechment)How i resolve this problem?

Hello,We have just connected new Sharp Printer (mx-4071) to our network. Everything works fine, but we can't get access to it by AirPrint from subnets. I can ping them/access the configuration site, but the AirPrint doesn't find them. Do you have any advice how should I change it? My network "administrator" tells me that he can't do anything in Fortigate and I need to change sth in AirPort's express. I'm attaching simple schematic of my connections. 

Hello, I'm exchanging my WatchGuard router to FortiGate 60E with 1 to 1 setting if possible and I'm not sure how to implement my NAT settings on FortiGate: Dynamic DNS pool and 1-to-1 NAT: NAT settings in example policy:  And this is how it looks in my FG GUI:   My second concern is the Incoming interface in my policies. I have like 6 VPN site-to-site tunnels and do I have to add every tunnel and VLAN as incoming interface or I can just set it to 'any' and restrict access to specific source and service. It worries me because NAT in this specific policy is turned off and 'any' includes WAN interface. Whats the best way to handle it? Thank you in advance for your answers!

Fortigate 1500DFirmwarev6.0.4 build0231 (GA)Mode NAT (Flow-based)System  Hello, When I install a new policy, the firewall drops the estabilished connections packets affected by the new rule.E.g. If I have a nfs connection, after policy applying, I have to restart it. It happens the same with database connections. Is there any workaround to avoid restart systems? Thank youRafa

hi,I am trying to setup a FortiWiFi 40C to work with our network. I hope this is even the correct subforum. We have an adsl-modem connected to WAN1 of the FortiWiFi, a large switch on LAN1 for alle the client-PCs and a bintec elmeg hybird 300 PBX system for VoiP on LAN2.Our ISP has given us 4 public IP Adresses as well as a gateway IP.The Gateway IP is public.97, useable addresses are public.98 to public.102. Only public.98 is allowed for SIP-login for VoiP though.What I am trying to achieve is to route all traffic for public.98 to the PBX on LAN2, and let the clients access the internet with public.99. For remote access to our NAS i would also need public.100 forwarded to the NASes IP on LAN1, but this is secondary. Right now I configured the WAN-Interface to connect to the modem with PPPoE which works fine, but all clients now have public.97 as public IP. Can somebody point me in the right direction what I have to configure? [strike]*edit: We had a working setup with a

Recently upgraded to said version.  Noticed that while creating a new policy using GUI, unable to see the '+' symbol while adding multiple interfaces (from/to). Also tried pressing ctrl button while doing the selection.   However, existing policies that have multiple interfaces remain.  So I tried using CLI and by comparing existing policies, able to use CLI to add the multiple interfaces. And this shows up on the GUI.  Hence, would like to confirm, whether is this a bug, or simply a removal of the existing feature.Would upgrading to v6 bring this back?  Thanks for your time.  

anyone else got this "issue" ? [&:] Regards, Jan

We're configuring our Internet circuit for BGP.  I've been instructed by our Network Provider to set our community to 100:999.  The 999 will allow for a subnet smaller than /24 to be announced.  What is the command or process to do this on the Fortigate 500e?I believe it would be the Cisco equivalent of 'set community 100:999'Thanks!

We are migrating our Internet circuit to BGP from static.  We already have an MPLS connection using BGP routing.  How do I announce our public IP block from the Internet circuit only?Example: Our MPLS circuit is 1.1.1.1 and we're announcing internal networks (but this seems to be global and not specific to any neighbor).  Our Internet circuit will be 2.2.2.2 with local-as 65001.  The 'config network' command seems to be global, so how can I 'config network' and add a prefix of our public IP block 3.3.3.1/26 only for the Internet neighbor?

Hi All, Please forgive me if this topic has been covered before. Either my lack of knowledge or my inability to use the right search keywords prevented me finding it. My question is this: Is it possible for an SSL-VPN user connected via split tunneling to connect to another user using the same connection? An example of this would be: User 1 is connected via vpn at home.User 2 is connected via vpn at home.User 2 calls User 1 and asks for remote assistance.User 1 is willing, but the connection cannot be made. Both remote users can successfully route to company resources and LAN workstations. LAN connected workstations can successfully connect to the remote users. Here is a bit of info about our infrastructure and I've also attached a drawing to help clarify what is happening:Firewall: Fortigate 300DNetwork: AT&T MPLS / Cisco Any help or insight that can be provided would be very much appreciated and earn my eternal gratitude. Thanks, Wayne

Hi everyone! Is it possible to use Kerberos for user authentication in Flow mode?If so, what other parts should i config?1) LDAP - done2) Goups - done3) Keytab - done4) Policy - done (in GUI)

Hello all! I am working on a 60E with three FortiAPs.   I am looking to create a special guest wifi network that has a separate subnet, but be able to access one or more printers on the local LAN.  Is this possible?  Creating the guest wifi if easy, but I cannot seem to get a policy to work. Thank you, Kelly 

We currently have a working VPN tunnel with multiple vendors using our outside interface's IP address for our Peer IP.  We would like to dynamically NAT our outbound traffic to a SINGLE IP address in our Public IP block and also have remote VPN connections use this IP for their Peer Address also.  Is this possible?Example: Currently our outside interface's IP is 1.1.1.1, which VPN partners connect to for their peer.  We would like to dynamically NAT all traffic to use 2.2.2.2, which is in a /26 block of public IPs.  We would request that our VPN partners use 2.2.2.2 for their peer IP... that way when we fail over to the DR site, we wouldn't need to reconfigure the tunnel with another public IP address.  Is this possible?  Thanks

Hello,I noticed that in the new dashboard for 5.6.0, the option for Backup config is missing (restore, revisions and other options also). I couldn't find also a way to insert it in the dashboard. The only way I found to take a backup was to manually insert the URL https://a.b.c.d/ng/system/config/backup.Do you know how I can insert these options in the dashboard?ThanksAndreas

I've 2 wan link... server network configure on wan1 and user network configured on WAN2. .. User network going to WAN2 using policy route where Server subnet going thru static route to WAN1. I've configure VIP on WAN1.. but  users on user subnet they want to access the server using public vip ip... How can we achieve this.  

Hi,I have a Fortigate 100E with OS v 6.0.0 installed and setup radius with a windows 2012 server.The radius server is found but when I test the credentials from the fortigate it failes with "Invalid credentials"I have set this up before with an older OS version and that is working just fine. I checked all of the settings between these 2 configurations and they are the same. Any ideas why radius authentication is not working?

Hello,  I have some difficulties with sending traffic between an interface and VLAN: Physical interface:   12.155.16.128 / 255.255.255.192VLAN:                    12.155.16.192 / 255.255.255.192 I created IPv4 policies between them, normally with just VLANs it works fine, but not really between an interface and a VLAN. I tried to switch on and off NAT in these policies, but with no luck.  Funny thing is that I have a site-to-site VPN tunnel connected to this location and I can reach hosts on this physical interface and VLAN just fine. Thank you for your help in advance!

Hello,  In all of my locations I'm using managed switches, so I only have to create VLAN interfaces for one of the ports and switch sends tagged traffic to one of the virtual interfaces. Now I have one exception and I need to configure everything without a switch. I need to connect my FortiGate 30E to an Access point with 3 different SSIDs (3 VLANs), a printer and VoIP telephone, so I need 4 VLANs + WAN to do this. With a switch, I'd just create some VLANs on specific ports and switch would do the magic with tagged and untagged ports. I can see that there are:-Loopback interface-Hardware switch-Software switch-WiFi SSID-PPPoE-EMAC VLAN I couldn't find a cookbook on Forti youtube that explains what's the difference between them. Can you guys give me a clue how to do this?

Hello, I'm in charge for a new VPN projet between with our Headquarter and some branch office.For one of our branch office, I have 10 users, but 4 WAN, 2 FTTH(fail over), one 4G and 1 SDSL for VoIP, and I want to connect my ERPbox who manage the printers in my ERP who is hosting in a datacenter. So, in the future I have 5 WAN to manage with the fortigate. Someone can ensure that the Fortigate 60E it's OK for 5 WAN ? Regards,

Hi Folks, I need to upgrade Fortigate firmware from 5.4.1 -> 6.0.2 I have the upgrade path 5.4.1->5.4.3->5.4.5->5.6.2->5.6.6->6.0.2 build 0163 Just looking for some one experience going from 5.4.1 -> 6.0.2 build. Is it ok to upgrade or should go with 5->6 or should I take a  while after every patch upgrade? ThanksA  

Hello Guys, when we enable Machine Learning with Anomaly detection in layer1 and threat detection in layer2 what is actualy the scan Sequenz when we also have the Protection Profile with Standard Signatures applied to Server Policy? Will the standard pattern be checken in 1st place and then machine learning? or will it beginn with machine Learning > anomalitie > Threat Detection > standard patters from protection profile? Another question: who is using Machine Learning in Production environment? is that realy i kind of Fire and Forget setup now? Thank you

Hi,I have two FortiGates and I created an IPsec tunnel between them via IPsec Wizard.The VPN is working well, but I cannot ping from Fortigate B CLI to a host in the other network.The ideea is that in network A I have a FortiAnalizer and I want to send logs from Fortigate B to it. Please help!Thanks!Kind regards,

We need to provide a secondary ISP connection to a location with a FortiWiFi for redundancy. I have a few questions if someone can share some insight. 1. How does the FortiExtender-40D-NAM connect to the FortiGate, US. or Ethernet? 2. Is the wireless service/SIM card provioby Fortinet or by the customer? 3. Is this the best / most cost effective solution available? If not, what else is worth considering?

Hi guys,I have an issue about fortigate rules.First of all i'm using fortigate in our edge network and before that was mikrotik routerboard.Mikrotik had a feature that was usable for me. now i have 3 internet connections links for typical solution. for specific issue i marked packets from each interface by mangle an and for backing route to packet's source sent it to the interface that it came.i'm searching for similar approach to solve this issue . anybody have idea for that.Thanks,