Solved

Hi, this seems like a real noob question, however I can't seem to find a simple answer.I understand that Forticlient is end point protection that requires licensing.Is it safe to assume you can simply use Forticlient software as the VPN client without any special licensing - should you desire it?

Hello. We are trying to achieve the following: traffic between hosts (a bunch of VMs, actually) has to be proctected by a firewall, but these hosts are located in the same L2 VLAN and use a matching L3 addressing subnet. The problem is not that we simply need to isolate the hosts that belong to the same VLAN (Private VLANs could be used for this purpose), they still need to communicate with each other and we need to firewall all of their communication. Further segmentation of the VLAN (into smaller networks) is just not feasible. Does anyone have an idea how to do this the best way in the Fortigate world? Would any features of the "new" Security Fabric be of any use here? Thanks for your help!

in my organization more than 4000 thin clients  hp t5570e with Windows Embedded installed i really need to block their traffic to WAN  Desirably all traffic  what is the best practicy of doing thatby OS, hostnmae (all of theor hostname starts with HP-XXXXXXXXXXXXX), or by mac address (mac also statc like ab:cd-ef:xx:xx)any help would be greatly appreciated 

I'm not sure how to ask this in a simple way, but here's my attempt: if I'm using VDOMs, and providing WAN access to all of my VDOMs via the root VDOM's WAN, should the root VDOM have a minimal configuration? More Details ------------- For years I had a simple network topology, so I didn't enable VDOMs in my Fortigate. I recently started segmenting my network to set up a VLAN for manufacturing/IOT devices in addition to my existing main business network. In order to share the same internet connection on the Fortigate between several VLANs, I enabled VDOMs. I (essentially) followed the directions found here https://cookbook.fortinet.com/inter-vdom-communication-with-static-routing-56/ for enabling VDOMs and sharing a WAN interface. However, instead of three VDOM's, I have two. The root VDOM "inherited" all of the configuration that was in place before I enabled VDOMs, and I still have my main business network connected to the root VDOM. My second VDOM is for the manufactu

All,In setting up a fortigate unit for remote users to access local lan of our enterprise, 3 vdom has been used with vdoms serving 3 causes - vpn termination, secure vdom & root. vpn vdom has virtual links created to vpn vdom & secure vdom. Question is:-1) for users authentication with radius, will it be using vpn vdom or root vdom? 2) If vpn vdom , how will the routes be towards the inside to reach authentication server? please help. thank you.

Have the way the Fortigate interprets regular expressions changed between FortiOS release 5.4 an 5.6 ???   \.ru\b  worked in 5.4 to match all domains under the top-domain .ru, it does not work in 5.6.4   if I add \.ru\b  in the Static URL filter via GUI the regexp as show in the CLI is \\.ru\\b and it does not match

Hello there,I can't connect to F.W via GUI or CLI(i don't have the cable),can I reset to factory settings in a physical way?

Hi, Just want to make sure. If I implement active-active HA of Fortigate, does it increase the throughput? Let says, 1 unit fortigate has 4Gbps throughput for threat protection (FGT-1200D). When I configure A-A HA, can the cluster of 2 units FGT handle up to 8Gbps threat protection throughput? Thank you

Hi Guys, We are currently deploying a FortiAnalyzer 400E unit for our customer. There are currently two HA core switches in the environment. Our initial design was to connect to one of core switches. Does FAZ 400E support LAG (link aggregation) to support connectivity to both core switches? Thanks for your help!

Hello there, we have the FortiClient with FortiClient Enterprise Manager in use. I am new to FortClient and asked me, how can I work with the quarantaine files? In the EWS I couldn't see an option for that and on the client I can't delete the files. Is the a main configuration for that, or I am blind to see? FortiClient 5.4.2.0860FortiClient EMS 1.0.1.0077 Thanks. Regards, Rolf

Hello! Who can make sense of these two pieces of information? FortiOS Handbook: Authentication for FortiOS 5.2, PDF file, page 28:password-expiry-warning and password-renewal In SSLVPN, when an LDAP user is connecting to the LDAP server it is possible for them to receive any pending password expiry or renewal warnings. When the password renewal or expiry warning exists, SSLVPN users will see a prompt allowing them to change their password. password-expiry-warning allows FortiOS to detect from the LDAP server when a password is expiring or has expired using server controls or error codes. password-renewal allows FortiOS to perform the online LDAP password renewal operations the LDAP server expects. Fortigate-cli-5.2.pdf, page 720:FortiGate LDAP support does not extend to proprietary functionality, such as notification of password expiration, that is available from some LDAP servers. FortiGate LDAP support does not supply information to the user about why authentication failed.

Hy guys!I'm looking for a way to change the PSK of a wireless service, deployed from our FortiWLM 8.4 solution. I'm using this to generate a random password every day for our guest Wifi.I can do this on the WLC (controller) but only if the complete wireless service is configured there (ownership), but not on WLM. 

https://forum.fortinet.com/tm.aspx?m=116066 i have see above thread for changing switch mode to interface mode, but cant find the line  " set internal-switch-mode switch" and change that to " set internal-switch-mode interface" in Firmware Version v5.0,build0252, anyone help? thanks. Current situation:i am using FortiWIFI 90D, start with switch mode, with "internal" ip:192.168.0.x/24, now want to add a subnet 192.168.2.x/24, how can i do?1. i try add a static route 192.168.2.x/24, with gateway 0.0.0.0, device:internal2. create policy Incoming Interface:internal (LAN) Source Address:all Outgoing Interface:internal (LAN) Destination Address:all Schedule:always Service:ALL Action:ACCEPT but didn't work, and i try add a router with WAN IP: 192.168.0.10, internal ip:192.168.2.1, dhcp enabled:192.168.2.100-200, all subnet pc can go internet, can ping 192.168.0.x/24 , but 192.168.0.x/24 can't ping 192.168.2.x/24 network, i want to set both 192.168.0.x/24 and 192.

I have a rule on my Fortigate (FortiGate 1000D) to block some countries (geoip blocking) But rule seems not working.Can someone help me to find out why? FortiFw (25) # showconfig firewall policy    edit 25        set name "GeoIP Block"        set uuid d40a24de-1cad-51e9-5df4-b01121de63c3        set srcintf "port9"        set dstintf "port10"        set srcaddr "Blocked Countries"        set dstaddr "all"        set schedule "always"        set service "ALL"        set logtraffic all        set fsso disable    nextendFortiFw (25) #    

The brief overview is we have someone attempting to, I assume compromise, phones in our VOIP system from an IP originating in the Russian Federation. I have attempted to block their IP, the /24 range of IPs, ports used and i'm still seeing packets on the internal interface from their IP. I cannot for the life of me figure out why this is happening and isn't being blocked, it's even using a rule configured for outbound communication to get in, according to FortiView. So I suppose the first question is, will the packet capturer, "diag sniffer packet internal 'net 185.22.155.0/24' 6" show packets that are dropped? I typically set it up so I have one set on wan1 and a separate one set on internal to see if the packet is actually getting to internal from wan1. So if I'm seeing a packet from wan 1 with src=185.22.155.18 and dst =8.27.x.x. then at the same time one on the internal showing src=8.27.x.x and dst=192.168.x.x that, to me, means the packet is getting through. As a note I also

Hello forum members. My first post. Recently we purchased FortiGate 1000D and replaced TMG 2010 successfully. I found a lot of similar discussions but nine of them describe my issue.  Now I can't create one rule (can't figure out how to) which I can create easily on Kerio Control or TMG itselfWhat I need, is to forward SMTP port to Exchange Server itself (10.22.10.59), bypassing my AntiSpamServer (10.22.10.80) when connection goes from specific IP addrress (lets say 2.3.4.5) in other words i need vip rule like below my.wan.ip.addr --> 10.22.10.80 (TCP: 25 --> 25) | (this is ok)my.wan.ip.addr —> 10.22.10.59 (TCP: 25 --> 25) srcip 2.3.4.5 | this is not ok  Please note that I have forwarding rule for SMTP service and it works well. All request to that service are forwarded to 10.22.10.80. This is ok. Now how to excuse a WAN IP by forwarding SMTP queries directly to my Exchange Server (10.22.10.59)

I have a FortiGate 200E that is setup to log to the FortiAnalyzer. From time to time, I'll log in to the Analyzer and notice that logging has stopped. Does anyone know how to setup an alert that will notify us that logging has stopped on the FortAnalyzer? I can fix it by logging in to the FortiGate and toggling the logging from real-time to every minute, that seems to get it going again.  Shawn

My computer (Win10) has an installation of FortiClient Endpoint Security (4.2.5.0286).  It doesn't work, not sure why.  So I want to install a version that will work, but I can't, because the previous version is installed.  When I right-click on this in Apps & Features and select Uninstall, it claims that "The Feature that you are trying to use is on a network resource that is unavailable", and asks me to point out where FortiClient_x64_en-us.msi is located.  I don't have such a file (I've checked), so I'm wondering what can be done to blow away the old installation before I can install the new version.

Hello, Has anyone had any luck with integrating Meru Wireless APs with a FortiGate 60e?  It seems when I try to create a managed AP I cannot since it's requiring a 16 character serial number and the Meru Wireless APs are 15 characters... I believe Meru Wireless APs can be converted into FortiAPs?  Any assistance would be appreciated :)  Thanks  

Is it possible to have VLANs on the Fortigate 60E without a Foritgate Managed Switch? I currently only have a few unmanaged switches but need 3 networks on the firewall to be completely separate. One method I have found seems to work but not sure if this is secure or correct is to create 3 new interfaces and assign different network addresses/subnet and then assign different ports to each. Then plug an unmanaged switch into each port and then you have 3 seperate networks. I have tested this and theres no pinging between networks and seems fine but wanted opinions? Also I did see I could create a VLAN interface on ports but wasnt sure if this would work without the Fortigate Switch?

Hi people !  I'm currently running on EMS version 6.0.3 build 0134 My setup is working fine, I have a couple of different profiles that are attached to a couple of different OU's in AD. But now - when adding and ad joining new laptops to the AD, I am unable to get the profile from the EMS attached. What is strange, is that when I browse the AD - in EMS - looking for the new laptops, I cant find them ?? I have checked, double checked and triple checked that the laptop is domain joined and present in the correct OU in AD. It looks the same as any other laptop... very strange.. I have also tried a manual sync from ems to AD, and that is fine..I have verified credentilas towards AD from EMS - again,,its fine. Anyone have any experience with this ??

Hello Everybody,As a total Newbie, I need some help. I'm the network administrator of a little association. We have an Active directory.  There is wi-fi access to our network (and through it to the internet) for some workers. For that we use 3 Forti AP 221C.Of course I have access to their admin page through a web browser and also to lots of setting through forticloud. I would like to set up a Guest WiFi access that only give access to the internet (not to shared folder on our LAN for example). Is it possible ? May I add something else on my network (hardware / software) to do this ? I found this : https://cookbook.fortinet.com/guest-wifi-accounts-60/ but don't know where can I find all this. Thanks a lot ! Have a Happy New Year !

Hi , I have a lan network 192.168.10.x  and a server on 192.168.10.30 , every host from the same network can acces this server by tapping the ip adress on web URL , i want to let this acces just for IT departement and block it for other hosts on the entreprise please Thanks 

Hello All! how are you?I need upgrade the FortiOS of a 90D from 5.2.13 to 6 at least. Witch updates i have to install step by step in order not lost administration (its a remote appliance) I have no remote hands that can help me. Thanks.

Hi all, Not sure where this topic should be posted since it overlaps between IPSEC site to site and LDAP authentication, but i'll give it a go here. I'm having a peculiar request: 1. 2 sites on a site to site VPN - Site A (main office) & Site B (branch office)2. At present the connection from B to A is not in a route all state, and each site goes out through its own connection for internet access3. Site A's VPN access is authenticated through LDAP to their Local Active Directory in Site A Now there is a requirement where I need to allow users from site B to access via site A's VPN  My question is:1. How do i reach site B's Active Directory / LDAP through the site to site for this authentication to occur?2. Locally, on site A, it is able to ping site B's Active Directory server3. I've created the LDAP entry on the Fortigate, but it is unable to reach Could someone point what I may have missed out?