Solved

Hello forum members. My first post. Recently we purchased FortiGate 1000D and replaced TMG 2010 successfully. I found a lot of similar discussions but nine of them describe my issue.  Now I can't create one rule (can't figure out how to) which I can create easily on Kerio Control or TMG itselfWhat I need, is to forward SMTP port to Exchange Server itself (10.22.10.59), bypassing my AntiSpamServer (10.22.10.80) when connection goes from specific IP addrress (lets say 2.3.4.5) in other words i need vip rule like below my.wan.ip.addr --> 10.22.10.80 (TCP: 25 --> 25) | (this is ok)my.wan.ip.addr —> 10.22.10.59 (TCP: 25 --> 25) srcip 2.3.4.5 | this is not ok  Please note that I have forwarding rule for SMTP service and it works well. All request to that service are forwarded to 10.22.10.80. This is ok. Now how to excuse a WAN IP by forwarding SMTP queries directly to my Exchange Server (10.22.10.59)

I have a FortiGate 200E that is setup to log to the FortiAnalyzer. From time to time, I'll log in to the Analyzer and notice that logging has stopped. Does anyone know how to setup an alert that will notify us that logging has stopped on the FortAnalyzer? I can fix it by logging in to the FortiGate and toggling the logging from real-time to every minute, that seems to get it going again.  Shawn

My computer (Win10) has an installation of FortiClient Endpoint Security (4.2.5.0286).  It doesn't work, not sure why.  So I want to install a version that will work, but I can't, because the previous version is installed.  When I right-click on this in Apps & Features and select Uninstall, it claims that "The Feature that you are trying to use is on a network resource that is unavailable", and asks me to point out where FortiClient_x64_en-us.msi is located.  I don't have such a file (I've checked), so I'm wondering what can be done to blow away the old installation before I can install the new version.

Hello, Has anyone had any luck with integrating Meru Wireless APs with a FortiGate 60e?  It seems when I try to create a managed AP I cannot since it's requiring a 16 character serial number and the Meru Wireless APs are 15 characters... I believe Meru Wireless APs can be converted into FortiAPs?  Any assistance would be appreciated :)  Thanks  

Is it possible to have VLANs on the Fortigate 60E without a Foritgate Managed Switch? I currently only have a few unmanaged switches but need 3 networks on the firewall to be completely separate. One method I have found seems to work but not sure if this is secure or correct is to create 3 new interfaces and assign different network addresses/subnet and then assign different ports to each. Then plug an unmanaged switch into each port and then you have 3 seperate networks. I have tested this and theres no pinging between networks and seems fine but wanted opinions? Also I did see I could create a VLAN interface on ports but wasnt sure if this would work without the Fortigate Switch?

Hi people !  I'm currently running on EMS version 6.0.3 build 0134 My setup is working fine, I have a couple of different profiles that are attached to a couple of different OU's in AD. But now - when adding and ad joining new laptops to the AD, I am unable to get the profile from the EMS attached. What is strange, is that when I browse the AD - in EMS - looking for the new laptops, I cant find them ?? I have checked, double checked and triple checked that the laptop is domain joined and present in the correct OU in AD. It looks the same as any other laptop... very strange.. I have also tried a manual sync from ems to AD, and that is fine..I have verified credentilas towards AD from EMS - again,,its fine. Anyone have any experience with this ??

Hello Everybody,As a total Newbie, I need some help. I'm the network administrator of a little association. We have an Active directory.  There is wi-fi access to our network (and through it to the internet) for some workers. For that we use 3 Forti AP 221C.Of course I have access to their admin page through a web browser and also to lots of setting through forticloud. I would like to set up a Guest WiFi access that only give access to the internet (not to shared folder on our LAN for example). Is it possible ? May I add something else on my network (hardware / software) to do this ? I found this : https://cookbook.fortinet.com/guest-wifi-accounts-60/ but don't know where can I find all this. Thanks a lot ! Have a Happy New Year !

Hi , I have a lan network 192.168.10.x  and a server on 192.168.10.30 , every host from the same network can acces this server by tapping the ip adress on web URL , i want to let this acces just for IT departement and block it for other hosts on the entreprise please Thanks 

Hello All! how are you?I need upgrade the FortiOS of a 90D from 5.2.13 to 6 at least. Witch updates i have to install step by step in order not lost administration (its a remote appliance) I have no remote hands that can help me. Thanks.

Hi all, Not sure where this topic should be posted since it overlaps between IPSEC site to site and LDAP authentication, but i'll give it a go here. I'm having a peculiar request: 1. 2 sites on a site to site VPN - Site A (main office) & Site B (branch office)2. At present the connection from B to A is not in a route all state, and each site goes out through its own connection for internet access3. Site A's VPN access is authenticated through LDAP to their Local Active Directory in Site A Now there is a requirement where I need to allow users from site B to access via site A's VPN  My question is:1. How do i reach site B's Active Directory / LDAP through the site to site for this authentication to occur?2. Locally, on site A, it is able to ping site B's Active Directory server3. I've created the LDAP entry on the Fortigate, but it is unable to reach Could someone point what I may have missed out?

Hello everyone!I'm trying to attempt loading a backup file .conf with a .bat file. Let me explain better, what I'm trying to do is execute Forticlient with a SSLVPN remote desktop configuration with a .bat file, so the user only have to login in to the VPN, just clicking on the .bat file.

I am setting up a Fortigate 60E with SD WAN for failover/load balance but running into an issue. I have 2 WANs connected and both work individually with my ipv4 policy if I switch between them, so I know the WANS are setup correct including the static routes. When I add them into SD-WAN and then set my ipv4 to use the SD WAN I have no internet at all. I feel I must be missing something obvious but I've followed the guides I've seen like this Any ideas would be appreciated

Trying to configure LDAP for a FortiManager 5.2.4 but can´t get it working. Configured a ldap server with the group that they should be a member of, but when I apply it users of that group can´t login. [ul]Is there any equivalent to the Fortigate diag test auth ldap ?Is there any logs to check? (Eventlog only says "User 'xxxx' login failed from GUI(10.241.241.2), reason:Authentication failure. Please try again...")Anything that you can see that´s not configured properly in the configuration below?[/ul] Configuration belowconfig system admin ldap edit "ldaps_domain" set server "dc1" set secondary-server "dc2" set cnid "cn" set dn "DC=domain,DC=tld" set port 636 set type regular set username "CN=sausername,OU=Service Accounts,OU=Internal IT,OU=ROOT,DC=domain,DC=tld" set password ENC ******* set group "CN=sg_FortiManagerAdministrators,OU=Groups,OU=ROOT,DC=domain,DC=tld" set secure ldaps set ca-cert "CA_Cert_1" set adom "all_adoms" next end

could someone please advise if this is possible with a fortinet product. I currently have Nortel contivity VPN-netgear wifi to netgear wifi-Nortel vpn within a warehouse.I would like to replace all products with an all in one solution, so the VPN client on the device establishes a tunnel across the wifi and terminates on the wifi device at the other end. a bit odd maybe but we cannot rely  on WPA2 for security. I have looked into Linksys, netgear etc. but site to site vpn only doable over LAN or ADSL WAN. Many thanks in advance.... 

Hi all, Fortinet Support has just informed me that there is no option to add a second DHCP relay server to the interface config. I just want to ask the community if they agree? config system interface edit "lan" set vdom "root" set dhcp-relay-service enable set ip 10.90.52.1 255.255.255.0 set allowaccess ping https ssh snmp http fgfm capwap set type hard-switch set stp enable set role lan set snmp-index 4 set dhcp-relay-ip "10.90.2.92" nextend I would like a second IP address in the set dhcp-relay-ip. We are setting up a DHCP Failover as we are having a scheduled power maintenance in our head office which means the main DHCP server will be out of action for a few hours.

I have a new Fortigate 80E installed. Issue is that anyone externally should be able to access an http webpage from a security camera system on an internal network but this doesn't work at all. Internally the webpage 192.168.4.2:8282 works just fine.Source ip: any Destination IP: 100.100.100.98 Destination port: 8282should translate toSource ip: original destination ip: 192.168.4.2 Destination port: 8282 I have many other similiar and more complex translations for exchange server, webpage (port 80) on a different server, vpn that runs on an internal server. All of these work just fine. Only difference I believe is that the Security camera is on a different internal interface. The NAT rules that work are all on the main lan interface 192.168.0.0/24I ran the protocol analyzer on the wan. I could see the attempt from the source device but no response from destination. I also ran a test on the security camera interface and I see no packets mentioned from the source ip or the port 8282.I am

Hy Everbody ! I want to disable in my fortigate 90 the SSH port 22.It is necessary to create a policy or I need to disable an option ? Thank you ! 

Hi, I have a small network where all my equipment has private IP addresses (10.x.x.x) and I am using a Fortigate 300C.   I have a special need where I need to use a public IP address (e.g. A.A.A.A) to talk to an equipment that is configured just to reply to that address.  My server talks to that equipment by means of a NAT using IP Pool (with only that address A.A.A.A), and it works great.   My server is also accessible with a VIP from the Internet and it works great.   Problem is that if that particular public IP Address (A.A.A.A) tries to access my server from the Internet the Fortigate doenst seem to know how to handle it...  The packets doesnt seem to reach the server and looking through the Fortigate sniffer on that port, I just see SYN, SYN/ACK, RST. I have tried disabling the NAT, but the only thing that returns the ability of the A.A.A.A address to reach the server from the outside is to delete the IP Pool where it is defined. 

All - I have 15 FortiAP's connected to my Fortigate and whenever I get more than 6 or so computers in a conference room the wpad_ac process tanks one of the CPU's of the Fortigate and doesn't allow any more computers to be authorized to our network. I have a ticket open with Fortinet and they've said the issue is known and will be fixed in the upcoming 6.0.4 release.  They've also stated it will not be fixed in the 5.6.x code stream (which is what we're running).  They've also not offered a workaround during the interim time until 6.0.4 is ready and we go through the necessary preparation for a major OS upgrade. My question is: has anyone else had this problem and if so did you solve it?  I can't believe our setup is unique - it conforms to the standard enterprise setup using Windows NPS as the RADIUS server outlined in Fortinet's cookbook.  Also never had a problem with the setup during our 5.4 days. I'm still pressing Fortinet for some better answer

Hello All, I have a new FortiGate 300D firewall and I was wondering if this device possessed the ability to take the traffic routed to it and span port it to another device that we use. Anyone have any experience with this functionality on this device, this is my first Fortinet product. Thanks

Hello, I'm trying to summarize the amount of data used by an application, host, etc. over a given period of time. I'm sysloggging to Splunk and seeing the following problem: long running sessions are logged every 2 minutes with the cumulative amount of data (bytes sent/received/total) up to that point. So... for example an session that lasted an hour would have 30+ syslog messages.  Now say the total data in the last syslog show 8MB sent, 2MB received, and a total of 10MB.  The syslog before might be 7.5MB sent, 1.9MB received, and a total of 9.5MB.  A simple search utilizing SUM produces a result that is like 200MB for the 10MB session (because the last syslog message when the session terminated has the complete data for the session) I tried to filter based on action (action != accept), but the results are like 1/3 of the actual bandwidth so that doesn't really work. Tried the splunk fortigate app and the data model appears to have the same

Hi all!A department on the company that I work are having issues with some FortiGates. This department is charge to the maintenance of the client's fortigates. Today they had two issues with "missing policies", one with a FG200D and another with a FortiWiFi 90D. The FG200D is installed on our office and it had "missing policies" after a Firmware upgrade following the upgrade path from FortiOS 5.6.3 to 5.6.6 and finally 6.0.3. The other device is a FortiWiFi 90D owned by one of our clients and this one also had "missing policies", but in this case it happened after a power disruption. We had this type of issue on the past on other devices, but were few. The department of maintenance tells me that they are following the recommendations of FortiNet for upgrades by reading the release notes and following the upgrade paths. My concern is that this is happening more often and we are scheduling to do a firmware upgrade to a core 1000D that manage the security on our DataCenter. Missed po

Hello,We have a Fortimail unit that uses LDAP authentication for logging into the webmail for our quaratine folder. When I run an LDAP bind test on mu username and password, it tells me "Too many DNs returned by user search." So far my account is the only one I've ran across this issue on. It sounds like this is an issue with my AD. Any suggestions?

Hi there,Can one collector agent pass logon information to multiple Fortigates at the same time ?Thanks,Mahmoud

When ever I log in to my fortigate 51E I get the following pop up (cant attach image for some reason):                                                    File System Check RecommendedThe last reboot was triggered by a power disruption. The system is up and running, but the undefined disk may have issues. It is strongly recommended that you check the file system consitency before proceeding.                                            Reboot and scan disk now | Remind me later. I pressed the reboot and scan disk now option on two occasions, when I select it, the system goes offline and scanns (I assume) but when it's done and I log in again it still gives me the same pop up message. Any ideas on how to get rid of it?