Solved

Hi, In our network we have a mix of FG200D, FG60E and FG200E firewalls all managed by a single FMG VM.  Currently we are running latest version of 5.4 across all devices and FMG. In the past we have been reluctant to move to the latest major release, at least until after a few minor releases to fix bugs.  Taking this into consideration, we are contemplating upgrading to the latest of either 5.6 or 6.0 and would like to know your experience and recommendation.  Are there issues with 6.0 making it more sensible to go the 5.6 route, at least for now? Your time is appreciated. Thank you,LarW63 

hi there, I need to set up some laptops to have pre-installed Forticlient. Is there a way to download forticlient full version (not online version), so I can easily deploy to those laptops?since my internet connection not so fast, 1 laptop need almost 1.5 hours just for install forticlient using online version. I need to set up 16 laptops. those laptops will connect to fortigate with OS 5.0 above, but before 5.2need help please. thank you

When adding a secondary node to HA, do I have to define the interfaces on secondary node? More specifically, the primary uses a LACP LAG to connect to core switches.  Do I need to define the LAG on the secondary, or will that config sync? I do have the core switch ports configged for the LAG, not sure if need to define on FGT prior to enabling HA.  Thx,Dave 

hi there, need advice and guidance.I've created virtual Ip and its grup.and already make DDNS for my WAN connection.policy also already create it. I try to enter web address (ddns ID I've registered), but page not found. Am I missing something? my internet connection is behind NAT. thank you.

Hello all We run a 3240C cluster in an active-pasive configuration.We have four vdoms's in total on the devices, with pretty much the two busiest vdoms in terms of traffic, feeding into np4 0.Our traffic predictions for next Summer suggest we might start to come close to pushing around 35 Gb's of traffic through our three data centres, so with reasonable load balancing, around 15 gbs of tcp traffic pr cluster. Going active-active is not an option, so the key question is, even though these firewalls are rated to 40 Gb, will we have enough ceiling to accomodate this traffic level through NP4 0? Are there any decent commands available to interrogate the NP4's and attempt to work out how hard the are currently working with our current throughput of around 5GB? Tanks in advance   James

Hello, i'm really new to the FortiGate-World so please be kind. I have the case that a user wants to open a certain website with a certain port (8024) to be able to stream this via the VLC player. When calling the URL this is blocked with the attached error message.   How can I share this URL with this port for all users?   FortiGate 60E, FortiOS v5.6.3 build1547   Thank you, Tobi

hi there, need help please. I need to configure VPN SSL. the issue is ISP only provide private IP.therefore, in vpn ssl setting, system listen to <private IP>:<port vpn ssl> please help. thank you

Hello Team,   I have following questions for FortiGate integration with Azure new features   1. Can Fortigate VM be deployed from Azure Security Center - https://docs.microsoft.com/en-us/azure/security-center/security-center-intro 2. Can Fortigate VM send metrics to Azure Applications Insights  3. Option for native VM Monitoring capabilities (tagging) for virtual machines that are hosted in Azure ? Kindly let me know if these features are available in 5.6 or planned for 6.0 release   Thanks Steve  

Hi,I am confused if how traffic shaping values work in fortigate. Say if we have 1 MB pipe of internet what should be the value in shaper. 1024 or 1024x8=8192. Regards,Sushil

Hi there! My first post here... English isn't my native language, so i'm sorry about some mistakes. Does somebody know if is it possible to use a hardware from a FortiManager 4000D to install a FortiAnalyzer image? I'm asking because today we have some FortiManagers (4000B) in spare that we would like to use as FortiAnalyzers (above version 4000B). I know its possible to use VM, but I'm not talking about it :)

Hi, I want to limit the bandwidth to access youtube. I want that users can not use more than 4mb of bandwidth. I already generate a traffic shaper of type Per-IP, then a traffic policy but I can not create an application control that detects only the traffic of youtube to apply in the ipv4 policy. any idea?a similar example cookbook for version 6.0.3? thanks.

Not sure it is in the correct thread. Running on 200D 5.4.8   This is mainly for AV. In order to detect viruses, we needed to add the SSL/SSH inspection and by selecting "Certificate Inspection", the firewall now detects viruses but only for non encrypted traffic. As most of the traffic is now via https, we need to select instead "Deep Inspection" However, all the sites now come with certificate errors. The engineer assigned to our case, told us that we need to install the Fortigate certificate on all our workstations, which is not really possible. too many devices (windows, IOS, MAc and Android) and too many browsers He said the alternative was to purchase a CA certificate and install it, but was not able to advise further.   Have many of you used that technique? I am guessing that it becomes more and more common to implement viruses/malware scanning at the gateway level, and this would be the easiest method now that 90% traffic is encrypted?   What CA would you recomme

Hi, Anyone has a procedure to configure Forticacheas an explicit proxy? 

Hi all,I've got a problem.I want to block mac adress of PC in LAN network.On Fortigate 100E isn't DHCP server.Forti OS 5.6.4I created a device with specific mac adress.I added this device to a device group (blocked macs) , and finally i used this group in IP v4 policy :[ul]Incoming Interface: LANSource Address: all Outgoing Interface: wan (your internet connection)Source : "BlockedMac" and subnet 10.10.10.0/24Service: AllAction: Deny[/ul]But this not work.Any ideas ?THX

Hi folks, We have ipsec tunnel vpn site - site between our HQ to branch office. Now branch office has ipsec tunnel with customer. Our HQ users need to access that customer network which is connected via remote Site - site2 site ipsec tunnel from branch office I'm using fortigate 200 D in HQ and 100D in branch office. any pointers please. Is there any option I can route traffic that comes from HQ to remote site towards customers ipsec tunnel? Its same like we forward sslvpn traffic to ipsectunnel. can we forward ipsec to remote device ipsec tunnel ? ThanksAtul

Hi all, I know this is a fairly common question on this forum but I haven't as of yet come across a definitive answer that works for me. I am hoping someone with more knowledge and experience can assist me. My environment is as follows:Fortiwifi 60E - 6.0.3 in Flow-based with profile-based in the settings.I have a number of devices with hardcoded DNS servers. I would like to be able to redirect DNS requests to my own internal DNS servers. I would particularly like to redirect requests to Googles DNS servers to ones of my own chosing. I have previously managed to do this with the a pfSense firewall, Untangle NGFW as well as Mikrotiks and Ubiquiti Routers. I can't seem to figure it out with FortiOS. The way I would typically achieve this is destination NATing (similar to port forwarding) but this doesn't work as expected in FortiOS. I have tried the following forum suggestions as well:https://forum.fortinet.co...&high=redirect+dnshttps://forum.fortinet.co...&h

Hi guys, I just try to troubleshoot internal bandwith issue.So here my setup.WAN2 = internet speed test can cap my 150Mbs internet serviceWAN1= Forti APDMZ = Unraid NASInternal hardware= different PC and Raspberry PIAll port are 1000Mbs full duplexWhen I copy a large file from or to my NAS I can only get 100Mbs When I do a IPERF3 test from my NAS to my PC same 100MbsWhen I do an IPERF3 from DMZ  port (in fortigate CLI) to my PC (internal hardware switch port)I only get 260MbsWhen I do an IPERF3 from DMZ  port (in fortigate CLI) to my NAS (DMZ port)I only get 460Mbs When I do the IPERF test from Fortigate to my PC CPU core peak at  core #1 40% core #2 100% core #3 and #4 1%When I do the test from PC to NAS the fortigate CPU is 1-2 % range on all core.again all port are 1000Mbs So my goal is to be able to reach 1Gbs when connected trough my NAS Any though? Thanks   

I'm setting up my first HA enabled 301E's running FortiOS 5.6.5 to replace our solo 300C that is stuck on FortiOS 5.2.  Since I cannot just drop it in and go, I'm trying to build the replacement units off to the side, but I'm kind of stuck.  I the 301E's on a circuit we were not using, so I can try to get it to phone home, register, check license, etc... I can plug a laptop into the circuit, set a static address, and get out onto the internet, but when I plug the circuit into the into the firewall it knows it is connected, but does not seem to have Internet access.  I put a dumb switch in between the the AdTran from the provider and Fortigate so I could plug my laptop in and ping the exterior interface of the firewall as a test.  There aren't any errors, and the port in question is setup a WAN.  I can ping the gateway address from the CLI, but I cannot ping or trace past it from the firewall.  I do have a "zero route" on the interface pointing to the gatew

Hello All, I'm new to Fortigate. I've one Fotigate 40C with FortiOS 5.2. I have 2 ISPs A & B with BGP. I've terminated both the ISP on WAN1 and WAN2 Ports and have configured the same as suggested in the below KB, followed every word (except for IPs :) ) :http://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-advanced-routing-52/Routing_BGP/Dual_Homed_Example.htm All was working, but now the BGP routes of ISP A are being redistributed to ISP B and vice versa, which created a loop like problem in my network and it went down. I had to shut the port of ISP B. I am looking for the solution, so that the BGP routes of ISPs are not redistributed to each other and the failover works perfectly. Please help me on this. ThanksAjay Bohra

Hi I have FG501E with one of its FAN high RPM speed (very noisy).Is there a way to reduce its speed? Thanks

Hello Team,We are using Fortinet 50E Firewall for small office/home office environment. Currently, we are having dual WAN/internet connection live on firewall. We are load-balancing outgoing traffic with fail over. Both the connections are active/active scenario with single LAN connection. Along with that we have hosted web server and mail server by using port forwarding through VIP. Now, we are planning to introduce new 3rd Internet connection however, firewall has only two WAN ports (WAN1 & WAN2). Is there any way to provision third Internet WAN connection. Appreciate your responses. :) Regards,Mayur Rajyaguru

Hello guys, I need to delete an interface from my FortiOS 5.4, but I can not do that because there is a System Administrator (admin) as a REF. I don't know what to do with this issue. How can I delete this object to allow me remove this interface.   Thanks and regards,

We have a 200D running v6.01. I've created a SSL portal, my user can connect to it without problems. Once connected they can reach a variety of websites and other resources. The one website I've built the configuration for is the only one that doesn't work. When we click a bookmark or try to quickconnect a new tab opens in the browser, the page background changes and then there's nothing, just an empty page.I'm not sure where to troubleshoot from. The site is hosted on a linux VM, the page loads on all the browsers we test with. Its an apache webserver connecting to a tomcat 8 application. The host's apache and tomcat logs show a connection without problems. We can use the website through tunnel mode.  The one guess I have is there's a conflict with certificates or ciphers. The Tomcat app and the pages it presents are stubbornly ssl only. This isn't homegrown, it was written by Microfocus and recently released. I've dug pretty deep trying to get it to send unencrypted connect

Hello, We are deploying a WiFi solution with Fortigate and FortiAuthenticator. We will use the device self-enrollment feature and we are not sure about the "Max. device" setting within Device Self-Enrollment configuration. Does anyone know what this feature is?   We want to limit end users to connect only one mobile device to the WiFi network. Does the "max device" feature prevent this?   Thank you!

Hello All,Few days ago I discover that I'm unable to connect to elastix web site with and without web filter activated.I create a rule with any-any accept without any restriction and got the same error: ERR_CONNECTION_RESETAny help please, firewall model is 60E version 5.6Thanks and kind regards,Gr1n3