Solved

All,In setting up a fortigate unit for remote users to access local lan of our enterprise, 3 vdom has been used with vdoms serving 3 causes - vpn termination, secure vdom & root. vpn vdom has virtual links created to vpn vdom & secure vdom. Question is:-1) for users authentication with radius, will it be using vpn vdom or root vdom? 2) If vpn vdom , how will the routes be towards the inside to reach authentication server? please help. thank you.

Have the way the Fortigate interprets regular expressions changed between FortiOS release 5.4 an 5.6 ???   \.ru\b  worked in 5.4 to match all domains under the top-domain .ru, it does not work in 5.6.4   if I add \.ru\b  in the Static URL filter via GUI the regexp as show in the CLI is \\.ru\\b and it does not match

Hello there,I can't connect to F.W via GUI or CLI(i don't have the cable),can I reset to factory settings in a physical way?

Hi, Just want to make sure. If I implement active-active HA of Fortigate, does it increase the throughput? Let says, 1 unit fortigate has 4Gbps throughput for threat protection (FGT-1200D). When I configure A-A HA, can the cluster of 2 units FGT handle up to 8Gbps threat protection throughput? Thank you

Hi Guys, We are currently deploying a FortiAnalyzer 400E unit for our customer. There are currently two HA core switches in the environment. Our initial design was to connect to one of core switches. Does FAZ 400E support LAG (link aggregation) to support connectivity to both core switches? Thanks for your help!

Hello there, we have the FortiClient with FortiClient Enterprise Manager in use. I am new to FortClient and asked me, how can I work with the quarantaine files? In the EWS I couldn't see an option for that and on the client I can't delete the files. Is the a main configuration for that, or I am blind to see? FortiClient 5.4.2.0860FortiClient EMS 1.0.1.0077 Thanks. Regards, Rolf

Hello! Who can make sense of these two pieces of information? FortiOS Handbook: Authentication for FortiOS 5.2, PDF file, page 28:password-expiry-warning and password-renewal In SSLVPN, when an LDAP user is connecting to the LDAP server it is possible for them to receive any pending password expiry or renewal warnings. When the password renewal or expiry warning exists, SSLVPN users will see a prompt allowing them to change their password. password-expiry-warning allows FortiOS to detect from the LDAP server when a password is expiring or has expired using server controls or error codes. password-renewal allows FortiOS to perform the online LDAP password renewal operations the LDAP server expects. Fortigate-cli-5.2.pdf, page 720:FortiGate LDAP support does not extend to proprietary functionality, such as notification of password expiration, that is available from some LDAP servers. FortiGate LDAP support does not supply information to the user about why authentication failed.

Hy guys!I'm looking for a way to change the PSK of a wireless service, deployed from our FortiWLM 8.4 solution. I'm using this to generate a random password every day for our guest Wifi.I can do this on the WLC (controller) but only if the complete wireless service is configured there (ownership), but not on WLM. 

https://forum.fortinet.com/tm.aspx?m=116066 i have see above thread for changing switch mode to interface mode, but cant find the line  " set internal-switch-mode switch" and change that to " set internal-switch-mode interface" in Firmware Version v5.0,build0252, anyone help? thanks. Current situation:i am using FortiWIFI 90D, start with switch mode, with "internal" ip:192.168.0.x/24, now want to add a subnet 192.168.2.x/24, how can i do?1. i try add a static route 192.168.2.x/24, with gateway 0.0.0.0, device:internal2. create policy Incoming Interface:internal (LAN) Source Address:all Outgoing Interface:internal (LAN) Destination Address:all Schedule:always Service:ALL Action:ACCEPT but didn't work, and i try add a router with WAN IP: 192.168.0.10, internal ip:192.168.2.1, dhcp enabled:192.168.2.100-200, all subnet pc can go internet, can ping 192.168.0.x/24 , but 192.168.0.x/24 can't ping 192.168.2.x/24 network, i want to set both 192.168.0.x/24 and 192.

I have a rule on my Fortigate (FortiGate 1000D) to block some countries (geoip blocking) But rule seems not working.Can someone help me to find out why? FortiFw (25) # showconfig firewall policy    edit 25        set name "GeoIP Block"        set uuid d40a24de-1cad-51e9-5df4-b01121de63c3        set srcintf "port9"        set dstintf "port10"        set srcaddr "Blocked Countries"        set dstaddr "all"        set schedule "always"        set service "ALL"        set logtraffic all        set fsso disable    nextendFortiFw (25) #    

The brief overview is we have someone attempting to, I assume compromise, phones in our VOIP system from an IP originating in the Russian Federation. I have attempted to block their IP, the /24 range of IPs, ports used and i'm still seeing packets on the internal interface from their IP. I cannot for the life of me figure out why this is happening and isn't being blocked, it's even using a rule configured for outbound communication to get in, according to FortiView. So I suppose the first question is, will the packet capturer, "diag sniffer packet internal 'net 185.22.155.0/24' 6" show packets that are dropped? I typically set it up so I have one set on wan1 and a separate one set on internal to see if the packet is actually getting to internal from wan1. So if I'm seeing a packet from wan 1 with src=185.22.155.18 and dst =8.27.x.x. then at the same time one on the internal showing src=8.27.x.x and dst=192.168.x.x that, to me, means the packet is getting through. As a note I also

Hello forum members. My first post. Recently we purchased FortiGate 1000D and replaced TMG 2010 successfully. I found a lot of similar discussions but nine of them describe my issue.  Now I can't create one rule (can't figure out how to) which I can create easily on Kerio Control or TMG itselfWhat I need, is to forward SMTP port to Exchange Server itself (10.22.10.59), bypassing my AntiSpamServer (10.22.10.80) when connection goes from specific IP addrress (lets say 2.3.4.5) in other words i need vip rule like below my.wan.ip.addr --> 10.22.10.80 (TCP: 25 --> 25) | (this is ok)my.wan.ip.addr —> 10.22.10.59 (TCP: 25 --> 25) srcip 2.3.4.5 | this is not ok  Please note that I have forwarding rule for SMTP service and it works well. All request to that service are forwarded to 10.22.10.80. This is ok. Now how to excuse a WAN IP by forwarding SMTP queries directly to my Exchange Server (10.22.10.59)

I have a FortiGate 200E that is setup to log to the FortiAnalyzer. From time to time, I'll log in to the Analyzer and notice that logging has stopped. Does anyone know how to setup an alert that will notify us that logging has stopped on the FortAnalyzer? I can fix it by logging in to the FortiGate and toggling the logging from real-time to every minute, that seems to get it going again.  Shawn

My computer (Win10) has an installation of FortiClient Endpoint Security (4.2.5.0286).  It doesn't work, not sure why.  So I want to install a version that will work, but I can't, because the previous version is installed.  When I right-click on this in Apps & Features and select Uninstall, it claims that "The Feature that you are trying to use is on a network resource that is unavailable", and asks me to point out where FortiClient_x64_en-us.msi is located.  I don't have such a file (I've checked), so I'm wondering what can be done to blow away the old installation before I can install the new version.

Hello, Has anyone had any luck with integrating Meru Wireless APs with a FortiGate 60e?  It seems when I try to create a managed AP I cannot since it's requiring a 16 character serial number and the Meru Wireless APs are 15 characters... I believe Meru Wireless APs can be converted into FortiAPs?  Any assistance would be appreciated :)  Thanks  

Is it possible to have VLANs on the Fortigate 60E without a Foritgate Managed Switch? I currently only have a few unmanaged switches but need 3 networks on the firewall to be completely separate. One method I have found seems to work but not sure if this is secure or correct is to create 3 new interfaces and assign different network addresses/subnet and then assign different ports to each. Then plug an unmanaged switch into each port and then you have 3 seperate networks. I have tested this and theres no pinging between networks and seems fine but wanted opinions? Also I did see I could create a VLAN interface on ports but wasnt sure if this would work without the Fortigate Switch?

Hi people !  I'm currently running on EMS version 6.0.3 build 0134 My setup is working fine, I have a couple of different profiles that are attached to a couple of different OU's in AD. But now - when adding and ad joining new laptops to the AD, I am unable to get the profile from the EMS attached. What is strange, is that when I browse the AD - in EMS - looking for the new laptops, I cant find them ?? I have checked, double checked and triple checked that the laptop is domain joined and present in the correct OU in AD. It looks the same as any other laptop... very strange.. I have also tried a manual sync from ems to AD, and that is fine..I have verified credentilas towards AD from EMS - again,,its fine. Anyone have any experience with this ??

Hello Everybody,As a total Newbie, I need some help. I'm the network administrator of a little association. We have an Active directory.  There is wi-fi access to our network (and through it to the internet) for some workers. For that we use 3 Forti AP 221C.Of course I have access to their admin page through a web browser and also to lots of setting through forticloud. I would like to set up a Guest WiFi access that only give access to the internet (not to shared folder on our LAN for example). Is it possible ? May I add something else on my network (hardware / software) to do this ? I found this : https://cookbook.fortinet.com/guest-wifi-accounts-60/ but don't know where can I find all this. Thanks a lot ! Have a Happy New Year !

Hi , I have a lan network 192.168.10.x  and a server on 192.168.10.30 , every host from the same network can acces this server by tapping the ip adress on web URL , i want to let this acces just for IT departement and block it for other hosts on the entreprise please Thanks 

Hello All! how are you?I need upgrade the FortiOS of a 90D from 5.2.13 to 6 at least. Witch updates i have to install step by step in order not lost administration (its a remote appliance) I have no remote hands that can help me. Thanks.

Hi all, Not sure where this topic should be posted since it overlaps between IPSEC site to site and LDAP authentication, but i'll give it a go here. I'm having a peculiar request: 1. 2 sites on a site to site VPN - Site A (main office) & Site B (branch office)2. At present the connection from B to A is not in a route all state, and each site goes out through its own connection for internet access3. Site A's VPN access is authenticated through LDAP to their Local Active Directory in Site A Now there is a requirement where I need to allow users from site B to access via site A's VPN  My question is:1. How do i reach site B's Active Directory / LDAP through the site to site for this authentication to occur?2. Locally, on site A, it is able to ping site B's Active Directory server3. I've created the LDAP entry on the Fortigate, but it is unable to reach Could someone point what I may have missed out?

Hello everyone!I'm trying to attempt loading a backup file .conf with a .bat file. Let me explain better, what I'm trying to do is execute Forticlient with a SSLVPN remote desktop configuration with a .bat file, so the user only have to login in to the VPN, just clicking on the .bat file.

I am setting up a Fortigate 60E with SD WAN for failover/load balance but running into an issue. I have 2 WANs connected and both work individually with my ipv4 policy if I switch between them, so I know the WANS are setup correct including the static routes. When I add them into SD-WAN and then set my ipv4 to use the SD WAN I have no internet at all. I feel I must be missing something obvious but I've followed the guides I've seen like this Any ideas would be appreciated

Trying to configure LDAP for a FortiManager 5.2.4 but can´t get it working. Configured a ldap server with the group that they should be a member of, but when I apply it users of that group can´t login. [ul]Is there any equivalent to the Fortigate diag test auth ldap ?Is there any logs to check? (Eventlog only says "User 'xxxx' login failed from GUI(10.241.241.2), reason:Authentication failure. Please try again...")Anything that you can see that´s not configured properly in the configuration below?[/ul] Configuration belowconfig system admin ldap edit "ldaps_domain" set server "dc1" set secondary-server "dc2" set cnid "cn" set dn "DC=domain,DC=tld" set port 636 set type regular set username "CN=sausername,OU=Service Accounts,OU=Internal IT,OU=ROOT,DC=domain,DC=tld" set password ENC ******* set group "CN=sg_FortiManagerAdministrators,OU=Groups,OU=ROOT,DC=domain,DC=tld" set secure ldaps set ca-cert "CA_Cert_1" set adom "all_adoms" next end

could someone please advise if this is possible with a fortinet product. I currently have Nortel contivity VPN-netgear wifi to netgear wifi-Nortel vpn within a warehouse.I would like to replace all products with an all in one solution, so the VPN client on the device establishes a tunnel across the wifi and terminates on the wifi device at the other end. a bit odd maybe but we cannot rely  on WPA2 for security. I have looked into Linksys, netgear etc. but site to site vpn only doable over LAN or ADSL WAN. Many thanks in advance....