Solved

Hello! I created Site-To-Site IPsec VPN between 100d and 61e.But once in each day it goes down.I looked at Log&Report at VPN Events and saw that phase 2 IPSec is down.Does anybody know how to solve this problem? 

Hello, I am an IT student. I just bought a used FortiAP 221C to learn how to config biz level wifi.But after search on line, I found topic https://forum.fortinet.com/tm.aspx?m=129796 and in FAQAdding Standalone FortiAP to FortiCloud 1. Register for a FortiCloud account at https://www.forticloud.com. 2. Click the “Add Device” link and enter the unique FortiCloud key located on your FortiAP device. 3. Deploy the FortiAP to an existing AP network or create a new AP network. 4. Associate your FortiAP with an SSID. 5. Connect your FortiAP to an internet connection, and wait for it to self-conf I looked around my 2nd hand  FortiAP 221C. there is definitely no FortiCloud key label like  I also found https://cookbook.fortinet.com/forticloud-fortiap-management-without-key/, when I follow step by step. However, I cannot create an AP network.I click the right upper corner button Add PortiAP Network, but it keeps popping up a window Syste

Hi, Have some problem with servers, 2008R, 2012,R2 and 2016 with the FortiClient installed. When we try to rdp to the servers from workstation, the screen appers black, and taking long time to login. Sometimes we have to launch the virtuel servers through vcenter console when the RPD not working. When we uninstall the FortiClient problem is gone. Anyone else having this problem or other tips we can try?Kent

Hi,I'm trying to block youtube for testing, but I could not, but for example, facebook.com is blocked, I made this by application control as the image shows. The purpose of this is testing to limit the video/media bandwidth.Thanks, 

Hi, guys.I had to configure a point-to-point VPN with a FortiGate 50B. Done! But I want to uninstall the FortiClient (6.0.1.0099) from my Windows 10 Laptop. I don't have the "Shutdown FortiClient" option available. The guy who configured the client VPN deleted it and now I don't know what to do to uninstall it. When I tried to uninstall, I received the message "Forticlient cannot be modified or removed while it is registered to a remote management server".Right now I don't have any VPN configured. I have followed the http://kb.fortinet.com/kb/viewContent.do?externalId=FD32800&sliceId=1 instructions but I can't find any "Enabled administrator full control permisson" directory or file (step 4) and it didn't worked...Any advice will be appreciated.

Hi, We have created PKI users: robert, dhyata and rivaan with 2FA enabled.We have created Administrators: robert_pki, dhyata_pki and rivaan_pki of type "Use public key infrastructure (PKI) group".All PKI users are members of PKI group. When I login (robert_pki), the browser asks to select cert and the login dialogue box is presented with the "User Name" field filled in with "robert_pki". I enter my 2FA password and login. That's all good. However, when another user trys to login, using their cert in their browser, their login dialogue box when presented, already has "robert_pki" as "User name" filled in and greyed out and hence 2FA does not work for them. If I delete robert_pki and login with 2FA dhyata_pki, it works. I create robert_pki and proceed to login with myself and see "dhyata_pki" as "User name" filled in and greyed out and hence 2FA does not work. Tried from different workstations and hence different browsers. I'm stumped.Please help. Forti

hi guys, I need to size a FGT as an SSLVPN gateway. There will be around 300 concurrent users, albeit on a 400 Mbps line (as of now). No heavy UTM is planned, just some AV, anti-botnet stuff. Remote users will access intranet servers for HTTP, HTTPS, some SAP (ERP), no big file transfers. Web portal and tunneling as well. I thought of going for a 500D in a cluster of 2. Running v5.2.7. Any comments, experience with the 500D and opinions on this are very welcome, time is pressing!Thanks.

Hi,How to show if https service is running in Fortigate? Because today, we can't access the web GUI (https) of Fortigate 1000C (v4.0MR3) but still able CLI.The mgmt1 and mgmt2 have set allow access for https and http.Even using http, the web GUI still can't show up.Yesterday, the web GUI still able to access and no configuration changes. My suspect is there is something wrong with https/http service in fortigate.How can I check the service and restart the service? And what is the impact when I restart the https/http service? Thank youArie

Hi,  Our scenario is :- Already has a IPsec connection between two offices , HQ and Site Office. The Site Office is behind a NAT device.   HQ Fortigate ---------IP Sec-----NAT device-----Site Office Fortigate1We need one more IPSec connection between the same offices.  ie. HQ Fortigate---IPSec----NAT device---Site Office Fortigate2.  ie we use same NAT device for both Fortigate1 and Fortigate2. So is it possible to use same LAN IP which is used in SiteOffice Fortigate1 , for Site Office Fortigate2 also.  ie same LAN IPs in both. Is it possible. Thanks 

Hi, I have a fortianalyzer VM 5.2.5. I added 2 fortigate device to fortianalyzer but could not find to add VDOMs which belongs to these devices. Can anybody help?

Hi, i'm currently trying to get IPv6 configured. I have 2 WAN interfaces each has its own prefix. WAN1 i got working. Here i'm able to deploy addresses via SLAAC or use static IP's. My LAN interface got a internal statc fd24 address, all my servers have this static address and this is used in DNS. Then i enabled the secondary ip-address option and added a static ip from each prefix to the LAN interface. Now my LAN interface has 3 static IPv6 addresses configured: config ipv6   set ip6-address fd24:7ed4:3bd5:99::250/64   set ip6-allowaccess ping https ssh     config ip6-extra-addr      edit 2a02:xxxx:xxxx:5b00::250/64      next      edit 2a02:xxxx:xxxx:5500::250/64      next   end   set ip6-send-adv enable   config ip6-delegated-prefix-list     edit 1     set upstream-interface "wan1"     set autonomous-flag enable     set onlink-flag

Hello,In my Fortigate, I have an IPv4 policy in place to deny traffic to the internet for two PC's on my network. The problem is, this is also blocking the connection to my Symantec Cloud Protection. How do I get around this, without completely disabling that policy?

Hi! Should the Local Address be an internal address like 192.168.14.0 at our site and the remote address an internal address for the remote site lika 192.168.15.0 or should it be external addresses? Thank you.

Trying to update a fortigate 60D with 5.2.10 on there. It says up to date.. obv not.Downloaded recommended firmware files (and others to test) All report"Selected file is not compatible with this FortiGate model." I've tried the following versions  

This is a newly configured Firewall. we try to enable the web filter in that. LAN pc's connect to the internet before enable the web filter. But after enable the web filter it's not connect to the internet. all configuration done correctly step by step.1. Configure the LDAP server (Bind type - Reguler)2. Configure the single sign on (Enable polling)3. Configure the IPv4 policy but after these steps LAN users can't access the internet. 

Hello, Could not find any reference for this situation, I have a pair with Fortigates in HA, each one has  a VDOM that it is active, for example:Master has VDOM 1 active on its unitSlave has Vdom 2 active on its unit. Before upgrading the firmware I assume that I need to select a master for both VDOMs and then apply the update, since the uninterruptable-upgrade feature it will perform the update on the subordinate first. Am I in the correct path ?

Hi, sometimes after an edit of a policy package on a FMG, such as create a new object or new policy, almost all firewalls goes in status "modified", but nothing has been really modified. The edit is done only on one device, with its policy package, but for some reason all other devices believe an edit has been done for them.If we try to re-install the policy package, the diff shows no infos, in the end it says "no commands to be installed" and the yellow triangle "Modified" turns into a green check as before.This happened various times with different FMG versions, 5.4 and now 5.6.3. Managed Fortigates are in 5.4.5.Can someone please explain why an edit has this impact even if is non-existant for other devices?

Hi Fortinet Fellows I want to ask what the difference between the FortiGate device with and without on board storage?Can we customize the FortiGate Local report? Thanks

Hi All, I'm simply trying to see which Fortinet product I can use to 1) Aggregate / load balance 2-3 wan link.  At a minimum 2 fiber from 2 source.  I would like an LTE backup for a 3rd link.  This is for a highly unstable environment2) Having a firewall for protecting the network, connecting remotes sites with VPN links, all controlled by policies linked to AD groups. Can I use one fortigate product for that or I need 2? Thanks

How does one go about selecting a FortiGate model for use in a church. Through most of the week there are only 8 users on the network. For a few hours on Sunday there may be 100 users. The use case on Sunday is fairly basic using the common UTM feature to keep guest users safe on the web. Traffic shaping will be used for video streaming from one computer. Third party wireless access points will be used. In one installation an SD-WAN with a 100 Mb / 12 Mb connections will be in use. In another installation a single 25 Mb fiber connection will be used. Cost needs to be a careful consideration. Would a 60E be appropriate?

https://docs.fortinet.com...os-5.4.9-release-notes

Hello GuysI tried uninstall FCT 6.0.1 on macOS 10.13.6, but without success.At first, I tried go to Applications > FortiClientUninstaller. When I  tried it, I got message "FortiClient is running. Please shutdown FortiClient."But, how definitely shutdown FortiClient in standalone mode without EMS?I did't find any option, how to FCT shutdown. I know, that on 5.6 version this option was. Offcourse I tried stop processes what I found here http://help.fortinet.com/fclient/olh/6-0-1/Content/FortiClient-6.0-Admin/D00_FCT%20Processes/0400_FCT_osx_processes.htm?tocpath=Appendix%20D%20-%20FortiClient%20Processes%7C_____2  on Activity Monitor, but still without success. Could you please help me, how to remove FCT 6.0.1? I want to go back to 5.6 version.  

Hi Guys, I have a little problem with one of my IPv4 Policy's. I've added a new FQDN address like "Computer.mydomain.local". After a few seconds, I can see the resolved IP address in the "Addresses" view.I added my new FQDN address to a new policy and waited a few minutes. In the IPv4 Policy view, it shows me the error message: "This policy has the following issues: -It is using unresolved FQDN(s)." But the addresses view still shows the resolved IP address. Do you have any ideas what I'm doing wrong? I couldn't find any similar topics about this. I'm on Firmware 5.4.4Thanks in advanceBest Regards

Hello everyone! Is there someway to attach a 'link-monitor' to a specific static route?? The feature "set update-static-route enable" just remove ALL the routes rellated to an interface. I was looking for something like Cisco track, that you can attach to any static route. Thanks in advance. 

Hello all, I hope I'm posting in the right area of the forum and that someone may be able to offer some advice! I've added an NTP server into the NTP Pool and the resulting NTP querries are being forward to my public static IP address, forward to the NTP server via my Fortigate 60E running 6.0.2 (It's on the end of an 80/20 VDSL line if that makes any difference). I've got DoS protection on the WAN interface and have added an IPS filter with all current NTP signatures. However, I'm still seeing:- [ul]Moderate levels of DoS attacks (effectively blocking ocassional NTP Pool monitoring requests, reducing the NTP Pool score and hence amount of time the server is available in the pool).Many many triggers of the "NTP.Zero.Transmit.Timestamp" IPS signature.[/ul] I was hoping to refine the DoS protection setttings but I don't seem to be able to get this to work. I have a main "WAN" DoS interface profile which protects against general attacks. It seems to be workin