Solved

I just plugged in a brand new FortiAP. We already had one FortiAP in place. When I discovered the new FortiAP it appears that the Fortigate pushed the configuration settings from the original AP to this one. It has the same exact SSID's etc. This is an issue, because I wanted to have a different SSID for each one. Is there a way to differentiate this? If I edit the SSID settings under Wifi Switch & Controller, will it change the SSID settings for the original AP? I don't want to change any settings for the original one. Thanks in advance for the help.

I am using FGT 60D with 5.6.3.When  i login into forticloud and navigate to the option Management & config its prompt an error. Can any one help to resolve this issue.    Device platform FortiGate-60D ( b1547) [-28] is not supported.     

Hi all, We have 2 X 100D Hardware Appliances running firmware version 6.0.0 (build 0076 GA) in NAT (Flow-based) Mode (HA: Active-Passive). They are deployed as perimeter firewalls for our wireless network.During a daily check on the appliances this morning, I found that they were blocking access (using the Web Filter mechanism) to a couple of sites that I believe are used by client devices on our wireless network to update their Sophos Anti-Virus software.The web filter on the firewalls appears to be incorrectly categorising d1.sophosupd.com & d2.sophosupd.com as 'Malicious Websites'.I created a Static URL Filter on each of our Web Filter Profiles to exempt *sophosupd.com and this seems to have rectified the issue for the time being, but I'm wondering if anyone else has had a similar experience. Further analysis of logs indicate that this began at approximately 12.00pm (GMT) yesterday (25/04/2018).Any input would be much appreciated.Best regards, John P

hi everyone,I have config ipsec vpn between 2 fortigates 80E & 60E (2 fortigates behind ISP Router), VPN status is up but i cannot ping to LAN network and i cannot see traffic . I configed IPSEC VPN route-based .  What's kind of information to provide for you to help this problem ? Please help me, thanks admin & everyone. 

I have a 600C running 5.0.7. Skype is an allowed/monitored app in the Application Control policy. Ports 80 and 443 are allowed. SSL inspection is enabled on port 443 so we can inspect certificates, but deep scanning is not selected for websites. If port 443 is selected for inspection, however, the Skype app cannot login. If it is deselected, then Skype will run. I saw an earlier post with a similar complaint, but there was no resolution. Has anyone else had problems running Skype with certificate inspection? I need to find a way to run Skype while still scanning other SSL certificates, so any suggestions would be welcome. Thanks.

Dear All,   Actually, I'm working as IT company and owned many of Forit device, their traffic log is being totally stored in FAZ. FAZ is using 5.4.2.   I have a few question on how to generate a standard bandwidth usage report that y-axiz must be represented ISP bandwidth but not calcualated by dataset itself. Means, most of dataset is sumed the traffic on specific interface.   For example, if I have 100M ADSL bandwidth and monitor one of source interface on WAN port in FAZ,  maximum bandwidth in y-axiz should be appeared as 100M.  But, it is not true.   It is because I knew and proved a set of dataset existing but not compatible with me.   Anyone can help me. Please share.   Thank you so much.   Frankie

Hi! i have a fortiGate 100E with architecture like in this diagram: i have a VIP that make snat from WAN1 (1.1.1.1) to server 10.0.0.1 and its working well from WAN.guest network configured to go out via WAN2 interface, and i need to allow to guest users to access the server with the VIP address (1.1.1.1),i tried to create a policy to allow connection from guest network to lan network via the VIP in destination and nothing,  i think there is any routing issue but i realy dont know what. please your help,Thanks!   

I try to publish a complex web application for demo over our Fortigate 240D.I use virtualIP to forward all the incoming http and https requests to our interal nginx load balancer.I secured the virtual IP with the policy on the attached image. The most important part of the policy is that it is published only for the members of our sslvpn_group.When user coming to the virtual IP https://mydemo.mycompany.com, it is redirected to [link]https://195.231.181.18/fgtauth?01002d0ea171e22a[/link] for authentication.The problem is that certificate doesn't match with the ip address, the browser shows NET::ERR_CERT_COMMON_NAME_INVALID.Is it possible to redirect to specific domain name instead of ip address ? Best Regards,János

Hi everyone. So I set up a policy based captive portal authentication (not configured at interface level).  I forced HTTPS login page, assign an authentication certificate (a valid GlobalSign wildcard certificate for *.unap.cl) and set authentication redir-url.  Like this rule.  edit 77        set uuid 1b9dfbee-18c8-51e8-b78f-0e0dacfd03c9        set srcintf "IntRed-NoSegura"        set dstintf "port17"        set srcaddr "Red_10.39.204.0"        set dstaddr "all"        set action accept        set schedule "always"        set service "ALL"        set groups "WiFI2"        

I just recently setup HA load-balancing between two FACs and wanted to share some notes regarding the ordeal. Both systems are VMs, running 4.3.2. The first system (master) has been in production for about a year now, and I finally got the chance to configure a HA slave for it. They are in remote data centers, with no L2 inter-connect so the load-balancing method was chosen since it allows for L3 connectivity. Primary use case is remote authentication using FortiToken Mobile, with both remote RADIUS and LDAP users. The FACs act as RADIUS servers for FortiGates. Licensing RequirementsFor both units you will need the following licensing:[ul]Base VM licenseSupport licenseAdditional user licenses, if required[/ul]You need a single license for these. Ie, these are registered to the master unit only:[ul]FortiToken licenses (mobile or hardware)[/ul] Communication Between HA Units[ul]Dedicated vNICs (port2) on each unit for HA communication[ul]No administration services enabledT

Hello, How can I see the previous version of my 200D firmware? I've updated with no upgrade path and I wanted to restore it. I did not save the backup on my computer. Thank you,

Hi, I am struggling to find documentation on how to add an internal certificate to the FortiGate HTTPS management page. Every google search returns how to avoid MIM/Webfiltering.  I would like to secure my FortiGate admin logon page with a certificate issued by a Windows PKI server so that the logon page doesn't error when we logon to it.  Any advice or articles to do this would be appreciated!  Tom 

Hi all ! My fortimail unit is configured in gateway mode. Internal mail servers route messages to the inernet through fortimail unit.  Option Domain - User - User Preference - Outgoing Recipient Safelisting is ON for all users. When I try  and send mail message from my mailbox through fortimail unit to the external mailbox, my personal safelist is empty and nothing is going on. What did I miss in my configuration?   As i see in the documentation " The icon indicates whether or not the FortiMail unit will automatically add recipient addresses in outgoing email sent by this email user to their per-user safe list, if it is allowed in the antispam profile." I do not see any options in Antispam profile. My appliance version is 5.4.4.

In the environment, it is one company with many AD domains.  There is a business need to make sure that users in one domain cannot access resources in another.  The current SSLVPN set up is as follows: Fortigate has an LDAP server defined for each domain.  The Fortigate has a firewall group linked to distinguished name of a group in the AD domain.  The group then has a dedicated VPN portal, dedicated IP range, and dedicated policies that define what resources it can access.  This is done for each domain. The customer has added some new requirements:1.  Two Factor Authentication (via Fortitoken)2.  Additional domains (this puts us above the 10 LDAP server limit in Fortigate) I'm doing a PoC of Fortiauthenticator and Fortitoken and have hit a wall.  I've completed the following:-FAC connects to LDAP server.-Imported user from LDAP as a remote user.-Created group and added the remote user.  We'll call the group "corp"-The test us

I have two fortigate 311B in cluster HA with this firmware. v4.0,build0646,121119 (MR3 Patch 11)  i created an interface type Aggregate with name PC01 and add the interface ' port1' and ' port2' then i needed to delete this interface because a I needed to add the interface 'port1' and 'port2' to other port aggregate, i deleted the interface PC01 but when I tryed to add the port1 and port 2 to other port aggregate the system sended me the follow message.  FG311B3912****** (PC01) # set member port1 entry not found in datasourcevalue parse error before 'port1' Command fail. Return code -3and when a try to put the interface port01 in other vdom the system send me the folowing message. FG311B3912****** (port1) # set vdom TEST Virtual domain must be same as virtual domain (root) of parent interface PC01 node_check_object fail! for vdom TESTvalue parse error before 'TEST' Command fail. Return code -651  Now i can used the interface port1 and port2 . {Admin: SN's remov

Hello, I have registered on the Fortinet training portal and have completed NSE 1 courses and certification but I cannot open any other NSE courses. I understand NSE 2 & 3 are for partners but when I open any NSE 4 course it gives me error message - "You do not have permission to self-enroll." Does anyone know why this is happening? Thanks in advance. Regards,Khushal

Currently we have 4x 60E.1 in our HQ office and then 3 for our remote/Satellite offices.VPN for remote staff then talk to HQ.We have 3 servers which are currently based in HQ at the moment, we are looking at moving them to cloudbased with firewalls so only connections from each office can access. This is incase HQ has network/power issues, the other offices can still operate.The only issue I would like to address is can the users/groups be synced across more than one devices easily.Then the VPN connection client if it can not connect to the first HQ, then connect to a secondary one ie so if vpn1.domain.com is down it tries to connect to vpn2.domain.com

Hi, just confirming I can add new interfaces to an existing aggregate without having to redo firewall policy?ie port1 and port2 are an aggregate with multiple sub interfaces, policy rules are built using these sub interfaces. I want to add port3 and port4 to this aggregate. Will the firewall require a policy rebuild? Thanks

Hi everyone. I'm presenting some issues in an OSPF over IPSec configuration. I have two FTGs connected by a VPN Tunnel working by OSPF routing protocol. They are working properly configured as in this guide: https://docs.fortinet.com/uploaded/files/1693/using-redundant-OSPF-routing-over-IPsec-VPN.pdf As you can see, in this document they configure Phase two of the VPN tunnel with 0.0.0.0 local and remote Addresses. The thing is we need to set this address as the company have (previously we had the tunnels configured with a static route and the local and remote subnets established in Phase Two) but when we set up this there is no OSPF traffic so no OSPF routes are visualized in routing table. Thanks everyone. 

Good day.How to  change firewall  edit number in the IP/MAC binding table ?I have list of MAC addresses Edit 1set mac ......set name...set status enablenextedit 3....etc.How to change numerals from 1to end of list without jumping from like example 1 to 3?

Hello Guys, i need to import >1000 IP-Adresses from a Excel Table to FortiGate, so i somehow need to make a script that will convert the IPs to the CLI Add Firewall Adress objects. Do someone has a excel scriipt for that?  How do you deal with it , if you have to add a large amount of firewall objects? Thank you

Hi All Just want to check if anyone had a FWF60D firewall without console port? is this common? Would Fortinet replace it if it's out of support but have Fortinet stickers on which means it wasn't opened/modified.Looked at it quite few times  to make sure I am not going crazy, but there is no console port at the front or back. ThanksAugustas

Hi Guys, Is it possible to configure the FortiWLC-50D with a guest SSID and have it redirect a captive portal configured on the Fortigate-800D? All our SSID's are configured on the FortiWLC-50D. We do not use the wireless capability on the Fortigate-800C firewall.  Is this possible? Thanks.

Greetings! We have setup captive portal on our network using local authentication. For some reason, some devices that are suppose to login first already show the Fortinet bar with a user logged in. Any ideas on why this happens? Thank you all in advance!

Hello, I'm facing the following strange problem with web filtering in 5.6.3. Please notice that the problem appeared after I registered my FG to an FMG for testing purposes, but now FG is deregistered, however the problem persists. So, it appears that web filtering is not blocking what it should block, and I see log messages saying "FortiGuard is enabled in the protection profile but the FortiGuard service is not enabled." and other messages saying:no rating service is foundURL TypehttpsMessagePolicy allows URLs when a rating error occurs Needless to say that Fortiguard is up and running, or at least it seems so in the system's dashboard. I did a check in System > Fortiguard > Filtering Services Availability and got a "Both web filter and antispam services are available". Does anybody know what's going on here? Thanks