Solved

Hello, Could you please let me know. How can I give bandwidth Priority to certain IP addresses ?  Regardless of other users consume bandwidth this "VIP" users should get accurate and guranteed bandwidth of 20 MBPS.I am using Fortis OS 5.4 

Hi Guys, I'm facing a problem replacing my old Cisco 1921 to Fortigate 90D. I have a public IP range from ISP, i.e.: 76.252.105.128/26. I divided this range to multiple subnets. Between Fortigate and ISP router there is 76.252.105.128/28 subnet (ISP router 76.252.105.129 and fortigate WAN: 76.252.105.130). The rest of public IPs were divided into small 4 IP subnets and assigned to LAN interfaces, i.e. LAN_1 76.252.105.176/30. The problem is that I cannot access internet servers from LAN_1 and opposite way - I cannot access internet server in LAN_1 (76.252.105.178) from the internet. I have 2 IPv4 policies ISP -> LAN_1 (without NAT) and LAN_1 -> ISP (Without NAT) allowing all traffic. I also have a private LAN_2 (192.168.1.0) which is overloaded to 76.252.105.130 and it works great! I don't have ideas why public IP routing doesn't want to work. On old Cisco everything works great. Do you have any ideas? 

Hi Fortigate Gurus ;) I d'like to block some "bad" sources. For that, I've added some addresses and georegions to a group and created a policy and ordered as first from wan1 to lan. For example I d'like to block China name                : bad2lan srcintf             : "wan1" dstintf             : "internal" srcaddr             : "bads" dstaddr             : "all" rtp-nat             : disable learning-mode       : disable action              : deny status         &

I use a Fortigate  100D with OS  5.4 I'm trying to create a new Custom Category on the Web Rating Overrides, only two default categories appear (Custom 1 and Custom 2) and there is no way to create another. According to the documentation (Security Profiles for FortiOS 5.4 Page 77), there should be a button labeled as Create New, but as you can see, there isn't any on my interface :(   Is there any other way to create and configure a Custom Category for Web Rating Overrides? 

Hello,I want to delete FortiClient traffic logs stored on FortianAlyzer that are visible in Log View->Security->Fortclient_>Traffic. eventually all FortiClient logs.Fortianalyzer v5.4.2-build1151 161213 (GA)Fortclient v5.4  

HiWe have fortiweb 1000D and upgrade firmware to 5.6.1we want to archive local log(Store in fortiweb internal hard disk) in remote Sitein this version fortiweb add ftp/tftp Policy in Log & report menu but when create ftp we do not assign it for any kind of logand we can use ftp policy only for archive config logI want to find best solution for archive all log in remote host?we do not have fortianalyzerthanks

Hello,I am preparing a PoC for test all features of FortiWeb. This lab there isn't outside to Internet so I need to find out any web application to run on Server located behind of fortiweb.Anybody knows any web application for install in any windows domain server? Thanks in advance!

Hello, I have a fortigate 100D. Can you tell me the difference between forward traffic and local traffic in Log & Report section?      

Hi,Im about to install a FortiWeb, to handle OWA, Reverse proxy etc.Where should I place the appliance...?[ul]Directly on Internet with an external IP?Behind Fortigate firewall with NAT?[/ul]If I place it behind the Fortigate, is it possible to use the Servers Certificate on the FortiWeb or do I need to do the HTTPS decyption on the Fortigate?If I place it behind the fortigate, the FortiWeb will have an internal (NAT:ed) address. Whats the best practice here? 

Hello, I've followed the cookbook instructions "Overriding a web filter profile" and the question that has come up is this.  Can I add this to an existing IPv4 Policy?  Meaning can I simply add the user group to the "source" fields instead of going on to step 4 etc. Link: http://cookbook.fortinet.com/overriding-web-filter-profile/ I have a FG800C with 5.4.0GA -Stephen

Greetings to you My problem in brief :We have EMS server with 600 endpoint licenses, My computer is connected to EMS and getting update for AVI want to use VPN from OUT Side to Company! I create user in fortigate user1,pass11$$$&^, I create policy to allow vpn to connect!I tested via browser is working  but from forticlient software it will connect to VPN ! but I can't ping any subnet which I added, Although I can ping my subnet via VPN Browser  My question is ----> in fortigate 200D device i don't have license for VPN, but I have license in EMS 600 EndPointand my Forticlient software it showing registered to EMS  but I'm not able to connect VPN! actually it will connect and I'm getting Alert --> Configuration update was received from FortiGate but I can't ping the subnet which I added ,Although I can ping my subnet via VPN Browser!  Thanks

Fortiauthenticator 400C in Active/Standby Configuration.v3.00-build0121-20141128-patch00 Is there a way to detect a Fortiauthenticator failover from the active unit to the standby unit using SNMP polling or traps? I have looked at the various Fortinet MIBs and although it looks possible with other Fortinet products, it does not seem to be straightforward with the Fortiauthenticator itself. I have also looked at the FAC specific MIBs but nothing stands out as being for that purpose. The 1.3.6.1.4.1.12356 OID is filled with interesting possibilities, but none of them seem to supported on the FAC 400C. I've also considered some secondary methods, such as monitoring the CPU, memory or interface usage on both boxes and comparing them to check for indications of a failover. Again, no particular variable stands out as being suited to that purpose. Is anyone aware of a way that I might be able to achieve the above? Darren.

Hello, The Fortigate NGFW we are using in our current location is a 60D. The 60D is being used as the main firewall, DHCP and DNS device. I have been tasked to separate 2 departments into different networks but keep the same DHCP scope for the new networks. My plan is to divide these departments into VLANs however I don’t know if/how you can setup the Fortigate to provide one DHCP scope to separate VLANs.Can I setup one VLAN to relay DCHP to the other VLAN?

Hello all, We have a Fortigate 100D. I am setting up some port forward & port address translation rules. In looking at the documentation in the KB and the cookbook, I see some differences to the recommendations: * KB article:  http://kb.fortinet.com/kb/documentLink.do?externalID=12945 * Cookbook article: http://cookbook.fortinet.com/using-virtual-ips-configure-port-forwarding-54/  They basically recommend the same process of 1) Create VIP 2) Create Firewall Policy to allow traffic to VIP.The cookbook says to create the policy and limit the services allowed to only the ports/services needed by the VIP, however the KB articles says when creating the policy that it is not necessary to specify a service to allow, and that it can be left to "ANY" since the VIP (with Port Address Translation turned on) only forwards packets using the specified port.  So my questions are this:  1) Is this ok to leave as the "Action=Accept" for "Servic

 Hi, I cannot install Forticlient on my PC. I have the message in french "une opération d'entrée/sortie avec chevauchement est en cours d'exécution" which corresponds to the English message "Overlapped I/O operation is in progress" :  After researches, it sounds be the KB2918614 update that in cause according to different messages on different forums. But after tried, the same message appears, and i can't install it on my PC. Please could you help for this issue ? My OS is Windows 7 Enterprise Service Pack 1. Thank you.

http://docs.fortinet.com/...2.10-release-notes.pdf

Hello everyone, Can someone explain to me why I can't add two default static routes with the destination 0.0.0.0/0.0.0.0 when there is a default route via a WAN Load Balancing "interface"? For example, here's my WAN LB configuration:  Here's how the routing table looks like (please disregard the missing gateway): This is how the new default route should look like:  And here's the error I get when I click OK on the previous screenshot:  This is the system info: Thank you,Slavko

Hello,Does FortiOS support PPTP server functionality. I know that it supports PPTP passthrough, but customer requirements demand PPTP server.ThanksAndreas

I have recently acquired the FortiMail-VM02 virtual appliance and have downloaded the most recent firmware version for said appliance:v5.3,build608,160712 (5.3.4 GA) This virtual appliance will be running in my VMware vSphere 5.5 environment. Does anybody happen to know, if I am able to install the latest version of VMware Tools onto this VM?  I cannot seem to find any documentation anywhere, that answers this question. Thanks.

Control traffic Greetings to you I have Firewall 5.0.11 , and 5.2.8 and I have 2 Internet links WAN1 --> 100mbps WAN2 --> 200Mbps I have Office 365 and Skype, and I want to control traffic when users being using Office or Skype I want if user being using Office 365 his traffic should go through WAN1 AND If he use Skype his traffic should go through WAN2 how I can do that ?

Hi all, I'm setting up the SSL VPN for my company and, I'm confused about how the VPN is licensed.  In my previous experience with Fortinet products, you had to have a license for the number of VPN clients you were going to have.  When we bought 4 new 300D's my sales person told me that the licensing is handled by the EMS server now.  I have installed the EMS server and it's licensed for 150 clients.  Where I get confused is how does the Fortigate know about the EMS server, or does it need to?  Honestly, I'm not at the point where I need full enterprise management outside of what the Fortigate can do itself, and all I want is to ensure that I can have more than the 10 users connect.   Do I point the forticlients at the EMS server for telemetry, or the fortigate itself?  If the Fortigate is doing he telemetry, how does it integrate with the EMS?  The only thing I found in the cookbook was for implementing an EMS to manage internal device

I have 4 computers using Forticlient VPN, 3 of them are working without troubles (2 acer, 1 lenovo), but I have an HP Pavilion, and everytime I connect to VPN, I lost the connection after 5 or 10 minutes. I have to write the credentials again to come back. Any idea of what could be happened? This is very annoyed, I cant work :(

Hello,We have purchased a Fortinet unit with the following specifications:Fortinet - FortiGate 94D PoEQuickStart Guide of this unit shows a diagram of the device. According to the diagram, the device has the following ports:USB MGMT (USB Mini-B)DMZ 1 & 2 (SFP)WAN 1 & 2 (RJ-45)LAN Ports 1-24LAN PoE Ports 25-48 Currently, we have DSL Internet Connection 1 from Internet Service Provider 1 and DSL Internet Connection 2 from Internet Service Provider 2. We have connected connection 1 to WAN 1 and connection 2 to WAN 2. Our requirement is to add DSL Internet Connection 3 from Internet Service Provider 3 to the Fortinet/FortiGate unit. However, the unit only provides two WAN connections, WAN 1 and WAN 2. Is it possible that we could add the DSL Internet Connection 3 from Internet Service Provider 3 to the FortiGate unit? Regards,Shehzad 

is it possible in v5.2.3? because i still need it to be filtered by ip4 policy.i'm able to do it using routing policy, but by using routing policy, it will disregard the rule i create in policy and object.

Hi:I'm considering buying some 60E's to replace some older 81CM's at branch locations.I have been buying 90D's and running 5.2 firmware. The 60E spec sheet shows great improvement over the other models, but I'm skeptical that its "ready for prime time."I've read in the forums the 50E models had a lot of issues, and E models only come with 5.4, which I have avoided using in production also.Anyone have experiences (positive or negative) with the 60E yet?Thanks,Scott