Solved

We are trying to replace a Cisco router with a FortiGate running 5.4 but are unable to get subnet translation to work as before. Here's the scope:[ul]It's an internal router used to route traffic between three different interfaces:[ul]This branch office's VLAN 192.168.100.0/24 with FortiGate's IP 192.168.100.254.Server VLAN 172.24.0.0/24 (connected through an IPSEC tunnel on a different FortiGate and reached with static route 172.24.0.0 255.255.255.0 192.168.100.1).MPLS network to HQ 10.100.0.0/24 with FortiGate's IP 10.100.0.254. Static route 10.3.0.0 255.255.255.0 10.100.0.1.[/ul][/ul]The subnet translation comes into play when HQ doesn't want to use 192.168.100.0/24 and 172.24.0.0/24 in their end to avoid risk of overlapping subnets so they have assigned subnets for each:[ul]192.168.100.0/24 = 10.100.1.0/24172.24.0.0/24 = 10.100.2.0/24[/ul]In the Cisco router this was simply managed at our end with these two lines: ip nat inside source static network 192.168.100.0 10.100.1

 I'm considering changing the primary WAN interface on one of my 100-Ds from manual mode to PPPoE mode. I've not used this mode in a Fortigate device before. Does the firewall behave any differently when using an interface in PPPoE mode vs manual mode? In case it's relevant I use a lot of the features on these firewalls. That includes site to site VPNs, advanced routing, SSO, most of the UTM features, etc etc etc.  Thanks for any help.

Hi everyone,I had a problem that my Forticlient was getting stuck at 98% (common issue). I have followed this guide to fix it: http://kb.fortinet.com/kb/documentLink.do?externalID=FD36630 I have also uninstalled and installed VPN client again.Now I have a working VPN solution, but also a machine does not go to sleep.In device manager I see miniport WAN drivers with exclamation marks. They seem to be duplicates. I have like miniport WAN driver #7If I uninstall Forticlient, computer sleeps. Any help in the subject appreciated.

Hi there, Does anyone know If it is possible to create/edit datasets from the cli? I'm running a FortiAnalyzer with the version 5.2.7 I've found below outdated document for the version Version 4.0 MR2, which includes the cli procedure (config sql-report dataset) but that's not working for my version.http://docs.fortinet.com/uploaded/files/1177/fortianalyzer-fortigate-sql-technote-40-mr2.pdf  I've tried a few variants of the command with the cli help but no luck. Thanks,Mari

I have a FG 100D running v5.2.9I have 2 WAN connections connected.Is it possible to route traffic to a certain IP address over the 2nd WAN link, and use the 1st WAN for all other traffic?I have tried but can't get this to work, do I just use static routes or policy routes?Also the traffic over the 2nd WAN needs to be source NAT'd Any help would be great

I'm seeing a FAC 200D regularly attempting TCP 2196 (and get blocked) repeatedly to a set of IP's in the 17.188.*.* range.   Most resolve to gateway.push.apple.com. or others in the APPLE-WWNET range. Anybody know if the FAC should be using Apple Push Notifications?  This seems a little odd to me.

Just updated our FAC to 4.2.1(v4.00-build0155-20161228-patch00), and FTMv4 Push appears to be enabled.  Kind of annoying on FTM iOS.  SSLVPN login using FortiClient 5.4.2 still appears to need the token, but when logging in the push notifications now get in the way.  Does anyone know how to tell the FAC to NOT send the FTMv4 push notification?

Hi to all,I am quite new to the FGT world. My Company bought a FGT 100D three months ago, that came with v. 5.2.4 installed. The GUI has shown the message about the update to 5.2.7, but nothing about 5.4. What do I need to update to 5.4? Do I need any support contract?Thank you all.

Hello,I am new to Fortinet world. I would like to configure fortigate to use different wan interfaces depeding on source address. For example, servers placed in DMZ should use wan2 interface, users in lan/guests should use wan1. So, I configured (see picture at the bottom of this post):- WAN-LLB: I set wan-load-balance interface with wan1 and wan2 interfaces- Static Route: I set for destination 0.0.0.0/0.0.0.0 the device wan-load-balance- WAN-LLB Rules: for test purpose, I created two rules:[ol]source: LAN subnet, destination: www.dnsstuff.com, outgoing interface: wan1source: DMZ subnet, destination: www.dnsstuff.com, outgoing interface: wan2[/ol]In this case, all seems to work. Clients in lan that surf in www.dnsstuff.com see in the web page that the public ip address used is the one of wan1, clients in DMZ see public ip of wan2. Then I changed destionation address from "dnsstuff" to "all". In this case, all firewall rules don't work. I ran a traceroute from a client lan add

Hi, I am using a FortiWiFi 60D with the firmware version v5.2.5,build701 (GA). Is there any method to filter or sort by the Source IP (not Source NAT IP) in Forward Traffic Log & Local Traffic Log? Thanks!Hung

Hi Everyone, I'm here to seek your kind help in understanding what's going on between "VPN connections" and "Windows' CPU Timer Resolution", and especially when it's connecting via FortiClient (latest, 5.4.2.0860). I recently noticed that whenever I'm connected to VPN, my notebook battery seems to be draining much faster than when I'm not. Then after some googling I've come up with a possible cause related to "CPU Timer Resolution" of Windows (I'm on Win10 - 1607 - 14393.693)  ClockRes (a utility to display the current Timer Resolution)https://technet.microsoft...nternals/bb897568.aspx When VPN is connected via FortiClient in my case, CPU Timer Resolution would *persistently* go to ~5ms (fine), as oppose to the disconnected state at ~15ms (normal idle) (see attached screenshot). To my limited knowledge, unnecessarily fine/short timer resolution would drain battery, just like what Chrome did some versions ago: https://arstechnica.com/g...raining-bug-in

Hello,I'v got a fortigate 100D which is unable to assign a IP for management in the same vlan as the LAN.its a single 100D ( no HA ) which I want to manage from vlan 10, the same subnet as the current management IP on LAN side.the gui is slow, probably due to production traffic going over the same port.hence I want to mitigate the management port to where it is supposed to be.however altho I'v enabled subnet overlap, which solves the issue shown below  I still can't get it to work, when I press ok the 100D comes with item not found ; your assist or opinion is very welcome, thanks in advance!

I decided to roll the dice and upgrade a FortiAnalyzer 200D to the new 5.4.2 firmware.I followed the upgrade guide and rebooted before the upgrade, etc. Everything seemed fine till I noticed that all authentication against RADIUS on the FortiAuthenticator 200D 4.1.2 was failing.  I mostly use this to give me two-factor authentication with FortiTokens for admins on the FAZ. Checking further, everything seemed to be going through, but the FAC always reported "Invalid Password".  Note that my FortiGate is still working with the FAC without problem. I tried a number of things, all without success:[ul]Re-entering the RADIUS secret for the FAZ and the FACCompletely recreating the FAC's RADIUS client and the FAZ's Remote Auth (RADIUS) serverRemoving and recreating local users on the FAC, removing and recreating the RADIUS users on the FAZUpdating the FAC to the most recent firmware (4.2.0)Trying users without two-factor authenticationTrying different EAP methodsVerify

Hi, I want to configure a policy based VPN from a remote site to a central firewall. All traffic from the remote site should be tunnelled, no local internet access. To my knowledge the only reliable way to do this is with policy based VPN, and it worked perfectly in 5.2. So i've set up the vpn tunnel and created the policy with action: IPSEC and specified the tunnel. local net 10.x.y.0/24, remote net: 0.0.0.0/0 (i want to tunnel all traffic to central site, remember?), but this breaks the fortigate's own initiated traffic, so it can't reach the vpn remote peer because it's trying to reach it over the VPN, which isn't up because it can't reach the peer... catch 22. This did not happen in 5.2. Config below: hostname # config vpn ipsec phase1hostname (phase1) # show config vpn ipsec phase1 edit "vpn-something" set interface "wan1" set keylife 28800 set peertype any set proposal aes128-sha256 aes256-sha256 set remote-gw x.y.z.x set psksecret somepsk next end&nbs

   Hi, all, on the Fortigate 310b (5.2.3,build670 (GA)) with two vdoms, i make this:config vdomedit vdom1config user settingset auth-timeout 30set auth-timeout-type idle-timeoutendfgt310b (setting) # showconfig user setting    set auth-timeout 30endBut the time-out doesn't work with 30 minutes! (i thinks is the default: 5m) In global configuration doesn't have this configuration:fgt310b (global) # config user setting ?device-category Configure device categories.What i'm doing wrong? Thanks! 

Hi - I've seen Out of band posts but my question are: 1) For the out of band management of Fortigate 500D and 1000D firewalls is the recommendation to configure a separate PSTN line (is it even possible to configure a connection via a PSTN line?),or is the recommendation to configure a separate IP address on the 2nd RJ 45 management interface and to use this? The reason I ask is that these appliances will be managed as part of a Firewall Management Service and need a OOB option. 2) Are there any issues we need to consider with OOB management (PSTN or the 2nd management interface) in a HA configuration (active/active or active/passive)?Many thanks, Larry  

Make/Model: Fortinet 60DIssue: I'm having trouble port-forwarding to my Xbox. No matter what I do it seems as though it doesn't work because my NAT type stays moderate, my goal is to get it to open. I need help with port-forwarding and also using MAC addresses to assign a permanent static IP to my Xbox. Please. if anyone can help me. I've been attempting things for months and am at my wits end.Note: I am not technologically savvy when it comes to this sort of router, so if anyone has a solution please "dumb it down" for me, haha. Any help is much appreciated and I hope to get this fixed, thank you.~ Connor Edit: Willing to pay for services.

Hello, Could you please let me know. How can I give bandwidth Priority to certain IP addresses ?  Regardless of other users consume bandwidth this "VIP" users should get accurate and guranteed bandwidth of 20 MBPS.I am using Fortis OS 5.4 

Hi Guys, I'm facing a problem replacing my old Cisco 1921 to Fortigate 90D. I have a public IP range from ISP, i.e.: 76.252.105.128/26. I divided this range to multiple subnets. Between Fortigate and ISP router there is 76.252.105.128/28 subnet (ISP router 76.252.105.129 and fortigate WAN: 76.252.105.130). The rest of public IPs were divided into small 4 IP subnets and assigned to LAN interfaces, i.e. LAN_1 76.252.105.176/30. The problem is that I cannot access internet servers from LAN_1 and opposite way - I cannot access internet server in LAN_1 (76.252.105.178) from the internet. I have 2 IPv4 policies ISP -> LAN_1 (without NAT) and LAN_1 -> ISP (Without NAT) allowing all traffic. I also have a private LAN_2 (192.168.1.0) which is overloaded to 76.252.105.130 and it works great! I don't have ideas why public IP routing doesn't want to work. On old Cisco everything works great. Do you have any ideas? 

Hi Fortigate Gurus ;) I d'like to block some "bad" sources. For that, I've added some addresses and georegions to a group and created a policy and ordered as first from wan1 to lan. For example I d'like to block China name                : bad2lan srcintf             : "wan1" dstintf             : "internal" srcaddr             : "bads" dstaddr             : "all" rtp-nat             : disable learning-mode       : disable action              : deny status         &

I use a Fortigate  100D with OS  5.4 I'm trying to create a new Custom Category on the Web Rating Overrides, only two default categories appear (Custom 1 and Custom 2) and there is no way to create another. According to the documentation (Security Profiles for FortiOS 5.4 Page 77), there should be a button labeled as Create New, but as you can see, there isn't any on my interface :(   Is there any other way to create and configure a Custom Category for Web Rating Overrides? 

Hello,I want to delete FortiClient traffic logs stored on FortianAlyzer that are visible in Log View->Security->Fortclient_>Traffic. eventually all FortiClient logs.Fortianalyzer v5.4.2-build1151 161213 (GA)Fortclient v5.4  

HiWe have fortiweb 1000D and upgrade firmware to 5.6.1we want to archive local log(Store in fortiweb internal hard disk) in remote Sitein this version fortiweb add ftp/tftp Policy in Log & report menu but when create ftp we do not assign it for any kind of logand we can use ftp policy only for archive config logI want to find best solution for archive all log in remote host?we do not have fortianalyzerthanks

Hello,I am preparing a PoC for test all features of FortiWeb. This lab there isn't outside to Internet so I need to find out any web application to run on Server located behind of fortiweb.Anybody knows any web application for install in any windows domain server? Thanks in advance!

Hello, I have a fortigate 100D. Can you tell me the difference between forward traffic and local traffic in Log & Report section?