Solved

Hi,Im about to install a FortiWeb, to handle OWA, Reverse proxy etc.Where should I place the appliance...?[ul]Directly on Internet with an external IP?Behind Fortigate firewall with NAT?[/ul]If I place it behind the Fortigate, is it possible to use the Servers Certificate on the FortiWeb or do I need to do the HTTPS decyption on the Fortigate?If I place it behind the fortigate, the FortiWeb will have an internal (NAT:ed) address. Whats the best practice here? 

Hello, I've followed the cookbook instructions "Overriding a web filter profile" and the question that has come up is this.  Can I add this to an existing IPv4 Policy?  Meaning can I simply add the user group to the "source" fields instead of going on to step 4 etc. Link: http://cookbook.fortinet.com/overriding-web-filter-profile/ I have a FG800C with 5.4.0GA -Stephen

Greetings to you My problem in brief :We have EMS server with 600 endpoint licenses, My computer is connected to EMS and getting update for AVI want to use VPN from OUT Side to Company! I create user in fortigate user1,pass11$$$&^, I create policy to allow vpn to connect!I tested via browser is working  but from forticlient software it will connect to VPN ! but I can't ping any subnet which I added, Although I can ping my subnet via VPN Browser  My question is ----> in fortigate 200D device i don't have license for VPN, but I have license in EMS 600 EndPointand my Forticlient software it showing registered to EMS  but I'm not able to connect VPN! actually it will connect and I'm getting Alert --> Configuration update was received from FortiGate but I can't ping the subnet which I added ,Although I can ping my subnet via VPN Browser!  Thanks

Fortiauthenticator 400C in Active/Standby Configuration.v3.00-build0121-20141128-patch00 Is there a way to detect a Fortiauthenticator failover from the active unit to the standby unit using SNMP polling or traps? I have looked at the various Fortinet MIBs and although it looks possible with other Fortinet products, it does not seem to be straightforward with the Fortiauthenticator itself. I have also looked at the FAC specific MIBs but nothing stands out as being for that purpose. The 1.3.6.1.4.1.12356 OID is filled with interesting possibilities, but none of them seem to supported on the FAC 400C. I've also considered some secondary methods, such as monitoring the CPU, memory or interface usage on both boxes and comparing them to check for indications of a failover. Again, no particular variable stands out as being suited to that purpose. Is anyone aware of a way that I might be able to achieve the above? Darren.

Hello, The Fortigate NGFW we are using in our current location is a 60D. The 60D is being used as the main firewall, DHCP and DNS device. I have been tasked to separate 2 departments into different networks but keep the same DHCP scope for the new networks. My plan is to divide these departments into VLANs however I don’t know if/how you can setup the Fortigate to provide one DHCP scope to separate VLANs.Can I setup one VLAN to relay DCHP to the other VLAN?

Hello all, We have a Fortigate 100D. I am setting up some port forward & port address translation rules. In looking at the documentation in the KB and the cookbook, I see some differences to the recommendations: * KB article:  http://kb.fortinet.com/kb/documentLink.do?externalID=12945 * Cookbook article: http://cookbook.fortinet.com/using-virtual-ips-configure-port-forwarding-54/  They basically recommend the same process of 1) Create VIP 2) Create Firewall Policy to allow traffic to VIP.The cookbook says to create the policy and limit the services allowed to only the ports/services needed by the VIP, however the KB articles says when creating the policy that it is not necessary to specify a service to allow, and that it can be left to "ANY" since the VIP (with Port Address Translation turned on) only forwards packets using the specified port.  So my questions are this:  1) Is this ok to leave as the "Action=Accept" for "Servic

 Hi, I cannot install Forticlient on my PC. I have the message in french "une opération d'entrée/sortie avec chevauchement est en cours d'exécution" which corresponds to the English message "Overlapped I/O operation is in progress" :  After researches, it sounds be the KB2918614 update that in cause according to different messages on different forums. But after tried, the same message appears, and i can't install it on my PC. Please could you help for this issue ? My OS is Windows 7 Enterprise Service Pack 1. Thank you.

http://docs.fortinet.com/...2.10-release-notes.pdf

Hello everyone, Can someone explain to me why I can't add two default static routes with the destination 0.0.0.0/0.0.0.0 when there is a default route via a WAN Load Balancing "interface"? For example, here's my WAN LB configuration:  Here's how the routing table looks like (please disregard the missing gateway): This is how the new default route should look like:  And here's the error I get when I click OK on the previous screenshot:  This is the system info: Thank you,Slavko

Hello,Does FortiOS support PPTP server functionality. I know that it supports PPTP passthrough, but customer requirements demand PPTP server.ThanksAndreas

I have recently acquired the FortiMail-VM02 virtual appliance and have downloaded the most recent firmware version for said appliance:v5.3,build608,160712 (5.3.4 GA) This virtual appliance will be running in my VMware vSphere 5.5 environment. Does anybody happen to know, if I am able to install the latest version of VMware Tools onto this VM?  I cannot seem to find any documentation anywhere, that answers this question. Thanks.

Control traffic Greetings to you I have Firewall 5.0.11 , and 5.2.8 and I have 2 Internet links WAN1 --> 100mbps WAN2 --> 200Mbps I have Office 365 and Skype, and I want to control traffic when users being using Office or Skype I want if user being using Office 365 his traffic should go through WAN1 AND If he use Skype his traffic should go through WAN2 how I can do that ?

Hi all, I'm setting up the SSL VPN for my company and, I'm confused about how the VPN is licensed.  In my previous experience with Fortinet products, you had to have a license for the number of VPN clients you were going to have.  When we bought 4 new 300D's my sales person told me that the licensing is handled by the EMS server now.  I have installed the EMS server and it's licensed for 150 clients.  Where I get confused is how does the Fortigate know about the EMS server, or does it need to?  Honestly, I'm not at the point where I need full enterprise management outside of what the Fortigate can do itself, and all I want is to ensure that I can have more than the 10 users connect.   Do I point the forticlients at the EMS server for telemetry, or the fortigate itself?  If the Fortigate is doing he telemetry, how does it integrate with the EMS?  The only thing I found in the cookbook was for implementing an EMS to manage internal device

I have 4 computers using Forticlient VPN, 3 of them are working without troubles (2 acer, 1 lenovo), but I have an HP Pavilion, and everytime I connect to VPN, I lost the connection after 5 or 10 minutes. I have to write the credentials again to come back. Any idea of what could be happened? This is very annoyed, I cant work :(

Hello,We have purchased a Fortinet unit with the following specifications:Fortinet - FortiGate 94D PoEQuickStart Guide of this unit shows a diagram of the device. According to the diagram, the device has the following ports:USB MGMT (USB Mini-B)DMZ 1 & 2 (SFP)WAN 1 & 2 (RJ-45)LAN Ports 1-24LAN PoE Ports 25-48 Currently, we have DSL Internet Connection 1 from Internet Service Provider 1 and DSL Internet Connection 2 from Internet Service Provider 2. We have connected connection 1 to WAN 1 and connection 2 to WAN 2. Our requirement is to add DSL Internet Connection 3 from Internet Service Provider 3 to the Fortinet/FortiGate unit. However, the unit only provides two WAN connections, WAN 1 and WAN 2. Is it possible that we could add the DSL Internet Connection 3 from Internet Service Provider 3 to the FortiGate unit? Regards,Shehzad 

is it possible in v5.2.3? because i still need it to be filtered by ip4 policy.i'm able to do it using routing policy, but by using routing policy, it will disregard the rule i create in policy and object.

Hi:I'm considering buying some 60E's to replace some older 81CM's at branch locations.I have been buying 90D's and running 5.2 firmware. The 60E spec sheet shows great improvement over the other models, but I'm skeptical that its "ready for prime time."I've read in the forums the 50E models had a lot of issues, and E models only come with 5.4, which I have avoided using in production also.Anyone have experiences (positive or negative) with the 60E yet?Thanks,Scott

Firmware Version v5.2.10,build742 I Need Set Up Lacp Aggregation  No setup methods found  how to do

Hi all,I'm new to fortigate, this is my first time setting up port forwarding on fortigate routers 60D.I have created 2 VIPs to forward ports 85 and 37777 to a specific internal IP address, then created 2 group VIPs, create the services and then added the firewall rules. However, when I try to verify or the ports, I get ports are closed. Configuration attached

Hi, I set up a VPN hub/spoke structure with a Dialup server and some Remote branches (all appliances are Fortigate 60B). Surprisingly, I observed an Automatic Static Route that appeared on the Dialup server pointing to Remote network, with an Administrative Distance =1. I did not see this feature in the documentation. On the remote site I could not see any automatic route (I put a manual one). My question is: how to change this AD to a suitable value? The VPN function is to serve as backup and I need to set an AD greater than normal route. Regards,

Hi everybody,I'm looking for the wiring diagram in order to run the HQIP firmware on a Fortigate 100D.In the diagnose wiki:http://wiki.diagnose.fortinet.com/index.php/Running_an_HQIP_%28Hardware_Quick_Inspection_Package%29_test#FortiGate_.2F_FortiWiFithere is only a wiring example for a 60C but 100D has much more ethernet ports.Can somedody help me?Thank YouMatteo

Hello, Is it possible to convert Fortigate mode from active-passive to active-active in a productive network. thanks

Hi Folks, I have 2 WAN connections which I currently use routing policies to send traffic out, I would like to know if it is possible to cascade/overflow traffic from WAN1 to WAN2 when a certain bandwidth is exceeded, for example: WAN1 hits 10Mbs usage and I would like the "excess" traffic to then use WAN2 until the load is reduced on WAN1 at which point WAN1 should be used again. I have come across a number of FG docs which allude to the fact this may be possible but if anyone could point me in the right direction I would be grateful. ThanksEddie

Hello, I have to deploy an explicit proxy architecture for a customer and we want to use authentication on it. Main mode will be FSSO, no issue with that. But if Fortigate doesn't identify a user by FSSO standard mode, we want to try by using NTLM. Is it possible ? I was thinking of this kind of configuration : set active-auth-method ntlm set sso-auth-method fssoBut is the active method used only when the connection with the agent is broken or also as a fallback when the agent just doesn't find anything in the AD ?  Thanks in advance. Best regards, François 

Hi, We currently have a Single Sign-On Agent installed on 1 DC, which is configured to monitor all DC's. All works fine until a users switches from wired Ethernet to Wifi, they are no longer able to browse the internet. To solve this, they would need to lock the laptop and log-in again to windows.  In the "Show Logon Users" the user will be listed with "wired" IP address and not Wifi IP.  I have tried reducing the "Workstation verify interval" to 1 minutes and the "IP address change verify interval" to 10 seconds but this did not solve the problem.   Firmware: v5.2.7,build718 on 300D