Solved

Hello, I've been running dual wan connections using ECMP Weighted Load Balance on my FWF80CM (v4 MR3 Patch 15) for a couple of years now. The solution has worked out pretty well but now I want to change this design to a more manual setup to improve control over how traffic flows through the device. My goals:WAN2 - Primary GatewayWAN1 - Failover Gateway Needs:I will still need to Policy route some specific traffic out WAN1I will still need to access VIPs setup on WAN1 externallyI will still need to access HTTPS admin on WAN1 externally To start off I assumed that I could just change ECMP back to Source IP (default) and then give WAN1 administrative distance higher than WAN2. Both WAN1 and WAN2 have static routes with the same distance currently. When I did this working remotely over HTTPS on WAN1 as soon as I applied the Admin Distance on WAN1 I lost my remote connection and found that I was also unable to access HTTPS admin on WAN2. In addition when I arrived at the

Hello, i have a big trouble with fortiwifi 80CM, its a new product to me, I did the installation myself, only have default configurations.. I have a 20mb internet speed, and before to install this forti my download speed was arround 20mb and 23 mb, and my upload speed was around 20mb to, so I introduce a fortiwifi 80CM, and I create 2 new SSID for internet access point, but when Im connected via wifi, my connections decreased, somethimes 10mb download speed and 2 or 2 upload speed, I dont know whats wrong, If fortiwifi doesnt work like a access point or what ? please HELP MEEE! regards!

If I buy extra VDOM licenses for a Fortigate 1000D and wish to buy a spare Fortigate 1000D to act as hardware failover do I have to buy seperate VDOM licenses for the hardware replacement or in the event of a failure would I be able to to transfer the VDOM license over? Thanks

I have an iOS Dialup VPN set up. I can connect to the VPN and ping/rdp to any host on the network if I use an IP but DNS doesn't work. I've configured the network's local DNS server in the settings but this didn't work. I can't ping by name, I also can't ping by FQDN. Any ideas?

Hello, Is there any CLI command(s) I can use to fully reset/purge one ADOM including the device, the package and the objects?Note I'm using FMAN v5.2.1. Thanks and regards.

HiI'd like to create second ospf process on FG 100d and 60C. Is this posible?How to do that?

Hi everyone,I've got a 600D that is used at a DC and a 300C that's used at the remote sites. The issue I'm running into is my vulnerability scanner is being stopped by the IPS, obviously, defeating the purpose. The scanner resides at the DC and scans the pcs on the LAN at the remote sites.  How would I go about creating an exclusion for my scanner? Thanks!

Traffic shaper in my FortiGate is not accurate and sometimes it doesn't work. I create several Per-IP traffic shapers profiles, then i apply in into policy. When i test internet speed in website speedtest.net. The speed is under what i limit. when i monitor it for one more day, all traffic shapers doesn't work and user can access the internet with full speed, while i haven't changed any configuration. Sometimes traffic shapers is under what is limit. sometimes all user can access the internet with full speed.Here is my configuration. config firewall shaper per-ip-shaper     edit "3-MB"         set max-bandwidth 3072     next config firewall policy     edit 16        set srcintf "port11"         set dstintf "port9" "port10"         set srcaddr "200.200.4.1-200.200.4.30_3MB"     &

Hi all,I was wondering if there is a kind a of all-in-one device with ADSL router and WiFi (dual radio) device in the FortiGate portfolio.It would be nice equip a small/home office with one device only to manage ADSL and WiFi connection. Thanks for all your answers M.

I created a new dataset to show the country for each logged in vpn-user. As the country is not stored in the vpn log I had to use the traffic log additionally. the problem is that I cannot use the $filter macro because I am getting an error: ERROR:  column reference "itime" is ambiguous LINE 1: ...om "FGTADOM3-elog-0" a, "FGTADOM3-tlog-0" b where itime >= 1... The dataset:select b.srccountry, count (distinct coalesce(nullifna(`xauthuser`), `a`.`user`) ) as f_user from $log-event a, $log-traffic b where $filter and a.subtype='vpn' and (a.tunneltype='ipsec' or left(a.tunneltype, 3)='ssl') and coalesce(nullifna(`xauthuser`), nullifna(`a`.`user`)) is not null and a.action = 'tunnel-up' and a.remip = b.srcip group by b.srccountry With a.$filter I am getting this error: ERROR:  column reference "itime" is ambiguous LINE 1: ...GTADOM3-tlog-0" b where a.itime >= 1435906800 and itime <= 1... Did anybody know how to solve this problem?

Hey Guy's, I am noticing consistent attempts to log into our device from our wan link (shown by the alert message console widget). I have not been able to figure out how to drill down and look at the IP that is trying to gain access. Any help would be greatly appreciated.  For now I have blocked all telnet and ssh attempts to the wan link and have the https access limited to static public IP's. Thanks in advance!

Hello all,i would like to use our fortigate unit in order to Block Tight VNC from entering or leaving our organization.how do i achieve it? Thanks,s.  

Does the 60D not support DOS-Policy GUI? Per the 5.2.3 release notes the following issue was fixed:260342 The DOS Policy ID may be missing in the GUI Thanks!  

Hi All I am new with fortigate 100D ver 5.0 firewall.I need your help how to allow specific users from LAN to access facebook?.step by step procedure would be really helpful. 

Can FG300D support site to site vpn with mikrotik router?I may need to enable site to site vpn with a 3rd party business network.they are using mikrotik brand of router with firewall features.what type of vpn method should i use? from their website, the following technologies are supported  Ipsec – tunnel and transport mode, certificate or PSK, AH and ESP security protocolsPoint to point tunneling (OpenVPN, PPTP, PPPoE, L2TP) Advanced PPP features (MLPPP, BCP) Simple tunnels (IPIP, EoIP) 6to4 tunnel support (IPv6 over IPv4 network) VLAN – IEEE802.1q Virtual LAN support, Q-in-Q support MPLS based VPNs 

Enable multiple IP addresses on VDOM-links VDOMs and VDOM-links are a great feature on the Fortigate Firewalls, however they have limited functionality compared to physical links. The one feature they miss that requires me to use loop-back Ethernet cables on the Fortigate is the inability to add multiple IP addresses. I also tried to workaround this by adding extra VDOM-links but they are not allowed to be in the same IP range. I hope you will add the very useful multiple IP feature to the VDOM-links in the near future.

Adding support for Firewall address and service objects for Virtual IP Fortigate Firewalls have great functionality to limit the firewall rule mess that many other firewalls have. You can create named services and service groups instead of filling in ports all the time, you can create names addresses, address-ranges and group these, and even add colors to the various objects to make the firewall rules transparent and easy to understand.Unfortunately Virtual IPs for Port Forwarding feel like they were forgotten. As here you will need to fill in IP addresses and Ports manually instead of being able to choose from the named and colored firewall objects.The worst part is that to forward a port you will need to add the address and port/service as a firewall object to create the Policy rule but you need to add them manually in the Virtual IP. So as a firewall admin you have to do everything twice. If You want to change a port of address you have to do it twice too.Another disadvantage i

i'm using fortigate 200D in my network and want to do some rules to our groupsI decide to make restricted Internet access to certain groups in particular Time.does it need to be synced with our Time Zone Area?   (specially in daylight saving) and other question ishow can i increase admin TTL?when i login to console after 15 min it will disconnect from web console and i must login againgis there anyway to increase this time? Regards

Hello, after reading this, and looking into the gui, it seems that fortigate only supports monitoring to a single IP. This is quite inconvenient because it can be affected for temporary provider issues, rate limitting, monitored ips that change (i.e a public dns server that stops accepting pings).Are there any plans to change this? Or is there any workaround so I can have a more stable verification?

For example, we have two links 4Mbits, ie the sum of 8Mbits, when we create a maximum bandwidth limit for a group of users 3Mbits this value applies to the sum of links, if the 8Mbits, or every link 4Mbits?

I had to restore a system, and after some time I was missing the certificate options in the menu (see the picture) In case you need to show that section, you just have to:Fortigate# config system global Fortigate (global)# set gui-certificate enable Fortigate (global)# end For the whole information, this is the post where I found this http://www.bauer-power.ne...from.html#.VZUM3N89tQI

hi everyone i'm trying to create dual wan to work with two of them together in format that lan1 always use wan 1 and lan 2 alleys use wan 2 for different department and different secure internet so i connect the wan's to the internet and created two ipv4 policies: lan 1 > wan 1 lan 2 > wan 2 and disabled the wan balancing feature but there still a problem with connection it's seem like the computers chose the wan to use randomly and when they try to use the different wan like lan 1 to wan 2 they cannot use internet because of the policy so what can i do to resolve the problem thanks for help

Hi,Legacy device controlling a simple /24 network using 1 wan connection.Its https certificate ran from 2002-2014 and has expired of course.Its internal java is woefully out of date. (can't load console in browser, but putty is fine) Version: Fortigate-100A 3.00,build0319,060724 Virus-DB: 6.585(2006-07-17 14:44) IPS-DB: 2.305(2006-07-21 11:19) I also cannot find documentation for the FortiGate 100A on docs.fortinet.I assume it is running FortiOs 3? Since business budget is small, and network is small, any recommendations on what to upgrade to?There is no other Forti appliance here (analyzer, manager, etc.) 

when converting FGT > FGT and mapping the interfaces, the SSL.root is not the destination interface list box. Also what do I match phase-1 VPN interfaces to? Do I even need to convert my config at all if I do a FG200B (5.2.3) to a FG200D (5.2.3)???

I just plug my 221c to 60D, but the status of the AP is always connecting:What's more, the warning led keep flickering like this.(Sorry, I can only attach one file.)The OS version of my 60D is:   v5.0,build0292 (GA Patch 9)The OS version of my 221C is: FP221C-v5.2-build475 How can I know what's going on? Is there any cli command or gui setting can I do?Thank you very much!