Solved

This is a Fortigate 80F in mid-stages of configuration.In Network/Interfaces, I see:LAN(1) Internal Hardware Switch    Type Hardware Switch  Members Internal-1>Internal-6 Internal-1 has an IP/Netmask which I presume applies to 1-6.WAN(2) hasFGWAN1(wan1)  Physical Interface with an IP addresswan1                     Physical interface with 00.0.0./0.0.0.0 Now, I am planning to set up a 2nd WAN interface but not yet.In the meantime, I want to set up an EXTERNAL ZONE with wan1 and wan2 but only wan2 is available it seems.   <<<So that's really the issue.In the end, I should think there would be:wan1 with an IP addresswan2 with a separate IP addressand an EXTERNAL ZONE with both of them in the zone.  

Hello, I made a txt file for Threat Feed as belowI wrote '#" for commentPaloalto can ignore some characters like '#' and recognize comment.Howerver Fortinet can't ignore "#" and then recognize invalid.Can you let me know how to use comment? 

Hi guys , new here :).Hope im posting at the right place. I did some changes in my home network yesterday. Ive changed the Tplink WD9970 Router to bridge mode and setup my fortigate as PPPoe . Everything was fine , there was internet , Wifi etc. But since then my Smart tv started giving me errors when trying to open Netflix , LG AppStore etc. What is more strange is when i open the Internet explorer app i can browse it and everthing seems to be fine. At the tv Network setting everything seems to be fine also. Any help guys? ty.

Hi,I have 2 new FortiGate 100F in production. When one authorized user logs into the first FortiGate 100F i get an email notification and same when he logs out.I tried to configure same on the second unit but could not see where do do that.Any help will be much appreciated. ThanksTazio

Hi. Please help me.Fortigate 60E-POE. FortiOS 7.2.1Legacy client (802.11 g) can't connect to SSID with error: "deny assoc request, ht rate set mismatch" Debug log from AP:[32770.007364] [AUTH] cpu0 vap-00(wlan00): [dc:f5:05:89:af:53] recv auth frame with algorithm 0 seq 1[32770.007387] [469.990] cpu0 wmi_unified_cmd_send: dev=wifi0 cmd_id=0x9022(WMI_PEER_CREATE_CMDID) if_id=0 vap=wlan00 peer_macaddr=dc:f5:05:89:af:53[32770.007426] [CWD_VOICE] cpu0 vap-00(wlan00): ieee80211_admctl_init dc:f5:05:89:af:53[32770.007444] [ASSOC] cpu0 vap-00(wlan00): [dc:f5:05:89:af:53] ieee80211_alloc_node: vap=0xc7330000, nodecount=8, ni=0xc58b3000 ref=2, ni_bss_node=0xc58b3000 bss_ref=2[32770.007468] wsev: cmd=0x8C02 ev_len=28 skb_len=76 nlmsg(len=76,type=16,flags=0,seq=26647,pid=0) extra=Ьх‰ЇStЙ[32770.007486] wsev: cmd=0x8C02 ev_len=12 skb_len=60 nlmsg(len=60,type=16,flags=0,seq=26648,pid=0) extra=Ьх‰ЇStЙ[32770.007501] [AUTH] cpu0 vap-00(wlan00): [dc:f5:05:89:af:53] send auth frame seq 2 sta

Hi,This is my first post here.Just migrated from Meraki to FortiGate.In Meraki we had the option to see all users who are connected to the network, is there a way to see same here on FortiGate 100F ThanksTazio

Hi All, I have setup an IPsec VPN to Azure VWAN based on the FortiNet Cookbook article. Cookbook | FortiGate / FortiOS 6.2.11 | Fortinet Documentation Library It is working, and BGP is Advertising routes from the Internal LAN to Azure and vice versa. My problem is that, when connecting to the FortiGate using the SSL VPN, I cannot use services hosted in Azure. Azure does not have a route back to my VPN IP range. I assume this is because the VPN pool is not considered an Internal Network. I think the way to solve this is to create a new VLAN on the LAN side (which will be advertised via BGP) and use NAT from the VPN Pool to the LAN network. Is this the correct approach to solve this problem? If so, could someone point me in the correct direction as to how to do this? Regards,Rob.

Hi everyone !  I tried the last version of FortiClient (7.0.6) and it seems this version has an important bug ! I use on_os_start_connect. When my computer boots and I'm landing on login screen, I have a command window who appears for a while and execute update_task.exe :  If I rollback to version 7.0.5, all works fine. Someone knows what's that ? Is it a bug or an expected behavior ? Thanks   

I have multiple virtual machines each hosting a web service and I have only one static public IP address. My FortiGate is FG-60F. I have multiple domain names that point to one public IP address. Is it possible to route the http traffic to my virtual machines based on the domain name?

I have multiple internal subnets which are all internally routed so that each subnet can reach all the others.  There is a Fortigate 6.4.9 to be accessing public addresses as usual and is connected to one of the internal subnets: subnet 1.  It is the default gateway for all of the hosts on the multiple subnets.For example,host at subnet 2 has destination on some public address.The internal routing sends the packet sourced on subnet 2 to the Fortigate internal address on subnet 1. How are the other subnets best included in the Fortigate settings?For example: I might want to set up an Address Group called INNER.And, an Address range or Group for each of the subnets that would be included in INNER.Does that make sense?Where is the interface on the Fortigate to be entered in this case?  

It is possible to predict TCP/IP Initial Sequence Numbers for the remote host.The remote host has predictable TCP sequence numbers.An attacker may use this flaw to establish spoofed TCP connections to this host.How does fortigate mitigate this? FortiGate 

Hi I need to configure DHCP on 201F , I have more than 300 users, what is best way (range , subnet )and how to do that ? Thanks 

Hi, I noticed in the release notes new products :FortiFirewall : FFW-3980E, FFW-4200F, FFW-4400F, FFW-VM64, FFW-VM64-KVM What is the difference between FGT and FFW ? Regards Lucas

FortiGate 30D FortiOS v5.2.3, Build 670I. Some devices on the Lan were blocked by right-clicking on the specific device on the "DHCP Monitor" page. Then selecting "Block"Q. Now, Is there a way to view all the blocked devices and then unblock them?As a newbie, it doesn't seem to be that complicated request but I'm unable to find/view blocked devices.What is the best practice in blocking specific devices in the future?

Is it possible to get a device inventory of a specific subnet using FortiAnalyzer? Can it perhaps be done creating a custom report? -PM

Hi,which interface (LAN, WAN or DMZ) applies with SSL-VPN, to define in the security-fabric? Thanks. 

Hi, I am using one free syslog application , I want to forward this logs to the syslog server  how can I do that Thanks  

I have a created a Firewall Policy to block some URLs, and selected "certificate-Inspection" for SSL. When a client PC tries to access the blocked URLs, I want them to view our custom 'access denied' page but instead Edge/Chrome gives this error page instead. How do i fix this? A step by step instruction would be great.   

I'm running FortiClient to connect from home to my organization's VPN.  Everything works fine when my laptop is connected via wifi.  However, if I plug the ethernet cable (from the very same home network) into the laptop and connect FortiClient, I cannot connect to any of my organization's servers, even though the VPN connection succeeds and is reporting an active connection. Any ideas?

Could someone clarify what the licensing options are for a FortiAP-U Series that is managed by a FortiGate?Can I use it without any supplemental license like any other FortiAP (except a Forticare license for hardware support if I need it) or I MUST buy a supplemental license also if don't need the supplemental Universal Threat Protection it could offer? Thank you very much for your help.

Good morning,I'm having trouble connecting to the Fortinet Single sign on agent on Domain Controller. The firewall fails to connect correctly with the SSOA on the domain controller. On DC the firewall (windows) it's off, port 8000/8002 are ok.Collector Agent status on DC is RUNNING,but when I click on the "show log on user" the system respond: "Time out when getting logon user list" Password require from Fortigate it's ok.Ldap server on port 389 it's ok. When click on "Show Monitored DCs" ---> Time out when getting DC agent status. The log application error: ldaplib::ldap_connect failed to connect to DC:3268 with error code 0x51. can anyone help me ? Tnx       

Hello team!!! Just a basic questionWe have a third party certificate issued from a trusteed certificate authority, for our web server.Is it possible to use the same certificate for doing deep inspection in outgoing fortigate policies?  Is there any requirement for this certificate to work?What are the steps to import this certificate into a Fortigate in 7.2.1 ? Thanks in advance.Regards,Damián 

Hello everyone,I apologize because I am using the translator to request help. I clarify that I do not have knowledge in fortinet not am I an administrator of one of these devices, I am an administrator of a SIEM and I am currently receiving the UTM type logs through Syslog and I see that within this log the origin country and destination country fields do not arrive . I would like to know if there is any way for this field to be included to send the request to the administrator of said firewall I exactly need to know which IPs are from Russia since I need to get a report of the incoming and outgoing connections from this country to the firewall tnx

Hello I have created 2 new policies for GEOblocking but there is no sequence group created for that. I know it is not needed, but I do like to keep the book keeping sound. How can I create a new one? I only see the ability to rename or delete.I would like to create one titled "GEOblocking & deny" Thank you  

Hello, I can't seem to find any questions quite like mine, and I apologize if I have missed them. Fortigate 300D - 6.0.4 We are setting up a SSL VPN with Split Tunneling. I can route our internal networks and some public IP Addresses through the tunnel. That much is easy. What I am trying to find out is if I can switch this around? So I would specify 0.0.0.0/0 to go through the tunnel, but then specify IPs, or FQDNs out through the endpoints local ISP. Specifically Microsoft Office 365 traffic. The reason I am thinking this way is because we currently have no control of internet access at the endpoint, like WebFilter/AppControl using FortiClient. Something I hope to get soon, but having to wait. I don't like the idea of internet access outside of the corp net that I cannot control. And this is why we don't use Split-Tunneling. Feel free to change my mind here, I might be barking up the wrong tree. If I had EMS I wouldn't be doing this. Many thanks!