Solved

HeyI want to control the access to the WI-FI network by MAC-ADDRESS but i cant seem to find the place how to configure; i'm managing FORTIAP by the the fortigate.Is it possible to control devices by MAC-ADRESS on the WI-FI network?

HeyIs it possible configure DHCP Snooping by the GUI? i'm managing the FORTISWITCH using the FORTIGATE but i cant seem to find the place to configure DHCP Snooping..

I am playing around with a GNS3 setup with two Fortigates in a cluster.  Is there a CLI command that would similar to diag sys topshow me similar output  likeget syst ha status...but in a "live" view?  On linux, I would dowatch "get syst ha status"... Is there something that would show me the cluster status in a live view? The HA Status widget in the GUI does not help much because I loose the session as soon as the Fortigate Cluster switches... Dan

Ubuntu Linux computer has two network interfaces:wlx1cbfce8bd2bd:  inet 10.1.1.129 netmask 255.255.255.0on this network, there is a device:  10.1.1.10 - with a UDP port 10000 that I wish to make accessible from the internet. the second interface is....(this is connected to Fortigate)enp4s0: inet 192.168.1.80 netmask 255.255.255.0 Fortigate LAN IP is:  192.168.1.1  I wish to enable somebody to connect to the UDP port 10000 of the 10.1.1.10 device from the internet. I do know how to set up NAT(Virtual IP) and IP4Policy to forward traffic to 192.168.1.80  - but I do not know how to do it to 10.1.1.10   I assume I need route(s) on Fortigate, as well as on my PC (192.168.1.80) and som eiptables?  to achieve that. 

Hello, I want to identify all BGP learned routes on a Fortigate and then apply a BGP Community attribute to them.I am using an inbound route-map on the BGP peer for this purpose, however it does seem to work. Is this the correct way to do this ? config router route-mapedit "HG_CORP_ROUTE_MAP_IN"config ruleedit 10set match-origin egp***matching all learned incoming BGP routesset set-community "7714:65100"***setting the community

Hi Folks, This question is super easy.  Sadly, I've used a few $ervice provider$ and I have to learn this stuff on my own. I have two devices - a Fortigate 60F and now a Fortiswitch 108E.   On the Fortigate, I've configured port 'b' to 10.30.10.0/255.255.255.0 for example.  On port 'b' of the Fortigate, I have a cheap managed switch that works.  My computers all have manually configured IPs and they are working.   The problem is that traffic is not being managed by my cheap switch, and the solution is a better switch. The problem: How do I change the IP/Netmask from port 'b' to the Fortiswitch on port 'a'?So far, I have the Fortiswitch registered in Forticloud, the Fortigate recognizes the switch and I have configured a 'FortiLink Interface' with an IP/Netmask of 10.31.10.1.255.255.255.0 on port 'a'. The problem is that i don't know how to make the switch 10.30.10.0.  I understandably get the error Conflicts with '10.30.1

Does fortigate or fortianalyzer has option to search traffic logs for IP that contains a certain value.For eg am trying to find destined to all IPs starting with 10.20.30.x

Does anyone know if one FortiToken Mobile app with two or more FortiGates for SSL VPN is possible? I mean WITHOUT FortiAuthenticator.We have mulitiple SSL VPN entry points in our nation-wide network. But now we want to use FortiToken Mobile. The gotcha is we don't have FortiAuthenticator for remote authentication. So we need to buy multiple tokens for all FortiGates. But I'm not sure if this even works with one smartphone per user. Toshi

Hi,I'm trying to figure out how to send an alert when an ip address is quarantined by the dos policy...Does anyone know how to do this through automation stitches? Thanks

hi all i know there is a number of configured dhcp servers per VDOM.Does anyone know if this limitation is applied for DHCP relay agents as well? thanks  

Hi,I don't understand what is and the meaning of the "status" button when I create the Intrusione Prevention policy.Anyone can help me? Thanks

Issue: We enter in our username and password for SSL, we receive the Duo push, duo push stays for a few seconds, then passes/approves the connection without user intervention. This doesn't allow the user to allow or deny the connection thus rendering Duo useless. Fortinet Users,We currently are using LDAP to sync our FortiGate 400E. We then create a local firewall group on our 400E and tie the remote server (LDAP) to this group. Typically this is a group we have in AD already to match.From here we tie this same group into the Authentication portal for SSL VPN connection.Next, we set up the firewall policies to also use this group. This process works without issues but now that we are trying to layer Cisco Duo on it we are having problems. What we did was add a radius to the firewall and then add an additional user to the remote group. We also had to make a NPS policy on our domain controller.We then make sure the NPS policy is in place. Conditions include the windows gro

I have a FortiVoice 20E4 and I want to do the following: When an external caller is calling to my number, an IVR will play that mentions some numbers, and, for example, when the caller presses the number 6, then a PIN (6-digit) will be requested. If the caller types the correct 6-digit PIN then it will connect to the corresponding internal extension.For example, the external caller presses 6, then 123456 (the PIN), and that connects them to the internal extension 111. If the external caller inserts the PIN 654321, then that connects them to the internal extension 222, etc.So practically when an external caller is calling, there will be a matching of PINs to internal extensions.How can this be done in FortiVoice? I was thinking as a band-aid solution to put 6 fake IVRs and connect from the 1st number to the 2nd, etc., essentially making the PIN with 5 connections. Is there a better way to do this?Thank you.

Hi all, I'm trying to advertise some prefixes to my ISP using BGP but don't see any messages originating from the Fortigate to the ISP. The ranges are in my routing table either as a static route or connected range. I've been following a few examples from the documentation but always end up with:  fg01 (root) # get router info bgp neighbors 162.57.210.17 advertised-routes % No prefix for neighbor 162.57.210.17  Current configuration is as follows:  config router prefix-list edit "all_prefixes" config rule edit 1 set prefix 78.121.89.0 255.255.255.0 unset ge unset le next edit 2 set prefix 78.121.88.128 255.255.255.192 unset ge unset le next end next end config router route-map edit "Filter_route" config rule edit 1 set match-ip-address "all_prefi

Is it possible in the CLI to append an address to an existing group without overwriting all the current addresses in the group? A have about 100 Fortigates for which I need to edit an address group, but just to add a new address.  The group has been manually edited at various locations to meet business needs, so I can't predict what addresses are already in the group. For those that are curious, we use FortiGate Cloud to manage all our devices and we can run scripts to push out edits to them all.

Was wondering if anyone had specs for this model.  Cant find anything on it.We have come into possession of this unit but trying to find a use for it as it probably is too much tech for us. Any help is appreciated.

Hello Fellas, I have my own lab wherein FG, FToken and FAC takes placed. In my own experience, fortitoken and fac are commonly used for the ff areas; ssl/ipsec vpn, wireless internet acces, and FG administration. Is anyone here able to explore other functions aside I mentioned above? Or can I use my Ftoken and FAC for RDP access, Applications access and etc? appreciate if anyone could share their experience with those products.

Hello, I'm having some difficulties understanding the route lookup process when SD-WAN is enabled.  According to Fortinet, SD-WAN rules (which are policy routes) are checked prior to FIB lookup. But, knowing there is always an implicit SD-WAN rule which catches all, will FIB lookup ever be performed for outbound traffic? While researching, i came upon this article which confused me even more :)https://docs.fortinet.com/document/fortigate/6.2.3/technical-tip-multiple-default-routes-where-sdwan-rules-are-not-preferred/20/fd47747 Thanks, Radu

Good day. I'm struggling with next problem We are using SSL VPN connection with two auth services LDAP and RADIUS (2FA thought FortiAuthenticator).And we were surprised that FortiGate sends auth queries (according to authentication rules in SSL VPN configuration) simultaneously. It's f***** ridiculous.My bosses cardinally against of using realms. They demand to use single URL.Yes usually we don't have problems because use individual groups.But we have several groups which must use 2FA but, if FAC will lay down, they have to use LDAP.And without realms it's impossible to do auth rules configuration for these groups.Is it possible to delimit users (without and with 2FA) with using single URL and without realms? For example:config authentication-ruleedit 1set groups "User_Group_1_2FA"set portal "User_Group_1"set auth radiusnextedit 2set groups "User_Group_2"set portal "User_Group_2"set auth ldapnextedit 3set groups "User_Group_1"set portal "User_Group_1"set auth l

Hi, I'm superadmin on my 60F (v7.0.3) and I want to configure the license-expiring-warning via CLI. I did this on two other 60F before but on the third one, I can not set this configuration and I can not see it via the CLI as well. Do you have a hint for me? Thanks! 

Hi,I'm using a Fortigate 1500D with VDOMs in 6.0.14.Here is my network topology :Initialy, there is only N2 and N3 communicating with a static route on my firewall by R1 and R2.My goal here is to add N1 which has to communicate with N3 using IPSEC connection over internet.To do so I first tried to use policy routing through IPSEC using this CB which didn't worked.Then I tried applying policy routing between N2 and N3 so that I could use static route for the IPSEC routing.It only worked half way.Here is my policy routing configuration :When I'm pinging from N2 to N3 it's OK but on the other half, it's impossible to ping from N3 to N2.Packets arrives to the firewall by R1 but the firewall isn't routing them. Here is a packet capture from the interface between the firewall and R1 :Nothing is comming on the packet capture on N2.What am I missing here ?

HI THERE ,i have really big problem , im doing  Outbound SSL decryption  with deep packet inspection on my fortigate , i have 10G connection , but when i use deep packet inspection my download speed limits to 200kbs or something near that, my upload is just work fine , and when ever i put SSL Profile to no inspection it gets fixed . i dont have any overhead on my device. what the problem could be ? Thanks in advanced.

Dear community  I want to execute the following: -> execute backup config tftp backup-stitch.conf 100.100.100.100 But I need to change the source-ip of the firewall from were the backup script is triggered. Is there a way to change the source-ip in this script?  Thank you,Laura

Hello friends, I am having a problem with a "FortiGate 40F"-firewall. Is it possible to delete a SD-WAN-Zone without loosing the connection to the Web-GUI? I only have access to this firewall over the internet... no physical/local access to it. Will I loose access to the firewall over the internet when I try to remove the member ports of the SD-WAN-Zone and subsequently delete the SD-WAN-Zone? The connection to the Web-GUI of this firewall is establised through one of the SD-WAN-member-ports. Would be nice of you to help me whith this question.

How do the VIP address are source natted and the purpose to bind a VIP to an InterfaceHere to clarify the way a VIP address can be source natted on an external interface. A Vip address could need to exit WAN1 using the same its IP address or using a dedicated ip pool, but the way to do it is not so obvious.In some configuration the behavior of the VIP in SNAT, sometimes, could seems to work badly, for example the address could be source natted every time with its vip address also for internal traffic or not natted with its vip address but with the ip pools used by the policy. Following all the different cases and the results shown Initial configuration:WAN1 Interface ip           : 172.16.100.200/24DMZ  Interface Ip             : 192.168.3.1/24LAN  Interface Ip              : 192.168.2.1/24 VIP with