Solved

We are going to deploy the Fortigate 1500d stack and we need to find out if it can work in QinQ mode ("802.1ad" or "set vlanforward enable"), and if so, do all versions of FortiOS support it?

 Hello Everyone... I ask about the license required to deploy 2 Fortiweb VM in HA...  I already have bought one license for one VM,,, so is there a needs to buy another license for the VM that will be used in standby mode..? or not. Thanks  

Just posting this in case it helps someone else ... I upgraded our FAZ-VM from v5.6 to v6.0 and then v6.2.1 ... and found that logs were no longer being received ... they were queueing up on our Fortigate and the "test connectivity" on the FGT was failing. After some mild panic and troubleshooting, then opening a ticket with Fortinet, I discovered that you MUST have encryption enabled on the FGT in the Logging configuration.  As soon as this was done, the problem was resolved. I had read the Release Notes, however the Special Notices wording was as follows:  All OFTP connections must be encrypted for FortiAnalyzer 6.2.0 (or higher)   Prior to upgrading to FortiAnalyzer 6.2, make sure that all FortiGate devices are configured to use encryption when   communicating with FortiAnalyzer. Starting with FortiAnalyzer 6.2.0, all OFTP communications must be encrypted. It was not at all clear that OFTP meant Logging.  Not to me anyway. Hope

Good Morning, is there a way to restrict firewall access over the internet to dns hosts? RegardsKlaus

Scenario: Small office with users and no AD-Domain.Is it possible to have a local agent installed (forticlient? Anything else?) on each computer logged in with a username/password and have that information sent to the fortigate when accessing rules etc instead of manually having to log on/into the captive portal every day? The end goal is to enter the username/password once on each computer and identify the users automatically.Any input appreciated! 

I found a problem with VIP with port forwarding when several VIP  are mixed binded to different interface. I discover this problem using hairpin policy to reach service from internal machine with public ip address of the service. If the vip I want access are after another vip with bind to different interface, the next vip are not evaluated. Example. VIP1      x.y.z.w:80 -> a.b.c.d:80        ANY VIP2      x.y.z.w:81 -> a.b.c.d:81        ANY VIP3      x.y.z.w:82 -> a.b.c.d:82        ANY VIP4      x.y.z.w:83 -> a.b.c.d:83        ANY VIP5      x.y.z.w:84 -> a.b.c.d:84        WAN VIP6      x.y.z.w:85 -> a.b.c.d:85        ANY connection to x.

Hi All, I have a Fortiswitch 108f connected and authorized on a Fortigate 40f. Initially I could see all the ports no problem. After a bit of mucking around I performed a factory reset on the gate. Initially the switch ports stopped displaying occasionally but now they wont display at all. I can see them on the graphic but if I click on the port the screen to the right comes up ("Fortiswitch Ports" but its empty. If I click the "Fortiswitch Ports" from the Menu on the left - same thing - no ports are showing. Any ideas out there?

Hello,I have a problem with groups on fortiauthenticator for remote vpn users with fortitoken mobile. On Fortiauthenticator I set "Remote User Sync Rule" for sync with remote LDAP group. Users have automaticaly assigned Fortitoken mobile and add them to the user group.FAC is set as radius server in Fortigate. On Fortigate is set user group for authentication vpn users through FAC. If I don't specify group from FAC it works without problem.But if I want to use group from FAC, it don't work. User enter his name and password for access to vpn, FAC send to him fortitoken push notification, he approve it and it finished with error fortitoken timeout.On picture is what I mean.  I need set different policy for groups of vpn users.I don't know if it is fault in my setup or anything else.Can somebody help me, please?Thank youBleBla

Hi, How to connect branch office which is the firewall is behind router? Branch office WAN using local ip, while router using public ip

Hi I'm trying to get a transparent proxy working using kerberos authentication.  I believe all I'm missing is a captive portal to facilitate the kerberos authentication. When I enable the captive portal on the lan interface, I have to exempt all addresses used in other policies that traverse this interface, which seems crazy. Is this expected behavior, or am I doing something wrong? Does anyone have a good guide on setting up kerberos auth for a transparent proxy?

Hi.I switched from profile-based to policy-based and i cant find anywhere to add a explicit proxy on my firewall anymore? I have search for any features that are not available when enabling "policy-based" but i cant find any mentions of the explicit proxy feature dissapearing. Any input?

can someone explain to a dummy what this filter does /mean? set prefix 192.168.1.0 255.255.255.128set ge 32set le 32

Hi There Currently using FortiManager to manage an estate of 50 or so Gates running version 6.4.5 on all devices.  We are deploying Virtual FGTs in AWS and Azure, which will also be managed by FortiManager. We are intending to make use of SDN Fabric Connectors to allow dynamic learning of objects for policy creation in both the Public Cloud environments. Can someone confirm if we need to configure the SDN connectors on the FGTs in each cloud environment or whether we only need to configure the SDN connectors on the FortiManager (assume the latter as this is where we create the policies) Many thanks

Good afternoon!  I am a networking rookie currently working with a Fortigate 80F, and am trying to understand how NAT works. I have two computers connected to the router with static IP addresses of 192.168.1.1 (PC1) and 192.168.1.101 (PC2). I am looking to set something basic up in which I can ping a virtual IP address (let's say 192.168.50.1) on PC1, and this will translate to PC2's IP address and get a reply back from PC2. I set up a Virtual IP to do this on PC1, and still have all interfaces on the hardware switch. I didn't get any response from the ping. I also added an IPv4 policy to allow traffic from the internal switch through that pings the VIP, but this also didn't work. Am I missing something here? I'm confused as to why this isn't working. I would really appreciate any insights anyone can provide!

Hello everyone. Today in my company we have 4 fortigates and we all use local user. We’re looking to switch to AD authentication, but I need to restrict the Ips that can be accessed using users. Today as we use local user I did the restriction using Trusted hosts. How could I do the same, but for AD users?

Hi, quick query just looking to disable some policies in my test lab What is the best practice with Fortigate to disable before fully deleting policies?

We have two Fortigate-100E installed, operating in HA A-P mode. Periodically, when trying to log in using the http protocol, it fails to log in to the system. At the same time, the following error appear when trying to log in: [size="1"]# [httpsd 8077 - 1635755401] ap_invoke_handler[571] -- new request (handler='logincheck-handler', uri='/logincheck', method='POST')[/size] [size="1"][httpsd 8077 - 1635755401] ap_invoke_handler[575] -- User-Agent: Mozilla/5.0 (Windows NT 6.2; WOW64; rv:45.0) Gecko/20100101 /[/size] [size="1"][httpsd 8077 - 1635755401] ap_invoke_handler[578] -- Source: 10.197.31.42:59957 Destination: 192.168.102.30:80[/size] [size="1"][httpsd 8077 - 1635755401] logincheck_handler[288] -- entering vdom for login_attempt (vdom='root')[/size] [size="1"][httpsd 8077 - 1635755401] logincheck_handler[322] -- login attempt OK, VDOM updated to 'root'[/size] [size="1"][httpsd 8077 - 1635755401] logincheck_handler[330] -- login_attempt (method=4, vdom='root', name='admin',adm

Hi, I have small issue, Imaging you have a IPSEC tunnel in interface mode. Before the tunnel is up, someone pings an IP on the other side, and because the tunnel is not yet up, the default route sends it to wan1 (Internet), no answer of course. Then the tunnel comes up and populates the routing table, but still the pings are sent to WAN1 because the session is already established with WAN1, is there a way to re-evaluate the sessions when something happens in the routing table ?

hiwe have just added a second internet connection (wan2), which we want to use only for wifi (wifi is on a vlan)to do so, I have configured a policy to authorise the traffic coming from wifi vlan to wan2however i had a conflit in the networkPlease help me to configure correctly the seconde internet wan2 and dedicate it only for wifi vlan 

Hi All. I apologize if this has been asked. I tried the KB but did not see this exact thread.So I would like to replace the default certificate on the Fortigate since it is considered best practice.Right now, we do not use the SSL VPN, only for Administration and only on the LAN. So I cannot get a cert from a public CA because the Fortinet is not resolving externally. How have others went about replacing the cert? Use AD cert? Thanks.

The unit is set up with FortiOS 5.2.2 and has the wan1 port connected to the ISP with PPPoE (1Gb subscription).If I connect the laptop or computer directly with PPPoE to the ISP I get ~800 Mb throughput (tested with speedtest, ISP's own speedtest and torrents). When I connect the Fortigate unit the throughput is capped at ~190 Mb (~140 with 5.2.5) and the unit stops responding (CPU 100%).I tried the following configurations:- internal lan in switch mode or in interface mode (hardware switch)- tried with firmwares 5.0.10 and 5.2.1The MTU for the PPPoE is 1492 so I also tried with mtu-overrride 1492 and still the sameThe unit behaves the same in every situation high cpu and capped througput.All the UTM features are turned off. All the tests are done with the basic configuration, just a policy from internal to wan1..Also another strange thing is that when I test with the download limited ~100Mb so that the unit doesn't completely freeze I can see from the top command that the CPU is 50% h

Hello Fortinet community,I try to connect a FortiAP (FAP221E) to a Fortigate 60F, working as the controller through a VPN IPsec connection.I changed the AC Discovery Type to manual on the AP, with the IP of the controller. The AP is well displayed in the Managed Forti APs list on the controller, i can authorize it, but it still stay offline.Can you please help me to understand (and solve of course) what happens and why the AP stays offline ?Thank you.BR,David.

Hi, I don't know i this is possible, but I am trying to setup a schedule that blocks only facebook and social media traffic at certain times for specific users, but allows all other services during those times. for example: users have access to allowed internet services but are only allowed to access facebook between 8:00-9:00am in the mornings and 12:00-13:00 in the afternoons. I have setup schedules and schedule groups and we use FortiSSO for user authentication however I cant seem to get it working as when I enable the schedule it blocks all internet access except for those times. Thanks in advance :) 

Hi to all, I have a problem with my fortinet firewall suddenly cannot access the web interface. I tried this link but cannot see the httpd service. How can I restart the httpd without restarting the firewall. Any help will do. Thanks rodz

Hi guys,I configured an infrastructure with 2 FortiGate Active-Passive and 2 FortiSwitch 1024D. The MCLAG is active and the network work. But I have a question.In a second moment I see this document.Is it necessary replicate the configuration of MCLAG on configuration of FortiGate? config switch-controller managed-switchedit "<switch-id>"config portsedit "<trunk name>"set type trunkset mode {static | lacp-passive | lacp-active}set bundle {enable | disable}set members "<port>,<port>"set mclag {enable | disable}nextendnext