Solved

Hello,I have WAN network with multiple IP ( subnet )The wan ip is the x.x.x.228 but but .229 - .232 are available.I already used different wan IP with VIP to map service for a specific public addressto internal address without problem. Now I set up a site2site IPsec tunnel and I can't use x.x.x.228 as public IP.I want my tunnel use x.x.x.229 instead of x.x.x.228 as incoming and outgoing IP I tried to use IP pool ( 1-to-1 to x.x.x.229) and use NAT on outgoing ( local vpn address-> vpn interface )vpn policy without success Which is the best way to manage this situation ?Do I need to set something on incoming policy ( vpn interface -> local vpn address ) ? Thank youGiuseppe 

Hi, I have a site-to-site vpn set up between 2 fortigates: Site A Fortigate 300E and site B Fortigate 60F, and I was able to fill the vpn and the communication between both sites. When I connect to a computer at site A from site B I can do it without problems through the IP, but for security reasons I want them to be able to communicate through the host name. In site A all my computers belong to a domain (mycompany.com.mx) but in my site B the computers are not within a domain. Is it possible to get site B computers to access site A computers by hostname and not just by IP? I hope you can help me Thank you

Look at this list https://www.hikvision.com/content/dam/hikvision/en/support/download/vms/ivms-5200-mobile-/ports-list1/iVMS-5200%20Mobile%20Surveillance%20V1.1.2_Port%20List.pdf This is surveillance system hikvision. Is this secure to open so much ports? Any experience from someone?

Hey =)    Unfortunately, I have problem with my VPN configuration.  Error Forticlient stopt by 80% I have already implemented all the suggested solutions including Internet Explorer Settings or configuration enabled TLSv1.1 etc. it says in the log "diag debug app fnbamd -1". invalid auth params for user 'vpn_test'. The user "vpn_test" is a local user and I didn't add any SSO or PKI or Domain My Forti is a FGT60D v6.0.13 build0443 (GA) FortiClient is 6.2.0 Who can help me please, I am at the end of my knowledge

We have a client that has a new Fortigate 100F that they (and in turn we) need assistance to setup properly, since they're our only client using DMZ. We need 2 address available publicly. x.y.z.194, which we've set as the WAN1 address and added a VIP that's mapped to their 192.168.x.x mail server on the necessary ports. We also have a web server connected to the DMZ with a configured address of x.y.z.195. What do we have to configure to make the web server accessible on http and https from the internet properly. I assume we'll need policy routes to allow traffic from the WAN to the DMZ, but I'm not sure how the DMZ port needs to be configured, or what other items need to be set. Unfortunately we can't do much testing since the fortigate needs to be configured before replacing their current (non fortigate) firewall, so we're trying to get this as close to correct as possible

I am currently running 5.6.12 on my 100D.  Now that 6.4 is out, even if it is not for the 100D, I am wondering is it time to upgrade to 6.0.9?  or is 6.2.3 better?  I would follow the upgrade path.  I have read about some memory leak issues in the 6.x series, are they fixed in 6.0.9 and/or 6.2.3 or do I have to contact support to get the latest IPS engine?  IPsec VPNs are a big thing for me so I need stability for that.  My fortigate connects via fortigate to fotigate VPN to a unit running 5.6.10 I think.  I have no control that unit.  Would there be any problems with connecting from a 6.2.3 to a 5.6.10 unit?

Hi Guys, Does anyone have a guide/reference for setting up geo-blocking to restrict certain countries?  Multiple IP's from several countries are trying to bruteforce the VPN.  We don't have any VPN users needing access from outside the country. Many thanks, IM  

Hey everyone,If I want to create a DNAT entry to map External IP: 1.1.1.1 to a group of 20 Mapped IP addresses (not in a range or subnet, for eg, 1.1.1.10, 1.1.1.20, 1.1.1.30, etc), how can I achieve this on the Fortigate? I don't see an option to add multiple mapped hosts or group in a single rule. Is this possible in any way, as other FWs do have this capability. Thanks!

Hi, My area of technology is not security, but I have a project that I'm working on at home and I purchased a used Fortigate 60D which I have registered.  On Port 7, I have a WAP with DHCP serving my basic household needs and that is great.   I would like to ask for general guidance on designing a specific, but common, setup.  I have three (3) computers that I want to use.  Computers 1 and 2 are Internet facing specifically using ports 443, 6000, 3001.  The third (3) data server needs to be shielded from external access by the web, but communicate on the subnet via port 3000 to Computers 1 & 2. The first question I have is: Do I use the DMZ with port forwarding for Computers 1 & 2?  Can you suggest a general plan of attack for this design? The second question I have is: Prior to my own hardware, I use AWS with private and public IPs.  I was successful with AW$, but I don't know how to mimic this.  I've just starte

Hi all,I have a FortiGate firewall that reduces my 250MBps Internet to about 22Mbps. I have tested the network without the firewall and i get a speed of about 240 Upload and Download.PLease help out! My device is a Fortigate 60E and possibly have Features turned-on i.e Application Control, Web Filter, SSL Protection.  Kindly advise the best Fortigate Firewall Model that Give me a good ThroughPut Bandwith nearly to 250Mbps with all the Important Features turned on. I heard about FortiGate 80F. 

System link-monitor is not working as expected. When the gateway ping comes back up, the routes remains down anyway. I have to disable and re-enable link-monitor for that interface.I have an open case with Fortinet

I want to create a VPN ipsec with forticlient  with the firewall "fortigate 90D" for my company. My problem is that I don't know the remote gateway of my firewall. Where is it? Thank's (Sorry for my english)

Hi, I have a IPSec VPN setup with our FGT 60 device. It works fine for one country and doesn't connect from other. I haven't applied any geo restrictions on the device and wondering what could be the reason for such behavior. Attached is VPN setup config and interface settings. There no address object setting for the interface. Note:1.I am able to ping public IP successfully from both locations.2.I am using public IP directly as gateway and there is no name resolution involved. Any suggestions and advice is appreciated! Thanks,Mirza 

We need the ability to see the external IP address of clients that are browsing sites that we are hosting behind the Fortigate firewall.   Here is a brief overview of our setup    [image][/image]   What we need to be able to do is see the actual external IP address (1.2.3.4) of customers that are browsing web sites that we are hosting internally.    As of right now, if a customer is browsing a site that is internet facing, if we view the logs on our load balancer, all external traffic looks like it is coming from the Fortigate firewall (10.50.1.1).  Here is an example log output from our HAProxy load balancer    Mar 10 00:04:03 haproxy2 haproxy[2166293]: 10.50.1.1:62232 [10/Mar/2021:00:04:03.640] localhost~ titu_cluster/titu11 0/0/0/2/3 200 64577 - - ---- 28/28/3/63/0 0/0 "GET /images/base_models/18865.jpg HTTP/1.1" Mar 10 00:04:03 haproxy2 haproxy[2166293]: 10.50.1.1:62235 [10/Mar/2021:00:04:03.639] localhost~ titu_cluster/titu12

Hi, We have FortiMail in our setup which was installed by a 3rd party. In the message logs, the Client IP is showing our Router's private IP. Is there a setting in FortiMail to use the originating IP of the email? Below are screenshots of the logs and a sample of one of the spam message headers. Thank you,    

Dear All, I try to make a policy in which one of the interface is a zone member, but I can not choose that from the interface list. It seems the zone members can not be used separately. Some interface has common rules, while in addition to those there are rules that specific only for one interface. Is there any hack for this? Thank you

attached a screenshot. I cant find the "CAPWAP" option in the Administrative Access. any global option to be enabled for this? 

Howdy all, Just got two Fortigate 1500D boxes. Running v5.2.2,build0642,141118 (GA). We configured the management interfaces on them and starting going through the web interface. However it suddenly seemed to stall/halt. Port 443 did accept connections but I was unable to retrieve anything (all existing sessions just seem to "hang"). The SSH interface was available and everything seemed to be functioning as expected except for the web interface. We did reboot the boxes and regained access to the interface but I was just wondering if there was some way to restart the web interface without restarting the whole box ;-)? Bgrds,Finnur

When we get a page browser blocked by our Fortiguard we get the following page returned (example browsing google.ie):    Is it possible to customize this page with:[ul]some corporate branding i.e. custom HTML/ImagesRule specific info that would help support tickets i.e. which rule blocked the request and what the requesting IP was?[/ul] 

HiI am planning an upgrade of two (HA Pair) of 600E firewalls.  They are currently 6.08 and I will need to go through several steps to get them to required version 6.4.5.My question is- would it be safer to shut down the switch ports on the secondary firewall and just upgrade one of the firewalls (and then upgrade the secondary firewall in a different change window) ?  If there were any unexpected issues this would enable me to fail back to the secondary firewall safely.I have done a similar process with other vendor's firewalls but am not sure if this method is supported or advisable with Fortigate firewalls.Many thanks

Hello fellow Fortinet users, I have a Cisco 55xx WLC that's currently using Cisco ISE for AAA.Considering the fact that the ISE and fortigate are incompatible when it comes to accounting my only choice was to configure the WLC to send accounting messages directly to the fortigate.While I can see all the different types of accounting messages from the WLC  on the fortigate, it's unable to fingerprint users in the logs.I went through support and they kinda gave up on me and said that the logs HAVE to come from a  RADIUS server.Has anyone  got this working or can suggest a way for me to overcome this problem? Cheers,Vignesh

Hello.Is there an easy way to promote or change HA roles from SLAVE to MASTER in Fortigate (800c) 2 nodes HA failover cluster, within Fortigate gui or cmd commands/configuration?  

Hi everybody,is there a tool Fortinet to configure offline any model of FortiGate? thanksac

Good day all, I will appreciate some feedback on how the application controls on fortigate work for traffic that is coming into the organization.we have app control , filtering used for user traffic that gets to outside world. if we want to prevent attacks from outside into our organization how should app control features be used? Thanks in advance.

We have a really good small biz product around here by ATT here that's a shared fiber offering.  1Gb up and down for less than $135 a month and they guarantee to add additional circuits if the original reaches 70% saturation. This product is so poorly marketed that nobody uses it, thus I've never installed it and had to share with anyone (that i can tell anyway).   Anyhoo, they came out yesterday to install it at one of our branches with 10 people.  They sent out the same Router with built in ONT as they use in NEW ATT Fiber\Uverse residential installs. It's even got wifi6.  Perfectly fine for this office's purposes. So I simply wired WAN2 into the back of the router to grab a 192 address from the router so i could configure it later to run pass thru and SD-WAN, then ultimately get rid of the cable broadband on WAN1.  But as soon as i plugged it in, it killed internet access on my WAN1-INTERNAL interface/subnet/setup...which is in NO way connecte