Solved

Good day to everyone! I faced a real problem with publishing sites with my Fortigate 100D. I have a web-server that published with http port 80. I need to redirect all http trafic to https. We are migrating from Forefront TMG and there I could do this by adding aditional listener on the 443 port and redirecting whole traffic to it. Can I do this with Fortigate 100D? Well actually there is no problem with publishing 80 port by VIPs but I have no idea how to redirect it.. I' ve tried everything but it doesn' t works... Please, help me!

Hello, Our customer complains of recurring ssl vpn outage, this impacts several users. I enclose the forticlient logs sent by the user, the day the cut occurred (03/30/2021). For information, the users of this customer connect with AD authentication in vpn ssl.Do you have any troubleshoot ideas? Because these are random cuts, and it does not happen at the same time for everyone. Thank you for your help.Best RegardsHanane

Dear all, How can I add a traffic shaper to a single policy as attached screen capture? Is it need to edit in CLI?Leo

Hi all, I've been running a Fortigate 61E in LAG mode (ie: static) on an Edgeswitch for some months now and it has worked well. I never managed to make it work in LACP. Now I'm moving to a Unifi Switch, which only supports LACP, and ... they don't negotiate. Wether I use passive or active, they just won't talk to each other. Any clue ?

I have one GNS3 lab environment for the testing purpose. I have one interface "LAN2" on fortigate which ip is 10.10.10.1 and one loopback interface ip is 20.20.20.1. I connect with router interface. When i configure OSPF on my fortigate LAn2 interface i got the faild dependeny Error.Please my attachement.

Hello all,  Time has a question on my mind, "What consumes less battery, SSL VPN or IPSEC?" Because I want a permanent VPN connection for Android devices. We use here EMS Server and FortiOS 7.0 Very thanks and best Regards :)

Installed FortiWiFi 50E , firmware 6.2.7 build 1190 Issue: VOIP phones are working except for park function. When receptionist parks a call, the next user cannot hear the call if the pick up the parks call. Weird thing is that if the pick up the parked call, place it on hold and then resume the call, the call will then proceed as normal. So: can't pickup parked calls unless you press hold twice. What we've tried:1. disable sip ALG helpers through CLI2. Created a few services to allow traffic on ports: 53 UDP 5060-5062 UDP 20000-40000 UDP and allowed these services to talk from LAN to WAN and from WAN to LAN3. rebooted phones, switches, firewall etc.4. Created a ticket with Fortinet, currently they are researching the issue...but my client is a Karen and is breathing down my back. Thank you for any help!

My first post, so firstly.... Hi. I've read a lot on this forum but never actually created an account to post anything, now that i have, I'm sure this is going to be the first of many. I'm creating a static URL whitelist with whole load of URLs. I'm trying to make sure I get the rules right first time as I've been given an output from another appliance that was doing their web filtering for them and don't want to have to go through it again. So i just wanted to know.... if i want to allow (everything is blocked by default) xxx.yyy.zzz.com/abc would a 'simple' rule with that exact URL suffice? Or should i do a 'wildcard' rule with xxx.yyy.zzz.com/abc*?  Is there a difference? I've read the guide for 5.6(the version I'm on) but all of the examples do not include subdomains nor do they say much about the wildcard option. 

Hey guys, How you doing? Well, I will migrate from DHCP on Windows Server to DHCP on fortigate. I have lot of resevations on the server, is there a way i can make this reservations on Fortigate without doing it one by one. Like a scrip or something?  For example on Windows server i can do it through PowerShell, with something like this:  Add-DhcpServerv4Reservation -ScopeId 192.168.0.0 -IPAddress 192.168.0.XX -ClientId "XXXXXXXXXXXX" -Description "Reservation for XXX" And I just replicate for every reservation I want.  Appreciate your help,  Thank you  

Lately, I've been seeing various cert issues while browsing various sites. Even Outlook seems to be having problems with the FortiGate. You can see from the image below that outlook is having problems accepting the cert from the Fortigate. Is the configuration wrong? Is there a step missed in the process? Is there a cookbook on SSL inspection? [image][/image]

This post is not maintained anymore. Post your updates to this thread and rwpatterson will update his list: https://forum.fortinet.com/FindPost/100451 Building a Hardware CPU/Memory list. Disclaimer: This is a user contributed list. No liability assumed for accuracy and completeness. Fortigate: Model | Memory | CPU (Family, Mode) FGT 20C | ????? FGT 40C | 512MB ?Mhz | 1 FA526id(wb) rev 1 (v4l) FortiSOC FGT 50B | 256MB ?Mhz | 1 Geode Integrated Processor by AMD PCS @431Mhz (5,10) FGT 60 | 128 MB| CentaurHauls VIA Samuel 2 400Mhz FWF 60A | 128MB ?MHz | 1 CPU - CentaurHauls VIA Samuel 2 @ 400MHz (6,7) FWF 60B | 256MB ?MHz | 1 CPU - VIA Samuel 2 @ 400MHz (6,7) FGT 60C | 440 MB | FortiSOC (FA526id(wb) rev 1 (v4l), BogoMIPS: 524.28) FWF 60C | 440 MB | FortiSOC (FA526id(wb) rev 1 (v4l), BogoMIPS: 524.28) FGT 80C | 512MB ?Mhz | 1 CPU - Celeron (Covington) @ 600MHz (6,5) FGT 80C Rev2| 1024MB ?Mhz | ? CPU | 8GB Flash for logging etc. FWF 80CM | 512MB ?Mhz | 1 CPU -

I have about 40 LDAP and 10 Local user on a fortigate 30e added.If I want to add more user the output is as follow: reached the maximum number of entries On the data sheet are no restrictions as i can see.https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiGate_FortiWiFi_30E.pdf If somebody know something would be great. Thanks in advance

Running a FortiWiFi 60D with FortiOS 6.0.9 located at a remote data center. We have the firewall Hardware Switch with ports 1 through 7 as members. One dual NIC server plus 4 PC's are connected to the ports 1 through 6. One PC, PC-Red, needs to be put on its own subnet. To do this I assume that we need to take its Internal Port out of the Hardware Switch, and assign it's port to a subnet, different from the subnet used by the Hardware Switch. We know the IP address, MAC address, and hostname. Is there a way to determine which port PC-Red is connected to so that we only remove PC-Red and not the server or other PC's from the Hardware Switch?

Hello forum members, Load balancing to https servers is bit new for me. I have done in the past regular http load balancing. I was under the impression that with certificates on the servers and incoming https requests being sent to one or the other real server should have nothing to do with FortiGate needing certs on it as we are not really terminating https on firewall, but simply relaying the requests over to two inside servers. But when I tried to configure virtual server, it requires SSL offloading and that of course will require certificate on FortiGate. So why is it mandatory for FortiGate to do SSL offloading for load balancing? The two inside servers are windows IIS with few websites that are duplicated on them. I assume, worst case, I need to have customer export already installed certs on these two boxes as PFX bundle and then split those into their constituent private key and public (cert) and then import into FortiGate and then use those certs (or rather

Hi! I have a working ipsec VPN so that people can access our entire internal LAN when outside the office.My question is - Is it possible to block specific internal IPs when using this VPN? So that everyone can access our internal LAN except one specific server for example.

Hello, I would like to buy a 30E or 40F Fortigate for my private use.When I read documentation, I don't find the way to limit the upload speed for Microsoft onedrive only on my connection. Is it possible to do this ? Because, when my son (or me) does a synchronisation of ours photos, the uplink of my adsl is completely satureted Thank a lot

Hello Experts, Can someone please confirm that if we have a regular VIP with an Public IP address, other than the Firewall external interface IP, will return traffic from the exposed server will use the same Public IP from the VIP? If not, do I need to create an IP pool with the same Public IP and then use that to NAT Internet bound traffic from server? Also what IP will be used by server if it initiates the traffic out to Internet in case of exposed server with VIP setup? Thanks

HiWe have a Venezuela CANTV Metro Ethernet link and we need to connect to Fortigate 60E in port 7 (WAN1 & 2 are in use in a SD-WAN and we need to include this link) We received from CANTV the follow parametersVLAN:                   118CANTV WAN IP:     190.202.4.9Customer WAN IP: 190.202.4.10WAN Mask:            255.255.255.252LAN IP:                 201.249.206.128 IP Available:          201.249.206.129 to 134 (135 is for broadcast)LAN Mask:            255.255.255.248 Someone can help us? We will appreciate a lot... Regard

Hello to all! I am new to forum and and FortiGate devices and I need some help. I just bought second hand Forti 100D, but it has old FortiOS (5.2) and form what I see there is no way to update it's firmware without subscription? Since I have bought this for HomeLab I don't need cloud/extended features and I must say I was shocked when I saw that I cannot event update firmware? Is this true? If it is really true, what is the lowest subscription to get access to firmware(since this is the only thing I need), as I said I don't need 24x7 support or others since this is for HomeLab purposes and learning.   

hello everybody, I recently updated an ha cluster of 100E from 6.2.2 to 6.4.5 following the suggested upgrade pathafter the update the HA cluster status is out-of-sync, I checked using diag sys ha checksum and I found a firewall address named FCTEMS_ALL_FORTICLOUD_SERVERS created on both master and slave but with different UUID I tried to set the UUID manually but I get the error "UUID attribute cannot be set directly", I tried to delete the object, it was deleted on both master and slave and the conf appeared in-sync but after a few minutes the address is automatically re-created with different UUID on the two firewalls and the HA status is out-of-sync  did anybody face this issue and found a solution?thanks!

Hello everyoneI'm facing a quite strange problem on my FG-60F wit FW v6.4.5 build1828 (GA)Either I do not understand the sense of a firewall or I'm not experienced enough. I'm using an IP block list connected via an external connector. The connector shows 1259 valid IP addressesI added a new deny policy on the very top of the chain to block all traffic from WAN1 to any where the source address is in the block list. Whatever I'm trying, this policy just does not work. I added also the current IP from my smartphone provider to the list for testing.  The IP is listed in the block list, but even so I'm still able to connect to everything which shouldn't be possible at all. If I block myself via a normal static address then is works as expected. The IP was found in the block list I'm still able to connect even so the bad guys  I really wonder if someone else has the same issue and how this could be fixed. Thank you very much! 

Hello, I have a server in my DMZ which must communicate with my antivirus manager server in my LAN.Ports used are 80 and 443IP v4 rules are ok. I encounter an issue when I try to access to the url [link]https://antivirusserver.domain.local[/link] from my DMZ serverI get the following messageWeb Page Blocked!You have tried to access a web page which is in violation of your internet usage policy.URL: [link]https://F-Secure[/link] Policy Manager automatically generated self-signed certificate/ Category: Unrated User name: Group name: To have the rating of this web page re-evaluated please click here. If I disable the web filter in my rule I can browse the URL.I tried to add antivirusserver.domain.local as a wildcard and allow it to static url filter but it doesn't work.Allow tried to add the url to my white list in web rating overrides but it doesn't work. Do you have an idea ? Regards,

Hi all, While I'm waiting on my first FortiGate's, I would like to prepare some things. We will have 11 BO which will connect to the HQ. At HQ we will have two 200F in HA, all BO will have 80F.HQ will have one Win 2019 Server (DHCP, DNS, etc).HQ will have FortiManagerI would like to make VLAN's and Subnets as next:VLAN 2 - Workstations (each site with their subnet ex. 10.10.10.0/24; 10.10.11.0/24, 10.10.13.0/24, etc over the same VLAN)VLAN 3 - ServersVLAN 4 - Management (switches, FG)VLAN 5 - WiFi - EmplyeeVLAN 6 - WiFi - GuestsVLAN 7 - Other (UPS)VLAN 8 - Trunk HQ - 100 Mbps InternetBO - most of them 50 Mbps and some 80 MbpsObviously need to split the tunnel  My questions: - What kind of VPN connection would you recommend? Routing?- Would it be better if I split VLAN so for each subnet different VLAN (each BO with their VLAN)? I'm not sure if this would make more trouble for the administration. VLANs 2, 3, 4, 7 and 8 need to talk to each other. VLAN 5 and VLAN

My FortiAP-112D has two holes at the bottom of the housing for Ethernet cables, each about 11/16" or 18mm.  These were supposed to have weather seals, judging from the image on the cover of the QuickStart Guide.  Due to the way the bottom cover slides into place, a standard cable gland out not work.  Maybe some molded rubber piece was used. Can anyone advise what sort of seal to use and/or where to find it? Thanks,billvo

Hello Everyone,I don't know if what i want is even possible but here it is. I have a client site with two vpns tunnel to two remote locations. What i want is if the ping to an internal ip address in one of the remote locations is fail i want the vpn interface toward that location to be disable.Thanks in advance.