Solved

We're using a few FortiGate 50E with FortiOS 5.6.2 and DNS filtering, which works great (properly enforces SafeSearch over SSL/TLS without requiring a local certificate to be installed). However, when Safe search is enforced, YouTube restrictions must be set to "strict" or "moderate". Even moderate YouTube restriction blocks LOTS of videos that aren't in any way problematic for a school. Is there a way to have Safe search enabled for search engines (Google, Bing, etc.) but not restrict YouTube?

Can not access Fortiguard seversHi, guys,   My Forti600E can not access Fortiguard servers ( for device registration, any Fortinet services), network infrastructure is:   The Forti600E has few network links : 1. The device is using Fortinet DNS services : 208.91.112.53 & 208.91.112.52 2. The default route (0.0.0.0/0.0.0.0) can point to internal network. 3. The route table to Fortinet DNS services are implicitly defined, as the following route table:   Forti600E-01 # get router info routing-table all Codes: K - kernel, C - connected, S - static, R - RIP, B - BGP            O - OSPF, IA - OSPF inter area            N1 - OSPF NSSA external type 1, N2 - OSPF NSSA external type 2            E1 - OSPF external type 1, E2 - OSPF external type 2            i - IS-IS, L1 - IS-IS level-1, L2 - IS-IS level-2, ia - IS-IS inter area     &nbsp

Hi, just after some help from anyone who has had some experience with VXLAN.I setup a VXLAN a while ago which worked fine but now has stopped passing traffic?  the ipsec tunnel is up but can only see traffic either side, ie not traversing the L2 VXLAN, it's a fairly simple setup, diag attachedAny help/suggestions appreciated.Dave

Several of our SSL-VPN Portals have been defined in the default realm (/). The title of the login page there is an inviting 'Please Login'.  For legal reasons, we want it to read 'unauthorized access is prohibited'. Is there a way to change this? Kind regards, Herta

Dear forum, I have a FortiGate 300E and a Fortimail 200E, love them both very much - great products! However I have an IPS Sensor issue regarding the signature "SMTP.Login.Brute.Force". On the FortiGate we have the IPv4 policy that controls smtp traffic to our spamfilter:Source: ALLDestination: SMTP VIP (External IP: X.X.X.X to Mapped IP 10.100.10.9, External Port 25 to Map port 25).Service: SMTP, SMTPSAction: AcceptSecurity Profiles: IPS (with IPS Signature SMTP.Login.Brute.Force, Quarantine 15 Minutes). On the FortiMail I see around 6000-7000 SMTP Auth Failed attempts every day, some are legit email addresses, but most are random names, which probably is someone trying to brute force login. Why does the IPS Sensor not stop this? I have tried custom signatures I found on these forums and put those into the IPS Sensor, with no luck : F-SBID( --attack_id 6228; --name POP3.Brute.Force; --protocol tcp; --service POP3; --flow from_server,reversed; --patte

The Fortinet Discussion Forums hold a wealth of information that has been helpful to users of Fortinet products.  We would be interested to know which of the posts, both old and new, you feel should be added into the Fortinet Knowledge Base. Regards,Admin.

Hi, I want to remove an IP Address from a Group and them delete that IP via CLI command, I try with the command exclude member but after exclude the member does not permit to delete the IP via CLI. There is a way to do that via CLI?. Regards,

hi guys according to  FortiOS-administrarion guide ver6.4.2 when using FQDN in firewall policy, the OS will gather and match related IP address to that FQDN and use them as a certain destination/source.photo #1,2here is my scenario : photo 3as i understand, according to my firewall rule ( photo 4) all client request (req1,2,3  ) to destination 5.5.5.5,4.4.4.4,6.6.66 will be blocked, even the request would be http://news.msn.comam i right ?

Hey Comm, my problem is, that on windows i can configure the forticlient very good, but on mac i can't configure the vpn connection correctly, because i don't have the advanced settings for IPsec, Phase1 and Phase2. So the client can't connect to our firewall. Is there any trick to get these settings? I have tried many other forticlient versions but in no version the advanced settings are displayed.  thanks!    

Hi, I was trying to find information about MAC address table size for some FortiGates (more specifically 100F, 200F, 500E and 600E). This information is not available on the datasheet and I'm wondering if there any other source available that could have this?

Hi! I already have a working setup where i have 2 WAN, one LAN and one DMZ set up. I have a VPN SSL Tunnel set up on WAN1. My situation is that my WAN1 is a 6mb connection and my WAN2 is a 50mb connection. VPN gets in via WAN1 connection. Users can login and work ok. So policy are set up ok. Now with new COVID protocols and many users working from home that 6mb connection isnt enougth. Trying to set up the VPN to listen on WAN2 but i cant get it to the Fortinet login (portmapping the public WAN2 ip and nothing listening on port 443). Got one default route for WAN1. No default route for WAN2. Some computers gets internet from WAN1 and other computers get internet from WAN2 (through a proxy). Both cases have internet and can reach the internet with the correct configuration. Is there a way to troubleshoot why i am not getting the login screen even if fortigate is teeling me that is listening on the interface?

[style="vertical-align: inherit;"][style="vertical-align: inherit;"]Caro, [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]tenho o seguinte problema. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Configure a conexão VPN site a site com dois fortigate HQ FG 80E e Branch 60E. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]A VPN funciona perfeitamente, as máquinas de ambos os lados se comunicam com sucesso. [/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Porém, as caixas Fortigate não respondem ao ping em si no modo CLI, eu executo o comando em ambas as caixas com "execute ping + ip".[/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]Mostra a mensagem[/style][/style] [style="vertical-align: inherit;"][style="vertical-align: inherit;"]FILIAL # executa ping 192.168.254.99 <- IP HQ FG 80E [/style]

Hi, I am deciding to buy a Fortigate 60F or 80F for my network.My ISP has 2 separated network(from the same fibre) like most dedicated internet. The dedicated one is 1 gbps, the dhcp one is like 300 or sth. I think the best solution for it would be buying two separated firewall for each room but I kind of want to know that if I could simply plug both cable from the modem into the same firewall and have them running as two separated network. Does it require a Vlan setup to separate them? How does the failover gonna works in above case? Thank you very much.

Hi, I am deciding to buy a Fortigate 60E or a 80F for my network.My ISP has 2 separated network(from the same fibre) like most dedicated internet. The dedicated one is 1 gbps, the dhcp one is like 300 mbps. I think the best solution for it would be buying two separated firewall for each room but I kind of want to know that if I could simply plug both cable from the modem into the same firewall and have them running as two separated network. Does it require a Vlan setup to separate them? How does the failover gonna works in above case? Thank you very much.

In reviewing specs of the FortiGate 40F vs. the 50E the 40F looks very capable. Is there any reason to purchase the 50E over the 40F? Are there any issues with the 40F that I should know about? Thanks.

As part of an office move we are upgrading from a FortiGate 30E to a FortiWiFi-60F security appliance. Is it possible to save the 30E settings (users, network, VPN, etc.) and restore them to the 60F? (Obviously settings that don't exist on the 30E such as WiFi would still need to be set up manually.) Or is it necessary to copy the settings by hand?

hi guys i am new in fortigate world, what is different between these two way of publishing a service :1- publish a server with using filtering \services\HTTP2- publishing a server using port forwarder are both work the same way and manner ?is there any technical benefit between them ?

Hi guys, I would like to know why I cannot set my security profiles on my security policies... I cannot found why or how to solve it. When I set a security profile like anti virus or web filter or application control or ips (default or new created ones), I receive a message that it conflicts with the system settings.. I do have license for that because on the status dashboard those are green marked. Can someone help me? :) Thanks and much appreciated. kr, 

Hi guys,  We have Forti400E HA pairs topology ( with FortiOS V6.4.2 ) in the production network, and intend to change the interface MAC add; do we need to change the same mac add for both devices at the same time, or just change the MAC add in primary/master Forti400E ( it will synch the mac add to the secondary/slave Forti400E ) ? Thanks so much for your advice  

Hello I have IPsec Tunnel  wrong named.unfortunately there are more than 300 policy that matching this IPsec Tunnel (and Interface)Its really disturbing daily.Is there a way to change it from command line or GUI whithout rebuild all policy?I'm on HA cluster FG-401-E that run 3 VDOM FortiOS 6.4.2Thank you for your help

Hi, I am getting the following log every around 15 minutes on my 50E. Administrator admin login failed from http(127.0.0.1) because of invalid password Any has any idea on what is this could be? Thanks

We are moving our SSL VPN tunnel users from Pulse Secure to FortiGate (6.0.6). In Pulse Secure, we can limit access based on the remote user's MAC address. I found https://kb.fortinet.com/k....do?externalID=FD41648 which describes how to configure that for SSL VPNweb mode, but a number of our SSL VPN users will be using tunnel mode exclusively. Is there a way to configure a mac-addr-check in tunnel mode via a host check option? If not, is there another way to limit access based on some other unique feature of a remote device? Kind regards, Herta

100D's in HA: The internal network is set for 10.4.1.x/24We also have other internal networks from 10.1.1.x to 10.8.1.x that can all talk to our primary 10.4.1.x subnetOur other networks are each on their own VLAN which is all handled by our core switch. Currently, our Aruba 5406 does all the routing from the other subnets.ip default-gateway 10.4.1.9 (FortiGate) ip route 0.0.0.0 0.0.0.0 10.4.1.9 In order for the firewall to be able to communicate to the other local subnet for AP discovery with FortiManager:[ol]Should we just change the subnet on the internal interface from /24 to /12 : 10.0.0.1 - 10.15.255.254Or would it be better to create some kind of loopback interface?[/ol]We just received two new 600E's that we'll be upgrading to soon as well. TIA

Hello all,I want to let subnet 10.0.0.0/8 out to the internet, however, i want to filter out 10.1.100.0/24. How do I do it in my 100F? Sorry, moved to Fortigate from a different product. 

Hey community, I am relatively new to the platform and I have been given FAZ as the main product I will be working on. I have looked in the forums and on a lot of other websites like fortiguru but I cannot find an answer.  Is there a way to use an event handler so that if a Firewall stops sending traffic for a couple of hours to send an alert via email to a group of people? I see you cannot put a 0 in the value field of a handler so I cannot do something like if 0 alerts for "firewall" for the past 1 hours, send an alert.  Any suggestions would be helpful. Thanks!