Solved

On the FortiExplorer page, I see a link for the iOS app...  Is there a corresponding Android app?ThanksJamie

Hi In your opinion, how reliable is application control (as in using it in policies to limit only those applications) when not ssl inspecting the traffic ?

Good day all, we are having fortigate 400E with 6.0.Can it be configured to act as ftp/secure ftp server. If so, where will the files transaction be stored in?  

Hello All,I am running 6.2.4.  I have a new Internet connection via AussieBroadBand here in Aus.  Our link is DHCP but we have two static IP addresses coming in on the same link.  The two IP Addresses are both /32 addresses. I have created a virtual IP as per the following documentation. This is very similar to the pfSense and I have done this previously with the pfsense in a separate environment.https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/502582/creating-a-security-policy I have also created the IPv4 policy as per the documentation.  However, it doesn't seem to work.  In the port forwarding section I forwarded ICMP and have monitored for incoming ICMP on the target machine but don't see any packets reaching the internal machine. I am starting to wonder whether my ISP is in fact forwarding those packets to me.  It's been a long time since I've done any packet sniffing on the fortigate, I'm hoping someone can help me with the

Hei, I have got a  problem with 2FA Mobile token. We use SSL VPN and LDAP. All vpn users  are assigned by 2FA with mobile token  and they are able to login to the network via VPN using 2FA mobile token. But only one user is unable to use the token.  When he tried his username and password , the forticleint not asks for fortitioken mobile and get directly connected into the network  , which is seems same as SSO, eventhough the user is successfully assigned by a fortitoken mobile. What might be the reason for this . How can I troubleshoot this and get it resolved.  Thanks!!

So here's my conundrum. I have 3 sites all with a private fiber connection to our network provider's datacenter, where they carved off a VDOM just for us to use. We run OSPF on a vlan between the 4 sites (network provider datacenter and 3 locations). I had a failover event this weekend where the circuit failed at the main site and it started running through the secondary site. Everything was fine except for the traffic to the firewall itself, which means nobody was able to auth to the SSL VPN at the main site because the core switch at our main site saw the /24 as a connected VLAN and didn't have any way to hit the Fortigate IP directly anymore. My thought is why can't I redistribute a /32 to the Fortigate LAN IP through OSPF to make sure that fails over automatically. But I can't find anything on that anywhere.  I did see about redistributing a loopback through OSPF, but I can't get the SSLVPN auth to originate from a loopback interface as far as I can tell. So if anyon

Hi Guys,This is the first time for me to replace a faulty Fortigate unit ( in cluster A-A ) with new RMA device.I have some plan of action but am confused between two approaches.Approach 1 ) Install same firmware as master, sync licences and restore config backup which was taken from faulty device and then attach network cables.Approach 2) Go as per this document which says that I need to execute this command config system ha and configure some parameters. Once done, attach the new device in network and it will sync the config from primary. https://kb.fortinet.com/kb/documentLink.do?externalID=FD36481Which of the two is correct or are both wrong and I am missing something else.

I hope I didn't get bamboozled on this rather expensive home firewall. The specs show that the WiFi supports 802.11 a/b/g/n/ac but it looks like there's only one radio in the unit so you have to pick between either 2.4 -or- 5 GHz. Is this correct or am I simply doing something wrong? 

 Why "all and guest group" in the source , What if we give "guest group  " only Thanks

Questions to those in the know: 1. In the printout: FG60C (global) # diagnose test application urlfilter 3 Saving to file [/tmp/urcCache.txt] Cache Contents: -=-=-=-=-=-=-=- Cache Mode:   TTL Cache DB Ver: 17.53220 Domain  |IP       DB Ver T URL 1e000000|00000000 17.53219 P B[link]https://vuexcasht3.ad.vu.edu.au/[/link] : what does the "T" indicator show and what values (such a "P", above) can be shown? Also, what does "B" prepending the URL show? 2. is it possible to (regexp or otherwise) filter printout generated by "diagnose test application urlfilter 3" for specific URL? (Currently, I'm forced to use grep on /tmp/urcCache.txt). 3. What is the difference between "diagnose test application urlfilter 3" and "diagnose test application urlfilter 16" 4. When I issue the command, I get an incomplete printout, eg. FG60C (global) # diagnose test application urlfilter 16 Saving to file [/tmp/urcCache.txt] Cache Contents: -=-=

Hi there,I use FG60D, and wanna use VPN web portal.what I've done:- create web tunnel- set AV check- create user and group, then add to portal mapping on menu vpn ssl setting I can reach web portal over web browser, directly, using assigned port.but I can't login, permission denied.am I missed something? unlucky for me, tried to search over forum and fortigate help, but can't find about complete guidance. also, Can I disable this feature, in the future? I mean outside can't reach web portal. please help. thank you.

Hello Everyone if i need my exchange-OWA accessable from Outside i need to create a Virtual IP.eg my public IP is 123.123.123.123 and my internal Exchange IP is 192.168.1.1 So i want that 123.123.123.123 Port 443 maps to 192.168.1.1 Port 443. And here is my question:As far as i can see i have to possibilities to reach my goal. *********************************************Possibility 1) on VIP i configureExternal IP Address/Range: 123.123.123.123Mapped IP Address/Range: 192.168.1.1 On Port Forwarding i configureExternal Service Port: 443Map to Port: 443*********************************************   *********************************************Possibility 2) on VIP i configureExternal IP Address/Range: 123.123.123.123Mapped IP Address/Range: 192.168.1.1And under "Optional Filters" i configure a Service like "HTTPS".*********************************************  Both possibilities work.Buth i guess there is something i don't understand?&n

https://docs.fortinet.com/document/fortigate/6.0.10/fortios-release-notes/760203/introduction

Hi guys, I hope someone can help me. Following scenario: Our customer has a Fortigate 100E unit with Build v5.6.5 installed (I know its outdated), running in "proxy mode" with explicity proxy settings and needs port opening for SMTP, SMTPs, HTTP and HTTPs directly to the Exchange Server for connectivity with O365. I created a Virtual IP 'Public IP -> Exchange Server' with the mentioned services and the fitting policy that allows all Microsoft IPs plus our public ip to access the virtual ip object with all services. As soon as I enable the rule telnet to port 25 is working but the internet connectivity from the exchange server doesn't work. As soon as I disable the rule I can surf through internet and can make a traceroute to www.google.com for example. I also created a explicity proxy rule but the exchange doesn't use the firewall as a proxy. I hope someone had the same behaviour and did found a solution. Thanks in advance!

Hi,I'm trying to run a traceroute from the CLI and also windows pc but unfortunately it does not give me the full hops for troubleshooting.From the policy settings, I've enabled the below configs: From the interface: Traceroute from CLI Is there something blocking this or have i missed something?

Good Day, I am new to the forums so forgive me if this is not posted in the proper spot. I am trying to enable the Dynamic Threat Detection part of the client. I can install the client as a standalone and it is enabled. But when we connect it to our EMS the feature is no longer enabled. I have looked through every screen that I can find and have had no luck finding where to enable it again. Can someone give me some guidance as to where to enable this feature? Thanks in advance. Fraser

I need a small /124 network for routing topology so I can use my IPv6 assigned by my service provider. Since these are Global Unicast addresses, I want to assign them to my servers; however, I need a transient network that is connected to my edge router and the devices down stream, since my IPv6 network is not all Global Public addresses. Due to the latter, does Fortigate distinguish differences (i know some vendors do) for routing between Link Local and unique Local?

I am reading over the documentation https://help.fortinet.com/fweb/561/Content/FortiWeb/fortiweb-admin/planning_topology.htm and I need the benefits of Reverse Proxy; however, I do not understand how the One-Arm reverse proxy works. If everything is on the same network segment, then layer 2 frame will just forward out the interface it was seen from. However, there is some warnings about Inline Reverse Proxy, and non HTTP/HTTPS traffic. Does the One-Arm Reverse proxy works when protect servers will be on a different subnet. I imagined this would be installed In-line and create rules that ignore the policy engine when (a)specific server was in destination with (b)specific traffic port. The latter would be no different then forwarding traffic around the unit, but the link to documentation says something about Performance and security. The One-Arm deployment seems like a number policy routes or virtual port forwarding would need to be created. Again, just even sure what the default ga

Hi friends,I have a scenario where one Fortigate firewall in behind the NAT, means Its WAN interface has private IP which is then NATed with some higher level network device to one Public IP, from internet using the Public IP I can access firewall web interface, but when I configure an IPSec remote access VPN, and try to connect with forticlient VPN and using the firewall's public IP, forticlient is not able to connect with firewall. I have tried from windows and android but same problem, if some one have any idea for solving this issue then kindly guide me.Thanks

According to FortiOS Handbook (Version 5.4), to create guest user account I need to create a guest type user group, then create user under guest management. My environment (school) would like to specify username instead of using autogenerated user0xx. Therefore I have to create a new one/change after auto-generated guest account. I found this process tedious when I have to create/edit a bunch of users a day.  The handbook didn't state the way to create guest user account under command line. Is it possible to do so under CLI?

Hi all,  I hope you can help me, I am kind of new with Fortigate and networks, I was asked to disable internet access in our Domain Controller, so I thought "that is easy", so I configured a Rule to block  internal interface - DC IP address to reach wan1 (internet). and it worked, but the thing now is that all domain computers are not able to access internet neither, any suggestion? best regards

I have a remote user that for an unknown reason started to have issues connecting remotely. No changes were done on the Fortigate. According to the user not no changes on the remote user side network (same ISP, same router). Previous to the issue they had been connecting without any issues since it was setup months ago on a daily basis. FortiClient connects but I lose Internet access and I cant ping the devices at the main office. I also noticed that I dont get an IP assigned. I already restarted the Fortigate and deleted and recreated the FortiClient VPN. Office/Fortigate network/subnet is 10.10.10.0Remote sites network/subnet is 10.0.0.0 I have experience issues in the past with overlapping subnets with FortiClient, but in those cases the device connecting remotely didnt loose Internet access, it just had issues accessing some devices at the office if some IP overlapped. They have been working fine for months Could it be issues with the subnets? Somethin

Forgive if this is loaded somewhere else. I'm running into a snag here.  I am currently on Spectrum and getting a /128 from them.  According to my WAN1 interface.   I am trying to get the DHCP to passthrough to my clients on a vlan, anyone have any luck with this?

Hello guys !I'm new to the VPN environnement, and trying to configure a site-to-site VPN tunnel between two Fortigate 60D.At the step "Pre-shared-key", I don't know if it's a specific key to the device (in that case where can i find it ?) or it's a secret word that i can randomly create and share between the two fortigates.I know that the PSK must be shared before any login/pasword authentification, but my question is:Where to get the PSK from ? Or I can create it myself ? Thanks !

Hello all. A lot of remote access IPsec clients see random phase2 down messages. I was wondering how do i go about getting to the root cause of each phase2 down instance? I'd like to know if it was just due to DPD deciding FGT can't see the client for a period of time so it yanks the tunnel down or whatever else might cause it. Usually when DPD's the culprit, I see log messages about it prior to the phase2 down message. Can anyone point me in the right direction?