Solved

our fortigate 90E did not last longer than 4 months of service when suddenly stops working. It is not booting up and the STA led not lighting...The PuTTY display (attached here with) shows where it stops booting up. Please help! Thanks much. Biftu  

Hi,what is the difference between nating using VIP or normal nat Thanks

Hi Everyone, In order to test some functionality end user would require to be able to select either 2.4Ghz or 5Ghz band. Therefore what I was thinking to do is create 2 ssid wich each one will be bind to their own band.   ssid 1: mynetwork --> 2.5Ghz band onlyssid 2: mynetwork --> 5Ghz band only Preferably I would like that these 2 ssid are within the same subnet. I know that this could probably be done very easy using bridge mode, but due to the infrastructure, it would be much less pain if I can do it in tunnel mode.  Is this somehting doable to have 2 different ssid belonging to the same subnet in tunnel mode? 

I noticed when I do a speed test my upload speed is always greater than my download. I'm new to FortiGate pls help me with a  solution. 

Hi guys, I'm configuring sd-wan with LB and when i tried to confiugre the static route i get the error attached.i've check from the interfaces that the 2 wan aren't in use in any rules right now but i still get this error.I've follow this guide: https://docs.fortinet.com/document/fortigate/6.0.0/cookbook/990932/redundant-internet-with-sd-wanPlease anyone could help me to understand this error? Thank you very much!Michele. 

Good Day I was wondering if anybody can help me as I am new to fortigate I have two fortigates, one at hq and one at branch HQ public ip 41.138.x.xLocal Lan : 192.168.1.0/24 Remote site public ip 86.179.x.xLocal Lan : 192.168.1.0/24VLAN20 : 192.168.20.0/24 I have setup an IPSEC vpn between the two site with phase 2 selectors of 0.0.0.0/0 Now I need to route all internet traffic from vlan 20 over the VPN tunnel so that it looks like vlan20 is coming from my HQ's public IP.  Can someone perhaps guide me how to setup static routes and which policies i should create to route all traffic from vlan20 over the tunnel. The local lan on the remote gate does not need to go through tunnel Many thanks in advance

Hi,I have a strange issue regarding ospf . I had a connected interface in one vdom (vdom B) , Later I removed this interface from the VDOM and assigned  to another device (R1) and advertised in ospf . Now this ip address can see in the routing table of vdom A but not on B .(it s not even seen  in the OSPF database of VDOM B. R1--------vdomA------vdom b.What could be the problem . Thanks

I'm trying to test a VIP on a Fortigate 310B v.5.2.2 but I am getting "A duplicate Entry Already Exists" I don't even want to apply the VIP to a policy at the moment I just want the VIP in place to make an IP change. Is there a way to crate a VIP when there is a duplicate external IP? Thanks 

Hello, I need to connect an ADSL modem to my fortigate 310B, I currently have 2 dedicated links and that's where my traffic comes out with a load balancing. But I need this ADSL to send some of my users through that link. Is this what I'm trying to do? Until now what I am, I connected the modem to a port of the fortigate, but it does not give an exit to internte, I suppose it is for lack of some rules or route? Thank you....

Hrm. Upgraded a little 60D dev firewall to 5.2 to give it a test drive. One of the first things I' ve noticed is that the packet capture menu that used to be under System > Network isn' t there any longer. I checked the 5.2 docs -- and it looks like that' s where it' s still *supposed* to be. Also checked the admin profile to make sure the super_admin profile still had " packet capture configuration" permissions (it does). Bug? Or am I just missing something.

Does anyone else also having the issue that the WAN IP is never showing up in the System Information Widget with 5.6.2?  ThxWayne

Hello, all: This question is against the very grain of my soul, but I have to ask. In all cases (except this one), I setup very strict security rules to keep the networks I manage safe: very limited ports and services allowed, using web and DNS filters, etc. I am asked to put in a Fortigate without knowing very little about the network. As best I can describe what I am being told, it should have the look and feel of two residential networks sharing one ISP. I can't make any other assumptions. I really cannot rule out things like custom apps or communications that have the look/feel of a game potentially. I've started by just allowing all services in the IP4 policies, with AV, default DNS and SSL set (see attachment)  I will not have any easy access to this location should I need to adjust or correct for anything. And the location owner would be very demanding in something being addressed with all haste (this is as diplomatically as I can put that). They ha

Good day Al We will be peering at out NAP provider over the next few days and they required the following to be configured on out layer 3 interface. no ip redirectsno ip proxy-arpno ip directed-broadcastno mop enable What the equivalent commands for the Fortigate, the above commands are for a Cisco. Thanks

Hi Guys, I need to configure a Fortigate 30D with the configuration steps in the link below (80CM): http://kb.fortinet.com/kb/microsites/microsite.do?cmd=displayKC&externalId=FD33377 I don't need the IPTV feature, just internet. Are the steps straight forward as the link? or do I need CLI to program. Currently the 30D is not with me, thus I cant test. Thanks for your help. Ken

Hello!We have a fortgate 100D with FortiOS v5.6.9 build1673 (GA) In the Web Filter "Bandwidth Consuming" is "Streaming Media and Download" blocked. In the URL Filter I allowed youtube, but I always get the message "Web Page Blocked"! How do I unlock youtube?

Hello , I want create a report in Forti Analyser to see if a policy is used or hit, so that i can remove the unused policies. Kind Regards, Vincent 

Does anyone know how to view ciphers for access to HA cluster from client ?I configured below. and I would like to know whether what kind of ciphers it can be avairable.config system global   set strong-crypto enableconfig system global     set admin-https-ssl-versions tlsv1-2 thank you

Hi All Currently one of my client provide us an information of network diagram which include multiple and used Fortigate as gateway and routing for vlan as show from screenshot. My question is does different VLAN able to act as gateway without any interface IP for each VLAN connectivity? 

60E on 6.0.4.  I am using the FGT as DHCP server.  The FGT itself has timezone and offset (-5 hours Eastern) and reflects the correct time in the dashboard.  The DHCP server on the FGT is defined with "set timezone-option specify" and "set timezone 12" where "12" corresponds to -5 Eastern per "set timezone ?". The problem is, the FGT DHCP server is sending out option 2 time offset of -14400s which is -4  hours.  I've confirmed this with a packet capture made on the FGT and viewed in WireShark.  It should be sending -18000s or -5 hours. If I set the DHCP server to "set timezone-option default" I still have the same problem, the time offset is still -4 Anyone seen this issue before?

1. You will still get spam and no matter what you do it just keeps coming.2. You call support and report said SPAM and they either blame you, tell you that you need another license, or change a setting that breaks something else.3. You will spend a lot of your companies money and after they have the product a while you will be fired for incompetence.4. You could burn the money and have the same results.5. Because it like everything else Fortinet will sound great in sales meetings and fail to perform. Case in point is my wireless that still cannot handle streaming media or my Fortiswitch that failed after trying to update the firmware brand new out of the box (thanks for shipping old junk)6. Cisco If I am wrong I would love to retract my statements but 6 months into my job and I have to monitor the fortimail every day for hours while valid email gets held up and SPAM walks right through it. If anyone has any suggestions I would love to hear them because I am about ready to rip my g

Hi all, We are in the process of migrating a multi-tenant network from an old Sonicwall and looking for better alternatives. I really want to give Fortigates a go but i'm unsure whether it will satisfy our requirements, could not find config examples online. The public subnets we are given by the ISP are: Public main WAN subnet 1: 1.0.0.0/29Public ISP routed subnet 2: 2.0.0.0/30Public ISP routed subnet 3: 3.0.0.0/30 I've assigned subnets 2 & 3 to tenants' 2 & 3 gateway device, for example tenant 3 has a Draytek sitting behind the Sonicwall with a public IP address of 3.0.0.2 on it (3.0.0.1 is the Sonicwall). We needs to be able to do his own NAT. The way I've done this on the Sonicwall is shown here: http://help.sonicwall.com/help/sw/eng/6500/25/9/0/content/Ch27_Network_Interfaces.031.39.html Is there any way of doing this on the Fortigate and have a public subnet assigned to an internal host/VLAN/interface while bypassing the WAN interfa

Hello, I wonder what does FDS stand for from output of diagnose sys top?  regards,

Hello everyone ! I am on version 6.2.0 of FortiOS. I created the SD-WAN interface and added the 3 existing interfaces, the internet link, the vpn and the link mpls. I created the required policies with NAT. I am having a problem on the MPLS link that I do not want to NAT because it is in my internal network. Is it possible to NAT on the internet links but not on the MPLS interface? [&o] Thanks in advance and have a good day!

Hello All, I am trying to understand if it is possible to export all configuration related with NATs, for example the Virtual IPs and IP pools.From Fortimanager can only export Firewall rules. Thanks in advance

We have a FortiWiFi serving about 8 users running FortiOS 6.04. The bandwidth at the location is fast: 300/20. The firewall is set to Proxy. We noticed on about 4 different occasions that when trying to download a file from a remote server (connected via WAN1) that the download would take an exceptional long time or would fail. This occurred on multiple computer on the network, different browsers, different source servers, over a number of days. This happened even when no other activity was taking place on the network at the time. We finally did some testing. We noticed that when downloading with AV and Web Filter security profiles Off in the IPv4 Policy that the download speed was about 18 Mb/s. With either AV and Web Filter security profiles On in the IPv4 Policy the download speed was initially 1 Mb/s. After about a minute though the speed would fall from 1 Mb/s all the way down to 5 Kb/s. We further isolated the performance impact to the HTTP inspection in the AV Profile.