Solved

Hi guys,I have an issue about fortigate rules.First of all i'm using fortigate in our edge network and before that was mikrotik routerboard.Mikrotik had a feature that was usable for me. now i have 3 internet connections links for typical solution. for specific issue i marked packets from each interface by mangle an and for backing route to packet's source sent it to the interface that it came.i'm searching for similar approach to solve this issue . anybody have idea for that.Thanks,

HiWe're currently comparing Forticlient and Z-scaler for client security. Was hoping to hear some stories from real users/admins.We have around 50.000 users all around the globe and I was wondering:[ul]How's the management platform, is it easy to understand and manage?Has there been any serious bugs or annoyances?Any weaknesses/limitations in the product that we should know about?How long does it take from updating the policy to it reaching the client?Which method do you use to authenticate the clients when they are outside the office? Is there any issues with said method?We have a bunch of local security products already and it would take considerable political efforts before we can replace them. Would you consider the client to be heavy if only using it for Web filtering/Sandbox:ing?Anything else I should be aware of?[/ul]I know these are very generic questions but I am grateful for any input. Thank you! Kind regards,Patrik

Hi All,As show below pictureFortigate 1 port 1 connects to Cisco switch G1/0/1Fortigate 1 port 2 connects to Cisco switch G2/0/1Fortigate 2 port 1 connects to Cisco switch G1/0/2Fortigate 2 port 2 connects to Cisco switch G2/0/2 My questions are1) My fortigates work on Active-Active mode, port 1 and port 2 are set as  1 802.3ad aggragate port. What should I configure my switch ports? All the four ports in one channel group? Or G1/0/1 and G2/0/1 in one channel group, G1/0/2 and G2/0/2 in other channel group? 2)  If my fortigates work on Active-Passive mode, port 1 and port 2 are set as  1 802.3ad aggragate port. What should I configure my switch ports? All the four ports in one channel group? Or G1/0/1 and G2/0/1 in one channel group, G1/0/2 and G2/0/2 in other channel group? Thanks in advance!  Best regards

Hi all,I am new to Fortinet products,  in particular the Fortigate60E running OS6.0.0 build 0076.  My client who has this device is looking to setup Backstop CRM and they require port 443 be open to their addresses for their program to run properly.  This is the info posted on their webquestionaire Permit your firewall to allow the following Backstop IP addresses US Office Network IP: 38.98.151.64/28 US Production Network IP: 64.27.172.240/28, 216.34.179.0/25 Port: 443[/ul]I was told opening traffic to incoming traffic is most important but if it can be setup to allow traffic both to and from those addresses on port 443 that would be optimal. Tried poking around but it is not obvious how to accomplish this.   Andrew Bernstein 

Hi! I am running tunnel mode ssl vpn without adding static route of my SSL VPN subnet pointing to ssl.root and everything works fine. whats the use of setting up this static route? thanks

Hello guys, I am facing the following challenge and can't get any further. I hope you can help me. I want to connect a VPN between a virtual server (hosted Windows Server 2016) and a data center.The virtual server has no VPN capability. With FortiClient I was able to establish the connection to the data center via IPSec,but it takes the IP of the data center when it goes out to the Internet. What do I have to change or how do I get it that he keeps his IP? Or is there another way, I have a FortiGate 50E in the datacenter. Thank you very much for your help.

All, we recently recieved new Fortigate appliances with FortiOS 6.0 installed.  We were not able to add them into the FortiManager because they are newer than the FortiManager itself. If I upgrade the FortiManager, will I lose connection to my existing appliances that are running older versions of FortiOS?   FortiManager Version: v5.6.6-build1750 181002 (GA) All of my current appliances: FortiGate 5.6.6,build1630 (GA) so what is the upgrade path to 6.0 when using FortiManager?

I'm now about to purchase a 60D with licensing until the end of the year.I'd like to wipe the device for security purposes.How would I re-register the device afterwards, and transfer the license to our business account? 

Hello, I need update my box FGT1500D from 5.4.5 to 6.0.4 version. So I wonder how is better way to reach this ?I think I have to format my box upload 6.0.4 firmware and reconfigure all from zero. but, at the support page tips to do step-by-step from 5.4.5 >5.6.2>5.6.6>6.0.4 by Web interface.Anyone update from 5.4 version to 6.0 version ? How Have you done ?

Hi All,We are using Fortinet 300E and another for fail over, i just want to know how to add a lease line which we bought only for to access a application from outside but it should not effect the current setup or effecting our LAn or WAN.We already have two line. Please help.

our antivirus guy will send me alerts from symantec. sometimes it gets these hits[Somebody is scanning your computer. Your computer's TCP ports: 10000, 8910, 70, 32774 and 59906 have been scanned from xxx.xx.1.2.]   xxx.xx.1.2 is the firewall. If i put the host ip that is affected in the forwarded traffic in fortiview I do not see the event listed at the time. is this just some wild traffic from the firewall or could it be something to worry about?

I've also posted this in the VPN section as I'm not sure if the problem is with the SSLVPN config or LDAP... I've got three 80C's in three offices around the world.  All are configured identically as far as SSL VPN goes and all were working in the past.  They all authenticate against the same LDAP server where users who are members of the "VPN Users" group are allowed to log in.  I recently upgraded the firmware on one firewall from 5.4.4 to 5.4.6 and it appears it's been since this time that I can no longer log in to that firewall while the other two still work fine.  When I try on this firewall, I get a "Permission denied" error and the logs on the firewall also show the permission is denied with a "SSL user failed to log in" message. If I run a tcpdump on the directory server, I see some initial back and forth which I assume is the handshake, then I see a couple of packets from the firewall that get responded to via the directory server as ICMP host unr

Hi Everyone,  I have a 200E deployed and we have two separate static ISP connections coming in from the same provider, utilizing the same GW. I have two LANS set up, with identical static routes[ul]0.0.0.0/0 - GW - WAN10.0.0.0/0 - GW - WAN2[/ul]And IPV4 policies[ul]Lan1 - Wan1 - all -all -always -all -accept -NAT - Use Outgoing InterfaceLan2 - Wan2 - all -all -always -all -accept -NAT - Use Outgoing Interface[/ul] Issue is that  I can only get to the internet on one of LAN1-WAN1 network, the secondary LAN wont connect/ping to the internet.

Hi !, I'am french and I'am sorry I do not speak very well English. I have a Fortigate 30E in 6.0.4 release. I would like to remove my operator modem to replace it with my Fortigate.I have a ADSL2+ line with French Operator. I have a phone jack with an adsl filter and a RJ11 to RJ45 cable connector. It's possible to connect the RJ45 on the wan port of my fortigate ? I have the information about my ADSL line (IP, Gateway, Protocole...) When I connect the cable rj45 on the wan port of my fortigate, no led flashes, everything must be configured for the port to flash? Look at the pictures, https://ibb.co/9HzdhYkThanks ! 

Hi guys, Newbie in Fortinet wireless. I have been browsing and saw that there are three options for managing FortiAPs, namely: FortiGate, FortiWLC and FortiCloud.[ol]I don't want to know deep details, but, what are the main differences between them? The Fortinet documentation doesn't mention these main differences, just says FortiWLC is desired for complex designs.Does the three controllers above support the same FortiAPs models?Do I need to change the firmware of the FortiAP depending on the controller I will use?If I am managing my FortiAPs through FortiCloud and my subscription expires, will the FortiAPs stop functioning?Do the FortiAPs recognize layer 7 applications when managed by three controllers above?[/ol]Regards,Julián

Hi,  I am finding the new 5.4 documentation little confusing. So I am not sure if can we use mix of security profiles in flow & proxy mode. Like we would like to use App-Control,IPS in Flow mode but web-filtering & AV scanning in proxy mode for maximum security.  Is this configuration supported.  Kindly please let me know.  Regards Sebastan

Hi there,for example i have this (after upgrading 5.4 to 5.6)    edit "auth-rule4pol7"        set srcaddr "Inside-Network-Clients" "Inside-Network-Server" "VPNs"        set ip-based disable        set active-auth-method "auth-sch4pol7"    next    edit "auth-rule4pol3"        set srcaddr "Inside-Network-Clients" "Inside-Network-Server" "VPNs"        set ip-based disable        set active-auth-method "auth-sch4pol3"So basically both has the same criteria...so both may fit. Now i have watched at my previous explicit Proxy rules, there is not mentioned which authentication rule will be used. So how do i prioritise the authentication rule over another one? Or how do i say this Proxy policy should use this rule like it was in 5.4? Hope

Hi Guys, i need help because after i've connected a second wan internet connection to split and force my guest lan to navigate with the new line and divide traffic with administrative lan, the forwarding traffic outside from my office stopped work. After that my fw stopped to route the internal lan  traffic to outside. My settings are these:wan1: 10.0.0.200 gw: 10.0.0.1lan2 (configured as wan interface): fw address 192.168.1.200 gw: 192.168.1.1 Lan1 (internal lan): 192.168.0.xlan3 (guest lan): 192.168.100.x Static routes:0.0.0.0/0 to wan1 10.0.0.1 (ip modem) - distance 10.0.0.0.0/0 to lan2 192.168.1.1 (ip modem) - distance 10. address configuration:i've define an address corresponding to my lan3 ip range "LANGUEST" = 192.168.100.0/24 Policy Routes:From:lan3("LANGUEST") to --> lan2 (wan guest) ALL | always | ALL --> acceptimplicit deny allFrom:lan1(internal) to --> wan1 ALL | always | ALL --> AcceptFrom:lan1(internal to --> lan2 (wan gue

hello guys,here i am searching for what is the best windows antivirus software for windows 10 ? for your windows 10 operating system. in the latest version you need to protect your operating system. so i want to discuss with which antivirus software you have and what's your opinion to other which antivirus you provide them. also i am using he bit-defender antivirus for my windows 10 operating system and now switch to the other antivirus software. so i just want to know which antivirus is best and which is similar to the bit-defender antivirus. i using the bit-defender antivirus since 2 years now and going to buy new antivirus program. so if you know about the answer of this question please answer this question. this answer is suggest me which antivirus which my windows 10 operating system.i also tried the malware-bytes. it's really hard to find the best antivirus software when you using the bit-defender. 

I have a report that I want to filter to specific networks that have been identified using the Address Group feature. I used filters Log messages that match any of the conditions - Log Field: Address Group (adgroup) equal to Business Networks I expected this to be as simple as that, but my reports still show IP addresses that are not in the Business Networks address group. What am I missing?Device is FortiGate-200EFortiAnalyzer is the latest version 

Dear Concern, We have a fortigate 300C over which we are able to receive broadcast on physical interfaces from our server on specific UDP ports. We have our clients connecting to us on our Fortigate via public network (Internet). Client connect us on on Dialup ipsec tunnel using Forti client from their respective end points and we want to forward the same broadcast information to them. When the VPN is connected clients are not able to receive real time broadcast on their systems. When the same client IP is connected directly without VPN on firewall, broadcast starts forwarding but on VPN the numbers are stuck unless we close the application from client and restart it. Upon restart the numbers that appear on the screen are different from the previous one which means that the numbers have refreshed. We have enabled broadcast forward on tunnel and physical interface but still no luck. Please suggest any way we can receive broadcast with dst IP 255.255.255.255 from appl

I have got FortiClient to connect to my enterprise VPN, but I can not connect through my router. The error message is: VPN has "trouble connecting with the remote gateway, retrying now..." The connection through a mobile phone net is successful. Are there any settings, I should do on the router?Thanks

Hi, this seems like a real noob question, however I can't seem to find a simple answer.I understand that Forticlient is end point protection that requires licensing.Is it safe to assume you can simply use Forticlient software as the VPN client without any special licensing - should you desire it?

Hello. We are trying to achieve the following: traffic between hosts (a bunch of VMs, actually) has to be proctected by a firewall, but these hosts are located in the same L2 VLAN and use a matching L3 addressing subnet. The problem is not that we simply need to isolate the hosts that belong to the same VLAN (Private VLANs could be used for this purpose), they still need to communicate with each other and we need to firewall all of their communication. Further segmentation of the VLAN (into smaller networks) is just not feasible. Does anyone have an idea how to do this the best way in the Fortigate world? Would any features of the "new" Security Fabric be of any use here? Thanks for your help!

in my organization more than 4000 thin clients  hp t5570e with Windows Embedded installed i really need to block their traffic to WAN  Desirably all traffic  what is the best practicy of doing thatby OS, hostnmae (all of theor hostname starts with HP-XXXXXXXXXXXXX), or by mac address (mac also statc like ab:cd-ef:xx:xx)any help would be greatly appreciated