Solved

Hi,  We newly connected via IPsec VPN with multiple subnets on both sides. I used the VPN Wizzard to establish the VPN and the Tunnelstatus shows up But of course this is only an indication of the whole as multiple Phase 2 Selectors have been entered. Most of it is working fine. But yes you guessed it 1 of the 9 Subnets on my side is unreachable.Is there a way to see the status of the indvidual Phase 2 Selectors ??

Hello, i have a FortiGate 60E (v5.6.3 build1547 (GA)) and i want to kick clients out of my network after 30 mins, and i don't want them to reconnect until 24 hour is passed. any advice?Thanks in advance. 

HI FortiGuys, One of my clients wanted to block fb but without using ssl inspection as he didn't want to install the cert to 100s of his staff computers. I explained that with that there would be no other way to get it done. Then to convince the client I opened a fortinet ticket and got the same response that this can't be done without the ssl inspection and cert installation. Now this guy hired some other service provider and those guys simply blocked social media signatures in app control and applied it to the policy and IT HAS WORKED. It doesn't say "fortiguard blocked" but just keeps the loading icon spinning and fb doesn't load at all. The whole situation is turning so embarrassing. Please tell me if this is a proper workaround? Will this work in the long term? How is this even working, looks like the browser simply doesn't complete the request in some way. Please any explanation here, thanks.

https://docs.fortinet.com...r-v5.6.1-release-notes

Hi there, I'm setting up a new Fortimail unit and I want to set it in Gateway mode. I have a DNS record mail.mydomain.com that currently is pointed to my mail server via a virtual IP set up in my Fortigate. I don't particularly want to change my MX record to the FDQN of my Fortimail, because I have users out in the field who need to be able to access the webmail site for my Zimbra server. Is there another way of setting this up in Gateway mode without having to change my MX record? Thanks in advance for the help.

Hi, This may be a dumb question, but I just want to confirm - is End of Life the same as End of Support? https://support.fortinet..../ProductLifeCycle.aspx

Hi Is it possible to extend default address (50 address per page) view of in Fortigate 200E, OS version 5.6.2. Means I want to see all address in a single page.

Hello everyone, i need to build a new customer environment, wheree a SSL-VPN with FortiToken-Mobile as a second factor for authentication need to be implemented.Unfortunately the new customer has more than 200 Employees, which means it would be a lot of clicking-work to import all the LDAP users and assign a FortiToken-Mobile to the account and send the Activation-Code. And directly adding an AD Group wouldn't help either...My Question is if there is an easy (lazy) way to import so much Users, assign them FortiToken-Mobile and send the Activation Codes?We managed another customer with regular FortiTokens where a FortiAuthenticator reads the Token-SN from an extra field from the user attributes, but i couldn't figure out how this would work with mobile tokens. Looking forward for your reply'sThank You

This question has been answered before in that FortiGate requires one to maintain identical licensing in an HA pair. So my question is more specific. What happens if you don't? I am fine if the secondary [non-licensed] device gets promoted to primary and all the FortiGuard services stop working, I will promote the licensed one to primary or get a replacement if it dies. I can live with the non-licensed device being primary for a little while. Anything else that I might need to think about? I don't need support from FortiCare with the non-licensed device, since any issues will be handled on the licensed one always acting as primary. Thoughts? And by thoughts, I don't need advice like just license both of them you cheapskate or similar. Thanks.

Hello, Is there a equivalent for diagnose sys checkused sys.int.name INTERFACE_NAME on the new FortiOS 5.6? This is a handy command and I can't run it on 5.6. It was removed? Thanks,

Hello,we are migrating to FortiGate and I am trying to implement the common scenario with DHCP which we use. We want to have reserved IP addresses for known clients, but assign a dedicated sub-range for unknown clients. E.g. on interface 192.168.1.0/24 we have reserved addresses for known clients from lower half 192.168.1.2-127. But for unknown clients I need DHCP to assign addresses higher than 128, e.g. 192.168.1.129. I have implemented this using various DHCP servers without problem in the past (even cheap routers).I tried to set this up the way I used to on other devices by restricted DHCP range and reservations out of this range. But GUI complains that reserved address is out of DHCP range. I have been searching the forum and it seems that FortGate isn't able to fulfil this requirement. But I would like to confirm this before I start thinking about workarounds.The main reason for this scenario is to preserve the simplicity of DHCP, but give unknown clients slightly more strict pol

Hello, I'm planning to deploy a Fortigate-3000D Firewall that will  support around 40 concurrent Site-to-Site IPsec VPNs. The question is to know whether an special license is required for these 40 concurrent VPNs. I've been unable to find a right information for this particular issue.Best regards.Albert.

Hi! I have a Fortigate-50B (system 4.0 MR3) model, and I have to open ports like 8080, 993,465 because these ports are not listed at "Predefined" into "Services". All this traffic is being blocked by the firewall.  I tried to create port 8080 into "Custom", by defining the source and destination port low/high with 8080, but after I placing in a Policy nothing changes and the port continue to be blocked. What should I do for make this simple task? Thank you.

Hello.We have a problem on FortiOS 5.6.3 with LDAP admin accounts. When the admin tries to login into the firewall the login is accepted but a password change is requested: This Account is using the default password, it is strongly recommended that you change your password. Does anyone to know why it is happening?  

Hello,I tried to set a new Global policy package (or even edit the default one) and I noticed that FMG did not give me any option to set the CNAT policy (the Admin Guide says that it should). Then I created a policy package inside a certain ADOM, but when I changed that CNAT settings, I got the error "Global adom package CNAT is not consistent with local adom package CNAT" I got a similar error when tried to change the inspection mode from flow to proxy. Do you know how can I set the NAT or the inspection mode, so that there is no conflict between the Global ADOM and a certain ADOM? Furthermore, when I have multiple ADOMs, others with CNAT, others without CNAT, others in proxy mode, others in flow mode, how can I coordinate each ADOM settings with the Global ADOM settings? Finally, it seems that in FMG 5.6 the Global ADOM refers to 5.6 also. Can we have multiple Global ADOMs, each one for every f/w version? Does this functionality make any sense at all? ThanksAndrea

Hi guys  I am currently in the process of rolling out FortiClient as an antivirus software for a company. I have setup an Endpoint profile for their servers. The profile enables AV.  I am looking for a way to exclude folders on different servers in a single Endpoint profile. I want to keep the Endpoint profiles to at a minimum. As far as I can see in the Administration Guide we're able to exclude folders and files using local paths and wildcards and not on UNC paths (not sure that would even make sense). In both senarios I have a Endpoint profile which enables AV. Senario 1:On ServerA I want to exclude C:\path\to\Software which is a software directory. On ServerB I do not want to exclude anything. I do not have the directory C:\path\to\Software. Both servers get the same Endpoint profile. Under the Endpoint Profile the AV execlude the following path: C:\path\to\Software My question: Will the AV on ServerB just disregard the exclude

hello Dears,we want to do fortigate POC for one of our customer, we have configured the SPAN session on the cisco switch by a source mentioning all the vlans and the destination port is the fortigate port17, Now i dont see any traffic coming to the firewall, what configuration has to be done on the fortigate end to accept packets, in Paloalto firewall i have a interface type as a TAP which i select and it accepts traffic but for fortigate firewall what has to be done. thanks

Hello. Friends, sorry for my English, i am from Russia and English is not my hight skill) I have FortiWiFi 61E withFirmwarev5.6.3 build1547 (GA)ModeNAT (Flow-based) I can't to create 2 and more web filter profile, only modify default. I don't see buton "add". On FortiGate 300D available button "add/clone" but on 61e button is no present. How can i create more than 1 profile? 

Hello. In my branch office network i have 2 LAN network (192.168.20.x and 192.168.110.x) and 2 WAN provider. I want use first ISP for VPN connet to Main Office and Second ISP for user WEB access. Please help me how it make?

Hi experts, I am troubleshooting an issue with FSSO and usernames, and I realized that the customer's DNS where the FSSO is installed is a mess, some workstations with 2 IPs (2 A records), others with 6 IPs, and most of them with wrong IP addresses (wrong A records). I would like to know if this is the main thing I have to troubleshoot, or if this is the repository where the collector agent is fed to link usernames and IP addresses. Please can you confirm? Regards,Julián

Hi all, I am new here, also new when it comes to using fortinet devices, A quick history.I am an IT in a small company and recently we ask our ISP to install us a firewall and so they set up a FWF 30E. I am so noob on the device that I rarely touch settings although they gave us an access.And recently our wifi started to act funny so I login to the device and check some settings, I was following a tutorial on fortinet cookbook which is available online when I might have mess up on settings on dedicated to fortiswitch,  on the location: Network>Interfaces>dedicated to fortiswitch I remembered selecting LAN on the Role option then click save then alas!next minute I couldn't access to the gui interface anymore.So now here's the several problem it cause:PC which is set to DHCP couldn't connect to the internet anymore, their IP address change incl default gateway so I have to set a static IP and the default gateway which is 10.10.1.254 - where I used to access the fortinet a

Hi I am new to FortiGate firewalls. We are planning to upgrade the existing FW which is FG300C 5.2.2 to FG300E latest fortios. I would like to know if there is any recommendation that i have to consider or some procedure which i can follow for the upgrade. Thank you 

Hi,Can anybody tell me the difference between FortiGate D Series and FortiGate E Series and which one is better in features and performance? Need your kind response as i have to suggest the best Fortigate series to the customer.Thank You 

Hi,Can anybody tell me the difference between FortiGate D Series and FortiGate E Series and which one is better in features and performance? Need your kind response as i have to suggest the best Fortigate series to the customer.Thank You

Quick query... What does the "set inter-controller-mode l2-roaming" command do?I cannot find any documentation relating to it. config wireless-controller inter-controller set inter-controller-mode l2-roaming set inter-controller-key ENC XXXXXXX set inter-controller-pri primary set fast-failover-max 10 set fast-failover-wait 10 end Regards, Pete