Support Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
New Contributor II

Help with allowing Microsoft activation

NEED:  To allow an external KMS server (we trust the external IP) to communicate back and forth with our internal server subnet for Windows activation, BUT...


PROBLEM: the KMS server has to see the traffic coming to it from a trusted IP-space.  Our firewall external IP is not in their trusted IP-space, and they don't whitelist IPs from other providers.  Can I put policies in place to allow the KMS server to see the IPs of our internal servers?  If so, how?

(faked IPs below)


KMS Server:

Our firewall External IP:   (Fortigate 200E, running FortiOS 7.0.9)

Our internal IP subnet:  (I believe this is considered trusted IP-space, as these are VMs hosted by the same company that has the KMS server)


I should have added, the KMS server only responds on port 1227.


Thanks for the help,





You may consider to configure IPsec tunnel between your site and KMS site. Therefore, there will be no need in NAT/DNAT.



New Contributor

To solve this problem, you can try adjusting the policy on your Fortigate firewall. Go to the Fortigate firewall configuration settings, go to the firewall rules or policies section. Create a new rule that allows outgoing traffic from the server's internal subnet ( to the KMS server ( on port 1227. Make sure that the rule has a higher priority than all existing rules that can block traffic. Apply the changes and save the configuration. If that doesn't help, you can get help from kmsauto, which provides help with Office and Windows activation. I'm sure it will work out for you, and good luck.


Select Forum Responses to become Knowledge Articles!

Select the “Nominate to Knowledge Base” button to recommend a forum post to become a knowledge article.

Top Kudoed Authors