Solved

Hello Is it possible to have an VIP that redirect incoming WAN traffic on 443 to an internal server AND using 443 to SSL VPN traffic? Right now we are using 10443, which works fine but problems arise when our road warriors are behind external firewalls on hotels, trains e.g that block 10443. Almost every firewall allows 443, which is why we want the change. I presented the idea to maintain SSL 10443 (more secure than 443) and create an IPsec tunnel, that users could attempt to use in case 10443 was blocked, but the idea was shutdown by they probably block IPsec ports as well. Anyone know a workaround?

Just wondeirng about Application Control is it free with a Fortigate 60E or part of a UTM package?  Also for a SMB is it needed they users cant install any software so should it just be set to monitor ratehr than blocking apps?

Hi,  We are planning a FG3960E for a customer. Customer is curious about  mgmt interface IP design.Does anyone know if FG3960E mgmt interface have dedicated route table from other VDOM ?Thanks in advance. Todd 

I manage a FortiWifi 61e with two connections over LAN and one over WAN.What prompts me to ask a question here is that in one of the LAN connections the speed is at 100mb / s instead of 1gb / s.Cables with category 6 and the switch to which the Fortigate is also connected to 1GB.When connecting a computer to the cable that connects to the Fortigate it marks speed of 1gb / s and all the equipment that I have connected to the switch mark speed of 1Gb / sDo you know why that LAN connection is not connected to 1Gg / s?

Hi guys,I'm asking is the "Adapter AC power supply" included in the forticare support coverage or not?Thanks.

Greetings Tech Wizards! Been a partner a few years and I have a number of older models.  Most are 40c or FWF 40 or 60 C.  Prior to joining FortiCloud I had upgraded one beyond 5.2 and had high CPU issues and had to roll back.  I have some newer units on the newer OSs and I like the features, but not having them has not been horrible.  Most of my clients are Small Business and I keep them on current contracts with Intrusion Prevention, Spam and AV etc. My question:  Is it safe to stay on the older OS as they haven't done any patch for this in a while? Thanks!Tom

Hello,We have SSL-VPN configured and working just fine, until today morning the Public IP gives (request time out) when pinging it,I've reviewed the policy and everything is as it should, clients can establish VPN connection after several attempts although the wan's IP is not responding, what seems to be the issue here ? Big thanks. 

I have a running VPN between 2 sites 2x FGT60C; Primary site have DynDNS with publig ip on FG's WAN interface. Remote site have internal IP behind a NAT-device controlled by the ISP. Due to limitation regarding interface routing and Policybased routing for DialIn I have configured both ends with normal DynDNS-ipsec. Everything works mostly fine and stable. I have devices on the remote site which frequently poll both the Primary site via VPN and external web-services "directly". Unfortunately it happening sometimes (1-2 times a week) that the vpn goes down without comming up again. Since remote end only is available through VPN; I am not able to manage remote end when the vpn is down. "diag sniffer packet any "src host remoteIP" on primary site indicates that the remote end does not try to recreate the tunnel. I could do a remote power-Cycle with a GSM-controlled socket; after power-cycle the tunnel cames up again. What can I do to trig automativ reconnection of remote sit

I'm used to configuring IPSec tunnels manually, and specifying encapsulation, hash, etc.  I have Fortigate 30e firewalls, and whenever you select "Create new" under "IPSec tunnels" it takes you to the Wizard.  This is fine, but if I want to use an undocumented client on Linux such as Openswan or Shrewsoft, I can't find the detailed phase 1 and phase 2 configs.  It appears that some configuration details are "baked in" and not displayed when you dump the configuration. Is there some documentation as to what is used for all IPSec config attributes? For example, DES, 3DES, etc. Thanks

FAZ VM64 (VMware), version 6.0.2. Only the built-in "Super_User" administrator profile group has access to reports.  If I clone that group, or if I create a new one, and confirm that all profile options are set to "read/write", users of that new profile cannot see or create any reports.  Is this normal?  I am not using multiple ADOMs; just the root. I want to create a separate user profile to only allow those users to log in and see/create/run reports.  It's almost like the file system has "Super_User" as the only group set with the correct file/folder permissions, and any new "profile" created within the GUI fails to initiate the "chmod" command, or something.  Even the built-in "Standard_User" profile, unchanged, doesn't work (same issues). Any help would be greatly appreciated.

Hi Guys, can anyone give some guidance and instructions regarding the following alert?  Message meets Alert conditionVirus/Worm detected: MSIL/Kryptik.PVO!tr Protocol: "POP3" Email Address From:  Email Address To:VIRUS REFERENCE URL:http://www.fortinet.com/ve?vn=MSIL%2FKryptik.PVO%21trdate=2018-10-23 time=10:42:49 devname=FGT60D*******devid=FGT60D******* logid="0211008192" type="utm" subtype="virus"eventtype="infected" level="warning" vd="root" eventtime=1540302169 msg="File is infected." action="blocked" service="POP3"sessionid=14262919 srcip=192.168.1.106 dstip=46.235.42.203 srcport=50423dstport=110 srcintf="internal" srcintfrole="lan" dstintf="wan1"dstintfrole="wan" policyid=1 proto=6 direction="incoming"filename="QUOTATION.lzh" quarskip="No-skip" virus="MSIL/Kryptik.PVO!tr"dtype="Virus"ref="http://www.fortinet.com/ve?vn=MSIL%2FKryptik.PVO%21tr"virusid=7918466 profile="default"analyticscksum="d4173c2132635a07f864bcf68c9e0cff4b860145bec71574c87727a00e6d426e"analyt

Hi All, I need a granular report that shows logon times and logoff times for the SSL VPN Users. The datasets I have been trying dont seem to be the most recent. Ideally I would like a report showing when users logged in, for how long and when they logged off and from which IP. The standard report only seems to be providing me with two days data as the cache is sitting at 100% for that report, not sure if this will impact my duration of history for the report?

Hello, I’m still somewhat new to the network admin world, so forgive me if this a dumb question. On the Daily report my Fortigate sends me, I see quite a few failed admin logins from external IP’s. Is this something to be concerned about? Is there anything I need to look at doing to fine tune my security? Thanks in advance for the help.

Hey all, I've setup a couple of VIPs with the same external IP to different internal IPs/networks and different ports on a client's firewall running 6.0.3 (previously 6.0.2). One of the VIPs only listens on TCP 7108 and forwards to a server on the Internal LAN.The other VIP listens on 22 and is supposed to forward to a server on the DMZ LAN (ftp over ssh). The issue is that traffic to the second VIP never seems to get to the firewall.  I sniff the IP and port 22, or I sniff the DMZ IP and port 22 and see nothing.  The first VIP to the internal LAN works perfectly. If I set the second VIP to use port 2222 (for example) and forward to 22, this works fine and responds.  The issue is that I need the 22 to 22 to work. The client has limited IPs to work with or I'd consider using a different IP entirely. This, to me, appears to be a bug with forwarding SSH.  I confirmed I have it disabled on all interfaces for management, and don't see a spec

Tengo habilitada en el puesto 1 y 2 por política IPv4 el antivirus, filtro web, filtro dns, app, dlp y ssl (deep inspection) y en el ordenador me funciona todo correctamente una vez instalo el certificado del Firewall. El problema que tengo es con los dispositivos móviles, ya que he puesto una regla (en el puesto 3) para que no le aplique ninguna política de seguridad, sólo tiene configurado el proxy. Este problema es que cada vez que entro en internet me salta el aviso del certificado y si le doy a entrar de todos modos accede a la página web sin problema. Me pasa con Android y iOS. A algunas aplicaciones como WhatsApp, Instagran, etc., puedo usarlas sin problemas

Hello, we are trying to enable a Huawei LTE modem as a backup line with a FGT-60C running FortiOS 4.3.12. The package of the LTE USB stick was labeled " Huawei E392" - which is a device supported by Fortinet. Unfortunately internaly the stick is detected as " Huawei E392-u12" which is NOT supported by Fortinet. Also creating a custom config did not work, when running the command " diag sys modem detect" we always get the message " modem is not attached" . Here are our parameters for the custom config: id = 1 vendor = Huawei model = E392-u12 vendor-id = 12d1 product-id = 151a class-id = ? init-string = ? Any hint for getting this device running is welcome Sincerely Harald

I can't download a working setup of VS Code from the page https://code.visualstudio.com/ because Fortigate replaces a small block from the files with zero bytes. The file comes from URL: https://az764295.vo.msecnd.net/stable/4e9361845dc28659923a300945f84731393e210d/VSCodeSetup-x64-1.26.0.exe After download, the setup returns crc32 error. The digital signatures (file properties) says invalid certificate.If I download the file without fortigate certificate replace (deep ssl) the file is correct. A comparison of the two files (downloaded with and without fortigate) in a hex editor shows at Offset 0xFFE28 is a block of length 432 of zeros bytes replaced from fortigate. Range 0xFFE28 - 0xFFFD7. This code block: 77 04 85 0B 6A 7B 8F 0C 32 F9 25 68 D7 7E BD 47   88 C0 1D 74 A6 52 EA 69 05 83 08 E3 E4 BF 03 3377 99 F4 2A FA 4E 47 D8 DE 99 03 3D 9E 09 9C C3E5 18 94 D2 77 95 73 01 0E E0 EA 8D B0 C3 81 1C9E 9B 49 92 07 5C B0 F5 04 AB 96 D2 53 F9 38 9919 D6 07 99 78 0F 7B

Hi All, I have userbased identity policies using captive portals. I have port 3, port 4 and a VLAN using different portals. These all work fine until I switch it to HTTPS redirect in Authentication then the captive portal throws up a certificate warning. I have run; config vdom edit root config firewall policy edit 16 set auth-redirect-addr test.test.co.uk (not the real address) set auth cert mycert end There is a dns entry on the local DC to point test.test.co.uk to the interface of port 3 (example) Now.... when you turn on HTTPS redirect and try and login you get a warning and invalid cert because the FW goes to xxx.xxx.208.1:1003/FGTAUTH? (lot of numbers) Any ideas anyone.

Hello.Can somebody tell me overall and per port poe-power for FGT-140D-POE device?

Hi Everyone, We have a Fortigate 3950B and 100+ VDOMs on it. Dont have a fortimanager. I want to ban some malicuos IPs (100+) for all VDOMs and these IPs may change every week. Solutions: 1- Go with ACLs on router. (I dont want this solution for some reasons)2-  Define all IPs on all VDOMs and create a firewall deny policy on all VDOMS. (If you dont die before you finish :))3- Create a VDOM. Define all IPs and create a firewall deny policy on this VDOM. Route all other VDOMs' trafic to this VDOM. I have not tried 3rd solution yet. Is this a good solution? Why not?Is there another solution to handle this situation?   Regards  

On our Fortigate 100D running 5.6.3, when I go to Log and Report > Web Filter and add a URL filter, I can only filter by the path or query string, not by the domain. For example, I cannot filter for all logs from example.com, instead I can only filter for example.com/<path>. Is it possible to filter by domain?

Tengo un FortiWifi 61E con la versión v6.0.2 build0163 (GA) y no puedo activar el sensor de DLP ya que no lo veo en las opciones y si voy a Sistema > Visibilidad de características no encuentro la correspondiente a la de DLP. ¿Podrían ayudarme? Auto translate: I can't activate DLP I have a FortiWifi 61E with version v 6.0.2 build0163 (GA) and I can not activate the DLP sensor because I do not see it in the options and if I go to system > Visibility features can not find the corresponding to the DLP.   Could you help me?

Fortigate 100D 5.6I have LAN (VLAN1) and VOICE (VLAN2). VLAN1 is assigned to ports 1-14. Vlan2 is assigned to ports 15-16.VLAN1: 192.168.1.1/24 DHCP Enabled 192.168.1.80 - 192.168.1.254VLAN2: 192.168.0.1/24 DHCP Enabled 192.168.0.50 - 192.168.0.254 Port 15 is mirrored from Port 16. Nothing connected currently.Port 16 is connected to it's own switch and devices.Port 1 is connected to it's own switch and devices.They are only linked by the firewall. The switches are not cross connected. Somehow, PC's on VLAN1 have pulled an IP from VLAN2. I can't get them to drop this IP and it still works, as in they can traverse the network and get to the internet. I have tried unplugging their cables, Windows Troubleshoot and Repair, ip config /release and then renewing. Nothing works. I can tone down the connection and they are plugged into VLAN1. Am I missing something? I should note, this is a fresh Fortigate 100D as the previous one bit the dust and had to be replaced.

I installed Forticlient app to use with one of our customers' VPN.  The customer no longer uses the VPN, and I want to uninstall the Forticlient software.  Client version=6.0.2.0128. I tried using Windows Control Panel, however clicking on the FortiClient app only gives a "Repair" option, and no "Uninstall".   I also checked the \Program Files\FortiClient folder to see if there was an uninstall app, but there is not. Attached a screen shot of what I see in Windows Control Panel. How can I uninstall the FortiClient software?   

Hi, Can you please help me with the scenario that i have. I want to connect a FortiAP with an already existing Cisco APs with same LAN and Same SSID. Is it possible ?