Solved

Hi Guys First post here so please go easy on me! ;) I'd like to be able to create a report that contains a chart the number of denied connection attemps that are made, per country, from the internet.   From Log View I'm able to see this information by putting in either of the following filters:smart_action="Policy violation" -srccountry=Reserved orsmart_action="Policy violation" -srcip=172.16.0.0/12,10.0.0.0/8,192.168.0.0/16 When I click on 'chart builder' I see the following queries: select `srccountry`, `dstip`, `service` from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and ( ( ( (`action`='deny') )) AND (lower(`srccountry`) != lower('Reserved'))) select `srccountry`, `dstip`, `service` from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and ( ( ( (`action`='deny') )) AND (not (`srcip` <<= inet('172.16.0.0/12'))) AND (not (`srcip` <<= inet('10.0.0.0/8'))) AND (not (`srcip` <<= inet('192.168.

Hello, we have a bunch of Fortigate devices which are logging several times (about 100k logs in 15 minutes, each device) on our logging platform (we use ELK), and this is overwhelming the disk space. How can we disable the logging on the "default deny policy' in order to stop these logs? Below is the log message that is filling our disk space: <189>date=2015-07-30 time=10:24:41 devname=fw01-xpto devid=FGT60XXXXXXXXXXX logid=0001000014 type=traffic subtype=local level=notice vd=root srcip=XXX.XXX.XXX.XXX srcport=137 srcintf="internal1" dstip=YYY.YYY.YYY.YYY dstport=137 dstintf="root" sessionid=2253947840 action=deny policyid=0 dstcountry="Reserved" srccountry="Reserved" trandisp=noop service="137/udp" proto=17 app="netbios forward" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 Thanks!!

Hi, Fortinet GURU's    Could anyone please help me out here?     I created FortiAnalyzer (BYOL) instance on AWS and allocated 200G volume for the instance in the first place. Then I created 2 50G ADOM's on FortiAnalyzer. Everything worked fine. Each VDOM was assigned to one ADOM and logs were sent to FortiAnalyzer.     I wanted to create more ADOM's with 50G each, however, there's only 1GB available left. I stopped the instance and increase the volume from 200G to 250G and then restart the FortiAnalyzer instance. The weird thing was that FortiAnalyzer didn't seem to detect the increased volume. It still showed "1GB available".     What should I do next? I searched some documents which mentioned "RAID". But from my 5.6.5 FortiAnalyzer GUI, there's no such "RAID management" option under "system settings"...     Much appreciate for any guidance! 

hello there, I am wondering if it is possible to get multiple sites connected to one HQ with VPN. As i only see the Site-to-Site wizard, where you have to say what is the IP of the branche office, I am not sure how to do that. DO i just need to redo the same wizward, with the same local IP but different branche IP? Thanks,Raffael

Hello, I am wondering whether the VPN IPSec Tunnels setup can be configured with a non-FortiGate/Cisco device. I am using a FortiGate 30E to have a VPN connection with my TP-Link Archer MR200 (modem). Is it possible? If it does, how do I set them up? Thank You.

FG200D IPS Log Tab Not Shown in log&reports

On Windows 7 I've installed the FortiClient 6.0.2.0128. In the advanced settings I chose "Remote Zugriff" (Englisch: "Remote access"?) as "standard Tab" ("Default tab"?). I expect that - after restarting the client - the tab "Remote access" is highlighted and I see the VPN user/password form. But I still see the Complience tab.Is my expectation wrong? Or do I do something wrong? Or is it just a bug?

Hello I have a Fortigate and Fortiswitch connected using Fortigate port1 - i set this port to dedicated to Fortiswitch addressing mode. it wants an IPaddress. is this just for point to point link with the switch or should this be an IP address on my internal LAN ?

Hello, A FortiGate with VDOMs configured, was already added to an FMG for several days working fine. The FMG is operating in advanced ADOM mode. When I created a new VDOM in the FMG for this FG, I faced the following issue: The VDOM was created OK, but when I tried to install a policy for the first time, the installation failed at the following command: config dnsfilter profilepurge giving the error message: "default can not be deleted because it is a static entry." I'm totally confused and do not have a clue about what to do. I had created several VDOMs via this FMG without a problem. I don't understand why the FMG decides to purge the dnsfilter profile for this particular VDOM. I tried to delete the VDOM and reconstruct it but I got the same issue. The problem is that I don't even understand why FMG is doing that change for this VDOM and how can I stop that. Has anybody an idea of possible causes of this problem and how to resolve this? Thanks 

Hi, Tried today the new forticlient but noticed that it misses the ssl-vpn module.

Hello I have started preparing to NSE4 Exam and most probablly I will choose Fortinet Network Security Expert 4 Written Exam—FortiOS 5.4.  and my questions is: 1. It is possible to pass an exam learning only from fortinet NSE institute e-learning course?2. If I will choose Fortinet Network Security Expert 4 Written Exam—FortiOS 5.4. should I also learn:FORTIGATE SECURITY 5.6.2\6.0 SELF-PACEDFORTIGATE INFRASTRUCTURE 5.6.2/6.0 SELF-PACED         

Hey guys, I know this is kind of weird to ask, but is it possible for my FortiGate device to be detected by FortiCloud/FortiManager/FortiAnalyzer if it is inside my LAN (with private IP at port WAN) instead of WAN (with public IP at port WAN)? And if it can, how do I activate it? Your help is much appreciated.

Hi everyone,Sorry if I'm not using the correct forum to post my question... I'm trying to connect two FortiAP 220B together by using a mesh topology but as I'm using FortiCloud and it seems I'm missing something. I'm trying to replicate the diagram below less the FortiGate as it is replaced by FortiCloud. FortiAP units used as both mesh root AP and leaf AP In my configuration, the first AP (A), the mess root, is directly connected to an Ethernet network with an access to the Internet. The second AP (B) should only be able to reach the Internet thru AP "A" because it is not connected physically. The mesh configuration has been made in Forticloud with the 5Ghz radio and the mesh SSID is the only one on this interface. When looking at the AP "B" in the CLI I can see that both APs are connected together correctly and running (see below) but the IP traffic is never going thru as I'm not able to ping the other AP nor the Internet. I can also see on AP "A" that a client is

Hi, I'm fairly new to Fortimanager so please excuse this question if it's somewhat basic. I have a Fortigate firewall that has been configured with two VDOMs; root and test.  In Fortimanager, I'd like to control the root VDOM in one ADOM and control the test VDOM in different ADOM.  However, when I add the Fortigate under Device Manager, it puts both VDOMs in the same ADOM.   How do I assign each VDOM separately? Thanks for your time,Larry

Hello,I work as a system/server admin at a company that has many branches around the world, which means that most employees are using vpn connections for work purposes. My problem is some employees are using proxy/vpn mobile apps to access social media sites (like youtube and facebook), and im unable to block these connections since I will be blocking all the vpn connections (tunneling) for all employees, also I cannot block their ips since I done know which ip belongs to which user. I hope you can help me in going around this issue because its causing alot of problems considering the limited bandwidth that we have. P.S I am new at this job and still learning about firewall and stuff, so if you are going to answer please be specific :)  Thanks

Hello all, I manage several Fortigates(80D,80E,60E) with different Fortios(5.6.3 and 5.4.8). I founded an issue with forti os 5.6.3 I'm not sure if it is an issue it is maybee my mistake. It relates to fortiview. When I want to monitor traffic(sources\destinations\interfaces)I don't see what widget "interface bandwith" shows and what is true. There is the smaller amount of bandwith in fortiview. I tried same with multiple Fortigate units and it is same for all with 5.6.3. I tried it for one unit(80D) with 4.5.8 and it was ok. I'm attaching image. img1 - You can see the computer which downloading file through VPN. The transfer rate is 3,44MB(aprox. 28Mbit) but fortiview\sources show only 8Mbit Bandwith for this computer.   

Hi Everyone, I'm running FortiOS 6.0.2 on a Fortigate 60E and having a few issues with IPv4 DOS Policies. I've exposed an NTP server to the Internet and added into the NTP Pool. However, as you might expect, I'm seeing a few issues from users/ systems who just wont play nice and are triggering my existing IPv4 WAN side DoS policy. I'd like to fine tune the behaviour here a little so have a couple of specific questions:- 1. Can I run more than one DoS policy on an interface (eg one specifically for an NTP server/ service)?   (I presume the answer is yes, but my experiements here so far have been unsuccessful- the new NTP DoS policy never seems to get triggered and the main WAN policy is getting hit all the time. Again, my assumption is that the order of the policies is important, but even moving the new NTP policy to the top of the list it doesn't seem to get hit). 2. Under 6.0.2 I don't seem to be able to change the quarintine time for a source I

Hi i have wan1 as my primary interface. I want to add a check that will set the interface down if theres any problem with it reaching internet. In that case i want wan2 to be the primary one.How do i configure a check that will set wan1 in admin down? thanks

Hello, I have a FG60D and a FSW 108E-FPOE. I want to create a dedicated switch port on the FG but as soon as I edit a port (e.g. 7) I do not see the option ‘Dedicated to FortiSwitch’. Any ideas? Albert

We upgraded our 500D from 5.6.2 to 5.6.3. In Policy&Objects-->ipv4 Policy we lost all our section labels, there is no Column Name for Seq #,  and no option that I can find to to Create Section Labels. Is this a bug or is there something we need to turn back on?

Hi everyone. As I was trying to add a new FortiGate device in the FortiManager (v6.0.2) an error occur which says "Probe failed: network".The device has already been added on FortiCloud and FortiAnalyzer (red dot on "Logs"), which means there is an internet connection. If there's anyone who can help, it is much appreciated.  

Hi everyone.  I'm using the FortiAnalyzer (v6.0.2) to monitor deployed devices on the FortiManager. The problem encountered is that the Logs doesn't update. It's connected, but there is no traffic going through, thus no analyzing can be done. Your help is much appreciated.

Hello I have a VIP for the server SCMAAS01 (10.128.0.30) where external IP is 10.146.136.30 and internal is 10.128.0.30. This VIP is just used in a policy (id 49) from an IPsec tunnel. (VPN_2_ETA) to internal interface (SERVER) for all protocols. For the other direction, I use an IP_POOL named NAT_SCMAAS01 where external IP range is 10.146.136.30-10.146.136.30 of type One-to-One. This object is only used in the policy (id 48) to internal interface (SERVER) from an IPsec tunnel. (VPN_2_ETA) for all protocols. Now, this server (10.128.0.30) is unable to go to internet. a policy exist to allow the trafic but I saw in the log that SNAT is applied too... In the policy (id 50) to allow this server to go to internet, NAT is configured of course but we don't use the NAT_POOL but the outgoing interface (195.141.249.225). Below the log. SCMAFW01 # 2018-09-13 11:33:22 id=20085 trace_id=1503 func=print_pkt_detail line=5292 msg="vd-root received a packet(proto=6, 10.128.0.30:61013->8.8.8

Hello all. We are going to be migrating to a new 100E for our production firewall. We are currently running a 300C which needs to be replaced. Currently on the 100E I have 5.4.9 on it but also see that 5.6.5 is out. I've read release notes and I don't have a certain need to be on one version or the other but I'm wondering if 5.6.5 is stable enough to put into a production environment to feel comfortable. 5.4.9 seems like it should be stable but if I could get my firewall to 5.6.X before going live, it will prevent me from having to do it down the line. We don't have a backup/spare firewall so that is why I ask. Better to do it now or wait because 5.6.x isn't stable in your opinion. We do run a handful of IPsec vpn connections through it but mostly just user traffic in and out of wan/dmz connections. Thanks in advance.

Good afternoon.  I have a situation where I would like to enable split-tunnel for multiple subnets that can't be expressed in a single subnet or range.  For example let's say 10.0.0.0/16 and 192.168.0.0/24.  On Cisco ASA this is done by creating a standard ACL for the split-tunnel that permits the desired networks. I'm trying to do this on a FortiGate 200D running version 5.2.  The VPN type is IPSec created with the iOS native client template, and it's working fine with just one of the split-tunnel networks defined.  I couldn't see a way via the GUI or CLI to add more than one split-tunnel network to the VPN tunnel.  Can this be done? Thanks