Solved

I can't download a working setup of VS Code from the page https://code.visualstudio.com/ because Fortigate replaces a small block from the files with zero bytes. The file comes from URL: https://az764295.vo.msecnd.net/stable/4e9361845dc28659923a300945f84731393e210d/VSCodeSetup-x64-1.26.0.exe After download, the setup returns crc32 error. The digital signatures (file properties) says invalid certificate.If I download the file without fortigate certificate replace (deep ssl) the file is correct. A comparison of the two files (downloaded with and without fortigate) in a hex editor shows at Offset 0xFFE28 is a block of length 432 of zeros bytes replaced from fortigate. Range 0xFFE28 - 0xFFFD7. This code block: 77 04 85 0B 6A 7B 8F 0C 32 F9 25 68 D7 7E BD 47   88 C0 1D 74 A6 52 EA 69 05 83 08 E3 E4 BF 03 3377 99 F4 2A FA 4E 47 D8 DE 99 03 3D 9E 09 9C C3E5 18 94 D2 77 95 73 01 0E E0 EA 8D B0 C3 81 1C9E 9B 49 92 07 5C B0 F5 04 AB 96 D2 53 F9 38 9919 D6 07 99 78 0F 7B

Hi All, I have userbased identity policies using captive portals. I have port 3, port 4 and a VLAN using different portals. These all work fine until I switch it to HTTPS redirect in Authentication then the captive portal throws up a certificate warning. I have run; config vdom edit root config firewall policy edit 16 set auth-redirect-addr test.test.co.uk (not the real address) set auth cert mycert end There is a dns entry on the local DC to point test.test.co.uk to the interface of port 3 (example) Now.... when you turn on HTTPS redirect and try and login you get a warning and invalid cert because the FW goes to xxx.xxx.208.1:1003/FGTAUTH? (lot of numbers) Any ideas anyone.

Hello.Can somebody tell me overall and per port poe-power for FGT-140D-POE device?

Hi Everyone, We have a Fortigate 3950B and 100+ VDOMs on it. Dont have a fortimanager. I want to ban some malicuos IPs (100+) for all VDOMs and these IPs may change every week. Solutions: 1- Go with ACLs on router. (I dont want this solution for some reasons)2-  Define all IPs on all VDOMs and create a firewall deny policy on all VDOMS. (If you dont die before you finish :))3- Create a VDOM. Define all IPs and create a firewall deny policy on this VDOM. Route all other VDOMs' trafic to this VDOM. I have not tried 3rd solution yet. Is this a good solution? Why not?Is there another solution to handle this situation?   Regards  

On our Fortigate 100D running 5.6.3, when I go to Log and Report > Web Filter and add a URL filter, I can only filter by the path or query string, not by the domain. For example, I cannot filter for all logs from example.com, instead I can only filter for example.com/<path>. Is it possible to filter by domain?

Tengo un FortiWifi 61E con la versión v6.0.2 build0163 (GA) y no puedo activar el sensor de DLP ya que no lo veo en las opciones y si voy a Sistema > Visibilidad de características no encuentro la correspondiente a la de DLP. ¿Podrían ayudarme? Auto translate: I can't activate DLP I have a FortiWifi 61E with version v 6.0.2 build0163 (GA) and I can not activate the DLP sensor because I do not see it in the options and if I go to system > Visibility features can not find the corresponding to the DLP.   Could you help me?

Fortigate 100D 5.6I have LAN (VLAN1) and VOICE (VLAN2). VLAN1 is assigned to ports 1-14. Vlan2 is assigned to ports 15-16.VLAN1: 192.168.1.1/24 DHCP Enabled 192.168.1.80 - 192.168.1.254VLAN2: 192.168.0.1/24 DHCP Enabled 192.168.0.50 - 192.168.0.254 Port 15 is mirrored from Port 16. Nothing connected currently.Port 16 is connected to it's own switch and devices.Port 1 is connected to it's own switch and devices.They are only linked by the firewall. The switches are not cross connected. Somehow, PC's on VLAN1 have pulled an IP from VLAN2. I can't get them to drop this IP and it still works, as in they can traverse the network and get to the internet. I have tried unplugging their cables, Windows Troubleshoot and Repair, ip config /release and then renewing. Nothing works. I can tone down the connection and they are plugged into VLAN1. Am I missing something? I should note, this is a fresh Fortigate 100D as the previous one bit the dust and had to be replaced.

I installed Forticlient app to use with one of our customers' VPN.  The customer no longer uses the VPN, and I want to uninstall the Forticlient software.  Client version=6.0.2.0128. I tried using Windows Control Panel, however clicking on the FortiClient app only gives a "Repair" option, and no "Uninstall".   I also checked the \Program Files\FortiClient folder to see if there was an uninstall app, but there is not. Attached a screen shot of what I see in Windows Control Panel. How can I uninstall the FortiClient software?   

Hi, Can you please help me with the scenario that i have. I want to connect a FortiAP with an already existing Cisco APs with same LAN and Same SSID. Is it possible ?

Hi guys, I need a clarification about the Kernel and System conserve mode thresholds. According to the NSE4 course, here you are these thresholds:1. The ambiguity is when the Fortigate has a memory <= 1GB, where the thresholds are the same. What happens if I have a Fortigate with a memory between 512 MB and 1 GB and I have reached 81% of my memory? The Fortigate will enter Kernel or System conserve mode? I can't answer this question from the above slides. 2. What mode is more aggressive? I would say is Kernel since any proxy inspection is bypassed and you can't do any configuration changes, while the system mode at least you can somewhat configure the behaviour with the "av-failopen" command. If I am right and Kernel is more aggressive, it makes sense the Fortigate goes first into system conserve mode (less aggressive) and if the memory usage keeps growing then into kernel conserve mode (more aggressive). But the above thresholds are also ambiguous since taking some number

Hi All, Good Day, Thank you in advance for your time to read this and helping me to solve this problem. Currently I have a setup like this On Fortigate I remove port 2 and port 3 on the lan profile and configured as VLAN's each assigned to VLAN10 and VLAN20 ON VLAN10 --- > 10.10.0.1/24 - Untagged (Internet Access Hosts)ON VLAN20 --- > 192.168.0.1/24 - Untagged (LAN Only) Port 1-10 - VLAN10Port 11-20 - VLAN20 Now my issue is this, I've created the profile and rules as well as IP address that will be used by the VLANS in NAT/Route Mode in FortinetBut My hosts that needs internet can't seem to route them. Should I configure the VLAN's ports to be trunked so fortigate sees all ports as one? I want fortigate to do the routing so it makes sense that i will not define a default gateway in my vlans.  I'm new to Fortinet and I've seen a lot of guides but no solid answer and I'm hoping if anyone here can give me one. Any help or advise

Hello, I have to deploy a fortimanager and i want to know if it's possible to have multiple global policy or policy package on one device. Several devices ( fortigate) have a lot of policies in common, and I need 2 or 3 Global policies. Thanks, JF

Hello All,I am currently on version 5.4 for both my Fortigate and Fortimail. I assume it's recommended that I update to 6.0? If so, do I need to go to 5.6 first? Or can I go straight to 6.0? Or should I even bother at all? Thanks in advance for the input.

I am going to upgrade our fortinet boxes from 5.4 to 5.6 in upcoming weeks.our FSSO  agent running on our server  is on version 5.0.0247do I need to upgrade the fsso agent or is that version compatible with all 5.x versions?

I try to eplain this to you: if you create a mapping in the objects section of FMG Policy & Objects and you use an interface that already has a mapping you get notified about this and FMG reports that if you save this you are going to replace the old (=existing) mapping. So far this is fine. You get to know that there already is a mapping and you could choose wether you want to replace it or not. Everthing ok here. If you use an interface e.g. in a policy but forget to do a mapping for all FGT this policy is to be rolled out to, the FMG will notice that upon its integrity checks it does before it rolls out anything. It will then prompt you for the missing mappings so you can complete them. So far this is fine too. When you then choose an interface of the FGT to complete the mapping you get all interfaces of the corresponding FGT in the drop down and you do not see which already have a mapping. Also you get interfaces that cannot be used as destination or source

Hi all, I am trying to fetch raw logs using the FortiAnalyzer SOAP API and the searchFazLog API method, but I am unable to authenticate: I keep getting the -101 error code and "Invalid user/password or adom" error message. I have tried authenticating using local account credentials as wel as a domain account credentials, both without any success (these creds work when logging in via the web interface). I have also tried adding the HTTP basic authentication header, no game unfortunately. We are currently using FAZ 5.2 (https://docs.fortinet.com/uploaded/files/2091/fortianalyzer_admin_520.pdf) Here is the example of my request and the response: [link]https://pastebin.com/Tr57D2Lv[/link] Can anybody point me in the right direction, as I'm sure I'm missing something trivial. Cheers,deacs

Hi  As I understand it a user logs on to the domain, the FSSO agent captures this logon and sends it to the Firewall, does anyone know how long this event stays live. I have an issue where users are in the list of logged on users in the morning but later in the day the seem to be missing and therefore lose internet access. Nick. 

https://docs.fortinet.com...os-6.0.2-release-notes

I believe this was an issue with older versions of FortiOS previously. When going to Authentication -> User Management -> User Groups, I hit create and target my remote LDAP (Windows AD), and try to specify the LDAP filter. The filter returns nothing when trying to use the memberOf property to grab members of a specific AD group. When using the information from the Administration Guide to create the filter as per the example, it also fails. I can add the group directly (Windows AD group under User Group), but it won't recognize the users within the group when I try to use FortiToken. If I go to Authentication -> Remote Auth. Servers -> LDAP -> My Win AD Setup -> Remote LDAP Users -> Import users by group memberships, this will work. Is there a way around this, or to make it work? The best I've come up with is to import the users by group memberships, and then in User Groups select the "Set a list of imported remote LDAP users". But this is a manual proces

Hi, I've got a short question regarding the ForitAuthenticator. We are setting this device up for ourself and for one of out customers. The customer needs to have it's own Admin Profile to create users and should only see it's own organization. The problem we are facing right now is that the customer admin can see all the users even outside it's own organization. Is there something we're missing? Kind regards,Tim

Hi everybody, I've got a strange problem with an Authenticator and Fortigate. We've configured an Authenticator as LDAP Server.The Fortigate authenticates against the Authenticator. When I create a new user this user is discovered by the LDAP connection, this works fine and I'm able to login with this user. But when I creat a token (mobile app) for this user and try to logon, I get the message "Permission Denied".Unassign the token and the user is able to login again. I also tried to change the token to e-mail verification, after entering the credentials I immediately get premission denied.2 seconds later I get an e-mail with the token but can't enter it. So the Fortigate does authenticate agains te FAC and sees the user has a token setup but it's stuck on the permission denied.This is a part of the log:[344] start_next_dn_bind-Trying DN 1:uid=tim,cn=LOCATION,ou=EXAMPLE,dc=EXAMPLE,dc=EXAMPLE [1701] fnbamd_ldap_get_result-Going to USERBIND state [2832]

Hello, I'm currently running on 1.2.5 version of FortiClient EMS and I would like to update it to 6.0.2. I was wondering if there was any procedure to follow to complete the update without major trouble ? Thank you for your help, have a nice day. B.

Dears,I was creating a services in object tab and I saw option of specifying multiple port number by choosing TCP or UDP in one service object, then y we need the service group object when we get an option to specify tcp and udp multiple port number in one service. Please find the attached service config snapshot thanks  

Hi all, I just want to ask if policy based routing replaces static routes? We have 12 or so remote sites on IPSEC site to site VPN's and we have recently had done so ALL traffic goes up via the VPN to our data centre and out through our main firewall. but we also want to do so all remote sites can get to all the other 11 remote VPN sites.  Now for ALL traffic to go out via the VPN up to our main firewall we used policy based routes that is configured like the attached picture shows. But i am sure i had a firewall about a month ago when i could not get to another remote VPN site that i had to add a static route in as well. can someone please confirm/deny this behaviour? I do not really want to add in all our 26 networks into each remote VPN site into static routes if i dont have to. Thank you in advance   

Hi All, I'm familiar with Hardware Switch mode on the FG200D series, however in 5.2 firmware have seen VLAN Switch mode. What is the difference, as you can create VLAN's on a hardware switch interface too? From the GUI there doesnt appear to be a difference, unless you can tag and untag VLANs on members in the VLAN Switch mode from the CLI ?