Solved

Hello all, I hope I'm posting in the right area of the forum and that someone may be able to offer some advice! I've added an NTP server into the NTP Pool and the resulting NTP querries are being forward to my public static IP address, forward to the NTP server via my Fortigate 60E running 6.0.2 (It's on the end of an 80/20 VDSL line if that makes any difference). I've got DoS protection on the WAN interface and have added an IPS filter with all current NTP signatures. However, I'm still seeing:- [ul]Moderate levels of DoS attacks (effectively blocking ocassional NTP Pool monitoring requests, reducing the NTP Pool score and hence amount of time the server is available in the pool).Many many triggers of the "NTP.Zero.Transmit.Timestamp" IPS signature.[/ul] I was hoping to refine the DoS protection setttings but I don't seem to be able to get this to work. I have a main "WAN" DoS interface profile which protects against general attacks. It seems to be workin

Hi, Does my FortiManager need access to the internet to gain any access to features that are dynamically populated like the updated OS's? If so please can someone let me know what services it needs to have access to so that I can poke the right holes through our FW? Any documentation that goes alongside it would be helpful for approval too.  Cheers 

Hi All, I'm trying to get NTP working through my FortiWifi 60D. However, normal NTP traffic gets blocked because it is using a privileged port as source port: <linux-host-behind-fortigate># ntpdate nl.pool.ntp.org 11 Jan 11:46:19 ntpdate[14461]: no server suitable for synchronization found <linux-host-behind-fortigate># This results in these packets (captured on the linux host):11:46:16.440887 IP 10.0.0.108.123 > 217.77.132.1.123: NTPv4, Client, length 48 11:46:16.640870 IP 10.0.0.108.123 > 91.148.192.49.123: NTPv4, Client, length 48 11:46:16.840873 IP 10.0.0.108.123 > 129.250.35.250.123: NTPv4, Client, length 48 11:46:17.040829 IP 10.0.0.108.123 > 131.211.8.244.123: NTPv4, Client, length 48 When I force ntpdate to use a non-privileged port, all is well: <linux-host-behind-fortigate># ntpdate -u nl.pool.ntp.org 11 Jan 11:46:35 ntpdate[14462]: adjust time server 131.211.8.244 offset 0.001271 sec <linux-host-behind-fortigate&

Hi Everyone, I hope your Thursday is going well! We have about 15 FAP-320C's. After a recent firmware upgrade the name on the AP's no longer show in FortiOS. The field is blank, so we don't know which AP is where in the building. Is there a way to blink the AP in order to locate it? Thanks,Johnathon

I have two 300C Fortigates, both running v5.2.13,build762.  As of this morning I cannot access the Address objects via the web interface on either firewall.  I can access other items under the Objects node, like VIPs, or services.  If I try to access the Addresses screen under Policy and Objects I get the spinning progress indicator and it never goes away.  Neither firewall is reporting high resource utilization.  Has anyone else encountered this?  I'll probably just reboot tohe one firewall that isn't mission critical, but rebooting the other one will be tricky due the business demands.

Have two ipsec phase1-interface VPNs between two locations (FortiGate to FortiGate, 5.6.x), each with multiple phase2s.  All works fine, and branch fortigate logs to our central FortiAnalyzer over the VPN. Setting up Security Fabric following https://cookbook.fortinet.com/security-fabric-over-ipsec-vpn-56/ it specifies changing the interface object (config system interface) for the phase1 vpn (NOT the vpn ipsec phase1/phase2s) to set its ip and remote-ip to match the local and remote ips of the two fortigates to use for FortiTelemetry between them (upstream FortiGate in Fabric).  These were initially both 0.0.0.0, with the ipsec phase1-interface specifying local-gw and remote-gw, and the multiple phase2-interfaces specifying local and remote subnets. My uneducated questions:- Will I break my multiple phase2s by specifying a specific ip and remote-ip in the phase1 interface object?- If the interface ip and remote-ip specified are /32 will this break the ass

Hello Everyone, I'm wondering what is Fotinet up to with all their current releases branches. This is absolutely madness.- 5.2.x finally works stable on most of the FortiGate units but it's already End of Engineering Support and the end of support Date is 2018-12-13. It's also not available for the E/F series.- 5.4.x received the most updates from the newer releases but ist still full of bugs.- 5.6.x is patched to version 3 from 2017-12-05 and contains really a lot of bugs (Month of post: March). It seems like it doesn't get a lot of attention from Fortinet.- The upcoming 6.0.0 release will also be full of bugs and most likely not recommend/suitable for prod environments. IMO most of the customers should wait at least 1 year of development and bug fixes before using it. So what is your strategy for 2018 and FortiOS? Are you using FortiGate D Series with FortiOS 5.2 even after EoS or are you using 5.4/5.6 with the need to frequently bother the bug-tracker and/or supp

Hi! I am using a Fortigate 200E with software version 5.4.5 I am trying to delete a vlan-interface. The problem is: fg200e_HZ_1_1 (interface) # delete Inet992The entry is used by other 4 entriesCommand fail. Return code -23       fg200e_HZ_1_1 (root) # diagnose sys checkused system.interface.name Inet992    --> The GUI shows 4 references, but there are NO references. The config does not show any other occurence of the name "Inet992" except the interface definition. Do you have any idea, how to delete the interface with the "invisible" references? Thank you and best wishesKPS   

I'm in the process of moving a customer from Cisco ASA to FortiGate and have run into a small issue with Virtual IP's. The FG is setup parallell to the ASA on inside and wan interfaces for reachability/management, all other interfaces are disabled. The plan is to configure as much as possible on the FG before migrating. Now to the issue.When I configure the Virtual IP's which are used in ASA for various servers today, the FG starts responding to ARP creating a conflict on the external interface since both ASA and FG responds to the same IP. In ASA it's possible to disable a NAT policy and that way prepare policies without impacting production, but I can't find any way to disable VIP's.  Any ideas?

Hi,There have been a few similar posts, but none with the same constellation (OS level and topology):We have a single FortiGate 100D running FortiOS 5.6.3 managing a stack of two FortiSwitch 124E with S124EN-v3.6.3-build4269.Connection is:FortiGate FortiLink LAG using Ports 12 and 13 connecting to Ports 23 and 24 of switch #1 (copper, no split-interface).ISL (fiber optic) between Switch #1 and Switch #2 on ports 25 and 26 (25 on 25 and 26 on 26). (no direct link between Switch #2 and the FortiGate possible). Switch #1 shows as "disconnected" and cannot be configured anymore. Switch #2 is functioning fine.We are going to schedule a maintenance window and reboot the switches, but i would like to know how this could have happened and how to prevent it in the future. Diagnostic: I can ping and telnet to both switches using the automatic FortiLink addresses (169.254.1.x), the disconnect happened more than 7 days ago (it's a new environment, no monitoring yet) so the event logs doe

We have wix websites that arent working behind the fortigate 1500d. When you go to http://www.site.com it forwards to https://www.site.com Randomly all browsers show the following error. This page isn’t workingwww.website.org didn’t send any data.ERR_EMPTY_RESPONSE   I already tried setting auto-asic-offload to false but it still does work 100% of the time.   Running 5.4.5 code.   This does not happen on any other network besides behind this fortigate.   Not getting anywhere with support.   Suggestions?         

Hello guys I noticed that a certain ip tried to invade a web server and IPS dropped that attempt, but soon after that same ip tried several more times. Is there a way to configure FGT to automatically block this ip for minutes or hours, so you can not keep trying every second? or that it is inserted into a blacklist?

Hi everybody,I'm pretty new with fortimail but I got an issue with a external sender: everytime he tries to send us a mail, the communication is cut off by our fortimail right after the startTLS.When looking up in the "mail event" log, it says something about an unknown SSL protocol.Have you ever encountered this situation? Is there something to do on our side or does the sender have a security issue?Here the log error: STARTTLS=server, error: accept failed=-1, reason=unknown protocol, SSL_error=1, errno=0, retry=-1, relay=mail.uni-media.be [194.78.234.25]  Thank you for your help,Joel

Hi, I have been asked to setup a DNS relay/proxy on our FortiGate 1200D, this sits on the perimeter of the network and has access to the internet.  Currently we have internal DNS servers which go through the FortiGate to our ISP, however it'd be nicer / cleaner that the FortiGate does the requests and all of our internal servers point to the FortiGate to do lookups against the ISP and return them to our internal domain controllers / DNS servers.  I can see how to setup a DNS Server - but this doesn't seem to suite my need. Unless I am using the wrong words in Google, other search engines and the FN Forum - I'm really struggling to find good documentation how to make my FG into a relay.  Any help, advice or guides would be amazing.  Thank you. 

GuysI have an issue here. I want to group my users into groups to which other can have full internet access (by-pass or override some generally blocked sites, and the other group follow these block settings). My firewall is not configured in any way around the groups, every one is going through the same control.I am tempted to create an IP address group in the firewall as it seems an easier out option (i group ip addresses of those computer/people i want to give full internet access.) this is an issue coz when you logged into a different machine, you cannot access internet. But the safe and secure manner is to get these users in a windows AD group and call the group in firewall somewhere i dont know. My problem is that i cant find where i can call this group in the firewall and create a second rule for it which reverts to default firewall controls.can some one guide me step by step as to where to start in fortigate because in windows AD the groups are created  but i

Hi! We are using Vlans based topology where we have vlans on distribution layer switches and few SVI lives on core switch.We have fiber coming from our ISP provider that I want to terminate in in our distribution switch as I have 10G interface in my distribution switch. The issue is that we have IP scheme our ISP and if I terminate the Fiber directly into our Fortigate FW then everything works but our 100E is just 1G sfp and we have one 10 G internet line.  The only way is to somehow terminate this to distribution switch to get 10G connection but I am coming up with any idea how I an design this because of the VLAN. Any suggestion with this? Thanks 

Hi all, I know this has been debated many times, but still can't solve it. I have a wildcard valid SSL certificate which I try to importe to my FortiGate. Of course, I have all relevant information, including private key. No matter what I do, it gets imported to "Certificates" rather than "Local Certificates". I can use it as my Fortinet certificate, I can use it for VPN SSL, but I can not use it for deep inspection. I'm trying different formats, but the results is always the same. Is there any valid procedure for that? 

Hi All, I am having an unusual problem affecting Mac OS X users.When a user connects to SSL VPN, some of the users will report the VPN does not sync, e.g. if connected using the VPN console, it will show connected but the FortiClient icon will show otherwise (refer to images). Another symptom is the connection duration will stuck and never increments. What happens thereafter, should the user disconnect the VPN and connects again, the VPN will stuck at "connecting"I infer it may be due to the OS X is unable to determine if the VPN is disconnected or still connecting. The workaround we employed is by having the user to re-install Fortigate when a VPN is required, but this is getting out of hand as our most affected user are road warriors. All our Mac OS X is running 10.13.4 High SierraAffecting both MacBook Air (Early 2015) and MacBook Pro (Early 2015) Any ideas are greatly welcomed.

We setup a FortiWiFi 60D about 4 years ago using WAN1 only. We are now on FortiOS 5.6.5. The WAN1 internet connection is a very slow DSL connection. Due to the extreme slowness and occasional outages, the need for internet connection redundancy became necessary. One of the most critical usages of the internet connection is to stream video to an off-site server via the WAN from one particular computer. We recently added a much faster connection to the WAN2 interface. We setup a SD-WAN to use these two WAN connections. We configured the   Two questions: 1. The SD-WAN setup instructions say to set up the faster internet connection to WAN1 and the slower connection to use WAN2. In our case the slow static IP address connection was already set up on WAN1 and the newly added static IP address connection was naturally added to WAN2. Does it matter if the slow connection is on WAN1 and the fast connection is on WAN2?   2. Under most circumstances we wish to primarily use the much fas

Hey Crew, I have a Fortianalyzer (6.0.1) and I'm seeking some help on this particular dataset: apprisk-ctrl-File-Transferred-By-Application. I tried adjusting some of the query but have since reset it to its default:select appid, app, filename, cloudaction, max(filesize) as filesize from $log where $filter and filesize is not null and clouduser is not null and filename is not null group by cloudaction, appid, app, filename order by filesize desc My test(s) all come back with No Data.  Any thoughts on where I can begin with this one and how I can adjust this query.My end goal is to get a log of all files transferred to cloud applications (Google Docs, Box, Dropbox, etc) by user and file size. Thanks in Advance.   

Hi!Last week I experienced problems trying login to fortinets support page (https://support.fortinet.com/Main.aspx).At first I assumed some kind of maintenance was going on so I ignored it but the problem still persists.Every time I click on login I get redirected back to the login page, I never get the chance to enter my credentials.The browser I am using is IE11 version: 11.0.9600.19080.This is the url it’s trying to redirect me to when I click on login: https://support.fortinet.com/SSO/login.ashx?ReturnUrl=%2fMain.aspx Is anyone else experiencing similar problems?I have an ongoing ticket that will soon be closed if I don't update it.

Hello guys I am homologating the FAZ, but in my extracted reports, there is no accurate and consistent information, so I began to analyze before what the FGT is registering. My navigation test machine has a deep inspection certificate. After opening some websites and youtube, I started looking at my FGT200D v5.6.2, Fortiview \ Sources. The destinations I can see, but I do not see the domain of the sites visited, the words used in my searches and categories. Is there a problem with Web Filter configuration or Application Control ...?  Has anyone ever come across something like this? Can you navigate websites and clearly have all the information that the user has done, where did they do it, applications, domain, etc ...? Thanks for your support right away.Hugs !

Hi,  First time poster here, so hopefully I got the most appropriate thread. I have just purchased a Fortigate 600c firewall to route my home office network to the internet.  I have two ISPs and am on a 1Gb plan with both of them. When I connect the basic routers that were provided from each ISP I get close to what is promised 900 Mb+.  However, when I run my connections through the Fortigate, I am only getting circa 500 Mb.  (As tested using Speedtest.net) I previously had a Fortigate 200b, which gave me the same speeds, and while investigating I noted that the CPU of the fortigate was maxing out.  Actually, initially I was getting slower speeds but after turning off logging it increased to around the 500 mark. I thought okay, the CPU isn't powerful enough to handle what I wanted, so I kept an eye out for a second hand later model when I found the 600c being sold locally.  Checking the specs on the 600c and seeing that it has 2.5

Hi guys! I have a SSL vpn on my Fortigate - the clients gets their ip addresses from a 192.168.x.x/24 pool. All fine. I have a neighboring firewall that needs to learn that route over BGP. But... The route is not there - I dont have it in my routing table on either firewalls.. So. how do i get my ssl ip pool routed to other firewalls using bgp ?  :) anyone knows ? 

Hello everybody, I have a question and hope you can help me. I have set up a captive portal and everythings works fine like I planned it. But there is one issue I ran into, that I didn' t plan with. If the traffic which triggers the captive portal is https traffic, then we get a certificate warning. Let me explain this: 1) I join the captive portal based wlan 2) I open a browser and surf to https://www.google.com 3) I get a certificate warning in the webbrowser 4) If I ignore this warning I' am redirected to the captive portal 5) If I authenticate myself with correct credentials I will be redirected to the original website. The thing is, that I want to get rid of the certificate warning. I found this little config switch wich allows me to choose the certificate I want to use: config user setting set auth-cert xxx end I tried it with our official thawte certificate but that didn' t help. So I tried some other certificates (but this will only help our