Solved

When the "FortiGate" policy in "FortiManager" is modified If the indication in "policy package status" is "out of sync" Can I find more information in the modified policy for "FortiGate"? 

Hello all, i am running a FG240D Cluster. I use this firewall as layer 2 firewall with webfilter, application filter and ips.Now i am thinking about to upgrade to 5.6.5 or 6.0.1 will it have a bennefit for me or is it okay if i stay on the5.4 line ? Thanks in advance for comments and suggestionsMarco 

Is there any way I can send the local traffic towards the VPN interface ? I am trying to copy the firewall config from the firewall to my TFTP server that is sitting behind another firewall.I have a VPN between the two firewall, ie the firewalls are the tunnel endpointsAnd this traffic is not the traffic from the network that is firing up the tunnel.So am I right in thinking that I cannot get it via tftp over a IPsec VPN tunnel via the setup that I have mentioned.So if there is no separate WAN provision I have to have local tftp server for storing the firewall config  right ?    

Hello, I need to create a VPN between our agency (using Fortigate 90E) and an external consulting company (using Cisco router). There would be no problem to create the S2S VPN between the two sites, except that our subnet is already known by the consulting company (192.168.1.0/24). So I can't create it for the moment.Therefore, they asked me to set up a NAT or an equivalent technical solution for the VPN connection in order to be able to make appear our network like 192.168.7.0/24 or other, so that it does not come into conflict with the subnet 192.168.1.0/24 already known at external consulting company.   I joined a diagram to understand the desired topology. I do not know if it's very complicated or very simple, I may be missing the technical solution but I wanted to know if you had any idea about this implementation on an UTM Fortigate 90E. Thank you in advance.

Hi , I have a 200Dbox which is running 5.2.1. Problem is ,in log the time is not appearing properly. Please see the below. Please help to fix this issue?

https://docs.fortinet.com....6.5-release-notes.pdf

Hello, I would like to know the difference between the internal ports and DMZ/WAN ports on the FortiGate 60E. Is it possible to create multiple VLANs on one internal port or it's only possible on DMZ/WAN ports ?See this picture for exemple : [link]https://i.imgur.com/NjusR2x.png[/link] Regards.

hello, i've configured syslog server on of our clients' vdom,including the configuration - config log syslogd override-setting <---     set override enable     set status enable     set server "CUSTOMER EXTERNAL SERVER IP (OMMITED for security measurments) "     set reliable enable     set port 601     set facility syslog <---     set source-ip "OUR VDOM EXTERNAL IP ( OMMITED for security measurments) "     set format default end config log syslogd override-filter <---     set severity notification     set forward-traffic enable     set local-traffic enable     set multicast-traffic enable     set sniffer-traffic enable     set anomaly enable     set voip enable     set dns enable     set filter ''    

Hello I am having a Samsung Galaxy S9+ with Android 8 and FortiClient VPN app is not working properly. Immediately after connecting I get disconnected again. On other phones it is working fine. Do any others have problems with Android 8, or have a solution for my problem? thx for help! 

When using "SSL Full Inspection" Question)1. Is it possible to set using "Trusted Public CA"?2. If possible   What kind of product should I buy? The only way to apply "trusted pravice ca" is to the manual. (http://cookbook.fortinet.com/preventing-certificate-warnings-cacert-56/) Thank you.

Hello, I've a question regards WAN failover and HA A/P design that I can't find the answer anywhere in the documentation.  Please check the attached diagram designed, the question that comes in mind is:[ul]If the link WAN1 from CORE1 to Port1 on of FS-1 goes down, then the Internet connectivity will be done through CORE1 - WAN2 as far as I understand.Is it possible to set it up, that instead of failover to use CORE1-WAN2 it uses CORE2-WAN1? The only way I've seen to set up this scenario is to enable port-monitoring on CORE1-WAN1 and then failover to CORE2. But in my opinion it seems a bit of extreme use to failover to CORE2 just only because the link between CORE1 WAN1 / FS1 Port1 fails.[/ul] Thanks for your help.

Hello, i want to ask, i have a fortigate with 2 internet connections,i want to make WAN 1 for server database and Active directory and WAN 2 for client, server database and AD is one segment with client, can i make that with fortigate? please help me.

Hi, We recently upgraded Fortimanager VM from v5.4.3 to v5.4.5.  While v5.6.x is in the plan, we haven't started our testing yet. One thing we noticed with FMG v5.4.5 is that there isn't any indication when a policy is Disabled.  It looks the same as enabled policies. In FMG v5.4.3, a disabled policy had both a Red 'X' and the policy line information appeared "greyed out". Has anyone else noticed this?  Is there a work around? Thanks for your time.Larry

.

Hello guys, I was trying trying to automate some tasks with Ansible module for FortiManager (https://github.com/networktocode/fortimanager-ansible), but stucked and need your help. My playbook successfully gets information from FMG and locks ADOMs, but I can't perform any changes because I get this kind of error:failed: [192.168.1.1] (item={u'bpm': u'12345', u'name': u'Customer1', u'addr': u'1.1.1.1'}) => {"changed": false, "fortimanager_response": {"result": [{"status": {"code": -10147, "message": "no write permission"}, "url": "/pm/config/adom/IBB/obj/firewall/address"}]}, "item": {"addr": "1.1.1.1", "bpm": "12345", "name": "Customer1"}, "msg": "Unable to Apply Config"}My user has all necessary permissions: FortiMgmt.dn.ukr # show system admin user ansibleconfig system admin user    edit "ansible"        set password ENC bla-bla-bla        set profileid "Super_User"  &nbsp

We have this issue with our Fortigate. After crashing iked we can't login to WWW interface and all IPSec tunnels are down. Is any idea why this happens? For fixing this issue need to restart iked and httpsd process or reboot device. P.S./ The CPU isn't overloaded and memory usage around 33% 816: 2018-06-16 04:53:33 <03432> firmware FortiGate-200B v5.2.13,build0762b762,171212 (GA) (Release) 817: 2018-06-16 04:53:33 <03432> application iked 818: 2018-06-16 04:53:33 <03432> *** signal 6 (Aborted) received *** 819: 2018-06-16 04:53:33 <03432> Register dump: 820: 2018-06-16 04:53:33 <03432> EAX: 00000000   EBX: 00000d68   ECX: 00000006    EDX: 40248ff4 821: 2018-06-16 04:53:33 <03432> ESI: 00000d68   EDI: ffffffc8   EBP: bffff658    ESP: bfffee8c 822: 2018-06-16 04:53:33 <03432> EIP: 40001012   EFLAGS: 00000246 823: 2018-06-16 04

hello there I'm completely new to Fortigate, and have some very limited experience.I configured a bunch of FG60E with very basic stuff, because they were meant to act like basic routers.I used to configure an ANY ANY All sources All destinations Allways allow policy on those FG60E running 5.6.3 The thing is that I had to aply the same "router" config to a FG100E (again running 5.6.3), and there is no "any" interface option under IPV4 Policy.Is that normal? or am I missing something. thank you very much in advance regards 

When the PC is connected via SSL VPN, it gets an IP (ie. 192.168.1.101).  The PC can ping any devices on 192.168.1.0/24, however when I tried to ping to the PC (192.168.1.101).  it is not reachable.  Not sure if there is some additional setting that I need to config? Remote PC (192.168.1.101)  <=> FortiGate FW <=> network elements (ie. 192.168.1.50) PING from 192.168.1.101 to 192.168.1.50 worksPING from 192.168.1.50 to 192.168.1.101 is not working (unreachable)

Hello, I am trying to determine if there is an firmware/OSVersion update available for one of our FortiAPs (FAP423E)[ul]It is attached to a FortiGate FGT81E on v5.4.8,build6501 Logged in to the FortiGate, under WiFi & Switch Controller > Managed FortiAPs I see the current OSVersion as: FP423E-v5.4-build6037Yesterday when I right click > Upgrade Firmware it was saying Failed to retrieve FortiAP recommended firmware updates. Today it just takes me to the Upgrade Firmware screen with Upgrade File with +Upload buttonSupported Upgrade Paths – FortiAP and FortiAP-S doesn't show anything matching build6501 and search shows No matching records foundSimilarly, SYSADMIN_NOTES search doesn't bring up anything[/ul]How can I find out if there is an update for our FAP423E in the 5.4xx stream (we are not currently looking at doing a point or major upgrade, just ensuring it is fully patched in the 5.4xx stream). Any help would be much appreciated!

Hello guysIn Fortigate, I'm using cache functionality in our navigation rules. The fact is that cache hits are small and the "non-cacheable" slice is very large.Would deep inspection help increase cache hits?What are the best practices for using cache in Fortigate?Is there a way to view what is this "non-cacheable" traffic is too large? hugs

Hi, We're running a pair of 1000C's in A-P (v5.0,build3608 (GA Patch 7)). We currently manage both FW's using MGMT1 with one dedicated IP. Does anyone how to give the primary and secondary separate dedicated MGMT IP's ? I'd like to use MGMT 1 on Primary and MGMT 2 on secondary - each with a different IP address. Thanks,PJ

Hello,I upgraded recently my FAZVM64 to 5.4.4 version. I have this alert message Log disk usage reached 90%, over threshold 80% and I want to increase the threshold to 95% in order to stop this alerts messages. When we configured the disk utilisation policy we calculated the disk usage at 95%. Does anyone have some clue about it? Thanks in Advance  

Hello, Actually we are moving on a dynamic VPN tunnels topology. We configured site A with B tunnel successfully, with OSPF over IPSec configuration. Then, we started to configure site A with C, but when we finished, no route was added. We did exactly the same we did between sites A - B, but no same result. Trying to resolve this, we did a get router info ospf interface and there is not the tunnels interfaces listed on both sites, just A - B interfaces and internal routing, but then we made an get router info protocols and there are listed network prefixes for sites A - B. Checking everything, is the same configuration on both cases, but one works but the other doesn't. I appreciate your answers. Thanks.

Hi experts, I have a FortiGate and I want to create firewall policies based on device detection for mobile devices. I realized that FortiGate can detect only some iPhone and Android devices. I have made a test with two iPhones of different models and iOS version. FortiGate recognizes iPhone 5 but not iPhone 6. The same with two Android phones. They all connect via Wi-Fi to Meraki APs, and the APs are connected to one Meraki switch and then this switch is connected to FortiGate. I know this is due to fingerprinting, but I don't know how to solve this, since right now I cannot create my firewall policies per mobile device detection due to this limitation. Any idea? Regards,Julián

hi, I would like to know if there is a way for my fortigate 800c to backup the config automatically every time I apply changes or maybe every period of time? Thank you, Raz.