Solved

We upgraded our Fortigate 200D to firmware v6.0.0 on Tuesday and since then, some users have been unable to connect to the VPN. In my testing I've found what I think is the cause but haven't been able to fix it.   After the upgrade, when some users authenticate to the LDAP server(s) the password check succeeds but no AD group membership information is returned. For example: diag test authserver ldap LDAPSERVER username1 password1 gives us:authenticate 'username1' against 'LDAPSERVER' succeeded!Group membership(s) - CN=group1,OU=blahblah,DC=contoso,DC=com                                   CN=group2,OU=blahblah,DC=contoso,DC=com                                   etc. howeverdiag test authserver ldap LDAPSERVER username2 password2 gives us:authenticate 'username2' against

Hi We're considering swapping out our Palo Altos for Fortigate, one very useful feature on the Palo Alto's is its Dynamic Block List, which can download a text file filled with IPs/CIDR from our server which are then added to the Firewalls block list (blocks are removed each time the list is re-downloaded), this list is generated from a script that correlates all the different IP threat lists, such as DShield, Shadow Server etc. How can we achieve this with Fortigate, i.e. downloading the list adding the IPs to the block list. I've search high and low, but can't see a similar feature. Thanks

Hello, i have a problem sending out FortiToken email confirmations...It was working fine and for the last two days, the emails that are sent are not correct and the users can't activate their FortiTokens on their accounts.The email has the wrong expiry date for the Token (1970!) as well as there is no serial number or QR Code to activate the token... Below I have  a copy of an automated email sent from a Fortigate 200D running OS v5.4.0,build1011 (GA) and has the correct time in the system Mon Apr 11 19:11:04 2016 (FortiGuard) Any help would be much appreciated! Regards,Thanasis Welcome to FortiToken Mobile - One-Time-Password software token. Please visit [link]http://docs.fortinet.com/ftoken.html[/link] for instructions on how to install your FortiToken Mobile application on your device and activate your token. Your Activation Code, which you will need to enter on your device later, is "" You must activate your token by:  Thu Jan  1 01:00:00

I get a 'driver is not digitally signed' error for each of the services it tries to install.  No option to 'continue anyway', followed by a roll back. 5.2 installs fine. 5.4 has installed correctly on my Mac. Any ideas before I tackle another 50 machines?

I hope it 's  all good  ;)

I have been trying to update our FP221Cs to 5.6.3 (0493) but I systematically get an error stating that the firmware is not compatible even though the 5.6.3 releases notes state that they are supported. Has anyone managed to do this upgrade.  I went from 5.6.1 to 5.6.2 (0489)without a problem.

Hello Guys, I have Fortigate 100D installed on multiple sites,  and everything is working. Only difference is that some firewalls have Lan port (which goes to internal network) as L3 Physical Interface with static IP whereas other firewalls have L2 type Hardware switch interface. Please explain how it makes difference in networking, Which is Industry standard and why ? 

Hi,Is there a way to get the real client IP behind the Fortigate Device, by adding the add x-forwarded header? I can see it is possible using FortiWeb, but not using Fortigate in the documentation. Vinodh

Hi, Where do you guys place your EMS server ? From a security point of view I'm considering placing it on a dmz that I can make available for our clients (multi customer enviroment). And just put in some rules.... But it might be even better having it behind an F5 service or something other ?  Any inputs ? tips ? :)

Hi i want that my users using forticlleint VPN SSL will be disconnected each 2 hours How i can do that ? Thank

Hi, I'm a newbie in Fortigate (and my English is quite poor, so hope you all can understand my writing), I use Fortigate 300D and 620B (I work at two places with two different series of Fortigate) I've been facing an authentication problem when users (from OpenLDAP) use their smartphone for internet login via Fortigate Login Page. They successfully connect to the system but not for a long period, then their smartphones will be logged out automatically, it's not auto refresh. Whereas no problem with Laptop and PC at all. It's quite serious for me with this problem. I would be very grateful, if anyone could give me any idea to fix it. Thanks in advance.

Hi, I have Fortinet 61E deployed and I want to allow my exchange server to be able to send and receive emails and OWA. WAN interface is 200.200.200.1Exch-1 is 192.168.0.10Exch-2 is 192.168.0.11 Internally I have have DNS round Robin and clients access the servers via URL and randomly assess both servers. For WAN, I have VIP 200.200.200.1 -> 192.168.0.10 (25 -> 25)I cannot create same VIP for other server as it says same already exists. How can I achieve the following:VIP 200.200.200.1 -> 192.168.0.10 (25 -> 25)VIP 200.200.200.1 -> 192.168.0.11 (25 -> 25) I need to open port 25 and 443 on WAN interface and forward traffic to both internal email servers. Exchange server is DAG.Attached is the scenario. Any help will be much appreciated.

Hello, I put new configured FG300E HA with FortiOS 5.4.7 into production network and this FG started to reboot about every 3 minutes and few seconds.Crashlog gives no information about source.How to debug this case ? I don't want to move to FortiOS 5.6.x because many older FortiAPs will not be supported. I'm afraid to move to FortiOS 5.4.8 because of known bug: 470399 The FG-300E/301E and FG-500E/501E reboots with kernel panic errors Perhaps downgrade to FortiOS < 5.4.6 ? A few days ago I've made ticket in Fortinet Support but no helpful suggestions received ... Janusz Such

Hello, I need some help in order to create a custom report. I have an IDS profile and I want to repport the attacks in order to optimize the IPS profile that I'm configuring. The problem is that the data I need is in differents Log Type Database, so I create two datasets: Dataset with log type traffic (where I get srcip,srccountry, dstip,natIP) and Dataset with log type attack (where I get attack type). But i didn't find a way to relate both datasets and I don't have the attack type for a database log type traffic. Does anyone have an idea how can I do that? Is there an SQL sequence I can do in order to have all this information into one Dataset? I'm using the version 5.2.4 ( I'm planning an upgrade, but not for this week) Thanks in advance :)

Hello guys. First of all sorry for my bad English. In the fortigate that we use in my company, I made the configuration of an automatic script so that a full backup of my fortigate is made every day. I am moving the .conf file to a server through a TFTP, but the backup is overlapped. Is there a way to not overlap? Each day I generate the new backup, create a new file and move it to the server? example: Backup_20180508 - first day Backup_20180509 The second day and so on. Thank you guys

Hello!Recently we invested in FortiAnalyzer VM and as off right now it’s working flawlessly and it has proven its worth already. But we are still trying to figure out how we could use FortiAnalyzer to show us the policies that aren't used or aren't used as much as others. Also we would like to know if there is a way to generate a report or place some filter options that could show us which ports/services are used by a certain policy? Let's say for example Lan to Wan.Thanks in advance!Len. B

I have an SSL inspection profile set to deep-inspection.What does this option actually do to the SSL handshake? And will the Fortigate still be able to inspect the traffic?"set client-cert-request bypass"

hi50E model running v5.6.3LDAP server setup and returns AD users, however when i try to add a remote LDAP user i get to the last stage - highlight the user i want and click submit  and i am returned to the list of existing users without the new one being added  - no error messageany ideas ?

I am new to FortiOS but need to configure an IPSEC VPN to a Ubiquity EdgeRouter on the Fortigate 30E firewall. I went through the wizard and have successfully configured the basics using the Fortinet to Cisco template than I converted my tunnel to Custom to set my desired Phase1 and Phase2 parameters. All went well and I saved the config but now, when I click on IPSec Tunnels to display my available tunnels I get an error message saying "Entry not found" and the page lever loads. I have attached a screenshot of what exactly I'm seeing. I have tried different browsers but all have the same problem I am not sure what to do now to be able to continue setting up my VPN. Please help me resolve this problem.

Hello Guys, I have some questions , I am doing vlan Design and add on wireless vlan where i can untagg my FortAPs .My confusion is that FortiAPs are using CAPWAP tunnel to reach Firewall , so does seperate vlan for these Aps make any difference or not. My target seperate wireless traffic from regular traffic. Other thing, In tunnel mode I got option to set DHCP scope on Firewall but how i can add other server as a DHCp server ? Thanks

FGT90D********** # ike 0:Juniper:Juniper: IPsec SA connect 5 200.2.185.178->194.209.69.10:0 ike 0:Juniper:Juniper: using existing connection ike 0:Juniper:Juniper: config found ike 0:Juniper: request is on the queue ike 0:Juniper:11: out 30BDB4CB6C55C10E564DB28F86A3A61408102001D436C4A70000024CD30DF81F3CA52DDAC0DD2B653669691B848974C17A94D5DAF3B228EB2F19061029E19600FE11DC2A2E49616068ED9682CB19F1B4FECD6ABA88BB483C698BE41898161F2B4EFABE8DF4E7062D1E5E0C3377B24585B2ECFDBC6C0B529FC34D3446F487BE71F0AB9C35B900D880EF7ACFA1402BA0348B56114363B69A9C11C4099689A8FA4725D0E74B6C4698F11AE98D6147840D2CCC173E094F6D1E0D443CE0B44636415FEA0C0E97D26E84EB50A3FED190EDE06BE69B60239B08FDBE1D36DA105D3CAAEAB424B8B7D6A40A8C7DE065F9E5EB4035A62C5CC257039E45C3D987DC1CF59ACDD4A5436F75FC686E54A2C0090ADBF0FE61DE5E0789BF4D1BBE856F483FE0DED3A51CD5BABC4B88A69C63C76B8CCAAD715EB53217C96673FC6F2B6989B850AFC4BFDBE49805259A340400DA93E9A124321AB7B4DCA707B1842E126D94C54E67309BC532B1D537C6CA42BF1442D98C0A94BE935C921552554D8EB3BBF

I have configured authentication for FSSO and i want create the report in FortiAnalyzer where user belongs to a particular group or organizational unit. Theoretically, i may use an LDAP Query, however, it is nowhere described as the benefit from this. Does anyone know how this works? FortiGate 5.2 FortiAnalyzer 5.2 FSSO 4.3.0156 - AD access mode: standard Regards

Hello, I should deploy 2 x Fortigate 3000D in HA located in one site each, so that the HA links cannot be direct crossover cables, but regular ethernet cables connected to a LAN infrastructure interconnecting both sites at L2. All my FG 3000D interfaces are 10-gigabit, so that I should use 2x 10-Gigabit interfaces for the HA connection between both, resulting in a theoretical 20Gbps connection. My problem is that I’ve been policed with up to 2 Gpbs in this LAN as per bandwidth constraints of the links between both sites. So my question is whether I can police the HA bandwith consumption in the Fortigate by any means (I have not found any feature to do it), or the best thing I could do is to replace two 10-gigabit SFP+ transceivers by 1-Gigabit SFP’s for HA? 

Hello all I found a very strange behavior. I have a Fortigate with VDOM enabled. In my VDOM named C1_INFRA, I have some VLAN interfaces. Each of these vlan interfaces are PING access enabled. The VLAN interface is aloways the gateway for the subnet. For example, I have a VLAN 10.200.3.0/24, the VLAN interface on my fortigate is 10.200.3.1 (with PING access enabled) and I have a device connected on this same VLAN using 10.200.3.253 as IP address. The device was unable to ping the gateway 10.200.3.1 but it is able to ping another device on the same VLAN. After a lot of researches, I saw in the Local-in policy that my PING from 10.200.3.253 (my device) to 10.200.3.1 is denied. I tried to create a new local-in policy but no success. I finally found the reason why my ping was reject by the fortigate. I configured some administrators and allowed only access from specific subnets (use of Trusted hosts). My subnet 10.200.3.0/24 was not in the list (and it is correct, I don't want to allow

I just plugged in a brand new FortiAP. We already had one FortiAP in place. When I discovered the new FortiAP it appears that the Fortigate pushed the configuration settings from the original AP to this one. It has the same exact SSID's etc. This is an issue, because I wanted to have a different SSID for each one. Is there a way to differentiate this? If I edit the SSID settings under Wifi Switch & Controller, will it change the SSID settings for the original AP? I don't want to change any settings for the original one. Thanks in advance for the help.