Solved

Hi all, I've already checked tons of manuals, forums, kbs and cookbooks, made hundreds of experiments on live hardware, but can't find the way to do very simple thing - negating defined split-tunneling subnets for remote WLANs. I mean subnets, which are defined in config wireless-controller wtp-profile / edit <profile> / conf split-tunneling-acl. It is nice feature but working opposite way it should - defined subnets are NOT routed to wireless controller. In most cases, traveler with FAP expecting direct access to corp network without other external resources slowdowns, which is 100% occurs, if we route all SSID traffic to WLC. Just imagine, how slow it could be, if remote WLAN deployed in hotel in Hong Kong, but WLC is on duty at Portugal. So I think it is quite normal to define just one (or few) subnets (internal corporate network) to route via WLC, and rest of traffic should go through local FAP GW. For now, to implement t

Hi All, I have an issue with FA disk space. I have license for 1.2TB but using only 103GB and it reaching the limit.There's an error on the dashboard "Hard drive allocated for this VM instance (98.0 GB) is less than the licensed VM storage volume (1.2 TB)." I've seen some posts on this forum how to extend the other disk size but in my case I dont have any disks avaliable : FAZVM64 # execute lvm info LVM Status: OK Disk1  :         Used      104GB/1258GB * Disk2  :  Unavailable        0GB Disk3  :  Unavailable        0GB Disk4  :  Unavailable        0GB Disk5  :  Unavailable        0GB Disk6  :  Unavailable        0GB Disk7  :  Unavailable     &nb

Anyone have one of these yet?  Looking to upgrade from a 40C. A little skeptical with this new line, I don't want another 60C type product on my hands here... Just looking to see reviews, stable, good, bad, ugly....

hi guys,I read this in FortiOS handbook:In reverse proxy mode, the FortiGate unit functions more like a web server for clients on the Internet. Replicated content is delivered from the proxy cache to the external client without exposing the web server or the private network residing safely behind the firewall.My question is, those lines mean that the connections from public users in internet won't go directly to my web-services which are behind fortigate?I want to be sure that servers behind firewall will not get in touch directly with users in internet. Thanks

hi,I am going to buy a fortigate 100 series (not decided specifically on model). What I really need to know is whether it support "reverse proxy" or not. I want it between internet and my webserver (I know about the foriweb, but I am tight in budget and want other fortigate features like IPS as well).Another question is, does fortigate need any license for HA?my last question is, can fortigate get authentication info from users ( for services that need it like email or sharepoint) and give it to server; if authentication was successful user will be directed to server. thanks in advance

Hi guys, I have a customer's FortiGate without UTM licenses such as AntiVirus or Web Filtering. I have read that Application Control is a free service from release 5.6.1 on. Application Control is now a free FortiGuard service and the database for Application Control signatures is separate from the IPS database http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-whats-new/Top-SecurityProfiles-app-control.htm I can see that the FortiGate has the Application Control Signatures correctly updated, but the IPS licenses are expired since customer didn't purchase these type of licenses, and Application Control uses the IPS engine. Then, what is the impact of these mismatches? Will the FortiGate perform Application Control correctly?  Regards,Julián

Hi team one of our customer using fortigate 100E with 5.6 fortiOS. they need to exclude the AWS ips from security scanning to avoid slow issue. i have created a new policy with fortigate internet service database. so i see that AWS using 4000+ ip address. my question is fortigate internet service database will update automatically ?. or only the same ip will use? RegardsMahesh

The "proxy" category is blocked but we wan't to allow only one legit web site. We created a custom signature with the right pattern. In the override section this custom application is set to "monitor". But this site still blocked. The problem seems that the custom signature worked and I see in the log the "pass" action when the service is HHTP BUT after that the workflow continue to HTTPS service and reach the default signature "Proxy.Websites" and at that time the action is set to "block"... So how to override the bock action? Is it possible to stop the workflow in the custom signature to stop processing after the "allow" action? We set the weight of the signature to 255 but this not working. Here the details: The custom signature:F-SBID( --attack_id 9524; --name "Permit.proxy.XXX"; --pattern "proxy.XXX.ca"; --protocol tcp; --no_case; --flow from_client; --context host; --app_cat 6; --weight 255;) 

Hi all, OK, two sites, HQ and branch1. HQ has a static IP directly connected to the FGT, branch1 has a dynamic IP and NAT router in front of it. On one of the HQ subnets I have computers that need to access both the Internet (via HQ DG) and 2 subnets at branch1. I have set up a dial-in style IPSEC VPN and it is connecting just fine. I've added a policy from the HQ subnet to the branch1 subnets using the dial-up VPN interface as the dst if and created a reciprocal policy for incoming traffic using the dial-up interface as the src if. There are no UTM components (AV, IDS, etc.) configured on these policies. Since it's a dial-in VPN I cannot set static routes on the dial-in "server" (HQ FGT) but I do have a static route on branch1's FGT to the HQ subnet via the VPN tunnel. From a laptop at branch1 I can access resources behind HQ's FGT. From the console on HQ's FGT I can ping resources behind branch1's FGT. However, when I try to access resourc

Hello All, I have two VDOMs, one for my servers and one for my desktops.  I have an inter-vdom link between them.It seems that if I want to allow traffic between a desktop and a server, I need to have 4 rules. Desktop ==> Server1 on the incoming interface on the desktop VDOM, and1 on the "incoming interface" (the inter-vdom link) on the server VDOM Server ==> Desktopthe exact opposites of the above. Is this correct? Thanks in advance,Chris.

Hi, I want to know exactly what will happen if my license expired? I think AV, AS, IPS, ect. won't update anymore but still working. Am I right?HA and Policies will not be affected. Am I right? thank you

Last few days I was busy with configuring IPV6 DHCP on my Fortigate. On the net I found some examples of IPV6 DHCP configurations but for some reasons it's not working on my FTG.  The only way to get it working is to enable autonomous-flag enable. The configuration that I made is as follow:  edit "VLAN10"         set vdom "root"         set ip 10.x.x.1 255.255.255.0         set allowaccess ping https ssh         set vlanforward enable         set device-identification enable         set fortiheartbeat enable         set role lan         set snmp-index 6         config ipv6       &nbs

Hello, I have been wondering what is the precise behavior of the NAT option in an IPv4 Policy. I have several machines connected through a Fortigate 200D and I don't need NAT since they're all in a private network. However, I noticed a strange behavior when I enable the NAT option (at least it sounds very strange to me). I have two Windows servers with an SQL database and they communicate through the Firewall (each server needs to connect to the other one's database). It works but the connection to the DB is very slow one way (slow enough to cause problems in some applications). I tried without the Firewall and the issue remains (so not a FW problem).BUT, I noticed that when I enable the NAT option in the policy between these two servers, the issue seems to go away (connection to the DB is fast). I don't change the policy in any way apart from the NAT option. I know it might be out of topic since the problem exists without the FW but I want to figure it out and knowing what the

Hi, I am new in fortianalyzer, my company would like to have report in working hours. How do I modified SQL select query to filter out weekend and lunch hour logs from the below predefined dataset: Dataset Name: Top-Users-By-Bandwidth select     coalesce(         nullifna(`user`),         nullifna(`unauthuser`),         ipstr(`srcip`)     )as user_src,     sum(         coalesce(sentbyte,0)+ coalesce(rcvdbyte,0)     ) as bandwidth,     sum(         coalesce(rcvdbyte,0)     ) as traffic_in,     sum(         coalesce(sentbyte,0)     ) as traffic_out,     count(*) as sessions from     $log where     $filter     and logid

Hello We are experiencing a strange issue where endpoints (Usually servers) are randomly dropping the NIC's when Forticlient is installed and the only way to bring them back is to enable/re-enable the NIC or reboot (We are also noticing major performance issues). We have Forticlient 5.6 and all clients are registered with an EMS version 1.0.5.0132.  This is a freshly rolled out solution. Things I have tried are..... 1. Uninstalled and re-installed. 2. Disabled all functions one at a time and tested. 3. Disabled compliance.4. Been through Windows logs. 5. Uninstall Forticlient - ONLY THING THAT FIXES THE ISSUE. Not really sure what else to try. Anyone else seen this issue or got any ideas? Cheers,S.

Hello all,  I installed a Fortiswitch 448D-POE running 3.5.4 in managed mode with a Fortigate 61E running 5.4.4 and I have some troubles with DHCP server that runs on my different VLANs. The Fortiswitch is configured to use Fortigate Fortilink interface as NTP server and the Fortigate correctly listen on Fortilink for NTP protocole. My clients are unable to get an IP address until there is not internet connection. It is very strange. The DHCP is set on the VLAN interface of the Fortigate. I have vlan 200 which is a sub-interface of the dedicated link to fortiswitch. the subnet is 192.168.201.0/24.  For the moment we don't want to have a external DHCP server. It should work with Fortigate.  When we don't have internet access, the client are unable to get an IP address and receive a 169.254.... I made some debug and I can see the DHCP DISCOVER that reach the Fortigate, and then I can see the DHCP OFFER sent by the Fortigate but the client never receive it. I

We are implementing a Fortinet infrastructure into one of our main buildings. We are essentially building a new network for these users and we are looking for this system to mesh well with our existing devices. I am currently setting up a Fortigate 600D running v5.4.4. I am trying to set up the WAN port on the Fortigate but every IP I assign to the port is erroring out, claiming that it belongs to our main firewall. The goal is to have a PAT so one external IP address (that belongs to our organization) should do it. At first we were trying to chase down ARP tables from different devices to figure out why that specific IP might be claimed, but as I started to toy around I noticed that even private IPs, externals that didn't belong to us, and IPs I was making up on the spot were claiming to be taken by our main firewall. Is this a bug with the Fortigate Software?  As a work around, I was able to set the WAN IP to 0.0.0.0/0.0.0.0, disable the port, set the IP correctly to one of

I'm new to FortiMail. I have used the Anti-Spam feature in the FortiGate firewalls. I presume that the mail scanning features in the FortiGate are limited compared to the FortiMail solution. How does FortiMail compare to commercial email scanning solutions designed for enterprise use that are available via the cloud? If you were going to recommend an inbound/outbound mail filtering/scanning option what would you recommend and why?

While the new Internet Service Database in 5.4 is a useful reference indeed, it is frustrating that entries in it cannot be bound to firewall policies (at least not that I've found).  You have service entries in there with thousands of IP address / port combinations that would be very useful to reference in policies, whereas you would normally be required to define all of those addresses as individual address objects in the configuration. Are there any plans to allow us to use this new feature in policies? Or am I just missing the way to do it currently?

Hello,I have a fortigate unit with firmware v5.4.2,build110, and I have two wan interfaces with too many inside interfaces. I have a policies identical and duplicated and I want decrease this HUGE number of policies by creating a zone for the WAN interfaces and also a new zone for the inside interfaces if possible.as you know I can't bind interfaces to a new zone since the interfaces are used at policies :(Q1: what is the best way to do this, i'm thinking to do that a notepad by creating a zone and replace the interfaces with the new zones, is it a good idea? or do you have another way?Q2: can I create a policy between interfaces within the same zone?Q3: can we add interface like vlan interfaces within a trunaggregate and physical interface within the same zone? thanks

Hello, guys! I have FortiGate 200D v5.6.2 build1486 (GA). I created proxy-policy. I add FSSO group there, but this policy don't work. The policy without FSSO group worked.  When I use "diagnose debug authd fsso list", I see correct FSSO logons.When I use "diagnose debug enable" and "diagnose degug authd fsso server-status", I see my Server Name and Connection Status - connected. Help me please.

hello, I have two fortigare 1000c units, and i’m in process to have teo internet links from the same isp and i want to apply BGP, and i have the following questions: 1- i will receive the default route from the isp through the two lines but i need to prefer the the WAN2 which is the second internet line from isp and in case the line is down use automatically to the first line, my question what bgp feature will be used? Or just use static route? 2- i will advertise my public subnet through the two lines but i will prefer some IPs within this subnet to prefer WAN1, what bgp feature to use to avhieve this? Or use policy based routing only? 3- currently i have enabled WAN load balancing, after applying the bgp and doing the points mentioned above, i think i should disable the WAN load balancing feature, right? 4- do i need to enable to activate some any SLAs mechanism in order to keep monitoring the WAN lines especially if we use static route? Or if we use receiving default route can solve

FortiSandbox 2.5.0 is out!!

Hi guys, I wonder if enabling IPS in the direction LAN --> WAN is necessary or not in order to protect my PCs againts attacks. I mean enabling IPS from LAN to Internet, like this:  Is it ok? Regards,Julián

Hello, We are encoutring high CPU usage on many 60D Fortigates. The firmware version is 5.2.3.The process responsible of this high CPU charge is httpsd (screenshot attached).Killing the process will reduce the charge but after few days, the same issue will start again. Did anyone have the same issue ? Thank you for your help. Regards,Hatim