Solved

We manage FortiGate firewalls like the 60D, 60E, and 100D. Sometimes we see messages about reaching the FortiSandbox quota for the day. Any way to reduce the amount of traffic going through the FortiSandbox? The only thing I can think of is to put items that should not be scanned with the Sandbox prior to the policy that uses the Sandbox.

Requirement:Access multiple remote client hosts (not entire remote LAN) over VPN and presenting local clients as single IP of 61.x.x.x. This is to comply with security imposed by remote client's CISCO ASR. See pic below for requirement. Following existing fortinet doco http://cookbook.fortinet.com/vpn-overlapping-subnets/ , I am only able to successfully established a routed VPN between the gateways 219.x.x.x <>185.x.x.x, using the "Site to Site - Cisco" wizard template then converted to custom VPN. Attempts to manually setting up the tunnel without converting from the template actually didn't work, despite matching all configuration!  My local LAN 192.168.0.x clients will need to access a number of specific remote hosts e.g 10.1.x.x and 10.2.x.x. Below are the Policies modified from the fortigate autocreated ones:edit 45         set srcintf "internal"         set dstintf "VPN-Phase1"  &nbsp

Hii have fortigate 60e using latest firmware of 5.6im trying to block porn sites from my internal users accesing the internet.this is what i did:in "security profiles" - "web filter" enabled "fortiguard category based filter" and block the "adult/mature" content then i wen to "ipv4 policy" and enabled the "web proxy" option. then tried to test it from a user machine browse to: www.sex.com and saw that the webpage didnt blocked. im attaching screenshots, please help. am i missing any configuration? thanks, 

Hi, Can anyone help me out with a command that will show me the VRRP status of an interface ? (I have searched all over, but I am unable to find anything. :( )

Good day folks, I have a good one for you all. We have recently instated a VPN with a provider of services. In short, the VPN works, however the connection is unreliable. Ping tests between the two have been sporadic at best, on average 20 - 30% packet loss. That and other connections, RPC, SSH, Telnet, RDP fail and when they do connect, timeout very quickly. I contacted our ISP to test and see if there is anything on the WAN side, but that came up clean. I just want to run down the configuration of the VPN connection to be 100% sure that it is indeed not the config nor the Fortinet causing the issue. The Fortinet 60D has the latest update, I used the VPN wizard, and converted it to custom, and punched in the necessary Phase 1 and 2 entries. Here is where it got a bit tricky; We have one encryption domain, 192.168.228.0/24. HOWEVER 228.0/24 had to be mip'd to 12.0/24 (factual internal range). Of course we know that you create a VIP range external 192.168.228.0/24 to 192.

FGT60D running v5.2.11. I'm looking to use application control to restrict outbound SMTP (internal -> wan) to IceWarp (a.k.a. Merak) mail server only, however I'm struggling to understand how to accurately identify IceWarp within a custom signature. Can anyone advise me whether:1. This is actually possible2. The best way to accurately and consistently identify IceWarp (as opposed to a powershell script sending SMTP traffic for example).  

Please see attached.  Running version 5.4.5.  I have a firewall FQDN configured.  I was able to edit a few by right click and choosing "Edit in CLI" (I needed to add the "set cache-ttl" setting).  Then I noticed that when I clicked on one that was configured as fqdn, it popped up as "set type ipmask".  See attached image.  Might want to fix this Fortinet.

At 4:23 PST today we started seeing 403 errors when trying to visit sites.  Only way to allow access is simple unfiltered NAT rule.  Searching form shows this happened in the past with a bad AV engine update.  I notice that support.fortinet.com is down with a 500 error so perhaps they self-inflicted the same.  TIME FOR AN ARCHITECTURE MODIFICATION! Anyone else seeing this? I'm seeing these in my debugs:16330: 2017-09-28 17:03:53 <01449> firmware FortiGate-500D v5.4.5,build1138b1138,170531 (GA) (Release) 16331: 2017-09-28 17:03:53 <01449> application scanunit 16332: 2017-09-28 17:03:53 <01449> *** signal 11 (Segmentation fault) received *** 16333: 2017-09-28 17:03:53 <01449> AVDB 05004000AVDB00201-00052.00000-1709281424 16334: 2017-09-28 17:03:53 <01449> ETDB 05004000AVDB00701-00052.00000-1709281423 16335: 2017-09-28 17:03:53 <01449> EXDB 05004000AVDB00401-00001.00000-1210171547 16336: 2017-09-28 17:03:53 <01449> AV

Hello- Our district has a FG800C with 2K client licenses. I have been told that I cannot upgrade the firmware (currently at 5.2.11) without having to upgrade the client licenses. However, the clients are now at 5.6. I cannot get an answer from either Fortigate or our vendor on whether or not I can upgrade my FG800C to the newest OS (5.6) without losing clients. Can anyone help clarify what I can/cannot do here? Thanks in advance!

I worked with FMG in the past when old devices were 4.0 and new devices were 5.2, but now that we're further into 5.6, it seems like FTNT is moving away from v4.0 compatibility. Since I can't nest ADOMs and have to set the firmware version per ADOM [for Fortigates] how can I manage FGTs that are legacy or can I not have any differing firmware units in the same ADOMs? Tried ignoring the version settings in device groups and got db failures with 5.2-5.6 Fortigates. *This is a lab folks, I am not running a depraved, unorganized infrastructure* Long term plan is to deploy in Azure, starting the configs for this setup on a local FMG 200D.   thank you

When looking at the Web Filter log on my 60D (5.6.0), I am seeing things like "video.twimg.com" and pbs.twimg.com". I want to see the entire URL of the video or picture being viewed. I was under the impression that web filtering monitor would give me this information. Any help would be much appreciated!

For a while now I have been successfully using the IPsec VPN with Forticlient (and native client on mac). However as soon as I assign user groups to firewall rules (the user groups contain the users which successfully connected to the IPsec VPN) the traffic is blocked. According to documentation I understood that I need to have XAuth activated for the VPNs which I have - still no luck. I currently have 2 types of IPsec VPNs, a PSK+XAuth based and a Cert+XAuth based one.Below you will find the config snippets of the respective VPN configurations: edit "RemoteAccess"        set type dynamic        set interface "wan1"        set authmethod signature        set mode aggressive        set peertype peergrp        set mode-cfg enable &n

Hi, When I try to add second SSL-VPN Portal, it says: " Maximum number of entries has been reached ."How can I fix this issue ? Thanks. Fortinet 30D , v5.4.5,build1138 (GA).

Currently I have 2 FortiGate 600D running for VPN gateway in my infrastructure with 80 active tunnels. We just bought Fortimanager and we want to manage VPN on FortiGate but I cannot import the VPN Tunnel on FortiGate to the FortiManager.I have enabled VPN Central Management on FortiManager. However it sill cannot see the tunnels on FortiManager.  Have anybody experiences with VPN on FortiManager? Thanks in advance. 

Hello,When I import an external CA certificate to a FortiGate (5.4.1), I have noticed that I cannot set the certificate's name. The name is always been set by FortiOS to "CA_Cert_1". Do you know if I can set a different name to this certificate? BTW, when I import an SSL certificate as local, FortiOS allows me to set any name I desire. The restriction seems to be in the name of the CA certificate only. Thanks

Hello, After fiddling with quite a few tunnels between Fortigates and ASAs, I have noticed that the ASAs only seem to accept/propose 3DES/SHA1 themselves for encryption/authentication. Is this due to that people doesn't patch their ASAs, and their firmware is archaic, or is it a setup error or an incompability with Fortigate? I don't have an ASA in my lab unfortunatly... Will try to get one. I have seen the same behavior at several customers - You get the IPsec settings from the IT department at the other end, and it contains a string of different encryption/authentication cryptos for you to setup in the Fortigate, but in reality, only 3DES/SHA1 is used, and a diagnose debug application ike -1 tells you that the ASA doesn't respond to, or offer anything else then 3DES/SHA1. Same goes for the phase 2 negotiations. This hasn't been any issue with any other firewall brand I've setup tunnels to. Like Palo Alto, Watchguard, pfSense, Sophos etc. All of them can at least d

I can not configure an LDAP Server on an FG-60E with FortiOS 5.6   I am trying to set up an FSSO from an FG-60E and a Windows Server 2003, but I can not add the LDAP server.   After placing the IP of the Windows 2003 Server, as well as the user and password of the domain administrator, when doing Browser to identify the Distinguished Name, the system indicates: "Invalid LDAP server"   If I put the Distinguished Name manually, and try to test the connection, it says "Invalid credentials"   All this despite the IP of the server is correct, as well as the user and password, which I am placing flat: User = Administrator Key = #####   Waiting for your comments

Hi,Do you guys know why fortigate 90e was removed from the line?Some bug?

I have a basic question: From your experience, what would you recommend as a naming convention for the objects (hosts, networks, ports etc) in a fortigate firewall that is more practical and makes it easier later to support and resolve problems? Your feedback will be appreciated!

Hi, Anyone have any experience with the LLS (L-bit) that most Cisco will have enabled default. As far as I can see in the logs my Cisco box will send with option 0x52, and the Fortigate will send with option 0x42 (that I figure is the LLS option) I am having issues with ospf flapping massivly between loading/full on the Cisco end - and was wondering if anyone else have looked into this..and if it do have an impact ? 

Hi. I will try to be as detailed as possible. Currently we have our network configuration as the draft below. I'm trying to migrate from VLAN1 to a server vlan but when i enable vlan100 no VLAN traffic is routed through the firewall. 1. Removed x.x.x.x/255.255.0.0 from Internal 2. Create Servers VLAN and add x.x.x.x/255.255.0.0  3. Remove x.x.x.x 255.255.0.0 from vlan 1 svi on core network 4. Add x.x.x.x 255.255.0.0 to VLAN100 svi on core network Existing config edit "Internal" set vdom "root"set ip x.x.x.x 255.255.0.0set allowaccess ping https ssh snmp set type aggregate set netflow-sampler both set member "port1" "port2" set device-identification enable set role lan set snmp-index 12 next config proposal... edit "Internal" set vdom "root" set allowaccess ping https ssh snmp set type aggregate set netflow-sampler both set member "port1" "port2" set device-identification enable set role lan set snmp-index 12 next edit "Servers" set vdom "root

Hi, In my fortimail log (installed in fortimanager) I can find so many threat/viruses, like 1 email with infected file each 2 or 10 Seconds. With dynamic sources (Majority asia). What I want to know, if you are experiencing the same events in your fortimail? And what are some best practice to reinforce my fortimail and security in general? (I have only fortinet product for security) Thank you for your answers.  

Hi all, I am a Newbie, I using Foretigate 300D, I need block "facebook, youtube, skype, gmail and amazon" and just open some ip as required. Please help me! Thanks!

They fixed the SSLVPN bug! :)

I have a Fortigate 60C currently running firmware v5.0,build0252 (GA Patch 5). The ' Per-IP Bandwidth Usage' widget is one I have used before to track down users that are using a lot of bandwidth on the network. However currently I can' t see it as an option when I try and add a widget, I am thinking that possibly this widget was only available in an earlier firmware version. Should this widget be available and if so can you tell me where to find it? If not is there a similar widget/report I can get, or is this widget included in the latest firmware?