Solved

Hi guys, I have two ADOMs on the FortiManager (v5.4): - root ADOM running v5.4 - SDC ADOM running v5.2 On SDC ADOM I have two clusters running v5.2. What option should I choose the moment FWs will be upgraded on 5.4? 1. Upgrade FWs, go to System Settings - All ADOMs, edit SDC and try to change version from 5.2 to 5.4? 2. Upgrade FWs, then try to bring/adopt the cluster FWs to root ADOM What do you guys use to make similar migration as smooth as possible? Thanks,Florin.

My filters are:Level [Equal To] NoticeDestination IP [Not Equal To] serverIP_AText filter:srcintf=port30 and service~RDP and action=start The log:itime=2017-08-24 13:12:44 sentbyte=0 rcvdbyte=0 srccountry=Reserved app=UDP_RDP date=2017-08-24 dstip=serverIP_B duration=0 vd=VD1 group=IT service=UDP_RDP proto=17 user=ME dstcountry=Reserved policytype=policy poluuid=45840192-88ea-51e7-b403-e3009408d646 devid=FG000000 dstport=3389 type=traffic dtime=2017-08-24 13:12:43 devname=FG00 time=13:12:43 sessionid=884716921 itime_t=1503594764 policyid=111 srcintf=port30 srcip=10.0.21.101 sentpkt=0 level=notice appcat=unscanned srcport=55887 logid=0000000015 subtype=forward trandisp=noop action=start dstintf=VLAN_6 I'm not getting any hits from that filter.

Hello, I want to be sure, the fortimanager communicate with the fortigate ( TCP 541), but is the fortigate communicate with Fortimanager too? Or Can i put the Fortimanager in a DMZ that the public network can't reached? ( only the Fortimanager can reach the public network not the opposit) Thanks, JF

Hi, We have a number of FortiGate firewalls which range from SMB 60C (being migrated to 51E) to large 1000D. We have purchased FortiManager and installed version 5.4.3 as it covers most of our firewalls firmware. I have recently learnt FortiManager can not manages all firewalls which are on different majour and minor release versions and this can only be managed under a single ADOM - is this correct, as I would under the impression FortiManager would provide a single manage plane for all the firewalls? Around 30% of the configuration on the FortiGates are similar i.e. VPN tunnel to a main FortiGate firewalls. However, the naming convention used to reference these objects is different and in some cases the subnets could be different using identical object naming standards. My understanding, is if I import the first FortiGate into the FortiManager under the same ADOM it will import the policies and objects within the ADOM database. If I then import the second firewall

Hello, I'm trying to understand what is difference in following actions on IPS signature: Block, Reset, Quarantine.  From the user view is traffic blocked in all cases, right? I understand that Quarantine puts IP adres on quarantine list so admins could easily check what is quarantined. But is there some more sophistiated using of these actions?Thank you Petr

Hello together, we upgraded from OS 5.2.5 to 5.6.1. We configured the option system link-monitor on 5.2.5.After we upgraded the function is disappeared, but it is already in our config file. Is the function replaced in 5.6.1 ? Is "SD-WAN Status Check" the replacement ? Many thanks for your help. regardsPatrick

FortiOS 5.2.11 on FGT 60D I'm attempting to re-introduce deep inspection of outbound traffic from laptops used on our network following a long standing ssl inspection issue being patched.The ssl inspection configuration and exemptions we had in place prior to the bug allowed laptops to run Windows Update without issue.Currently on my laptop (Windows 10 Pro) Windows Update fails with error 0x80240437 when run from behind the Fortigate; if I run from within our guest network (which is not behind a Fortigate / SSL inspection) it completes successfully. I can see in the WindowsUpdate.log that this is (probably) down to a certificate check failure:2017/07/19 10:36:59.4330139 16176 14616 IdleTimer [0]3F30.3918::07/19/2017-10:36:59.433 [agent]WU operation (CAgentProtocolTalker::SyncUpdates_WithRecover) started; operation # 10; does<NULL> use network; is<NULL> at background priority<NULL>2017/07/19 10:36:59.4330826 16176 14616 WebServices [0]3F30.3918::07/19/2017-10

We have a /24 LAN configured on a vlan interface. It has been requested to segregate one host on the LAN so it can only reach other LAN hosts via defined policies.Is it possible to do this without changing the host IP address, subnet and default gateway? For instance, is there any way that can two VLANs be treated as one interface in terms of their subnet but control traffic between them using policies?We have a lot of flexibility with VLAN configuration. We do not currently use zones but I do not believe this would help.The managed switches support private VLAN, but this is not an option since we have multiple switches on the LAN (the privacy setting is restricted to the local switch only). From what I can see this is not possible, but it is certainly worth asking. If there are no other options we'll just assign a new IP range to the host and proceed with a regular layer 3 solution. But it would be very nice to do this somehow "in the background". And it would be very u

I want to monitor bandwidth used by Fortigate policies with Fortianalyzer but there is difference between the values appear in report output (bandwidth policy:Top 30 Policies by Bandwidth) on Fortianalyzer and policy count(byte in 5.4) on Fortigate. (I. e. the policy count is 58.55MB and the Fortianalyzer report shows 55.84MB for bandwidth policy) I'm confused which one is right. What does the difference mean? How can I get the correct result? 

Hi all, Currently all CAs in the TrustedCA list are trusted when doing ssl handshake inspection. Now I would like to remove the trust for certain CAs like "WoSign" and/or others systemwide / for ssl inspection. I'm running FOS 5.6.1 and can't seem to find any option to do this. How can this be done?  Cheers,germafab

Hi, Got a Fortigate 60E running 5.4.5. Client's ISP wants us to change public static IP.  This morning I added a new route for the new default gateway, then I went over to WAN1 and updated the new IP and subnet mask.  Hit OK, and instead of changing, it came back with an error just saying "Entry is used." I google that and all I see is details about changing from switch mode to interface mode, nothing about changing an interface's IP Address.  any ideas? 

Hi Guys, Is there any chance to enable `timeout-sent-rst` globaly? Not only for specific policies. I am asking because we have zone containing lot of interfaces. And we don't have rules between them as there is `intrazone allow` configured. http://kb.fortinet.com/kb....do?externalID=FD35049 It's FortiGate-600D. Many thanks. Daniel

Hi Fortinet Team, We are using your cool program Forticlient to have an secure tunnel to our customer repository for checking in stuff in gitlab. The problem is that 2 of us have an speed issue when having Forticlient active. That means, as soon as we logged in, the internet connection gets extremley slow, calling websites is actually impossible. We can committ and push, but nothing more. The IT department told us, that they using this kind of software and process with over 30 coworkers without greater problems. Me and my partner are working on a new Macbook pro (Feb 2017) with latest version of macOS Sierra (10.12.6) and also with the latest Forticlient Software (5.6). I tested the software also on my Windows notebook. The connection speed is also going down but its possible to surf through the net. So this might be a problem with our Macbooks?! Do you have any suggestion what we can try to fix this issue? Thanks indeed, best regards Florian 

Hello! I have two Fortigate 300C devices in two buildings. The connection is a layer 3 connection with static routes, as shown in the uploaded picture. The connection between the two Fortigates is configured on port 2. Also on Port 2 there is a tunnel interface with an IP address. The routing configuration between the Fortigates is static routing. On port 1 on both Fortigates is the connection to the local network of both buildings (connection to the main switches of the buildings). Now I want to transport a second network from the Fortigate 1 over Port 2 to the Fortigate 2 device. This second network is connected on port 3 on the device Fortigate 1. The port on the Switch pointing to the Fortigate 1 is tagged, with one VLAN (VLAN ID 20). I want to transport this VLAN 20 tagged from port 3 (Fortigate 1) over the Port 2 to the other device Fortigate 2 and connect a switch on Port 3 on Fortigate 2. This switch will add this tagged VLAN 20 on his uplink port and then t

Hello, I have looked through the pre-configured datasets in Fortianalyser but cannot seem to find: - drilldown showing top users app usage based on bandwidth where appcat = 'x'.- drilldown showing top users websites visited based on bandwidth where catdesc='x'. Does anyone have datasets for these ?Thank you kindly.

Hello, I have the following drilldown dataset. I cannot work out how to convert the 'bandwidth' column in to a 'browse time' column. Is anyone able to assist ? (I have attached a screenshot which shows how I would like it to be with a browse time column).Thank you kindly if possible. select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, app, sum(coalesce(`sentbyte`, 0)+coalesce(`rcvdbyte`, 0)) as bandwidth from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and nullifna(app) is not null and (appcat = 'Social.Media') group by user_src, app order by bandwidth desc

Hello guys, I am having a problem with Office 365 Autodiscover process and FortiGate. Basically, when my client (Outlook or even web browser) tries to reach an unresolvable URL like https://tenantname.mail.onmicrosoft.com/autodiscover/autodiscover.xml it presents me with FortiGate certificate warning (signed by FortiGate CA) and when accepted I get to the FortiGate's replacement message saying that DNS name does not exist.If HTTPS URL is valid (DNS resolvable) then it just gets me to the destination, even if there is no content there, which is what's needed in the previous case. I've tried creating a Static URL Filter in order to bypass this behavior, without luck. Even disabling all kind of SSL inspection and Application Control options, I still get that "error". Is there a way to bypass this? I am using only Explicit Proxy rules. Replacement message cannot be disabled in general, but can be bypassed for this particular FQDN, if possible. Thanks a lot! BR

Has anyone managed to shutdown FortiClient 5.6 manually when managed by EMS and you set a password lock ? Even after I click "Disconnect" and enter the password I cannot unlock forticlient and shut it down, works well in 5.4 but not in 5.6.

We are planning to purchase a Fortigate 600D as it has 2 X 10 GE SFP+ interfaces. We will be terminating a 1Gbps ( fiber link) from the ISP on one of these 10 GE interfaces. My question is  1) Can we modify the speed on these interfaces to run at 1 Gbps  assuming the other end also supports it?2) Can we terminate the Internet connections on any of the available ports on the Fortigate or are there dedicated ports ?  Thanks

Hello allMay I know the data sheet of FortiGate-800C?ThanksBR

I have installed 5.4GA on a test 60D unit, all is kind of okay, i have turned on Advanced Routing under features.. i see no place though where i can configure ECMP (inc. health monitor)? does anyone know where this feature has gone?! it used to be under settings in Static routing on 5.2... but is missing on 5.4 even when Advanced routing is turned off..

Before upgrading to EMS 1.2.1, when one clicked on the forticlient tray icon and selected "Connect to VPN", the VPN window opened in order for the user to enter the appropriate credentials (username/password). Now, after the upgrade, when the "Connect to VPN" is selected a small window appears saying: "Empty username is not allowed" !!! Do I miss something or every EMS upgrade creates more bugs than corrects?!

Hi, I have a question. I will enable DHCP option 191 with 2 IP address. I can set 1 IP address. This is my dhcp config:config system dhcp server edit 1 set ntp-service local set default-gateway 10.6.34.1 set netmask 255.255.255.0 set interface "lan" config ip-range edit 1 set start-ip 10.6.34.30 set end-ip 10.6.34.70 next end set timezone-option default set option1 191 '0a01221d' set dns-server1 10.1.34.60 set dns-server2 10.1.34.61 next end The Cisco command for option 191 is: option 191 ascii pool1=10.1.34.22,10.1.34.29;level=2 Does anybody know how to do it? Thanks a lot Regards

Hello.Is there a way to FortiGate logs to a second or third syslog server, syslogd2 or syslogd3?  I don't see how to do that in the 5.4 web console or CLI.  It seems that 5.2 had that feature.http://help.fortinet.com/fgt/handbook/cli52_html/index.html#page/FortiOS%25205.2%2520CLI/config_log.16.19.html

I would like to know if anyone has already managed by SSH to enable in fortigate authentication via SSH with local certificate