Solved

Hello, In our company we have Fortigate 60D (v5.4.1) and I'm trying to setup the VPN with Cisco router. Cisco router is owned by other company and I do not have access to it. Phase 1 seems to work as expected ([...] - text cut for better visibility):ike 0:phase-1-int:193473: negotiation resultike 0:phase-1-int:193473: proposal id = 1:ike 0:phase-1-int:193473: protocol id = ISAKMP:ike 0:phase-1-int:193473: trans_id = KEY_IKE.ike 0:phase-1-int:193473: encapsulation = IKE/noneike 0:phase-1-int:193473: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256ike 0:phase-1-int:193473: type=OAKLEY_HASH_ALG, val=SHA2_512.ike 0:phase-1-int:193473: type=AUTH_METHOD, val=PRESHARED_KEY.ike 0:phase-1-int:193473: type=OAKLEY_GROUP, val=ECP384.ike 0:phase-1-int:193473: ISAKMP SA lifetime=28800[...]ike 0:phase-1-int:193473: VID CISCO-UNITY [...]ike 0:phase-1-int:193473: peer supports UNITY[...]ike 0:phase-1-int:193473: DPD negotiatedike 0:phase-1-int:193473: NAT not detectedike 0:phase-1-int:193473: PSK

Hello everyone,I need to enable application control profile on all my policies, how can i do this in one step? 

Hi, First, please let me say, i have gone over the forum and read many posts about this issue, and i just can't find a recommended solution for CLI backups for my system.We have some Fortigate firewalls, all are configured with VDOMs and running in a 2 device cluster (some as active/active and the other as active/passive)Backing up the device should not be so hard. i am trying to log-in to the machine using CLI and running a backup to TFTP operation (Later, i would like also to run an automataed script , but thats the next step)I created a user for the backup. It has a dedicated admin profile (i dont think it is a good idea to give the backup admin user a super admin permission) When i log in with that user, i cannot run the "config global" command , which makes me wonder : 1) what is the difference between running "execute backup full-configuration" from VDOM menu , and running "execute backup config " from global menu? From where should i execute the backup operation? 2) What i

Hello everyone, I am new in FortiGate product, and here is the situation : My company own 60E in HQ, and now we have a new remote office launched,then we need to purchase a new firewall for Site to Site VPN purpose. (Only 3 user in remote office) May I know which Low-end model of FortiGate firewall is suitable to create site to site VPN with my 60E in HQ? Thanks.  

getting this error when FortiClient starts right after user logging-onto Windows. "FortiClient User Avatar Agent has stopped working"Description:  Stopped working Problem signature:   Problem Event Name:    CLR20r3   Problem Signature 01:    fortiavatar.exe   Problem Signature 02:    5.6.0.1075   Problem Signature 03:    5942e3aa   Problem Signature 04:    CommandLine   Problem Signature 05:    1.9.71.2   Problem Signature 06:    512e3cff   Problem Signature 07:    14e   Problem Signature 08:    27   Problem Signature 09:    System.IO.FileNotFoundException   OS Version:    6.1.7601.2.1.0.274.10   Locale ID:    1033 Read our privacy statement online:   http://go.microsoft.com/f...04288&clcid=0x0409 If the online privacy statement

Hi guys, Please, I need clarification about the free FortiCloud account. This is what I have gathered about it: NSE4:Every FortiGate comes with a free one month trial of FortiCloud. Through the FortiGate GUI, you can bind FortiCloud to your Fortinet Technical Support & Customer Service account, activate the trial, and start sending logs. FortiCloud datasheet:Data retention is limited to 7 days. Customers with FortiGate model 30 through 3200 series receive 7 days of rolling storage (unlimited volume).https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiCloud.pdf Fortinet docs:A no-charge service option is available, with 1 GB of storage data. However, the free service is limited to 100 MB logs per day, and only retains 30 days of traffic.https://docs.fortinet.com/uploaded/files/1730/forticloud-faq-20.pdf  As you can see, the documentation is ambiguous. FortiCloud datasheet says data retention is limited to 7 days with unlimite

Hi all, I've already checked tons of manuals, forums, kbs and cookbooks, made hundreds of experiments on live hardware, but can't find the way to do very simple thing - negating defined split-tunneling subnets for remote WLANs. I mean subnets, which are defined in config wireless-controller wtp-profile / edit <profile> / conf split-tunneling-acl. It is nice feature but working opposite way it should - defined subnets are NOT routed to wireless controller. In most cases, traveler with FAP expecting direct access to corp network without other external resources slowdowns, which is 100% occurs, if we route all SSID traffic to WLC. Just imagine, how slow it could be, if remote WLAN deployed in hotel in Hong Kong, but WLC is on duty at Portugal. So I think it is quite normal to define just one (or few) subnets (internal corporate network) to route via WLC, and rest of traffic should go through local FAP GW. For now, to implement t

Hi All, I have an issue with FA disk space. I have license for 1.2TB but using only 103GB and it reaching the limit.There's an error on the dashboard "Hard drive allocated for this VM instance (98.0 GB) is less than the licensed VM storage volume (1.2 TB)." I've seen some posts on this forum how to extend the other disk size but in my case I dont have any disks avaliable : FAZVM64 # execute lvm info LVM Status: OK Disk1  :         Used      104GB/1258GB * Disk2  :  Unavailable        0GB Disk3  :  Unavailable        0GB Disk4  :  Unavailable        0GB Disk5  :  Unavailable        0GB Disk6  :  Unavailable        0GB Disk7  :  Unavailable     &nb

Anyone have one of these yet?  Looking to upgrade from a 40C. A little skeptical with this new line, I don't want another 60C type product on my hands here... Just looking to see reviews, stable, good, bad, ugly....

hi guys,I read this in FortiOS handbook:In reverse proxy mode, the FortiGate unit functions more like a web server for clients on the Internet. Replicated content is delivered from the proxy cache to the external client without exposing the web server or the private network residing safely behind the firewall.My question is, those lines mean that the connections from public users in internet won't go directly to my web-services which are behind fortigate?I want to be sure that servers behind firewall will not get in touch directly with users in internet. Thanks

hi,I am going to buy a fortigate 100 series (not decided specifically on model). What I really need to know is whether it support "reverse proxy" or not. I want it between internet and my webserver (I know about the foriweb, but I am tight in budget and want other fortigate features like IPS as well).Another question is, does fortigate need any license for HA?my last question is, can fortigate get authentication info from users ( for services that need it like email or sharepoint) and give it to server; if authentication was successful user will be directed to server. thanks in advance

Hi guys, I have a customer's FortiGate without UTM licenses such as AntiVirus or Web Filtering. I have read that Application Control is a free service from release 5.6.1 on. Application Control is now a free FortiGuard service and the database for Application Control signatures is separate from the IPS database http://help.fortinet.com/fos50hlp/56/Content/FortiOS/fortigate-whats-new/Top-SecurityProfiles-app-control.htm I can see that the FortiGate has the Application Control Signatures correctly updated, but the IPS licenses are expired since customer didn't purchase these type of licenses, and Application Control uses the IPS engine. Then, what is the impact of these mismatches? Will the FortiGate perform Application Control correctly?  Regards,Julián

Hi team one of our customer using fortigate 100E with 5.6 fortiOS. they need to exclude the AWS ips from security scanning to avoid slow issue. i have created a new policy with fortigate internet service database. so i see that AWS using 4000+ ip address. my question is fortigate internet service database will update automatically ?. or only the same ip will use? RegardsMahesh

The "proxy" category is blocked but we wan't to allow only one legit web site. We created a custom signature with the right pattern. In the override section this custom application is set to "monitor". But this site still blocked. The problem seems that the custom signature worked and I see in the log the "pass" action when the service is HHTP BUT after that the workflow continue to HTTPS service and reach the default signature "Proxy.Websites" and at that time the action is set to "block"... So how to override the bock action? Is it possible to stop the workflow in the custom signature to stop processing after the "allow" action? We set the weight of the signature to 255 but this not working. Here the details: The custom signature:F-SBID( --attack_id 9524; --name "Permit.proxy.XXX"; --pattern "proxy.XXX.ca"; --protocol tcp; --no_case; --flow from_client; --context host; --app_cat 6; --weight 255;) 

Hi all, OK, two sites, HQ and branch1. HQ has a static IP directly connected to the FGT, branch1 has a dynamic IP and NAT router in front of it. On one of the HQ subnets I have computers that need to access both the Internet (via HQ DG) and 2 subnets at branch1. I have set up a dial-in style IPSEC VPN and it is connecting just fine. I've added a policy from the HQ subnet to the branch1 subnets using the dial-up VPN interface as the dst if and created a reciprocal policy for incoming traffic using the dial-up interface as the src if. There are no UTM components (AV, IDS, etc.) configured on these policies. Since it's a dial-in VPN I cannot set static routes on the dial-in "server" (HQ FGT) but I do have a static route on branch1's FGT to the HQ subnet via the VPN tunnel. From a laptop at branch1 I can access resources behind HQ's FGT. From the console on HQ's FGT I can ping resources behind branch1's FGT. However, when I try to access resourc

Hello All, I have two VDOMs, one for my servers and one for my desktops.  I have an inter-vdom link between them.It seems that if I want to allow traffic between a desktop and a server, I need to have 4 rules. Desktop ==> Server1 on the incoming interface on the desktop VDOM, and1 on the "incoming interface" (the inter-vdom link) on the server VDOM Server ==> Desktopthe exact opposites of the above. Is this correct? Thanks in advance,Chris.

Hi, I want to know exactly what will happen if my license expired? I think AV, AS, IPS, ect. won't update anymore but still working. Am I right?HA and Policies will not be affected. Am I right? thank you

Last few days I was busy with configuring IPV6 DHCP on my Fortigate. On the net I found some examples of IPV6 DHCP configurations but for some reasons it's not working on my FTG.  The only way to get it working is to enable autonomous-flag enable. The configuration that I made is as follow:  edit "VLAN10"         set vdom "root"         set ip 10.x.x.1 255.255.255.0         set allowaccess ping https ssh         set vlanforward enable         set device-identification enable         set fortiheartbeat enable         set role lan         set snmp-index 6         config ipv6       &nbs

Hello, I have been wondering what is the precise behavior of the NAT option in an IPv4 Policy. I have several machines connected through a Fortigate 200D and I don't need NAT since they're all in a private network. However, I noticed a strange behavior when I enable the NAT option (at least it sounds very strange to me). I have two Windows servers with an SQL database and they communicate through the Firewall (each server needs to connect to the other one's database). It works but the connection to the DB is very slow one way (slow enough to cause problems in some applications). I tried without the Firewall and the issue remains (so not a FW problem).BUT, I noticed that when I enable the NAT option in the policy between these two servers, the issue seems to go away (connection to the DB is fast). I don't change the policy in any way apart from the NAT option. I know it might be out of topic since the problem exists without the FW but I want to figure it out and knowing what the

Hi, I am new in fortianalyzer, my company would like to have report in working hours. How do I modified SQL select query to filter out weekend and lunch hour logs from the below predefined dataset: Dataset Name: Top-Users-By-Bandwidth select     coalesce(         nullifna(`user`),         nullifna(`unauthuser`),         ipstr(`srcip`)     )as user_src,     sum(         coalesce(sentbyte,0)+ coalesce(rcvdbyte,0)     ) as bandwidth,     sum(         coalesce(rcvdbyte,0)     ) as traffic_in,     sum(         coalesce(sentbyte,0)     ) as traffic_out,     count(*) as sessions from     $log where     $filter     and logid

Hello We are experiencing a strange issue where endpoints (Usually servers) are randomly dropping the NIC's when Forticlient is installed and the only way to bring them back is to enable/re-enable the NIC or reboot (We are also noticing major performance issues). We have Forticlient 5.6 and all clients are registered with an EMS version 1.0.5.0132.  This is a freshly rolled out solution. Things I have tried are..... 1. Uninstalled and re-installed. 2. Disabled all functions one at a time and tested. 3. Disabled compliance.4. Been through Windows logs. 5. Uninstall Forticlient - ONLY THING THAT FIXES THE ISSUE. Not really sure what else to try. Anyone else seen this issue or got any ideas? Cheers,S.

Hello all,  I installed a Fortiswitch 448D-POE running 3.5.4 in managed mode with a Fortigate 61E running 5.4.4 and I have some troubles with DHCP server that runs on my different VLANs. The Fortiswitch is configured to use Fortigate Fortilink interface as NTP server and the Fortigate correctly listen on Fortilink for NTP protocole. My clients are unable to get an IP address until there is not internet connection. It is very strange. The DHCP is set on the VLAN interface of the Fortigate. I have vlan 200 which is a sub-interface of the dedicated link to fortiswitch. the subnet is 192.168.201.0/24.  For the moment we don't want to have a external DHCP server. It should work with Fortigate.  When we don't have internet access, the client are unable to get an IP address and receive a 169.254.... I made some debug and I can see the DHCP DISCOVER that reach the Fortigate, and then I can see the DHCP OFFER sent by the Fortigate but the client never receive it. I

We are implementing a Fortinet infrastructure into one of our main buildings. We are essentially building a new network for these users and we are looking for this system to mesh well with our existing devices. I am currently setting up a Fortigate 600D running v5.4.4. I am trying to set up the WAN port on the Fortigate but every IP I assign to the port is erroring out, claiming that it belongs to our main firewall. The goal is to have a PAT so one external IP address (that belongs to our organization) should do it. At first we were trying to chase down ARP tables from different devices to figure out why that specific IP might be claimed, but as I started to toy around I noticed that even private IPs, externals that didn't belong to us, and IPs I was making up on the spot were claiming to be taken by our main firewall. Is this a bug with the Fortigate Software?  As a work around, I was able to set the WAN IP to 0.0.0.0/0.0.0.0, disable the port, set the IP correctly to one of

I'm new to FortiMail. I have used the Anti-Spam feature in the FortiGate firewalls. I presume that the mail scanning features in the FortiGate are limited compared to the FortiMail solution. How does FortiMail compare to commercial email scanning solutions designed for enterprise use that are available via the cloud? If you were going to recommend an inbound/outbound mail filtering/scanning option what would you recommend and why?

While the new Internet Service Database in 5.4 is a useful reference indeed, it is frustrating that entries in it cannot be bound to firewall policies (at least not that I've found).  You have service entries in there with thousands of IP address / port combinations that would be very useful to reference in policies, whereas you would normally be required to define all of those addresses as individual address objects in the configuration. Are there any plans to allow us to use this new feature in policies? Or am I just missing the way to do it currently?