Solved

F-Gate 5.4.1Inspection Mode: Proxy-basedSec Profiles: SSL (full-inspections), Web, Proxy.Client Firefox: version 46,47,56Symptoms: All HTTPS connections failing.Firefox error message: Secure Connection FailedPacket Sniffer result (attached): Client-to-FG => 3 way handshake ok, Client SSL hello, FG ACK, FG RST. FG-to-Server=> 3-way handshakeDebug WAD (attached): Failing to load default Untrusted CertificateWorkaround: Use the Fortinet_CA_SSL default certificate (which is by default used for trusted re-sign) for untrusted as well, however this will workSolution (1): Regenerate the default Untrusted Certificate (not sure if possible). Solution (2): Generate a new self-signed certificate for the Untrusted Certificate (not sure if possible). Solution (3): Generate a new CA-signed certificate for the Untrusted Certificate.

Hi All,I'm the network administrator at a school. We recently got a Fortigate 30E device to control the network.  I need help with the Fortigate. I'm struggling to create an IPv4 Policy to allow staff to access the internet all the time and disallow students to access the internet on certain times. I know how to do the scheduling and groups from the Active Directory.  My concern, however, is that some staff members work on LAN connected devices... These LAN devices are not joined to the domain.  By the IPv4 Policy when selecting the source, I select the source as Staff (from the Active Directory group) and NONE. When I apply the policy, LAN connected devices have no access to the internet... I have added their MAC and IP Addresses to the Custom Devices and added them to the policy as the source, but still no internet.  Any help regarding this please??  Thanks in advance :)    

Hi all :) we have a fortigate with fortiOS 5.2.2 and we need to upgrade it to 5.6.3i have a question about it :     "can we directly install fortiOS 5.6.3 on it if our firewall has no config ? or we should go through the upgrade path?"

Hi,I have recently come across a doubt regarding whether, FortiNet Web Filtering can be used for blocking the access to various social media sites like, Facebook, Twitter, Instagram, etc. If yes, may I know the process involved, please. Thanks in Advance.

Hello everyone, I noticed in Log&Report -> Forward Traffic pretty many (2-3 entries per second) Deny:DNS error. That is what it looks like: On the FortinetGuide Twitter Account I found information: "If you see #FortiGate forward traffic log Deny:DNS Error, it's not the 'gate blocking DNS traffic. It's just not forwarding failed response." https://twitter.com/forti...tus/912853368636366850 But what exacly it is? Why these errors are so much? Mail server is not configured properly? Thanks in advance for your feedback. Regards, Lucas

Hi experts, I have a doubt about the "Workstation verify interval" and "Dead entry timeout interval":  1. So if user A closes his laptop without logging off, the collector will not be able to connect to the workstation and his status will change to "not verified". This will trigger the dead entry timeout interval and it will last 8 hours (by default) until the user is purged from the collector. If within this period of time an attacker connects his laptop with an static IP equals to that of the user A, now the collector will be able to connect to the workstation, the status will change to "OK" and the attacker will gain access to the network. Am I correct? 2. What happens when the "Workstation verify interval" is set to 0? The collector will not check if users are still logged on, but what will be the status of them? 3. What happens when the "Dead entry timeout interval" is set to 0? Will the users be never purge? Regards,Julián  

Is there a way to generate a complete list of units in FA across all ADOMS?  I would like to be able to find a unit by serial number, if I could make a list based on name I could figure out what ADOM it's in from there. 

Hello,I have some questions about the Configuration and Rebranding Tool.According to the FortiClient docummentation the Configuration tool is free and can be downloaded from the FNDN site.Does it mean that I can create an MSI installer and provide it to hundreds of our customers for deploying via Active directory for free?Does it matter that the configuration tool was downloaded under my account and I can user it for unlimited customers to create custom installer? The Rebranding tool should be available to download with FNDN site license. What does it mean? Where to obtain this license and where to put/upload the license on the FNDN site?

  Does this exists? I've found http://kb.fortinet.com/kb/documentLink.do?externalID=FD39996, but couldn't found the files they're mentioning (even as a partner). I also found several references to packages for some distros, but couldn't find anything "official" that confirm nor denies Linux support.  Or is it unofficial (like "open-vm-tools" on vmware)?  

Hi experts, In my work I have never seen two FortiGates in HA Active-Active mode, always Active-Passive mode. There is documentation for both modes, but the Active-Passive is always more common. According to me Active-Active mode is better since it provides redundancy, like Active-Passive, and also load balancing, unlike Active-Passive, which I guess it enhances the performance of the two FortiGates. Why is Active-Passive mode more common? Is there any downside of using Active-Active mode? Many thanks in advance,Julián 

We have a pair of 1500d units and FortiAnalyzer. Last night one of our web servers started throwing errors. I *think* the Fortigate failed over to the other node, but I haven't be able to find any log to prove this. How does one configure the Fortigate, or FortiAnalyzer, to alert someone when LB monitoring logs a failure with a web server? Denny

HiI have a Fortigate 80C Firewall.This is having all the Internal Ports configured as Internal Switch. Just to note Fortigate 80C Internal Switches are 100Mbps each. My target is I need to make the bundle with 2 of these ports so that it can be more than 100Mbps. Is there any way that in Fortinet 80C I can make the 2 Internal Switch Port as Link Aggregation or Bundle ? If Yes what are the syntax could be ? I attached 2 port internal switch screen shot in case it helps to understand the scenario. BR//Subrun

In our organization we have clients that do not connect to internet and we only have our infrastructure with out internet facility due to security reasons. How can we install forticlient without connecting to internet. Means where is offline installer (Full installation)

Forticlient 5.6.2 blocks *.local domains as 'newly observed'.  I can't log into VMWare console now. Also, there's no category for this to be allowed.  Where in the EMS server is the setting to "allow" or "warn"?  EMS server is not completely up to date.  

Hi guys, When trying to activate the CASI feature I noticed it is not visible under System > Feature Visibility. My Fortigate is working in proxy-based mode, but the NSE4 course says it is OK:  However, the Fortinet Help says the following: Unfortunately CASI does not work when using Proxy-based profiles for AV or Web filtering for example. Make sure to only use Flow-based profiles in combination with CASI on a specific policy.http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-whats-new-54/Top_CASI.htm But I am not sure if that means CASI doesn't work with proxy-based mode at all or if it can be used within a profile without proxy profile. What do you think about this? By the way, I am running firmware v5.6.2. Regards,Julián 

Hey y'all, I'm new here so bear with me I'm looking for a solution to automate setting up a FortiGate machine - i.e. spin it up and have it automatically set rules, VIPs, etc. without ever necessarily having to log onto it. The obvious solution is Ansible/Chef/Puppet and the like but I've no experience using these tools on FortiOS, only Linux distros. Has anybody tried this? Or even better does anybody have a different solution to my conundrum? Thanks in advance!- Chloé  

New to Fortigate, have a 30E running latest 5.6 firmware. I am trying to understand the process of creating VLANs on the device. It appears to me that, from the hardware switch containing LAN ports 1-4, you can create VLANs with VLAN IDs and unique router IP addresses for each VLAN. Then you can connect to the "trunk" port of another switch to any of the 4 ports and configure matching VLAN IDs on the separate switch. This works as far as I can tell. But how would I configure a port on the Fortigate to be in "access" VLAN mode? For example, I create VLANs 10, 20, and 30 under the Hardware Switch. I don't see a way to have port 1 assigned to VLAN 10, port 2 to VLAN 20, port 3 to VLAN 30, and then maybe port 4 would be a trunk of all VLANs to a separate switch. If I remove a port from the hardware switch, I don't see any VLAN settings at all in the GUI config (no option for native VLAN, default VLAN, or anything at all.) So is this scenario not possible on the 30E?

I have to set up a NAT-intensive box, using FMG + ADOM, 5.6.2 (FG 5.6.3)Firewall is connected to many worlds, and trying to make everything without central NAT turned up to be quite a mess.However, on Central NAT, I can not resolve the following situation: If a private-addressed server goes to the internet on SMTP, it should masquerade its source IP as (e.g.) 1.1.1.1, if going out with HTTP request then it has to be masked as 1.1.1.2, if DNS, then 1.1.1.3. Without central NAT, one only has to separate SMTP, DNS and HTTP rules giving every NAT field its own pool. Any ideas? Martin

I have a successful SSL inspection policy enabled with AV scanning as well on my Fortigate 50E. I have the following policy configured on the LAN-Internet policy. SSL inspection is configured to inspect all ports: edit 1        set name "LAN-Internet"        set uuid 3fb6d2ee-fc17-51e7-e50e-699ed85aaff6        set srcintf "lan"        set dstintf "wan1"        set srcaddr "all"        set dstaddr "all"        set action accept        set schedule "always"        set service "ALL"        set utm-status enable        set av-profile "default" &nbs

HA StatusStandaloneSystem TimeThu Jan 25 11:11:12 CET 2018 [link=https://10.240.1.26/cgi-bin/module/launchpad/dashboard?nocache=0.6431283330759745][Change][/link]Firmware Versionv5.2.7-build0757 160408 (GA) or can I do it during office hours if I take a snapshot. Thanks

Hi,I want to create one DMZ with 2 vlans on foortigate 600d unit; is it possible?or whats the best way to do with 2 servers (mail server and database server)?Thanks

Hi guys:   We want to implement two factor authentication in forticlient vpn, may be done using Fortitokens ?Thanks in advance. Hugo

Greetings all,   We're trying to update our Fortigate D200 from v5.6.2 to v5.6.3.  When we do this, regardless of the method used to send the firmware (USB, web update / via web interface, boot and pull from USB) our fortigate hangs at "Firmware upgrade in progress ..." after it reboots and nothing else happens after that.  We've let it sit as long as 30 minutes and it does not progress past that point.  If we reboot, the system detects that the firmware update failed on the backup partition and proceeds with a normal boot process. We've had a history of firmware update issues on this device and I wanted to check with the community here to see if anyone else has had similar issues with this update or the D200 in general, and if so, if anyone knew of anything else I should try to resolve the issue.  If there are also any diagnostics I should run that could give me more insight into the condition of the flash, or logs that could show me more d

Hi Team,I am searching a solution for my client. He is having 5 sites in different - 2 countries. Now IPsec Site to Site VPN tunnels and (One site) Dial-up User IPsec VPN are working fine from HO office. Today client has requested for Intersite communication also. I don't want to make VPN tunnel between sites because some sites having low bandwidth.  How I can archive the solution now. I got a solution as VPN Concentrator on the fortigate website: http://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-ipsecvpn-52/Hub_and_Spoke_Config/Config_Hub.htm#ToDefineVPNConcentrator Please help me. Is it a good solution for me? Do I need any dynamic routing?Regards,Deepak Kumar   

FortiMail 5.4 has been approved for release and will be uploaded to the support site in the next few hours.This version of FortiMail is a major rework focused on enhancing the GUI, removing the need for plugins and improving the configuration workflow: In addition to the GUI enhancements,  the following new features have been added:[ul]Extreme virus database supportFortiGuard Virus Outbreak Protection Service (licensed feature)Dynamic Adult Image Analysis Service (licensed feature)SAML SSO Support for FortiMail webmail.Password decryption for archive and PDF filesAV and FSA rescan for released quarantine email[/ul]See the release notes and admin guides once uploaded for details of these and many more new features.  Carl