Solved

Hi, What solution do any of you use to remotely power down a Fortigate when it enters unrecoverable conserve mode? I have a few devices in remote locations that I cannot get to in a timely manner, I need to be able to remotely connect to a PDU of some sort to power down a port and reboot the device. I have some across 8 way switching PDU's such as the one below from APC and Lindy but a single port device would be ideal. Any thoughts and what have you done to get over this problem? https://www.lindy.co.uk/networking-c5/remote-access-c266/ip-power-switch-classic-8-power-management-over-ip-p4456 http://www.apc.com/shop/my/en/products/Rack-PDU-Switched-1U-16A-208-230V-8-C13/P-AP7921 

I blocked facebook on fortinet firewall, but this ultrasurf extension on chrome has  bypass to unblock fbanyone help me to block this extention. 

Hi Is there a chance to temporarily disable one (1) super admin account? I have created a super admin account for our vendor access and I wanted to disable it once in a while after the support. Thank you.

Is the seq# that determines the order in which the policy are applied?Thanks 

I have a FS-248D managed by a Fortigate 60E. I have found many MANY examples on how to aggregate Fortilink interfaces, but I can't find a single example on how to aggregate ports on the fortiswitch.Neither from GUI or CLI.Actually I found some examples given when running the Fortiswitch in standalone, not managed. The reason I want to do this is to support LACP (2 ports) from my linus NAS.I had this setup on a DGS-1210-52 (might I add, the 248D is quite the upgrade!) which worked perfectly well. Can someone help me? Side question, does anyone see an issue trying to reuse one of the old DGS-1210 by aggregating it(using 4 ports) on the fortiswitch as well? ThanksLouis

Hello,   I forget about the Forigate 60d (fortios 5.6) and I can not configure several external IP addresses (on the same WAN interface). The fault WAN is configured with an external address (46.20.145.200). I have 4 other external IP addresses that I would like to use to NAT on different internal server, for example: 46.20.145.202 - 192.168.1.201 (Special Port 23587) 46.20.145.203 - 192.168.1.202 (https) 46.20.145.204 - 192.168.1.203 (https) etc ... Idea?   Thanks

I have fortiGate 30D that have 5 ports (1WAN and 4 LAN ports). now i have two ISP, can i use LAN port to connect to ISP link as WAN port. because in fortigate 30D, it has WAN Link Load Balancing. Thank in advanced

We have users with extra email aliases attached to their Microsoft Exchange accounts. I had LDAP authentication profile selected with Recipient Verification enabled  and discovered due to a user complaint that all of the emails destined to one of these attached aliases were automatically rejected. I changed the authentication method to SMTP and now it seems that any email to our @domain.com is accepted and everything else is rejected. I am pretty sure that this is not the work of the recipient verification feature but actually the recipient policy I have in place. Will recipient verification work correctly with attached aliases? How do I get recipient verification working via SMTP/ESMTP?

Hello, is there a version of FortiExplorer that is offline installable?I need to install it on education-computers which are not online. RegardsSascha 

Hello everyone, I'm looking to take the NSE5 exam and was wondering if anyone who has already taken it could share their experience?  Many thanks!A

Dears, I want to disable tcp state by-pass for a particular source and destination as per below link of cisco, how we can do in fortigate. http://www.cisco.com/c/en/us/support/docs/security/asa-5500-x-series-next-generation-firewalls/118995-configure-asa-00.html#anc7 Thanks

How often are the IPS signatures updated? For instance this advisory was just posted @ https://www.us-cert.gov/ncas/alerts/TA17-164A Thanks

Hi experts, I have very simple project that they need firewall solution and I am compatible with fortinet products. So, is there any trick that I crack fortigate-vm and use it forever without loosing my configurations?   regards

I am running 5.2 on a 60C, with FortiClient 5.2.1 on all clients, all of which are " on-net" . However, on the 60C, all of the clients show up as " off-net" . Is there something that I need to do in order to make them register properly?

Hello! Guys, need help... Cant understand the problem. Have a lot of branch offices with FortiWiFis 30E-3G4G-INTL there, and 300D in the center. All of them are connected with ipsec vpn to center (300D). So... Yesterday I was removing old Zywall with brand new FG. New comps with win8, 10, iphones and androids worked perfect. But windows 7 saw only local lan... All of devices got their ips through FG's DHCP with correct gateways and DNS... Yep... And there were no any logs  about sevens on the FG... I replaced FG with old zywall - and everything started to work. What is this? Thanks!

Hello, we having trouble with throughput the SSL VPN on Windows Latency from the client to the Fortigate is about 20ms and bandwidth in Fortigate site is 1Gbps and client site is 100Mbbps First, when connecting locally over the internal gigabit network (with near-zero latency), performance easily exceeds about 60Mbps for download on the client. I verified through trace routes, the route table, and Task Manager that tested traffic was indeed flowing through SSL VPN. This tells me that the underlying hardware is capable. However, when testing from off-site (at least 100Mbps and 20ms latency), the performance changes. From the client' s perspective, the download rate through SSL VPN is about 13Mbps and the upload is the problem in that it cannot exceed about 2-3Mbps.It seems that the increased latency is the contributing factor. Given that the SSL VPN uses TCP, my guess is that there' s an issue with TCP window scaling of the SSL VPN connection itself, especially when the client is

Is it possible to return a list of unused firewall addresses in the cli?This is directly related to the Ref column in the GUI. However the ref column can not be sorted or filtered.So the question might be if the ref count can be seen in the cli somehow? I am aware of diag sys checkused, but the opposite is required here.It would be possible to write a script to do this but obviously if the functionality exists already that would be better. Backstory, firmware is 4.3 and we've hit the address table limit. Our immediate need is to free some addresses prior to a firmware upgrade.

Hello folks, The setup is as follows:-The users use FortiClient 5.4 to connect to the FG (running 5.4.4) through SSL VPN.-The users is authenticated by AD (Windows 2008 R2) using LDAPS.-The users can successfully authenticated, and change their passwords (if the passwords are expired, or the user account has to change the password at next login). The problem is, if the user is configured to use two-factor authentication (FortiToken), the user can login but cann't change his password and get "Permission denied (-455)" error, as follows:-The user is asked to enter his username/password.-Then is asked to enter the new password.-Then get the above error message.-In the AD, nothing change. Could anyone help me in resolving this issue? BR,M Zaki

Hello, I currently have a setup with our Domain Controller's DNS Server which forwards all external queries to a FortiGate 60C. To allow network computers to lookup each other, I have assigned the DNS server for our internal network interface to point to the DNS Server which sits on our Domain Controller. Hence, all connected machines will use the Domain Controller's Internal DNS initially to find network resources and on the instance it can't for external resources, it forwards all requests to FortiGate to query the ISP DNS servers. For expansion purposes, I am looking at placing a Domain Controller at branch offices which are currently segmented by different subnet zones i.e. Main Office DNS Zone = 10.0.0.0Branch Office 1# DNS Zone 10.0.30.0Branch Office 2# DNS Zone = 10.0.70.0 Each office is linked together via IPSec Tunnels hence, resources are visible to one another despite being on different locations. Given that Domain Controllers require DNS to work, I

I have an 80D unit and I want to configure it to allow HTTPS/HTTP/SSH services hosted on 2 difference internal servers. I have been reading a lot of the forums but still can not quite get the 2nd pubic IP to do what I need. To hide my Public IPs a bit I'll use the "Public.56" && "Public.58" as the externally assigned IPv4 addressesPort 1: Public.56Port 4: Internal 192.168.242.1I can successfully port forward 22 (SSH) and 80(HTTP) from Port 1 to Port 4 and to the internal server at 192.168.242.120. This has been working just fine for a while now. No issues there. I now have a physical 2nd server that also serves up SSH and HTTPS. For reasons beyond my control when accessing the SSH the port MUST be 22 from the outside. Clients have made FW rules on their end for their developers to connect on our port 22. I have 4 more Public IPs available to us so I thought I would fire up another set of physical ports on the 80D: Port 2: Public.58Port 3: Internal 10.0.242.1 I ne

Fortinet released IPS signature ISC.BIND.TKEY.Query.Reponse.Handling.DoS to address this vulnerability. How can i create custom IPS signature?

Hi,does anyone have a full list of forticlient update servers? we have a "safe" network with no internet access, but i want to make a policy that will allow the forticlient to update, but in order to do so i need a list of forticlient update servers. currently i allow "update.fortiguard.net, service.fortiguard.net" but no updates. I can ping the servers from the safe network. anyone?

Hello! I have a Hardware Switch "internal" with two Physical Interfaces Members and I need one of the Physical Interface to create a new Phisical Vlan. It´s possible to remove one of thems , Could I have a Hardware Switch "internal" with only one physical interface? or... Could I delete the Hardware Switch "internal" ?? thanks

Hi, I'm new to the forums so I bid you all a good hello first and foremost. I'm currently seeing an issue due to the aggressive nature in which our 100D ha cluster is reusing source nat ports for address translation.  This is causing an issue with one of our web services, where by the source port is reused too quickly and causes the session data to be dropped. I believe the issue is caused by the server we are connecting to having TIME_WAIT configured for a 2 minute interval and our fortinet reusing the source port after a few seconds. Would creating a policy to increase the time to live session timer help in this instance ? I'm just concerned by increasing the amount of time sessions are able to sit within the firewall's memory this will potentially have a negative effect on the performance even if it does rectify our issue. We had a Cisco ASA HA setup previously which we never encountered this issue, it seems its related to the way fortios applies port addres

Greetings to youI would like to know how mach forticlient take to update their AV database!? now there as new ransomware called [size="3"]WannaCry hitting computers ! did forticlient update their AV signature ? to detect this attack ? [/size]