Solved

If I need to make a change in the VPN phase II, this change must be execute at the same time at both ends of the vpn tunnel otherwise the tunnel go down? 

Hello, We use FortiGate 3700D running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415. We've deployed the builting Fortinet certificate "Fortinet_CA_SSLProxy.cer" on all workstations.We've a policy with "SSL/SSH Inspection" and "Application Sensor" Profile to manage WebEx communications (allow audio/video and deny remote control or other features). But we obtain a certificate error when we use WebEx (see attachment): "you cannot connect to audio or video because we cannot validate the security certificate to your WebEx site". Do  you know how to avoid this pop-up? Regards, Chris

In my company we have an Fortigate 100d can someone please help me so that i can isolate this ports due to the ransomware attack that happened the last days.Thank you very much.

Hello, I recently upgraded my fortiOS to 5.6.0 in my 300D, so now I receive logs from the fortigate I get the logs with the actual date but when I want to display them I get "No entry found". Like I stated before I have fortimanager/analyzer 5.4.2 it's the latest version.Is there anything to do? Is it a compatibility issue? In that case, should I wait until a new release for the fortianalyzer? I tried everything else, removing and rebuilding the DB but didn't work.Thank you for your answers. Regards.

Hello, I have 2x Fortigate 200B with firmware  v4.0,build0632,120705 (MR3 Patch 8). not too much traffic and sessions: Ca 200 Mb/s , up to 10k ip packets/s , up to 15k active session. I have noticed that sometimes cpu is very high but only user part. It happens mostly, every 5-10 minutes for more less 10-20s but sometimes it takes much more time as You can see on day graph  I did some debug but i can't see nothing wrong.   I turn off: snmp access, widget in dashborad, tune tcp timers but without success.  Still high cpu user. What can be reason of that? How can i debug this more deeply ? Below some of my ouputsBig thanks for help  # get system performance statusCPU states: 1% user 25% system 0% nice 74% idleCPU0 states: 1% user 25% system 0% nice 74% idleMemory states: 64% usedAverage network usage: 72437 kbps in 1 minute, 114673 kbps in 10 minutes, 110949 kbps in 30 minutesAverage sessions: 7546 sessions in 1 minute, 7650 sessions in 10 min

I'm looking for a little clarity on this after we've come across an intermittent issue on 5.2.7 with SSL Inspection enabled. We serve a number of SSL websites to external customers from a single web server. Up until last week the server was running Windows 2008 SP2 Standard and customers had no issues accessing the site from any of the main browsers (IE, Edge, Chrome, Firefox). Unfortunately we had an issue with the server and were forced to quickly implement a Windows 2012 R2 web server to serve the same sites. This was locked down (using IISCrypto) to offer appropriate encryption and cipher combinations, including TLS 1.2 (which was not supported on the older machine). No changes were made on the Fortigate configuration. Since implementation we have had intermittent connectivity issues reported by customers which we have occasionally been able to replicate as they are not happening consistently. These occur across all browsers - in Firefox reporting an SSL_ERROR_B

Hello, In our environment we have a Fortigate 100 D, I'm planning to deploy in all laptop a VPN client, ideally at the end, would be great to get this done: - Detect if user is in our facilities or not, there's no need to connect vpn if users are in the office.  So if any user goes away, vpn tunnel should connect automatically. - Should use AD credentials, as you all know, the more passwords we have, the more support requests IT department will suffer, all laptops are protected by Active Directory credentials, so somehow security in VPN connection should be automated. The goal is to offer VPN benefits but without any user interaction...all traffic should be routed to VPN, even Internet connectionsAnyone have any experience on this? Thank you. 

Hello guys, I am having a very strange problem with my wireless connection. We currently have an Exchange-On-Premises server in our network. When we open Outlook, it connects to this server to handle emails. The thing is that my Outlook client takes a very long time to connect to the server when i am connected through wifi, usually 20 minutes. We have a FortiWifi 90D that manages 2 FortiAP14C. This problem happens no matter to what signal emitter we connect to (FWF90D or FAP14C). This only happens when we connect to the SSID that has access to the local network. It doesnt happen when we are connected through wire. I am certain that it isnt a firewall rule or anything like that. I contacted Fortinet support to solve the problem, but they couldnt neither. We tried everything: allowing unrestricted access to the SSID, packet debug, upgrading firmware (we are currently using 5.6), etc. Anyone with the same problem?   

Hello everyone, just want to clear a small doubet that I could not find anywhere. Lets say I create an aggregate interface and have 10 Vlan interfaces under that aggregate interface.When on the IPV4 policy if I select the Source or Destination interface as the aggregate interface that is a shortcut to selecting all the VLAN interfaces under that aggregate, correct? Many Thanks

I'm looking for a way to block applications based on the "Hostname", but the "Hostname" has a space in it. For example, there is a Just Proxy VPN that is getting through our firewall. If I filter the Application Control log, the Application is SSL_TLSv1.2, and in the details, the Hostname is "Just Proxy VPN" and the URL is "/", and the Category is Network.Service. It uses different IP addresses and ports, so I can't block using those. I can't block all of SSL_TLSv1.2, but I want to block any application using hostname= "Just Proxy VPN". I can filter for it in the logs, but I can't seem to setup a block for it. Is there a way to create an Application using this information to then block it? Here is a detail log for one instance: itime=2017-04-10 20:44:54 vd=root app=SSL_TLSv1.2 date=2017-04-10 dstip=139.59.64.226 apprisk=medium group=FSSO_NoNetscape service=tcp/7624 proto=6 eventtype=app-ctrl-all devid=FG1K5D3I15800570 dstintf=port25 applist=BlockYouTube msg=Network.Servi

Hi everyone, proud new owner of a pair of 1500D that I am going to implement in the coming months. My current test setup is Active/Active HA with a single 1G port connected to the LAN side(to a Cisco 6509 VSS Core). The production environment(Active/Passive) currently has 2 x 10G port per firewall appliance to each Core. So example, FW1 to Core1(active) and FW1 to Core2(redundant). Same thing goes for FW2. My goal is to have redundant connections in a similar fashion with the Fortigates. I know it supports 802.3ad, but I want to make sure it is implemented correctly, especially as this will change all the rules and static routes currently being sent to a single port.  I haven't been able to find good information(cookbook,tech docs,...) to truly determine the Best practices, so before I open a ticket with support, I thought checking with the forums would probably be better. Is anyone currently running A/A HA with redundant LAN ports to their Core's or am I over-compl

Xmas surprise Upgraded all E-series + 80D. Will see...

There are 5 sites IPsec between all of them.There is a DC at the head office with a collector agent.I am trying to get FSSO to work between all sites. The fortigate at headoffice has FSSO working correctly however the remote fortigates wont.I can ping the Head office DC from remote sites but its as if the fortigates cant communicate with the head office DC on port 8000 looking at th debugs : [fsae_server_init_spec:116]: num 1, idx 0, 127.0.0.1:8000 disconnect_server_only[KCM FSSO]: disconnecting _event_error[Local FSSO Agent]: error occurred in read: Connection refused  All policies do not have specific ports configure(all ports allowed)The Windows firewall on the DC is turned off.Please help

Hello, I have a 100E (5.4.4) and there is no  "packet capture" under "Network", now i cant find if this supported or not, i know in the past fortigate disabled this feature for small models in relation to process power, but a 100E isn't small or slow in my opinion. Can someone point me to the right document? Sorry, i really have to work on my search skills. Thanks in advance

hi allsee attached diagram, it'll help explain it better i don't know how to "attack" thisthank you

Hi everybody,The VPN section is divided in to two groups: tunnel mode and interface mode.Which is the difference between to the two?Thank you.

I'm going to visit some 100Ds in a rather remote location. They are currently at 4.3.11 and would like to upgrade the FortiOS 5.2 or 5.4? I've looked and have not found anything outlining pros and cons of each. I'm sort of leaning to 5.2, but would like some input. Thanks in advance....CB

Hello together, I'm trying to get my Fortigates registered via LLDP in my Switches.This works perfectly on two FGT-50E, currently on 5.4.1.It does not work on 3x FGT-90D and on one 110C. These are all on 5.4.somewhat firmware.What I did:    edit "internal14"        set vdom "root"        set type physical        set device-identification enable        set lldp-transmission enable    next and:config system global    set lldp-transmission enableend Then:diag lldpx restart We use HP ProCurve switches. Any idea? 

[/size]Hi,[/size] I'm new to the Fortinet product, actually it is my first Fortigate firewall configuration. I configured IPSec tunnel between Cisco RV042 at head office (HQ) and FortiWiFi 30E at branch office (BO) to connect 2 Asterisk servers.  The HQ subnets are 192.168.16.0/255.255.240.0, BO subnet is 192.168.0.0/255.255.255.224. The tunnel is up and running. I can ping to the servers and access the servers via SSH. Servers can ping each other. Strange thing is, Fortigate does not forward IAX2 packets between offices via IPSec tunnel. diag sys session list command shows Fortigate sends IAX2 packets from BO to HQ to its default gateway, not to the tunnel.[size="2"] session info: proto=17 proto_state=00 duration=336 expire=178 timeout=0 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=5origin-shaper=reply-shaper=per_ip_shaper=ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255state=may_dirty ndr app_valid statistic(bytes/packets/allow_err): or

I've been playing around with a FortiMail eval recently and couldn't for the life of me find where to configure DLP. The documentation says that its under it's own menu called 'Data Loss Prevention' under 'Policy' but I can't see the menu. I've logged into the demo FortiMail (https://fortimail.fortidemo.com/admin) and can't see it there either. Does anyone know howto enable the DLP feature on the FortiMail? 

I would like to ask that how we suggest fortigate to customer ,  For example we have 500 user so how we will check which device is best and what will be through output will be better for it

Hello, I am adding a new IP range to our WAN1 port and came across a weird issue/confusion on how the fgt is defining these fields in the GUI. I am probably overthinking it, but are we supposed to put in the full Assigned LAN Netblock address with /28 the IP assigns me in the fgt Network/Interfaces/edit WAN1 "IP/Netmask" field, or just the first LAN Usable IP (205.105.155.146/255.255.255.240 - or 255.255.255.255)? Same goes for my static routes. The ISP gave me a Default Gateway for LAN Netblock to use - that should be my static route, correct? 0.0.0.0/0.0.0.0 as the IP/Mask and 205.105.155.145 for the Gateway under Router/Static/Static Routes? Example of what we were provided, including explanation from ISP:Assigned LAN Netblock  - 205.105.155.144/28Subnet Mask: 255.255.255.240LAN Usable IPs: 205.105.155.146 through 205.105.155.158*You mas assign these IPs to your LAN (LAN Default Gateway, PC, Workstation, Firewall, etc)Default Gateway for LAN Netblock: 205.105.155.145

Hi! Guys, I got some problems with new firmware. I use fg300d with FO 5,4. There is configured dial-in ipsec. Everything worked fine until now. All tunnels are hung up. All services are blocked except port forwarding so i could connect to putty's serial console. There are a lot of messages such as "unregister_netdevice: waiting for IPSec NAT_6 to become free. Usage count = 1".  I event cant execute reboot. System just wrote that it is going to reboot bye-bye - and just continue to posts that error messages about netdevice. FG is situated in the data center, so i unable just to switch off and on it...  I'm just in a jam... any help is highly appreciated... Thanks! 

Hello there, is there a option in the EMS to configure a pattern Update interval or something like this? Thanks. Regards, Rolf

Hello, Hope someone can help here. The fortigate seems to skip web filtering following application control. Is this normal? Thanks in advance.