Solved

ROUTER: FGT60EFirmware: v5.6.2 build1486(GA) Problem: incoming traffic towards internal mail server (i.e. ports 25, 143, 993, 995 etc.) has flowed normally for several days after router installation and configuration. It happened twice as of today that the router started blocking incoming traffic without apparent reason - looks like it sometimes lets traffic actually flow, as the incoming mail is slowed by several minutes to hours and then finally manages to sneak in, although with a heavy delay. This is an example of a reply from a connection attempt to port 25 SMTP: > telnet mail.customer.com 25Trying 123.456.789.74...Connected to mail.customer.comEscape character is '^]'.421 4.7.0 Connection refusedConnection closed by foreign host. Is there a way to understand WHY is this traffic is blocked? I tried to have blocked traffic logged and displayed, but didn't manage to do it. The first time it happened we remotely rebooted the router, and it got back to

While reading the NSE8 Exam description (http://www.fortinet.com/sites/default/files/NSE8_Certification_ExamDescription.pdf), some questions popped up. Apparently the tested topics and firmware versions can change any time without notice.Is there already a NSE8 update planned this year? If the topics and firmware versions would change, would these changes have a different exam number? So that you can choose to take the old or new exam? It seems that the written exam can already be scheduled at pearson vue. Is the practical exam already out of beta?How would a remotely scheduled session look like?

Hi guysI'm definitely not paranoid, but I'm a bit scared of the new "Locky" ransomware. Fortinet has published yesterday a blog post about Locky, but I can't find anything in the AV signature database nor in the IPS for this Locky bastard. Does anyone know which scan engine is able to detect Locky or Dridex? ThxWayne

Hi,Can someone tell me where (in the MacBook OS Sierra file system) the FortiClient 5.7 online installer puts the PKG file after it finishes the download? In one MacBook I am getting "No installer found in FDS" server error but in another MacBook, the online installer (dmg file) seem to download fine.  But I cannot locate the downloaded file in the file system. What I am trying to do is transfer the downloaded file onto the other MacBook where its not working in the hope of trying to bypass this broken installer issue. Thanks a lot.     

Hello All, Maybe a stupid question but Im working on a design Problem with HA, VDOM's and SNMP under FortiOS 5.4.6. According to the examples in the "FortiOS Handbook - Virtual Domains" I tried to set up a multi vdom scenario with the root vdom facing to the internet and two departmental vdoms. The root vdom are also holds the management vdom. The two fortigates are forming an active-active cluster and all vdoms are on the same virtual cluster. Each of the two nodes have a reserved management interface with an IP (Node A - 192.168.0.1/24, Node B -192.168.0.2/24) but the Management Traffic, especially SNMP, should go via a clustered interface (192.168.0.10/24). The Node reserved management Interfaces are by design in the Global VDOM and the clustered management interface are in the root vdom. Because all of the three are on the same IP Subnet (The Management Subnet) I simply cant assign the clustered Interface the choosen IP Address. Tried to enable allow-subnet-overlap b

Good day! I'm in charge of networking for a company, this company have roughly 150 employees in office.   However, recently we encounter an issue, there seems an high CPU usage and this causes the outgoing/incoming internet traffic to crawl and all employee unable to connect to the internet. When it occurs, the Current Session (GUI) reported up to 5,000 sessions! To further investigate this matter, I spend weeks observing the traffic in Current Session (GUI), in normal usage, fortigate 60D able to handle 1,000 session to 2,700 session without hiccups. We even tried use CLI to observe the stats and it reports ipsmonitor and scanunitd uses the most resources during high load. Another note is that during high cpu load, while internet traffic is essentially disabled. LAN still work, employees are able to access NAS through the network, (DHCP is handled by the same Fortigate 60D). This mean that the fortigate is still working intranet, but somehow 'stuck' in in

I'm configuring a pair of FortiGate 100E firewalls in our lab as a pilot to convert from Cisco ASA 5510 firewalls to FortiGate 100E firewalls and I've been able to replicate the majority of the hardware configuration, but I'm running into some issues with a management interface and HA sync. On the ASA, we use the WAN interface for management of both the active and standby firewalls. Cisco ASA interfaces can be configured with a "standby" command <ip address 192.168.1.1 255.255.255.0 standby 192.168.1.2 for example> and the standby firewall will be reachable by the standby IP Address. However, this doesn't appear to be an option on the FortiGate. My workaround was going to be configuring a static management IP Address on both the primary and secondary firewalls in the same subnet as the WAN1 interface, so that we could always reach them. In theory, I'd like it to look something like this: WAN1 - 192.168.1.1Primary MGMT - 192.168.1.2Secondary MGMT - 192.168.1.3 I'm a

Hello, I am experiencing an issue when I am trying to create an IPSec VPN tunnel.I have tried this on both Fortigate 60D and 200D with v5.2.3,build670 (GA) firmware. When trying to create a tunnel using the GUI wizard, at the final step just before creating the tunnel, I receive the error: "Empty Values Not Allowed" and the tunnel is not created. All fields are filled in and I really do not know what the problem is.I have tried to restart the units as well as to backup the config and restore it to another fortigate unit but I receive the same error... Any help would be much appreciated! Thanasis

Hello, everyone I would like to know how to download the firmware for an FP221B which has version v5.0-build048. The AP constantly loses the signal and I have to disconnect the network cable and connect again. I want to know if it's firmware problem first.I see that there is an update available, I select it from Fortiguard, however, I get an error.I want to know the download, to start the update from the local hard drive. The recommended update is the FP221B-v5.2-build0254 Thank you very much.

Before opening a ticket I was hoping the fortiniet gurus could help out.  I have a 60E with a UTM license running 5.4.3.  When I went to enable explicit proxy from feature select there was no option, it's not listed in any of the options.  From the cli when I look at system settings its not listed as gui-explicit-proxy  enable or disabled.  What am I missing?  Any help is appreciated. Thanks in advance!

Hello,  I have a situation on a FortiManager lab: i've added a FortiGate 70D version v5.6.2 build1486 (GA) to the latest and fresh-installed FortiManager version, v5.6.0-build1557 170727 (GA). When i first add the device there are no conflicts nor errors, then i modify -via FMG- a tiny object and when i try to apply the changes i see lots of stuff being updated, such as:[ul]VPN Certificate CA (root_Internal_CA)UUIDs for IPv4 addresses: SSLVPN_TUNNEL_ADDR1, all.UUIDs for IPv6 addresses: SSLVPN_TUNNEL_IPv6_ADDR1, allSettings for the webproxy custom service.Settings for switch controller security policy 802-1X-policy-defaultSettings for lots of wtp-profiles: FAP221E-default, FAP222E-default, FAP223E-default, FAPS221E-default, FAPS223E-default, FAPU221EV-default, FAPU223EV-default, FAPU321EV-default, FAPU323EV-default.[/ul] This fails. I've attached the log to this post. After that the device is always in a "conflic

Hi All,Hoping someone can point me in the right direction as I cannot seem to get the following setup working:Equipment: 60DSoftware: 5.6.0Internet: Dual WAN Connectivity to 2 x different ISP's Network SetupThe FW itself currently has two Trusted networks connected locally:[ul]192.168.1.0/24 ---Home Network  (Net A)10.0.0.0/24 --- Security Lab containing a few servers  (Net B)[/ul]I also have a small network range defined for Remote Access Users (10.10.254.0/28) who I would like to remotely access the Security Lab (Net B) via an IPSEC VPN.[ul]ISP A is connected to WAN1 --- Used as the main internet connection for (Net A)ISP B is connected to  WAN2 -- Used as the back up connection for (Net A).[/ul]Both ISP's provide a default route though I have modified the Interface Admin Distance as follows:[ul]ISP A (Distance 1)ISP B (Distance 5)[/ul]I 'do not' want to run these links in a load balancing setup. Problem StatementI would like the remote access users to VPN in

Hi  I have a strange problem which I could not understand what exactly cause this issue I have a Fortinet 90D Firewall and I have 2 ISP connections for redundancy ISP 1 is connected to WAN1 and ISP 2 is connected to Internal Port 14 I have done all the static routes and Policies settings right but here is still a problem, in the internal VLAN I have 3 servers: server 1 and 3 have access to internet through WAN1 but not through Internal port 14server 2 has access to internet through Internal Port 14 but not through WAN1  All the settings for all servers have been done the same can you please help me how I can fix this issue to give access to all the servers through both interfaces. 

Hello. I need to link the Fortigate with the FortiAuthenticator through VPN. I created a site-to-site tunnel, everything works, hosts communicate between sites, but fortigate sends its local traffic from the wan interface (public address). What should I do to connect Fortigate and FortiAuthenticator?the tunnels are in policy mode diagnose debug flow: id=20085 trace_id=398 func=ipsec_output_finish line=525 msg="send to public_address_site1 via intf-port10" id=20085 trace_id=399 func=print_pkt_detail line=5363 msg="vd-root received a packet(proto=6, public_address_site1:7158->local_address_site2:8000) from local. flag [S ], seq 1012248423, ack 0, win 13980" id=20085 trace_id=399 func=init_ip_session_common line=5519 msg="allocate a new session-00021e79" id=20085 trace_id=399 func=ipsecdev_hard_start_xmit line=178 msg="enter IPsec interface-vpn_interface_name" id=20085 trace_id=399 func=esp_output4 line=891 msg="IPsec encrypt/auth

Hi! I am just evaluating Fortisandbox VM on Xenserver 7.1.The performance is quite bad although the hardware of the Hypervisor is very fast. Did anybody here try Fortisandbox on another hypervisor? How was the performance? Regards,KPS

Hi Guys, We all probably know that Wifi WPA2 is vulnerable to KRACK  https://www.darkreading.com/attacks-breaches/secure-wifi-hijacked-by-krack-vulns-in-wpa2-/d/d-id/133...https://www.darkreading.com/attacks-breaches/secure-wifi-hijacked-by-krack-vulns-in-wpa2-/d/d-id/133...http://fortiguard.com/psirt/FG-IR-17-196FortiAP's latest firmware solves this vulnerability in firmware 5.6.1:  https://forum.fortinet.com/tm.aspx?m=153352I need to upgrade all FortiAP's  to latest firmware.  I have  upgrade doc for FortiAP's as well http://docs.fortinet.com/uploaded/files/3961/fortiap-v5.6.1-release-notes.pdf. It doesn't say about compatibility between Fortigate Firewall & FortiAP's OS? My question are:a) Do I need to upgrade Fortigate firmware/ FortiOS first before I upgrade FortiAP's connected to it?. Is there any issue if Fortigate Firewall firmware is older than FortiAP's firmware. b)  Any pointer like step by step guide for this u

I'm following these instructions to enable rogue AP monitoring. But I'm only able to set wids-profile on one of two radios on one of two profiles. The other 3 radios fail to set the wids-profile with the error: command parse error before 'wids-profile' Command fail. Return code -61 When I run "get" on either of the 3 radios that fail, I don't see wids-profile in the listed fields at all. I need to enable rogue AP monitoring on these other radios, as the one that works is 2.4GHz, I need at least one 5GHz radio scanning for rogue APs as well. How can I set the wids-profile field in these other radios in my FortiAP profiles?

Hi guys, I have been reading about Antivirus with both inspection modes and had a doubt. I thought when using Antivirus with flow-based full scan only the IPS engine is used, but the NSE4 course says the following about Antivirus with flow-based full scan: "The IPS engine checks for the rule match and then sends to the AV engine for scanning".Then, what is the exactly function of the IPS engine is the AV engine scans the file? What does rule match mean? Thanks in advance,Julián

Hi guys ! I asked mysef about best practices and recommandation about the basic configuration of logging on low end fortigate (30E -> 100E. for example). I bought a lot of Fortigate with an hard disk to be able to save logs on disk instead of RAM. But What do you recommand about configuration of logging inside the policies ? 2 years ago, when I started with Fortigate, one of my colleague teach me to ALWAYS enable "Log All Sessions" for each policy... Now, with a little more experience, I think it is not the best choice. Indeed, I often have high memory consumption (and my fortigate is often in conserve mode) with low-end model and I'm sure that is related to "Log All Sessions". What are your opinion about this subject ? Currently, by default in my policies, I log only "Security Event" and I enable only "All Session" parameters on the policies that allow traffic from WAN to LAN. What do you do with the implicit deny policy ? Thank you for your answe

we have an issue in our DNS could be from fortigate, could be the traffic route not define correctly. The Scenario iswe have 2 ISP connections both are directly connected to Fortigate 100D version 5.4.5.1138. server subnet going to DIA link and PC subnet going to DSL link. but pcs are getting DNS from AD server. now the problem is i cannot access MSN, DHL and Turkishairline sites unless i use 8.8.8.8 or DSL gateway IP.

Hi therewe are using Fortimail 200D (with FW: v5.4,build692,170724 (5.4.0 GA)) and my question is, how to send quarantine mails to the recipient user instantly without scheduling only hourly? thanksTom

I need to bring back (to analytics) an archived log, but only 60 days in the past.How do i accomplish this? I heard about "execute sql-local rebuild-db", but that command does not have a date as a parameter.Should i change the storage policy and then run that command? Thanks in advance.

Hello, We are using a FortiGate 60D in our company.Right now we are using 5.2.11 Build 0754 as firmware. When we check the update page of the device 5.4 and 5.6 firmwares are listed in other releases tab of the page. Which one is recommended for 60D ? Should we stay with 5.2.11 or is it safe to move on 5.4 atleast. Also we are using FortiAP 221C's so we need to upgrade thier firmwares according to fortigate. Thanks.

Hi folks,we are using some Fortinet products since we find them great.. Now we are trying to accomplish the following project (see attached picture): From ISP1, the incoming HTTPS packets to FW1 should travel across the VPN to the server on the opposit site, called "beta".So we have to DNAT incoming HTTPS packet from 1.1.1.1 to 192.168.1.2. What works for now (DNAT without crossing the VPN tunnel): First case - Site A: Client connects from the Internet over the external IP 1.1.1.1, on port 443 (HTTPS), and is DNAT to 192.168.0.2:443 Incoming Packet flow: WAN-FW1 (1.1.1.1) ==> 192.168.0.1 ==> 192.168.0.2 (using VIP), this is OK. First case - Site B: Client connects from the Internet over the external IP 2.2.2.2, on port 443 (HTTPS), and is DNAT to 192.168.1.2:443 Incoming Packet flow: WAN-FW2 (2.2.2.2) ==> 192.168.1.1 ==> 192.168.1.2 (using VIP), this is OK.  What should work (DNAT crossing the VPN tunnel to the other side):

I migrated a user over from a Sonicwall, and for sake of uniformity with other fortigates and policy management, I created Zones for the WAN interfaces. They have 3 ISP connections. There are 2 SMTP relay servers that go outbound (outbound only) using IP Pools. I need to NAT them to an appropriate IP per ISP. When I create the policy, I can choose multiple IP pools, but it appears to use them top down with no association to the appropriate ISP/interface. For instance if ISP-A was on 1.1.1.1 and ISP-B was on 2.2.2.1, it will always use the 1.1.1.1 IP because its the first IP Pool.  What I really need is to associate an IP Pool to an interface, the same way you would a VIP. This way IP Pool 1.1.1.2 will only ever be used on the ISP-A interface, and same for the other IP Pools. Anyone know if this is possible, or a way of solving this problem?