Solved

After update to 5.4.4 on FAP221B and FAP321C the web console will not load.Has it been removed or disabled??Cleared computer cache and it still will not allow me to connect.I tried SSH, TELNET, HTTP and HTTPS.. none of them worked.

First of all, thanks for the help. I do not use Fortinet much, but I have a problem handling a simple Blacklist. My idea is to connect SIEM, Fail2ban, TOR exit nodes and other internal systems to Fortigate via SSH. Create a policy, a group of addresses and run, as is done with other manufacturers. I've mounted a script that does that, it passes an ip, and creates it as an object and puts it in a group: https://github.com/kinomakino/Ban-ip-Bash-Scripts/blob/master/ban_fortinet.sh Now I have several problems: 1.- the maximum limits for Fortigat in groups of addresses is 300. VERY LOW. If for example I want to block all the nodes out of the TOR network every night (one of the things I need to implement in Forti) I can not do it. 2.- In the case of making a "stack", I do not know how to list in CLI the current ip addresses in a group and have that data in bash to handle loops and conditions. 3.- I can not "remove" all the ip addresses of a group from CLI,

Hi guys,I have a FGM running 5.4.2 and just turned ON FortiAnalyzer features .Now can someone please share from its XP the difference between this and a dedicate FortiAnaliyzer unit (actually VM).All our FGTs are used for: Firewall and VPN only - no UTM at all. Thanks!

Hi, On a fortigate running FortiOS v3.0, it is possible to specify an IP range for ssl-vpn user groups using these commands :edit "Group1" set group-type sslvpn set sslvpn-tunnel enable set sslvpn-tunnel-startip 172.16.0.1 set sslvpn-tunnel-endip 172.16.0.10 I upgraded my firmware to v5.4 and these commands are not available anymore. (sslvpn group type doesn't exist)Where can I specify IP range for my user groups in this version ? ThanksAlvi

Hi all, after a power outage an Active-Passive cluster of FGs shows the "File System Check" message at the login. If I perform the File System Check, only one of the firewall will reboot and check for errors or I will have both of them offline? I'd like to avoid service interruption but I don't know if this is possible in this case. 

We have a Fortigate 100D firewall (Fortios 5.2.x) with Dual WAN (WAN1 and WAN2 interfaces) connectivity to 2 different ISP’s. It is acting as active/passive. WAN1 is the primary WAN link (distance 10) WAN2 is our failover link (distance 20)All is working well but we want to monitor our WAN2 link with third-party monitoring software (Paessler PRTG) Because WAN2 is passive, ICMP ping doesn’t work. This would be the simplest method for proactively monitoring the WAN2 link with other monitoring software. I want to know if there are other methods before considering FortiAnalyzer. Is it possible to enable ICMP ping to a passive WAN2 link? Are there other methods to achieve proactive alerting (e.g. e-mail, snmp) when a passive WAN2 interface fails? What I’ve learned so far:[ul]I’ve been using dead gateway detection/link monitor. It writes a message to the Fortigate event log when an event happens, but I can’t extract this specific log alert with SNMP or receive an alert with aler

Le'ts say i want to see Logs for specfic Ip address.i have fortigate 80c.Thank!

i have 100-D fortigate and it is behind Router. i want to create Ipsec vpn (access vpn) for my remote users. static ip/public is given on router. how can i achieve this. if you could explain and share example if possible..

We are trying to replace a Cisco router with a FortiGate running 5.4 but are unable to get subnet translation to work as before. Here's the scope:[ul]It's an internal router used to route traffic between three different interfaces:[ul]This branch office's VLAN 192.168.100.0/24 with FortiGate's IP 192.168.100.254.Server VLAN 172.24.0.0/24 (connected through an IPSEC tunnel on a different FortiGate and reached with static route 172.24.0.0 255.255.255.0 192.168.100.1).MPLS network to HQ 10.100.0.0/24 with FortiGate's IP 10.100.0.254. Static route 10.3.0.0 255.255.255.0 10.100.0.1.[/ul][/ul]The subnet translation comes into play when HQ doesn't want to use 192.168.100.0/24 and 172.24.0.0/24 in their end to avoid risk of overlapping subnets so they have assigned subnets for each:[ul]192.168.100.0/24 = 10.100.1.0/24172.24.0.0/24 = 10.100.2.0/24[/ul]In the Cisco router this was simply managed at our end with these two lines: ip nat inside source static network 192.168.100.0 10.100.1

 I'm considering changing the primary WAN interface on one of my 100-Ds from manual mode to PPPoE mode. I've not used this mode in a Fortigate device before. Does the firewall behave any differently when using an interface in PPPoE mode vs manual mode? In case it's relevant I use a lot of the features on these firewalls. That includes site to site VPNs, advanced routing, SSO, most of the UTM features, etc etc etc.  Thanks for any help.

Hi everyone,I had a problem that my Forticlient was getting stuck at 98% (common issue). I have followed this guide to fix it: http://kb.fortinet.com/kb/documentLink.do?externalID=FD36630 I have also uninstalled and installed VPN client again.Now I have a working VPN solution, but also a machine does not go to sleep.In device manager I see miniport WAN drivers with exclamation marks. They seem to be duplicates. I have like miniport WAN driver #7If I uninstall Forticlient, computer sleeps. Any help in the subject appreciated.

Hi there, Does anyone know If it is possible to create/edit datasets from the cli? I'm running a FortiAnalyzer with the version 5.2.7 I've found below outdated document for the version Version 4.0 MR2, which includes the cli procedure (config sql-report dataset) but that's not working for my version.http://docs.fortinet.com/uploaded/files/1177/fortianalyzer-fortigate-sql-technote-40-mr2.pdf  I've tried a few variants of the command with the cli help but no luck. Thanks,Mari

I have a FG 100D running v5.2.9I have 2 WAN connections connected.Is it possible to route traffic to a certain IP address over the 2nd WAN link, and use the 1st WAN for all other traffic?I have tried but can't get this to work, do I just use static routes or policy routes?Also the traffic over the 2nd WAN needs to be source NAT'd Any help would be great

I'm seeing a FAC 200D regularly attempting TCP 2196 (and get blocked) repeatedly to a set of IP's in the 17.188.*.* range.   Most resolve to gateway.push.apple.com. or others in the APPLE-WWNET range. Anybody know if the FAC should be using Apple Push Notifications?  This seems a little odd to me.

Just updated our FAC to 4.2.1(v4.00-build0155-20161228-patch00), and FTMv4 Push appears to be enabled.  Kind of annoying on FTM iOS.  SSLVPN login using FortiClient 5.4.2 still appears to need the token, but when logging in the push notifications now get in the way.  Does anyone know how to tell the FAC to NOT send the FTMv4 push notification?

Hi to all,I am quite new to the FGT world. My Company bought a FGT 100D three months ago, that came with v. 5.2.4 installed. The GUI has shown the message about the update to 5.2.7, but nothing about 5.4. What do I need to update to 5.4? Do I need any support contract?Thank you all.

Hello,I am new to Fortinet world. I would like to configure fortigate to use different wan interfaces depeding on source address. For example, servers placed in DMZ should use wan2 interface, users in lan/guests should use wan1. So, I configured (see picture at the bottom of this post):- WAN-LLB: I set wan-load-balance interface with wan1 and wan2 interfaces- Static Route: I set for destination 0.0.0.0/0.0.0.0 the device wan-load-balance- WAN-LLB Rules: for test purpose, I created two rules:[ol]source: LAN subnet, destination: www.dnsstuff.com, outgoing interface: wan1source: DMZ subnet, destination: www.dnsstuff.com, outgoing interface: wan2[/ol]In this case, all seems to work. Clients in lan that surf in www.dnsstuff.com see in the web page that the public ip address used is the one of wan1, clients in DMZ see public ip of wan2. Then I changed destionation address from "dnsstuff" to "all". In this case, all firewall rules don't work. I ran a traceroute from a client lan add

Hi, I am using a FortiWiFi 60D with the firmware version v5.2.5,build701 (GA). Is there any method to filter or sort by the Source IP (not Source NAT IP) in Forward Traffic Log & Local Traffic Log? Thanks!Hung

Hi Everyone, I'm here to seek your kind help in understanding what's going on between "VPN connections" and "Windows' CPU Timer Resolution", and especially when it's connecting via FortiClient (latest, 5.4.2.0860). I recently noticed that whenever I'm connected to VPN, my notebook battery seems to be draining much faster than when I'm not. Then after some googling I've come up with a possible cause related to "CPU Timer Resolution" of Windows (I'm on Win10 - 1607 - 14393.693)  ClockRes (a utility to display the current Timer Resolution)https://technet.microsoft...nternals/bb897568.aspx When VPN is connected via FortiClient in my case, CPU Timer Resolution would *persistently* go to ~5ms (fine), as oppose to the disconnected state at ~15ms (normal idle) (see attached screenshot). To my limited knowledge, unnecessarily fine/short timer resolution would drain battery, just like what Chrome did some versions ago: https://arstechnica.com/g...raining-bug-in

Hello,I'v got a fortigate 100D which is unable to assign a IP for management in the same vlan as the LAN.its a single 100D ( no HA ) which I want to manage from vlan 10, the same subnet as the current management IP on LAN side.the gui is slow, probably due to production traffic going over the same port.hence I want to mitigate the management port to where it is supposed to be.however altho I'v enabled subnet overlap, which solves the issue shown below  I still can't get it to work, when I press ok the 100D comes with item not found ; your assist or opinion is very welcome, thanks in advance!

I decided to roll the dice and upgrade a FortiAnalyzer 200D to the new 5.4.2 firmware.I followed the upgrade guide and rebooted before the upgrade, etc. Everything seemed fine till I noticed that all authentication against RADIUS on the FortiAuthenticator 200D 4.1.2 was failing.  I mostly use this to give me two-factor authentication with FortiTokens for admins on the FAZ. Checking further, everything seemed to be going through, but the FAC always reported "Invalid Password".  Note that my FortiGate is still working with the FAC without problem. I tried a number of things, all without success:[ul]Re-entering the RADIUS secret for the FAZ and the FACCompletely recreating the FAC's RADIUS client and the FAZ's Remote Auth (RADIUS) serverRemoving and recreating local users on the FAC, removing and recreating the RADIUS users on the FAZUpdating the FAC to the most recent firmware (4.2.0)Trying users without two-factor authenticationTrying different EAP methodsVerify

Hi, I want to configure a policy based VPN from a remote site to a central firewall. All traffic from the remote site should be tunnelled, no local internet access. To my knowledge the only reliable way to do this is with policy based VPN, and it worked perfectly in 5.2. So i've set up the vpn tunnel and created the policy with action: IPSEC and specified the tunnel. local net 10.x.y.0/24, remote net: 0.0.0.0/0 (i want to tunnel all traffic to central site, remember?), but this breaks the fortigate's own initiated traffic, so it can't reach the vpn remote peer because it's trying to reach it over the VPN, which isn't up because it can't reach the peer... catch 22. This did not happen in 5.2. Config below: hostname # config vpn ipsec phase1hostname (phase1) # show config vpn ipsec phase1 edit "vpn-something" set interface "wan1" set keylife 28800 set peertype any set proposal aes128-sha256 aes256-sha256 set remote-gw x.y.z.x set psksecret somepsk next end&nbs

   Hi, all, on the Fortigate 310b (5.2.3,build670 (GA)) with two vdoms, i make this:config vdomedit vdom1config user settingset auth-timeout 30set auth-timeout-type idle-timeoutendfgt310b (setting) # showconfig user setting    set auth-timeout 30endBut the time-out doesn't work with 30 minutes! (i thinks is the default: 5m) In global configuration doesn't have this configuration:fgt310b (global) # config user setting ?device-category Configure device categories.What i'm doing wrong? Thanks! 

Hi - I've seen Out of band posts but my question are: 1) For the out of band management of Fortigate 500D and 1000D firewalls is the recommendation to configure a separate PSTN line (is it even possible to configure a connection via a PSTN line?),or is the recommendation to configure a separate IP address on the 2nd RJ 45 management interface and to use this? The reason I ask is that these appliances will be managed as part of a Firewall Management Service and need a OOB option. 2) Are there any issues we need to consider with OOB management (PSTN or the 2nd management interface) in a HA configuration (active/active or active/passive)?Many thanks, Larry  

Make/Model: Fortinet 60DIssue: I'm having trouble port-forwarding to my Xbox. No matter what I do it seems as though it doesn't work because my NAT type stays moderate, my goal is to get it to open. I need help with port-forwarding and also using MAC addresses to assign a permanent static IP to my Xbox. Please. if anyone can help me. I've been attempting things for months and am at my wits end.Note: I am not technologically savvy when it comes to this sort of router, so if anyone has a solution please "dumb it down" for me, haha. Any help is much appreciated and I hope to get this fixed, thank you.~ Connor Edit: Willing to pay for services.