Solved

Hi All,Hoping someone can point me in the right direction as I cannot seem to get the following setup working:Equipment: 60DSoftware: 5.6.0Internet: Dual WAN Connectivity to 2 x different ISP's Network SetupThe FW itself currently has two Trusted networks connected locally:[ul]192.168.1.0/24 ---Home Network  (Net A)10.0.0.0/24 --- Security Lab containing a few servers  (Net B)[/ul]I also have a small network range defined for Remote Access Users (10.10.254.0/28) who I would like to remotely access the Security Lab (Net B) via an IPSEC VPN.[ul]ISP A is connected to WAN1 --- Used as the main internet connection for (Net A)ISP B is connected to  WAN2 -- Used as the back up connection for (Net A).[/ul]Both ISP's provide a default route though I have modified the Interface Admin Distance as follows:[ul]ISP A (Distance 1)ISP B (Distance 5)[/ul]I 'do not' want to run these links in a load balancing setup. Problem StatementI would like the remote access users to VPN in

Hi  I have a strange problem which I could not understand what exactly cause this issue I have a Fortinet 90D Firewall and I have 2 ISP connections for redundancy ISP 1 is connected to WAN1 and ISP 2 is connected to Internal Port 14 I have done all the static routes and Policies settings right but here is still a problem, in the internal VLAN I have 3 servers: server 1 and 3 have access to internet through WAN1 but not through Internal port 14server 2 has access to internet through Internal Port 14 but not through WAN1  All the settings for all servers have been done the same can you please help me how I can fix this issue to give access to all the servers through both interfaces. 

Hello. I need to link the Fortigate with the FortiAuthenticator through VPN. I created a site-to-site tunnel, everything works, hosts communicate between sites, but fortigate sends its local traffic from the wan interface (public address). What should I do to connect Fortigate and FortiAuthenticator?the tunnels are in policy mode diagnose debug flow: id=20085 trace_id=398 func=ipsec_output_finish line=525 msg="send to public_address_site1 via intf-port10" id=20085 trace_id=399 func=print_pkt_detail line=5363 msg="vd-root received a packet(proto=6, public_address_site1:7158->local_address_site2:8000) from local. flag [S ], seq 1012248423, ack 0, win 13980" id=20085 trace_id=399 func=init_ip_session_common line=5519 msg="allocate a new session-00021e79" id=20085 trace_id=399 func=ipsecdev_hard_start_xmit line=178 msg="enter IPsec interface-vpn_interface_name" id=20085 trace_id=399 func=esp_output4 line=891 msg="IPsec encrypt/auth

Hi! I am just evaluating Fortisandbox VM on Xenserver 7.1.The performance is quite bad although the hardware of the Hypervisor is very fast. Did anybody here try Fortisandbox on another hypervisor? How was the performance? Regards,KPS

Hi Guys, We all probably know that Wifi WPA2 is vulnerable to KRACK  https://www.darkreading.com/attacks-breaches/secure-wifi-hijacked-by-krack-vulns-in-wpa2-/d/d-id/133...https://www.darkreading.com/attacks-breaches/secure-wifi-hijacked-by-krack-vulns-in-wpa2-/d/d-id/133...http://fortiguard.com/psirt/FG-IR-17-196FortiAP's latest firmware solves this vulnerability in firmware 5.6.1:  https://forum.fortinet.com/tm.aspx?m=153352I need to upgrade all FortiAP's  to latest firmware.  I have  upgrade doc for FortiAP's as well http://docs.fortinet.com/uploaded/files/3961/fortiap-v5.6.1-release-notes.pdf. It doesn't say about compatibility between Fortigate Firewall & FortiAP's OS? My question are:a) Do I need to upgrade Fortigate firmware/ FortiOS first before I upgrade FortiAP's connected to it?. Is there any issue if Fortigate Firewall firmware is older than FortiAP's firmware. b)  Any pointer like step by step guide for this u

I'm following these instructions to enable rogue AP monitoring. But I'm only able to set wids-profile on one of two radios on one of two profiles. The other 3 radios fail to set the wids-profile with the error: command parse error before 'wids-profile' Command fail. Return code -61 When I run "get" on either of the 3 radios that fail, I don't see wids-profile in the listed fields at all. I need to enable rogue AP monitoring on these other radios, as the one that works is 2.4GHz, I need at least one 5GHz radio scanning for rogue APs as well. How can I set the wids-profile field in these other radios in my FortiAP profiles?

Hi guys, I have been reading about Antivirus with both inspection modes and had a doubt. I thought when using Antivirus with flow-based full scan only the IPS engine is used, but the NSE4 course says the following about Antivirus with flow-based full scan: "The IPS engine checks for the rule match and then sends to the AV engine for scanning".Then, what is the exactly function of the IPS engine is the AV engine scans the file? What does rule match mean? Thanks in advance,Julián

Hi guys ! I asked mysef about best practices and recommandation about the basic configuration of logging on low end fortigate (30E -> 100E. for example). I bought a lot of Fortigate with an hard disk to be able to save logs on disk instead of RAM. But What do you recommand about configuration of logging inside the policies ? 2 years ago, when I started with Fortigate, one of my colleague teach me to ALWAYS enable "Log All Sessions" for each policy... Now, with a little more experience, I think it is not the best choice. Indeed, I often have high memory consumption (and my fortigate is often in conserve mode) with low-end model and I'm sure that is related to "Log All Sessions". What are your opinion about this subject ? Currently, by default in my policies, I log only "Security Event" and I enable only "All Session" parameters on the policies that allow traffic from WAN to LAN. What do you do with the implicit deny policy ? Thank you for your answe

we have an issue in our DNS could be from fortigate, could be the traffic route not define correctly. The Scenario iswe have 2 ISP connections both are directly connected to Fortigate 100D version 5.4.5.1138. server subnet going to DIA link and PC subnet going to DSL link. but pcs are getting DNS from AD server. now the problem is i cannot access MSN, DHL and Turkishairline sites unless i use 8.8.8.8 or DSL gateway IP.

Hi therewe are using Fortimail 200D (with FW: v5.4,build692,170724 (5.4.0 GA)) and my question is, how to send quarantine mails to the recipient user instantly without scheduling only hourly? thanksTom

I need to bring back (to analytics) an archived log, but only 60 days in the past.How do i accomplish this? I heard about "execute sql-local rebuild-db", but that command does not have a date as a parameter.Should i change the storage policy and then run that command? Thanks in advance.

Hello, We are using a FortiGate 60D in our company.Right now we are using 5.2.11 Build 0754 as firmware. When we check the update page of the device 5.4 and 5.6 firmwares are listed in other releases tab of the page. Which one is recommended for 60D ? Should we stay with 5.2.11 or is it safe to move on 5.4 atleast. Also we are using FortiAP 221C's so we need to upgrade thier firmwares according to fortigate. Thanks.

Hi folks,we are using some Fortinet products since we find them great.. Now we are trying to accomplish the following project (see attached picture): From ISP1, the incoming HTTPS packets to FW1 should travel across the VPN to the server on the opposit site, called "beta".So we have to DNAT incoming HTTPS packet from 1.1.1.1 to 192.168.1.2. What works for now (DNAT without crossing the VPN tunnel): First case - Site A: Client connects from the Internet over the external IP 1.1.1.1, on port 443 (HTTPS), and is DNAT to 192.168.0.2:443 Incoming Packet flow: WAN-FW1 (1.1.1.1) ==> 192.168.0.1 ==> 192.168.0.2 (using VIP), this is OK. First case - Site B: Client connects from the Internet over the external IP 2.2.2.2, on port 443 (HTTPS), and is DNAT to 192.168.1.2:443 Incoming Packet flow: WAN-FW2 (2.2.2.2) ==> 192.168.1.1 ==> 192.168.1.2 (using VIP), this is OK.  What should work (DNAT crossing the VPN tunnel to the other side):

I migrated a user over from a Sonicwall, and for sake of uniformity with other fortigates and policy management, I created Zones for the WAN interfaces. They have 3 ISP connections. There are 2 SMTP relay servers that go outbound (outbound only) using IP Pools. I need to NAT them to an appropriate IP per ISP. When I create the policy, I can choose multiple IP pools, but it appears to use them top down with no association to the appropriate ISP/interface. For instance if ISP-A was on 1.1.1.1 and ISP-B was on 2.2.2.1, it will always use the 1.1.1.1 IP because its the first IP Pool.  What I really need is to associate an IP Pool to an interface, the same way you would a VIP. This way IP Pool 1.1.1.2 will only ever be used on the ISP-A interface, and same for the other IP Pools. Anyone know if this is possible, or a way of solving this problem?

Hi Guys, Just wondering If I want to allow external web service hosted on third party vendor to SSL_VPN user. What steps I need to follow. Though that external web service URL is only accessible from our private company network due to external public facing IP binding  I guess done by vendor. But needed to be accesible over our SSLVPN user as a part of test. Firewall model: Fortigate200D(Master) HA mode Operation Mode : NATInspection Mode: proxy -basedSSL VPN tunnelfirm: v5.4.3  cheers! ThanksAtul

This is a tough one and I will be thoroughly impressed if someone were able to give me any advice that could help solve this issue. Fortinet support is having trouble solving so I'm reaching out to the community for help. I'm going to provide a little background (sorry it's a little lengthy but I think it helps understand the issue) on our issues with FSSO and then get into our current issue. Hopefully someone has seen this problem and can offer some suggestions as to what the problem might be. Background:We've been using FSSO for around 8 years. We initially installed a single collector agent in DC Agent mode. We had 8-10 internet auth groups and things seemed to run fine. We then decided to add a second Collector for redundancy. Things still ran as expected. A few years later, we started authenticating our laptop users to our wireless network (802.1x/PEAP) via Group Policy configurations. This introduced our first set of issues with FSSO. We found out that when users had bo

Hi guys, I am new in this forum and also in the Fortinet world, so here you are my first question. I have a FortiGate, but it seems FortiGuard Anti-virus signatures doesn't update. When I go to Services > Anti-Virus under www.fortiguard.com, I see the current version is 52.227. However, my FortiGate has version 50.00151, the license is not expired and the last update was some months ago. Also the update settings are OK. All these things are in the attached screenshot. What am I missing? Why doesn't the Anvi-Virus package update? Regards,Julián 

well...after long time ago, now it's out...

hello friends,how can i configure a built in access point with my fg 60e working with 2.5 ghz?how can i add policies ?i did not find any documentsthank you in advance

We manage FortiGate firewalls like the 60D, 60E, and 100D. Sometimes we see messages about reaching the FortiSandbox quota for the day. Any way to reduce the amount of traffic going through the FortiSandbox? The only thing I can think of is to put items that should not be scanned with the Sandbox prior to the policy that uses the Sandbox.

Requirement:Access multiple remote client hosts (not entire remote LAN) over VPN and presenting local clients as single IP of 61.x.x.x. This is to comply with security imposed by remote client's CISCO ASR. See pic below for requirement. Following existing fortinet doco http://cookbook.fortinet.com/vpn-overlapping-subnets/ , I am only able to successfully established a routed VPN between the gateways 219.x.x.x <>185.x.x.x, using the "Site to Site - Cisco" wizard template then converted to custom VPN. Attempts to manually setting up the tunnel without converting from the template actually didn't work, despite matching all configuration!  My local LAN 192.168.0.x clients will need to access a number of specific remote hosts e.g 10.1.x.x and 10.2.x.x. Below are the Policies modified from the fortigate autocreated ones:edit 45         set srcintf "internal"         set dstintf "VPN-Phase1"  &nbsp

Hii have fortigate 60e using latest firmware of 5.6im trying to block porn sites from my internal users accesing the internet.this is what i did:in "security profiles" - "web filter" enabled "fortiguard category based filter" and block the "adult/mature" content then i wen to "ipv4 policy" and enabled the "web proxy" option. then tried to test it from a user machine browse to: www.sex.com and saw that the webpage didnt blocked. im attaching screenshots, please help. am i missing any configuration? thanks, 

Hi, Can anyone help me out with a command that will show me the VRRP status of an interface ? (I have searched all over, but I am unable to find anything. :( )

Good day folks, I have a good one for you all. We have recently instated a VPN with a provider of services. In short, the VPN works, however the connection is unreliable. Ping tests between the two have been sporadic at best, on average 20 - 30% packet loss. That and other connections, RPC, SSH, Telnet, RDP fail and when they do connect, timeout very quickly. I contacted our ISP to test and see if there is anything on the WAN side, but that came up clean. I just want to run down the configuration of the VPN connection to be 100% sure that it is indeed not the config nor the Fortinet causing the issue. The Fortinet 60D has the latest update, I used the VPN wizard, and converted it to custom, and punched in the necessary Phase 1 and 2 entries. Here is where it got a bit tricky; We have one encryption domain, 192.168.228.0/24. HOWEVER 228.0/24 had to be mip'd to 12.0/24 (factual internal range). Of course we know that you create a VIP range external 192.168.228.0/24 to 192.

FGT60D running v5.2.11. I'm looking to use application control to restrict outbound SMTP (internal -> wan) to IceWarp (a.k.a. Merak) mail server only, however I'm struggling to understand how to accurately identify IceWarp within a custom signature. Can anyone advise me whether:1. This is actually possible2. The best way to accurately and consistently identify IceWarp (as opposed to a powershell script sending SMTP traffic for example).