Solved

Please see attached.  Running version 5.4.5.  I have a firewall FQDN configured.  I was able to edit a few by right click and choosing "Edit in CLI" (I needed to add the "set cache-ttl" setting).  Then I noticed that when I clicked on one that was configured as fqdn, it popped up as "set type ipmask".  See attached image.  Might want to fix this Fortinet.

At 4:23 PST today we started seeing 403 errors when trying to visit sites.  Only way to allow access is simple unfiltered NAT rule.  Searching form shows this happened in the past with a bad AV engine update.  I notice that support.fortinet.com is down with a 500 error so perhaps they self-inflicted the same.  TIME FOR AN ARCHITECTURE MODIFICATION! Anyone else seeing this? I'm seeing these in my debugs:16330: 2017-09-28 17:03:53 <01449> firmware FortiGate-500D v5.4.5,build1138b1138,170531 (GA) (Release) 16331: 2017-09-28 17:03:53 <01449> application scanunit 16332: 2017-09-28 17:03:53 <01449> *** signal 11 (Segmentation fault) received *** 16333: 2017-09-28 17:03:53 <01449> AVDB 05004000AVDB00201-00052.00000-1709281424 16334: 2017-09-28 17:03:53 <01449> ETDB 05004000AVDB00701-00052.00000-1709281423 16335: 2017-09-28 17:03:53 <01449> EXDB 05004000AVDB00401-00001.00000-1210171547 16336: 2017-09-28 17:03:53 <01449> AV

Hello- Our district has a FG800C with 2K client licenses. I have been told that I cannot upgrade the firmware (currently at 5.2.11) without having to upgrade the client licenses. However, the clients are now at 5.6. I cannot get an answer from either Fortigate or our vendor on whether or not I can upgrade my FG800C to the newest OS (5.6) without losing clients. Can anyone help clarify what I can/cannot do here? Thanks in advance!

I worked with FMG in the past when old devices were 4.0 and new devices were 5.2, but now that we're further into 5.6, it seems like FTNT is moving away from v4.0 compatibility. Since I can't nest ADOMs and have to set the firmware version per ADOM [for Fortigates] how can I manage FGTs that are legacy or can I not have any differing firmware units in the same ADOMs? Tried ignoring the version settings in device groups and got db failures with 5.2-5.6 Fortigates. *This is a lab folks, I am not running a depraved, unorganized infrastructure* Long term plan is to deploy in Azure, starting the configs for this setup on a local FMG 200D.   thank you

When looking at the Web Filter log on my 60D (5.6.0), I am seeing things like "video.twimg.com" and pbs.twimg.com". I want to see the entire URL of the video or picture being viewed. I was under the impression that web filtering monitor would give me this information. Any help would be much appreciated!

For a while now I have been successfully using the IPsec VPN with Forticlient (and native client on mac). However as soon as I assign user groups to firewall rules (the user groups contain the users which successfully connected to the IPsec VPN) the traffic is blocked. According to documentation I understood that I need to have XAuth activated for the VPNs which I have - still no luck. I currently have 2 types of IPsec VPNs, a PSK+XAuth based and a Cert+XAuth based one.Below you will find the config snippets of the respective VPN configurations: edit "RemoteAccess"        set type dynamic        set interface "wan1"        set authmethod signature        set mode aggressive        set peertype peergrp        set mode-cfg enable &n

Hi, When I try to add second SSL-VPN Portal, it says: " Maximum number of entries has been reached ."How can I fix this issue ? Thanks. Fortinet 30D , v5.4.5,build1138 (GA).

Currently I have 2 FortiGate 600D running for VPN gateway in my infrastructure with 80 active tunnels. We just bought Fortimanager and we want to manage VPN on FortiGate but I cannot import the VPN Tunnel on FortiGate to the FortiManager.I have enabled VPN Central Management on FortiManager. However it sill cannot see the tunnels on FortiManager.  Have anybody experiences with VPN on FortiManager? Thanks in advance. 

Hello,When I import an external CA certificate to a FortiGate (5.4.1), I have noticed that I cannot set the certificate's name. The name is always been set by FortiOS to "CA_Cert_1". Do you know if I can set a different name to this certificate? BTW, when I import an SSL certificate as local, FortiOS allows me to set any name I desire. The restriction seems to be in the name of the CA certificate only. Thanks

Hello, After fiddling with quite a few tunnels between Fortigates and ASAs, I have noticed that the ASAs only seem to accept/propose 3DES/SHA1 themselves for encryption/authentication. Is this due to that people doesn't patch their ASAs, and their firmware is archaic, or is it a setup error or an incompability with Fortigate? I don't have an ASA in my lab unfortunatly... Will try to get one. I have seen the same behavior at several customers - You get the IPsec settings from the IT department at the other end, and it contains a string of different encryption/authentication cryptos for you to setup in the Fortigate, but in reality, only 3DES/SHA1 is used, and a diagnose debug application ike -1 tells you that the ASA doesn't respond to, or offer anything else then 3DES/SHA1. Same goes for the phase 2 negotiations. This hasn't been any issue with any other firewall brand I've setup tunnels to. Like Palo Alto, Watchguard, pfSense, Sophos etc. All of them can at least d

I can not configure an LDAP Server on an FG-60E with FortiOS 5.6   I am trying to set up an FSSO from an FG-60E and a Windows Server 2003, but I can not add the LDAP server.   After placing the IP of the Windows 2003 Server, as well as the user and password of the domain administrator, when doing Browser to identify the Distinguished Name, the system indicates: "Invalid LDAP server"   If I put the Distinguished Name manually, and try to test the connection, it says "Invalid credentials"   All this despite the IP of the server is correct, as well as the user and password, which I am placing flat: User = Administrator Key = #####   Waiting for your comments

Hi,Do you guys know why fortigate 90e was removed from the line?Some bug?

I have a basic question: From your experience, what would you recommend as a naming convention for the objects (hosts, networks, ports etc) in a fortigate firewall that is more practical and makes it easier later to support and resolve problems? Your feedback will be appreciated!

Hi, Anyone have any experience with the LLS (L-bit) that most Cisco will have enabled default. As far as I can see in the logs my Cisco box will send with option 0x52, and the Fortigate will send with option 0x42 (that I figure is the LLS option) I am having issues with ospf flapping massivly between loading/full on the Cisco end - and was wondering if anyone else have looked into this..and if it do have an impact ? 

Hi. I will try to be as detailed as possible. Currently we have our network configuration as the draft below. I'm trying to migrate from VLAN1 to a server vlan but when i enable vlan100 no VLAN traffic is routed through the firewall. 1. Removed x.x.x.x/255.255.0.0 from Internal 2. Create Servers VLAN and add x.x.x.x/255.255.0.0  3. Remove x.x.x.x 255.255.0.0 from vlan 1 svi on core network 4. Add x.x.x.x 255.255.0.0 to VLAN100 svi on core network Existing config edit "Internal" set vdom "root"set ip x.x.x.x 255.255.0.0set allowaccess ping https ssh snmp set type aggregate set netflow-sampler both set member "port1" "port2" set device-identification enable set role lan set snmp-index 12 next config proposal... edit "Internal" set vdom "root" set allowaccess ping https ssh snmp set type aggregate set netflow-sampler both set member "port1" "port2" set device-identification enable set role lan set snmp-index 12 next edit "Servers" set vdom "root

Hi, In my fortimail log (installed in fortimanager) I can find so many threat/viruses, like 1 email with infected file each 2 or 10 Seconds. With dynamic sources (Majority asia). What I want to know, if you are experiencing the same events in your fortimail? And what are some best practice to reinforce my fortimail and security in general? (I have only fortinet product for security) Thank you for your answers.  

Hi all, I am a Newbie, I using Foretigate 300D, I need block "facebook, youtube, skype, gmail and amazon" and just open some ip as required. Please help me! Thanks!

They fixed the SSLVPN bug! :)

I have a Fortigate 60C currently running firmware v5.0,build0252 (GA Patch 5). The ' Per-IP Bandwidth Usage' widget is one I have used before to track down users that are using a lot of bandwidth on the network. However currently I can' t see it as an option when I try and add a widget, I am thinking that possibly this widget was only available in an earlier firmware version. Should this widget be available and if so can you tell me where to find it? If not is there a similar widget/report I can get, or is this widget included in the latest firmware?

Hi guys, I have two ADOMs on the FortiManager (v5.4): - root ADOM running v5.4 - SDC ADOM running v5.2 On SDC ADOM I have two clusters running v5.2. What option should I choose the moment FWs will be upgraded on 5.4? 1. Upgrade FWs, go to System Settings - All ADOMs, edit SDC and try to change version from 5.2 to 5.4? 2. Upgrade FWs, then try to bring/adopt the cluster FWs to root ADOM What do you guys use to make similar migration as smooth as possible? Thanks,Florin.

My filters are:Level [Equal To] NoticeDestination IP [Not Equal To] serverIP_AText filter:srcintf=port30 and service~RDP and action=start The log:itime=2017-08-24 13:12:44 sentbyte=0 rcvdbyte=0 srccountry=Reserved app=UDP_RDP date=2017-08-24 dstip=serverIP_B duration=0 vd=VD1 group=IT service=UDP_RDP proto=17 user=ME dstcountry=Reserved policytype=policy poluuid=45840192-88ea-51e7-b403-e3009408d646 devid=FG000000 dstport=3389 type=traffic dtime=2017-08-24 13:12:43 devname=FG00 time=13:12:43 sessionid=884716921 itime_t=1503594764 policyid=111 srcintf=port30 srcip=10.0.21.101 sentpkt=0 level=notice appcat=unscanned srcport=55887 logid=0000000015 subtype=forward trandisp=noop action=start dstintf=VLAN_6 I'm not getting any hits from that filter.

Hello, I want to be sure, the fortimanager communicate with the fortigate ( TCP 541), but is the fortigate communicate with Fortimanager too? Or Can i put the Fortimanager in a DMZ that the public network can't reached? ( only the Fortimanager can reach the public network not the opposit) Thanks, JF

Hi, We have a number of FortiGate firewalls which range from SMB 60C (being migrated to 51E) to large 1000D. We have purchased FortiManager and installed version 5.4.3 as it covers most of our firewalls firmware. I have recently learnt FortiManager can not manages all firewalls which are on different majour and minor release versions and this can only be managed under a single ADOM - is this correct, as I would under the impression FortiManager would provide a single manage plane for all the firewalls? Around 30% of the configuration on the FortiGates are similar i.e. VPN tunnel to a main FortiGate firewalls. However, the naming convention used to reference these objects is different and in some cases the subnets could be different using identical object naming standards. My understanding, is if I import the first FortiGate into the FortiManager under the same ADOM it will import the policies and objects within the ADOM database. If I then import the second firewall

Hello, I'm trying to understand what is difference in following actions on IPS signature: Block, Reset, Quarantine.  From the user view is traffic blocked in all cases, right? I understand that Quarantine puts IP adres on quarantine list so admins could easily check what is quarantined. But is there some more sophistiated using of these actions?Thank you Petr

Hello together, we upgraded from OS 5.2.5 to 5.6.1. We configured the option system link-monitor on 5.2.5.After we upgraded the function is disappeared, but it is already in our config file. Is the function replaced in 5.6.1 ? Is "SD-WAN Status Check" the replacement ? Many thanks for your help. regardsPatrick