Solved

FortiOS 5.2.11 on FGT 60D I'm attempting to re-introduce deep inspection of outbound traffic from laptops used on our network following a long standing ssl inspection issue being patched.The ssl inspection configuration and exemptions we had in place prior to the bug allowed laptops to run Windows Update without issue.Currently on my laptop (Windows 10 Pro) Windows Update fails with error 0x80240437 when run from behind the Fortigate; if I run from within our guest network (which is not behind a Fortigate / SSL inspection) it completes successfully. I can see in the WindowsUpdate.log that this is (probably) down to a certificate check failure:2017/07/19 10:36:59.4330139 16176 14616 IdleTimer [0]3F30.3918::07/19/2017-10:36:59.433 [agent]WU operation (CAgentProtocolTalker::SyncUpdates_WithRecover) started; operation # 10; does<NULL> use network; is<NULL> at background priority<NULL>2017/07/19 10:36:59.4330826 16176 14616 WebServices [0]3F30.3918::07/19/2017-10

We have a /24 LAN configured on a vlan interface. It has been requested to segregate one host on the LAN so it can only reach other LAN hosts via defined policies.Is it possible to do this without changing the host IP address, subnet and default gateway? For instance, is there any way that can two VLANs be treated as one interface in terms of their subnet but control traffic between them using policies?We have a lot of flexibility with VLAN configuration. We do not currently use zones but I do not believe this would help.The managed switches support private VLAN, but this is not an option since we have multiple switches on the LAN (the privacy setting is restricted to the local switch only). From what I can see this is not possible, but it is certainly worth asking. If there are no other options we'll just assign a new IP range to the host and proceed with a regular layer 3 solution. But it would be very nice to do this somehow "in the background". And it would be very u

I want to monitor bandwidth used by Fortigate policies with Fortianalyzer but there is difference between the values appear in report output (bandwidth policy:Top 30 Policies by Bandwidth) on Fortianalyzer and policy count(byte in 5.4) on Fortigate. (I. e. the policy count is 58.55MB and the Fortianalyzer report shows 55.84MB for bandwidth policy) I'm confused which one is right. What does the difference mean? How can I get the correct result? 

Hi all, Currently all CAs in the TrustedCA list are trusted when doing ssl handshake inspection. Now I would like to remove the trust for certain CAs like "WoSign" and/or others systemwide / for ssl inspection. I'm running FOS 5.6.1 and can't seem to find any option to do this. How can this be done?  Cheers,germafab

Hi, Got a Fortigate 60E running 5.4.5. Client's ISP wants us to change public static IP.  This morning I added a new route for the new default gateway, then I went over to WAN1 and updated the new IP and subnet mask.  Hit OK, and instead of changing, it came back with an error just saying "Entry is used." I google that and all I see is details about changing from switch mode to interface mode, nothing about changing an interface's IP Address.  any ideas? 

Hi Guys, Is there any chance to enable `timeout-sent-rst` globaly? Not only for specific policies. I am asking because we have zone containing lot of interfaces. And we don't have rules between them as there is `intrazone allow` configured. http://kb.fortinet.com/kb....do?externalID=FD35049 It's FortiGate-600D. Many thanks. Daniel

Hi Fortinet Team, We are using your cool program Forticlient to have an secure tunnel to our customer repository for checking in stuff in gitlab. The problem is that 2 of us have an speed issue when having Forticlient active. That means, as soon as we logged in, the internet connection gets extremley slow, calling websites is actually impossible. We can committ and push, but nothing more. The IT department told us, that they using this kind of software and process with over 30 coworkers without greater problems. Me and my partner are working on a new Macbook pro (Feb 2017) with latest version of macOS Sierra (10.12.6) and also with the latest Forticlient Software (5.6). I tested the software also on my Windows notebook. The connection speed is also going down but its possible to surf through the net. So this might be a problem with our Macbooks?! Do you have any suggestion what we can try to fix this issue? Thanks indeed, best regards Florian 

Hello! I have two Fortigate 300C devices in two buildings. The connection is a layer 3 connection with static routes, as shown in the uploaded picture. The connection between the two Fortigates is configured on port 2. Also on Port 2 there is a tunnel interface with an IP address. The routing configuration between the Fortigates is static routing. On port 1 on both Fortigates is the connection to the local network of both buildings (connection to the main switches of the buildings). Now I want to transport a second network from the Fortigate 1 over Port 2 to the Fortigate 2 device. This second network is connected on port 3 on the device Fortigate 1. The port on the Switch pointing to the Fortigate 1 is tagged, with one VLAN (VLAN ID 20). I want to transport this VLAN 20 tagged from port 3 (Fortigate 1) over the Port 2 to the other device Fortigate 2 and connect a switch on Port 3 on Fortigate 2. This switch will add this tagged VLAN 20 on his uplink port and then t

Hello, I have looked through the pre-configured datasets in Fortianalyser but cannot seem to find: - drilldown showing top users app usage based on bandwidth where appcat = 'x'.- drilldown showing top users websites visited based on bandwidth where catdesc='x'. Does anyone have datasets for these ?Thank you kindly.

Hello, I have the following drilldown dataset. I cannot work out how to convert the 'bandwidth' column in to a 'browse time' column. Is anyone able to assist ? (I have attached a screenshot which shows how I would like it to be with a browse time column).Thank you kindly if possible. select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, app, sum(coalesce(`sentbyte`, 0)+coalesce(`rcvdbyte`, 0)) as bandwidth from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and nullifna(app) is not null and (appcat = 'Social.Media') group by user_src, app order by bandwidth desc

Hello guys, I am having a problem with Office 365 Autodiscover process and FortiGate. Basically, when my client (Outlook or even web browser) tries to reach an unresolvable URL like https://tenantname.mail.onmicrosoft.com/autodiscover/autodiscover.xml it presents me with FortiGate certificate warning (signed by FortiGate CA) and when accepted I get to the FortiGate's replacement message saying that DNS name does not exist.If HTTPS URL is valid (DNS resolvable) then it just gets me to the destination, even if there is no content there, which is what's needed in the previous case. I've tried creating a Static URL Filter in order to bypass this behavior, without luck. Even disabling all kind of SSL inspection and Application Control options, I still get that "error". Is there a way to bypass this? I am using only Explicit Proxy rules. Replacement message cannot be disabled in general, but can be bypassed for this particular FQDN, if possible. Thanks a lot! BR

Has anyone managed to shutdown FortiClient 5.6 manually when managed by EMS and you set a password lock ? Even after I click "Disconnect" and enter the password I cannot unlock forticlient and shut it down, works well in 5.4 but not in 5.6.

We are planning to purchase a Fortigate 600D as it has 2 X 10 GE SFP+ interfaces. We will be terminating a 1Gbps ( fiber link) from the ISP on one of these 10 GE interfaces. My question is  1) Can we modify the speed on these interfaces to run at 1 Gbps  assuming the other end also supports it?2) Can we terminate the Internet connections on any of the available ports on the Fortigate or are there dedicated ports ?  Thanks

Hello allMay I know the data sheet of FortiGate-800C?ThanksBR

I have installed 5.4GA on a test 60D unit, all is kind of okay, i have turned on Advanced Routing under features.. i see no place though where i can configure ECMP (inc. health monitor)? does anyone know where this feature has gone?! it used to be under settings in Static routing on 5.2... but is missing on 5.4 even when Advanced routing is turned off..

Before upgrading to EMS 1.2.1, when one clicked on the forticlient tray icon and selected "Connect to VPN", the VPN window opened in order for the user to enter the appropriate credentials (username/password). Now, after the upgrade, when the "Connect to VPN" is selected a small window appears saying: "Empty username is not allowed" !!! Do I miss something or every EMS upgrade creates more bugs than corrects?!

Hi, I have a question. I will enable DHCP option 191 with 2 IP address. I can set 1 IP address. This is my dhcp config:config system dhcp server edit 1 set ntp-service local set default-gateway 10.6.34.1 set netmask 255.255.255.0 set interface "lan" config ip-range edit 1 set start-ip 10.6.34.30 set end-ip 10.6.34.70 next end set timezone-option default set option1 191 '0a01221d' set dns-server1 10.1.34.60 set dns-server2 10.1.34.61 next end The Cisco command for option 191 is: option 191 ascii pool1=10.1.34.22,10.1.34.29;level=2 Does anybody know how to do it? Thanks a lot Regards

Hello.Is there a way to FortiGate logs to a second or third syslog server, syslogd2 or syslogd3?  I don't see how to do that in the 5.4 web console or CLI.  It seems that 5.2 had that feature.http://help.fortinet.com/fgt/handbook/cli52_html/index.html#page/FortiOS%25205.2%2520CLI/config_log.16.19.html

I would like to know if anyone has already managed by SSH to enable in fortigate authentication via SSH with local certificate

Hello everybody :), I want to connect via ssh to the fortigate and make a reboot. code: sshpass -p 'password' ssh admin@192.168.209.155 exec reboot The fortigate expects y or n, how do I get the fortigate said y or n?

Hi,I've got a strange problem with my Fortigate 800. When I try to ping from the wan interface : FGT800-XX-XX $ execute ping-options source <WAN-IP>                                                                FGT800-XX-XX $ execute ping 8.8.4.4The ping doesn't work and I use diagnose debug flow trace to see where the icmp packet are going.Here the result :msg="enter IPsec tunnel-FGT-XXXX-XXXX" 2017-07-24 15:04:09 id=36871 trace_id=12559 func=ipsec_common_output4 line=595 msg="No matching IPsec selector, drop" ICMP packet from wan interface are encapsuled in a VPN Tunnel instead of going to Internet directly. I need this to configure Dead Gateway Detection option.&nbsp

hi all we are using 1000D fortigate and observing high memory usage(86%) but CPU&Disk usage is normal(3% & 9%).IPS,Application & web-filter are enable on that. can anyone explain what is exact reason behind this miss behavior & how to resolve? Thanks in advance.   

Hello, I have a report#1 which shows the top 10 bandwidth users of the category 'social networking'.Now, I want to create a second report#2 which details which social networking sites each of report#1's users went to. My question is, how do I tell my second report#2 to only use the top 10 users that were selected in report#1 ? Thank you kindly for any help. 

We do a lot of mobile development so our users tend to be on OS previews/beta's a lot and the current FortiClient FC's on Android O (8.0) when you open it. Anyone aware of a beta or something for the client by chance that might work with Android O or a work around? Thanks in advance!

http://docs.fortinet.com/uploaded/files/3614/fortios-v5.6.0-release-notes.pdf