Solved

Firmware Version v5.2.10,build742 I Need Set Up Lacp Aggregation  No setup methods found  how to do

Hi all,I'm new to fortigate, this is my first time setting up port forwarding on fortigate routers 60D.I have created 2 VIPs to forward ports 85 and 37777 to a specific internal IP address, then created 2 group VIPs, create the services and then added the firewall rules. However, when I try to verify or the ports, I get ports are closed. Configuration attached

Hi, I set up a VPN hub/spoke structure with a Dialup server and some Remote branches (all appliances are Fortigate 60B). Surprisingly, I observed an Automatic Static Route that appeared on the Dialup server pointing to Remote network, with an Administrative Distance =1. I did not see this feature in the documentation. On the remote site I could not see any automatic route (I put a manual one). My question is: how to change this AD to a suitable value? The VPN function is to serve as backup and I need to set an AD greater than normal route. Regards,

Hi everybody,I'm looking for the wiring diagram in order to run the HQIP firmware on a Fortigate 100D.In the diagnose wiki:http://wiki.diagnose.fortinet.com/index.php/Running_an_HQIP_%28Hardware_Quick_Inspection_Package%29_test#FortiGate_.2F_FortiWiFithere is only a wiring example for a 60C but 100D has much more ethernet ports.Can somedody help me?Thank YouMatteo

Hello, Is it possible to convert Fortigate mode from active-passive to active-active in a productive network. thanks

Hi Folks, I have 2 WAN connections which I currently use routing policies to send traffic out, I would like to know if it is possible to cascade/overflow traffic from WAN1 to WAN2 when a certain bandwidth is exceeded, for example: WAN1 hits 10Mbs usage and I would like the "excess" traffic to then use WAN2 until the load is reduced on WAN1 at which point WAN1 should be used again. I have come across a number of FG docs which allude to the fact this may be possible but if anyone could point me in the right direction I would be grateful. ThanksEddie

Hello, I have to deploy an explicit proxy architecture for a customer and we want to use authentication on it. Main mode will be FSSO, no issue with that. But if Fortigate doesn't identify a user by FSSO standard mode, we want to try by using NTLM. Is it possible ? I was thinking of this kind of configuration : set active-auth-method ntlm set sso-auth-method fssoBut is the active method used only when the connection with the agent is broken or also as a fallback when the agent just doesn't find anything in the AD ?  Thanks in advance. Best regards, François 

Hi, We currently have a Single Sign-On Agent installed on 1 DC, which is configured to monitor all DC's. All works fine until a users switches from wired Ethernet to Wifi, they are no longer able to browse the internet. To solve this, they would need to lock the laptop and log-in again to windows.  In the "Show Logon Users" the user will be listed with "wired" IP address and not Wifi IP.  I have tried reducing the "Workstation verify interval" to 1 minutes and the "IP address change verify interval" to 10 seconds but this did not solve the problem.   Firmware: v5.2.7,build718 on 300D

Setup = 2 X FortiGate 100D Hardware Appliances (Active Passive) v5.2.8, build 727. NAT Mode.Hi all,We are experiencing a strange situation here and I was wondering if anyone had experienced something similar.We are seeing entries in traffic logs which indicate DNS requests being made to the online FortiNet DNS Servers (208.91.112.53 & 208.91.112.52) from network clients. Nothing unusual there, but the Application Name being returned in the log entries is not DNS as expected but, WhatsApp & WhatsApp_File.Transfer.  Has anyone any suggestion as to why these DNS requests are being mis-classified in this way? Many thanks, John P 

Hi guys, currently I'm hanging at a really bad issue.I configured SSL VPN Portal at a FWF 60D, but the Portal is unreachable at all.Not from External, not from internal. Setup:Internal LAN --> FWF 60D --> Transfer-Network --> VDSL Router --> WANClient --> WAN --> VDSL Router (Port Forward 8443 to FWF) --> FWF 60D --> LAN Try to reach SSL VPN Portal from Internal at the Transfer Network Interface of FWF (not possible)Try to reach SSL VPN Portal from External WAN over VSDL Router (not possible) Diag Debug Application sslvpn --> no connectionI know, its an easy thing, but I stuck at the moment... No further ideas...

I currently have  2 vdoms setup. I have not been able to configure both vdoms with the same wan port. Is this possible? The reason I am trying to approach it this way as opposed to having  separate external interfaces for each vdom is because i want to setup wan failover to cover both vdoms.

Hello, I have the following dataset which returns the bandwidth and browsetime of users who visit social media websites.This report works perfectly when I run the 'test' feature within the dataset, however as soon as I place it in to a report, the output results are distorted i.e. browsetimes should as only 1 or 2 seconds.Can anyone confirm if this dataset is structured correctly (even though it does work via 'test' in the dataset panel). Dataset attached to this post.

Hello everyone. I would like to ask, if i can change the language of the reporting to german manually.The language is currently not available on the Fortianalyzer.I can translate the chart-title to german. But i cant change some fields on the topsheet, like data range, report date or table of content.I know it's just a detail, but some customers ask us, if we are able to change that. Thanks for any help.   

I have an FGT60D running DHCP on the Internal interface serving IP addresses to about 120 clients. Every few weeks someone using Windows will report to me that they are seeing a pop-up message that they have an IP address conflict. This happened this morning to a Windows 7 client. Running ipconfig shows the client has an address of 192.168.1.136 and does not change, however, the Fortigate system log shows that they are requesting a new IP address about every 10 seconds. The log shows the following events:[ol]DHCP client sends a DHCPDISCOVERDHCP server sends a DHCPOFFER and offers a leaseDHCP client sends a DHCPREQUEST and requests for the given leaseDHCP client accepts the given lease and sends a DHCPACKDHCP client detects an IP conflict with the given lease and sends a DHCPDECLINE[/ol]On the client system I've tried a release/renew, as well as deleting the network adapter from the device manager and rebooting, allowing the network adapter to be auto-installed on system boot. Neither o

Hello all! We are currently testing FortiClient as we want to switch over to it as our main AV and VPN client solution. Our plan is to push out the initial client through SCCM to all of our endpoints and then use EMS to manage them. I noticed that the users will get prompted when pushing a FortiClient upgrade (say v5.4.1 to 5.4.2)  from EMS, since they have to reboot. Is there an option for a completely silent upgrade through EMS?  Any help is appreciated. Thanks!

I've upgraded our Fortimail to 5.3.5. We have a valid Fortisandbox.Cloud Contract - now with 5.3.5 we can only send 100 Samples per day!! Level 1 Support says that this is per design! So be carefull when upgrading!! On the Dashboard:"Legacy FortiSandbox cloud service is used. Please activate FortiCloud as soon as possible!"

Greetings to youDearsOur management care about security and nowdays new virus Shamoon malware is diffuseMy Question Is Forticlient AV can prevent this Virus Samoon malware ? yes or no ? as we do update always

Hello, We use FortiGate 3700D running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415. One of our Fortigate gave us several failure (5 times during while 3 last months) about "Optional power supply not detected".We've check all power plug and all looks good.Do you know if this failure detection or this alert message could be a or a known error from this FortiOS version? Regards, Chris 

Hello,Does FortiGate VMX support integration with Openstack orchestrator?ThanksAndreas

Hi,   Recently we have upgraded our 800C to FortiOs 5.4.1 but as soon as the unit reboots some web rating overrides urls stop working, so, in the GUI we can see them, but it doesn't work until we run in the CLI the "set rating" command. It has happened every time the unit reboots. Any suggestion about how to proceed ? Regards.

I have noticed that in some of my logs, the DNS hostname field for external IP addresses has an entry of ChangeMe. For the firewall DNS settings I have one of my internal DNS servers and then one of googles open DNS servers. Anyone seen this before?

Hi all, is there any way to create new firewall policy via 'config firewall policy' without having to specify a policy id; i.e., let it just take the next available number?  I'm trying to either mass clone or mass create new rules to break multi-interface rules into individual rules so 'interface pair view' becomes usable again in the web interface.  Doing this while having to come up with unique numbers for each clone or edit command is a nightmare.

Hello, we are experiencing an issue with a multi site VPN setup. The central office has a Digium PBX and Digium VoIP Phones are deployed throughout the company. We are quite frequently experiencing issues where our traffic drops and the VoIP Phones at the remote locations are unable to reconnect. The cause of the drops appears to be our Comcast Cable internet connection. It cuts out for a short period of time, maybe 30 seconds or less. Once the VPN tunnel is restored, all traffic can resume as normal (we have RDP Traffic back to the central office as well), but some of the phones will not reconnect. Not all phones. Even rebooting the phones has no effect. The only thing that helps these phones is either waiting maybe 20-30 minutes or more, or to reboot the Firewall at that particular remote location.   Does this sound like anything anyone has come across before? I have a ticket open with FortiNet support, I'm waiting to coordinate getting a packet capture at th

Hi Guys, I am new in Fortigate firewall, is there way to monitor the bandwidth from the settings of the firewall or a software that you can suggest? Thank you guys. 

Hello all, Recently I started to use FortiClient for SSL VPN Connection.Yesterday I tried to install the version 5.4.1 on a XP Client but I'm getting the error attached. I'm using a Forti Client Online Installation tool and basically after that the image download finish this pop-up is shown: "The digital signature on the installer package is invalid. Installation aborted."  In internet I found this solution:- From Internet Options- Select the “Advanced” tab.- Scroll down to the Security section and check the box next to “Allow software to run or install even if the signature is invalid.” This didn't solve..  So I checked for a same issue in this forum but actually I'm not still able to solve. I tried to follow the resolution suggested in this topic:Unable to install FortiClient 5.4 on Windows 7 SP1 x64  The solution is to upgrade windows to the kb3033929, but of course no new kb are available for Win XP. Can you help me t