Solved

What firewall ports are used for push authentication?We use Cisco AnyConnect and use the FortiAuth for 2 factor.  If the users phone is on the corporate network, then it will communicate with the FortiAuthenticator for 2 factor with push messages.  If the phone is connected to the public network, then it fails.  Where are the server name settings specified that the app is going to use to communicate back to the Authenticator? SOMEBODY has to have the detailed process.  My support ticket has been open for over a week with no response. Chris

Hello,I can't import FGT 5.6 to a FortiManager 5.4.3.Is there a solution?Thanks.

Hello, I've a FGT100D and wanna configure it like a Cisco switch.1、Port 1：switchport access vlan 102、Port [11-14]：switchport mode trunk, channel-group 1 mode on3、Interface Vlan10, ip address 192.168.10.254/24 How to configure FGT100D to solve this issue ?Thanks for your response.  

Good morning,Yesterday I've updated Fortimail, to v5.3,build634,170228 (5.3.9 GA ).Since then there seems to be some extra spam, which could be a coincidence or it could be related to the update.The thing that worries me is the anti-spam status. the license status looks like this :AntiSpam:Trial (Expires Unlimited)AntiSpam definition:7.00370 (Updated 2017-07-20) By the looks of it, the anti-spam definition is updated, same goes for AV.However AV is green, antispam is yellow. is this normal? should I update / renew the license?Thanks!

That might sound like I need to verify IP addresses, but that is not the case.  I have an interesting problem that I need to address and was wondering if anyone had any insight or experience with this issue.  We recently purchased a 100e to replace an old, and dying, ASA5510.  The initial setup went smoothly and all traffic was flowing as expected.  I had to add a second, separate but similar, network for SFTP traffic.  The IP scheme was close but not an exact match.  This part also went smoothly. I have recently been tasked with configuring a test network for training purposes.  I went about the same process as I did adding in the second network, but ran into a small issue.  Even numbered IP addresses can hit the internet, but odd numbered IP addresses are stopped at the firewall.  For simplicity sake, I opened the ports up to all traffic but still get blocked when using an IP address that has a final octet that ends in an odd num

Hi, We started out with all of our FGs and FM running v5.2.  We have since worked through upgrading all FGs to v5.4.4 and FM to v5.4.3.  Yet our Global Database is still aligned with v5.2.  So, we tried upgrading it to v5.4 and surprisingly all of the Global objects and policies were reset in the process.   Fortunately, it's a VM and we took a snapshot prior to the upgrade.  So, we rolled back and are running again with Global Database at v5.2 level. Does anyone have any guidance on upgrading the Global Database, while preserving the existing objects and policies? Thank you,LarW63

good morning, we have used the conf decribed in the title for a while to allow external users to connect to an internal samba share. the setup followed the cookbook example. this worked very well until we changed the internet provider.the new provider uses ppoe, to support this we had to add a static route: Destination 0.0.0.0/0 Device wan1 Gateway 123.123.123.9  the ip of wan1 is 123.123.123.10. this works for everything (wlan, internal network, rdp from external clients, internal web servers ...) except for the vpn connections. after adding a second policy to allow traffic from wan1 to the vpn interface i'm able to connect with forticlient and there's some data transfered in both directions. the client gets an ip address  but i'm not longer able to see the internal network resources. any ideas how to fix this? thankslorenz

Hi, I just upgraded my VMWare FM to 5.4.3.  Now, in the dashboard I see message "hard drive allocated for this VM instance...is less than the licensed VM storage volume...".  Does anyone know how to resize the volume?  The disk size set in VMWare is even larger than the licensed volume size. Thanks,LarW63

Hi ! We are beginning to migrate to IPv6 in a /48 switch with about 30 primary subnets and 100 secondary subnets. We use 2 FG-800C (Firmware 5.4.4) and 2 FG-600D (latest Firmware) as FW and OSPF for internal routing subject to NAC rules. Drawing our address assignation plan, the question we have is whether those boxes are capable of /127 addressing for point-to-point communication with internal and border routers.Yes/No will do for an answer, but I'd be extra grateful is someone could also point me to the relevant Fortinet documentation. (I did search the knowledge base online to no avail.) Cheers, -giogia

Hi, We upgraded EMS from 1.05 to 1.2 but after upgrading we get the error below when we go to the console/webgui Anyone an idea what to do?Internal Server ErrorThe server encountered an internal error or misconfiguration and was unable to complete your request.Please contact the server administrator at admin@yourcompany.com to inform them of the time this error occurred, and the actions you performed just before this error.More information about this error may be available in the server error log.

I have got a Fortigate 100D appliance with v5.0,build0271. The issue is that I cannot see all the websites that are being visited by users in the Security Log -> Web Filter. However, the URLs IP addresses do appear in the traffic log -> Forward Traffic. Anyone can help on this please?

Hi All, We have successfully migrated our existing configuration to new fortigate 300. But, 1 big issue is the policy in 300d now required "Name" which in the previous firewall is not required. I Would like to seek your assistance regarding this issue.  What would be the best and easiest solution to name all the configured policy rather than edit/putting it manually and one by one?  thank you and Regards

Good afternoon, I'm new in the Fortinet world and I need some help setting up my FortiWiFi 90D. I am trying to find a way to configure several subnets (or VLANs) in my equipment, for example, adding ports 1, 2 and 3 to one of them and ports 4, 5 and 6 to another one (with different IP ranges). I have tried changing to "interface mode" ("set-internal-switch-mode interface") and creating a pair of VLANs and assigning ports to them directly (both in graphic mode and through CLI) but I did not get any results (i always get some kind of failure or directly did not appear the option in the corresponding menu). If someone could give me some kind of information about it I would greatly appreciate it. Thank you so much. Greetings.

Hi guys,I have this small issue with viewing top web sites from fortimanager 5.4.3 for my HQ fortigate 300D with fortiOS 5.6.0.I have other fortigates in remotes sites, and everything works fine. But when it comes to my HQ fortigate It displays "No entry found".I tried to compare the config with the remotes sites, everything seems all right. I found nothing with my fortimanager or fortigate. Please HELP, my boss want to view the visited web sites with the amount time that users spend browsing those sites. Thank you for your answers ^^ 

.

Hi,I'm new to forti. I got 30E box and i was configuring. Accidentally disabled LAN port. How to enable the same back??. There is a reset button on box, how to use it to revert to factory defaults? Thnx!

I need help with pin-pointing where/what is causing the disposition on mail we're trying to receive form a a sender. I have submitted a ticket to support (2nd time) and not getting any help from them. Not much available on this topic in the KB also. Attached I have a screenshot of the log.

Hi everyone,   I have problem when connect SSL-VPN using forticlient 5.4.2. I was try turn off firewall, change MTU but unsuccess. Please help me. Detail in attackment. 

Goodmorning,I'v got a issue regarding my fortimail.I wish to exclude a support@mydomain.com address from my fortimail. block / safe list doesn't do the trick as far as I know.what I wish to accomplisch :sender : any domainreceiver : support@mydomain.comno spam / block check. What happens now is that some emails towards the support mail get blocked. with an SLA of 4 hours this is unwanted.in short, any mail send from anywhere needs to land in the inbox of support@mydmain.com without fortimail interfering. I'v searched on the web but couldn't find anything. Any help is appreciated, thanks! 

Hi, What solution do any of you use to remotely power down a Fortigate when it enters unrecoverable conserve mode? I have a few devices in remote locations that I cannot get to in a timely manner, I need to be able to remotely connect to a PDU of some sort to power down a port and reboot the device. I have some across 8 way switching PDU's such as the one below from APC and Lindy but a single port device would be ideal. Any thoughts and what have you done to get over this problem? https://www.lindy.co.uk/networking-c5/remote-access-c266/ip-power-switch-classic-8-power-management-over-ip-p4456 http://www.apc.com/shop/my/en/products/Rack-PDU-Switched-1U-16A-208-230V-8-C13/P-AP7921 

I blocked facebook on fortinet firewall, but this ultrasurf extension on chrome has  bypass to unblock fbanyone help me to block this extention. 

Hi Is there a chance to temporarily disable one (1) super admin account? I have created a super admin account for our vendor access and I wanted to disable it once in a while after the support. Thank you.

Is the seq# that determines the order in which the policy are applied?Thanks 

I have a FS-248D managed by a Fortigate 60E. I have found many MANY examples on how to aggregate Fortilink interfaces, but I can't find a single example on how to aggregate ports on the fortiswitch.Neither from GUI or CLI.Actually I found some examples given when running the Fortiswitch in standalone, not managed. The reason I want to do this is to support LACP (2 ports) from my linus NAS.I had this setup on a DGS-1210-52 (might I add, the 248D is quite the upgrade!) which worked perfectly well. Can someone help me? Side question, does anyone see an issue trying to reuse one of the old DGS-1210 by aggregating it(using 4 ports) on the fortiswitch as well? ThanksLouis

Hello,   I forget about the Forigate 60d (fortios 5.6) and I can not configure several external IP addresses (on the same WAN interface). The fault WAN is configured with an external address (46.20.145.200). I have 4 other external IP addresses that I would like to use to NAT on different internal server, for example: 46.20.145.202 - 192.168.1.201 (Special Port 23587) 46.20.145.203 - 192.168.1.202 (https) 46.20.145.204 - 192.168.1.203 (https) etc ... Idea?   Thanks