Solved

I'm looking to find out how many concurrent site to site vpn connections can be handled by a FortiGate 100D.  It would be acting as a vpn concentrator The current WAN connection is 100Mb. Each connection would be using on average 1Mb/s.  Is there a hardware or software limitation on the number of connections?The WAN speed can be increased if needed. Thanks!

Heyoo, We have a stock "full-access" portal we use that enables split tunneling. We have a single user that has an application on her laptop that much appear to come from within our network in order to work. All I am trying to do is create another portal, just for her, that disables split tunneling. Portal is created..no problem.I create a new SSL VPN firewall policy specifying the user and info and authentication rule specifying the SSL portal to use and I am unable to save it without error about range not valid... Is this the correct procedure to do this? I'm following the cookbook for 5.0.7 and I thought it was pretty staightforward but I guess not. All I want is a second portal for a single user that doesn't use split tunneling. Thanks!

Hello!We are running EMS 1.0.1.0077 with client versions 5.4.1.0840 and 5.4.1.0860. I've noticed that unless a user is logged in, all of the machines show as offline, which includes our servers. Does anyone know if this is a known bug or a configuration change that I can make on either the hosts, EMS server or within the forticlient configuration? We have AV, Webfilter and vulnerability enabled for servers and will soon add the application firewall. We also have the EMS server communicating with our Fortianalyzer.

Hello I'm new to the forum and also to Fortinet products. I've a customer that have a  request that i couldn't find an answer online. our scenario:  In our network the lan interfaces are lan and lan2 and the ip is 172.16.x.x, wan port is our internet My customer want when he telnet to 10.0.0.x the packet will get to fortigate and the destination ip will change from 10.0.0.x to legal ip on the internet 34.x.x.x and also the source ip change with NAT. I've tried many things and the last one was using VIP and configure the incoming interface as lan and have a policy from lan to wan where the source ip is 172.16.0.0 and destination is 10.0.0.x. we have 100D, ver 5.2.8 Does anyone knows if this is possible and how to accomplish this? Thanks  

Hi! I'm using FG600D Firmware Version 5.2.9 and using VDOMs.According to this KB, this can be achieved creating an LDAP server and then configuring the administrator making the ldap server and the administrator in the same group.It seems that the ldap server cannot be configured in the global section, this can only be done in VDOMs. Is this correct? Is there any way to authenticate global administrators against an LDAP server? Many thanks in advanceEnrico

Hi all, Does anyone know if it's possible to show URLs or hostnames in reports as clickable hyperlinks?

Hello! Could you please help me with creating custom report templates.I want to create report with specific columns (example is in attached file). And one more question - Can I add to report some of Active Directory atributes?tel  +7 7222 600006fax  +7 7222 604740

http://docs.fortinet.com/uploaded/files/3285/fortios-v5.2.9-release-notes.pdf The list of the resolved issues is important IMHO, just some tips:297421 HTTPs traffic is blocked after AV/IPS database update from FortiGuard.306929 Fortigate memory logging is automatically enabled after reboot.382828 When trying to access internal server through SSL VPN in web mode, the login page is not371264 Modify user ran into lock when trying to change user's password during sslvpn connection.376599 Keep IPSec traffic on the hardware during rekeying causes kernel panic.

Hi,see attachment for an overview of my scenario. Using Fortigate 92D on 5.4.1. Configuration was done via GUI. I have one WAN interface with multiple public IP addresses available and a DMZ with a few servers that all listen on 443, plus SSLVPN listen on the primary address (10.10.10.116). I configured 4 additional secondary IP addresses on the WAN interface (10.10.10.117 - 10.10.10.120). I created VIPs to map those addresses to the internal addresses of my servers, and inbound IPv4 policies to allow traffic on those VIPs. Everything is working so far as intended.  Now I'm trying configure outbound NAT for those servers, and this is where I'm not sure which configuration would be considered best practice. I would like that all outbound traffic of each server is NATed to the same IP address that is used for the inbound VIPs (10.10.10.117 - 10.10.10.120). [ul]I created 4 overload IP Pools (one for each external address)I created 4 IPv4 Policies DMZ -> WAN, from th

Dear all, on a Windows 10 machine Forticlient VPN sometimes works and sometimes get's stuck at 98%. The progress window stops at 98% and simply returns to the login screen. This is different from other posts. Since the Windows 10 machine is located at a remote spot, I cannot simply go there and try the not-always-working WAN port workarounds or reboot the machine. We always use the newest Forticlient installer. What to do? We run FortiOS 4.0.4 on a FG310B. Any help appriciated.

Hello, I am basically trying to create a report which will have the networks displayed in one column and beside that the values of who the maximum band width user is , the maximum session an so on will be there. The network which I am working on is a /22 network for which I am editing the data set so that I get reporting based on /22 subnets , select ip_subnet(`srcip`) as subnet, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and ( ( `srcip` <<=inet('10.22.64.0/22') OR `srcname` = '10.22.64.0/22'))  group by subnet having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc The Analyzer instead of taking the /22 subnet mask it is taking as /24 and giving me a report which obviously is not the one what I want. Would be great if someone could point

Hi, We have a Fortigate 600D and would use the two 10Gbit ports for connecting to our network. Over this two Ports (in link aggregation mode) i need to communicate with three VDOMs (VLAN-based). So my idea was to create the trunk in the root-vdom (named rootTrunk) and create an VLAN-Interface on this trunk (named Trunk_VLAN20).So i have create it and assigned an ip address to the interface Trunk_VLAN20 and (yeah!) can ping the IP from a Client in VLAN20. Now i would like to move the ip adress to the correct vdom behind the root-vdom by create a VDOM Link between root-vdom and vdom_1. Also i create a VLAN interface on npu0_vlink0 (port for root-vdom named vlink0_20) and a VLAN interface on npu0_vlink1 (Port for vdom_1 named vlink1_20).After this i assign the ip adress to virtual port vlink1_20. this was not possible to ping. Thus i think thats was a problem in root-vdom by a missing policy. Now i create a policy (in root-vdom) from Trunk_VLAN20 to vlink0_20

Hi guys, Not sure if anyone' s noticed, but it seems that Fortinet will be moving away from the FCNSA and FCNSP certification levels, and going towards an eight level ' NSE' cert. More details can be found here: http://www.fortinet.com/sites/default/files/basicfiles/NSE-Learning-Path.pdf To go-to the next certification level, you would need to hold all the previous ones. So to reach NSE-6 for example, you would need to be NSE-5 certified. The levels in a nutshell are: NSE-1: Completed FCNSA on-line material NSE-2: Passing FCNSA exam NSE-3: Achieving ' Silver' status on the Fortinet forums NSE-4: Passing FCNSP exam NSE-5: Attending FortiManager & FortiAnalyzer training and pass the exams NSE-6: Attending the FortiOS Troubleshooting course and pass the exam NSE-7: Achieving ' Gold' status on the Fortinet forums NSE-8: Pass an oral and practical exam (that has yet to be created) I personally think it' s a great idea and the courses/exams required are perhap

Hello everyone, i have installed for a rist time the EMS and we are now Testing 20 Workstations with a customer. i must say EMS seems to be very cool improvment in comparison to managing FortiClient from FortiGate. But we have one Big Issue now.  We activated Application Control and Also Exploit Protection. and now a lot of "good" and well known Applications like Veem, Outlook, TeamViewer, Apple Mobile Device Service etc. will be blocked as Exploit or P2P (Veem Backup for example) So the question is how can we override this Applications if they will be threated as Exploit??? Thank you very much.  

Hey, who is going first ?  Some small models like 40C are not support.Just have a quick look at release notes, there is a loooooot of know issues...

Is it possible to bind users to a specific IP with IPsec VPN?

Hi everyone, I have recently installed FortiClient 5.4 in a virtual machine running Windows 7 in order to connect to an external VPN. I have configured the settings of the connection (VPN-SSL), and I receive the email with the FortiToken correctly. However, once I try to log in using the six digit code, I always get the same error message (I'm from Spain, so this is more or less what it says): "Unable to connect to the VPN, VPN server may not be available (-8)". Also, in the logs I get the following message: "msg=SSLVPN tunnel connection failed (Error=-8)" At first, I thought that the origin of the problem was the server, but they have used my credentials from another network to check them, and apparently it worked. I don't use any antivirus program in the host, and Windows Firewall is completely disabled. Any leads of what could I do to solve the issue? Best regards

Hi all,I'm very new to this forum so I want to say hello to everyone first and I'd be very happy if I can get some help here :)We have 4 Sites, all connected to each other (mesh) via Site-to-Site IPsec VPN Tunnels. Everything works without problems except one thing:Let's say site B is using VoIP phone system over site A. In site A all phones are working without interruptions, but site B faces the issue of phones go offline and then reconnecting themselves. I monitored with the sniffing option and found that VoIP packets some-when just aren't transmitted for at least 40s. Usually it's running fine, they can do phone calls etc. but then irregularly packets aren't sent anymore.I've monitored the connection between the phone system (192.168.8.30) and one desk phone (192.168.12.50). In the attached picture you can see the packets which are transferred (left side is site A, right side is site B).For any help to find out more about this problem I'd be very happy as this is very annoying :(&nb

I am in this situation. I created IPsec SiteToSite  VPN  with FG60D v.5.2.9  and MikroTik Router. Tunnel is UP and hosts in routed subnet(FG 192.168.1.0/24 MikroTik 192.168.2.0/24) are reachable. Traffic is on. There is only one trouble. From FG60D (192.168.1.1) I am not able ping anything in MikroTik subnet. But from PC (192.168.1.2) in FG's lan ping works. From MikroTik Site all works perfectly. Only from Fortigate ping not response. What is default IP for traffic generated from fortigate(source IP) ?

I have an Action:DENY policy setup at the top of the ruleset for inbound traffic from WAN1 to DMZ. The source address for this policy is a group which consists of some geography-based networks and " bad addresses" that come up frequently in the IPS. However, this policy doesn' t ever seem to get matched and hosts I have explicitly added to the blacklist group--or even as their own entry--are matched against policies further down in the chain. I know this has to be something easy, but after staring at it for a couple of days I' m just not seeing it. Hopefully one of you fellows can see what I' m missing. This is on a FortiGate 80C running FortiOS 5.0.7 (build 3608). I' ve attached a screenshot of the rule set, but the relevant bits of code are here: config firewall address edit " all" next edit " outside.blacklist.121.139.0.0" set subnet 121.139.0.0 255.255.0.0 next edit " outside.blacklist.96.8.126.97" set subnet 96.8.126.0 25

I want to remote to a server on DMZ. Here is my scenario: As shown in the attached image, We have a fortigate 100D firewall which gets its internet from ADSL TP-link modem. There is also a valid IP set on the modem and the modem itself is connected to fortigate's WAN1 interface. The server which I want to remote to is located on DMZ. Please help me configuring and getting my scenario work properly.thank u 

I'm having trouble getting a custom app ctrl sig to work on 5.4.1. Basically i want to identify the use of a special type of browser, it's present in the user-agent field as 'Shield' and the header includes the unique field 'X-SHIELD-ID:'I've got an app ctrl sensor that passes everything and a custom override with the sig below set to monitor, however the log identifies the app as http.browser_ie , which it basically is.Can anyone see anything wrong in the syntax i've used, if not, is there another reason why this is getting logged at IE and not the custom sig? GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko; Shield X-SHIELD-ID: d0131c8c-fa23-4e74-9e1d-d6b8fa9489ed F-SBID( --name "Shielded_Browser"; --protocol tcp; --service HTTP; --flow from_client; --parsed_type HTTP_GET; --pattern "Shield"; --context header; --no_case; --app_cat 25; )

Multiple incoming static IPs @ WAN1, forwarding to specific servers. VIPs / VGroup / Port Forwarding set up (No NAT), and forwarding works internally using secondary IP (can connect to web server), but can't access from outside... times out. My experience with this is limited, so I am not prone to experiment too much.. ;) Read somewhere that specifying a secondary IP on the WAN1 interface should not be necessary, is that true? That's the only idea I have left, so if that's not it, maybe someone can point me in the right direction.. Thanks!CW Jones

I have FortiMAil 100c in Gateway mod with Exchange2007. How to block or is there some option to limit wrong SMTP auth for mail accounts on fortimail ?

I was pointed to http://docs.fortinet.com/uploaded/files/2041/using-a-custom-certificate-for-SSL-inspection.pdf by support when I asked about using cert for ssl inspection. Are these instructions only meant for someone who has an internal CA that is trusted by clients? It seems that no Public SSL CA company would grant this type of cert. If that is the case the directions don't really say that. I am just trying to do web filtering of my clients and was hoping to not have to install cert on them. Also how does it work with web filtering on guest network / byod where you can't install cert on client machines?