Solved

Hi, I'm trying to configure webmail access for end users, to allow quarantine access.I have set gateway mode.LDAP profile works good, it means I can browse LDAP tree and LDAP Query Test (Authentication) works for me too (test result = Bind successful).When I try to login to webmail I get login failed message.Event log shows only that webmail login was failed, no more details.I'm not sure if FM even tries to authenticate webmail user by LDAP.Perhaps something is missing in my configuration, I looked inside AntiSpam/Quarantine Settings for allow end user access settings, but I found nothing like that.What is missing in my config? Regards, Piotr M. 

Hello all, I've recently implemented a number of FG-100s and FG-300s and am trying to move my web filtering service over to these devices. We require that all web traffic be tracked back to the user and so I'm also trying to implement the FSSO service to provide a seamless browsing service to my users. This has worked well so far for windows systems but has proven troublesome for Mac systems. Mac logons do usually show up in the FSSO user list but the "system name" column shows their IP addresses instead of their system name. Web browsing in this situation, to put it succinctly, does not work for the Macs.  Does anyone else successfully use Mac systems with the FSSO service, and if so then what's the trick to getting them to play nicely together? I should mention that we are using the FSSO polling mode recommended by Fortinet to work with Mac systems. Thanks for any help!

I have a FG 800C that was working fineI Backup my configuration, edit it and restore itnow I cannot login to the unit,every try resolve i wrong user and passwordI Try to Login using Fortiexplorer with user "maintainer" to recover my password.I can login, but when trying to reset password i get this massage: FG800C # config system adminFG800C (admin) # edit admin 'maintainer' account can only edit existing admins. node_check_object fail! for name adminvalue parse error before 'admin' Command fail. Return code -37 It seems like there is no user name "admin"is there any way to recover the user? or even restore everything to default? 

Hi, I was wondering how disruptive it is to enable vCluster2 on a production Fortigate installation which is already up and running. Does it affect the existing traffic in any way? Cheers!Emil

I've got a couple of 60C's in HA running 5.0.4.  I tried to log in to the web interface today and it logs me in and loads the top toolbar and sits there with two empty frames for a while before it finally returns a "Error 500: Internal Server Error" in the left frame.  I've tried killing all the httpsd processes but it hasn't made a difference.  A diag debug on the web-ui shows the following when the error shows in the web interface:-[httpsd 27319] http_config.c[573] ap_invoke_handler -- handler 'fastcgi-script' completed (result==500)[httpsd 27319] http_request.c[1443] ap_internal_redirect -- internal redirect to '/p/pubredir/httperror/' Trying to avoid rebooting the firewall at all costs.  I've considered a forced failover to the secondary device but want to exhaust any other possible options before going down that road, and I'm not sure it will fix it anyway.   The web interface was working fine a day or two ago and nothing has changed since then.

 What is the CLI cmd to determine the transceivers installed in a fgt?

In the latest MacOS Seirra beta 5- FortiClient breaks!I'm running version 5.2.3.370. The screen shows empty content, no buttons or text. Any ideas? 

Hello i want to ask,yesterday user in my office cannot browse to internet and use VPN  connection, after i check in my fortigate dashboardantivirus , IPS UTM is unlicensed but i have subscription until 2019, after i check to my policy and routing nothing wrong with my seeting , after that i refresh a browser an antivirus and IPS is licensed again and user in my office can browse to internet again,i dont  know what my problem is, can anyone answer me why subsciption in my fortigate suddenly unlicensed ? please help me.

I need to add a new Isp on Wan 2 and then i would that clients use Wan2 to surf the web but servers and services (exchange server,web server etc etc)  keep on use Wan1.It's enough to:-set the network interface for wan2-add a static route for wan2-change the policies internal---->wan1 and set the outgoing interface to wan2  ??Thanks for your helpFrancesco

Hi guys, I have a customer who needs to block a specific excel file from leaving their network. We have v5.4.1 running on their firewall and I'm busy reading up on DLP and came across the watermarking feature / option, but I do not find it anywhere in the GUI. must this be enabled in CLI or has this been removed from 5.4? they still mention it in the FortiOS 5.4.0 Handbook - Security Profiles. Is there another way I can go about creating the DLP filter for this specific Excel file? bearing in mind anybody could potentially rename the file as well... thanks,theG

HelloI'm really struggling to get a VPN up and running between our 100D with firmware version 5.2.4. and Azure.  I have followed a number of instructions but none seem to work.  The Azure end was created using resource manager.  When I look in the logs I just see IPsec phase 1 errors.  My config looks like this.  any help would be much appreciated.  config vpn ipsec phase1-interfacenext    edit "Azure_P1"    set interface "wan2"    set ike-version 2    set keylife 28800    set proposal aes256-sha256 aes256-sha1 aes128-sha256 aes128-sha1    set dhgrp 2    set remote-gw xxx.xxx.xxx.xxx    set psksecret ENC xxxxxx nextendconfig vpn ipsec phase2-interfacenext    edit "Azure_P2"    set phase1name "Azure_P1"    set proposal aes256-sha256 aes256-sha1 aes128-sha256 aes128-sha1  &nbs

My fortigate 100d is not forward traffic between Guestlan and lan.Guestlan is on a seperate lan.Wan adresses are 200.200.200.2 255.255.255.240One webserver is on 200.200.200.3 and traffic is going fine. From the internet as from the guestnetwerkthe second webserver is on 200.200.200.2From the internet this website is accessable. But when we try to acces the website from the guestnewerk it is not accessable. When we look at the log and report we see it is getting in the Implicit Deny rule. The guest network is 192.168.1.1 and external adres is 200.200.200.13. We have internet acces and eveything is working fine.When I put the webserver from 200.200.200.2 to 200.200.200.4 it is working fine. When I change this back to 200.200.200.2 it stops working. Is this a bug because we use the first address in the range. https on the webinterface is not enabled.System settings https port 443 is changed to 8443 for Administration logon. Please assist

It seems whenever FC updates its databases, it briefly "turns off" according to Windows, which prompts a notification. It shows every minute or so while scanning, and if you watch Action Center while it's doing so, the AV status 'flickers' between on and off. Has anyone else had this/have a solution for it?

Hello, We just proceed with DLP implementation.We create DLP rules to examine and supress mail wich content .js, .bat ... inside archives .zipHowever, how can we add exception for single sender identified by his email adress or his IP ? Thanks for the answer. Best regards Fortigate 500D Firmware v5.2.4

I have a cluster of 3 x FG5001D using 4 VDOM. we was on version 5.0.9 when we realized that the option "Packet Capture" under any VDOM (Vdom -> System -> Network) was not there.After this, we proceed to update to the actual version 5.2.8 and the menu option "Packet Capture" does not appear. trying through CLI, the packet capture works well. but the user of packet capture don't have intimacy with CLI, then we need the GUI working.i checked the user permissions, clear browser caches, other navigator and nothing was effective Any clue of what i have to do?

Hi everybody. I'm setting up a new Fortigate HA cluster (300D) and i have a strange issue. Each time i have to reboot a node of the cluster, he came back as a standalone Fortigate.  Any idea how i can resolve that ? This is pretty annoying. Here is the HA configuration. config system haset group-name "Toto"set mode a-pset password ENC totoset hbdev "mgmt1" 50 "mgmt2" 50 set session-pickup enableset ha-mgmt-status enableset ha-mgmt-interface "Management" <= this is actually a vlan interfaceset ha-mgmt-interface-gateway x.x.xset override disableend

I am wondering if there is anyone that knows a good way to export firewalls rules with comments to a readable format ? copying the rulebase from the gui and paste it to excel works but to get the comments you need to copy the rule base from the CLI and then filter and so on which takes time. Checkpoint for example has many good ways to export the rulebase to HTML. Is there any scripts that can read the config file and export id,src int,dst int,src,dst,port and comment ?

I'm using 5.4.1. I setup fsso and trying to view user activity in forward traffic logs but the user column is blank. I know it is seeing the user because the policy allows that user and the web-filter logs display the user. Is this just a cosmetic bug in 5.4.1 or am I missing something here?

Hello ,My problem is when i reboot my SLAVE fortigate  in a HA cluster config , all of physical ports are down ( with no lights ),  so there is no connection with a master fortigate  , i have restored a last good configuration  to the master HA - GF  but the problem is not resolved .please it is a hardware problem or a software pblm : thank you

.

build701Appeared in the download portal....but [size="5"]no enhancements?????[/size] 

I have WiFi controller HP, wireless users are identified by the RADIUS server (Windows NPS). I want to see these WiFi users on FortiGate, is this possible?Thank you!

Hi,Just replaced my old firewall (Zywall) with a Fortigate 100DOn the Zywall there were 2 vlans 6 and 99I rebuild this on the Fortigate. Connected the same cabeling to the fortigate but the vlans are not working.Lan port 1 is connected to a HP switch and on the switch vlan 6 and vlan 99 are tagged on this port (this was already set)My question is why is there no traffic between the fortigate and the lan.Vlan6 Type is Vlan, interface is lan, id is 6. ping is enabled. DHCP is also enabled. ip is 192.168.101.1Vlan99 Type is Vlan, interface is lan, id is 99. ping is enabled. DHCP is also enabled. ip is 19268.99.254lan itself is 192.168.1.1have a policy from vlan6 and vlan99 to Internet and a policy from vlan6 to vlan99 visaversa.Any why i cannot ping from internal netwerkserver to 192.168.101.1?

Hello,i have issue when open some website like yahoo.com For example but not limited to ,from Chrome i found  error  below:"The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1". what should to do to solve this issue ? thanks

hello all, I'm planning to place the slave unit of a Fortigate HA cluster into a remote location. There is a leased line (layer 2) for the HA connect. Can anybody confirm that I can run the HA traffic across a VLAN between the access switches on each side of the line? I know that HA traffic uses a non-standard ethertype, and I've tested that HA traffic is transfered unchanged over that line. But now there will be VRRP traffic between 2 routers on this line as well, and I'd like to isolate the HA traffic on a VLAN of it's own. There is the option to enable authentication and encryption of the HA traffic but this will cost performance. Though it will isolate the traffic I guess. I appreciate any advice, esp. from someone who has already separated a HA cluster geographically.