Solved

I'm looking for a little clarity on this after we've come across an intermittent issue on 5.2.7 with SSL Inspection enabled. We serve a number of SSL websites to external customers from a single web server. Up until last week the server was running Windows 2008 SP2 Standard and customers had no issues accessing the site from any of the main browsers (IE, Edge, Chrome, Firefox). Unfortunately we had an issue with the server and were forced to quickly implement a Windows 2012 R2 web server to serve the same sites. This was locked down (using IISCrypto) to offer appropriate encryption and cipher combinations, including TLS 1.2 (which was not supported on the older machine). No changes were made on the Fortigate configuration. Since implementation we have had intermittent connectivity issues reported by customers which we have occasionally been able to replicate as they are not happening consistently. These occur across all browsers - in Firefox reporting an SSL_ERROR_B

Hello, In our environment we have a Fortigate 100 D, I'm planning to deploy in all laptop a VPN client, ideally at the end, would be great to get this done: - Detect if user is in our facilities or not, there's no need to connect vpn if users are in the office.  So if any user goes away, vpn tunnel should connect automatically. - Should use AD credentials, as you all know, the more passwords we have, the more support requests IT department will suffer, all laptops are protected by Active Directory credentials, so somehow security in VPN connection should be automated. The goal is to offer VPN benefits but without any user interaction...all traffic should be routed to VPN, even Internet connectionsAnyone have any experience on this? Thank you. 

Hello guys, I am having a very strange problem with my wireless connection. We currently have an Exchange-On-Premises server in our network. When we open Outlook, it connects to this server to handle emails. The thing is that my Outlook client takes a very long time to connect to the server when i am connected through wifi, usually 20 minutes. We have a FortiWifi 90D that manages 2 FortiAP14C. This problem happens no matter to what signal emitter we connect to (FWF90D or FAP14C). This only happens when we connect to the SSID that has access to the local network. It doesnt happen when we are connected through wire. I am certain that it isnt a firewall rule or anything like that. I contacted Fortinet support to solve the problem, but they couldnt neither. We tried everything: allowing unrestricted access to the SSID, packet debug, upgrading firmware (we are currently using 5.6), etc. Anyone with the same problem?   

Hello everyone, just want to clear a small doubet that I could not find anywhere. Lets say I create an aggregate interface and have 10 Vlan interfaces under that aggregate interface.When on the IPV4 policy if I select the Source or Destination interface as the aggregate interface that is a shortcut to selecting all the VLAN interfaces under that aggregate, correct? Many Thanks

I'm looking for a way to block applications based on the "Hostname", but the "Hostname" has a space in it. For example, there is a Just Proxy VPN that is getting through our firewall. If I filter the Application Control log, the Application is SSL_TLSv1.2, and in the details, the Hostname is "Just Proxy VPN" and the URL is "/", and the Category is Network.Service. It uses different IP addresses and ports, so I can't block using those. I can't block all of SSL_TLSv1.2, but I want to block any application using hostname= "Just Proxy VPN". I can filter for it in the logs, but I can't seem to setup a block for it. Is there a way to create an Application using this information to then block it? Here is a detail log for one instance: itime=2017-04-10 20:44:54 vd=root app=SSL_TLSv1.2 date=2017-04-10 dstip=139.59.64.226 apprisk=medium group=FSSO_NoNetscape service=tcp/7624 proto=6 eventtype=app-ctrl-all devid=FG1K5D3I15800570 dstintf=port25 applist=BlockYouTube msg=Network.Servi

Hi everyone, proud new owner of a pair of 1500D that I am going to implement in the coming months. My current test setup is Active/Active HA with a single 1G port connected to the LAN side(to a Cisco 6509 VSS Core). The production environment(Active/Passive) currently has 2 x 10G port per firewall appliance to each Core. So example, FW1 to Core1(active) and FW1 to Core2(redundant). Same thing goes for FW2. My goal is to have redundant connections in a similar fashion with the Fortigates. I know it supports 802.3ad, but I want to make sure it is implemented correctly, especially as this will change all the rules and static routes currently being sent to a single port.  I haven't been able to find good information(cookbook,tech docs,...) to truly determine the Best practices, so before I open a ticket with support, I thought checking with the forums would probably be better. Is anyone currently running A/A HA with redundant LAN ports to their Core's or am I over-compl

Xmas surprise Upgraded all E-series + 80D. Will see...

There are 5 sites IPsec between all of them.There is a DC at the head office with a collector agent.I am trying to get FSSO to work between all sites. The fortigate at headoffice has FSSO working correctly however the remote fortigates wont.I can ping the Head office DC from remote sites but its as if the fortigates cant communicate with the head office DC on port 8000 looking at th debugs : [fsae_server_init_spec:116]: num 1, idx 0, 127.0.0.1:8000 disconnect_server_only[KCM FSSO]: disconnecting _event_error[Local FSSO Agent]: error occurred in read: Connection refused  All policies do not have specific ports configure(all ports allowed)The Windows firewall on the DC is turned off.Please help

Hello, I have a 100E (5.4.4) and there is no  "packet capture" under "Network", now i cant find if this supported or not, i know in the past fortigate disabled this feature for small models in relation to process power, but a 100E isn't small or slow in my opinion. Can someone point me to the right document? Sorry, i really have to work on my search skills. Thanks in advance

hi allsee attached diagram, it'll help explain it better i don't know how to "attack" thisthank you

Hi everybody,The VPN section is divided in to two groups: tunnel mode and interface mode.Which is the difference between to the two?Thank you.

I'm going to visit some 100Ds in a rather remote location. They are currently at 4.3.11 and would like to upgrade the FortiOS 5.2 or 5.4? I've looked and have not found anything outlining pros and cons of each. I'm sort of leaning to 5.2, but would like some input. Thanks in advance....CB

Hello together, I'm trying to get my Fortigates registered via LLDP in my Switches.This works perfectly on two FGT-50E, currently on 5.4.1.It does not work on 3x FGT-90D and on one 110C. These are all on 5.4.somewhat firmware.What I did:    edit "internal14"        set vdom "root"        set type physical        set device-identification enable        set lldp-transmission enable    next and:config system global    set lldp-transmission enableend Then:diag lldpx restart We use HP ProCurve switches. Any idea? 

[/size]Hi,[/size] I'm new to the Fortinet product, actually it is my first Fortigate firewall configuration. I configured IPSec tunnel between Cisco RV042 at head office (HQ) and FortiWiFi 30E at branch office (BO) to connect 2 Asterisk servers.  The HQ subnets are 192.168.16.0/255.255.240.0, BO subnet is 192.168.0.0/255.255.255.224. The tunnel is up and running. I can ping to the servers and access the servers via SSH. Servers can ping each other. Strange thing is, Fortigate does not forward IAX2 packets between offices via IPSec tunnel. diag sys session list command shows Fortigate sends IAX2 packets from BO to HQ to its default gateway, not to the tunnel.[size="2"] session info: proto=17 proto_state=00 duration=336 expire=178 timeout=0 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=5origin-shaper=reply-shaper=per_ip_shaper=ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/255state=may_dirty ndr app_valid statistic(bytes/packets/allow_err): or

I've been playing around with a FortiMail eval recently and couldn't for the life of me find where to configure DLP. The documentation says that its under it's own menu called 'Data Loss Prevention' under 'Policy' but I can't see the menu. I've logged into the demo FortiMail (https://fortimail.fortidemo.com/admin) and can't see it there either. Does anyone know howto enable the DLP feature on the FortiMail? 

I would like to ask that how we suggest fortigate to customer ,  For example we have 500 user so how we will check which device is best and what will be through output will be better for it

Hello, I am adding a new IP range to our WAN1 port and came across a weird issue/confusion on how the fgt is defining these fields in the GUI. I am probably overthinking it, but are we supposed to put in the full Assigned LAN Netblock address with /28 the IP assigns me in the fgt Network/Interfaces/edit WAN1 "IP/Netmask" field, or just the first LAN Usable IP (205.105.155.146/255.255.255.240 - or 255.255.255.255)? Same goes for my static routes. The ISP gave me a Default Gateway for LAN Netblock to use - that should be my static route, correct? 0.0.0.0/0.0.0.0 as the IP/Mask and 205.105.155.145 for the Gateway under Router/Static/Static Routes? Example of what we were provided, including explanation from ISP:Assigned LAN Netblock  - 205.105.155.144/28Subnet Mask: 255.255.255.240LAN Usable IPs: 205.105.155.146 through 205.105.155.158*You mas assign these IPs to your LAN (LAN Default Gateway, PC, Workstation, Firewall, etc)Default Gateway for LAN Netblock: 205.105.155.145

Hi! Guys, I got some problems with new firmware. I use fg300d with FO 5,4. There is configured dial-in ipsec. Everything worked fine until now. All tunnels are hung up. All services are blocked except port forwarding so i could connect to putty's serial console. There are a lot of messages such as "unregister_netdevice: waiting for IPSec NAT_6 to become free. Usage count = 1".  I event cant execute reboot. System just wrote that it is going to reboot bye-bye - and just continue to posts that error messages about netdevice. FG is situated in the data center, so i unable just to switch off and on it...  I'm just in a jam... any help is highly appreciated... Thanks! 

Hello there, is there a option in the EMS to configure a pattern Update interval or something like this? Thanks. Regards, Rolf

Hello, Hope someone can help here. The fortigate seems to skip web filtering following application control. Is this normal? Thanks in advance.

I have a FGT90D that is presenting a strange issue. When I pull up Fortiview and look at Applications, it shows the wrong service/application icons for applications. For example, it may show the Facebook icon for Outlook or the Spotify logo for Dropbox. While its not majorly critical, its an odd issue and it looks off.  Anyone else experience this issue? Thx, Kevin 

I have in the Anti-Spam profile a WhiteList entry likeType: Email WildcardPattern: *@domain.comAction: Mark as ClearStatus: enable But still EMails from this Domain are blocked with the Message: smtp helo/ehlo domain name DNS check failed. How can i solve this without setting the Source-IP on WhiteList?

I have tried "/pm/config/adom/FortiManager/obj/webfilter/urlfilter", but nothing was returned.

Hello,Does FortiOS support OpenVPN server?ThanksAndreas

I had a few different servers go down recently - they just go comatose and need to reboot. I've also had a few of those servers run out of HD space from the windows temp file being full.  When I checked I had about 1 million GIUD type directories with files like vir_extreme_flat_sig.tmp   And a whole bunch of log files from some installer. These look like forti files to me.   Anyone else having this issue?  Any ideas on how to fix?