Solved

Dear colleagues,  do you know if and when a virtual appliance version of the FortiWLC will be released?

Hello, I have just implemented Deep Packet SSL Inspection on our Fortigate firewall.I am finding instances of SSL certificate pinning (HPKP) where I need to make exceptions to the DPI list e.g. *.google.com etc.This fixes the problem.What I am finding strange is how some of the sites I need to make exceptions for do not 'seem' to be using HPKP pinning (or HSTS.For example, I look within Chrome browser 'chrome://net-internals/#capture' I do not see any entries for those particular sites using pinning or HSTS (HTTP strict transport security). Also when I do lookups to public SSL verification sites they say there are no HPKP or HSTS headers being used on that site.Why would this be ?Could it be to do with the fact that some sites aggregate content from many other sites and perhaps one of those sites is using HPKP or HSTS headers ?The other strange issue is that sometime these problem sites work for users and sometimes they don't. Could this related to the above, in that these sites may be

Hi!I am just using my first FG 200Es (OS: 5.4.4)As they do not have a SSD, I need to log to memory. Everything is working fine, but the log is VERY small. It does just keep the last 140-170 lines. Is this the "normal behaviour"? Is it safe to increase the max-size of the memory-log: config log memory global-setting    set max-size 2236949end Standard-Size is 65536 One second thing: Is there any possibility to let the two nodes of a HA-cluster boot "one after the other", if I change that setting? Thank youRegards,KPS 

Hi, I am using Fortigate 200D, i want to restrict users from downloading files larger than 20MB based on policycan someone help me step by step Thanks and RegardsMirza

Hi there,  On the Lifecycle announcements from the support website, there's no 60D mention. I know that 60D is a model from 2013 and now this hardware has 4 years old. Is there any other way to confirm the lifecycle from a 60 D-series model  ? Thank you !  Luiz CamiloNCT Informática

Hello,I am not very practice with Fortigate and I am analyzing the company firewall policies, so I would like to know the meaning of the policies in the attached file.The direction of the policies is IN >> OUTThank you--Nicola

Hi, We want to replace our Fortinet AP FAP221C with something better. We have problems with Apple devices like iPhone and laptops they frequently disconnects from access points. Can someone recommend more reliable Fortinet model? Thanks,Aigars 

Hi Everyone - first post here. I'm new to fortinet but hopefully I have a simple question for the experts. We are about to activate a new WAN service from a new ISP. Currently, our 100D is configured only for WAN1, but I would like to keep that config as there are a lot of rules and site-site VPN config that I wouldn't know how to duplicate if we brought in the new WAN link and connected it to WAN2. So my question is: can I simply edit the .cfg backup file from the existing config and search for all references to my existing IP and replace it with the new IPs? Then, once it's up and running on the new IP I can go back and take my time and manually build WAN2 as a redundant link. The current WAN1 link is just a slow 20Mb/20Mb and the new is 100Mb/100Mb. Since the switchover is so critical this method seems like it would be really fast and basically come online instantly, the site-site tunnel would reestablish itself after i changed the IPs on the destination fortigate also. Anyone w

HiI want to compare fortiweb 1000D and 3000E cpu model?

Hello,I have a  90D at office . Connected by Normal Ethernet switches to Workstations and Wifi access points. I blocked unwanted applications on PCs but the same apps opens in Wifi.Any help would be really appreciated. Thank you.   

Hello Does anyone know where I can find a list of code status and their meaning for command "diagnose debug crashlog read" When I execute that command I get:# di debug crashlog read | grep 2016-12-08 12654: 2016-12-08 08:42:39 the killed daemon is /bin/pyfcgid: status=0x100 What does "0x100" mean? what are other possible code status? Thank you

Can you authenticate via an ldap user to the SSL web portal? Using 5.2.2 Forticlient. I just today set up the web portal, so something could definitely be misconfigured there. However, I created an SSL VPN Group, added the Domain Users group to it as a test from AD. Also created a local user called "test" and added it to that group.  I can log in as 'test' but not as any user of AD. 

ipsec site to site vpn configured. on WAN2 i have staic Ip, and on WAN1 i have normal internet connectivity. i want to use WAN1 for internet traffic and WAN 2 (configured with static ip) for site to site and access vpn. how can i achieve it ? please help me out. 

We user FSSO to authenticate users for web traffic. We don't use explicit proxy because of office365 performance.When there are multiple users on one server, user traffic from a user will be identified as traffic from another user on the same server. This is not what we want. Did anyone run into the same problem and is there a solution? We use FSSO with a Collector Agent on one of our DC's and agents on the other DC servers. 

We have 1 FortiGate that handles the routing of our internal networks as well as the outside world. I'm looking for a way to allow server A on network A to know who server B on network B is when they communicate. With NAT on, when this communication happens, server A sees the communication as coming from the FortiGate instead of from server B. I need to be a to set something like an X-Forwarded-For header on the traffic, or be able to to NAT just the external traffic and set the inside networks to transparency. My understanding is that since we just have the single device which handles inside and outside, I have to have NAT but the FortiGate seems to only allow yes or no when it comes to NAT. Can anyone shed some light on this issue? 

I have a Fortigate 90D with firmware 5.4.1. I am new to the Fortigate firewalls. My problem is the following:I have two Active Directory groups called FacebookUsers and TwitterUsers. SSO is correctly configured.So, I’ve set up this rules for testing purposes:1- Allow rule, from internal interface to external, all services, all destination addresses, all source addresses and FacebookUsers group. I’ve attached a web filter profile called “Allow Facebook” with a static URL filter for the *.facebook.com wildcard domain set to allow. I’ve also assigned an SSL inspection profile.2- Similar rule to allow Twitter with a web filter profile for the *.twitter.com wildcard domain.3- Deny rule, from internal interface to external, all services, all destination addresses, all users, no web filter profile.A user who belongs to the group FacebookUsers can browse the Facebook domain. But he can also browse Twitter and any other URL. Rule number 1 is applied.A user who belongs to the group TwitterUsers

Looks like FortiAuthenticator 4.3.0 (build 0216) firmware is out. Per release notes, it now allows you to turn off FTM push notifications for radius users.  There are a number of bug fixes, including better logging and reports of push notifications. Unfortunately for me, "Known Issues" still lists the bug I ran into with EAP, and a possibly related one:   375401 Password authentication fails for admins in EAP.   392437 SSH FAC login fails using CHAP/MS.CHAP/MS.CHAPv2 authentication to Cisco ACS remote RADIUS users. Anybody upgraded to 4.3.0 yet?  I'd like to not be the first this time!

Starting eval of FortiManager and imported two of my Fortigates.  Everything pretty straightforward, except the imported IPSec VPN tunnels.  I have custom IPSec VPN tunnels created manually for Fortinet > Juniper SSG firewalls.I can see the imported tunnels under VPN Manager > Monitor and the status is Up. But how do I modify these imported tunnels or create new tunnels?  I do not want tunnel created with a wizard due to it will not work with Juniper Networks SSG firewalls. The FortiManager I am evaluating is 5.4.1 build 1082 Thanks in Advance!Joe

Dear all,I can't see this in the PDF brochure for this product and was wondering if it features FortiASIC SoC2 or newer implementation of the SoC. Thanks in advance.

Hello We are enabling SSL VPN in our environment.  In previous FortiGate versions there was an option to establish the tunnel through a browser plugin. Please attachment left-hand-side.... Note the 'Tunnel Mode' section with 'Connect' 'Disconnect' and 'Refresh' options. This option is not present anymore on current 5.4.2 version. Please attachment right-hand-side. Our remote users are not permitted to install software, so the full client will not work for us. Can anybody advise how we can enable the browser tunnel plugin. Many thanks

After update to 5.4.4 on FAP221B and FAP321C the web console will not load.Has it been removed or disabled??Cleared computer cache and it still will not allow me to connect.I tried SSH, TELNET, HTTP and HTTPS.. none of them worked.

First of all, thanks for the help. I do not use Fortinet much, but I have a problem handling a simple Blacklist. My idea is to connect SIEM, Fail2ban, TOR exit nodes and other internal systems to Fortigate via SSH. Create a policy, a group of addresses and run, as is done with other manufacturers. I've mounted a script that does that, it passes an ip, and creates it as an object and puts it in a group: https://github.com/kinomakino/Ban-ip-Bash-Scripts/blob/master/ban_fortinet.sh Now I have several problems: 1.- the maximum limits for Fortigat in groups of addresses is 300. VERY LOW. If for example I want to block all the nodes out of the TOR network every night (one of the things I need to implement in Forti) I can not do it. 2.- In the case of making a "stack", I do not know how to list in CLI the current ip addresses in a group and have that data in bash to handle loops and conditions. 3.- I can not "remove" all the ip addresses of a group from CLI,

Hi guys,I have a FGM running 5.4.2 and just turned ON FortiAnalyzer features .Now can someone please share from its XP the difference between this and a dedicate FortiAnaliyzer unit (actually VM).All our FGTs are used for: Firewall and VPN only - no UTM at all. Thanks!

Hi, On a fortigate running FortiOS v3.0, it is possible to specify an IP range for ssl-vpn user groups using these commands :edit "Group1" set group-type sslvpn set sslvpn-tunnel enable set sslvpn-tunnel-startip 172.16.0.1 set sslvpn-tunnel-endip 172.16.0.10 I upgraded my firmware to v5.4 and these commands are not available anymore. (sslvpn group type doesn't exist)Where can I specify IP range for my user groups in this version ? ThanksAlvi

Hi all, after a power outage an Active-Passive cluster of FGs shows the "File System Check" message at the login. If I perform the File System Check, only one of the firewall will reboot and check for errors or I will have both of them offline? I'd like to avoid service interruption but I don't know if this is possible in this case.