Solved

Hi all, I'm setting up the SSL VPN for my company and, I'm confused about how the VPN is licensed.  In my previous experience with Fortinet products, you had to have a license for the number of VPN clients you were going to have.  When we bought 4 new 300D's my sales person told me that the licensing is handled by the EMS server now.  I have installed the EMS server and it's licensed for 150 clients.  Where I get confused is how does the Fortigate know about the EMS server, or does it need to?  Honestly, I'm not at the point where I need full enterprise management outside of what the Fortigate can do itself, and all I want is to ensure that I can have more than the 10 users connect.   Do I point the forticlients at the EMS server for telemetry, or the fortigate itself?  If the Fortigate is doing he telemetry, how does it integrate with the EMS?  The only thing I found in the cookbook was for implementing an EMS to manage internal device

I have 4 computers using Forticlient VPN, 3 of them are working without troubles (2 acer, 1 lenovo), but I have an HP Pavilion, and everytime I connect to VPN, I lost the connection after 5 or 10 minutes. I have to write the credentials again to come back. Any idea of what could be happened? This is very annoyed, I cant work :(

Hello,We have purchased a Fortinet unit with the following specifications:Fortinet - FortiGate 94D PoEQuickStart Guide of this unit shows a diagram of the device. According to the diagram, the device has the following ports:USB MGMT (USB Mini-B)DMZ 1 & 2 (SFP)WAN 1 & 2 (RJ-45)LAN Ports 1-24LAN PoE Ports 25-48 Currently, we have DSL Internet Connection 1 from Internet Service Provider 1 and DSL Internet Connection 2 from Internet Service Provider 2. We have connected connection 1 to WAN 1 and connection 2 to WAN 2. Our requirement is to add DSL Internet Connection 3 from Internet Service Provider 3 to the Fortinet/FortiGate unit. However, the unit only provides two WAN connections, WAN 1 and WAN 2. Is it possible that we could add the DSL Internet Connection 3 from Internet Service Provider 3 to the FortiGate unit? Regards,Shehzad 

is it possible in v5.2.3? because i still need it to be filtered by ip4 policy.i'm able to do it using routing policy, but by using routing policy, it will disregard the rule i create in policy and object.

Hi:I'm considering buying some 60E's to replace some older 81CM's at branch locations.I have been buying 90D's and running 5.2 firmware. The 60E spec sheet shows great improvement over the other models, but I'm skeptical that its "ready for prime time."I've read in the forums the 50E models had a lot of issues, and E models only come with 5.4, which I have avoided using in production also.Anyone have experiences (positive or negative) with the 60E yet?Thanks,Scott

Firmware Version v5.2.10,build742 I Need Set Up Lacp Aggregation  No setup methods found  how to do

Hi all,I'm new to fortigate, this is my first time setting up port forwarding on fortigate routers 60D.I have created 2 VIPs to forward ports 85 and 37777 to a specific internal IP address, then created 2 group VIPs, create the services and then added the firewall rules. However, when I try to verify or the ports, I get ports are closed. Configuration attached

Hi, I set up a VPN hub/spoke structure with a Dialup server and some Remote branches (all appliances are Fortigate 60B). Surprisingly, I observed an Automatic Static Route that appeared on the Dialup server pointing to Remote network, with an Administrative Distance =1. I did not see this feature in the documentation. On the remote site I could not see any automatic route (I put a manual one). My question is: how to change this AD to a suitable value? The VPN function is to serve as backup and I need to set an AD greater than normal route. Regards,

Hi everybody,I'm looking for the wiring diagram in order to run the HQIP firmware on a Fortigate 100D.In the diagnose wiki:http://wiki.diagnose.fortinet.com/index.php/Running_an_HQIP_%28Hardware_Quick_Inspection_Package%29_test#FortiGate_.2F_FortiWiFithere is only a wiring example for a 60C but 100D has much more ethernet ports.Can somedody help me?Thank YouMatteo

Hello, Is it possible to convert Fortigate mode from active-passive to active-active in a productive network. thanks

Hi Folks, I have 2 WAN connections which I currently use routing policies to send traffic out, I would like to know if it is possible to cascade/overflow traffic from WAN1 to WAN2 when a certain bandwidth is exceeded, for example: WAN1 hits 10Mbs usage and I would like the "excess" traffic to then use WAN2 until the load is reduced on WAN1 at which point WAN1 should be used again. I have come across a number of FG docs which allude to the fact this may be possible but if anyone could point me in the right direction I would be grateful. ThanksEddie

Hello, I have to deploy an explicit proxy architecture for a customer and we want to use authentication on it. Main mode will be FSSO, no issue with that. But if Fortigate doesn't identify a user by FSSO standard mode, we want to try by using NTLM. Is it possible ? I was thinking of this kind of configuration : set active-auth-method ntlm set sso-auth-method fssoBut is the active method used only when the connection with the agent is broken or also as a fallback when the agent just doesn't find anything in the AD ?  Thanks in advance. Best regards, François 

Hi, We currently have a Single Sign-On Agent installed on 1 DC, which is configured to monitor all DC's. All works fine until a users switches from wired Ethernet to Wifi, they are no longer able to browse the internet. To solve this, they would need to lock the laptop and log-in again to windows.  In the "Show Logon Users" the user will be listed with "wired" IP address and not Wifi IP.  I have tried reducing the "Workstation verify interval" to 1 minutes and the "IP address change verify interval" to 10 seconds but this did not solve the problem.   Firmware: v5.2.7,build718 on 300D

Setup = 2 X FortiGate 100D Hardware Appliances (Active Passive) v5.2.8, build 727. NAT Mode.Hi all,We are experiencing a strange situation here and I was wondering if anyone had experienced something similar.We are seeing entries in traffic logs which indicate DNS requests being made to the online FortiNet DNS Servers (208.91.112.53 & 208.91.112.52) from network clients. Nothing unusual there, but the Application Name being returned in the log entries is not DNS as expected but, WhatsApp & WhatsApp_File.Transfer.  Has anyone any suggestion as to why these DNS requests are being mis-classified in this way? Many thanks, John P 

Hi guys, currently I'm hanging at a really bad issue.I configured SSL VPN Portal at a FWF 60D, but the Portal is unreachable at all.Not from External, not from internal. Setup:Internal LAN --> FWF 60D --> Transfer-Network --> VDSL Router --> WANClient --> WAN --> VDSL Router (Port Forward 8443 to FWF) --> FWF 60D --> LAN Try to reach SSL VPN Portal from Internal at the Transfer Network Interface of FWF (not possible)Try to reach SSL VPN Portal from External WAN over VSDL Router (not possible) Diag Debug Application sslvpn --> no connectionI know, its an easy thing, but I stuck at the moment... No further ideas...

I currently have  2 vdoms setup. I have not been able to configure both vdoms with the same wan port. Is this possible? The reason I am trying to approach it this way as opposed to having  separate external interfaces for each vdom is because i want to setup wan failover to cover both vdoms.

Hello, I have the following dataset which returns the bandwidth and browsetime of users who visit social media websites.This report works perfectly when I run the 'test' feature within the dataset, however as soon as I place it in to a report, the output results are distorted i.e. browsetimes should as only 1 or 2 seconds.Can anyone confirm if this dataset is structured correctly (even though it does work via 'test' in the dataset panel). Dataset attached to this post.

Hello everyone. I would like to ask, if i can change the language of the reporting to german manually.The language is currently not available on the Fortianalyzer.I can translate the chart-title to german. But i cant change some fields on the topsheet, like data range, report date or table of content.I know it's just a detail, but some customers ask us, if we are able to change that. Thanks for any help.   

I have an FGT60D running DHCP on the Internal interface serving IP addresses to about 120 clients. Every few weeks someone using Windows will report to me that they are seeing a pop-up message that they have an IP address conflict. This happened this morning to a Windows 7 client. Running ipconfig shows the client has an address of 192.168.1.136 and does not change, however, the Fortigate system log shows that they are requesting a new IP address about every 10 seconds. The log shows the following events:[ol]DHCP client sends a DHCPDISCOVERDHCP server sends a DHCPOFFER and offers a leaseDHCP client sends a DHCPREQUEST and requests for the given leaseDHCP client accepts the given lease and sends a DHCPACKDHCP client detects an IP conflict with the given lease and sends a DHCPDECLINE[/ol]On the client system I've tried a release/renew, as well as deleting the network adapter from the device manager and rebooting, allowing the network adapter to be auto-installed on system boot. Neither o

Hello all! We are currently testing FortiClient as we want to switch over to it as our main AV and VPN client solution. Our plan is to push out the initial client through SCCM to all of our endpoints and then use EMS to manage them. I noticed that the users will get prompted when pushing a FortiClient upgrade (say v5.4.1 to 5.4.2)  from EMS, since they have to reboot. Is there an option for a completely silent upgrade through EMS?  Any help is appreciated. Thanks!

I've upgraded our Fortimail to 5.3.5. We have a valid Fortisandbox.Cloud Contract - now with 5.3.5 we can only send 100 Samples per day!! Level 1 Support says that this is per design! So be carefull when upgrading!! On the Dashboard:"Legacy FortiSandbox cloud service is used. Please activate FortiCloud as soon as possible!"

Greetings to youDearsOur management care about security and nowdays new virus Shamoon malware is diffuseMy Question Is Forticlient AV can prevent this Virus Samoon malware ? yes or no ? as we do update always

Hello, We use FortiGate 3700D running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415. One of our Fortigate gave us several failure (5 times during while 3 last months) about "Optional power supply not detected".We've check all power plug and all looks good.Do you know if this failure detection or this alert message could be a or a known error from this FortiOS version? Regards, Chris 

Hello,Does FortiGate VMX support integration with Openstack orchestrator?ThanksAndreas

Hi,   Recently we have upgraded our 800C to FortiOs 5.4.1 but as soon as the unit reboots some web rating overrides urls stop working, so, in the GUI we can see them, but it doesn't work until we run in the CLI the "set rating" command. It has happened every time the unit reboots. Any suggestion about how to proceed ? Regards.