Solved

I tried to generate a report within URL field but i'm not able to looking for the right query to use in the dataset.At the log View I see the URL field.Someone can help me?Thank's

Hi after installing new Windows 10 Preview 14251 latest FortiClient 5.4. doesn't work anymore. I deinstalled and reinstalled the same Problem."Your system has been quarantined." error message after starting. It seems that the Network Driver is incompatible.  Anyone with the same experience ?

Hello, I'm about to place an order for FG-51E. I'm planning to install FG-51E in my home office (~12 servers and a few users) with 75mbps internet connection. Will FG-51E be able to sustain 75mbps internet traffic with all features on?Especially, what throughput should I expect  from  SSL traffic inspection? Thank you!

Hey all, I've inherited a Fortigate 80C and recently I've lost all login access to this device. Everything else seems to work, like VPN access and our VLAN. I found a way online to reset the lost admin password using the Maintainer login to change it but I'm getting an error:  Domain1 login: maintainer Password: ******************** Welcome !Domain1 # config system adminDomain1 (admin) # edit admin new entry 'admin' addedDomain1 (admin) # set password Pass1Domain1 (admin) # end User must have a profile object set operator error, -56 discard the setting Command fail. Return code -56 I've tried this a couple of times with the same result. I even tried it with my own login but no joy. I'm not a Fortigate guy so I'm not familiar with the device or any of its idiosyncracies. Am I missing a step here or is there a better way to do this?  Thanks, Joe B 

I'm a little confused about how setting the config from the command line works. Specifically, when I enable router logging, the option disappears from the config. See below: Fortigate (eventfilter) # showconfig log eventfilter    set system disable    set vpn disable    set user disable    set router disable    set wireless-activity disable    set wan-opt disable    set endpoint disable    set ha disableend   (eventfilter) # set router enable   Fortigate (eventfilter) # end   Fortigate (eventfilter) # show config log eventfilter     set system disable     set vpn disable     set user disable     set wireless-activity disable     set wan-opt disable     set endpoint disable     set ha disable end  Why does this happen? &n

Hi,   Does anyone know if I can user social login guest registration along with administration approval? I mean, the guest user register itself using social login (FB, Linkedin, etc) then some administrators receives an email to allow the user to navigate ?  I am using a FortiAuthenticator v4.00-build0019-20151007-patch00.   PS: I have "Require administrator approval" on Self-service portal -> self-registration ENABLED but only works in the regular form. Thanks in advanced. Ronald

I am running two reports on user activity, detailed web browsing, and web usage report.both are full of category Information Technology, most of it is MS office related and such. I have been asked to exclude that category, so the report is easier for management to read.I do not see anywhere to exclude categories, can someone point me in the right direction? 

Hello, We use two FortiGate 3700D (HA cluster) running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415.We run a FortiAuthenticator v4.00-build0019-20151007-patch00 We 'd like to upgrade all to last versions: FortiManager and FortiOS to v5.4, FortiAuthenticator to 4.1. These upgrades are validated for FortiManager and FortiOS.http://docs.fortinet.com/uploaded/files/2902/fortimanager-compatibility.pdf About FortiAuthenticator, the Release Notes v4.1 (last version) says:FortiAuthenticator™ 4.1 supports the following FortiOS versions: FortiOS v5.0 Patch Release 12 FortiOS v5.2 Patch Release 4 Other FortiOS versions may function correctly, but may not be supported by Fortinet.http://docs.fortinet.com/...c-release-notes-41.pdf Does someone try and run a FortiManager/FortiOS v5.4 with FortiAuthenticator to 4.1? Regards, Chris

Anyone here set this up? I have tried, get the authentication from Duo, but the 40Gate denies entry. Any hints or tips would be appreciated. Thanks in advance. Using SSL VPN connectivity through the firewall with LDAP authentication, by the way.Fortigate 800C HA Firmware Version v5.2.3,build670 (GA) 

Hi, "diag sys session list" shows this:    session info: proto=6 proto_state=01 duration=722 expire=28077 timeout=28800 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=3origin-shaper=reply-shaper=per_ip_shaper=ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/7state=log may_dirty npu synced none log-startstatistic(bytes/packets/allow_err): org=1031/6/1 reply=659/6/1 tuples=2orgin->sink: org pre->post, reply pre->post dev=31->41/41->31 gwy=192.168.x.x/192.168.y.yhook=pre dir=org act=noop 172.x.x.x:61697->192.x.x.x:1521(0.0.0.0:0)hook=post dir=reply act=noop 192.x.x.x:1521->172.x.x.x:61697(0.0.0.0:0)pos/(before,after) 0/(0,0), 0/(0,0)misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=4serial=00863f17 tos=ff/ff ips_view=0 app_list=0 app=0dd_type=0 dd_mode=0npu_state=0x003000npu info: flag=0x81/0x81, offload=8/8, ips_offload=0/0, epid=128/129, ipid=129/128, vlan=0x801e/0x801cvlifid=129/128, vtag_in=0x001e/0x001c in_npu=1/1, out_npu=1/1, fwd_en=0/0 Afte

Hi'llI'm using a fortigate 92D with the latest image 5.4 I connect my client's with the Forticlient using IPSEC.This all works I narrowed down in my rules who can connect and to what.But I want to allow only SMB (found that) and SQL traffic to a named instance on a SQL 2012 R2 server.As long as I use the All services rule it works but I would like to limit it to SMB and SQLWhich service and ports are we talking about ??Rene

Hi guys... I have one question. I need to know whether fortigate 60D got mac access filter or not?I have tried to search in system>network>interface>(please refer attachment)...but under dhcp setting, there is no option for mac acees filter. Thanks for help in advance

Hello everybody, I use CatTools for the automatic configuration backup for over fifty Fortigate 60D devices with the Firmware 5.2.2 and 5.2.4.I used the Device.Backup.RunningConfig activity, which connects to the devices via ssh and everything worked fine. However after upgrading most of the devices to Version v5.2.5,build0701 the backup doesn't work anymore. An upgrade to newest Version 5.4.0 also didn't help. I compared the new and the old configuration and also looked for some clues in the Release Notes but couldn't find any reason for this behaviour. CatTools always brings the "Failed to connect to 212.x.x.x. No Response from remote host. Will try again." error message. I would be very grateful if somebody has an idea on how to solve this issue. If you need any additional Information, I will provide it as fast as possible. Thanks in advance and best regards,brigadax

Hello guys, we should enforce TLS to a specifig Domain and verify a specific Certifikate. We have a mail from that Partner he gave us his TLS Certificate CN, TLS Certificate Issuer CA and a link to download the Root CA (its a public CA).  so we must now konfigure TLS for that Specific domain. It should be that way? goint to Access Policy > Delivery > create new > sender pattern * > recipinet patter "*domain of the partner > TLS Profile > Secure . But on this TLS Secure level profile are so many possible options + you have to import a CA first. So we should import that Root Public CA into FortiMail and then choose it there? What should we wright in Check CA Issuer? its a Verisign CA, will it be ok if we chosse "Contain" + "Verisign" ? Whats the Certificate Subject means? is that the Certificate CN? The Domain of our Partner? Did someone have already expierience with such setup?  Thank you 

Hi all,I'm very new on fortigate firewall.I'm configuring a FG100D, it's running in "interface mode" and I need to bridge 2 interfaces, so I created a virtual-switch: I tried both GUI and CLI, then I set an IP Address on the interface "Virtual-Switch".Testing with a ping, I can reach 2 devices connected to virtual-switch, but in "Routing->Monitor" there is not entry with the net assigned to VS, I also create some static routes and, of course, those routes are not in routing table. Software-switch works well. Do you have any suggestion? This my virtual-switch config: config system virtual-switch edit VS01 set physiscal-switch sw0 config port edit port 9 end edit port 10      

Hello, You have blocked zip and. EXE using DLP but I have a problem I can not even download from trusted sites such as Microsoft, please help to exclude these sites from the ban. We also need exception specific domain if Send us e-mail contains a zip attachments  thanks

Hello I was going to upgrade a 200B firewall this evening at one of our branch offices. Going from v4.3.12 to v5.2.6This is a single firewall that was at one time part of an active-passive HA pair.  The slave had been removed a while ago but The HA config on this FW, says that it is still MASTER and that HA Config is 'Active-Passive'.  I was concerned that if I applied an upgrade of the firmware and did a reboot, this could cause a possible failure or crash.  Could it have?  My main question:  How do I set the firewall to 'STANDALONE' without impacting the current config(attached)? Is it as simple as going into HA Config and changing the Mode from Active-Passive to Standalone and hitting OK? Of course my main concern is doing something improperly that brings down the firewall. Thanks!

Hi: I´m planing to implemente HA virtual clustering, and as far as i can read on the documentation, fortigate cluster uses a special set of mac addresses on the interfaces, i have an scenario where i need to specify a specific mac address on some interfaces, so, my mayor concern is about compatibility of this custom mac address with HA functionality, should it work? We are planning to use 2 x FG100D, 5.2.6, virtual clustering, 3 vdoms, we use just firewall, ipsec, and ssl vpn, and have implemented wan failover and balancing, all of this already working fine in a stand alone FG100D. It would be great to hear from your experiencies regarding this. Thanks in advance for any feedback on this  Victor 

Hi, how I can enable extended log of web filtering ?   I got Fortigate 60D (firmware 5.2.5)I enable webfilterI add webfillter monitor-all to interface But I do not have UTM under Log & Report :(I try google  and CLI# config dlp sensor  # edit [Name of Profil]  # set extended-utm-log [enable | disable]  # set dlp-log [enable | disable]  # set nac-quar-log [enable | disable]  # end   BUT : # config webfilter profile  # edit [Name of Profil]  # set extended-utm-log [enable | disable] I get error -61 after this command. :( Also I can't change profile under web filter in security profiles :( Please advise..  Thanks

Hello everyone, it's been a while since I've visited this place. I have a strange problem (or a couple of them.....) and I hope someone will be able to help me understand what's causing them. I have 3 Internet connections on a FGT-500D. Two ADSL lines are joined in a WAN Link Load Balancing (LLB) interface. This WAN LLB interface is my default static route to the Internet. The third Internet connection has a static IP, and I'm trying to use it as an VPN endpoint for dial-up VPN clients. The first issue I'm facing is that I cannot add another default static route (with different priority) when a static default route is already entered via WAN LLB. I get an error message "A duplicate entry is found". Two or more static default routes are usually possible to be entered, when there's no WAN LLB. I've tried correcting the problem with Policy Based Routing, but it's simply not working. Here's some IKE debug output (larger image:( Any ideas?

Hello All, Sorry if this obvious question but I need to double/triple check this:  Does the basic FG-600C part number provides IPSEC VPN capabilities? or Do I need a UTM bundle in order to create site to site IPSEC VPNs?   Thanks,     

Hello Unfortunately I have to say that the FortiCache software is disappointing. So far we discovered bugs with LACP, SSL Inspection, and FSSO. And caching does not work properly, the minimum thing that should be good at! If you are thinking of buying this appliance: please please do a proof of concept beforehand using the VM. Anyhow I would welcome other people’s views. Thanks,

Hello For HA heartbeat Fortinet documentation advises to use copper ports. E.g. dmz and wan2 http://docs-legacy.fortinet.com/cb/html/index.html#page/FOS_Cookbook/Install_advanced/cb_install-ha.html We only have fibre patch panels between the racks where the firewalls will be placed. We have Fortigates 2 x 600Cs Can anybody think on any reason why I should not use the fibre SFP ports for HA heartbeats?  Thanks,  

I have a 60d FortiGate integrated to my domain for internet authentication , every day 16:00 have to authenticate again for my browser with a User Network to regain internet. Anyone know tells me how to solve this problem ?

Good day! We are yet to deploy FortiAnalyzer 200D.It has v5.0.10-build0365 150129 (GA) firmware.I plan to upgrade the firmware.Do you have any suggestions on what is the most stable firmware version we should upgrade to?Preferably the firmware version which has the least reported issues other than v5.4. Thank you!