Solved

Hi Folks, I have 2 WAN connections which I currently use routing policies to send traffic out, I would like to know if it is possible to cascade/overflow traffic from WAN1 to WAN2 when a certain bandwidth is exceeded, for example: WAN1 hits 10Mbs usage and I would like the "excess" traffic to then use WAN2 until the load is reduced on WAN1 at which point WAN1 should be used again. I have come across a number of FG docs which allude to the fact this may be possible but if anyone could point me in the right direction I would be grateful. ThanksEddie

Hello, I have to deploy an explicit proxy architecture for a customer and we want to use authentication on it. Main mode will be FSSO, no issue with that. But if Fortigate doesn't identify a user by FSSO standard mode, we want to try by using NTLM. Is it possible ? I was thinking of this kind of configuration : set active-auth-method ntlm set sso-auth-method fssoBut is the active method used only when the connection with the agent is broken or also as a fallback when the agent just doesn't find anything in the AD ?  Thanks in advance. Best regards, François 

Hi, We currently have a Single Sign-On Agent installed on 1 DC, which is configured to monitor all DC's. All works fine until a users switches from wired Ethernet to Wifi, they are no longer able to browse the internet. To solve this, they would need to lock the laptop and log-in again to windows.  In the "Show Logon Users" the user will be listed with "wired" IP address and not Wifi IP.  I have tried reducing the "Workstation verify interval" to 1 minutes and the "IP address change verify interval" to 10 seconds but this did not solve the problem.   Firmware: v5.2.7,build718 on 300D

Setup = 2 X FortiGate 100D Hardware Appliances (Active Passive) v5.2.8, build 727. NAT Mode.Hi all,We are experiencing a strange situation here and I was wondering if anyone had experienced something similar.We are seeing entries in traffic logs which indicate DNS requests being made to the online FortiNet DNS Servers (208.91.112.53 & 208.91.112.52) from network clients. Nothing unusual there, but the Application Name being returned in the log entries is not DNS as expected but, WhatsApp & WhatsApp_File.Transfer.  Has anyone any suggestion as to why these DNS requests are being mis-classified in this way? Many thanks, John P 

Hi guys, currently I'm hanging at a really bad issue.I configured SSL VPN Portal at a FWF 60D, but the Portal is unreachable at all.Not from External, not from internal. Setup:Internal LAN --> FWF 60D --> Transfer-Network --> VDSL Router --> WANClient --> WAN --> VDSL Router (Port Forward 8443 to FWF) --> FWF 60D --> LAN Try to reach SSL VPN Portal from Internal at the Transfer Network Interface of FWF (not possible)Try to reach SSL VPN Portal from External WAN over VSDL Router (not possible) Diag Debug Application sslvpn --> no connectionI know, its an easy thing, but I stuck at the moment... No further ideas...

I currently have  2 vdoms setup. I have not been able to configure both vdoms with the same wan port. Is this possible? The reason I am trying to approach it this way as opposed to having  separate external interfaces for each vdom is because i want to setup wan failover to cover both vdoms.

Hello, I have the following dataset which returns the bandwidth and browsetime of users who visit social media websites.This report works perfectly when I run the 'test' feature within the dataset, however as soon as I place it in to a report, the output results are distorted i.e. browsetimes should as only 1 or 2 seconds.Can anyone confirm if this dataset is structured correctly (even though it does work via 'test' in the dataset panel). Dataset attached to this post.

Hello everyone. I would like to ask, if i can change the language of the reporting to german manually.The language is currently not available on the Fortianalyzer.I can translate the chart-title to german. But i cant change some fields on the topsheet, like data range, report date or table of content.I know it's just a detail, but some customers ask us, if we are able to change that. Thanks for any help.   

I have an FGT60D running DHCP on the Internal interface serving IP addresses to about 120 clients. Every few weeks someone using Windows will report to me that they are seeing a pop-up message that they have an IP address conflict. This happened this morning to a Windows 7 client. Running ipconfig shows the client has an address of 192.168.1.136 and does not change, however, the Fortigate system log shows that they are requesting a new IP address about every 10 seconds. The log shows the following events:[ol]DHCP client sends a DHCPDISCOVERDHCP server sends a DHCPOFFER and offers a leaseDHCP client sends a DHCPREQUEST and requests for the given leaseDHCP client accepts the given lease and sends a DHCPACKDHCP client detects an IP conflict with the given lease and sends a DHCPDECLINE[/ol]On the client system I've tried a release/renew, as well as deleting the network adapter from the device manager and rebooting, allowing the network adapter to be auto-installed on system boot. Neither o

Hello all! We are currently testing FortiClient as we want to switch over to it as our main AV and VPN client solution. Our plan is to push out the initial client through SCCM to all of our endpoints and then use EMS to manage them. I noticed that the users will get prompted when pushing a FortiClient upgrade (say v5.4.1 to 5.4.2)  from EMS, since they have to reboot. Is there an option for a completely silent upgrade through EMS?  Any help is appreciated. Thanks!

I've upgraded our Fortimail to 5.3.5. We have a valid Fortisandbox.Cloud Contract - now with 5.3.5 we can only send 100 Samples per day!! Level 1 Support says that this is per design! So be carefull when upgrading!! On the Dashboard:"Legacy FortiSandbox cloud service is used. Please activate FortiCloud as soon as possible!"

Greetings to youDearsOur management care about security and nowdays new virus Shamoon malware is diffuseMy Question Is Forticlient AV can prevent this Virus Samoon malware ? yes or no ? as we do update always

Hello, We use FortiGate 3700D running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415. One of our Fortigate gave us several failure (5 times during while 3 last months) about "Optional power supply not detected".We've check all power plug and all looks good.Do you know if this failure detection or this alert message could be a or a known error from this FortiOS version? Regards, Chris 

Hello,Does FortiGate VMX support integration with Openstack orchestrator?ThanksAndreas

Hi,   Recently we have upgraded our 800C to FortiOs 5.4.1 but as soon as the unit reboots some web rating overrides urls stop working, so, in the GUI we can see them, but it doesn't work until we run in the CLI the "set rating" command. It has happened every time the unit reboots. Any suggestion about how to proceed ? Regards.

I have noticed that in some of my logs, the DNS hostname field for external IP addresses has an entry of ChangeMe. For the firewall DNS settings I have one of my internal DNS servers and then one of googles open DNS servers. Anyone seen this before?

Hi all, is there any way to create new firewall policy via 'config firewall policy' without having to specify a policy id; i.e., let it just take the next available number?  I'm trying to either mass clone or mass create new rules to break multi-interface rules into individual rules so 'interface pair view' becomes usable again in the web interface.  Doing this while having to come up with unique numbers for each clone or edit command is a nightmare.

Hello, we are experiencing an issue with a multi site VPN setup. The central office has a Digium PBX and Digium VoIP Phones are deployed throughout the company. We are quite frequently experiencing issues where our traffic drops and the VoIP Phones at the remote locations are unable to reconnect. The cause of the drops appears to be our Comcast Cable internet connection. It cuts out for a short period of time, maybe 30 seconds or less. Once the VPN tunnel is restored, all traffic can resume as normal (we have RDP Traffic back to the central office as well), but some of the phones will not reconnect. Not all phones. Even rebooting the phones has no effect. The only thing that helps these phones is either waiting maybe 20-30 minutes or more, or to reboot the Firewall at that particular remote location.   Does this sound like anything anyone has come across before? I have a ticket open with FortiNet support, I'm waiting to coordinate getting a packet capture at th

Hi Guys, I am new in Fortigate firewall, is there way to monitor the bandwidth from the settings of the firewall or a software that you can suggest? Thank you guys. 

Hello all, Recently I started to use FortiClient for SSL VPN Connection.Yesterday I tried to install the version 5.4.1 on a XP Client but I'm getting the error attached. I'm using a Forti Client Online Installation tool and basically after that the image download finish this pop-up is shown: "The digital signature on the installer package is invalid. Installation aborted."  In internet I found this solution:- From Internet Options- Select the “Advanced” tab.- Scroll down to the Security section and check the box next to “Allow software to run or install even if the signature is invalid.” This didn't solve..  So I checked for a same issue in this forum but actually I'm not still able to solve. I tried to follow the resolution suggested in this topic:Unable to install FortiClient 5.4 on Windows 7 SP1 x64  The solution is to upgrade windows to the kb3033929, but of course no new kb are available for Win XP. Can you help me t

I'm looking to find out how many concurrent site to site vpn connections can be handled by a FortiGate 100D.  It would be acting as a vpn concentrator The current WAN connection is 100Mb. Each connection would be using on average 1Mb/s.  Is there a hardware or software limitation on the number of connections?The WAN speed can be increased if needed. Thanks!

Heyoo, We have a stock "full-access" portal we use that enables split tunneling. We have a single user that has an application on her laptop that much appear to come from within our network in order to work. All I am trying to do is create another portal, just for her, that disables split tunneling. Portal is created..no problem.I create a new SSL VPN firewall policy specifying the user and info and authentication rule specifying the SSL portal to use and I am unable to save it without error about range not valid... Is this the correct procedure to do this? I'm following the cookbook for 5.0.7 and I thought it was pretty staightforward but I guess not. All I want is a second portal for a single user that doesn't use split tunneling. Thanks!

Hello!We are running EMS 1.0.1.0077 with client versions 5.4.1.0840 and 5.4.1.0860. I've noticed that unless a user is logged in, all of the machines show as offline, which includes our servers. Does anyone know if this is a known bug or a configuration change that I can make on either the hosts, EMS server or within the forticlient configuration? We have AV, Webfilter and vulnerability enabled for servers and will soon add the application firewall. We also have the EMS server communicating with our Fortianalyzer.

Hello I'm new to the forum and also to Fortinet products. I've a customer that have a  request that i couldn't find an answer online. our scenario:  In our network the lan interfaces are lan and lan2 and the ip is 172.16.x.x, wan port is our internet My customer want when he telnet to 10.0.0.x the packet will get to fortigate and the destination ip will change from 10.0.0.x to legal ip on the internet 34.x.x.x and also the source ip change with NAT. I've tried many things and the last one was using VIP and configure the incoming interface as lan and have a policy from lan to wan where the source ip is 172.16.0.0 and destination is 10.0.0.x. we have 100D, ver 5.2.8 Does anyone knows if this is possible and how to accomplish this? Thanks  

Hi! I'm using FG600D Firmware Version 5.2.9 and using VDOMs.According to this KB, this can be achieved creating an LDAP server and then configuring the administrator making the ldap server and the administrator in the same group.It seems that the ldap server cannot be configured in the global section, this can only be done in VDOMs. Is this correct? Is there any way to authenticate global administrators against an LDAP server? Many thanks in advanceEnrico