Solved

Hi,see attachment for an overview of my scenario. Using Fortigate 92D on 5.4.1. Configuration was done via GUI. I have one WAN interface with multiple public IP addresses available and a DMZ with a few servers that all listen on 443, plus SSLVPN listen on the primary address (10.10.10.116). I configured 4 additional secondary IP addresses on the WAN interface (10.10.10.117 - 10.10.10.120). I created VIPs to map those addresses to the internal addresses of my servers, and inbound IPv4 policies to allow traffic on those VIPs. Everything is working so far as intended.  Now I'm trying configure outbound NAT for those servers, and this is where I'm not sure which configuration would be considered best practice. I would like that all outbound traffic of each server is NATed to the same IP address that is used for the inbound VIPs (10.10.10.117 - 10.10.10.120). [ul]I created 4 overload IP Pools (one for each external address)I created 4 IPv4 Policies DMZ -> WAN, from th

Dear all, on a Windows 10 machine Forticlient VPN sometimes works and sometimes get's stuck at 98%. The progress window stops at 98% and simply returns to the login screen. This is different from other posts. Since the Windows 10 machine is located at a remote spot, I cannot simply go there and try the not-always-working WAN port workarounds or reboot the machine. We always use the newest Forticlient installer. What to do? We run FortiOS 4.0.4 on a FG310B. Any help appriciated.

Hello, I am basically trying to create a report which will have the networks displayed in one column and beside that the values of who the maximum band width user is , the maximum session an so on will be there. The network which I am working on is a /22 network for which I am editing the data set so that I get reporting based on /22 subnets , select ip_subnet(`srcip`) as subnet, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and ( ( `srcip` <<=inet('10.22.64.0/22') OR `srcname` = '10.22.64.0/22'))  group by subnet having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc The Analyzer instead of taking the /22 subnet mask it is taking as /24 and giving me a report which obviously is not the one what I want. Would be great if someone could point

Hi, We have a Fortigate 600D and would use the two 10Gbit ports for connecting to our network. Over this two Ports (in link aggregation mode) i need to communicate with three VDOMs (VLAN-based). So my idea was to create the trunk in the root-vdom (named rootTrunk) and create an VLAN-Interface on this trunk (named Trunk_VLAN20).So i have create it and assigned an ip address to the interface Trunk_VLAN20 and (yeah!) can ping the IP from a Client in VLAN20. Now i would like to move the ip adress to the correct vdom behind the root-vdom by create a VDOM Link between root-vdom and vdom_1. Also i create a VLAN interface on npu0_vlink0 (port for root-vdom named vlink0_20) and a VLAN interface on npu0_vlink1 (Port for vdom_1 named vlink1_20).After this i assign the ip adress to virtual port vlink1_20. this was not possible to ping. Thus i think thats was a problem in root-vdom by a missing policy. Now i create a policy (in root-vdom) from Trunk_VLAN20 to vlink0_20

Hi guys, Not sure if anyone' s noticed, but it seems that Fortinet will be moving away from the FCNSA and FCNSP certification levels, and going towards an eight level ' NSE' cert. More details can be found here: http://www.fortinet.com/sites/default/files/basicfiles/NSE-Learning-Path.pdf To go-to the next certification level, you would need to hold all the previous ones. So to reach NSE-6 for example, you would need to be NSE-5 certified. The levels in a nutshell are: NSE-1: Completed FCNSA on-line material NSE-2: Passing FCNSA exam NSE-3: Achieving ' Silver' status on the Fortinet forums NSE-4: Passing FCNSP exam NSE-5: Attending FortiManager & FortiAnalyzer training and pass the exams NSE-6: Attending the FortiOS Troubleshooting course and pass the exam NSE-7: Achieving ' Gold' status on the Fortinet forums NSE-8: Pass an oral and practical exam (that has yet to be created) I personally think it' s a great idea and the courses/exams required are perhap

Hello everyone, i have installed for a rist time the EMS and we are now Testing 20 Workstations with a customer. i must say EMS seems to be very cool improvment in comparison to managing FortiClient from FortiGate. But we have one Big Issue now.  We activated Application Control and Also Exploit Protection. and now a lot of "good" and well known Applications like Veem, Outlook, TeamViewer, Apple Mobile Device Service etc. will be blocked as Exploit or P2P (Veem Backup for example) So the question is how can we override this Applications if they will be threated as Exploit??? Thank you very much.  

Hey, who is going first ?  Some small models like 40C are not support.Just have a quick look at release notes, there is a loooooot of know issues...

Is it possible to bind users to a specific IP with IPsec VPN?

Hi everyone, I have recently installed FortiClient 5.4 in a virtual machine running Windows 7 in order to connect to an external VPN. I have configured the settings of the connection (VPN-SSL), and I receive the email with the FortiToken correctly. However, once I try to log in using the six digit code, I always get the same error message (I'm from Spain, so this is more or less what it says): "Unable to connect to the VPN, VPN server may not be available (-8)". Also, in the logs I get the following message: "msg=SSLVPN tunnel connection failed (Error=-8)" At first, I thought that the origin of the problem was the server, but they have used my credentials from another network to check them, and apparently it worked. I don't use any antivirus program in the host, and Windows Firewall is completely disabled. Any leads of what could I do to solve the issue? Best regards

Hi all,I'm very new to this forum so I want to say hello to everyone first and I'd be very happy if I can get some help here :)We have 4 Sites, all connected to each other (mesh) via Site-to-Site IPsec VPN Tunnels. Everything works without problems except one thing:Let's say site B is using VoIP phone system over site A. In site A all phones are working without interruptions, but site B faces the issue of phones go offline and then reconnecting themselves. I monitored with the sniffing option and found that VoIP packets some-when just aren't transmitted for at least 40s. Usually it's running fine, they can do phone calls etc. but then irregularly packets aren't sent anymore.I've monitored the connection between the phone system (192.168.8.30) and one desk phone (192.168.12.50). In the attached picture you can see the packets which are transferred (left side is site A, right side is site B).For any help to find out more about this problem I'd be very happy as this is very annoying :(&nb

I am in this situation. I created IPsec SiteToSite  VPN  with FG60D v.5.2.9  and MikroTik Router. Tunnel is UP and hosts in routed subnet(FG 192.168.1.0/24 MikroTik 192.168.2.0/24) are reachable. Traffic is on. There is only one trouble. From FG60D (192.168.1.1) I am not able ping anything in MikroTik subnet. But from PC (192.168.1.2) in FG's lan ping works. From MikroTik Site all works perfectly. Only from Fortigate ping not response. What is default IP for traffic generated from fortigate(source IP) ?

I have an Action:DENY policy setup at the top of the ruleset for inbound traffic from WAN1 to DMZ. The source address for this policy is a group which consists of some geography-based networks and " bad addresses" that come up frequently in the IPS. However, this policy doesn' t ever seem to get matched and hosts I have explicitly added to the blacklist group--or even as their own entry--are matched against policies further down in the chain. I know this has to be something easy, but after staring at it for a couple of days I' m just not seeing it. Hopefully one of you fellows can see what I' m missing. This is on a FortiGate 80C running FortiOS 5.0.7 (build 3608). I' ve attached a screenshot of the rule set, but the relevant bits of code are here: config firewall address edit " all" next edit " outside.blacklist.121.139.0.0" set subnet 121.139.0.0 255.255.0.0 next edit " outside.blacklist.96.8.126.97" set subnet 96.8.126.0 25

I want to remote to a server on DMZ. Here is my scenario: As shown in the attached image, We have a fortigate 100D firewall which gets its internet from ADSL TP-link modem. There is also a valid IP set on the modem and the modem itself is connected to fortigate's WAN1 interface. The server which I want to remote to is located on DMZ. Please help me configuring and getting my scenario work properly.thank u 

I'm having trouble getting a custom app ctrl sig to work on 5.4.1. Basically i want to identify the use of a special type of browser, it's present in the user-agent field as 'Shield' and the header includes the unique field 'X-SHIELD-ID:'I've got an app ctrl sensor that passes everything and a custom override with the sig below set to monitor, however the log identifies the app as http.browser_ie , which it basically is.Can anyone see anything wrong in the syntax i've used, if not, is there another reason why this is getting logged at IE and not the custom sig? GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko; Shield X-SHIELD-ID: d0131c8c-fa23-4e74-9e1d-d6b8fa9489ed F-SBID( --name "Shielded_Browser"; --protocol tcp; --service HTTP; --flow from_client; --parsed_type HTTP_GET; --pattern "Shield"; --context header; --no_case; --app_cat 25; )

Multiple incoming static IPs @ WAN1, forwarding to specific servers. VIPs / VGroup / Port Forwarding set up (No NAT), and forwarding works internally using secondary IP (can connect to web server), but can't access from outside... times out. My experience with this is limited, so I am not prone to experiment too much.. ;) Read somewhere that specifying a secondary IP on the WAN1 interface should not be necessary, is that true? That's the only idea I have left, so if that's not it, maybe someone can point me in the right direction.. Thanks!CW Jones

I have FortiMAil 100c in Gateway mod with Exchange2007. How to block or is there some option to limit wrong SMTP auth for mail accounts on fortimail ?

I was pointed to http://docs.fortinet.com/uploaded/files/2041/using-a-custom-certificate-for-SSL-inspection.pdf by support when I asked about using cert for ssl inspection. Are these instructions only meant for someone who has an internal CA that is trusted by clients? It seems that no Public SSL CA company would grant this type of cert. If that is the case the directions don't really say that. I am just trying to do web filtering of my clients and was hoping to not have to install cert on them. Also how does it work with web filtering on guest network / byod where you can't install cert on client machines?

I am prepping a new Fortigate 240 running 5.2.9 to be installed. I have two WAN links. One is primary incoming with public IP and outgoing web. The second is mostly for VOIP and redundancy. I setup a WLLB with the two interfaces. I am now trying to setup policies. I have 1-2 rules that I want to do source (IP / domain) filtering on with Virtual IP NAT to internal server from WAN1. In the address object setup you cannot choose interface wan-load-balance only wan1 / wan2 or any. I know the traffic will come in WAN1 since that is where public IP is. Then when I create policy I must choose incoming interface of wan-load-balance since wan1 / wan2 aren't available in drop down. When I do this however it removes the address I created for wan1 from the drop down list of source addresses? Since I am using WWLB with the two wan interfaces do I need to choose any as interface for address object? Is there something I am missing here? I just want to make sure I am load balancing outg

Hello there, I`ve upgraded our FGT60C from Firmware v5.2.7 to v5.2.8. Now in ssl-vpn-portal rdp-native doesn`t work anymore. There comes the message "Failed to launch rdp-native" Java is installed correct and works. SMB-access to shares works as well. Has anybody the same experience? Thanks for comments. Nik

Hi all We have a site with a FG 60D with a few FP221c'sThe FGT is running version 5.4.1 build 5447 Users are complaining that they are having intermittent wireless connectivity issues.They noted the following The wireless remains connected, but access to the internet and internal resources is lost and later returns. They verified that when connected to the wired network they are not having any issues.This could happen several times a week. Anyone experience this issue ? Thanksggntt

I have a vpn config with forticlient... days ago worked well but today not. I review the events in the fortinet but does not tell me much. When the client tries to connect it reaches 98% and closes the application can you help with any idea?attachment the print screen

Hi! I uninstall Forticlient 5.4 on Windows 8.1, during uninstall it notice what services are running and I need to restart my PC.After I accepted Forticlient uninstall correctly but after restart ALL my network devices failed to start (code 10). WTF?  

All: We are trying to get an estimate of daily syslog log volume in GB with all logging options enabled on the 3700D for roughly a 500mbps throughput.  Could someone give us a rough estimate?  We realize there are many variables but are just looking for an estimate to make a comparison. Thanks!

I am working with a new client who's user community is big. When I am try to generate log for 1 day the log report has only 10,000 entries in it. But it would definitely have more than that. Is there any way to increase it ?. It would be great if someone could help me on that. 

Just acquired a Fortigate 70D and setting it up for the first time. Have not configured anything as complicated or powerful as this firewall before. Tablo is a device for capturing over-the-air TV broadcasts and streaming them to your viewing devices. It requires some port forwarding when you want to reach the device from outside. Specifically, it requires port 21101->8887 and 21100->80. I have tried to configure this on our Fortigate 70D but the device still says it is not properly configured. Here are all the sections of the config that pertain to the Tablo device. Please help me find where I have done something incorrect (or made it more complicated than it needs to be)! config system dhcp server     edit 1         config reserved-address             edit 1                 set ip