Solved

Hi Im having troubles configuring DDNS on my fortigate. My ISP is blocking dns for fortigates servers 208.91.112.53 and 208.91.112.53. Is there a way to configure DDNS with my ISPs dns server? Can i change the default port fortigates uses for dns? thanksCarlos

i swore i was able to do this before, but is there a way to block a device (or even better yet all mobile devices) on a certain SSID and only allow them on the other SSID?  foritnet 100d (5.4) with 4 FP221B-v5.4. we have our guest network (which i want the mobile deivces to use) and our network side SSID, which a few people seem to seem connect to since they know the password.  thanksbrian   

Hi, This is a recording of the first draft of the transparent mode module for FOS 5.2: https://www.brainshark.com/fortinet/vu?pi=zGJzT1BNYzJRhMz0 You are more than welcome to watch it and share your comments and feedback in the forum. Regards, Edy

Hello,We have fortigate 80C (FortiOS V5.0+) using User identity based policy and Created a Schedule timeout policy for accessing facebook and youtube in lunch time.The problem is after the scheduled timeout the active session will still be allowed facebook and youtube (not blocking) but new sessions is blocking. Any idea , how to fix this? Thanks,Asok

Hi All, At the moment we have a FortiWifi 80C (v1 variant with 512MB memory) now on 5.2.2 which works fine, but there are a few things with it that are quite annoying to us, in particular the loud, high pitched fan noise and the incapability of the WiFi part to operate at 2.4GHz and 5GHz simultaneously, so we're considering replacing it. Based on our traffic and other requirements the FortiWifi 60D looks like a contender, but from the data sheet it isn't clear if it can operate at both 2.4GHz and 5GHz simultaneously (something most $30 home routers can do). It's also not clear if this thing has a fan. Also, what is the difference between the various hardware rivisions? Are there even any revisions like on the 80C? Thanks, H.

Hi,Recently we have upgradedFortigate 200A Firewall from 4.2.2 to 4.3.18Fortianalyzer 1000B from 4.2.2 to 4.3.8 Before the upgradation, all reports are showing data and worked well in FAZ.After upgradation, I have noticed below issues1. No matching Log data (No Data) in all repots 2. Unnder Report-->Layout is not visible/available in GUI 3. Under Report-->Schedule is not visible/available in GUI When I do SQL Query test/run, I see below error ERROR: operator does not exist: timestamp without time zone >= integer. LINE 1: select ((case when itime_start >= 1458766800 and itime_end <... Logs are reaching to FAZ, since I can see real time traffic logs All Policies are enabled with "Log data" option In Fortigate Firewall, all logs are send option is enabled towards FAZ  I think it must be an issue with SQL database, but I am not sure how to fix it.Can any one of you help me to resolve this issue. 

Hi all, My fortigate 110C usually has high CPU problem. I checked the enviroment (temperature, fan...) all is ok. On fortigate, I configured many policy route, I think it is reason for this problem. so how many policy route entry Fortigare recommend to device can run well? anyone can advise me ? Thanks all!

Hello everyone, I want someone guide me to configure "Banned word check" in Emailfilter profile. Thanks  

i have tried to configure dnsbl , i want someone correct me if the below configure is ok or not:config spamfilter dnsbl Edit 1 set name "Dnsbl " config entriesEdit 1 set action reject set zen.spamhaus.org server set status enable nextEdit 2 set action reject set server dnsbl.spamhaus.org set status enable nextend thanks

I am using fortigate 200B with OS v5.2.4,build688 (GA).I have configured bword from the CLI, it works before the firmware upgrade.Unfortunately, I forgot which version of firmware can be working well.Anyone can help?Thanks.

Hello! I would like to make a automated backup for the fortimanager (400B OS 5.0.6). What solutions are there? Thanks for answers! kind regards - maximilian

Does anyone know if you can configure RADIUS groups for the FAZ? I can't seem to find any information on this in the admin guides or CLI. What I'm trying to do is have users loging to a RADIUS server (FortiAuthenticator in this instance) and from there be given role based access. For example if the user belongs in the 'admin' group they would be given full access, but if they're in the 'partners' group they would be given access to the report/fortiview. I'm going blind trying to figure this out! :)

Hi. Having strange problem. I created some SSL VPN accounts about a month ago. For some reason, I'm now unable to delete any of them. I can edit them. I can create new accounts and delete those new accounts, but anything I created a month ago cannot be deleted. Any ideas? Thanks in advance.

Hello, Having issues keeping a IPsec Site-to-Site tunnel up.. I am having FG60D device successfully connect to azure using FortiGate Cookbook - IPsec VPN to Microsoft Azure (5.2)   but tunnel got disconnect frequently in few hours and Had to reboot 60D always to get the tunnel bring up firmware version : V5.2.6, build711 phase 1 proposal : encryption AES 128 authentication SHA256encryption AES 256 authentication SHA256encryption AES 128 authentication SHA1encryption AES 256 authentication SHA1Diffie-Hellman group       : 2key lifetime                    : 56600 seconds  phase 2 proposal : encryption AES 128 authentication SMA1encryption AES 256 authentication SHA1encryption AES 128 authentication SHA256encryption AES 256 authentication SHA256 Replay detection

We have a Fortigate 600C. At the moment you can get to our Firewall admin page through https from the internet. What is the best way to lock down this access to only allow access from specific IP's? So, we would still like access to the admin page and to get logged in from the internet, but only from specific IP addresses.  Thanks in advance. New to Fortinet and need all the assistance I can get.  

In our Fortigate 100D we enabled IMPA and POP3 profiles, but need to make sure the antivirus is working as expected, for that how one can run an attack test ?

Couldn't find anything straightforward about disabling SSL v2 on Fortimail. Executed this command which seems to have helped:Config system global                Set strong-crypto enableEnd we are running v. 4 codeLet us know if there's a better way, or if this helps you. 

Hello all, I try to add our new FortiGate 200D to our monitoring. Unfortunately I got some confusing output when I did a "snmpwalk" to the firewall. Normally the physical ports 9,10, 12,14 and 15 should be "up". But when I do a snmpwalk on the "ifOperStatus" it is IF-MIB::ifOperStatus.1 = INTEGER: down(2)IF-MIB::ifOperStatus.2 = INTEGER: down(2)IF-MIB::ifOperStatus.3 = INTEGER: down(2)IF-MIB::ifOperStatus.4 = INTEGER: up(1)IF-MIB::ifOperStatus.5 = INTEGER: up(1)IF-MIB::ifOperStatus.6 = INTEGER: down(2)IF-MIB::ifOperStatus.7 = INTEGER: down(2)IF-MIB::ifOperStatus.8 = INTEGER: up(1)IF-MIB::ifOperStatus.9 = INTEGER: up(1)IF-MIB::ifOperStatus.10 = INTEGER: down(2)IF-MIB::ifOperStatus.11 = INTEGER: down(2)IF-MIB::ifOperStatus.12 = INTEGER: down(2)IF-MIB::ifOperStatus.13 = INTEGER: down(2)IF-MIB::ifOperStatus.14 = INTEGER: down(2)IF-MIB::ifOperStatus.15 = INTEGER: down(2)IF-MIB::ifOperStatus.16 = INTEGER: down(2)IF-MIB::ifOperStatus.17 = INTEGER: down(2)IF-MIB::ifOperStatus.18 = IN

I have a problem with instalation FortiClient version: 5.4.0.780. Windows 7 Professional x64. At the end of instalation i have a few errors and I can gothrough this http://zapodaj.net/63f68bd238067.jpg.html http://zapodaj.net/f8f3692fa84c5.jpg.html I have traied with restarting and F8 but i work only for a time I again restart my PC and then shows up recovery and delete whole FortiClient. Sorry for my English.

Hi, on Fortigate 100D ver 4.x we used a FSSO with FSSO Agent installed on Active Directory server with no trouble. After change firmware to 5.2 and FSSO Agent to 4.3.0159, users started complain about websites: sometimes websites opened and sometimes not. I decided to change SSO method to Polling. I configured everything with no luck. no users are shown in User & Device -> Monitor -> Firewall -> Show all FSSO Logons. The " diagnose debug authd fsso server-status" command shows only " Local FSSO Agent" !! which is not visible under User & Device -> Single Sign-On (I even deleted everything I created before): LDAP test: pass. When I add a SSO, the status is always grey X mark.

new release is available in the download portal...

Hello,I have successfully connected site to site IPsec connection to azure and everything working fine except the dns. I have my windows DNS server in Azure network So my client have to get dns query through IPsec tunnel I am confused configuring DNS in FG60D See the attached image for current config Please let me know how to configure DNS on FG60D to get query from azure vm. ThanksNihal     

Several people convinced me that the next platform I should learn is Fortinet's, so I just got a used FortiGate 90D. Amusingly enough, it still has support and contracts for a few more weeks, so I updated it to 5.4, build 1011. I can't seem to find a way to set up a VLAN that is tagged on one physical interface and untagged on another. On JunOS, I would do this: set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode trunk set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members userVlanset interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode accessset interfaces ge-0/0/1 unit 0 family ethernet-switching vlan userVlanset interfaces vlan unit 10 family inet address 192.168.10.1/24set vlans userVlan vlan-id 10 set vlans userVlan l3-interface vlan.10 That would tag the VLAN out port 0/0/0, not tag it out port 0/0/1, and the router would have a layer 3 interface on the VLAN that can be reached from either to act as the gateway for all traffic on

I have configured LACP link (2 port) on Cisco 3560 and FG310B, everything seem be fine, but when I put traffic on this LACP link, traffic just rided on one physical link, when I shutdown one port of LACP, traffic switch to another. It didn't load share!Do I have to config somthing futher on Fortigate ?

Hi there Specialists,I have a question regarding custom IPS rules. I've wrote multiple IPS custom rules to prevent locky infections. The rules contains a pretty common attachment name, but for now it's being used by the locky ransomware so we would like to block all the SMTP attachment containing the name we defined ( see rules ). The rules are:#SMTP F-SBID ( --name "ITCustom.Locky.SMTP.TCP.Feb21-1"; --protocol tcp; --ipver 4; --pattern "invoice*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "IT.Custom.Locky.SMTP.TCP.Feb21-2"; --protocol tcp; --ipver 4; --pattern "invoice_*-*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "ITk.Custom.Locky.SMTP.UDP.Feb21-1"; --protocol udp; --ipver 4; --pattern "incoice*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "IT.Custom.Locky.SMTP.UDP.Feb21-2"; --protocol udp; --ipver 4; --pattern "invoice_*-*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) #HTTPF-