Solved

Hello all,I have trouble with FC 5.4.0.0780 on Win 7. When I'm trying to connect to FG I'm getting the following warning, and it stuck at 40% :"Unable to establish the VPN connection. The VPN server may be unreachable. (-5)" Does anyone have the similar issue ? Thank you in advance.

Hello, I have a fortianalyzer on version 5.2.7. I'd like to see what the top services (https, smtp, ftp, etc) are every hour over the course of a day, and how much bandwidth each is using per hour. Is there a custom dataset, or might someone help me create one, which will allow me to view the top 5 or so applications / services in use broken down by bandwidth and hour of day?  Thanks for any help.

Hello all,I am running firmware 5.2.8 what the benefit and impact of enable "heuristic quarantine" in Antivirus profile?What do I need to do it? Thanks

Hey folks. Newbie here. I'm not a networking person (more software pm and technical sales), so please excuse my ignorance on the subject. Our IT consultancy says that we should considering purchasing new firewall appliances to replace our 60D models; the organization has grown over the past few years, but not astronomically. My understanding from networking friends is that problems are often more related to software license limits than CPU. Its justification is that mobile device traffic isn't being covered (they say our firewalls couldn't handle the extra coverage) and that we're 'on the edge' of normal operation. We see no evidence that they're operating "on the edge". What are the signs we should look for that will tell us we do need a new firewall and how can we monitor that and be alerted when it happens? Thank you. -d 

I manage 7 separate sites servicing around 10,000 users in total with internet services through WiFi enabled equipment using Fortinet and Fortigate devices at each site. 9,996 users seem quite happy with the service, but 4 of them have reported an error when connecting to what I assume is the Authenticator, as the error comes up with the captive portal login option - the error reads 'Error (EBNCaptivePortalHandler) Unknown Error' (screenshot attached). The users are able to 'OK' the error and login successfully. The devices are iOS 9 and 10 (happened on both versions) to this small user group. These users have logged in successfully at other sites, without the error, so its just on this one site that they get this error. I have raised this with the service provider (we pay for this internet/WiFi service to be installed and managed for us) but since it is not all users at all sites, they argue that it is a personal handset issue not a system/infrastructure issue. Any thoughts

Hello, a customer asked me if it is possible to block / deny senders which have numbers in their email adresses like (mike445@example.com) . is it possible to build like a regex for that? is it possible to say if Sender has more than 2 Numbers or more than 3 numbers in his email adress? Thank you very much

Our new Fortimail appliance (400) refuses the typical https://192.168.0.99 admin login on port 1 SSH admin works fine. We have tried all major web browsers.We executed a factory reset.Yes, password is blank.Yes, "admin" Any suggestions????  

Hello, Is anyone running 0.0.0.0/0.0.0.0 as the source and destination for a P2 selector? I have a growing list of about 30 P2's that would be much easier to manage if it were just the one wildcard entry. I would still be controlling the traffic on my policies. Any pros/cons to doing it this way? The unit on the other side of the tunnel is a Fortigate as well.   Thanks

Hello everyone, I'm a newcomer. I come from a sonicwall tz205! I'd need some tips for setting up a new fortigate 100d... :)I will explain briefly the situation. I always had a very simple network. Now at work I have created a new network for voip phones. At the moment so I have two physical networks. 1 for PC in 192.168.1.0/24 2 for voip phone 192.168.3.0/24 I had the interfaces on sonicwall x0 x1 x2 ... on the new fortigate 100d I do not have that kind of division.I currently have 16 port switch hardware dedicated to the "LAN" with the address 192.168.1.0/24. How can I bind a port for the VoIP network? I neet to create a new interface ? zone ? vlan ? The other thing that I must say is that I wish the two networks were able to communicate.I did several tests but I can not do a ping from one network to another. Thank you all!

The fortigate 5.x documentation states that when you create a virtual IP address (VIP) and do NOT specify port mapping, that traffic should be translated for both inbound (dnat) and outbound (snat) traffic. If says: " if you leave the ' port forwarding' checkbox unchecked it is therefore mapping all ports, it will do bi-directional NAting, so the single VIP entry will control both inbound and outbound address translation." Overall this seems like a very good thing for reducing the complexity of configuration for standard internet-accessible servers. However, we' re finding that this doesn' t seem to work unless you issue " set nat-source-vip enable" from the CLI for every VIP (it defaults to disable). By default, outbound traffic just falls through to the general nat pool that we have set up for all other clients. Is this the expected behavior? If so, I can' t see how the reference manual is correct. If this is needed, is there a way to change the

Hello, I would like to ask some advise and recommendations as well with our Site-to-Site IPSEC VPN.Below are the scenarios. Please refer on the attached diagram. We have an existing Site-to-Site IPSEC which is Site A going to Site C. Since we are expanding our site, we are creating a new site which is site B. The problem is, it has the same IP segment, 192.168.18.xx. [strike]Also, our main goal is to be able to communicate site A and site B without changing the IP Networks on both sites. Meaning, we will use 192.168.18.xxx on both sites. Is it possible?[/strike] Already achieved this goal. Next, let's say we were able to achieve our main goal above. [strike]Our next goal is to be able to communicate site B to site C without changing configurations on site A to site C which is our existing site-to-site IPSEC.[/strike] Mission complete. :D  Thank You.

Hello, I'm currently building a site-to-site IPSEC VPN but I would like to know if its possible to use a private IP (10.10.10.0/30) network. Below is my current configuration. Firewall A:Port 10: 10.10.10.1/32 Firewall B: Port 9: 10.10.10.2/32 Both port interface is connected using a cross-cable. Problem: I tried to create an IPSEC - Phase 1 but the tunnel is still down. Thank You

I'm pretty new to setting firewall policies and I'm not sure if I'm looking in the right places to solve this problem. I have the below configs in my Fortigate 90D. For policy 6 I defined a group of schedules to cover all after-hour periods. However no one can access the internet on weekends. They can ping as far as the firewall, but not any external addresses. My question is, did I set the schedules correctly? Everything else appears to work fine, including "morning hours" and "evening hours". # show firewall policyconfig firewall policy    edit 1        set srcintf "internal"        set dstintf "wan"        set srcaddr "all"        set dstaddr "all"        set action accept        set schedule "working hours"        set ser

Hello everyone, i want to allow access to only one facebook page and block other pages...i've been looking for a solution but nothing worked, is there any way that i can do this. Im using URL filter.Fortigat 80D v5.2.7,build718 (GA) thank you for your answers 

Hi, I have a VPN between 2 Fortigate and I notice a strange behaviour : Some machines on one network can ping machines on the other side of the VPN while others can't.Checking in Fortiview / sessions, I discovered that some of them correctly execute the ping through the VPN while the other are trying to connect through WAN (and so it doesn't work). I configured policies for traffic going from and to the other side of VPN, and route to remote network using the corresponding vpn interface. In attachment is an example of what happens. My local network is 10.1.0.0/16 and the remote network is 192.168.0.0/16. Do you have any idea on how to solve this problem ? THank you very much, Regards, Fred

Hi all,I have a Fortigate 90D with Web filter and SSL Inspection enabled. I can't reach https://www.giustizia.it: with Chrome I receive "ERR_CONNECTION_CLOSED", with Firefox instead "Cannot create secure connection". If I turn off SSL Inspection I can navigate to the site; I have tried to add an exception in web filter's rules (wildcard, simple, exempt, allow...) but with no luck. How I can solve this issue?Thanks in advance

Anybody seen any cool tools that will grab fwpolicies and dump them into a format to import into xls, or csv or any other method?

Hi, I'm trying to configure webmail access for end users, to allow quarantine access.I have set gateway mode.LDAP profile works good, it means I can browse LDAP tree and LDAP Query Test (Authentication) works for me too (test result = Bind successful).When I try to login to webmail I get login failed message.Event log shows only that webmail login was failed, no more details.I'm not sure if FM even tries to authenticate webmail user by LDAP.Perhaps something is missing in my configuration, I looked inside AntiSpam/Quarantine Settings for allow end user access settings, but I found nothing like that.What is missing in my config? Regards, Piotr M. 

Hello all, I've recently implemented a number of FG-100s and FG-300s and am trying to move my web filtering service over to these devices. We require that all web traffic be tracked back to the user and so I'm also trying to implement the FSSO service to provide a seamless browsing service to my users. This has worked well so far for windows systems but has proven troublesome for Mac systems. Mac logons do usually show up in the FSSO user list but the "system name" column shows their IP addresses instead of their system name. Web browsing in this situation, to put it succinctly, does not work for the Macs.  Does anyone else successfully use Mac systems with the FSSO service, and if so then what's the trick to getting them to play nicely together? I should mention that we are using the FSSO polling mode recommended by Fortinet to work with Mac systems. Thanks for any help!

I have a FG 800C that was working fineI Backup my configuration, edit it and restore itnow I cannot login to the unit,every try resolve i wrong user and passwordI Try to Login using Fortiexplorer with user "maintainer" to recover my password.I can login, but when trying to reset password i get this massage: FG800C # config system adminFG800C (admin) # edit admin 'maintainer' account can only edit existing admins. node_check_object fail! for name adminvalue parse error before 'admin' Command fail. Return code -37 It seems like there is no user name "admin"is there any way to recover the user? or even restore everything to default? 

Hi, I was wondering how disruptive it is to enable vCluster2 on a production Fortigate installation which is already up and running. Does it affect the existing traffic in any way? Cheers!Emil

I've got a couple of 60C's in HA running 5.0.4.  I tried to log in to the web interface today and it logs me in and loads the top toolbar and sits there with two empty frames for a while before it finally returns a "Error 500: Internal Server Error" in the left frame.  I've tried killing all the httpsd processes but it hasn't made a difference.  A diag debug on the web-ui shows the following when the error shows in the web interface:-[httpsd 27319] http_config.c[573] ap_invoke_handler -- handler 'fastcgi-script' completed (result==500)[httpsd 27319] http_request.c[1443] ap_internal_redirect -- internal redirect to '/p/pubredir/httperror/' Trying to avoid rebooting the firewall at all costs.  I've considered a forced failover to the secondary device but want to exhaust any other possible options before going down that road, and I'm not sure it will fix it anyway.   The web interface was working fine a day or two ago and nothing has changed since then.

 What is the CLI cmd to determine the transceivers installed in a fgt?

In the latest MacOS Seirra beta 5- FortiClient breaks!I'm running version 5.2.3.370. The screen shows empty content, no buttons or text. Any ideas? 

Hello i want to ask,yesterday user in my office cannot browse to internet and use VPN  connection, after i check in my fortigate dashboardantivirus , IPS UTM is unlicensed but i have subscription until 2019, after i check to my policy and routing nothing wrong with my seeting , after that i refresh a browser an antivirus and IPS is licensed again and user in my office can browse to internet again,i dont  know what my problem is, can anyone answer me why subsciption in my fortigate suddenly unlicensed ? please help me.