Solved

Hi all good news for everyone which uses SSL Offloading with Virtual Server. FortiOS 5.2.8 is supporting new TLS 1.2 which was until now not the case and which is only the case under FortiOS 5.4 All devices which are able to use SSL Offloading (consult software matrix) have under FortiOS 5.2.8 this possibility.# get system status | grep VersionVersion: FortiGate-300D v5.2.8,build0727,160629 (GA) # config firewall vip(vip) # edit testnew entry 'test' added(test) # set type server-load-balance(test) # set server-type https(test) # set ssl-min-versionssl-3.0 SSL 3.0.tls-1.0 TLS 1.0.tls-1.1 TLS 1.1.tls-1.2 TLS 1.2. hope this helps have fun Andrea

Will the FG-TRAN-GC (1000baseTX) SFP work in the SFP+ port of an 800C?   I can do this with Cisco SFP+ ports.  They will take any 1Gig or 10Gig SFP. You may be asking why.  Why use the SFP+ port when you have 4 other SFP 1Gig ports available.  I have 2 Fortigate 800C devices in HA.  One 800C is at the main site and the other is connected at the DR site.  HA runs over a 1Gig dedicated fiber.  The switch at the main site can utilize 10Gig, but the switch at the DR site does not have 10Gig ports.   Thanks

Hi there, I want to know what does the Message " replay packet(allow_err), drop" exactly mean? I have a problem with updating my branch offices Antiviruses which are connected to head office through fortigate 400A. In the section of log access of fortianalyzer,deny logs for antivirus update, all have replay packet(allow_err), drop message. all the policy and network configurations are correct. thank you for the help.

Hi, at first a happy new year to all. I have a Problem when i enable ssl deep-Inspection and surfing through the Web. I noticed that some sites loading only if i reload the site twice. Sometimes but not often I get a "ssl_error_bad_mac_read" error in Firefox. It also went gone when I reload the site. It is relative often reproducible when I am surfing through the fortinet forum. I am using the build in fortinet proxy certificate which CA is certainly imported in the browser under trusted ca authorities I have checked this with some other browsers and on other machines to rule out that it is a browser/machine problem only. The goal why i have enabled deep inspection is to use antivirus in https. Allow Invalid SSL Certificates and Log Invalid Certificates are both enabled but I get no errors. Like I said it is not on all sites but when I noticed that and loading process was too long then I reload the site and now it comes up. Then I figured out when deep-inspection is turned off th

After Update of OS to 5.4.1 the Fotigate(800C) won't register forticlients anymore. Error message from Forticlient:  Forticlient is actively blocking this forticlient form registering. Endpoint Event: FortiClient registration failed due to version too low. VPN provision seams also to be lost from endpoint controll as wel. This is an very bad issue regarded to the fact that our company has lost endpoint control of several hundred client's. Best RegardTrond-Ove

Since implementing a Fortigate 60D with 5.2.3 a few weeks ago the system log shows an hourly entry reporting numbers of files dropped by quard (I've attached an example screenshot).The entry provides no real information as to the cause, and I'm struggling to locate information online that indicates whether we should be concerned about this.I've found reference to the quarantine daemon in the CLI manual and methods of debugging however I can't determine what options are available to use with the diag test application quarantined command and am concerned about running such commands blind in a production environment.  Can anyone offer some advice on the following:1. How can I determine the reason for this behaviour?2. Should I be concerned about this, or is it typical? TIA

Does FortiOS 5.4 has functionality to redirect HTTPS traffic to ICAP server?Hello, We have currently Forrtigate VM64 v5.2.5,build701, configured ICAP for redirect http/https traffic to ICAP server (DLP acts as ICAP serrver) HTTP traffic redirecting succsessfully to ICAP server. But HTTPS traffic is not redirecting to ICAP server. (configured ssl-inspection and enabled it on policy) I think v5.2.5,build701 does not support redirecting HTTPS traffic via ICAP The question is: Does new FortiOS 5.4 has functionality to redirect HTTPS traffic to ICAP server? Thanks

So I'd like to get some clarification please if what I believe I'm seeing is correct. I'm trying to configure RADIUS authentication with on a Cisco SG500X switch using the FortiAuthenticator for Radius. The "Small Business" Cisco switches don't have a full version of IOS running on them, but I have this working where a member of a Remote LDAP group on the FA logins into the switch SSH it will log them in with priv lvl 1. What I want is to boost this to priv lvl 15, and on a normal IOS switch you would return Cisco-Av-Pair = priv-lvl-15 Radius attribute. I have attempted to configure this attribute, along with Service-Type = Administrative-User against my Remote LDAP group, but a packet capture shows that the FA is not sending the Radius attributes at all in its Access-Accept packet. My question is, is this because the FA is looking for a Vendor-Specfic(26) of Cisco as opposed to CiscoSystems in the Access-Request packet? See AVP from Wireshark: Access-Request:RADIUS Prot

Hello all, I am seeking some advice. I have two different clients with dual WAN setups and I believe that I am running the redundancy incorrectly. I have essentially the same question for both setups so I will just describe one. I have 2 Fortigate 40Cs setup in HA with WAN1 running off of a DSL connection and WAN2 going through our VOIP internet connection (also DSL, but separate from the main connection). I have the priority and distance set higher for WAN2 and everything seemed to work well. Although I must admit I didn't really believe that the setup was complete. The failover from WAN1 to WAN2 works perfectly if the WAN1 modem was powered down or physically disconnected from WAN1. In this case all traffic would be routed through WAN2. When WAN1 would come back up everything would route through WAN1. The issue I ran into which I'm sure most of you probably already see is that if the internet for WAN1 died, without the device going down or being removed (ie, if I were

Hello,need to upgrade from 5.0.11 to 5.2.6 fortigate 800C active/passive. If something goes wrong I know it is possible to boot from the partition where I still have 5.0.11. Is that correct and how to eventually achieve it ?

We have a email server that get over 10k hits of authentication failure error as the bots tries to login with random passwords everyday. The trend we notice on Fortigate is that these attacking source IPs will hit very high number of sessions. Is there a way to automate Fortigate to automatically block these source IPs from WAN1 to Port1 when their sessions reach a preset number?

Using FortiMail 200D, Firmware version: 5.3.1 I've activated the next checks in the Session ProfileBut I'd like to permit some known senders to bypass it.I have tried, without result:[ul]Activate "Enable sender safelist checking" in Session Policy and add the addressesAdd the address in AntiSpam > Domain >  Safe List Add an entry in Policy > Access Control with Action=Safe:[ul]Sender Pattern: *@mail.telcel.comRecipient Pattern: *@mydomain.comSender IP: TheirIP/32Reverse DNS: -/*Auth Status: AnyAction: Safe[/ul][/ul]However I still see the rejected mail in the log: AntiSpam Log:Message: Invalid ehlo/helo domain. ( xiang.telcel.com ) Client: mail.telcel.com [200.38.208.219] History Log:Classifier: Session Domain Disposition: Reject Event Log:Message Milter: from=<someaddr@mail.telcel.com>, reject=550 5.5.0 Invalid EHLO/HELO domain So, where should I put the address for not be rejected? Thanks in advance.Roberto.

   Hi, i cant get access by https GUI administration, but i can by http. i try with many browsers. Maybe is and SSL error with the certificate, i dont know.  I check the access configuration:#config sys int    edit "port2"        set vdom "root"        set allowaccess ping https ssh http fgfm        set type physical        set alias "Inside"        set snmp-index 2#config sys admin    edit "sgermano"        set remote-auth disable        set peer-auth disable        set trusthost1 0.0.0.0 0.0.0.0Thanks!!

One of the factors in the original ordering of the 60D was that model still had local disk for logging, as this small business does not have a syslog server or similar.Now forticloud free with 1GB storage was being used for logging and as the 60D firmware upgraded disabled more and more utilization of the flashdrive - well at least we had Forticloud. Then without warning Forticloud changed from 1GB to 7 days -- and suddenly a bunch of log history was lost. And now the firewall is toast as well.We still have the support and services bundle through 2018 but now I have to decide: Stay with FTGIf so, what model - and does a local storage device matter (Why not just use a USB3 or thunderduck port :)And how the heck do you figure out pricing for the cloud products?[ul]Forticloud  (I can't even find the part number for the new service)FortiSandBox Cloud Price  - and whats its effectiveness?And what is Central Management?And now there is AP Network (I guess for FortiAP

Hi everyone,Now my company is using Fortinet 100D with 2 static IP for 2 WAN port, now my boss wants to have another static IP. But the question is: firewall just have two ports WAN, can I configure to add 1 more WAN ports to make firewall have 3 WAN ports. 

Hi: I'm a developer and I just upgrade to the beta version of the new MacOS 10.12; the first message I just received by the system was that Forclient is not compatible. The complete problem reported is the following: Process: FortiClient [39883] Path: /Incompatible Software/FortiClient.app/Contents/MacOS/FortiClient Identifier: com.fortinet.FortiClient Version: 5.4.0.493 (0) Code Type: X86-64 (Native) Parent Process: ??? [1] Responsible: FortiClient [39883] User ID: 502Date/Time: 2016-07-07 09:08:25.370 -0500 OS Version: Mac OS X 10.12 (16A239j) Report Version: 12 Anonymous UUID: FB47259E-A856-A09C-88ED-2DF4E90A1E66Sleep/Wake UUID: 09017C39-4FBA-4398-A1B8-E5FF96E7875CTime Awake Since Boot: 49000 seconds Time Since Wake: 7300 secondsSystem Integrity Protection: enabledCrashed Thread: 0Exception Type: EXC_CRASH Exception Codes: 0x0000000000000000, 0x0000000000000000 Exception Note: EXC_CORPSE_NOTIFYTermination Reason: DYLD, [0x1] Library missingApplication Specific Informa

Hi Guys, I have an issue which I am working on. I have a scenario setup with 2 separate network EG Network A and Network B. Network A is an existing production environment with simple setup. Cisco Router Interface A connected to WAN (OSPF) and Interface B connected to layer 2 switch. Router gives out IP to clients connected to switch with 192.168.2.x/24 IP range. This is working fine. Network B - Has FG as edge with Interface running VLANS and connected different subnets. EG Port1 has VLAN10 etc with IP 10.11.15.33/28. Port 2 has an IP in the range of Network A on /24 configured configured on the interface itself e.g. 192.168.2.200 (I also tried to put it as a VLAN with subinterface IP as above) FG is connected to a Layer 2 switch that has VLAN trunk allowed all and e.g port 4-8 is given access as VLAN10. Access port is connected to HOST A, B with IP's 10.11.15.34 and .35 respectively. I need to have Client from Network A able to access HOST A in Network B which I a

My 500D has crashed twice within the past 2 weeks. devname=RP-FortiGate-500D vd=root date=2016-07-06 time=13:34:20 logid=0100032546 type=event subtype=system level=warning vd=root logdesc="Application crashed" action=crash msg="Pid: 07553, application: src-vis, Firmware: FortiGate-500D v5.4.1,build1064b1064,160608 (GA) (Release), Signal 11 received, Backtrace: [0x01b07dca] [0x7f2182e87d00]" Any ideas on where I should start looking for the root cause?   Thank you

Is there an ETA as to when 5.4.1 is going to drop?  I have a brand new 300D that I am waiting to put into production as soon as 5.4.1 is ready.

I am using the web usage report, one of the graphics it's showing is the "Top 50 sites by browsing time", the problem is that most of this time is just accounted to blocked sites, for example connect.facebook.net or plus.google.comIf I watch the same data in fortiview they show indeed as blocked. I'd like to know if there are any graphs that exclude the blocked data in this case? I've been looking in the graphs an doesn't seem to be anything (even though this what most of the audience will expect)

For example: The Fortigate 500D IOS 5.2.3   Hi, searching in the 500D reports and I repetitive attack from some country, so the quetions: Is useful block by country? For example in first policy :  src: "Netherlands" dst: All Thanks.

Hi Guys, Need the expert help here. I've got 2 of Fortigate200D setup as Active-Passive. Both has got 2 WAN link to internet, configured with ECMP weighted load balance. I've got IPSec setup by our MPLS provider as backup link. This IPSec tunnel sits on a static IP on WAN1. Heres the thing, when both WAN are plugged in, I'm getting intermitten ping loss to IPSec router, but when only WAN1 is connected, all is good. I have tried to configure policy routes but to no avail. I'm 100% sure this has got to do with the 200D wan load balancing algorithm. Any experts care to share some advise or has anyone had previous experience? Thanks!  

Hello, I am new to Fortigate and struggling with setting up forticlient access.  I know what I want, but in going through all of the Fortinet documentation I just can't find the exact solution I need. I have a fortigate running 5.2.7 and also have EMS.  I basically want to do an assessment of my laptops running Forticlient before they are allowed to connect to the SSLVPN using Forticlient. 1.  When a laptop connects from the internet, before I allow connection to my internal network I want to make sure that the forticlient AV is up to date and the firewall is active. If not, I do not want it to connect. 2.  After a laptop connects with forticlient, I want it to be able to register it's status with the internal EMS server.  The many examples in fortigate documentation show how to get it to register with the fortigate itself, but I am using EMS. Can anyone point me in the right direction? Thanks!

I have five vdoms on 1500D unit and I need to add different administrators into each vdom for management via radius and wildcard password. Is this possible with FortiOS 5.2? I added radius server as the authentication server and then created user group to include that server. I then go to Global->Admin->Administrators to create new administrator. On the page,1. I entered administrator username, which matches the radius record2. I Selected Remote as the Type3. I checked Wildcard4. I selected profile as prof_admin5. I selected corresponding VDOM and User group. All good, right? Then I go ahead to create a second administrator for the same vdom, I cannot check the Wildcard box... Is this a bug OR it is the limitation?

Hi, we have been running different VDOMS for handling different SSLVPN for some customers, with LDAP to their own AD.Would like to get rid of these VDOMS and use one VDOM for all customers but with different portals. There´s two drawback with this that I´m aware of and that is that you can´t have different domain suffixes and the other one is the seperation of, in our case, LDAP servers. We can live with the domain suffix "issue" but is it possible to filter which LDAP server that will be used based on the username? For example, if we would use firstname@domain1.com it would use LDAPServer1 and if the username is firstname@domain2.com use LDAPServer2? I haven´t seen this possibility but without it we can´t change the design since the customers LDAP servers will log and try the credentials for the "wrong domain". Best Regards