Solved

I need to add a new Isp on Wan 2 and then i would that clients use Wan2 to surf the web but servers and services (exchange server,web server etc etc)  keep on use Wan1.It's enough to:-set the network interface for wan2-add a static route for wan2-change the policies internal---->wan1 and set the outgoing interface to wan2  ??Thanks for your helpFrancesco

Hi guys, I have a customer who needs to block a specific excel file from leaving their network. We have v5.4.1 running on their firewall and I'm busy reading up on DLP and came across the watermarking feature / option, but I do not find it anywhere in the GUI. must this be enabled in CLI or has this been removed from 5.4? they still mention it in the FortiOS 5.4.0 Handbook - Security Profiles. Is there another way I can go about creating the DLP filter for this specific Excel file? bearing in mind anybody could potentially rename the file as well... thanks,theG

HelloI'm really struggling to get a VPN up and running between our 100D with firmware version 5.2.4. and Azure.  I have followed a number of instructions but none seem to work.  The Azure end was created using resource manager.  When I look in the logs I just see IPsec phase 1 errors.  My config looks like this.  any help would be much appreciated.  config vpn ipsec phase1-interfacenext    edit "Azure_P1"    set interface "wan2"    set ike-version 2    set keylife 28800    set proposal aes256-sha256 aes256-sha1 aes128-sha256 aes128-sha1    set dhgrp 2    set remote-gw xxx.xxx.xxx.xxx    set psksecret ENC xxxxxx nextendconfig vpn ipsec phase2-interfacenext    edit "Azure_P2"    set phase1name "Azure_P1"    set proposal aes256-sha256 aes256-sha1 aes128-sha256 aes128-sha1  &nbs

My fortigate 100d is not forward traffic between Guestlan and lan.Guestlan is on a seperate lan.Wan adresses are 200.200.200.2 255.255.255.240One webserver is on 200.200.200.3 and traffic is going fine. From the internet as from the guestnetwerkthe second webserver is on 200.200.200.2From the internet this website is accessable. But when we try to acces the website from the guestnewerk it is not accessable. When we look at the log and report we see it is getting in the Implicit Deny rule. The guest network is 192.168.1.1 and external adres is 200.200.200.13. We have internet acces and eveything is working fine.When I put the webserver from 200.200.200.2 to 200.200.200.4 it is working fine. When I change this back to 200.200.200.2 it stops working. Is this a bug because we use the first address in the range. https on the webinterface is not enabled.System settings https port 443 is changed to 8443 for Administration logon. Please assist

It seems whenever FC updates its databases, it briefly "turns off" according to Windows, which prompts a notification. It shows every minute or so while scanning, and if you watch Action Center while it's doing so, the AV status 'flickers' between on and off. Has anyone else had this/have a solution for it?

Hello, We just proceed with DLP implementation.We create DLP rules to examine and supress mail wich content .js, .bat ... inside archives .zipHowever, how can we add exception for single sender identified by his email adress or his IP ? Thanks for the answer. Best regards Fortigate 500D Firmware v5.2.4

I have a cluster of 3 x FG5001D using 4 VDOM. we was on version 5.0.9 when we realized that the option "Packet Capture" under any VDOM (Vdom -> System -> Network) was not there.After this, we proceed to update to the actual version 5.2.8 and the menu option "Packet Capture" does not appear. trying through CLI, the packet capture works well. but the user of packet capture don't have intimacy with CLI, then we need the GUI working.i checked the user permissions, clear browser caches, other navigator and nothing was effective Any clue of what i have to do?

Hi everybody. I'm setting up a new Fortigate HA cluster (300D) and i have a strange issue. Each time i have to reboot a node of the cluster, he came back as a standalone Fortigate.  Any idea how i can resolve that ? This is pretty annoying. Here is the HA configuration. config system haset group-name "Toto"set mode a-pset password ENC totoset hbdev "mgmt1" 50 "mgmt2" 50 set session-pickup enableset ha-mgmt-status enableset ha-mgmt-interface "Management" <= this is actually a vlan interfaceset ha-mgmt-interface-gateway x.x.xset override disableend

I am wondering if there is anyone that knows a good way to export firewalls rules with comments to a readable format ? copying the rulebase from the gui and paste it to excel works but to get the comments you need to copy the rule base from the CLI and then filter and so on which takes time. Checkpoint for example has many good ways to export the rulebase to HTML. Is there any scripts that can read the config file and export id,src int,dst int,src,dst,port and comment ?

I'm using 5.4.1. I setup fsso and trying to view user activity in forward traffic logs but the user column is blank. I know it is seeing the user because the policy allows that user and the web-filter logs display the user. Is this just a cosmetic bug in 5.4.1 or am I missing something here?

Hello ,My problem is when i reboot my SLAVE fortigate  in a HA cluster config , all of physical ports are down ( with no lights ),  so there is no connection with a master fortigate  , i have restored a last good configuration  to the master HA - GF  but the problem is not resolved .please it is a hardware problem or a software pblm : thank you

.

build701Appeared in the download portal....but [size="5"]no enhancements?????[/size] 

I have WiFi controller HP, wireless users are identified by the RADIUS server (Windows NPS). I want to see these WiFi users on FortiGate, is this possible?Thank you!

Hi,Just replaced my old firewall (Zywall) with a Fortigate 100DOn the Zywall there were 2 vlans 6 and 99I rebuild this on the Fortigate. Connected the same cabeling to the fortigate but the vlans are not working.Lan port 1 is connected to a HP switch and on the switch vlan 6 and vlan 99 are tagged on this port (this was already set)My question is why is there no traffic between the fortigate and the lan.Vlan6 Type is Vlan, interface is lan, id is 6. ping is enabled. DHCP is also enabled. ip is 192.168.101.1Vlan99 Type is Vlan, interface is lan, id is 99. ping is enabled. DHCP is also enabled. ip is 19268.99.254lan itself is 192.168.1.1have a policy from vlan6 and vlan99 to Internet and a policy from vlan6 to vlan99 visaversa.Any why i cannot ping from internal netwerkserver to 192.168.101.1?

Hello,i have issue when open some website like yahoo.com For example but not limited to ,from Chrome i found  error  below:"The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1". what should to do to solve this issue ? thanks

hello all, I'm planning to place the slave unit of a Fortigate HA cluster into a remote location. There is a leased line (layer 2) for the HA connect. Can anybody confirm that I can run the HA traffic across a VLAN between the access switches on each side of the line? I know that HA traffic uses a non-standard ethertype, and I've tested that HA traffic is transfered unchanged over that line. But now there will be VRRP traffic between 2 routers on this line as well, and I'd like to isolate the HA traffic on a VLAN of it's own. There is the option to enable authentication and encryption of the HA traffic but this will cost performance. Though it will isolate the traffic I guess. I appreciate any advice, esp. from someone who has already separated a HA cluster geographically.

Hi All,I am having some issues with websites not rendering correctly behind a Fortigate 200D (5.0.7) Basically the pages are screwed up with text over the top of other text and the layout of the page changing. I have attached an image of what I see for reference.  The only features that are turned on on the Fortigate are, WiFi and Switch Controller and Web Filter. I have tried disabling the web filter and this made no difference. I'm hoping someone else has seen this behaviour and knows of a fix ThanksRob

Can someone tell me, which algorithm uses fortinet to choose between two suppliers connected one in each wan? How it makes the desition?  Thanks 

Administration Guide says "Server Override Mode Select Strict (Access Override Server Only) or Loose (Allow Access Other Servers) override mode. " and CLI documentation for "config fmupdate server-override-status" isn't much more helpful. Clarification of what this does, would be much appreciated.

Hi All, We recently started installing the Forticlient due to a virus outbreak that was not caught by Symantec.  On top of the virus, for a week I have been dealing with random IGMP storms on the LAN and I cannot seem to track it down.  I was worried a couple of our servers had something malicious on them that was causing them to send out all this traffic.  It would cripple our server vLAN and it is very random.  Sometimes I can do a day without any storms, but other times it happens an hr or two after rebooting the servers. I did find one post about someone having a broadcast, or multicast storm and it was the Forticlient that seemed to be the culprit.  Has anyone else noticed this type of behavior, especially when installed on a VMware VM? I started installing two new Server 2012 VM's on Friday.  The only thing I installed, aside from Windows updates, was the Forticlient and later on the network was flooded with IGMP traffic again.  I

Hi, I am new with Fortigate. Fine product. But I have the follow challange.I have 8 public ip addresses and one to assigen one public address to a guest lan.Should I use Vdom's? What is the best way to accomplish this? using a Foritgate 100D Thanks in advance.

Hello,We have run into a problem with a custom dataset, and we don't know how to solve it. It would be great if someone with good query-skills could have a look at it. A customer wants a more detailed version of the "threat-Top-Virus-Source"-dataset, where srccountry also should be listed. We suspect that the problem is that "srccountry" only exists in the DB "log-traffic", not in "log-virus", but we are pretty clueless about what to do right now... The original dataset "threat-Top-Virus-Source":[code lang=sql]select srcip, hostname, sum(totalnum) as totalnum from (###(select srcip, hostname, count(*) as totalnum from $log-traffic where $filter and logid_to_int(logid) not in (4, 7, 14) and utmevent is not null and virus is not null group by srcip, hostname order by totalnum desc)### union all ###(select srcip , ipstr(`dstip`) as hostname, count(*) as totalnum from $log-virus where $filter and (eventtype is null or logver>=52) and nullifna(virus) is not null group by srcip,

Sir , we are using FOrtiAnalyzer VM64 with multiple Fortigate FW's   .kinldy help me create following Reports 1) Create Daily Total Bandwidth Used   ( Inbound   & OutBound ) Like Downloaded :  X GB Uploaded  :   X GB Currently there are reports which showing Top 20 Bandwidth Users 2)In Fortiview Tab when filtering  via Proxy Policy ID 571  it is showing other connection Blocked events also instead of showing Just Events  with Proxy Policy ID 571  , how to 3)In threats Reports its showing Malware source IP , Hostname   , Is is possible to show MAC Address also  [when i go to fortiview >Select malware > Select IP > i am able to see details like source Hostname & Mac address 4)Reports of  VPN /P2p Users Like    catagory = Utorrent Hostname & Ip address Hostname & Ip address catagory = Vuze Hostname & Ip address orHostname - IP - Utorrent thank y

Good afternoon. I am not a networking guru, so I hope ask these questions in the correct manner. I have a port that I want open and forwarding to a specific client machine. I have gone through and done the VIP, VIP Group and entered the policy. Everything seems good according to what I read in the cookbook. Running v4.0 MR3 Patch 12. When I do an external port test, I get a time out error, and that the port is not available.  Subscriptions are not up to date. Am I missing something to open this specific port?  Lets say it is port 4080.  Is there a specific area in the panel that I need to specifically open that port before port forwarding will even work, or is the set up of port forwarding essentially opening that port? I just know there is also the Services\Custom set up, and I have done nothing in that area... Help is deeply appreciated.