Solved

FG-100D is configured with two WANs combined via WLLB. ISP for WAN1 has been flaky lately, dropping out for 30 seconds or so occasionally. I expected traffic to be immediately routed to WAN2, but in reality I have to manually disable WAN1 in the GUI in order for this to happen. The relevant parts of the config is below. I'm trying to determine whether I have something configured incorrectly in the Fortigate, or if the misconfiguration is occurring between my ears. Thanks in advance. Eric 5.04-FW-build1064 config system interface    edit "wan1"        set vdom "root"        set ip 74.143.138.236 255.255.255.248        set allowaccess ping fgfm        set type physical        set alias "isp1"        set estimated-upstream-ban

Hi Everyone,I am trying to create a report of all keyword searches ,there is a dataset "webfilter-Top-Search-Phrases" in 5.2.2 however produces no data.Has anyone had success with tis dataset or any other method. As I previously said I just want to know what the top 20 -30 keyword searches are in Google or likewise. Many thanks In advance

We left setting up our wireless networks for after we had the pre-existing wired networks duplicated and working when we made the switch from Cisco to Fortinet. It seems now that this may have been a mistake.We want 2 networks. One for guests, and one for corporate users. The one for guests is no problem. It's up and running. The one for corporate users isn't.We'd like the corporate wifi to be on the same network as the internal wired network. The problem is that this was already setup as it's own dedicated interface. From what I've read, the usual solution is to make the wired and wireless part of the same virtual switch. This isn't an option for us due to the current setup.How can I make the wireless bridge that internal network? Or maybe make that wireless network separate, but have access to the internal network as if it was a member?

Folks - Exchange 2010 lets you restrict use of internal Distribution Lists to authenticated *senders* only.  However, when an outside user replies to a message that includes the internal distribution list as well as external addresses, Exchange allows that message. This leads to unwanted Reply to All scenarios occuring. Can I blocked mail to ADistributionList@ourdomain.com, where ourdomain.com is a protected domain in our Fortimail configuration? Running Fortimail v5.2, Build 404. Thanks for any assistance, it is appreciated.  I did review the admin manual but wasn't able to find any item which appeared germane. Regards - Pete

Hi, I am trying to create a report from a filter/view on the Traffic Log page in Log View. The steps I am taking is as follows:1) Add Filter > Service: SMTP 2) Add Filter > Destination Country: China3) Last 30 days. I get the results back that I expect, all SMTP traffic going to China.4) Tools > Chart Builder 5) Give it a name "SMTP to China". 6) Keep all over settings as deafult, preview appears, click Save. Receive a message stating "Error in creating the chart and dataset" I'm not sure what I am doing wrong, and don't currently have the knowedge of FAZ to create this report myself. Any ideas? This is a FAZ-300D running v5.4.1-build1082 160629 (GA)

I've searched for a long moment but couldn't find answer to my question below.  It would be nice if someone could help me. I have a FortiGate 80c whose firmware (O/S) is vers 4.3.15.  Its web management UI is using some default certificate.  Of course, I could:1. put an exception in every browser I'm using to manage the device, or2. import the certificate to every browser I'm using But I think there's a 3rd option: use a better certificate with a well-known CA.  However, I'm unable to see where I1. I assign the SSL certificate,2. I import this SSL certificate (in System > Certificates > Local Certificates like those cert for SSL-VPN?) Thanks in advance NB: In case it's not clear, I'm not talking about the SSL certificate assigned to SSL-VPN.

Hi,How  to reduce bad  syn rate to the minimum ? Thanks

Hi I have fortigate 60D running 5.4.12 fortiswitches 124D with S124DN-v3.4-build192 running2 forti aps 321 with FP321C-v5.4-build0339. the fortiaps are connectect through the fortiswitches with the fortigate. The reason why I bought fortinet solutions because of the good security and the central management.Problem is that the capwap tunnels are instable. Once they are up they stay up, but dont reboot any of the systems or you risk that switch or AP is not able to establish capwap again. date=2016-07-28 time=19:16:29 logid=0100022900 type=event subtype=system level=notice vd=root logdesc="CAPUTP session status" msg="session join: S124DN3W15000064 is connected date=2016-07-28 time=19:16:19 logid=0100026001 type=event subtype=system level=information vd=root logdesc="DHCP Ack log" interface="root-sw" dhcp_msg="Ack" mac=08:5B:0E:E4:68:BA ip=169.254.254.2 lease=604800 hostname="S124DN3W15000064" msg="DHCP server sends a DHCPACK" date=2016-07-28 time=19:16:10 log

We have a need to use VDOMs, which I'm not currently using. I have a fairly extensive configuration (IPSec, VPN clients, email and web filtering, etc.).  When enabling  VDOMs, what exactly happens to my current configuration?  If I have all that sort of logic set up, how disruptive is it going to be?  I'd like to get my current config going in a single VDOM before I start experimenting with an additional VDOM.   The documentation is kind of unclear about this, so forgive me if this is a FAQ that I just can't locate a good answer to.  I'm a total newbie with VDOMs, and don't have an extra Fortigate to use in a lab so I'm unfortunately experimenting with production here.  Thanks in advance! - Steve 

In fortiOS 5.4, how to link a schedule to a Traffic Shaping Policy ? Thank's 

Hi, thank you for your time...someone told me that there is a solution for setting Quota in New FortiOS, but i can't find anything to do that.i just want to know, is there anyway to set Quota for my local internet users, or not?thank you.

i am not new to the Fortigate line of routers but have questions regarding IPS and how/when to implement it. if i am configuring a new fortigate router for a client that has a small office network /w domain server (IE: 10pc / 1DC)  how should IPS be implemented...if need be?  port forwards that would be set up for the server would be port 80 and port 443 and nothing for the desktop clients except maybe RDP access. #1 would it be needed?#2 would i just apply the default IPS filter on the WAN to LAN policy for the port forward? any info would be greatly appreciated. Thanks,Gary.

Hi all good news for everyone which uses SSL Offloading with Virtual Server. FortiOS 5.2.8 is supporting new TLS 1.2 which was until now not the case and which is only the case under FortiOS 5.4 All devices which are able to use SSL Offloading (consult software matrix) have under FortiOS 5.2.8 this possibility.# get system status | grep VersionVersion: FortiGate-300D v5.2.8,build0727,160629 (GA) # config firewall vip(vip) # edit testnew entry 'test' added(test) # set type server-load-balance(test) # set server-type https(test) # set ssl-min-versionssl-3.0 SSL 3.0.tls-1.0 TLS 1.0.tls-1.1 TLS 1.1.tls-1.2 TLS 1.2. hope this helps have fun Andrea

Will the FG-TRAN-GC (1000baseTX) SFP work in the SFP+ port of an 800C?   I can do this with Cisco SFP+ ports.  They will take any 1Gig or 10Gig SFP. You may be asking why.  Why use the SFP+ port when you have 4 other SFP 1Gig ports available.  I have 2 Fortigate 800C devices in HA.  One 800C is at the main site and the other is connected at the DR site.  HA runs over a 1Gig dedicated fiber.  The switch at the main site can utilize 10Gig, but the switch at the DR site does not have 10Gig ports.   Thanks

Hi there, I want to know what does the Message " replay packet(allow_err), drop" exactly mean? I have a problem with updating my branch offices Antiviruses which are connected to head office through fortigate 400A. In the section of log access of fortianalyzer,deny logs for antivirus update, all have replay packet(allow_err), drop message. all the policy and network configurations are correct. thank you for the help.

Hi, at first a happy new year to all. I have a Problem when i enable ssl deep-Inspection and surfing through the Web. I noticed that some sites loading only if i reload the site twice. Sometimes but not often I get a "ssl_error_bad_mac_read" error in Firefox. It also went gone when I reload the site. It is relative often reproducible when I am surfing through the fortinet forum. I am using the build in fortinet proxy certificate which CA is certainly imported in the browser under trusted ca authorities I have checked this with some other browsers and on other machines to rule out that it is a browser/machine problem only. The goal why i have enabled deep inspection is to use antivirus in https. Allow Invalid SSL Certificates and Log Invalid Certificates are both enabled but I get no errors. Like I said it is not on all sites but when I noticed that and loading process was too long then I reload the site and now it comes up. Then I figured out when deep-inspection is turned off th

After Update of OS to 5.4.1 the Fotigate(800C) won't register forticlients anymore. Error message from Forticlient:  Forticlient is actively blocking this forticlient form registering. Endpoint Event: FortiClient registration failed due to version too low. VPN provision seams also to be lost from endpoint controll as wel. This is an very bad issue regarded to the fact that our company has lost endpoint control of several hundred client's. Best RegardTrond-Ove

Since implementing a Fortigate 60D with 5.2.3 a few weeks ago the system log shows an hourly entry reporting numbers of files dropped by quard (I've attached an example screenshot).The entry provides no real information as to the cause, and I'm struggling to locate information online that indicates whether we should be concerned about this.I've found reference to the quarantine daemon in the CLI manual and methods of debugging however I can't determine what options are available to use with the diag test application quarantined command and am concerned about running such commands blind in a production environment.  Can anyone offer some advice on the following:1. How can I determine the reason for this behaviour?2. Should I be concerned about this, or is it typical? TIA

Does FortiOS 5.4 has functionality to redirect HTTPS traffic to ICAP server?Hello, We have currently Forrtigate VM64 v5.2.5,build701, configured ICAP for redirect http/https traffic to ICAP server (DLP acts as ICAP serrver) HTTP traffic redirecting succsessfully to ICAP server. But HTTPS traffic is not redirecting to ICAP server. (configured ssl-inspection and enabled it on policy) I think v5.2.5,build701 does not support redirecting HTTPS traffic via ICAP The question is: Does new FortiOS 5.4 has functionality to redirect HTTPS traffic to ICAP server? Thanks

So I'd like to get some clarification please if what I believe I'm seeing is correct. I'm trying to configure RADIUS authentication with on a Cisco SG500X switch using the FortiAuthenticator for Radius. The "Small Business" Cisco switches don't have a full version of IOS running on them, but I have this working where a member of a Remote LDAP group on the FA logins into the switch SSH it will log them in with priv lvl 1. What I want is to boost this to priv lvl 15, and on a normal IOS switch you would return Cisco-Av-Pair = priv-lvl-15 Radius attribute. I have attempted to configure this attribute, along with Service-Type = Administrative-User against my Remote LDAP group, but a packet capture shows that the FA is not sending the Radius attributes at all in its Access-Accept packet. My question is, is this because the FA is looking for a Vendor-Specfic(26) of Cisco as opposed to CiscoSystems in the Access-Request packet? See AVP from Wireshark: Access-Request:RADIUS Prot

Hello all, I am seeking some advice. I have two different clients with dual WAN setups and I believe that I am running the redundancy incorrectly. I have essentially the same question for both setups so I will just describe one. I have 2 Fortigate 40Cs setup in HA with WAN1 running off of a DSL connection and WAN2 going through our VOIP internet connection (also DSL, but separate from the main connection). I have the priority and distance set higher for WAN2 and everything seemed to work well. Although I must admit I didn't really believe that the setup was complete. The failover from WAN1 to WAN2 works perfectly if the WAN1 modem was powered down or physically disconnected from WAN1. In this case all traffic would be routed through WAN2. When WAN1 would come back up everything would route through WAN1. The issue I ran into which I'm sure most of you probably already see is that if the internet for WAN1 died, without the device going down or being removed (ie, if I were

Hello,need to upgrade from 5.0.11 to 5.2.6 fortigate 800C active/passive. If something goes wrong I know it is possible to boot from the partition where I still have 5.0.11. Is that correct and how to eventually achieve it ?

We have a email server that get over 10k hits of authentication failure error as the bots tries to login with random passwords everyday. The trend we notice on Fortigate is that these attacking source IPs will hit very high number of sessions. Is there a way to automate Fortigate to automatically block these source IPs from WAN1 to Port1 when their sessions reach a preset number?

Using FortiMail 200D, Firmware version: 5.3.1 I've activated the next checks in the Session ProfileBut I'd like to permit some known senders to bypass it.I have tried, without result:[ul]Activate "Enable sender safelist checking" in Session Policy and add the addressesAdd the address in AntiSpam > Domain >  Safe List Add an entry in Policy > Access Control with Action=Safe:[ul]Sender Pattern: *@mail.telcel.comRecipient Pattern: *@mydomain.comSender IP: TheirIP/32Reverse DNS: -/*Auth Status: AnyAction: Safe[/ul][/ul]However I still see the rejected mail in the log: AntiSpam Log:Message: Invalid ehlo/helo domain. ( xiang.telcel.com ) Client: mail.telcel.com [200.38.208.219] History Log:Classifier: Session Domain Disposition: Reject Event Log:Message Milter: from=<someaddr@mail.telcel.com>, reject=550 5.5.0 Invalid EHLO/HELO domain So, where should I put the address for not be rejected? Thanks in advance.Roberto.

   Hi, i cant get access by https GUI administration, but i can by http. i try with many browsers. Maybe is and SSL error with the certificate, i dont know.  I check the access configuration:#config sys int    edit "port2"        set vdom "root"        set allowaccess ping https ssh http fgfm        set type physical        set alias "Inside"        set snmp-index 2#config sys admin    edit "sgermano"        set remote-auth disable        set peer-auth disable        set trusthost1 0.0.0.0 0.0.0.0Thanks!!