Solved

Hi there, Please i need help with a dataset that shows the number of mails blocked by address. Is there anyone that can help me?. Thanks in advance and best regards,Jose

Good afternoon! I have to make a report with the users whose traffic exceeds 8 GB per month. I formed Daset and it works correctly.Dataset:select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and logid_to_int(logid) not in (4, 7, 14) group by user_src having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>8589934592 order by bandwidth descAnswer dataset: User135,369,256,69134,364,302,1501,004,954,541128,694User221,554,866,67321,068,549,543486,317,13038,515User320,008,767,42719,264,670,852744,096,575174,823User417,295,362,95115,710,305,4861,585,057,46582,488User515,714,387,91614,970,889,199743,498,71766,21User613,465,465,87413,009,276,608456,189,26697,073User712,417,131,22012,099,502,104317,629,11648,073User812,380,196,76611,028,109,6931,352,087,07357,715Use

Greetings all. New Fortinet user here. I'm hoping one of you SQL query gurus could help out with a custom dataset which meets the following requirements: - Lists all individual blocked session details for specified web filter categories.     - Session details include: category, timestamp, user, srcip, dstip, hostname, and url.     - Sort is ascending by category and then timestamp.     - Should be able to edit the categories on the fly before running the report. Let me know if there's more information needed. Thanks in advance.

Hi, I have a FortiWifi 60D with actual Firmware Version 5.2.5. In the FortiAp Profile exists an Profile named 11n-only which cannot be deleted. The button is greyed out. I have checked all dependencies but there exists nothing to this profile anymore. My next step was to delete it via cli but the result was : Can not delete a static table entry Command fail This entry is shown: FortiWifi-60D # show wireless-controller wtp-profile 11n-only config wireless-controller wtp-profile     edit "11n-only"             config platform                 set type 60C             end         set ap-country DE             config radio-1              

a little disappointed..no enhancements..it's just a bugs fixed release....[size="5"]definitely 1 of terrible f/w for FOS...[/size] UNSTABLE GUI[size="6"]ANNOYING SSL VPN problem..............[/size] [size="3"]fortinet, I think you must quickly push out next fixed release or give some explains.........[/size] 201508020844, CSB-150730-1-Partial-Config-LossFortiGate models listed below may lose configuration pertaining to IPsec interface, virtual access point interface, loopback interface, or virtual-switch interface after a reboot when the FortiGate is deployed with FortiOS 5.2.4 with build number 0688 and time 150722.FGT20C3X12000161 # get sys statVersion: FortiGate-20C v5.2.4,build0688,150722 (GA)Potentially Affected Products: FortiGate: FG-20C, FG-20C-ADSL, FG-30D, FG-30D-PoE, FG-40CFortiWiFi: FW-20C, FW-20C-ADSL, FW-30D, FW-30D-PoE, FW-40CResolution: FortiOS 5.2.4 software images for the models above have been rebuilt and re-posted on the customer support web site

Hi All, working with the fortigate 30D and the web filtering isn't working.  if you look below, this is my response to checking if the web filtering is running# diagnose debug ratingLocale : englishThe service is not enabled. but everything on the gui points to it being turned on.  Can anyone suggest something?  If I can get this up I may look into it running in transparent mode. Thanks All,Lucas

My issue is that I can't ping devices connected to the remote gateway. The tunnel is working just fine and I can ping the remote gateway. The remote gateway is a FortiGate 60D on Firmware v5.2.3,build670 (GA). Here's the (simplified) network setup: device1 (192.168.200.11) | (remote net 192.168.200.0/24) |FG-60D (192.168.200.10 on internal interfaces) | (IPsec tunnel) |local GW (192.168.180.70) | (local net 192.168.180.0/24)On the FortiGate CLI device1 responds to pinging and also devices on the local net respond. But I can't reach device1 from the local net. I'm suspecting the error might be, that I haven't configured the IP and Remote IP on the VPN interface. They're set to the default value 0.0.0.0. I tried entering the Fortigate's IP 192.168.200.10 and 192.168.180.70 as Remote IP. But because I've configured that IP already for the internal interfaces I get the error "IP address is in same subnet as the others".  What sh

Hi all, Does forticlient support other VPN server? Or it can only be configure to connect to the fortigate itself? Thank you for the feedback.  Regards,JAM

When Anti-maleware is deployed in the Flow Mode (versus Proxy Mode), what happens to the detection rate? - It dramatically decreases - it decreases slightly - stays the same - increases

Hi, i have a fully licensed vm01 (not eval). Now i am trying to work out whether Vmware fault-tolerance or a passive Fortigate VM is the way. if i run 2 vms (1 active, 1 passive), do i need an additional license for the passive vm since it is not in use? thanks 

Hi All,I have a 300D firewall,  came across something i think is strange hopefully you lot can shed some light on it.in a nutshell my policy  looks like thisInternal > External from any source adress to destination FQDNsometing.com | schedule always | services TCP-51460 allow/accept ........ if i go to my browser and type in the URL somthing.com:51460.....nothing happens , if i run a sniffer in the external interface no packets for that port , as soon as i change the services to all instead or TCP-51460 it works and the sniffers sees packets (obviously) please let me know what you think is wrong ?  Shane

Traceroute for remote address across the VPN showing the incorrect second hop. The second hop is going through the 'mgmt' 'DMZ' 'wifi-controller' interface. This happens because the VPN interface has an IP address of 0.0.0.0 so the FortiGate uses the first interface according to the ifindex number. Does this matter or what interface should i set it too? i have multiple vlans however I use one vlan for all internal connection traffic.

Hi,We are using Fortigate 200A with version 4.0 (MR2 Patch 2) and Fortiguard license expired.Now, we are planning to block few websites to overcome Internet Bandwidth high utilization issue.I have configured Webfilter under UTM services, but it does not work. I think its because of no FortiGuard active licence. I heard that we can use Static Filter list here. Can someone guide me, how to use it, since I do not see static filter option in GUI mode. Or is there any other way to block websites without having Fortiguard active license. Thanks and RegardsNaveen

Hi Everyone,This is Naveen and I just joined this forum. I see It is very good forum with all useful discussions.I have a problem with Log and Reports. We are using Fortigate 200A with version 4.0 (MR2 Patch 2) and Fortianalyzer 1000B with version 4.0 (MR2 patch 2). In FortiGate, I have configured "Remote Logging & Archiving" with FAZ Ip address with minimum "debug" level.I am able to see all event logs in FAZ, but unable to see Trffic logs. I think, because of this issue, FAZ is unable to show the reports and it says "No matching log data for this report". I have configured Layout, Data Filter and Schedule in FAZ. It will be appreciable, if someone can help me to address this issue.

Hello, Quick question: In order to allow Skype to continue to function after putting P2P blocking in place I had place a monitoring rule explicitly for Skype above it. This allow access to Skype but fills up my logs with constant entries. What's the best way to set this up so I don't monitor Skype at all? Thanks!

Hi, I'm pretty sure that this is a self answered post, but here goes... Network has switches at the access level, all of them trunked with the company vlans to a distribution switch, which is trunked up to the fortigate - see simplified diagram network.jpg The vlans are being routed at the distribution switch, so this switch is the gateway for each vlan. the gateway for the switch is the fortigate of course. the trunk between the distribution switch and the forti includes the vlans also - just because i want the forti to detect the devices being connected on each vlan, other than that if i could i would eliminate this trunk. Upon setting this up (which is a production system that had no vlans and is heavily secured with both device based rules and FSSO rules), the FSSO rules keep working great. As for the device based rules they stopped working. My assumption is that when datagrams reach the distro switch and then are forwarded to the fortigate, the m

Hello all, out of curiosity I joined the public beta and installed the iOS9 beta on my iPhone. I had an existing IPSec VPN connection that I created a while ago using FortiOS 4 on a 40C. The upgrade from 4 to 5 (and now 5.2.1) was problem-free, and the IPSec tunnel works as-is on my iPad, but my iPhone running the iOS9 beta doesn't seem to be able to use the VPN connection properly. I even created a new tunnel using the VPN Wizard for iOS devices, and the same behavior is observed: The iPhone connects just fine, but when sending traffic, I see the traffic coming in through the tunnel, leaving the egress interface (in this case, the LAN), being answered and the packets coming back through the Fortigate out through the VPN tunnel interface to the iPhone, but the iPhone doesn't seem to respond at all. Seems as though iOS 9 can only send via IPSec, but not receive... I've already opened a ticket with Apple, but I wanted to come here and see if anyone else had the same issue.

Fortigate 200D not send logs on Forticloud.Firmware Versionv5.2.3,build670 (GA) Setting  

Hi all,we have enabled deep SSL-Inspection on FG100D Cluster. Everything works fine by now, except full validation of certificates presented by the remoteserver. For example, all self-signed certificates on remote-servers are accepted by Fortigate, because there ist no issuer validation (try with test on https://filippo.io/Badfish/). I found the CLI-setting "ssl-ca-list", which should solve this problem by verifying server certificates against stored CA-Cert list in Fortigate. But - how can I import ANY trusted Root-CA certs in Fortigate, like browsers have? Is it possible to import a "trusted root-CA-package" or something like that? Thank you!

What is the easiest way to change a bunch of Forticlient registrations to a new EMS server?  Currently they are registered to a Fortigate Thanks  

Attempting to install FortiClient (VPN client only) on Windows Server 2008 R2, 64-bit OS.  I downloaded the installer yesterday, version 5.4.  It gives this message: "Service 'FortiShield' (FortiShield) failed to start. Verify that you have sufficient privileges to start system services."  Even though I chose the option "Run as administrator" when launching the installer. I would attach the log file, but it's too large and the forum won't allow uploading a zip file.  Thanks to anyone who can help.

IPS is sending copious amounts of alerts for HP.SiteScope.Remote.Code.Execution. I'm curious to know if there is a way to exclude these alerts. We have determined this to be a false report generated from a program required one these handful of machines. Any help would be greatly appreciated.

HI ppl I have not assigned anything to the fortiaps and still i see this 40.2 ip in the connecting via column as in the picsThe ap is on internal5 port and the port is set to dedicated to ext device with an dummy ip of 169.X.X.X.  Screens:[link]http://i.imgur.com/Tbmx5hY.jpg[/link] http://i.imgur.com/XXJsLKd.jpg  I tried to reset the ap following this doc: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36190&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=9466136&stateId=0%200%2074138876 But i keep getting the wtp-profile not set error and when i try to create some wtp-profile i get the not found in datasource error. Any help please. Thanks.  

Hi all ,New to Fortigate, can anyone tell me if you can    see what policy a packet hits first ? the firewall im nor managing has ,alot of policies  most of them redundant, i would like a sort of sniffer to see what Policy was use to either accept or dent the packet on CLI.  

Hi, I need to create custom report with template filter for web page.Behavior similar like in "User Detailed browser" reports, but filtering nor by user, but by web page. Report example: www.webpage.comUser1      time1      Bandwidth1User2      time2      Bandwidth2User3      time3      Bandwidth3User4      time4      Bandwidth4 How can I create this report?is it possiible? :) Thank you