Solved

One of the factors in the original ordering of the 60D was that model still had local disk for logging, as this small business does not have a syslog server or similar.Now forticloud free with 1GB storage was being used for logging and as the 60D firmware upgraded disabled more and more utilization of the flashdrive - well at least we had Forticloud. Then without warning Forticloud changed from 1GB to 7 days -- and suddenly a bunch of log history was lost. And now the firewall is toast as well.We still have the support and services bundle through 2018 but now I have to decide: Stay with FTGIf so, what model - and does a local storage device matter (Why not just use a USB3 or thunderduck port :)And how the heck do you figure out pricing for the cloud products?[ul]Forticloud  (I can't even find the part number for the new service)FortiSandBox Cloud Price  - and whats its effectiveness?And what is Central Management?And now there is AP Network (I guess for FortiAP

Hi everyone,Now my company is using Fortinet 100D with 2 static IP for 2 WAN port, now my boss wants to have another static IP. But the question is: firewall just have two ports WAN, can I configure to add 1 more WAN ports to make firewall have 3 WAN ports. 

Hi: I'm a developer and I just upgrade to the beta version of the new MacOS 10.12; the first message I just received by the system was that Forclient is not compatible. The complete problem reported is the following: Process: FortiClient [39883] Path: /Incompatible Software/FortiClient.app/Contents/MacOS/FortiClient Identifier: com.fortinet.FortiClient Version: 5.4.0.493 (0) Code Type: X86-64 (Native) Parent Process: ??? [1] Responsible: FortiClient [39883] User ID: 502Date/Time: 2016-07-07 09:08:25.370 -0500 OS Version: Mac OS X 10.12 (16A239j) Report Version: 12 Anonymous UUID: FB47259E-A856-A09C-88ED-2DF4E90A1E66Sleep/Wake UUID: 09017C39-4FBA-4398-A1B8-E5FF96E7875CTime Awake Since Boot: 49000 seconds Time Since Wake: 7300 secondsSystem Integrity Protection: enabledCrashed Thread: 0Exception Type: EXC_CRASH Exception Codes: 0x0000000000000000, 0x0000000000000000 Exception Note: EXC_CORPSE_NOTIFYTermination Reason: DYLD, [0x1] Library missingApplication Specific Informa

Hi Guys, I have an issue which I am working on. I have a scenario setup with 2 separate network EG Network A and Network B. Network A is an existing production environment with simple setup. Cisco Router Interface A connected to WAN (OSPF) and Interface B connected to layer 2 switch. Router gives out IP to clients connected to switch with 192.168.2.x/24 IP range. This is working fine. Network B - Has FG as edge with Interface running VLANS and connected different subnets. EG Port1 has VLAN10 etc with IP 10.11.15.33/28. Port 2 has an IP in the range of Network A on /24 configured configured on the interface itself e.g. 192.168.2.200 (I also tried to put it as a VLAN with subinterface IP as above) FG is connected to a Layer 2 switch that has VLAN trunk allowed all and e.g port 4-8 is given access as VLAN10. Access port is connected to HOST A, B with IP's 10.11.15.34 and .35 respectively. I need to have Client from Network A able to access HOST A in Network B which I a

My 500D has crashed twice within the past 2 weeks. devname=RP-FortiGate-500D vd=root date=2016-07-06 time=13:34:20 logid=0100032546 type=event subtype=system level=warning vd=root logdesc="Application crashed" action=crash msg="Pid: 07553, application: src-vis, Firmware: FortiGate-500D v5.4.1,build1064b1064,160608 (GA) (Release), Signal 11 received, Backtrace: [0x01b07dca] [0x7f2182e87d00]" Any ideas on where I should start looking for the root cause?   Thank you

Is there an ETA as to when 5.4.1 is going to drop?  I have a brand new 300D that I am waiting to put into production as soon as 5.4.1 is ready.

I am using the web usage report, one of the graphics it's showing is the "Top 50 sites by browsing time", the problem is that most of this time is just accounted to blocked sites, for example connect.facebook.net or plus.google.comIf I watch the same data in fortiview they show indeed as blocked. I'd like to know if there are any graphs that exclude the blocked data in this case? I've been looking in the graphs an doesn't seem to be anything (even though this what most of the audience will expect)

For example: The Fortigate 500D IOS 5.2.3   Hi, searching in the 500D reports and I repetitive attack from some country, so the quetions: Is useful block by country? For example in first policy :  src: "Netherlands" dst: All Thanks.

Hi Guys, Need the expert help here. I've got 2 of Fortigate200D setup as Active-Passive. Both has got 2 WAN link to internet, configured with ECMP weighted load balance. I've got IPSec setup by our MPLS provider as backup link. This IPSec tunnel sits on a static IP on WAN1. Heres the thing, when both WAN are plugged in, I'm getting intermitten ping loss to IPSec router, but when only WAN1 is connected, all is good. I have tried to configure policy routes but to no avail. I'm 100% sure this has got to do with the 200D wan load balancing algorithm. Any experts care to share some advise or has anyone had previous experience? Thanks!  

Hello, I am new to Fortigate and struggling with setting up forticlient access.  I know what I want, but in going through all of the Fortinet documentation I just can't find the exact solution I need. I have a fortigate running 5.2.7 and also have EMS.  I basically want to do an assessment of my laptops running Forticlient before they are allowed to connect to the SSLVPN using Forticlient. 1.  When a laptop connects from the internet, before I allow connection to my internal network I want to make sure that the forticlient AV is up to date and the firewall is active. If not, I do not want it to connect. 2.  After a laptop connects with forticlient, I want it to be able to register it's status with the internal EMS server.  The many examples in fortigate documentation show how to get it to register with the fortigate itself, but I am using EMS. Can anyone point me in the right direction? Thanks!

I have five vdoms on 1500D unit and I need to add different administrators into each vdom for management via radius and wildcard password. Is this possible with FortiOS 5.2? I added radius server as the authentication server and then created user group to include that server. I then go to Global->Admin->Administrators to create new administrator. On the page,1. I entered administrator username, which matches the radius record2. I Selected Remote as the Type3. I checked Wildcard4. I selected profile as prof_admin5. I selected corresponding VDOM and User group. All good, right? Then I go ahead to create a second administrator for the same vdom, I cannot check the Wildcard box... Is this a bug OR it is the limitation?

Hi, we have been running different VDOMS for handling different SSLVPN for some customers, with LDAP to their own AD.Would like to get rid of these VDOMS and use one VDOM for all customers but with different portals. There´s two drawback with this that I´m aware of and that is that you can´t have different domain suffixes and the other one is the seperation of, in our case, LDAP servers. We can live with the domain suffix "issue" but is it possible to filter which LDAP server that will be used based on the username? For example, if we would use firstname@domain1.com it would use LDAPServer1 and if the username is firstname@domain2.com use LDAPServer2? I haven´t seen this possibility but without it we can´t change the design since the customers LDAP servers will log and try the credentials for the "wrong domain". Best Regards

   Hi, i have FGT310B (v5.2.3,build670 (GA)) and i can't see the memory logs.FGT310B (setting) # show full-configuration config log memory setting    set status enable    set diskfull overwriteendFGT310B (setting) # show fullconfig log setting    set resolve-ip disable    set resolve-port enable    set log-user-in-upper disable    set fwpolicy-implicit-log disable    set fwpolicy6-implicit-log disable    set log-invalid-packet disable    set local-in-allow enable    set local-in-deny-unicast enable    set local-in-deny-broadcast disable    set local-out enable    set daemon-log disable    set neighbor-event disable    set brief-traffic-format disable    set user

Hello, Having issues keeping a VPN Site-to-Site tunnel up.. My devices are a FG100D and the remote device is a FG30, both have been updated to v5.2.3 firmware. I set up the site-to-site with the VPN wizard, the VPN tunnel was working for about 3 days and then it stopped. Tried debugging on the near end (Remote end FG30 device is about an hour drive away, I would like to resolve it from this end if possible without having to drive there). In the debug it says: P1_RETRANSMIT about 3 times then goes to a negotiation timeout, deleting... Connection expiring due to phase1 down. Tried setting the VPN interface to IKE V1 and aggressive mode but same result. Set it back to IKE2. Not sure if that is the default because setting up with the wizard does not specify. I figured it would default to IKE V2. Looked at a few forum threads and this one had some interesting commands to restart the VPN tunnel: https://forum.fortinet.com/tm.aspx?m=107918 # execute router restart# di

Hi allFG v5.4.1 In policy can not set traffice shapping mac

Hello all, I have a situation  Site Asubet 192.168.100.x/24subnet 10.80.14.x/24 Site B Subnet 192.168.100.x/24 traffic will only be initiated from site A --> 10.80.14.x  The vpn is up and running, but we want to NAT from site A to B.If a user from site A pings to 10.80.255.254  it must be natted to 192.168.100.6 over the vpn to the other side. We have all the policies in place. But it is still not working. Could someone send me in the right direction?Which settings do i need to make to change the destination adress 10.80.255.254 natted to 192.168.100.6? The package should be changed from:src addr: 10.80.14.x --> dest addr: 10.80.255.254src addr: 10.80.14.x --> dest addr: 192.168.100.6 (translated on the fortigate) Thank you very much for spending time !

I have FGT300D, her power is off, I installed two transceivers  FG-TRAN-GC (her out-put is RJ45) in the port SFP (port 5 and port 6), then, I start the power on.I configured port5 (192.168.1.254/24) and port6 (192.168.5.0/24), each port is in her LAN, I put PC1 or switch2 in port5, it’s connected,  if I put PC2 or switch2 in port6 will be connect and will be down after 4 secondsIf I reverse interconnection PC/switch, I connect  PC1 in port6 then PC2 in port5, the PC1 is connected and the PC2 not connected (same problem).I conclude, if I install two transceivers  FG-TRAN-GC in Port SFP, one port  will be connect and the other port will be not connect.

I tried to generate a report within URL field but i'm not able to looking for the right query to use in the dataset.At the log View I see the URL field.Someone can help me?Thank's

Hi after installing new Windows 10 Preview 14251 latest FortiClient 5.4. doesn't work anymore. I deinstalled and reinstalled the same Problem."Your system has been quarantined." error message after starting. It seems that the Network Driver is incompatible.  Anyone with the same experience ?

Hello, I'm about to place an order for FG-51E. I'm planning to install FG-51E in my home office (~12 servers and a few users) with 75mbps internet connection. Will FG-51E be able to sustain 75mbps internet traffic with all features on?Especially, what throughput should I expect  from  SSL traffic inspection? Thank you!

Hey all, I've inherited a Fortigate 80C and recently I've lost all login access to this device. Everything else seems to work, like VPN access and our VLAN. I found a way online to reset the lost admin password using the Maintainer login to change it but I'm getting an error:  Domain1 login: maintainer Password: ******************** Welcome !Domain1 # config system adminDomain1 (admin) # edit admin new entry 'admin' addedDomain1 (admin) # set password Pass1Domain1 (admin) # end User must have a profile object set operator error, -56 discard the setting Command fail. Return code -56 I've tried this a couple of times with the same result. I even tried it with my own login but no joy. I'm not a Fortigate guy so I'm not familiar with the device or any of its idiosyncracies. Am I missing a step here or is there a better way to do this?  Thanks, Joe B 

I'm a little confused about how setting the config from the command line works. Specifically, when I enable router logging, the option disappears from the config. See below: Fortigate (eventfilter) # showconfig log eventfilter    set system disable    set vpn disable    set user disable    set router disable    set wireless-activity disable    set wan-opt disable    set endpoint disable    set ha disableend   (eventfilter) # set router enable   Fortigate (eventfilter) # end   Fortigate (eventfilter) # show config log eventfilter     set system disable     set vpn disable     set user disable     set wireless-activity disable     set wan-opt disable     set endpoint disable     set ha disable end  Why does this happen? &n

Hi,   Does anyone know if I can user social login guest registration along with administration approval? I mean, the guest user register itself using social login (FB, Linkedin, etc) then some administrators receives an email to allow the user to navigate ?  I am using a FortiAuthenticator v4.00-build0019-20151007-patch00.   PS: I have "Require administrator approval" on Self-service portal -> self-registration ENABLED but only works in the regular form. Thanks in advanced. Ronald

I am running two reports on user activity, detailed web browsing, and web usage report.both are full of category Information Technology, most of it is MS office related and such. I have been asked to exclude that category, so the report is easier for management to read.I do not see anywhere to exclude categories, can someone point me in the right direction? 

Hello, We use two FortiGate 3700D (HA cluster) running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415.We run a FortiAuthenticator v4.00-build0019-20151007-patch00 We 'd like to upgrade all to last versions: FortiManager and FortiOS to v5.4, FortiAuthenticator to 4.1. These upgrades are validated for FortiManager and FortiOS.http://docs.fortinet.com/uploaded/files/2902/fortimanager-compatibility.pdf About FortiAuthenticator, the Release Notes v4.1 (last version) says:FortiAuthenticator™ 4.1 supports the following FortiOS versions: FortiOS v5.0 Patch Release 12 FortiOS v5.2 Patch Release 4 Other FortiOS versions may function correctly, but may not be supported by Fortinet.http://docs.fortinet.com/...c-release-notes-41.pdf Does someone try and run a FortiManager/FortiOS v5.4 with FortiAuthenticator to 4.1? Regards, Chris