Solved

Hi. Is it possible to display on GUI Wan & Opt menu? Thanks.  

Hello, I have a client with 2 WAN connections. They would like to use WAN2 as a "failover only" for WAN1 (i.e., no load balancing).They would also like to route Guest VLAN traffic out WAN2 only. I have searched the KB articles and the forum, and I am still a bit confused as to how to properly implement this scenario.I believe I need to do the following:[ul]Set wan1 and wan2 static routes with same distance and priorityConfigure link health monitor/dead gateway detection for wan1Create policy-based route for internal LAN (except guest) to go out wan1 (must be first so traffic flows out wan1 first, unless down)Create policy-based route for internal LAN (except guest) to go out wan2 (this is backup route if wan1 fails)Create policy-based route for Guest VLAN  to go out wan2Modify default LAN firewall policy to allow traffic (except guest VLAN) out wan1 and wan2 interfaceModify Guest VLAN firewall policy to allow traffic

On a freshly configured FG60D using the free FortiCloud subscription limit of 1GB and running 5.2.3 all my Traffic,  Event and System Logs show as empty. Logging is configured to use FortiCloud and the FortiCloud website shows up to date log entries for this firewall as expected, but they cannot be viewed from the local Fortigate UI itself (regardless of browser used). The system resources readout through FortiCloud is non functional, reading a static 0% CPU and 58% RAM. This is the second Fortigate unit on the account that I'm setting up for our test network. The primary unit's logging is configured in the same manner and works correctly in both the local UI and Forticloud. Any ideas on how to resolve this issue?

Trying to get this configuration sorted out for to successfully establish an IPSEC VPN tunnel using the following hardware:[ul]AT&T hotspot w/public IP addressFortiextender 100b into the WAN port with a private IP of 10.100.1.110Fortiwifi 30d w/internal interface set to private IP of 10.1.13.211 & DHCP enabled w/10.1.13.110-200[/ul]Remote endpoint for the tunnel is a VMWare Edge server and the remote tunnel is already set up to allow traffic from the public IP address and private peer of 10.1.13.0/24. I have created the VPN local endpoint as well, bot Phase I and Phase II. Policies are in place for all interfaces including the FortiExtender, but the tunnel will not come online. I can imagine this is likely due to something missing in the configuration:[ul]There is likely some NAT'ing that I am missingMaybe a policy or two that I am missing[/ul]NOTE: All devices behind the firewall will be connected via the LAN interface on the 10.1.13.x subnet.

Hello, I configured with FSSO agentless with windows domain AD. My Fortigate WIFI 90D has root vDOM and WIFI vDOM.When I do "diagnose debug fsso-polling detail" I see "most recent connection status: err: server can not be accessible"My LDAP configuration is working correctly, I can fetch all OUs and Groups.I think I have problem with source IP of vDOM. I have to config LDAP source-IP to one interface in root vDOM in order to make LDAP configuration working.I wonder the same thing is happening with FSSO agentless. But I do not know how to fix this. Could anyone have any ideas about my problem. Thanks,

Hello, we have an annoying issue here with user authentication to an IIS server through a Fortigate 240d (FortiOS 5.2.3) cluster.I have made a policy that allows connection from the internet for the usergroup rds-userssource interface: wan1source address: allsource users: rds-usersoutgoing interface: insidedestination address: vip of iis server (static nat)service: https What happens is that, when you connect to this vip address from the internet, you get the Fortinet authentication portal, where you have to enter your (AD) username, password en fortitoken. When succesful authenticated, you can enter the company webportal.This works great, however.... The next user that originates from the same public ip address, don't have to go through the authentication and is directly redirected to the webportal (!) I haven't found a workaround for this yet, maybe anyone has an idea how to solve this issue? Thank you and regards,Ralph WillemsenArnhem, Netherlands 

This is not my strongest area but it is the its the task at hand..Main office 100D v5.2.2Branch 60D v5.2.2Followed instructions from video to create a site to site. Went to VPN/Monitor/IPSec Monitor and it shows the status as down. Any guidance would be greatly appreciated. 

I have two Fortigate units that I manage. One is a 30D and one a 60D both running the same firmware v5.2.3,build670 With both units from time to time I am unable to access the web-gui. The only fix appears to be to restart them.Whilst I am unable to access the gui, the units are still working and processing traffic outgoing.I am not able to reproduce this, it just happens when it wants to. On the 60D I am unable to SSH in when this occurs, it will give me an SSH login prompt, however once the username and password are entered it just sits there and does not log me in. It's kind of like the login process works, but is separate to the actual management tool itself which is not functional at the time. On the 60D I am also unable to use FortiExplorer from an iPad using a USB cable to access the unit when this occurs. This has happened at least 3 times, maybe more, the only fix as I said above appears to be to power off the unit and power it back on. I hav

Hi all in our office (branch office) we have a Fortigate 60C and we are currently connected on one only ISP; FGT-60C configuration is quite simple: all internal traffic goes to wan1 There is also a static VPN configured with our headquarter so we have also a couple of static ruotes and some policies to route voip traffic to our switchboard (located on headquarter) and also traffic to our internal network located in our headquarter Now in the branch office we want to add another ISP connection; it will be PPoE and it will be connected to wan2 We want to configure in this way  - Internal traffic going to web (all external addresses) goes through wan2 (the new connection)  - Internal traffic going to headquarter goes to VPN configured in wan1 What do I need to configure ? Do I need to configure a new policy "internal - wan2" (all - all - accept) and disable the current one "internal - wan1" ? I suppose I will need to change/add also the current static routes; how ? Thank yo

Hi, Does anyone have an overall guideline or check-list for hardening a 1000c. The firewall is currently being used for web filtering and application control, I will be adding some simple DLP sensors and IPS also. pj

Okay I see what they are saying below about the Disclaimer access banner, but is there a way to edit the banner to what I want it to say? Disclaimer access banner Optionally, the FortiGate unit can present a warning statement to administrators before or after login authentication. The administrator must accept the statement to continue. Logs record response to the disclaimer at each logon. The default pre-login and post-login banner messages contain the same text: This is a private computer system. Unauthorized access or use is prohibited and subject to prosecution and/or disciplinary action. All use of this system constitutes consent to monitoring at all times and users are not entitled to any expectation of privacy. If monitoring reveals possible evidence of violation of criminal statutes, this evidence and any other related information, including identification information about the user, may be provided to law enforcement officials. If monitoring reveals violations of

Hi, quick one: - I have a 100Mbps pipe to the internet- I create a rule to intercept traffic from 1 ip and give it 50Mbps of minimum guaranteed bandwidth questions:- what happened when that ip is not generating traffic (i.e. laptop is off)? Is the firewall giving the rest of the network 100Mbps or 50Mbps? thanks 

I have a FortWifi 30D connected via IPSEC VPN to a Fortigate 60C. Behind the FWF30D is an IP-phone that one of our users has at their home office. The phone working normally and can connect to the HQ network via VPN. I have a Fortianalyzer in the same IP range as some of my VOIP equipment that the phone communicates with. I would like to get the FWF30D to send its logs to the Fortianalyzer. I can ping from the FAZ to the FWF30D' s LAN address, and to the IP-phone beyond it. I cannot trace or ping from the FWF30D (via CLI) to the FAZ. It seems like the FWF30D will not send its traffic through its own IPSEC VPN. Any ideas on how to resolve this? Specs: FWF30D v5.0,build4459 (GA) Fortigate 60C v4.0,build0672,130904 (MR3 Patch 15) (yes I know its old) FAZVM64 v5.0.7-build0321 140627 (GA) Prior to the FWF30D we had a FWF50B doing the same thing. The FWF50B died, and we replaced it with the FWF30D.

 Dear all, currently i have a fortigate 100d with firmware version v5.2.0,build0589. i planing to manage user policy with Identity based policy feature. but i unable found this when i configure my policy. Any one can teach me how to enable Identity based policy feature?

Hi there, I need help with a dataset/report on FortiAnalyzer. What I need:Detailled Report about Application Category "Video/Audio"- See which Applications (In appcat=Video/Audio) consumed which bandwith- Which users connected to which application (in appcat=Audio/Video)- Top 30 users for every Application with Bandwith usage (in appcat=Video/Audio) Is there anybody who can help me? Thanks and best regardsMattias

Hi I am struggling with setting up a VPN connection from IOS devices to my internal network (Fortigate firewall 500D) I started by using SSL VPN, but found the IOS app was next to useless, as it doesn't support tunneling and as soon as you close the app, you lose the VPN.  I started looking into IPSEC via the IOS Dialup, but cannot get my head around it. My knowledge of IPSEC was that it requires a source IP and destination IP, however, with the mobile devices constantly on the road, near on impossible to lock down the devices IP. It seems IPSEC IOS doesnt require this, but i am lost to understand how it authenticates the tunnel between the devices?  Any help to get my head around this would be much appreciated.  Thanks Paul

Few days ago during a diagnostic, I was annoyed to find that I got no ping reply from my FortiGate 80c DMZ interface (ping sent from a server situated in the DMZ). But " PING" option in DMZ interface properties page has already been checked. After some fiddlings, I figured out that I also had to put source IP address in " Trusted Host" field of *any* administrator. Now, there' s a problem (or two problems): * The description of PING in the PDF documentation (fortigate-admin-40-mr2.pdf) says that Interface responds to pings. Use this settings to verify your installation and for testing. * The description of " Trusted Hosts" says that The IP address and netmask of trusted hosts from which the administrator can log in. But ping has nothing to do with " log in" , so in first reading, it was hard to imagine there' s a relationship between " trusted hosts" and " ping" . It' s either a bug or a documentation ambiguity.

I' m trying to create an LDAP Server under User & Device-> Authentication on a FortiWiFi 60D v5.2.0, build 0589. The Active Directory server is Windows Server 2008 R2. When I click the icon by the Distinguished Name field it fills in the name. Using Server Port 389. I selected Bind Type = Regular. When I fill in the User DN and Password but I consistently get an Invalid credentials message. The LDAP Server is listed on the LDAP Servers page but when I click to Edit this and to Test the connection I again get the Invalid credentials message. This is the first time I' m trying to set this up. Can anyone tell what I' m doing wrong?

Does anyone know if there is an alternative method being worked on for the web-based Fortigate SSL VPN since the current SSL VPN relies on the NAPI plugin for it to work? Safari works great, but Chorome is depreciating NAPI plugins and eventually disabling and blocking, and Firefox is expected to follow suit in the near future.  - Gianluigi

fortigate 80c don't work web filter.Help me please  [link]https://www.youtube.com/watch?v=KdBZX4HKOtE[/link]

Hi Experts, We are running Fortigate 300C firewall in HA (Active - Passive). Pls share step-by-step process for upgrading the Firmware for Active Passive HA (remotely). RegardsSB 

Hi, today I logged on FG 100D, and alert message console showed a lot of login trials. Is this an attempt to break in the system and how to protect myself? 12015-10-05 12:49:32Failed admin authentication attempt for root22015-10-05 12:49:32Failed admin authentication attempt for root32015-10-05 12:49:32Failed admin authentication attempt for root42015-10-05 12:48:58Failed admin authentication attempt for root52015-10-05 12:48:56Failed admin authentication attempt for admin62015-10-05 12:48:54Failed admin authentication attempt for aaron72015-10-05 12:17:25Failed admin authentication attempt for log82015-10-05 12:17:21Failed admin authentication attempt for admin92015-10-05 12:17:18Failed admin authentication attempt for vyatta102015-10-05 12:10:57Failed admin authentication attempt for R00T123112015-10-05 11:59:16Failed admin authentication attempt for admin122015-10-05 11:59:12Failed admin authentication attempt for root132015-10-05 11:59:12Failed admin authentication attempt for

Hello.I can not create a new profile in the web filter and Profile Group. 

Hello All, We have configured FSSO on a FG300 running version 5.0 (GA 13)In this config we are using group filters, but when I check the CA that is running on an A.D. server, we noticed that a service account was logged on multiple times (about 20 times). This service account isn't included in the A.D. servers' groups where we configured the groups that must be used in the identity based firewall policy.These groups have been configured/selected in the FG.After I had excluded that service account, FSSO seems to be working.Another important thing: we have upgraded the agents on the DC's but only restarted the services, we didn't do a complete reboot of each A.D. controller.Could this be the culprit? Best regards,Torenhof 

I understand 'Log Rate' to be SYSLOG messages received from devices, but what is a 'Log Message' as shown by 'diagnose fortilogd msgrate' command? Also, is there a CLI command to show[ul]Insert Lag Time?Insert Rate?[/ul]