Solved

Hi all, I was trying to set up a tunnel on a fresh FortiGate-VM (KVM) installation but I can't select AES as encryption for Phase1 proposal: I'm using version 5.2.5 (build701); the appliance is not licensed yet. Have you experienced this before?

Hi guys, I'm facing a big problem here with one FG60D (5.2.1). I had configure email filter as usual but it's not working. I don't know why cause it's an easy configuration. My config email filter profile is:config spamfilter profile    edit "EF_example"        set comment "Email Filter"        set flow-based enable        set spam-filtering enable        set options spambwl spamfsip spamfssubmit spamfschksum spamfsurl spamfsphish            config imap                set tag-msg "[FG-Spam]"            end            config pop3  &nbs

Hello,I'm facing a rather odd and annoying problem in FortiManager 5.4. I cannot set the system's time and timezone. No matter what settings I provide, the system keeps ignoring them and uses a random timezone and time. I have tried with different browsers (Mozilla, Chrome and Explorer) and the behavior is the same. Has anybody experienced similar problem and knows the solution?ThanksAndreas

Hi All, I'm tired of beating my head against this wall and am hoping one of you may have a sledgehammer or wrecking ball I can borrow. The use case is as such: PLC vendor needs access to specific VLAN on our network so they can remotely manage their systems. They requested an IPSec VPN to access via the FortiClient. So far I have an IPSec VPN set up that works almost flawlessly. User can connect, is unable to ping any of our internal IP addresses and can even ping the IP address (172.22.5.2/24) on our core cisco stack. That IP is the VLAN172 IP address. If I SSH in to the cisco device I can ping everything on that subnet no problem. Pinging and tracerouting via the Fortigate CLI succeeds to all 172 subnet addresses as expected as well. But from the VPN the cisco is the only IP address I can ping successfully. On the internal interface I have a VLAN set up with the proper VLAN ID and 172.22.5.6/24 as the IP address. I have the 172.22.5.0/24 Subnet set up as a firewal

Hi All I have a really strange issue at my remote office.  Basically I have a FortiWifi-40c V5.2.2 with a pretty basic configuration:WAN1 -> RouterInternal1 -> LAN SwitchInternal 5 -> Workshop switch We have an IPSEC tunnel up to our Head Office. The issues we are having is that when I plug a device into the LAN (My laptop for example), I fail to get any internet breakout. After investigating, I found that the machine kept getting and IP from our local windows DHCP server, but then it would loose the IP and try and renew again (This will carry on in a constant loop). If i get on to the windows server, the DHCP adress leases get full of "BAD_Request" objects. Looking through the event logs on the windows server came back with no errors being logged. Now the interesting this is... When I unplug the Fortigate, bam...I get a DHCP address. I then plug the Fortigate back in to the LAN switch and I can browse and access various resources. Another in

Hi Im having troubles configuring DDNS on my fortigate. My ISP is blocking dns for fortigates servers 208.91.112.53 and 208.91.112.53. Is there a way to configure DDNS with my ISPs dns server? Can i change the default port fortigates uses for dns? thanksCarlos

i swore i was able to do this before, but is there a way to block a device (or even better yet all mobile devices) on a certain SSID and only allow them on the other SSID?  foritnet 100d (5.4) with 4 FP221B-v5.4. we have our guest network (which i want the mobile deivces to use) and our network side SSID, which a few people seem to seem connect to since they know the password.  thanksbrian   

Hi, This is a recording of the first draft of the transparent mode module for FOS 5.2: https://www.brainshark.com/fortinet/vu?pi=zGJzT1BNYzJRhMz0 You are more than welcome to watch it and share your comments and feedback in the forum. Regards, Edy

Hello,We have fortigate 80C (FortiOS V5.0+) using User identity based policy and Created a Schedule timeout policy for accessing facebook and youtube in lunch time.The problem is after the scheduled timeout the active session will still be allowed facebook and youtube (not blocking) but new sessions is blocking. Any idea , how to fix this? Thanks,Asok

Hi All, At the moment we have a FortiWifi 80C (v1 variant with 512MB memory) now on 5.2.2 which works fine, but there are a few things with it that are quite annoying to us, in particular the loud, high pitched fan noise and the incapability of the WiFi part to operate at 2.4GHz and 5GHz simultaneously, so we're considering replacing it. Based on our traffic and other requirements the FortiWifi 60D looks like a contender, but from the data sheet it isn't clear if it can operate at both 2.4GHz and 5GHz simultaneously (something most $30 home routers can do). It's also not clear if this thing has a fan. Also, what is the difference between the various hardware rivisions? Are there even any revisions like on the 80C? Thanks, H.

Hi,Recently we have upgradedFortigate 200A Firewall from 4.2.2 to 4.3.18Fortianalyzer 1000B from 4.2.2 to 4.3.8 Before the upgradation, all reports are showing data and worked well in FAZ.After upgradation, I have noticed below issues1. No matching Log data (No Data) in all repots 2. Unnder Report-->Layout is not visible/available in GUI 3. Under Report-->Schedule is not visible/available in GUI When I do SQL Query test/run, I see below error ERROR: operator does not exist: timestamp without time zone >= integer. LINE 1: select ((case when itime_start >= 1458766800 and itime_end <... Logs are reaching to FAZ, since I can see real time traffic logs All Policies are enabled with "Log data" option In Fortigate Firewall, all logs are send option is enabled towards FAZ  I think it must be an issue with SQL database, but I am not sure how to fix it.Can any one of you help me to resolve this issue. 

Hi all, My fortigate 110C usually has high CPU problem. I checked the enviroment (temperature, fan...) all is ok. On fortigate, I configured many policy route, I think it is reason for this problem. so how many policy route entry Fortigare recommend to device can run well? anyone can advise me ? Thanks all!

Hello everyone, I want someone guide me to configure "Banned word check" in Emailfilter profile. Thanks  

i have tried to configure dnsbl , i want someone correct me if the below configure is ok or not:config spamfilter dnsbl Edit 1 set name "Dnsbl " config entriesEdit 1 set action reject set zen.spamhaus.org server set status enable nextEdit 2 set action reject set server dnsbl.spamhaus.org set status enable nextend thanks

I am using fortigate 200B with OS v5.2.4,build688 (GA).I have configured bword from the CLI, it works before the firmware upgrade.Unfortunately, I forgot which version of firmware can be working well.Anyone can help?Thanks.

Hello! I would like to make a automated backup for the fortimanager (400B OS 5.0.6). What solutions are there? Thanks for answers! kind regards - maximilian

Does anyone know if you can configure RADIUS groups for the FAZ? I can't seem to find any information on this in the admin guides or CLI. What I'm trying to do is have users loging to a RADIUS server (FortiAuthenticator in this instance) and from there be given role based access. For example if the user belongs in the 'admin' group they would be given full access, but if they're in the 'partners' group they would be given access to the report/fortiview. I'm going blind trying to figure this out! :)

Hi. Having strange problem. I created some SSL VPN accounts about a month ago. For some reason, I'm now unable to delete any of them. I can edit them. I can create new accounts and delete those new accounts, but anything I created a month ago cannot be deleted. Any ideas? Thanks in advance.

Hello, Having issues keeping a IPsec Site-to-Site tunnel up.. I am having FG60D device successfully connect to azure using FortiGate Cookbook - IPsec VPN to Microsoft Azure (5.2)   but tunnel got disconnect frequently in few hours and Had to reboot 60D always to get the tunnel bring up firmware version : V5.2.6, build711 phase 1 proposal : encryption AES 128 authentication SHA256encryption AES 256 authentication SHA256encryption AES 128 authentication SHA1encryption AES 256 authentication SHA1Diffie-Hellman group       : 2key lifetime                    : 56600 seconds  phase 2 proposal : encryption AES 128 authentication SMA1encryption AES 256 authentication SHA1encryption AES 128 authentication SHA256encryption AES 256 authentication SHA256 Replay detection

We have a Fortigate 600C. At the moment you can get to our Firewall admin page through https from the internet. What is the best way to lock down this access to only allow access from specific IP's? So, we would still like access to the admin page and to get logged in from the internet, but only from specific IP addresses.  Thanks in advance. New to Fortinet and need all the assistance I can get.  

In our Fortigate 100D we enabled IMPA and POP3 profiles, but need to make sure the antivirus is working as expected, for that how one can run an attack test ?

Couldn't find anything straightforward about disabling SSL v2 on Fortimail. Executed this command which seems to have helped:Config system global                Set strong-crypto enableEnd we are running v. 4 codeLet us know if there's a better way, or if this helps you. 

Hello all, I try to add our new FortiGate 200D to our monitoring. Unfortunately I got some confusing output when I did a "snmpwalk" to the firewall. Normally the physical ports 9,10, 12,14 and 15 should be "up". But when I do a snmpwalk on the "ifOperStatus" it is IF-MIB::ifOperStatus.1 = INTEGER: down(2)IF-MIB::ifOperStatus.2 = INTEGER: down(2)IF-MIB::ifOperStatus.3 = INTEGER: down(2)IF-MIB::ifOperStatus.4 = INTEGER: up(1)IF-MIB::ifOperStatus.5 = INTEGER: up(1)IF-MIB::ifOperStatus.6 = INTEGER: down(2)IF-MIB::ifOperStatus.7 = INTEGER: down(2)IF-MIB::ifOperStatus.8 = INTEGER: up(1)IF-MIB::ifOperStatus.9 = INTEGER: up(1)IF-MIB::ifOperStatus.10 = INTEGER: down(2)IF-MIB::ifOperStatus.11 = INTEGER: down(2)IF-MIB::ifOperStatus.12 = INTEGER: down(2)IF-MIB::ifOperStatus.13 = INTEGER: down(2)IF-MIB::ifOperStatus.14 = INTEGER: down(2)IF-MIB::ifOperStatus.15 = INTEGER: down(2)IF-MIB::ifOperStatus.16 = INTEGER: down(2)IF-MIB::ifOperStatus.17 = INTEGER: down(2)IF-MIB::ifOperStatus.18 = IN

I have a problem with instalation FortiClient version: 5.4.0.780. Windows 7 Professional x64. At the end of instalation i have a few errors and I can gothrough this http://zapodaj.net/63f68bd238067.jpg.html http://zapodaj.net/f8f3692fa84c5.jpg.html I have traied with restarting and F8 but i work only for a time I again restart my PC and then shows up recovery and delete whole FortiClient. Sorry for my English.

Hi, on Fortigate 100D ver 4.x we used a FSSO with FSSO Agent installed on Active Directory server with no trouble. After change firmware to 5.2 and FSSO Agent to 4.3.0159, users started complain about websites: sometimes websites opened and sometimes not. I decided to change SSO method to Polling. I configured everything with no luck. no users are shown in User & Device -> Monitor -> Firewall -> Show all FSSO Logons. The " diagnose debug authd fsso server-status" command shows only " Local FSSO Agent" !! which is not visible under User & Device -> Single Sign-On (I even deleted everything I created before): LDAP test: pass. When I add a SSO, the status is always grey X mark.