Solved

Anyone here set this up? I have tried, get the authentication from Duo, but the 40Gate denies entry. Any hints or tips would be appreciated. Thanks in advance. Using SSL VPN connectivity through the firewall with LDAP authentication, by the way.Fortigate 800C HA Firmware Version v5.2.3,build670 (GA) 

Hi, "diag sys session list" shows this:    session info: proto=6 proto_state=01 duration=722 expire=28077 timeout=28800 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=3origin-shaper=reply-shaper=per_ip_shaper=ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/7state=log may_dirty npu synced none log-startstatistic(bytes/packets/allow_err): org=1031/6/1 reply=659/6/1 tuples=2orgin->sink: org pre->post, reply pre->post dev=31->41/41->31 gwy=192.168.x.x/192.168.y.yhook=pre dir=org act=noop 172.x.x.x:61697->192.x.x.x:1521(0.0.0.0:0)hook=post dir=reply act=noop 192.x.x.x:1521->172.x.x.x:61697(0.0.0.0:0)pos/(before,after) 0/(0,0), 0/(0,0)misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=4serial=00863f17 tos=ff/ff ips_view=0 app_list=0 app=0dd_type=0 dd_mode=0npu_state=0x003000npu info: flag=0x81/0x81, offload=8/8, ips_offload=0/0, epid=128/129, ipid=129/128, vlan=0x801e/0x801cvlifid=129/128, vtag_in=0x001e/0x001c in_npu=1/1, out_npu=1/1, fwd_en=0/0 Afte

Hi'llI'm using a fortigate 92D with the latest image 5.4 I connect my client's with the Forticlient using IPSEC.This all works I narrowed down in my rules who can connect and to what.But I want to allow only SMB (found that) and SQL traffic to a named instance on a SQL 2012 R2 server.As long as I use the All services rule it works but I would like to limit it to SMB and SQLWhich service and ports are we talking about ??Rene

Hi guys... I have one question. I need to know whether fortigate 60D got mac access filter or not?I have tried to search in system>network>interface>(please refer attachment)...but under dhcp setting, there is no option for mac acees filter. Thanks for help in advance

Hello everybody, I use CatTools for the automatic configuration backup for over fifty Fortigate 60D devices with the Firmware 5.2.2 and 5.2.4.I used the Device.Backup.RunningConfig activity, which connects to the devices via ssh and everything worked fine. However after upgrading most of the devices to Version v5.2.5,build0701 the backup doesn't work anymore. An upgrade to newest Version 5.4.0 also didn't help. I compared the new and the old configuration and also looked for some clues in the Release Notes but couldn't find any reason for this behaviour. CatTools always brings the "Failed to connect to 212.x.x.x. No Response from remote host. Will try again." error message. I would be very grateful if somebody has an idea on how to solve this issue. If you need any additional Information, I will provide it as fast as possible. Thanks in advance and best regards,brigadax

Hello guys, we should enforce TLS to a specifig Domain and verify a specific Certifikate. We have a mail from that Partner he gave us his TLS Certificate CN, TLS Certificate Issuer CA and a link to download the Root CA (its a public CA).  so we must now konfigure TLS for that Specific domain. It should be that way? goint to Access Policy > Delivery > create new > sender pattern * > recipinet patter "*domain of the partner > TLS Profile > Secure . But on this TLS Secure level profile are so many possible options + you have to import a CA first. So we should import that Root Public CA into FortiMail and then choose it there? What should we wright in Check CA Issuer? its a Verisign CA, will it be ok if we chosse "Contain" + "Verisign" ? Whats the Certificate Subject means? is that the Certificate CN? The Domain of our Partner? Did someone have already expierience with such setup?  Thank you 

Hi all,I'm very new on fortigate firewall.I'm configuring a FG100D, it's running in "interface mode" and I need to bridge 2 interfaces, so I created a virtual-switch: I tried both GUI and CLI, then I set an IP Address on the interface "Virtual-Switch".Testing with a ping, I can reach 2 devices connected to virtual-switch, but in "Routing->Monitor" there is not entry with the net assigned to VS, I also create some static routes and, of course, those routes are not in routing table. Software-switch works well. Do you have any suggestion? This my virtual-switch config: config system virtual-switch edit VS01 set physiscal-switch sw0 config port edit port 9 end edit port 10      

Hello, You have blocked zip and. EXE using DLP but I have a problem I can not even download from trusted sites such as Microsoft, please help to exclude these sites from the ban. We also need exception specific domain if Send us e-mail contains a zip attachments  thanks

Hello I was going to upgrade a 200B firewall this evening at one of our branch offices. Going from v4.3.12 to v5.2.6This is a single firewall that was at one time part of an active-passive HA pair.  The slave had been removed a while ago but The HA config on this FW, says that it is still MASTER and that HA Config is 'Active-Passive'.  I was concerned that if I applied an upgrade of the firmware and did a reboot, this could cause a possible failure or crash.  Could it have?  My main question:  How do I set the firewall to 'STANDALONE' without impacting the current config(attached)? Is it as simple as going into HA Config and changing the Mode from Active-Passive to Standalone and hitting OK? Of course my main concern is doing something improperly that brings down the firewall. Thanks!

Hi: I´m planing to implemente HA virtual clustering, and as far as i can read on the documentation, fortigate cluster uses a special set of mac addresses on the interfaces, i have an scenario where i need to specify a specific mac address on some interfaces, so, my mayor concern is about compatibility of this custom mac address with HA functionality, should it work? We are planning to use 2 x FG100D, 5.2.6, virtual clustering, 3 vdoms, we use just firewall, ipsec, and ssl vpn, and have implemented wan failover and balancing, all of this already working fine in a stand alone FG100D. It would be great to hear from your experiencies regarding this. Thanks in advance for any feedback on this  Victor 

Hi, how I can enable extended log of web filtering ?   I got Fortigate 60D (firmware 5.2.5)I enable webfilterI add webfillter monitor-all to interface But I do not have UTM under Log & Report :(I try google  and CLI# config dlp sensor  # edit [Name of Profil]  # set extended-utm-log [enable | disable]  # set dlp-log [enable | disable]  # set nac-quar-log [enable | disable]  # end   BUT : # config webfilter profile  # edit [Name of Profil]  # set extended-utm-log [enable | disable] I get error -61 after this command. :( Also I can't change profile under web filter in security profiles :( Please advise..  Thanks

Hello everyone, it's been a while since I've visited this place. I have a strange problem (or a couple of them.....) and I hope someone will be able to help me understand what's causing them. I have 3 Internet connections on a FGT-500D. Two ADSL lines are joined in a WAN Link Load Balancing (LLB) interface. This WAN LLB interface is my default static route to the Internet. The third Internet connection has a static IP, and I'm trying to use it as an VPN endpoint for dial-up VPN clients. The first issue I'm facing is that I cannot add another default static route (with different priority) when a static default route is already entered via WAN LLB. I get an error message "A duplicate entry is found". Two or more static default routes are usually possible to be entered, when there's no WAN LLB. I've tried correcting the problem with Policy Based Routing, but it's simply not working. Here's some IKE debug output (larger image:( Any ideas?

Hello All, Sorry if this obvious question but I need to double/triple check this:  Does the basic FG-600C part number provides IPSEC VPN capabilities? or Do I need a UTM bundle in order to create site to site IPSEC VPNs?   Thanks,     

Hello Unfortunately I have to say that the FortiCache software is disappointing. So far we discovered bugs with LACP, SSL Inspection, and FSSO. And caching does not work properly, the minimum thing that should be good at! If you are thinking of buying this appliance: please please do a proof of concept beforehand using the VM. Anyhow I would welcome other people’s views. Thanks,

Hello For HA heartbeat Fortinet documentation advises to use copper ports. E.g. dmz and wan2 http://docs-legacy.fortinet.com/cb/html/index.html#page/FOS_Cookbook/Install_advanced/cb_install-ha.html We only have fibre patch panels between the racks where the firewalls will be placed. We have Fortigates 2 x 600Cs Can anybody think on any reason why I should not use the fibre SFP ports for HA heartbeats?  Thanks,  

I have a 60d FortiGate integrated to my domain for internet authentication , every day 16:00 have to authenticate again for my browser with a User Network to regain internet. Anyone know tells me how to solve this problem ?

Good day! We are yet to deploy FortiAnalyzer 200D.It has v5.0.10-build0365 150129 (GA) firmware.I plan to upgrade the firmware.Do you have any suggestions on what is the most stable firmware version we should upgrade to?Preferably the firmware version which has the least reported issues other than v5.4. Thank you!

Hello, I've opened a post inside "User and Authentication" section, but I'm not sure it's the best place to post this kind of problem! We lost our RSSO Agent Relais settings on FortiGate after each Policy Package installation from FortiManager. Could you check our post if you know about this problem? Regards, Chris

Hi, I have problem with Fortigate 100D (5.2.4) and lt2tp/ipsec. If  I connecting with the computer to a VPN and selected "Microsoft CHAP Version 2 (MS-CHAP v2)", then I get error. With "Unencrypted password (PAP) works perfectly. Why does not work with "Microsoft CHAP Version 2 (MS-CHAP v2)"?  

Hi there, I have setup a new vpn ipsec tunnel between two fortigates running 5.0.3. SA proposal chosen, matched gateway PROD_VPN_P1 DPD negotiated peer is Fortigate/FortiOS (v5 b208) and then I get the following message in the debugs ike 0:PROD_VPN_P1:2806: remote address a.b.c.d does not match configuration address a.b.y.z, drop Not sure whats happening. Thanks Anne

Hello Team, I am in process of choosing FortiGate-VM (on AWS) for one of my customer for their requirement of having a Firewall in front of their public hosted site(s). This Firewall (single Public IP exposed) will run on the Public subnet and will front-end/Proxy-front the web servers running in the different subnet. Since there are couple of Web services they want to expose both running on default http port, is there any possibility to forward requests to different hosts as per their domain requested. For example. www.example.com (pointing to 100.99.100.99) -> FortiGateVM -> Machine1 hosting this website on port 80.www.actual.com (pointing to 100.99.100.99) -> FortiGateVM -> Machine2 hosting this website on port 80. Any possibility of DNS virtual hosting (just like it is done on Apache) or Header Host based ? Regards,Amit

Hello, I also logged a ticket for this with Fortinet, but there's still no solution that works.For a customer I configured a Fortigate VM with several vdoms and vdom linksWhat happens is that routing table in External vdom is configured to route traffic to network 192.168.247.0/24via the internal vdomlink. What happens is, that traffic is routed out of another interface, i.e. the default gateway to the internet.What is remarkable is that the routing monitor shows the correct route to that 192.168.247 network, while the kernel routing table doesn't mention this subnet.Someone who recognizes this strange behaviour? Is it a vmware issue?I also upgraded the firewall from 5.0.11 to 5.2.5 already, what -unfortunately- did not solve it! Kind regardsRalph WillemsenArnhem, Netherlands 

Hello,we have LACP with two port on each of two nodes of A-A cluster configured. I noticed that etherchannel haves different aggregator ID on Fortigate and act as secondary aggregator also on Cisco (6509E). Each node in FG Cluster configured with their own ether channel. FGT100D-HA1 (root) # diag netlink aggregate name MAINLINK-LACP LACP flags: (A|P)(S|F)(A|I)(I|O)(E|D)(E|D) (A|P) - LACP mode is Active or Passive (S|F) - LACP speed is Slow or Fast (A|I) - Aggregatable or Individual (I|O) - Port In sync or Out of sync (E|D) - Frame collection is Enabled or Disabled (E|D) - Frame distribution is Enabled or Disabled status: up ports: 2 link-up-delay: 50ms min-links: 1 ha: master distribution algorithm: L4 LACP mode: active LACP speed: slow LACP HA: enable aggregator ID: 1 actor key: 17 actor MAC address: 00:09:0f:ac:98:5e partner key: 101 partner MAC address: ec:30:91:e1:03:40 slave: port3 link status: up link failure count: 0 permanent MAC addr: 00:09:0f:ac:98:5e LACP state: establ

Dear all, We cant access the Fortigat. We need to reset the admin account. (fortigate virtual appliance)  FGVM64-5.04-FW-build1011-151221 Its a virtual appliance running on Vmware. We are able to enter the config files.So we can edit the files if needed. Or how to enable the fortigate maintainer ? Its disabled.We need to reset this by editing the config files directly. Thats the onlyaccess we have,   We mounted the system with a linux boot cd. So thats how we can enter the system. Help needed urgent !!!! 

Hello!After realising that SLAAC is not supposed to work when ISP gives just a /64 with which I should subnet this into smaller (because I have to define globally routable IPv6 addresses non-overlappingly on both external and internal interfaces), I asked our ISP for a /48 and got it (unlike last time over a year ago). But I still can't get IPv6 working (without NAT). I write down the configuration. It is FG200D with a single internet connection in wan1 port and vlan14 is our test internal vlan for IPv6 which also has IPv4 addressing on it. I use 2001:db:1:: prefix for example conf (replacing the original with it) but prefix lengths are not altered. My main goal at the moment is to get access to IPv6 internet from internal network. Allowing access from internet to internal network will be my next step. If anybody has ideas, thank you in advance!  1. External interface wan1 (IPv6 part of it).        config ipv6     &n