Solved

Hi Friends, I am new to this forum, I have created a policy to block the traffic from China(& one of my remote location's IP) as attached pic.And I have moved the policy to top in the sequence.   I have tested from my remote location, I am able access the firewall public IP and also I am able access the VPN.So this policy is not working. Can anyone help me to write correct policy to block traffic from a particular sub-net or country. ThanksRamesh

Hi, I am configuring a Fortigate 100D with Maximum Local Users = 1000Is there a way to extend that limitation. I can't input anymore users since I reached 1000.The log in's will be use for SSL VPN clients.         

As far as I can tell, there is no documentation about variables in datasets other than, "Select the add variable icon, , to add a variable, expression, and description information."  What happens after that?  Where is the variable used?  How is it used?  My ultimate question is, can I create a custom query such as "select … from $log where $filter and sentbyte >= @MinimumBytes"?  Can I have a MinimumBytes variable which is threshold value configurable within a Chart or Report?  Sometimes I want to report on large file transfers (e.g., >= 1 MB) and sometimes I want to include smaller file transfers (e.g., >= 5 KB).  Do I need two different datasets or can I have one dataset which is filtered by a variable? 

I try to block open proxy by blocking Proxy Category in Application Control.So far didn't success.If someone had success blocking that, please share Test: -search open proxy that using port 80 from [link]http://proxylist.hidemyass.com/[/link] -set Chrome using open proxy for example 107.167.21.243 port 80 -test whether can access www.playboy.com FYI, PaloAlto can block open proxy and SoftEther, but can't block Opera Turbo or Psiphon3 REQUEST:When FortiGate will have Opera Turbo Application Control thanks[link]https://nbctcp.wordpress.com[/link]  

Hello, I am testing Windows 10, but I can't seem to be able to connect to our FortiNet.Forticlient gets stuch at 98% for a while, then disconnects. I have tried all solutions that worked for me in the past when I had the same problem in Windows 8.1, to no avail. Is this being worked on? Thanks, Tanausu

Hi, Good day, Anyone experience doing multiple VDOMS with multiple SSL VPN portals, but using only 1 public address. The ISP is connected to the root VDOM so i made a routing and policy and made a inter VDOM link to VDOM2.I have no problem on accessing SSL VPN Portal for root VDOM since the ISP is connectedEX PublicIP:8080 >> portal for root vdom. Now i set up the SSL VPN Portal for VDOM2, and listening to a private IP with unique corresponding port(its InterVDOM link interface) 172.16.1.1:8081 Now since the internet is connected to the root VDOM, I created a VIP to translate cause I am using only one public ip.Ex. PublicIP:8081 >>> 172.16.1.1:8081 No luck. its not translating.I sure my policy and routing is okay i can ping an ip from each vdom. and policies are ANY ALL to ANY ALL Is other work around for this? what i might  missed out?    

I have a question regarding creating a VDOM. I have been using the root vdom for our environment, but would like to test if flow mode might be better, so looking to setup a new vdom with flow mode enabled. If I create a Flow based vdom does this disrupt any of my policies on the root vdom. Speaking of the root vdom, should this be used, or should this be left alone and a VDOM setup for what we are using the root vdom for? 1st of many questions to come :) Thanks in advance. Matt  

We are wanting to add about 75 devices for RADIUS authentication to the FortiAuthenticator. I want to use password-only authentication, use a particular realm, and apply a group filter to that realm. I don't want to have to do those steps for each device I import. I can see two possibilities that would be better, but they would both require some changes to the programming of the FortiAuthenticator:[ul]Instead of Client name/IP, you put in a subnet instead (e.g., 10.11.20.0/24).You could allow for more fields on the CSV import file that define things like auth_type,realm,group_filter[/ul]But I don't want to wait for some future version of code. Is it possible to do the things I want without having to tweak every single device that gets imported? Thanks!

I installed forticlient 5.4.0.121 for IOS, and the problem is with client certificate. I installed certifate on Iphone, but forticlient doesn't access it.  If i tun on "use certificate" below are option to select filename and passphrase, but, i cannot select any certificate there.If i turn off request of user certificate  vpn is working fine even with 2 factor authentication.  

Hello, I am a new user on fortigate and I am working on setting up OSPF on 2 fortigate 200D in HA Active/Passive mode. The fortigate are connected to our HQ subnet which is composed by several /24 vlans. The vlans gateway are hosted by the fortigates. The HQ global network is 10.0.0.0/12. The fortigate are also connected to our remote datacenter. The aim is to advertise the HQ subnet to our remote datacenter and to receive back route information from the datacenter router. On the fortigate we have configured OSPF below: config router ospf     set auto-cost-ref-bandwidth 100000     set router-id 10.6.100.1     set restart-mode graceful-restart     config area         edit 0.0.0.0         next     end     config ospf-interface         edit "Datacenter"        

Good afternoon! I just migrated from FortiManager v. 5.2 to v. 5.4 and noticed that events under the fgfm subtype were no longer triggering, even though I've seen some of my monitored fortigates drop. These are set to trigger from the local device, so I'm limited to the event level filter.  I tried a couple things like making sure the fgfm event was enabled in the local log disk filter and made sure other events were triggering. Also tried setting the alerts to trigger off anything greater or equal to debug, but still nothing has shown. Any extra step I'm missing? Thanks in advance guys!

We are getting alerts from various network PCs alerting to Virus/Worm detected: JS/Moat.2081C96D!tr with Destination IPs directing to various website hosts, like Digital Ocean or GoDaddy. MOAT.js is a legitimate javascript API but the email alerts are so cryptic that it's tough to tell if these alerts are legitimate activity, like the local Java installation attempting to update, or if they're actually a Worm attempting to communicate out. Has anyone else seen these alerts and perhaps have more information on "Virus/Worm detected: JS/Moat.2081C96D!tr" since there isn't much of anything in any virus definition database online discussing details of it.

Hi all, I was trying to set up a tunnel on a fresh FortiGate-VM (KVM) installation but I can't select AES as encryption for Phase1 proposal: I'm using version 5.2.5 (build701); the appliance is not licensed yet. Have you experienced this before?

Hi guys, I'm facing a big problem here with one FG60D (5.2.1). I had configure email filter as usual but it's not working. I don't know why cause it's an easy configuration. My config email filter profile is:config spamfilter profile    edit "EF_example"        set comment "Email Filter"        set flow-based enable        set spam-filtering enable        set options spambwl spamfsip spamfssubmit spamfschksum spamfsurl spamfsphish            config imap                set tag-msg "[FG-Spam]"            end            config pop3  &nbs

Hello,I'm facing a rather odd and annoying problem in FortiManager 5.4. I cannot set the system's time and timezone. No matter what settings I provide, the system keeps ignoring them and uses a random timezone and time. I have tried with different browsers (Mozilla, Chrome and Explorer) and the behavior is the same. Has anybody experienced similar problem and knows the solution?ThanksAndreas

Hi All, I'm tired of beating my head against this wall and am hoping one of you may have a sledgehammer or wrecking ball I can borrow. The use case is as such: PLC vendor needs access to specific VLAN on our network so they can remotely manage their systems. They requested an IPSec VPN to access via the FortiClient. So far I have an IPSec VPN set up that works almost flawlessly. User can connect, is unable to ping any of our internal IP addresses and can even ping the IP address (172.22.5.2/24) on our core cisco stack. That IP is the VLAN172 IP address. If I SSH in to the cisco device I can ping everything on that subnet no problem. Pinging and tracerouting via the Fortigate CLI succeeds to all 172 subnet addresses as expected as well. But from the VPN the cisco is the only IP address I can ping successfully. On the internal interface I have a VLAN set up with the proper VLAN ID and 172.22.5.6/24 as the IP address. I have the 172.22.5.0/24 Subnet set up as a firewal

Hi All I have a really strange issue at my remote office.  Basically I have a FortiWifi-40c V5.2.2 with a pretty basic configuration:WAN1 -> RouterInternal1 -> LAN SwitchInternal 5 -> Workshop switch We have an IPSEC tunnel up to our Head Office. The issues we are having is that when I plug a device into the LAN (My laptop for example), I fail to get any internet breakout. After investigating, I found that the machine kept getting and IP from our local windows DHCP server, but then it would loose the IP and try and renew again (This will carry on in a constant loop). If i get on to the windows server, the DHCP adress leases get full of "BAD_Request" objects. Looking through the event logs on the windows server came back with no errors being logged. Now the interesting this is... When I unplug the Fortigate, bam...I get a DHCP address. I then plug the Fortigate back in to the LAN switch and I can browse and access various resources. Another in

Hi Im having troubles configuring DDNS on my fortigate. My ISP is blocking dns for fortigates servers 208.91.112.53 and 208.91.112.53. Is there a way to configure DDNS with my ISPs dns server? Can i change the default port fortigates uses for dns? thanksCarlos

i swore i was able to do this before, but is there a way to block a device (or even better yet all mobile devices) on a certain SSID and only allow them on the other SSID?  foritnet 100d (5.4) with 4 FP221B-v5.4. we have our guest network (which i want the mobile deivces to use) and our network side SSID, which a few people seem to seem connect to since they know the password.  thanksbrian   

Hi, This is a recording of the first draft of the transparent mode module for FOS 5.2: https://www.brainshark.com/fortinet/vu?pi=zGJzT1BNYzJRhMz0 You are more than welcome to watch it and share your comments and feedback in the forum. Regards, Edy

Hello,We have fortigate 80C (FortiOS V5.0+) using User identity based policy and Created a Schedule timeout policy for accessing facebook and youtube in lunch time.The problem is after the scheduled timeout the active session will still be allowed facebook and youtube (not blocking) but new sessions is blocking. Any idea , how to fix this? Thanks,Asok

Hi All, At the moment we have a FortiWifi 80C (v1 variant with 512MB memory) now on 5.2.2 which works fine, but there are a few things with it that are quite annoying to us, in particular the loud, high pitched fan noise and the incapability of the WiFi part to operate at 2.4GHz and 5GHz simultaneously, so we're considering replacing it. Based on our traffic and other requirements the FortiWifi 60D looks like a contender, but from the data sheet it isn't clear if it can operate at both 2.4GHz and 5GHz simultaneously (something most $30 home routers can do). It's also not clear if this thing has a fan. Also, what is the difference between the various hardware rivisions? Are there even any revisions like on the 80C? Thanks, H.

Hi,Recently we have upgradedFortigate 200A Firewall from 4.2.2 to 4.3.18Fortianalyzer 1000B from 4.2.2 to 4.3.8 Before the upgradation, all reports are showing data and worked well in FAZ.After upgradation, I have noticed below issues1. No matching Log data (No Data) in all repots 2. Unnder Report-->Layout is not visible/available in GUI 3. Under Report-->Schedule is not visible/available in GUI When I do SQL Query test/run, I see below error ERROR: operator does not exist: timestamp without time zone >= integer. LINE 1: select ((case when itime_start >= 1458766800 and itime_end <... Logs are reaching to FAZ, since I can see real time traffic logs All Policies are enabled with "Log data" option In Fortigate Firewall, all logs are send option is enabled towards FAZ  I think it must be an issue with SQL database, but I am not sure how to fix it.Can any one of you help me to resolve this issue. 

Hi all, My fortigate 110C usually has high CPU problem. I checked the enviroment (temperature, fan...) all is ok. On fortigate, I configured many policy route, I think it is reason for this problem. so how many policy route entry Fortigare recommend to device can run well? anyone can advise me ? Thanks all!

Hello everyone, I want someone guide me to configure "Banned word check" in Emailfilter profile. Thanks