Solved

We have a Fortigate firewall in active/backup configuration running FortiOS 5.0.9. TL;DR Firewall intermittently stops passing https packets from iPhone or iPad with message on the firewall of "no session matched". Just posting this here in case anyone else is experiencing this odd issue. More information Recently one of our users noticed that they were unable to access an internal application that is essentially a web site that uses https. They can get to the initial page of the web site but not beyond it using an Apple iPhone or iPad client. We have done a lot of testing at each stage of our network and traced the packets through the network using Wireshark and some network taps. We tap the fibre going into the firewall and we can see packets going in, however they never emerge out of the trust interface, past the initial loading of the web page. Essentially, the packets are getting all the way through the network until they reach the firewall.&nbsp

On my fortimail unit the Anti Spam Definition is 7.00286. How can I check if this is the latest definitions available from fortiguard? 

Hello, I have 5 external IP`s addresses from my ISP. I added those addresses to WAN1 interface. I have several servers in DMZ (e.g. mail server), whose services are accessible from the outside. I created the appropriate VIP addresses and traffic from Internet to DMZ goes to the correct servers. But all the servers from DMZ and LAN internet users go from one address (primary WAN1 address). How can I set different external IP address for outgoing servers traffic?

     I have an IPSec site to site tunnel between a FortiGate 110C and Cisco ASA5510.  There is a single NAT happening on the Fortigate side that translates the LAN addresses to a block of addresses.  All traffic between the hosts on the ASA side and hosts on the FortiGate LAN are working correctly.  The issue comes into play when self originated traffic from the 110C is pushed across the tunnel, in particular sFlow data.  When the source IP is set to default, the traffic is pushed from the WAN IP to the tunnel interface.  When the source IP is set as the LAN interface the traffic is being directed to the tunnel,  however, it is not using the NAT pool of addresses for the tunnel traffic.  As a test I used IMCP to flesh this out.  execute ping-options source 0.0.0.0execute ping ASA HOSTthis failsexecute ping-options source LAN IPexecute ping ASA HOSTthis failsexecute ping-options source TUNNEL NAT POOL e

Hi All, 1. I'm very new to Fortigate2. It's a Fortigate 60D3. I did not configure the router myself and there is no document on how it was done :(4. Some program wants to reach an external website on port 8008. Somehow I have the feeling that the Fortigate is not allowing that. 5. Can anyone point me in the right direction to check this 'blocking' behaviour and make sure this traffic is allowed? All help appreciated,Regards,Gerard

Hello folks, I recently upgraded to firmware 5.2.3 (from 5.0.x) on FG-40C. However, after the upgrade, I no longer see the Advanced option under DHCP Server (System > Network > Interface) I am running the FG-40C ports in internal switch mode (but my understanding bot switch mode and interface mode should have the Advanced options under DHCP Server).   I have attached a screenshot to this post. Has anyone experienced the same issue?  Any help would be much appreciated. Many thanks.  Cheers,Arthur

Hey guys, I have a box which I'm building a site-to-site tunnel on. The remote site has two locations, and my box should be able to 'fail' to the second location if the primary is unreachable. From what I understand, this should be as simple as creating a phase 1 for each location, and using the 'set monitor "primary-phase-1"' on the secondary tunnel - like this: config vpn ipsec phase1-interface    edit "Primary"        set interface "wan1"        set nattraversal disable        set comments "To Primary Location"        set dhgrp 5        set remote-gw XX.XX.XX.XX        set psksecret ENC xxxxxxxxxxxxxxx    next    edit "Secondary"       &nb

I blocked user MAC Reservation + Access Control, but if the user sets himself a static IP address, it uses the Internet and network.How to fix?Fortigate 80c

Hi,I was trying to figure out how I can subtract "from_dtime(dtime)" of "now()" and count the interval in days.I was wondering if somebody knows. Tks folks.

I had this issue before in a version prior to 5.2.2.  Worked perfectly in 5.2.2 updating to 5.2.3.  Looks like it's a problem again. Anyone have any ideas?  Removing the old version to install the new is not really an option.

Hi I migrated over to my HA Fortigate 100D setup from my Cisco Router. What I have noticed is that with external requests going to my internal NAT server, is it is showing that the external connection is made from the VLAN interface IP address instead of the original external Source IP. this is a bit frustrating because some Linux machines behind the fortigates are blacklisting the interface address due to failed hack attempts because it all seems to come from one address -- hope this makes sense. so an external requests looks like its coming from the interface address 192.168.30.254 and not the original source public address of 41.xxx.xxx.xxx etc. hope this is just me making a noob mistake on the new toys... 

Hello all,I've got a problem with Skype connection. Sometimes it works and sometimes skype can't connect without any clue.. On application control, i've granted acces to Skype I've set a rule that use appsensor, and open a port.  But it change nothing. sometimes i can conenct slype but sometimes no.. Have you got an idea? Regards,Alexandre

Im running V5.2.4 build0688 150722 GA on my FortiWiFi 60D-POE but the packet capture feature is missing from the menu. I have read that you can get to the packet capture util directly via a URL which works but the GUI should have a link to it. Do you have to enable this now like you do with other GUI features? Thanks

Hello, I have sucessfully managed to block http and https traffic on my Fortigate 100D but for some reason, if I open Google Chrome, all blocked HTTPS sites are accessible wile HTTP sites remain blocked !!! I tried with Safari and Firefox and both HTTP & HTTPS sites are blocked... Is there any reason why Chrome is bypassing the firewall settings? The settings on the firewall are:SSL/SSH Inspection ON, blocking HTTPS trafficWebFilter ON, blocking all websites (* wildcard - deny) and allowing only 3 specific ones.IPv4 Policy that incorporates the above rules.

Hello, I am having a problem creating a site-to site VPN tunnel that has one side behind NAT with dynamic public IP.I followed the instructions on the below video as the scenario is exactly as mine and that is what I am trying to accomplish but, the FortiGate firewall never dials in (or it tries but it fails...)  [link]https://www.youtube.com/watch?v=AMVkOVPzOCw[/link] Can anyone please shed some light? Thank you in advance,Thanasis

Using 60C hardware I've been asked to connect to a vendor VPN gateway. The only details I have been provided are IP address, username and password, and the fact that we "are able to connect just by creating a VPN connection in windows".Connecting from a Windows box doesn't suit our needs.I'm familiar with ipsec point to point but not dialup.All the vpn information I can find is either point to point or where forticlient / iOS / M$ etc are the dial up clients and fortigate is the vpn gateway. I've searched this forum, the kb, the handbook and the cookbook.I found the Microsoft VPN section of the handbook but the fortigate is the gateway not the client. Even that mentions username, password and psk but we haven't been advised of a psk. Can the fortigate act like as a dialup client similar to a windows VPN client? Is the information provided to us sufficient? edit - we will have a dynamic IP and traverse a NAT.

Hello, I have configured site to site vpn between Fortigate 200D-800C, and the  tunnel is up, but there is no traffic going out and coming in, after investigating by capturing the icmp traffic, I found that the source address traffic is coming from the Management Interface rather than the required LAN Port 1. please helpThanksAhmed

I'm attempting to setup netflow and am not having any luck. I have a fortigate 80C and am using PRTG for monitoring. I followed these instructions found from Fortinet, but the probe says no information has been sent to it. config system netflow set collector-ip <address> set collector-port <port> set source-ip <address> set active-flow-timeout <integer> set inactive-flow-timeout <integer> end   I set the collector IP as the server address that has the PRTG probe on it, the port to a UDP port that wasn't used, and it matches what PRTG is looking for and I made sure there was a rule in the local firewall to allow it. The source IP I wasn't sure exactly what should be used, so I entered the routers IP address, and the timers I set to 1 and 15 respectively.   Any insights on how to get this fixed would be very helpful, I'm looking forward to collecting the data on my WAN usage.   Thanks   Jon

Hi All, I am a P-12 school and have a 300C running 5.2.3.  We have a mix of PCs, Macs and iPads.  While we have a Windows AD Domain not all of our devices are bound or login to the domain.  We don't have access to our WLC to do any Radius authentication. I'd like to setup the ability for staff to optionally authenticate with the Fortigate to gain extra web access.  This would allow them to access sites that are deemed inappropriate for the students.  I don't want to force the staff to have to authenticate all the time, and I don't want all our students to have to authenticate either. I am quite new to the Fortigate so am wondering how others would go about achieving this? Thanks in advance,Chris.

Hello, we are going to buy a pair of 2 new Fortigate 900D boxes to replace our old devices.Unfortunately, the Fortigate support/ intrusion prevention subscription for our old firewalls will end next month. Now I´m asking myself what will happen with IPS?[ul]Will IPS continue to work with old IPS signatures?Will IPS completely be deactived?[/ul]Thanks

Hi All, Managed to source a brand new Fortimail 100 but very old with V2 firmware.  Upgraded to 3.5.4 (Build 531) which seemed to go OK apart from a user auth prob on POP3 and IMAP.  The upgraded to 4.0.4 (Build 146). The upgrade seemed to go AOK.  Can login via SSH.Can login as a webmail userbut if I go to HTTPS://fortimail/admin I get the login screen, auth AOK but then I get to https://192.168.100.95/admin/FEAdmin.html but the screen is blank!I cannot get any admin view via the web access.Anyone got a suggestion? to make matters worse the box is now refusing SMTP connection attempts with Error 451 4.3.2 Try again later Should I just bite the bullet and do a clean install of 4.3.9 (Build 548) and just start configuring afresh?

Hi,if I try to update our FAP320C to 5.2.4 (build 245) i get an error with wrong Image. on the FAP is FortiAP-320C v5.2,build638,140916 (GA)... RegradsByterunner

We have an FG200B running v5.0.9 and we want to start using the Transparent Web Proxy features again (we do have an SSD in the FG200B).I configured a Policy limited to just a couple of PCs and ticked the appropriate box.  The Monitor in the FG200B shows that the transparent proxy is working.  So far so good.Now I want to configure an Exempt List for URLs which don't work so good with the transparent proxy. Nothing I can see in the GUI, so I check the FortiOS Handbook. It says go to "WAN Opt & Cache > Cache > Exempt List" ... except my GUI doesn't have this option.The handbook also says use "config wanopt webcache" and then "set cache-exemption enable" ... except my CLI doesn't have this option.Can anyone shed any light on this?  Does the FG200B simply not have this level of configuration available?  I know it used to be available back in v4.3, so was it removed for some reason?

Hey,I've been playing around with the new User-Source based policies but unable to make them work.I have the following policy which is placed at the very top of the list but it just doesnt work (see attached image).Instead, it falls through to another policy I have that allows internet for the entire office.What am I missing?ThanksGil 

How can I monitor/see all session of a particular IP?