Solved

i have tried to configure dnsbl , i want someone correct me if the below configure is ok or not:config spamfilter dnsbl Edit 1 set name "Dnsbl " config entriesEdit 1 set action reject set zen.spamhaus.org server set status enable nextEdit 2 set action reject set server dnsbl.spamhaus.org set status enable nextend thanks

I am using fortigate 200B with OS v5.2.4,build688 (GA).I have configured bword from the CLI, it works before the firmware upgrade.Unfortunately, I forgot which version of firmware can be working well.Anyone can help?Thanks.

Hello! I would like to make a automated backup for the fortimanager (400B OS 5.0.6). What solutions are there? Thanks for answers! kind regards - maximilian

Does anyone know if you can configure RADIUS groups for the FAZ? I can't seem to find any information on this in the admin guides or CLI. What I'm trying to do is have users loging to a RADIUS server (FortiAuthenticator in this instance) and from there be given role based access. For example if the user belongs in the 'admin' group they would be given full access, but if they're in the 'partners' group they would be given access to the report/fortiview. I'm going blind trying to figure this out! :)

Hi. Having strange problem. I created some SSL VPN accounts about a month ago. For some reason, I'm now unable to delete any of them. I can edit them. I can create new accounts and delete those new accounts, but anything I created a month ago cannot be deleted. Any ideas? Thanks in advance.

Hello, Having issues keeping a IPsec Site-to-Site tunnel up.. I am having FG60D device successfully connect to azure using FortiGate Cookbook - IPsec VPN to Microsoft Azure (5.2)   but tunnel got disconnect frequently in few hours and Had to reboot 60D always to get the tunnel bring up firmware version : V5.2.6, build711 phase 1 proposal : encryption AES 128 authentication SHA256encryption AES 256 authentication SHA256encryption AES 128 authentication SHA1encryption AES 256 authentication SHA1Diffie-Hellman group       : 2key lifetime                    : 56600 seconds  phase 2 proposal : encryption AES 128 authentication SMA1encryption AES 256 authentication SHA1encryption AES 128 authentication SHA256encryption AES 256 authentication SHA256 Replay detection

We have a Fortigate 600C. At the moment you can get to our Firewall admin page through https from the internet. What is the best way to lock down this access to only allow access from specific IP's? So, we would still like access to the admin page and to get logged in from the internet, but only from specific IP addresses.  Thanks in advance. New to Fortinet and need all the assistance I can get.  

In our Fortigate 100D we enabled IMPA and POP3 profiles, but need to make sure the antivirus is working as expected, for that how one can run an attack test ?

Couldn't find anything straightforward about disabling SSL v2 on Fortimail. Executed this command which seems to have helped:Config system global                Set strong-crypto enableEnd we are running v. 4 codeLet us know if there's a better way, or if this helps you. 

Hello all, I try to add our new FortiGate 200D to our monitoring. Unfortunately I got some confusing output when I did a "snmpwalk" to the firewall. Normally the physical ports 9,10, 12,14 and 15 should be "up". But when I do a snmpwalk on the "ifOperStatus" it is IF-MIB::ifOperStatus.1 = INTEGER: down(2)IF-MIB::ifOperStatus.2 = INTEGER: down(2)IF-MIB::ifOperStatus.3 = INTEGER: down(2)IF-MIB::ifOperStatus.4 = INTEGER: up(1)IF-MIB::ifOperStatus.5 = INTEGER: up(1)IF-MIB::ifOperStatus.6 = INTEGER: down(2)IF-MIB::ifOperStatus.7 = INTEGER: down(2)IF-MIB::ifOperStatus.8 = INTEGER: up(1)IF-MIB::ifOperStatus.9 = INTEGER: up(1)IF-MIB::ifOperStatus.10 = INTEGER: down(2)IF-MIB::ifOperStatus.11 = INTEGER: down(2)IF-MIB::ifOperStatus.12 = INTEGER: down(2)IF-MIB::ifOperStatus.13 = INTEGER: down(2)IF-MIB::ifOperStatus.14 = INTEGER: down(2)IF-MIB::ifOperStatus.15 = INTEGER: down(2)IF-MIB::ifOperStatus.16 = INTEGER: down(2)IF-MIB::ifOperStatus.17 = INTEGER: down(2)IF-MIB::ifOperStatus.18 = IN

I have a problem with instalation FortiClient version: 5.4.0.780. Windows 7 Professional x64. At the end of instalation i have a few errors and I can gothrough this http://zapodaj.net/63f68bd238067.jpg.html http://zapodaj.net/f8f3692fa84c5.jpg.html I have traied with restarting and F8 but i work only for a time I again restart my PC and then shows up recovery and delete whole FortiClient. Sorry for my English.

Hi, on Fortigate 100D ver 4.x we used a FSSO with FSSO Agent installed on Active Directory server with no trouble. After change firmware to 5.2 and FSSO Agent to 4.3.0159, users started complain about websites: sometimes websites opened and sometimes not. I decided to change SSO method to Polling. I configured everything with no luck. no users are shown in User & Device -> Monitor -> Firewall -> Show all FSSO Logons. The " diagnose debug authd fsso server-status" command shows only " Local FSSO Agent" !! which is not visible under User & Device -> Single Sign-On (I even deleted everything I created before): LDAP test: pass. When I add a SSO, the status is always grey X mark.

new release is available in the download portal...

Hello,I have successfully connected site to site IPsec connection to azure and everything working fine except the dns. I have my windows DNS server in Azure network So my client have to get dns query through IPsec tunnel I am confused configuring DNS in FG60D See the attached image for current config Please let me know how to configure DNS on FG60D to get query from azure vm. ThanksNihal     

Several people convinced me that the next platform I should learn is Fortinet's, so I just got a used FortiGate 90D. Amusingly enough, it still has support and contracts for a few more weeks, so I updated it to 5.4, build 1011. I can't seem to find a way to set up a VLAN that is tagged on one physical interface and untagged on another. On JunOS, I would do this: set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode trunk set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members userVlanset interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode accessset interfaces ge-0/0/1 unit 0 family ethernet-switching vlan userVlanset interfaces vlan unit 10 family inet address 192.168.10.1/24set vlans userVlan vlan-id 10 set vlans userVlan l3-interface vlan.10 That would tag the VLAN out port 0/0/0, not tag it out port 0/0/1, and the router would have a layer 3 interface on the VLAN that can be reached from either to act as the gateway for all traffic on

I have configured LACP link (2 port) on Cisco 3560 and FG310B, everything seem be fine, but when I put traffic on this LACP link, traffic just rided on one physical link, when I shutdown one port of LACP, traffic switch to another. It didn't load share!Do I have to config somthing futher on Fortigate ?

Hi there Specialists,I have a question regarding custom IPS rules. I've wrote multiple IPS custom rules to prevent locky infections. The rules contains a pretty common attachment name, but for now it's being used by the locky ransomware so we would like to block all the SMTP attachment containing the name we defined ( see rules ). The rules are:#SMTP F-SBID ( --name "ITCustom.Locky.SMTP.TCP.Feb21-1"; --protocol tcp; --ipver 4; --pattern "invoice*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "IT.Custom.Locky.SMTP.TCP.Feb21-2"; --protocol tcp; --ipver 4; --pattern "invoice_*-*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "ITk.Custom.Locky.SMTP.UDP.Feb21-1"; --protocol udp; --ipver 4; --pattern "incoice*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "IT.Custom.Locky.SMTP.UDP.Feb21-2"; --protocol udp; --ipver 4; --pattern "invoice_*-*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) #HTTPF-

Hi, Im trying to use Open Directory LDAP authentication for VPN logins.I've set it up for multiple Active Directories and it works great.But Open Directory does not have a memberOf attribute on user object.I have found a couple of suggestions on google, but have found nothing that works. my config is:config user ldap   edit ldap_name      cnid mail      dn dc=server,dc=domain,dc=local      type regular      username uid=username,cn=users,dc=server,dc=domain,dc=local      password *      group-member-check group-object      group-object-filter "(&(objectclass=posixserver)(memberUid=*))"      member-attr gidNumberend If I allow any LDAP group in Group on Fortigate it works.If I try to specify a group it doesn't match.&

Hello,How to block access to my device using a public address from the Internet?just i want access it form my internal network.  thanks in advice 

Hi Everyone, The IP addresses on our internet facing physical interface, as well as on the VIP IP addresses recently got flagged as vulnerable DNS open resolver servers. This surprised me, as we do not run any internet facing DNS servers and have never explicitly configured the Fortigate (FortiOS 5.2) firewall to listen on port 53, or forward port 53 traffic to an internal DNS server. But when I checked an IP address with openresolver.com, sure enough, that says the IP address is listening on port 53, and is vulnerable to a DNS amplification attack. Anyone know what gives? Thanks!

I've started yesterday by installing Forticlient, "VPN only feature". Was not working at all. I mean in console was not usable, just a "Navigation to the webpage was canceled", settings again displayed nothing.After trying to run it in compatibility mode or as admin, gave up, uninstalled it an reinstalled "full flavor". Now some things started to work, it was showing some messaged. But still not working.So next was to let windows update to latest build, "Version 10.0.14257 Build 14257" (Insider build)Now I was able to view the screens configure a VPN connection (SSL-VPN) and try to connect to it.1st attempt caused a windows crash. Next attempts ended with connection going up to 48% and then show a "Access denied.  (-455)" message.As a side note, when trying to click on systray icon and select "connect to .... vpn" I only got a "Failed to start Forticlient Console." message. (does not take UAC into account?) Is this software suppose to work somehow? Is there one being able to

hello everyone,  I am a newbie to Fortigate VPN connections. We have a VPN  connection (Fortigate 200D) with our partners usine Cisco ASA. I need to add a second subnet at our end to the VPN and also additional remote subnets to the VPN tunnel. I really need all the help i can get with this.  Thanks 

Hello everyone I am all new to Fortinet and FortiGate, though i am a quite old Networks "user" Right now i am in the process of swapping a Juniper SRX100 with a Fortigate 92D and a Juniper SRX240 with a Fortigate 140D-POE (+FAP321C)In general i find all the configuration points i wish (and can dream of) and  always amazed how easy and efficient everything is (especially coming from Cisco, Juniper and other Checkpoint products) The only thing i am struggling with right now is the setup of the LANs and VLANs (i didn't think that going full VDOM was necessary) I attached a quickly drawn high level concept of the network to give an idea of what i am trying to achieve I am working with 3 VLANsGreen - 192.168.1.0/24 - DHCP server activeAmber - 192.168.10.0/24 - DHCP server activeRed - 192.168.100.0/24 - DHCP server active Green is reserved for trusted devices (PCs, Macs, iDevices, ...)Amber is reserved for internet facing servers and other de

I'm experiencing an issue with FortiClient where it has suddenly completely stopped working. [see screenshot below].I've searched everywhere for a solution to this issue but haven't found any solutions. I've tried disabling all my anti-virus applications as well, and that still doesn't help.I've also tried installing just the SSL VPN application but it gets stuck at 98% for about a minute and then switches back to disconnected. Thanks in advance to anyone with a solution! 

Hi, We are using Fortigate 200A with version 4.0 (MR2 Patch 2) and active fortiguard license.Is it possible to configure web filtering (restrict the torrents, streaming contents) based on time period, likeblock between 6 AM to 6 PMallow between 6 PM to 6 AM next day If its possible, how to configure ?Can any one of you help me here. Thanks in-advance.