Solved

Hello, I'm newbie here. I need some technical advise from you all. Our company is based in Singapore and just implemented SSL VPN using fortigate 90D. Our goal is to access google drive and some trade markets websites when my users were in china. As you guys know china got blocked a lot of websites. Today i have tested google drives can access once ssl vpn is connected back to Singapore but other websites is still not able to access (for example- bloomberg, facebook and others. Is there anyway to by pass china firewall to unblock all those websites? Really appreciate your advise. Thanks you. Have a nice day. :)

Hello, is ist possible to disabling the whole Wlan-Module of the Forti, not only disabling the SSID Broadcast? THX

We were doing some penentration tests on our systems and we found out that on our FortiGate 200D which has SSL VPN enabled it is susceptible to the LongJam attack. In the SSL VPN Settings, the below values have been set:    set algorithm high     set sslv2 disable     set sslv3 disableIn the Global COnfig, the below settings have been set:    set strong-crypto enable Yet, when we perform the test again, the below output is presented to us:Vulnerable connection combinations :   SSL/TLS version : TLSv1.1   Cipher suite : TLS1_CK_DHE_RSA_WITH_AES_256_CBC_SHA   Diffie-Hellman MODP size (bits) : 1024     Warning - This is a known static Oakley Group2 modulus. This may make     the remote host more vulnerable to the Logjam attack.   Logjam attack difficulty : Hard (would require nation-state resources)   SSL/TLS version : TLSv1.1 &n

Hi, I found an extremely strange behavior in the FortiOS 5.2.3 on our FGT 110C.FG-GW # diagnose sys link-monitor statusLink Monitor: gwdetect-upg-1 Status: alive Create time: Sun Mar 29 01:17:53 2015Source interface: wan1 (3)Interval: 5, Timeout 5Fail times: 0/5Send times: 0[...]    protocol: ping, state: alive[...]Link Monitor: gwdetect-upg-2 Status: alive Create time: Sun Mar 29 01:17:53 2015Source interface: wan2 (10)Interval: 5, Timeout 5Fail times: 0/5Send times: 0[...]    protocol: ping, state: alive[...] seems to be correct, but FG-GW # diagnose sys link-monitor interface wan1Interface(wan1): state(down, since Sun Mar 29 01:18:21 2015), latency(8.96), jitters(18.33), session count(639), bandwidth(55977)FG-GW # diagnose sys link-monitor interface wan2Interface(wan2): state(down, since Sun Mar 29 01:18:22 2015), latency(21.22), jitters(8.04), session count(81), bandwidth(30896) show's down links. The same output are shown

The purpose of the Learning forum is to promote informal learning within our user community: **Prototype new training material prior to formal training release **Provide just-in-time learning updates to partners who have already attended formal training. Training Services will post regular updates and moderate this forum. You are welcome to post references to any learning resource which has helped you learn Fortinet products and technology, and ask questions to the learning community. Many thanks.

Hi,I am wondering if there is a CLI commando to change country on the AP? reason I ask is that when i change country on the profile the Accesspoint will not change, i have 10 223B accesspoints and one of them is not changing country to NO(norway). 

FNGFortianalyzer 5.2.4 FortiView:What are the list of values for the Action column?  I see Accept and Close for example.And what are the list of values for the Security Action column?  I see Allow or it's blank.And when you see something like the Action column has Close in it, and the Security Action column has Allow in it.  What does this mean?And I've searched the manuals for the values and I didn't find them.   

Greetings! Good day to everyone! Our school is currently setting up a topology similar to Ken Felix's article on this link - http://socpuppet.blogspot...arent-using-inter.html > Awesome article by the way :) We were able to make the said topology from the article to work but we need to modify it for the setup that we want. Our servers are connected to the Root VDOM through an independent interface. We have another VDOM in transparent mode connected to the Root VDOM through a virtual link. DHCP service is provided through the virtual link. Internet connection is provided by a separate firewall connected to the transparent VDOM.With the current setup, we didn't have any problems in terms of connecting to the internet. But the challenge would now be accessing the servers. We can't seem to connect to them. Running a traceroute from the LAN shows that the traffic goes out to the internet through the gateway 10.199.199.254. We are still getting accustomed at configurin

We upgrade our Fortigate 60D to 5.0.4 version, put it in " Interface Mode" and create 2 ipsec vpn tunnels with 2 phases ok to connect to our old cisco router (using dial up vpn) The problem is i cant create the vpn policy for IPSEC, it only show me te SSL VPN options. We have a 60 C with 4.12 with this configuration working ok. Thanks in advance

Hello,i have fortigate 200D ver5.2.3 i want to know the antivirus take update or not and also for the other fortigaurd services   thanks

Dear all, I have this scenario:Site DC - Datacentre in GermanySite France - Branch Office in ParisBoth locations have a FortiGate and their own Internet connection (SDSL). This connection is used for IPSec Phase1 Interface Mode Tunnels to establish the inter-site connection to reach services in the datacentre. This works well since two years.Devices located in France use the on site Internet connection, the FortiGate there is the default gateway, for everything. But they connect through the VPN tunnel to the terminal server (Citrix) with their PCs and terminal clients and are using the Web there. This is done with a static route, which is a common configuration. But wow the public IP of the provider in Germany is used, and the users often get the German site, like Google, Amazon, etc. To avoid this my plan was to redirect on the FortiGate in the datacentre with a policy route the traffic for HTTP port 80 and HTTPS port 443 for the source IP of the Citrix server back through the VP

I create guest user, but not send credential via sms or wifi ?these options are operative?  You suggest me know how to configure them? RegardsLuca

All, Can anybody here assist me with outbound traffic events. (from a small number of our internal hosts to the internet) Event: SSL.RSA.Temporary.Key.Security.BypassAdditional information: http://www.fortinet.com/ids/VID40207 Since a few months a fairly small number of machines generate an awful lot outbound events to specific IP addresses.We are pretty confident this is not something to be worried about as we have leveraged additional tools to investigate our internal hosts. Still very interested what this can be related to. As a reference point, in the month of January 3 hosts generated 40825 events. Following IP addresses are noted for these 3 hosts as the Destination address they are communicating with. (AT&T addresses belonging to CerfNet) 12.130.55.203: 14928 events12.130.55.186: 5279 events12.130.55.56: 10519 events12.130.55.172: 3346 events12.130.55.187: 3386 events206.19.56.155: 3347 events Anybody any idea? R

I have a little script that uses scp to download the current configuration to my server, there's a second part of the script that does a diff with both files and warns me when there have been modifications.I am having an issue with the  private keys for "Fortinet_CA_SSLProxy"  and for "Fortinet_SSLProxy", weird enough the certificates are the same all the time, so i'm a bit lost here. Aren't the backups mean to be identical? (other than the  conf_file_ver)? 

I am trying to install a wildcard SSL cert from Go Daddy and having issues.  Anyone have some documentation on this?  I have seen documentation with regular certs and a CSR but this does not require a CSR.

Hi ! I have a Fortigate 90d model, and i have to open ports like 6080, 1433 and 1434. I wish that those ports to be open only to a single internal IP addressWhat should I do for make this simple task ?

I have a need to NAT outbound traffic to a specific Range if the traffic needs to go across a L2L tunnel. Remote customer gave us a range, so traffic going to them is 'seen' as from that range. I have the L2L tunnel up, how do I make the fortigate nat the traffic?  Thx

Hi,In an A-P HA cluster, with the Master down (Slave has become Master), what happens when I go and change config and the actual master comes back and takes over as master again? Will there be a config sync issue?Thanks for any insight. Bye,Marki

Hi my foriclient has been working fine for 3 months until today,  on Windows 10.  Defender is disabled,  no other AV / Spyware etc installed.... have confirmed that Defender isn't running Started the PC today and I am seeing the windows notification panel flashing constantly with "Update Virus Protection Virus Protection is out of date, Tap or click to update Foritclient Antivirus" which is then after a second or so is replaced with "Update Spyware Protection Spyware Protection is out of date, Tap or click to update Foritclient Antivirus" This cycles constantly,  if I click the notification, occasionally a windows Security and Maintenance window appears asking me do i want to run this app... the app is "c:\program files (x86)Fortinet\forticlient\FCWsc.exe" ... I allow this... nothing then appears to happen I can't open the Forticlient Console,  click the tray icon,  select open console... nothing happens. Can't uninstall as the For

Hi Guys, I did not passed for the NSE 400 exam last week ( 63% :( ). One of the Q's was as follows: Which model's supports built-IN enabled DHCP while installing the Fortigate for the first time. I cannot find any documentation and/or list which describes this. Could someone know which model's does? Thanks in advance!

Hello,i have fortigate 200D i want some one tell me how to download and install fortianalyzer  thanks

I have a 600C with a recurring crash problem.  It is running 5.0.11, but the problem has persisted since 5.0.4 or so. About every 1-3 months, the gui will show that all interfaces are connected at 1GBPS and that each port has sent/received approximately 191 billion packets if I over over a port (not shown below).    Once the gui reaches this state, it is usually about 2-3 days before the firewall stops working altogether. At that point, I need to do a full power down/power off reset. If I just do a warm boot, it will not recover and will stop mid-boot with an error message. Has anyone experienced anything similar with a 600C? I am beginning to think this is a hardware issue. Suggestions welcome. Thanks.  

Hello, I am pretty new to Fortigate products, so sorry in advance for any confusion in my post. I am using a fortigate 60D in dual WAN and using it as NAT mode. We have three ISPs at work, and want to use two ISPs at the same time to do traffic load balance (currently static routes are used for particular traffics), and want to use the third ISP as a backup for automatic failover. Is there any way how I can use the DMZ port as WAN3 to achieve above?

Hello! Guys, need help to solve the problem. There is one ISP, one cable is connected to the first port of FG300D. I have a block of IP addresses – for NAT and Transparent modes. I need to create 2 VDOMs - one of them will work in NAT mode, the other will be in Transparent. Unable to add already used by root VDOM WAN interface to the second VDOM (Transparent). Is it possible?I’m sorry for my English  - I am doing my best )))  

helloi'm looking for a guide (video) to configure exchange 2010 on fortigate 80d.Thanks