Solved

Hi,I have the szenario that a ssl vpn (tunnel and web mode) is reachable at both wan ports that are connected to the internet. Since 5.2.4 I cannot reach the portal using wan1, but at wan2. A packet sniffer shows only a syn, but no ack. So, a simple https://public.wan1.ip failes, but https://public.wan2.ip works. If this a known issue? I plan to downgrade to 5.2.3 for testing and to reconfigure the fgt using a factory default, but not during the productive time. FGT110C with 5.2.4

I see that "Remote LDAP" groups can be created on the FortiAuthenticator.  Is it possible to import or use LDAP (Active Directory) groups in any way with the FortiAuthenticator? It seems like everything to do with LDAP can only be "managed" by the individual "name" and not a directory. This also applies to the FortiAuthenticator client.  We are implementing the client and I have to individually select EVERY single user that needs to be in bypass.  That is all the users to start while we roll out mobile tokens to everyone. Thanks, Chris

.

Hi All, When I login to my account in support.fortinet.com, I found out that there is a new FortiOS 5.2.4 release and I can't find any release notes yet for this version. Is it a BETA for testing? Can we use that already as latest firmware version in our fortigate? Any comments or info regarding above statement is kindly appreciated. Thank you. Kind regards,JAM

Hello, has anyone successfully created a pcks12 certificate using openssl and VeriSign to install a VeriSign certificate on a Fortigate device for the ssl deep packet inspection? If so, how did you do it? -Chris

Hi,i Really appreciate if someone could Help me, i'm new on the forumWell My probleme is :I have two Fortigate 100d in different site All the configuration is working perfect VPN Ssl Fortiguard....the only problémes that i have actually is With Webfiltering exactly with Youtube, See attached Picture before the filter was working normally without any probleme but actually inside the network youtube is working without by passing the filter, no authentification in the catégorie of Streaming media and download and the problémes is only Youtube .Other streaming website like Dailymotion are using the filter normally.and the problémes is the same with the two Fortigate on defferent site.Firmware V: 4.0Model: Fortigate 100 D Great Thanks for the Help,Best regards,Zito

Hi all,on Fortigate 90D I've configured a WAN1 interface with Public Range an everythings works well.Now I've requested a new connectivity (with another ISP) with a new public Range and I've already configured it on WAN2 interface without static route, only IP assigned to interface.Can you help me to understand this:1- How configure Distance and Priority in order to have WAN1 and WAN2 working together?My Goal is:ServerGroup1 -> WAN1 (already configured with static route 0.0.0.0/0.0.0.0 PRI: 0 DIST: 10)ServerGroup2 -> WAN2 (?) Thanks a lot.Regards.Leo  

Hi Everyone, I recently purchased a FortiGate 60D 3G4G VZW firewall and want to update to the latest firmware version. However, each firmware image I have downloaded fails to install, saying it is the wrong image type. I've tried a number of the 5.0 and 5.2 images for the "FGT_60D-v5-buildXXXX" trains. Each fails to install, despite being listed as a supported model in the release notes. This happens from the CLI or GUI, local upload or from Fortiguard services. Can anyone point me in the right direction to where I can get my hands on the correct firmware for this device?  Thanks!

there is dns server on fortigate 40c ? because when i try to make the router as dns server on my computer it's not getting any addressalso i don't see the feature here:config system global set fgd-alert-subscription advisory latest-threat set gui-antivirus disable set gui-application-control disable set gui-dhcp-advanced enable set gui-endpoint-control disable set gui-implicit-policy disable set gui-wan-load-balancing disable set gui-webfilter disable set gui-wireless-controller disable set hostname "FGT40C3913032173" set internal-switch-mode interface set timezone 04 and this command is not working: config system dns-database [style="background-color: #ffffff;"]command parse error before 'dns-database'[/style] [style="background-color: #ffffff;"]Command fail. Return code 1[/style] this is my firmware version:Firmware Versionv5.2.3,build670 (GA)

Hello, I've been running dual wan connections using ECMP Weighted Load Balance on my FWF80CM (v4 MR3 Patch 15) for a couple of years now. The solution has worked out pretty well but now I want to change this design to a more manual setup to improve control over how traffic flows through the device. My goals:WAN2 - Primary GatewayWAN1 - Failover Gateway Needs:I will still need to Policy route some specific traffic out WAN1I will still need to access VIPs setup on WAN1 externallyI will still need to access HTTPS admin on WAN1 externally To start off I assumed that I could just change ECMP back to Source IP (default) and then give WAN1 administrative distance higher than WAN2. Both WAN1 and WAN2 have static routes with the same distance currently. When I did this working remotely over HTTPS on WAN1 as soon as I applied the Admin Distance on WAN1 I lost my remote connection and found that I was also unable to access HTTPS admin on WAN2. In addition when I arrived at the

Hello, i have a big trouble with fortiwifi 80CM, its a new product to me, I did the installation myself, only have default configurations.. I have a 20mb internet speed, and before to install this forti my download speed was arround 20mb and 23 mb, and my upload speed was around 20mb to, so I introduce a fortiwifi 80CM, and I create 2 new SSID for internet access point, but when Im connected via wifi, my connections decreased, somethimes 10mb download speed and 2 or 2 upload speed, I dont know whats wrong, If fortiwifi doesnt work like a access point or what ? please HELP MEEE! regards!

If I buy extra VDOM licenses for a Fortigate 1000D and wish to buy a spare Fortigate 1000D to act as hardware failover do I have to buy seperate VDOM licenses for the hardware replacement or in the event of a failure would I be able to to transfer the VDOM license over? Thanks

I have an iOS Dialup VPN set up. I can connect to the VPN and ping/rdp to any host on the network if I use an IP but DNS doesn't work. I've configured the network's local DNS server in the settings but this didn't work. I can't ping by name, I also can't ping by FQDN. Any ideas?

Hello, Is there any CLI command(s) I can use to fully reset/purge one ADOM including the device, the package and the objects?Note I'm using FMAN v5.2.1. Thanks and regards.

HiI'd like to create second ospf process on FG 100d and 60C. Is this posible?How to do that?

Hi everyone,I've got a 600D that is used at a DC and a 300C that's used at the remote sites. The issue I'm running into is my vulnerability scanner is being stopped by the IPS, obviously, defeating the purpose. The scanner resides at the DC and scans the pcs on the LAN at the remote sites.  How would I go about creating an exclusion for my scanner? Thanks!

Traffic shaper in my FortiGate is not accurate and sometimes it doesn't work. I create several Per-IP traffic shapers profiles, then i apply in into policy. When i test internet speed in website speedtest.net. The speed is under what i limit. when i monitor it for one more day, all traffic shapers doesn't work and user can access the internet with full speed, while i haven't changed any configuration. Sometimes traffic shapers is under what is limit. sometimes all user can access the internet with full speed.Here is my configuration. config firewall shaper per-ip-shaper     edit "3-MB"         set max-bandwidth 3072     next config firewall policy     edit 16        set srcintf "port11"         set dstintf "port9" "port10"         set srcaddr "200.200.4.1-200.200.4.30_3MB"     &

Hi all,I was wondering if there is a kind a of all-in-one device with ADSL router and WiFi (dual radio) device in the FortiGate portfolio.It would be nice equip a small/home office with one device only to manage ADSL and WiFi connection. Thanks for all your answers M.

I created a new dataset to show the country for each logged in vpn-user. As the country is not stored in the vpn log I had to use the traffic log additionally. the problem is that I cannot use the $filter macro because I am getting an error: ERROR:  column reference "itime" is ambiguous LINE 1: ...om "FGTADOM3-elog-0" a, "FGTADOM3-tlog-0" b where itime >= 1... The dataset:select b.srccountry, count (distinct coalesce(nullifna(`xauthuser`), `a`.`user`) ) as f_user from $log-event a, $log-traffic b where $filter and a.subtype='vpn' and (a.tunneltype='ipsec' or left(a.tunneltype, 3)='ssl') and coalesce(nullifna(`xauthuser`), nullifna(`a`.`user`)) is not null and a.action = 'tunnel-up' and a.remip = b.srcip group by b.srccountry With a.$filter I am getting this error: ERROR:  column reference "itime" is ambiguous LINE 1: ...GTADOM3-tlog-0" b where a.itime >= 1435906800 and itime <= 1... Did anybody know how to solve this problem?

Hey Guy's, I am noticing consistent attempts to log into our device from our wan link (shown by the alert message console widget). I have not been able to figure out how to drill down and look at the IP that is trying to gain access. Any help would be greatly appreciated.  For now I have blocked all telnet and ssh attempts to the wan link and have the https access limited to static public IP's. Thanks in advance!

Hello all,i would like to use our fortigate unit in order to Block Tight VNC from entering or leaving our organization.how do i achieve it? Thanks,s.  

Does the 60D not support DOS-Policy GUI? Per the 5.2.3 release notes the following issue was fixed:260342 The DOS Policy ID may be missing in the GUI Thanks!  

Hi All I am new with fortigate 100D ver 5.0 firewall.I need your help how to allow specific users from LAN to access facebook?.step by step procedure would be really helpful. 

Can FG300D support site to site vpn with mikrotik router?I may need to enable site to site vpn with a 3rd party business network.they are using mikrotik brand of router with firewall features.what type of vpn method should i use? from their website, the following technologies are supported  Ipsec – tunnel and transport mode, certificate or PSK, AH and ESP security protocolsPoint to point tunneling (OpenVPN, PPTP, PPPoE, L2TP) Advanced PPP features (MLPPP, BCP) Simple tunnels (IPIP, EoIP) 6to4 tunnel support (IPv6 over IPv4 network) VLAN – IEEE802.1q Virtual LAN support, Q-in-Q support MPLS based VPNs 

Enable multiple IP addresses on VDOM-links VDOMs and VDOM-links are a great feature on the Fortigate Firewalls, however they have limited functionality compared to physical links. The one feature they miss that requires me to use loop-back Ethernet cables on the Fortigate is the inability to add multiple IP addresses. I also tried to workaround this by adding extra VDOM-links but they are not allowed to be in the same IP range. I hope you will add the very useful multiple IP feature to the VDOM-links in the near future.