Solved

I could be drawing a blank here: Is there an event handler or setting somewhere to alert when logs are not populating to the FAZ? - i.e. turning Red under Device Manager?

Hi everybody! Just a short question. A customer is asking us if it is possible to change the size of the mtu packets to 1500 in a gre tunnel. As far as I know, there's an overhead at the beginning of these packets depending the type of encryption used, so it wouldn't be possible to do this. Am I right? Thanks in advance.

Hi,I try to route a server via WAN1. Standard is wan2 When I try to enter so I always get a message Invalid IP range. Can someone help me pleaseRegardsSebastian

Hi all! I'm currently using FortiGate 800C with firmware v5.2.1 in transparent mode and created one Ipsec VPN tunnel. Is it possible to automatically assign IP addresses to VPN clients with FortiClients? I've checked "set assign-ip-from", "set mode-cfg" and "set dhcp-ipsec", but all seem unavailable in policy-based VPNs. Thanks! 

Hi, I need to use FortiClient IPSEC VPN using the new version, however, I have only the old configuration - extension - vpl. The new configuration on FortiClient 5 is conf (it seems).  I was not able to find out any information in how to import this vpl extension to the new one, it seems that there is a tool - FortiClient Tools that allows to convert it, but when I try to get this tool on FTP, an USER and PASS is requested.  ftp://support.fortinet.com/FortiClient/Windows/v4.00/4.0MR3/MR3_Patch_5 FortiClientTools_4.3.5.0472.zip Does anyone know how to convert it or make it available from vpl to new one? or at least to provide me this file to do it? thank you. John.

Hi there is anybody actually using the central VPN console mode in fortimanager? I am trying to convert VPN Configurations and have all sorts of trouble, e.g. creating a phase 2 to an external (non managed) Hub that needs a src-subnet and dst-subnet. Seems to be impossible, however...?

Hi Guys Has anyone SAT the NSE4 exam so far, i am taking this exam next month, please share experience and tips for all the people like me. RegardsSandeep 

Dear All, few months ago I configured VLAN on my network and it worked corectly. After I have changed router to FTG 80C (5.2.5) the VLAN stopped working. I use HP switch which supports VLAN - I didn't change the configuration on it. I use on FTG advanced routing. Idea is:LAN - 192.168.1.0/24VLAN - 192.168.5.0/24 - access to Internet but no access to LAN Fortigate 192.168.1.99 <-> hp switch 192.168.1.106 (VLAN 192.168.5.2) <-> tp-link switch (WAN 192.168.5.3) I added on FTG VLAN interface 192.168.5.1 and policy VLAN -> WAN. When I am connected to tp-link I have no access to Internet - I can ping 192.168.5.2 but I can't ping 192.168.5.1 (VLAN interface on Fortigate). I think that I should add some Static Routes or Policy Routes? Thank You in advance,Bart. 

I'm somewhat new to Fortinet products so I seem to need some help that is not obvious to me in the documentation.  We've had FortiAnalyzer for about 6 months.  Logs from various Fortigate devices are forwarded here.  But the oldest logs I can find are only 38 days old.  I'd like to have at least 90 days of logs available.  The dashboard shows 8% Hard Disk Usage and has stayed at that level for quite a while so it certainly has space to spare.  How can I increase our Hard Drive Usage, that is, retain logs longer? File Management?  None of the File Management settings are set.  Would I achieve my goal by changing the File Management's "Automatically Delete" setting for "Device log files" to "older than 3 months"? 

i have FG 500 A  and i try to restore the conf file to 80C   from USB but it give me Copy config 1.conf from USB disk ... Get config file from USB disk OK. Invalid config file Command fail. Return code -39 can any one help thanks 

Is the FGT60D V 5.2.5 capable to scan antivirus in https? I don't see any hints in the Antivirus Profile which point this out. When i take Proxy mode i see only the standard protocols but no https for example. In other words how can I see if FGT 60D can ssl-deep scan?

When configuring an SSLVPN in tunnel mode why do we have to specify source IP information in the VPN > SSL > SETTINGS screen under Tunnel Mode Client Settings as well as in VPN > SSL > PORTALS in the Source IP Pools field when checking Enable Tunnel Mode?  If I don't get an answer I will lab it up and find out but I'm hoping to save some time. I suspect it has to do with Authentication/Portal Mapping but I would like some confirmation on that.   Does the settings config assign the IP ranges that WILL be used when a tunnel mode client connects and the Portal setting is used separately to define configuration sent to the Forticlient for remote policy definition? Are they purely redundant configuration fields? Does one setting just give you more granular control over assigned IPs to specific users/groups?  ie Does the IP pool in the portal config trump the IP Ranges value in the

Hi, I have some trouble with DHCP for the secondary IP on the internal Interface. So far as I could read it seems that the DHCP-Server only listen for request at the main IP but not on the secondary. My Device is the FG/60D with V5.2.5 Does the scope of DHCP only for the main ip of the Interface or is it a bug? Normaly DHCP makes a broadcast request so it goes regardless which IP is defined to the DHCP listener  (in this case the internal interface). The main ip here is 192.168.1.250 the secondary is 10.10.90.250 both with mask 255.255.255.0 The ping on both networks works as expected.The policy rule allow all services in both networks. When I configure the remote device with static Ip for the 10.10.90.x Networkit works but on DHCP it will never receives an IP. When I configure the DHCP with Network 192.168.1.x DHCP works. I have seen solutions who says to create a new interface which was on the subnetor VLAN but I belive that there must be give another way to solve

Hi,Is it possible to add radius server groups in FortiOS? I can only see primary and secondary radius servers under one name? Also I can bind multiple radius servers to user groups. With that will the users get authenticated from any of the linked radius servers? Thanks,Raj 

I am a relative newbie to Fortinet that has a small amount of Fortinet experience but now I need to learn more.  I am fairly conversant with Cisco stuff.Object - to eventually have two tunnels using certificates going to different networks.Plan:1. To set up a direct connection without anything, just wire to wire2. Demonstrate one ipsec tunnel using passwords/passphrase3. Demonstrate two tunnels using passwords/passphrase Tear down the above4. Demonstrate one tunnel using a certificate5. Demonstrate second tunnel using passwords/passphraseTear down password tunnel above6.Demonstrate a 2nd tunnel using a certificate Endstate possibilities: 2 tunnels using one each certificate/passwordand 2 tunnels using only certificates So what I'm playing with: laptop(192) -> Fortinet(.1) -> Fortinet(.2) -> laptop(172) Direct connection: laptop -> Fortinet -> Fortinet -> laptopfrom either laptop I can ping the local and remote Fortinet but not the remote laptop&nbs

Fortigate 90D (v5.2.5)I have two offices connected by a site-to-site IPSec VPN: 192.168.2.0/24 and 192.168.4.0/24.If the VPN is down, any traffic sent to the other office gets routed to the Internet.However, when the VPN comes back up, any IP's I tried to access while the VPN was down still get routed to the Internet while other IP's in the same subnet get routed correctly.For example:My computer is 192.168.2.99, my local Fortigate is 192.168.2.1 and I'm trying to access 192.168.4.5 and 192.168.4.50 on the other side of the VPN.  I pinged 192.168.4.50 while the VPN was down.  The VPN is back up when I run the two tracert commands below, one right after the other.  One gets correctly routed through the VPN and the other through the Internet: C:\>tracert 192.168.4.5 Tracing route to 192.168.4.5 over a maximum of 30 hops: 1 <1 ms <1 ms <1 ms 192.168.2.1 2 * * * Request timed out. 3 44 ms 44 ms 49 ms 192.168.4.5 Trace complete. C:\>tracert 192.16

Hi there, Please i need help with a dataset that shows the number of mails blocked by address. Is there anyone that can help me?. Thanks in advance and best regards,Jose

Good afternoon! I have to make a report with the users whose traffic exceeds 8 GB per month. I formed Daset and it works correctly.Dataset:select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and logid_to_int(logid) not in (4, 7, 14) group by user_src having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>8589934592 order by bandwidth descAnswer dataset: User135,369,256,69134,364,302,1501,004,954,541128,694User221,554,866,67321,068,549,543486,317,13038,515User320,008,767,42719,264,670,852744,096,575174,823User417,295,362,95115,710,305,4861,585,057,46582,488User515,714,387,91614,970,889,199743,498,71766,21User613,465,465,87413,009,276,608456,189,26697,073User712,417,131,22012,099,502,104317,629,11648,073User812,380,196,76611,028,109,6931,352,087,07357,715Use

Greetings all. New Fortinet user here. I'm hoping one of you SQL query gurus could help out with a custom dataset which meets the following requirements: - Lists all individual blocked session details for specified web filter categories.     - Session details include: category, timestamp, user, srcip, dstip, hostname, and url.     - Sort is ascending by category and then timestamp.     - Should be able to edit the categories on the fly before running the report. Let me know if there's more information needed. Thanks in advance.

Hi, I have a FortiWifi 60D with actual Firmware Version 5.2.5. In the FortiAp Profile exists an Profile named 11n-only which cannot be deleted. The button is greyed out. I have checked all dependencies but there exists nothing to this profile anymore. My next step was to delete it via cli but the result was : Can not delete a static table entry Command fail This entry is shown: FortiWifi-60D # show wireless-controller wtp-profile 11n-only config wireless-controller wtp-profile     edit "11n-only"             config platform                 set type 60C             end         set ap-country DE             config radio-1              

a little disappointed..no enhancements..it's just a bugs fixed release....[size="5"]definitely 1 of terrible f/w for FOS...[/size] UNSTABLE GUI[size="6"]ANNOYING SSL VPN problem..............[/size] [size="3"]fortinet, I think you must quickly push out next fixed release or give some explains.........[/size] 201508020844, CSB-150730-1-Partial-Config-LossFortiGate models listed below may lose configuration pertaining to IPsec interface, virtual access point interface, loopback interface, or virtual-switch interface after a reboot when the FortiGate is deployed with FortiOS 5.2.4 with build number 0688 and time 150722.FGT20C3X12000161 # get sys statVersion: FortiGate-20C v5.2.4,build0688,150722 (GA)Potentially Affected Products: FortiGate: FG-20C, FG-20C-ADSL, FG-30D, FG-30D-PoE, FG-40CFortiWiFi: FW-20C, FW-20C-ADSL, FW-30D, FW-30D-PoE, FW-40CResolution: FortiOS 5.2.4 software images for the models above have been rebuilt and re-posted on the customer support web site

Hi All, working with the fortigate 30D and the web filtering isn't working.  if you look below, this is my response to checking if the web filtering is running# diagnose debug ratingLocale : englishThe service is not enabled. but everything on the gui points to it being turned on.  Can anyone suggest something?  If I can get this up I may look into it running in transparent mode. Thanks All,Lucas

My issue is that I can't ping devices connected to the remote gateway. The tunnel is working just fine and I can ping the remote gateway. The remote gateway is a FortiGate 60D on Firmware v5.2.3,build670 (GA). Here's the (simplified) network setup: device1 (192.168.200.11) | (remote net 192.168.200.0/24) |FG-60D (192.168.200.10 on internal interfaces) | (IPsec tunnel) |local GW (192.168.180.70) | (local net 192.168.180.0/24)On the FortiGate CLI device1 responds to pinging and also devices on the local net respond. But I can't reach device1 from the local net. I'm suspecting the error might be, that I haven't configured the IP and Remote IP on the VPN interface. They're set to the default value 0.0.0.0. I tried entering the Fortigate's IP 192.168.200.10 and 192.168.180.70 as Remote IP. But because I've configured that IP already for the internal interfaces I get the error "IP address is in same subnet as the others".  What sh

Hi all, Does forticlient support other VPN server? Or it can only be configure to connect to the fortigate itself? Thank you for the feedback.  Regards,JAM

When Anti-maleware is deployed in the Flow Mode (versus Proxy Mode), what happens to the detection rate? - It dramatically decreases - it decreases slightly - stays the same - increases