Solved

Hi All,I have a 300D firewall,  came across something i think is strange hopefully you lot can shed some light on it.in a nutshell my policy  looks like thisInternal > External from any source adress to destination FQDNsometing.com | schedule always | services TCP-51460 allow/accept ........ if i go to my browser and type in the URL somthing.com:51460.....nothing happens , if i run a sniffer in the external interface no packets for that port , as soon as i change the services to all instead or TCP-51460 it works and the sniffers sees packets (obviously) please let me know what you think is wrong ?  Shane

Traceroute for remote address across the VPN showing the incorrect second hop. The second hop is going through the 'mgmt' 'DMZ' 'wifi-controller' interface. This happens because the VPN interface has an IP address of 0.0.0.0 so the FortiGate uses the first interface according to the ifindex number. Does this matter or what interface should i set it too? i have multiple vlans however I use one vlan for all internal connection traffic.

Hi,We are using Fortigate 200A with version 4.0 (MR2 Patch 2) and Fortiguard license expired.Now, we are planning to block few websites to overcome Internet Bandwidth high utilization issue.I have configured Webfilter under UTM services, but it does not work. I think its because of no FortiGuard active licence. I heard that we can use Static Filter list here. Can someone guide me, how to use it, since I do not see static filter option in GUI mode. Or is there any other way to block websites without having Fortiguard active license. Thanks and RegardsNaveen

Hi Everyone,This is Naveen and I just joined this forum. I see It is very good forum with all useful discussions.I have a problem with Log and Reports. We are using Fortigate 200A with version 4.0 (MR2 Patch 2) and Fortianalyzer 1000B with version 4.0 (MR2 patch 2). In FortiGate, I have configured "Remote Logging & Archiving" with FAZ Ip address with minimum "debug" level.I am able to see all event logs in FAZ, but unable to see Trffic logs. I think, because of this issue, FAZ is unable to show the reports and it says "No matching log data for this report". I have configured Layout, Data Filter and Schedule in FAZ. It will be appreciable, if someone can help me to address this issue.

Hello, Quick question: In order to allow Skype to continue to function after putting P2P blocking in place I had place a monitoring rule explicitly for Skype above it. This allow access to Skype but fills up my logs with constant entries. What's the best way to set this up so I don't monitor Skype at all? Thanks!

Hi, I'm pretty sure that this is a self answered post, but here goes... Network has switches at the access level, all of them trunked with the company vlans to a distribution switch, which is trunked up to the fortigate - see simplified diagram network.jpg The vlans are being routed at the distribution switch, so this switch is the gateway for each vlan. the gateway for the switch is the fortigate of course. the trunk between the distribution switch and the forti includes the vlans also - just because i want the forti to detect the devices being connected on each vlan, other than that if i could i would eliminate this trunk. Upon setting this up (which is a production system that had no vlans and is heavily secured with both device based rules and FSSO rules), the FSSO rules keep working great. As for the device based rules they stopped working. My assumption is that when datagrams reach the distro switch and then are forwarded to the fortigate, the m

Hello all, out of curiosity I joined the public beta and installed the iOS9 beta on my iPhone. I had an existing IPSec VPN connection that I created a while ago using FortiOS 4 on a 40C. The upgrade from 4 to 5 (and now 5.2.1) was problem-free, and the IPSec tunnel works as-is on my iPad, but my iPhone running the iOS9 beta doesn't seem to be able to use the VPN connection properly. I even created a new tunnel using the VPN Wizard for iOS devices, and the same behavior is observed: The iPhone connects just fine, but when sending traffic, I see the traffic coming in through the tunnel, leaving the egress interface (in this case, the LAN), being answered and the packets coming back through the Fortigate out through the VPN tunnel interface to the iPhone, but the iPhone doesn't seem to respond at all. Seems as though iOS 9 can only send via IPSec, but not receive... I've already opened a ticket with Apple, but I wanted to come here and see if anyone else had the same issue.

Fortigate 200D not send logs on Forticloud.Firmware Versionv5.2.3,build670 (GA) Setting  

Hi all,we have enabled deep SSL-Inspection on FG100D Cluster. Everything works fine by now, except full validation of certificates presented by the remoteserver. For example, all self-signed certificates on remote-servers are accepted by Fortigate, because there ist no issuer validation (try with test on https://filippo.io/Badfish/). I found the CLI-setting "ssl-ca-list", which should solve this problem by verifying server certificates against stored CA-Cert list in Fortigate. But - how can I import ANY trusted Root-CA certs in Fortigate, like browsers have? Is it possible to import a "trusted root-CA-package" or something like that? Thank you!

What is the easiest way to change a bunch of Forticlient registrations to a new EMS server?  Currently they are registered to a Fortigate Thanks  

Attempting to install FortiClient (VPN client only) on Windows Server 2008 R2, 64-bit OS.  I downloaded the installer yesterday, version 5.4.  It gives this message: "Service 'FortiShield' (FortiShield) failed to start. Verify that you have sufficient privileges to start system services."  Even though I chose the option "Run as administrator" when launching the installer. I would attach the log file, but it's too large and the forum won't allow uploading a zip file.  Thanks to anyone who can help.

IPS is sending copious amounts of alerts for HP.SiteScope.Remote.Code.Execution. I'm curious to know if there is a way to exclude these alerts. We have determined this to be a false report generated from a program required one these handful of machines. Any help would be greatly appreciated.

HI ppl I have not assigned anything to the fortiaps and still i see this 40.2 ip in the connecting via column as in the picsThe ap is on internal5 port and the port is set to dedicated to ext device with an dummy ip of 169.X.X.X.  Screens:[link]http://i.imgur.com/Tbmx5hY.jpg[/link] http://i.imgur.com/XXJsLKd.jpg  I tried to reset the ap following this doc: http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=FD36190&sliceId=1&docTypeID=DT_KCARTICLE_1_1&dialogID=9466136&stateId=0%200%2074138876 But i keep getting the wtp-profile not set error and when i try to create some wtp-profile i get the not found in datasource error. Any help please. Thanks.  

Hi all ,New to Fortigate, can anyone tell me if you can    see what policy a packet hits first ? the firewall im nor managing has ,alot of policies  most of them redundant, i would like a sort of sniffer to see what Policy was use to either accept or dent the packet on CLI.  

Hi, I need to create custom report with template filter for web page.Behavior similar like in "User Detailed browser" reports, but filtering nor by user, but by web page. Report example: www.webpage.comUser1      time1      Bandwidth1User2      time2      Bandwidth2User3      time3      Bandwidth3User4      time4      Bandwidth4 How can I create this report?is it possiible? :) Thank you

Hi. Is it possible to display on GUI Wan & Opt menu? Thanks.  

Hello, I have a client with 2 WAN connections. They would like to use WAN2 as a "failover only" for WAN1 (i.e., no load balancing).They would also like to route Guest VLAN traffic out WAN2 only. I have searched the KB articles and the forum, and I am still a bit confused as to how to properly implement this scenario.I believe I need to do the following:[ul]Set wan1 and wan2 static routes with same distance and priorityConfigure link health monitor/dead gateway detection for wan1Create policy-based route for internal LAN (except guest) to go out wan1 (must be first so traffic flows out wan1 first, unless down)Create policy-based route for internal LAN (except guest) to go out wan2 (this is backup route if wan1 fails)Create policy-based route for Guest VLAN  to go out wan2Modify default LAN firewall policy to allow traffic (except guest VLAN) out wan1 and wan2 interfaceModify Guest VLAN firewall policy to allow traffic

On a freshly configured FG60D using the free FortiCloud subscription limit of 1GB and running 5.2.3 all my Traffic,  Event and System Logs show as empty. Logging is configured to use FortiCloud and the FortiCloud website shows up to date log entries for this firewall as expected, but they cannot be viewed from the local Fortigate UI itself (regardless of browser used). The system resources readout through FortiCloud is non functional, reading a static 0% CPU and 58% RAM. This is the second Fortigate unit on the account that I'm setting up for our test network. The primary unit's logging is configured in the same manner and works correctly in both the local UI and Forticloud. Any ideas on how to resolve this issue?

Trying to get this configuration sorted out for to successfully establish an IPSEC VPN tunnel using the following hardware:[ul]AT&T hotspot w/public IP addressFortiextender 100b into the WAN port with a private IP of 10.100.1.110Fortiwifi 30d w/internal interface set to private IP of 10.1.13.211 & DHCP enabled w/10.1.13.110-200[/ul]Remote endpoint for the tunnel is a VMWare Edge server and the remote tunnel is already set up to allow traffic from the public IP address and private peer of 10.1.13.0/24. I have created the VPN local endpoint as well, bot Phase I and Phase II. Policies are in place for all interfaces including the FortiExtender, but the tunnel will not come online. I can imagine this is likely due to something missing in the configuration:[ul]There is likely some NAT'ing that I am missingMaybe a policy or two that I am missing[/ul]NOTE: All devices behind the firewall will be connected via the LAN interface on the 10.1.13.x subnet.

Hello, I configured with FSSO agentless with windows domain AD. My Fortigate WIFI 90D has root vDOM and WIFI vDOM.When I do "diagnose debug fsso-polling detail" I see "most recent connection status: err: server can not be accessible"My LDAP configuration is working correctly, I can fetch all OUs and Groups.I think I have problem with source IP of vDOM. I have to config LDAP source-IP to one interface in root vDOM in order to make LDAP configuration working.I wonder the same thing is happening with FSSO agentless. But I do not know how to fix this. Could anyone have any ideas about my problem. Thanks,

Hello, we have an annoying issue here with user authentication to an IIS server through a Fortigate 240d (FortiOS 5.2.3) cluster.I have made a policy that allows connection from the internet for the usergroup rds-userssource interface: wan1source address: allsource users: rds-usersoutgoing interface: insidedestination address: vip of iis server (static nat)service: https What happens is that, when you connect to this vip address from the internet, you get the Fortinet authentication portal, where you have to enter your (AD) username, password en fortitoken. When succesful authenticated, you can enter the company webportal.This works great, however.... The next user that originates from the same public ip address, don't have to go through the authentication and is directly redirected to the webportal (!) I haven't found a workaround for this yet, maybe anyone has an idea how to solve this issue? Thank you and regards,Ralph WillemsenArnhem, Netherlands 

This is not my strongest area but it is the its the task at hand..Main office 100D v5.2.2Branch 60D v5.2.2Followed instructions from video to create a site to site. Went to VPN/Monitor/IPSec Monitor and it shows the status as down. Any guidance would be greatly appreciated. 

I have two Fortigate units that I manage. One is a 30D and one a 60D both running the same firmware v5.2.3,build670 With both units from time to time I am unable to access the web-gui. The only fix appears to be to restart them.Whilst I am unable to access the gui, the units are still working and processing traffic outgoing.I am not able to reproduce this, it just happens when it wants to. On the 60D I am unable to SSH in when this occurs, it will give me an SSH login prompt, however once the username and password are entered it just sits there and does not log me in. It's kind of like the login process works, but is separate to the actual management tool itself which is not functional at the time. On the 60D I am also unable to use FortiExplorer from an iPad using a USB cable to access the unit when this occurs. This has happened at least 3 times, maybe more, the only fix as I said above appears to be to power off the unit and power it back on. I hav

Hi all in our office (branch office) we have a Fortigate 60C and we are currently connected on one only ISP; FGT-60C configuration is quite simple: all internal traffic goes to wan1 There is also a static VPN configured with our headquarter so we have also a couple of static ruotes and some policies to route voip traffic to our switchboard (located on headquarter) and also traffic to our internal network located in our headquarter Now in the branch office we want to add another ISP connection; it will be PPoE and it will be connected to wan2 We want to configure in this way  - Internal traffic going to web (all external addresses) goes through wan2 (the new connection)  - Internal traffic going to headquarter goes to VPN configured in wan1 What do I need to configure ? Do I need to configure a new policy "internal - wan2" (all - all - accept) and disable the current one "internal - wan1" ? I suppose I will need to change/add also the current static routes; how ? Thank yo

Hi, Does anyone have an overall guideline or check-list for hardening a 1000c. The firewall is currently being used for web filtering and application control, I will be adding some simple DLP sensors and IPS also. pj