Solved

Hi Experts, We are running Fortigate 300C firewall in HA (Active - Passive). Pls share step-by-step process for upgrading the Firmware for Active Passive HA (remotely). RegardsSB 

Hi, today I logged on FG 100D, and alert message console showed a lot of login trials. Is this an attempt to break in the system and how to protect myself? 12015-10-05 12:49:32Failed admin authentication attempt for root22015-10-05 12:49:32Failed admin authentication attempt for root32015-10-05 12:49:32Failed admin authentication attempt for root42015-10-05 12:48:58Failed admin authentication attempt for root52015-10-05 12:48:56Failed admin authentication attempt for admin62015-10-05 12:48:54Failed admin authentication attempt for aaron72015-10-05 12:17:25Failed admin authentication attempt for log82015-10-05 12:17:21Failed admin authentication attempt for admin92015-10-05 12:17:18Failed admin authentication attempt for vyatta102015-10-05 12:10:57Failed admin authentication attempt for R00T123112015-10-05 11:59:16Failed admin authentication attempt for admin122015-10-05 11:59:12Failed admin authentication attempt for root132015-10-05 11:59:12Failed admin authentication attempt for

Hello.I can not create a new profile in the web filter and Profile Group. 

Hello All, We have configured FSSO on a FG300 running version 5.0 (GA 13)In this config we are using group filters, but when I check the CA that is running on an A.D. server, we noticed that a service account was logged on multiple times (about 20 times). This service account isn't included in the A.D. servers' groups where we configured the groups that must be used in the identity based firewall policy.These groups have been configured/selected in the FG.After I had excluded that service account, FSSO seems to be working.Another important thing: we have upgraded the agents on the DC's but only restarted the services, we didn't do a complete reboot of each A.D. controller.Could this be the culprit? Best regards,Torenhof 

I understand 'Log Rate' to be SYSLOG messages received from devices, but what is a 'Log Message' as shown by 'diagnose fortilogd msgrate' command? Also, is there a CLI command to show[ul]Insert Lag Time?Insert Rate?[/ul]

Hi, i have created an openssl certificate and successfully imported to fortigate then downloaded the selfsigned certificate and imported to my machine. I want to introduce the two factor security i.e. load a certificate onto each of the clients that are connecting to the Fortigate. I have selected the option ' Require Client Certificate' but am not sure what Certificate to use? appreciate your cooperate and feedback regarding how to add certificate to be selected from the client certificate in forticlient tool. attached FYR.. thank you Hussien Idris

Hi,I've got a weird issue on one of my clients site. The finally moved from pptp to ssl-vpn and androids/windows work flawless. However, all ipads and iphones are not able to connect via RDP with forticlient. Anyone got any ideas? The worst part is I don't got any iOS device to actually test it from my office, but would be awesome if someone got any pointers on what to look for when I'll go to client to try fixing the issue.

Trying to configure the workflow in Fortimanager. Configured an admin account to authenticate using LDAP and assigned him permission to approve a session but it does not seem to work. However if i change the auth type for the admin user to local then he can approve changes. Does fortimanager have any such limitation?

We currently evaluating fortigate for using it as a client ssl vpn endpoint.Most of our users have notebooks where they are local administrators because they have to install software most of the time.All of this notebooks are domain joined.When they use the ssl vpn they should be able to work like as they are connected in house into our intranet. Only this notebooks should be able to use the ssl vpn endpoint. Our first thought was to use computer certificates as a 2nd factor. It looks like this isn't possible because the client does not show the computer certificates.We have user certifactes for client authentication and email signature. But they are exportable. Users could export them and use them on their private computers and successfully connect to the network. For now the only solution we found is to register the forticlient installations which generates more costs because we need to license the forticlient without using (at least for now) any of the other features

hi allstill feeling very new to the world of routing, switching etc so please forgive me if my question isnt clear. i have a nice new shiny fortiwifi 30d for my home FW/Router. The sad news is that my ISP, being cheap and nasty, have hard coded requirement for PPPoE traffic to be tagged with VLAN 100. ive had a bit of a play but i cant for the life of me figure out how to tag the physical interface. I created a sub interface and tagged this with VLAN 100 however this wont connect as the physical WAN with appears to take precedent. To rehash; need to tag all WAN interface traffic with VLAN 100? any help would be great. thanks.

Hi, Need suggestions. I was asked to do a remote SSL VPN solution for a hub-spoke network design. Three spoke has small unit onsite and they belongs to three different sister companies. The hub has bigger fortigate as well and IPSEC tunnel to each spoke. The requirements are:1.2-factor auth for remote vpn on central HUB Firewall.2. Each user authenticated via corresponding company AD.3. Once user is authenticated, user has access only to the corresponding company network4. Dedicated vpn client for user computer, no web browser based. My concern part is really the item#3 above. I do not even know if fortiOS can provide the feature to assign subnet/routing dynamically based on Domain user account with a single remote SSL VPN profile. However I can image to use different remote ssl vpn profiles for different company/domain users, such as user from Company A connects to "vpn.example.com/company-a" via forticlient; user from Company B connects to "vpn.example.com/co

'CLI Reference for FortiOS 5.2', for section 'execute set system session filter' states "Use these commands to define the session filter for get system session commands." Firstly, 'get system session' is a non-'Global' VDOM command, however, 'execute set system session filter' is a 'Global' VDOM command - so, I don't understand why they should be partnered.... More importantly, even I can't get them to work - observe: FG60C (global) #  diagnose sys vd list | grep root name=root index=0 enabled ....: FG60C (global) # execute set system session filter list session filter:         vd: 0         proto: any         source ip: any         dest ip: 208.91.114.47-208.91.114.47         source port: any         dest port: any      &nbs

I have noticed on a handful of my Forticlient's stopped receiving virus definition updates.  The log states cannot obtain updates. Update server responded with unauthorized access. Fortigate version 5.11Forticlient version 5.09 I have also tried update one of the workstations to 5.2.4 and it still cant get updates. Thanks

I have had a couple computers run really slow because Forticlient is installed.  When I uninstall, they go back to normal.  Any ideas what might be happening? Thanks

Hi Is it possible to allow a read-only user to change their own password in FortiAnalyzer 5.2? /Björn

Hello Please, can you give me an example about the configuration of Wi-fi by CLI in Fortiwifi 60D with wpa2? Thanks in advance Regards!

I have successfully managed to configure FortiGate captive portal authentication through an OpenLDAP server on a 60D firewall. Now the problem I am facing is that I made it to work with individual users that reside on the OpenLDAP server.What I am trying to accomplish now is instead of having to add the LDAP users on FortiGate individually, I would like to have a group on the FortiGate that points to the same LDAP group and any users in that LDAP group to be able to go through the captive portal. I have setup the group on both FortiGate and LDAP but when I am trying to login on the captive portal with a user account that belongs to that group on the LDAP, it says Authentication Failed. Any ideas? 

Yesterday I was at a customer who had a transparent setup for UTM filtering.I am not very familiar with transparent configurations, but the FGTs only had a few commands available to be run. For instance, 'diagnose' and 'get test' amongst others, were not available. What could be the cause of this? They were running FW 5.2.4 on two 310Bs in HA. The admin account had super_admin rights. Another question: A previous administrator had activated Web-Filtering on an inbound rule. What can be achieved from this? I don't understand how that would work.

Dear All, this forum was helping me a lot, my question is previously our company was using ISA server and the reporting was pretty good and they need the same like report. Which is for each user they need to have site, category, hits, browsingtime, bandwidth. I tried preparing the report but the user will come on the left column and they need separate sheet for each user like in the attached report. This will be a great help if we can have it. Thank you for reading and helping me :)

Hello I am running a FortiGate 300C with Firmware Version v5.0, build 0318 (GA Patch 12) in the NetworkIn the NetFlow stats on the network, I am seeing a huge amount of traffic (more than 30%) being used by Apple Software Restore (7800) What do I need to do so that I can block this traffic absolutely? If any one can advise on this will be much appreciated.Please let me know if any further information is needed from my side. Thanks in advance  

Hi,We need to decommission an Active Directory domain controller and are having difficulty removing it from our SSO configuration.  In the Users and Device>>Authentication>>LDAP Servers page, the option to delete the LDAP server is greyed out.  There's no option under the Single Sign-on page to disassociate an LDAP server from the Local SSO agent.  I can't seem to find anything online on using the CLI to remove a server either (lots of info on adding them).  Any help would be appreciated. We're running FortiOS 5.2.4, and are using the Local SSO agent in polling mode.

Hi All; I'm trying to block facebook and youtube https acces, so i flooowed the steps described https://www.youtube.com/watch?v=-7OUDfhtc_g but it's still does not work for me. Reagrads

Hi all, I tried to set up a FortiAP 14C for the first time and have some questions. One of our customers wants to connect a few branches with the HQ, using FortiAP 14C on the remote side and a FortiGate 40C in the HQ. Each FortiAP should connect devices via WLAN and LAN with the company's network as well as offer them access to the Internet. I found several videos and documents describing the setup of 14C as an AP for WLAN and LAN and following them, I could establish connections as wanted. But this works only, when the FortiAP 14C is located in the same network as the FortiGate 40C. My expectation was, that - if this works fine - I could bring the AP to the branch and the same functionality would be available. But unfortunately, the AP does not establish a VPN connection to the 40C. So, obviously, I misunderstood the setup. Unfortunately, I don't find a document or video which describes the necessary configuration tasks for our environment. So my questions are

Hi, i have two fgt600C on A/P cluster running FortiOS 5.2.4, my issue is i have two different license on both FGTs (Primary Bundle, secondary NGFW) so am missing the AV on the 2nd device, now the issue is whenever there is an update it shows expired . how do is solve it is by bringing down (reboot) the slave run the update on master works fine connected back again . is my issue is related to license difference ( since 2nd device does not have AV license so when there is an update it reflect the status on master ) or its something else.  

Hi Back in FAZ v4.2, there was a built-in report called "Top Allowed Categories for Most Active Users" (see attachment).  You could see at a glance who the top offenders were and where they were spending their time.  It was based on web page requests, whereas FortiView now uses sessions, which surely isn't the same (ie. you could potentially have one session open that is generating millions of requests).  There was also a filter called "Include Web Clicks Only", which removed all the other embedded links to advertising, etc.  This was probably the most valuable report the FAZ produced.  Our managers loved it because they knew who to speak to about their web browsing behaviour. Fast forward to v5.2, and while it has many good individual reports on users, categories, etc., it doesn't have a single report that combines these together in a powerful way like the above report did. I've tried to work out how to create my own dataset, but as others have