Solved

Hi, I wonder if you can make HA with two FortiGate 30D on the datasheet says no, but I've read several times on the internet people saying they could using text mode, it really is possible?

We have many disconnections of the FortiAp 222B with its controller (Fortigate 500D). The event message is the next: - Control message maximal retransmission limit reached You can see the event in the next image: We have more FortiAp in the same network working well Has Someone had this error and know the solution?  

Hi Is it possible to define a different timezone for a report?Right now it will always use the timezone of the fortianalyzer. We want to send reports to branches in different timezones, and use their local time in the report.And also use a specific local time range, like 'yesterday'. BrgdsSander 

Hi We are using an FAZ1000D with FortiOS 5.2.3.We would like to send out a threat report every morning, but only if threats have been detected. Is this possible? We don't want to receive any empty reports. Additionally we would like to hide pages in a report.The default threat report has 3 categories (Malware, Botnet and Intrusions) would it be possible to hide the categories in a report which don't contain data? Thanks & BrgdsSander

We have a Fortigate 200D running the 5.0 firmware. When I use the Packet Capture, I notice some odd behaviour that I do not understand and wanted to know if this is normal or is there a problem. I select the Packet Capture option via the GUI. System > Network > Packet Capture I create a new packet capture and select my criteria. Sometimes I filter certain hosts and then start the capture. When I attempt to generate some traffic to one of the hosts in the capture criteria, I do not see all of the packets. Particular examples include the following:[ol]I generate a continuous ping to a host, the packet capture captures the first two ICMP requests and responses but doesn't capture anymore than that, even though the ping is still running in the background.I SSH to one of my hosts, the packet capture gets the first few packets (the three-way handshake) and maybe one or two more but then fails to capture any of the rest of the packets.[/ol]I should point out that the firewall

We have a Fortigate firewall in active/backup configuration running FortiOS 5.0.9. TL;DR Firewall intermittently stops passing https packets from iPhone or iPad with message on the firewall of "no session matched". Just posting this here in case anyone else is experiencing this odd issue. More information Recently one of our users noticed that they were unable to access an internal application that is essentially a web site that uses https. They can get to the initial page of the web site but not beyond it using an Apple iPhone or iPad client. We have done a lot of testing at each stage of our network and traced the packets through the network using Wireshark and some network taps. We tap the fibre going into the firewall and we can see packets going in, however they never emerge out of the trust interface, past the initial loading of the web page. Essentially, the packets are getting all the way through the network until they reach the firewall.&nbsp

On my fortimail unit the Anti Spam Definition is 7.00286. How can I check if this is the latest definitions available from fortiguard? 

Hello, I have 5 external IP`s addresses from my ISP. I added those addresses to WAN1 interface. I have several servers in DMZ (e.g. mail server), whose services are accessible from the outside. I created the appropriate VIP addresses and traffic from Internet to DMZ goes to the correct servers. But all the servers from DMZ and LAN internet users go from one address (primary WAN1 address). How can I set different external IP address for outgoing servers traffic?

     I have an IPSec site to site tunnel between a FortiGate 110C and Cisco ASA5510.  There is a single NAT happening on the Fortigate side that translates the LAN addresses to a block of addresses.  All traffic between the hosts on the ASA side and hosts on the FortiGate LAN are working correctly.  The issue comes into play when self originated traffic from the 110C is pushed across the tunnel, in particular sFlow data.  When the source IP is set to default, the traffic is pushed from the WAN IP to the tunnel interface.  When the source IP is set as the LAN interface the traffic is being directed to the tunnel,  however, it is not using the NAT pool of addresses for the tunnel traffic.  As a test I used IMCP to flesh this out.  execute ping-options source 0.0.0.0execute ping ASA HOSTthis failsexecute ping-options source LAN IPexecute ping ASA HOSTthis failsexecute ping-options source TUNNEL NAT POOL e

Hi All, 1. I'm very new to Fortigate2. It's a Fortigate 60D3. I did not configure the router myself and there is no document on how it was done :(4. Some program wants to reach an external website on port 8008. Somehow I have the feeling that the Fortigate is not allowing that. 5. Can anyone point me in the right direction to check this 'blocking' behaviour and make sure this traffic is allowed? All help appreciated,Regards,Gerard

Hello folks, I recently upgraded to firmware 5.2.3 (from 5.0.x) on FG-40C. However, after the upgrade, I no longer see the Advanced option under DHCP Server (System > Network > Interface) I am running the FG-40C ports in internal switch mode (but my understanding bot switch mode and interface mode should have the Advanced options under DHCP Server).   I have attached a screenshot to this post. Has anyone experienced the same issue?  Any help would be much appreciated. Many thanks.  Cheers,Arthur

Hey guys, I have a box which I'm building a site-to-site tunnel on. The remote site has two locations, and my box should be able to 'fail' to the second location if the primary is unreachable. From what I understand, this should be as simple as creating a phase 1 for each location, and using the 'set monitor "primary-phase-1"' on the secondary tunnel - like this: config vpn ipsec phase1-interface    edit "Primary"        set interface "wan1"        set nattraversal disable        set comments "To Primary Location"        set dhgrp 5        set remote-gw XX.XX.XX.XX        set psksecret ENC xxxxxxxxxxxxxxx    next    edit "Secondary"       &nb

I blocked user MAC Reservation + Access Control, but if the user sets himself a static IP address, it uses the Internet and network.How to fix?Fortigate 80c

Hi,I was trying to figure out how I can subtract "from_dtime(dtime)" of "now()" and count the interval in days.I was wondering if somebody knows. Tks folks.

I had this issue before in a version prior to 5.2.2.  Worked perfectly in 5.2.2 updating to 5.2.3.  Looks like it's a problem again. Anyone have any ideas?  Removing the old version to install the new is not really an option.

Hi I migrated over to my HA Fortigate 100D setup from my Cisco Router. What I have noticed is that with external requests going to my internal NAT server, is it is showing that the external connection is made from the VLAN interface IP address instead of the original external Source IP. this is a bit frustrating because some Linux machines behind the fortigates are blacklisting the interface address due to failed hack attempts because it all seems to come from one address -- hope this makes sense. so an external requests looks like its coming from the interface address 192.168.30.254 and not the original source public address of 41.xxx.xxx.xxx etc. hope this is just me making a noob mistake on the new toys... 

Hello all,I've got a problem with Skype connection. Sometimes it works and sometimes skype can't connect without any clue.. On application control, i've granted acces to Skype I've set a rule that use appsensor, and open a port.  But it change nothing. sometimes i can conenct slype but sometimes no.. Have you got an idea? Regards,Alexandre

Im running V5.2.4 build0688 150722 GA on my FortiWiFi 60D-POE but the packet capture feature is missing from the menu. I have read that you can get to the packet capture util directly via a URL which works but the GUI should have a link to it. Do you have to enable this now like you do with other GUI features? Thanks

Hello, I have sucessfully managed to block http and https traffic on my Fortigate 100D but for some reason, if I open Google Chrome, all blocked HTTPS sites are accessible wile HTTP sites remain blocked !!! I tried with Safari and Firefox and both HTTP & HTTPS sites are blocked... Is there any reason why Chrome is bypassing the firewall settings? The settings on the firewall are:SSL/SSH Inspection ON, blocking HTTPS trafficWebFilter ON, blocking all websites (* wildcard - deny) and allowing only 3 specific ones.IPv4 Policy that incorporates the above rules.

Hello, I am having a problem creating a site-to site VPN tunnel that has one side behind NAT with dynamic public IP.I followed the instructions on the below video as the scenario is exactly as mine and that is what I am trying to accomplish but, the FortiGate firewall never dials in (or it tries but it fails...)  [link]https://www.youtube.com/watch?v=AMVkOVPzOCw[/link] Can anyone please shed some light? Thank you in advance,Thanasis

Using 60C hardware I've been asked to connect to a vendor VPN gateway. The only details I have been provided are IP address, username and password, and the fact that we "are able to connect just by creating a VPN connection in windows".Connecting from a Windows box doesn't suit our needs.I'm familiar with ipsec point to point but not dialup.All the vpn information I can find is either point to point or where forticlient / iOS / M$ etc are the dial up clients and fortigate is the vpn gateway. I've searched this forum, the kb, the handbook and the cookbook.I found the Microsoft VPN section of the handbook but the fortigate is the gateway not the client. Even that mentions username, password and psk but we haven't been advised of a psk. Can the fortigate act like as a dialup client similar to a windows VPN client? Is the information provided to us sufficient? edit - we will have a dynamic IP and traverse a NAT.

Hello, I have configured site to site vpn between Fortigate 200D-800C, and the  tunnel is up, but there is no traffic going out and coming in, after investigating by capturing the icmp traffic, I found that the source address traffic is coming from the Management Interface rather than the required LAN Port 1. please helpThanksAhmed

I'm attempting to setup netflow and am not having any luck. I have a fortigate 80C and am using PRTG for monitoring. I followed these instructions found from Fortinet, but the probe says no information has been sent to it. config system netflow set collector-ip <address> set collector-port <port> set source-ip <address> set active-flow-timeout <integer> set inactive-flow-timeout <integer> end   I set the collector IP as the server address that has the PRTG probe on it, the port to a UDP port that wasn't used, and it matches what PRTG is looking for and I made sure there was a rule in the local firewall to allow it. The source IP I wasn't sure exactly what should be used, so I entered the routers IP address, and the timers I set to 1 and 15 respectively.   Any insights on how to get this fixed would be very helpful, I'm looking forward to collecting the data on my WAN usage.   Thanks   Jon

Hi All, I am a P-12 school and have a 300C running 5.2.3.  We have a mix of PCs, Macs and iPads.  While we have a Windows AD Domain not all of our devices are bound or login to the domain.  We don't have access to our WLC to do any Radius authentication. I'd like to setup the ability for staff to optionally authenticate with the Fortigate to gain extra web access.  This would allow them to access sites that are deemed inappropriate for the students.  I don't want to force the staff to have to authenticate all the time, and I don't want all our students to have to authenticate either. I am quite new to the Fortigate so am wondering how others would go about achieving this? Thanks in advance,Chris.

Hello, we are going to buy a pair of 2 new Fortigate 900D boxes to replace our old devices.Unfortunately, the Fortigate support/ intrusion prevention subscription for our old firewalls will end next month. Now I´m asking myself what will happen with IPS?[ul]Will IPS continue to work with old IPS signatures?Will IPS completely be deactived?[/ul]Thanks