Solved

Hi The documentation (http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/wifi-ethernet_bridge.058.1.html) names two different bridge operations:[ol]Bridge SSID to FortiGate wired networkFortiAP local bridging (Private Cloud-Managed AP)[/ol]The setup of the SSID seems identical to me. While in the first variant an interface on the Fortigate is being configured this step is missing in the second variant. My setup would look like: FortiAP (Subnet C) <--> Switch (L3) <--> Fortigate (Subnet I) The point is: when the traffic leaves the FortiAP anyhow (in bridged mode) why should I setup a software interface on the Fortigate? Whats is the intention of this? What do I gain? I have somehow the feeling that I have to choose the first variant if I want to use VLANs (what I do not need in my case). Thank you very much!

HiI have just setup a Fortigate 30D and configured it to use RSA SecurID 2FA which is working. I have enabled event logging for all events. When I check the logs through the GUI and the Console they are all empty. I have also enabled email alerting which is working. any ideas?Simon  

I have used fortigate UTM devices in past which supports URL Filtering and application filtering. In the security tab I could see we can block applications and URLs but I was wondering if it supports a feature using which we can allow the user to access facebook.com but the user then should not be able to hit the LIKE button or do simillar activities inside the HTTP/website. Please guide how to configure this

Hi I own a Fortigate 60D and I think about to add 3 FortiAPs. Since the 60D has only 175 Mbps CAPWAP throughput (roughly 21MB/s) its not an option to tunnel the traffic. Nevertheless I would like to setup a guest network with a tunnel mode to isolate the traffic. So my question: can I have two SSIDs on the same FortiAPs one profile with local bridge and the other one in tunnel mode? Has someone this setup running? Thank you very much.

Hi, We are using a Fortigate 300c. We have configured users to be in a portal e.g. (3 admins in a single portal). Is it possible to restrict the users to be assigned to a specific internal IP address based on their MAC address even if they are in the same portal. Thanks in advance,Pitot

Hi, We have FortiGate 200D (fw v5.2.3,build670 (GA)) and I was wondering if I could setup DNS zone forwarding on this device. Please advise! Thanks!

Hi, Does anyone know what history log field "resolved" means? Emails from our exchange server go out through FML in gateway mode, and they get through without problems (action for outbound mails is BYPASS), but all outgoing mails in history log have same status in resolved field - FAILED. Other statuses for incoming is OK for good mail, FAIL and FORGED usually means spam because of some sort of DNS mismatch. It is DNS resolving issue, but I dont konw why internal exchange isnt resolved. Nslookup form FML shows good PTR and A records. We use internal DNS servers, and all works well exept this thing. Nowhere in documentation is clearly stated what RESOLVED resolves (IP to DNS name, helo/ehlo banner to PTR or some other combination).  This is log example:  Column Content # 14884 Date 2015-05-21 Time 13:21:47 Classifier Not Spam Disposition Accept From xxx@domain.com To xxx@otherdomain.com Subject Subject Subject Se

Hi All, We have a FortiGate 100D Cluster (Active-Active), running Version 5.2.2 Build 642 (GA). We have several IPv4 Policies permitting access to the Internet from several different subnets. On each policy we have Web Cache enabled.However, when I look at the Cache Monitor in WAN Opt & Cache, I see No Data, indicating that nothing is being cached. Could someone please give me some pointers on what I should look at next to troubleshoot this issue. Many thanks, JP

Hi everyone, I'm planning to setup a FG-80C in  transparent mode behind two routers on my network. I just want to know  what are the features of fortigate that will not work in transparent mode setup compared to NAT mode?And what should be the best practice in transparent mode? My purpose is just blocking prohibited sites on my network and control the bandwidth usage on particular users. Is single sign on and traffic shapping works in transparent mode? Can I also access the firewall outside my network while in transparent mode?Any help, tips, suggestions, reactions will be much appreciated. Thank you. Regards,Jam

I've just checked two fortmails with latest OS 5.1.It seems to be vulnerable for LogJam attacks.When will there a new Firmware be available? Patrick

"Cross-domain" request problem about JS...have anyone can get it from beta portal???..

Hi,we have a fortigate 60B with a 4.0mr3 patch 13 firmware and we want to migrate to a fortigate 80C with v5.0,build3608 (GA Patch 7). I don't know if i should migrate the 60B to 5.0 before creating my backup or If i can directly try my backup on the 80C? Thanks

What documentation exists about the forwarding of a authentication on the ssl vpn webportal to services I present in the portal? If you use this, what services do you present with using SSO? We have a lot of internal services, microsoft based, atlassian systems, etc. (all of them are using our active directory for authentication) and we would like the users to only have to sign on on the portal itself.

Hi everyone. I have a FortiWifi 90D currently running the IOS 5.2.3 and I'm having some issues with the Authentication portal after a user login time's out or if the computer is not part of the domain. In the 5.0.X the user had to re-authenticate in a editable portal (Captive Portal), but now when you try to access the internet there's no portal and nothing happens. Is there a new config that I'm not aware of? Thank you in advance.

Hallo, I have a problem in phase 2 with rekeying. I have 7 location and my home office, at the location i have 2 30B v4.0,build0665,  3 80c v5.0,build0310, 1 60d v5.0,build0310 and 1 100D v5.0,build4429, at home i have a Server with Strongswan 4.5.2. between the 100d and Strongswan is a static tunnel, the other Forti's are configured as responder and strongswan as initiator.The keylifetime is 1800s, after this time the 100D delete child_sa and phase 2 ist down, but phase2 don't come up. at the other location's i have a simular problem after rekeying in phase 2, i see phase 2 is up on both sites, when i ping a host, i don't get a answer. The package pass the tunnel and go to the host, the host send an answer, this package go in the tunnel interface from the forti, at home i don't see this package on the lan-interface from my Server. Strongswan is configured with inactivity option (300s). After 300s phase2 go down. if i ping a host, i get an answer. Doe

Hi,does anybody know if it's possible to configure an IP Subnet instead of a single IP or FQDN for a Client in Radius Service? For example, in Freeradius you can define: client 192.168.1.0/24 { secret = VERYSECRETSTRING } or client private-network-1 { ipaddr = 192.168.1.0 netmask = 24 secret = VERYSECRETSTRING shortname = private-network-1 } Thank you. Regards. Jorge.

Hello, from few days I try to set up router to using two ISP. I have virtual IP 79.10.10.245->192.168.1.5 on WAN1. I would like to use WAN2 for only one internal IP (192.168.1.15) and others internal IPs should go out via WAN1. I set up WAN2 (outside IP), added static route and police routes. Now the traffic for 192.168.1.15 goes via WAN2 but there is no routing between 192.168.1.15 and virtual IP 79.10.10.245. From 192.168.1.15 I can ping 192.168.1.5 and WAN1 router IP 79.10.10.242 but I can't ping 79.10.10.245. WAN1 79.10.10.242/28WAN2 80.10.10.242/28Mail server IP: 79.10.10.245 /internal 192.168.1.5/ Static route:WAN1:destination:0.0.0.0/0.0.0.0device: wan1 gateway: 79.10.10.241distance:10priority:0 WAN1:destination:0.0.0.0/0.0.0.0device: wan2gateway: 80.10.10.241distance:10priority:5 Policy routes:Procotol: allInncoming interface: internalSource: 192.168.1.15Destination: 0.0.0.0/0.0.0.0Outgoing interfece: WAN2Gateway:  80.10.10.241&nb

So We updated our Firmware to 5.0.9 not too long ago and we now seem to have issues with https sites. I just need to know if this behavior is normal, or if there is something wrong. The issues we have are that some https sites, not all, when users access them, they will come up with any or all of the following..... A blank white page The will state that there is no Java, or Flash installed, when there is. Or that the incorrect java or flash version is installed, even when we know for 100% sure that the correct version is on the pc. I can do one of 2 things to fix this. 1. I can either create an address object with the site url in it, and put it into a policy in front of our main user policy, that ONLY has AV and IPS turned on. SSL inspection and webcache are turned off in this policy. 2. I can put the url into the url filter the user gets as a wildcard and exempt, and that also makes the site work. Again, on our previous version of firmware, which I BELIEVE was 5.0.6 w

Hi all, new to fortigate products.. trying to get web filtering up and running so I can get rid of Websense and simply use the fortigates features. I'm hitting a little problem though.. so I'm using FSSO in polling mode to AD. Its recognizing the users fine, but it seems to be timing out at some point. For example, I have a windows 7 VM that I have using the fortigate as its gateway for testing. I log this machine in as a test user, test the policies, it blocks me to the appropriate sites, etc.. however after a while, it seems to just "forget" about me and won't let me access any sites at all unless I log off/back on. Annoying. Am I timing out? Any way to prevent this from happening or how do you handle? Using a Fortigate 200D

Hi, there I configured Web Filter override for certain user group. User can now enter username and password to override for 15 min (not user changeable). However from logging/reporting perspective, is there anyway to see who is overriding the web filter? How long left for the override duration and how to revoke the web filter override for certain user if needed? Plus, it doesnot seem like Web override can not use the same user account for authentication? For example, USER1 belong to Group1 which is configured for override authentication. USER1 is browsing to www.abc.com which is blocked by filter profile. USER1 can not use her/his account to override, right? Maybe asking too much but can not find a manual to give me answers... 

Hi all, Hoping to find an answer here, I'm kind of new to Fortinet and this is my first post here.  I bought 2 x FortiGate 500Ds for a client, running in Active/Active mode with 5.23 FortiOS.  There are 8 SFP slots in each of them, and the units each came with 2 1000BaseSX SFP modules.  Problem is I do not get a link light on these ports when I make the fiber connection and there is no connection detected.  The same cable works fine when connecting it to a Cisco 4507 switch (also a 1000BaseSX module).   This is happening on both FortiGate units, on all ports and all GBICs.  The ports are not shutdown and I'm fairly certain I'm making the connection correctly.  So I'm thinking there must be something I need to configure to make these ports work.  But can't find any info.  What am I missing?

Hi, i have the following situation:WAN1 IP Gateway is 10.10.2.1/24 Wan2 IP Gateway is 10.10.1.1/24 INTERNAL_LAN 192.168.1.0/24 GUEST_LAN 10.1.1.0/24 I'm trying to make computers on INTERNAL_LAN access the internet using WAN1 and GUEST_LAN to WAN2. I created 2 static routes as below: 0.0.0.0/0.0.0.0 Gateway 10.10.2.1 on device WAN1 0.0.0.0/0.0.0.0 Gateway 10.10.1.1 on device WAN2 both having distance 10 and priority 0 2 policies are created, INTERNAL_LAN to WAN1 and GUEST_LAN to WAN2, ALL allowedWhen I connect only WAN1, the computers on INTERNAL_LAN can access internet -> OK When I connect only WAN2, the computers on GUEST_LAN can access internet -> OK When I connect WAN1 and WAN2, the computers on GUEST_LAN can access internet via WAN2, but INTERNAL_LAN can't access via WAN1 -> PROBLEM Why ?Thank you for any help Luca

Hi,i've trouble creating a L2TP/IPSec VPN on our Fortigate(FW 5.2.2,build642) If i use the wizard (Dialup - Android (Native L2TP/IPsec), i cannot select the WAN Interface as incoming Interface.There is only DMZ and INTERNAL available (the fortigate is in Switch-mode).Selecting the iOS (Native) wizard, the WAN Interfaces are available (we use load-balancing). My VPN menu also looks different to the pictures in the documents (i've no "Auto Key(IKE)" option / the "Policy-based IPsec VPN" Feature is enabled). I've also tried to create the tunnel via CLI, but i got a error at "set interface wan1".Is it because the fortigate is in Switch-mode? Hope you can help me. regardsJuergen 

Policy Based NAT might not be the correct term but what I am looking for is: For the VPN tunnel, the remote subnet and local subnet are the same. With Cisco ASA, I would need to configure policy based NAT or identity NAT. However not sure how to do that with Fortigate. Please advise.

Hello, I have a Fortigate 60C and 7 FortiAP. I know i can't add all my AP to the Fortigate in normal mode. I read this http://kb.fortinet.com/kb/documentLink.do?externalID=FD36164But what i don't understand is what involve the bridge mode ? Is there a way to add two differents SSID to an AP, one in bridge mode and the other in normal ? Thanks