Solved

Okay I see what they are saying below about the Disclaimer access banner, but is there a way to edit the banner to what I want it to say? Disclaimer access banner Optionally, the FortiGate unit can present a warning statement to administrators before or after login authentication. The administrator must accept the statement to continue. Logs record response to the disclaimer at each logon. The default pre-login and post-login banner messages contain the same text: This is a private computer system. Unauthorized access or use is prohibited and subject to prosecution and/or disciplinary action. All use of this system constitutes consent to monitoring at all times and users are not entitled to any expectation of privacy. If monitoring reveals possible evidence of violation of criminal statutes, this evidence and any other related information, including identification information about the user, may be provided to law enforcement officials. If monitoring reveals violations of

Hi, quick one: - I have a 100Mbps pipe to the internet- I create a rule to intercept traffic from 1 ip and give it 50Mbps of minimum guaranteed bandwidth questions:- what happened when that ip is not generating traffic (i.e. laptop is off)? Is the firewall giving the rest of the network 100Mbps or 50Mbps? thanks 

I have a FortWifi 30D connected via IPSEC VPN to a Fortigate 60C. Behind the FWF30D is an IP-phone that one of our users has at their home office. The phone working normally and can connect to the HQ network via VPN. I have a Fortianalyzer in the same IP range as some of my VOIP equipment that the phone communicates with. I would like to get the FWF30D to send its logs to the Fortianalyzer. I can ping from the FAZ to the FWF30D' s LAN address, and to the IP-phone beyond it. I cannot trace or ping from the FWF30D (via CLI) to the FAZ. It seems like the FWF30D will not send its traffic through its own IPSEC VPN. Any ideas on how to resolve this? Specs: FWF30D v5.0,build4459 (GA) Fortigate 60C v4.0,build0672,130904 (MR3 Patch 15) (yes I know its old) FAZVM64 v5.0.7-build0321 140627 (GA) Prior to the FWF30D we had a FWF50B doing the same thing. The FWF50B died, and we replaced it with the FWF30D.

 Dear all, currently i have a fortigate 100d with firmware version v5.2.0,build0589. i planing to manage user policy with Identity based policy feature. but i unable found this when i configure my policy. Any one can teach me how to enable Identity based policy feature?

Hi there, I need help with a dataset/report on FortiAnalyzer. What I need:Detailled Report about Application Category "Video/Audio"- See which Applications (In appcat=Video/Audio) consumed which bandwith- Which users connected to which application (in appcat=Audio/Video)- Top 30 users for every Application with Bandwith usage (in appcat=Video/Audio) Is there anybody who can help me? Thanks and best regardsMattias

Hi I am struggling with setting up a VPN connection from IOS devices to my internal network (Fortigate firewall 500D) I started by using SSL VPN, but found the IOS app was next to useless, as it doesn't support tunneling and as soon as you close the app, you lose the VPN.  I started looking into IPSEC via the IOS Dialup, but cannot get my head around it. My knowledge of IPSEC was that it requires a source IP and destination IP, however, with the mobile devices constantly on the road, near on impossible to lock down the devices IP. It seems IPSEC IOS doesnt require this, but i am lost to understand how it authenticates the tunnel between the devices?  Any help to get my head around this would be much appreciated.  Thanks Paul

Few days ago during a diagnostic, I was annoyed to find that I got no ping reply from my FortiGate 80c DMZ interface (ping sent from a server situated in the DMZ). But " PING" option in DMZ interface properties page has already been checked. After some fiddlings, I figured out that I also had to put source IP address in " Trusted Host" field of *any* administrator. Now, there' s a problem (or two problems): * The description of PING in the PDF documentation (fortigate-admin-40-mr2.pdf) says that Interface responds to pings. Use this settings to verify your installation and for testing. * The description of " Trusted Hosts" says that The IP address and netmask of trusted hosts from which the administrator can log in. But ping has nothing to do with " log in" , so in first reading, it was hard to imagine there' s a relationship between " trusted hosts" and " ping" . It' s either a bug or a documentation ambiguity.

I' m trying to create an LDAP Server under User & Device-> Authentication on a FortiWiFi 60D v5.2.0, build 0589. The Active Directory server is Windows Server 2008 R2. When I click the icon by the Distinguished Name field it fills in the name. Using Server Port 389. I selected Bind Type = Regular. When I fill in the User DN and Password but I consistently get an Invalid credentials message. The LDAP Server is listed on the LDAP Servers page but when I click to Edit this and to Test the connection I again get the Invalid credentials message. This is the first time I' m trying to set this up. Can anyone tell what I' m doing wrong?

Does anyone know if there is an alternative method being worked on for the web-based Fortigate SSL VPN since the current SSL VPN relies on the NAPI plugin for it to work? Safari works great, but Chorome is depreciating NAPI plugins and eventually disabling and blocking, and Firefox is expected to follow suit in the near future.  - Gianluigi

fortigate 80c don't work web filter.Help me please  [link]https://www.youtube.com/watch?v=KdBZX4HKOtE[/link]

Hi Experts, We are running Fortigate 300C firewall in HA (Active - Passive). Pls share step-by-step process for upgrading the Firmware for Active Passive HA (remotely). RegardsSB 

Hi, today I logged on FG 100D, and alert message console showed a lot of login trials. Is this an attempt to break in the system and how to protect myself? 12015-10-05 12:49:32Failed admin authentication attempt for root22015-10-05 12:49:32Failed admin authentication attempt for root32015-10-05 12:49:32Failed admin authentication attempt for root42015-10-05 12:48:58Failed admin authentication attempt for root52015-10-05 12:48:56Failed admin authentication attempt for admin62015-10-05 12:48:54Failed admin authentication attempt for aaron72015-10-05 12:17:25Failed admin authentication attempt for log82015-10-05 12:17:21Failed admin authentication attempt for admin92015-10-05 12:17:18Failed admin authentication attempt for vyatta102015-10-05 12:10:57Failed admin authentication attempt for R00T123112015-10-05 11:59:16Failed admin authentication attempt for admin122015-10-05 11:59:12Failed admin authentication attempt for root132015-10-05 11:59:12Failed admin authentication attempt for

Hello.I can not create a new profile in the web filter and Profile Group. 

Hello All, We have configured FSSO on a FG300 running version 5.0 (GA 13)In this config we are using group filters, but when I check the CA that is running on an A.D. server, we noticed that a service account was logged on multiple times (about 20 times). This service account isn't included in the A.D. servers' groups where we configured the groups that must be used in the identity based firewall policy.These groups have been configured/selected in the FG.After I had excluded that service account, FSSO seems to be working.Another important thing: we have upgraded the agents on the DC's but only restarted the services, we didn't do a complete reboot of each A.D. controller.Could this be the culprit? Best regards,Torenhof 

I understand 'Log Rate' to be SYSLOG messages received from devices, but what is a 'Log Message' as shown by 'diagnose fortilogd msgrate' command? Also, is there a CLI command to show[ul]Insert Lag Time?Insert Rate?[/ul]

Hi, i have created an openssl certificate and successfully imported to fortigate then downloaded the selfsigned certificate and imported to my machine. I want to introduce the two factor security i.e. load a certificate onto each of the clients that are connecting to the Fortigate. I have selected the option ' Require Client Certificate' but am not sure what Certificate to use? appreciate your cooperate and feedback regarding how to add certificate to be selected from the client certificate in forticlient tool. attached FYR.. thank you Hussien Idris

Hi,I've got a weird issue on one of my clients site. The finally moved from pptp to ssl-vpn and androids/windows work flawless. However, all ipads and iphones are not able to connect via RDP with forticlient. Anyone got any ideas? The worst part is I don't got any iOS device to actually test it from my office, but would be awesome if someone got any pointers on what to look for when I'll go to client to try fixing the issue.

Trying to configure the workflow in Fortimanager. Configured an admin account to authenticate using LDAP and assigned him permission to approve a session but it does not seem to work. However if i change the auth type for the admin user to local then he can approve changes. Does fortimanager have any such limitation?

We currently evaluating fortigate for using it as a client ssl vpn endpoint.Most of our users have notebooks where they are local administrators because they have to install software most of the time.All of this notebooks are domain joined.When they use the ssl vpn they should be able to work like as they are connected in house into our intranet. Only this notebooks should be able to use the ssl vpn endpoint. Our first thought was to use computer certificates as a 2nd factor. It looks like this isn't possible because the client does not show the computer certificates.We have user certifactes for client authentication and email signature. But they are exportable. Users could export them and use them on their private computers and successfully connect to the network. For now the only solution we found is to register the forticlient installations which generates more costs because we need to license the forticlient without using (at least for now) any of the other features

hi allstill feeling very new to the world of routing, switching etc so please forgive me if my question isnt clear. i have a nice new shiny fortiwifi 30d for my home FW/Router. The sad news is that my ISP, being cheap and nasty, have hard coded requirement for PPPoE traffic to be tagged with VLAN 100. ive had a bit of a play but i cant for the life of me figure out how to tag the physical interface. I created a sub interface and tagged this with VLAN 100 however this wont connect as the physical WAN with appears to take precedent. To rehash; need to tag all WAN interface traffic with VLAN 100? any help would be great. thanks.

Hi, Need suggestions. I was asked to do a remote SSL VPN solution for a hub-spoke network design. Three spoke has small unit onsite and they belongs to three different sister companies. The hub has bigger fortigate as well and IPSEC tunnel to each spoke. The requirements are:1.2-factor auth for remote vpn on central HUB Firewall.2. Each user authenticated via corresponding company AD.3. Once user is authenticated, user has access only to the corresponding company network4. Dedicated vpn client for user computer, no web browser based. My concern part is really the item#3 above. I do not even know if fortiOS can provide the feature to assign subnet/routing dynamically based on Domain user account with a single remote SSL VPN profile. However I can image to use different remote ssl vpn profiles for different company/domain users, such as user from Company A connects to "vpn.example.com/company-a" via forticlient; user from Company B connects to "vpn.example.com/co

'CLI Reference for FortiOS 5.2', for section 'execute set system session filter' states "Use these commands to define the session filter for get system session commands." Firstly, 'get system session' is a non-'Global' VDOM command, however, 'execute set system session filter' is a 'Global' VDOM command - so, I don't understand why they should be partnered.... More importantly, even I can't get them to work - observe: FG60C (global) #  diagnose sys vd list | grep root name=root index=0 enabled ....: FG60C (global) # execute set system session filter list session filter:         vd: 0         proto: any         source ip: any         dest ip: 208.91.114.47-208.91.114.47         source port: any         dest port: any      &nbs

I have noticed on a handful of my Forticlient's stopped receiving virus definition updates.  The log states cannot obtain updates. Update server responded with unauthorized access. Fortigate version 5.11Forticlient version 5.09 I have also tried update one of the workstations to 5.2.4 and it still cant get updates. Thanks

I have had a couple computers run really slow because Forticlient is installed.  When I uninstall, they go back to normal.  Any ideas what might be happening? Thanks

Hi Is it possible to allow a read-only user to change their own password in FortiAnalyzer 5.2? /Björn