Solved

Hi Does anyone knows if FortiOS support discontinuous subnet mask like 10.0.128.0/255.0.255.0? Our networking team make use of discontinuous mask since our Cisco switch support it but I can't find any information about the FortiOS documentation.   ThanksDominic

Hello All, At a client, I have some issues adding a "newly" received fortigate 100D after one defective member has been replaced by Fortigate.The problem is that the firewalls now have different buildnumbers and when I try to join the new member, I get the following warning:fortinet HA cannot be formed because the internal ports of box is in different mode with this box, ... I have checked the interface name and they are different on the two boxes.On the primary node, it's name is: internalon the received node, it's name is: lan I have one backup of the primary node that has been working as standalone during a year and a half.The current firmware version = FG100D-5.02-FW-build618-140915I have uploaded the firmware through TFTP in the preboot menu (on received node). How can I restore the HA with these two firewalls?I need to change the cfg file of the working firewall? If so, what and where?I can change the name of the interface on the received firewall? I've b

helloi have strange problem.i have fortigate 60. the problem is i can't ping from CLI console some IP addreses.for example, i have server with ip 192.168.1.15ping to this address gives 100% packet lossif i change ip of the server to 192.168.1.5 the ping working fine.i can't find anything blocking addresses 192.168.1.11-192.168.1.20anyone have idea why is it? thanks.

We are running 5.2.2 on a Fortigate 100D.I have set up at SSL VPN portal with web mode only (no tunnel).In the bookmarks I have added a webpage that is only accessable through a VPN tunnel. I have added a policy that allows the access from ssl.root to the IPsec interface that the website is behind.But I see that traffic from the web mode only portal is originating with a source address of 192.168.1.99 which is the default management IP of the fortigate. I have greped through the whole config an can not find any relation between ssl.root and the management IP. Access to the website is not working (ofcourse) since the management IP is not part of the Phase 2.I have also tried to turn on NAT on the policy, but it still shows the management IP when I run diagnose debug trace. Do anyone have any idea on how I can change the IP that the web mode is using or a way to NAT this correctly?  

I'm having trouble finding a way to change my authentication mode from "Aggressive" to "Main" while connecting via OS X Forticlient. I'm testing with IPSec Remote Access on my Fortigate 200D and my windows workstations connect fine, because I can set them to "Main" mode.  Everything is up to date, including the forticlient application. Any ideas?

Hi all, I am about to implement the SSL Webportal in our environment, but cannot find an answer to the following question:My WAN-interface has a public subnet assigned. When setting up SSL I need to select which interface to listen to, but I cannot see where to assign a specific IP where I want the service to listen. Is this controlled by a policy? I don't want the SSL Webportal to listen to all public IPs. Thanks in advanceRegardsMichael

I have configured my fortigate 80C firewall for SSL VPN...& am able to connect also thru it..only issue is am losing internet connectivity after getting connected to VPN... any idea?? EDIT: I have enabled split tunneling & now everything is working...

I notice that when the FortiMail sends outbound mail, it's using the RC4 cipher: it looks like (version=TLSv1.2 cipher=RC4-SHA bits=128/128) when I view headers for a message sent from the FortiMail. We're using version 5.2. I'm sure it can be set to AES128 or something better, but I'm not sure how to achieve this. Any thoughts?

I have a Foritgate 80C which I recently upgraded to v5.2.3 build 670.  I am hoping to test this configuration with this unit before purchasing a Forigate 100D or 200D firewall. Issue: I have 2 ISP's and utilizing both WAN1 and WAN2.  When WAN1 is active, I cannot receive traffic inbound (such as a ping test) over WAN2.  If I shutdown WAN1, the traffic (the ping test as well as RDP and other tests) start to work right away over WAN2.  If I activate the WAN1 connection again, the traffic inbound on WAN2 stops as soon as the interface is up. It would appear that while WAN1 is active, inbound connections to WAN2 are not allowed. Basic Config / Testing (IP's are fake): (Please read this from top to bottom, basically this is me working logically through the configuration w/ my results as I progress) Internal1 (LAN) Mailserver for testing - 172.16.5.10 WAN1 - Static IP Address - Have 5 Static IP's I can use Interface has IP Address 10.0.0

Hi, I recently restored a configure from my production 310B Firewall to my backup Firewall (Same model) after restoring the config I am getting very bad pings and spotty connectivity on all ports. I reset to default installed the same OS and then brought over the config. I would rather not build from scratch if I don't have to. Thank YouMarc

Hello,I have FortiOS 5.0.11 but it is not still clear how it works. It has been enabled HTTPS inspection with CA sertificate (Fortinet_CA_SSL_Proxy) but on web filter profile scan encrypted connections is not configured. I can't understand why actually scan encrypted connections is disabled. Maybe a lot of traffic can't be scanned because of this ? Maybe also application control could benefit from enabling scan encrypted connections ? Another question is about the way Fortigate use it's own certificate for ssl inspection. Can Fortigate work as man in the middle to deep scan HTTPS traffic ? Regards

I have a virtual server setup from a public ip to an internal server ( owa ) with ssloffload.  The server has the necessary fortigate certificate and the fortigate is presenting the original server certificate to the clients coming from the web.  It used to work well in 5.0.9 but since I upgraded to 5.2.3 it's no longer working.  Web browser give bad certificate error.   I cannot open the page at all.  Where there any change in the way ssl or certificate are processed in 5.2.x that need to be manually adjusted ? The certificate is not expired. Any idea what could have happened? Thanks

Dear all,i have a fortigate 100D version v5.2.1,build618, i need to set a rules to block all streaming video from YouTube and Facebook YouTube was close, but Facebook video streaming is still open

After automatic installation of 200 FortiClients, every one downloads about 200MB of signatures from Internet. This means: 40 GB have to be downloaded just for FortiClient installation. Can I avoid it? Consequent updates are smaller and are not using that much of Internet so the problem is just installation. I don't want to buy FortiManager only for first signatures update. Is there any way to import current signatures from local file into FortiClient after installation?

Hello everyone, I have been asked to give 2 tenants in our building public IP ranges for their use.Tenant 1 wants 5 public IP addresses and tenant 2 wants 12 public IP addressesWe have 32 public IP's of which we are using 5 on a Fortigate 100D v5.0.9They must have public IP's and not nat'ed private addresses. How would I configure this. Thanks

Hi Guys, I desparetly need your help, I'm trying to create a VPN Connection between the Fortigate 60C and Cisco 881 Router. I have tried everything and there is still no positive result. [>:] Phase 1 negotiation is successfull but there is no Phase 2 Start. I have tried both Links under  http://blog.webernetz.net/2015/02/05/ipsec-site-to-site-vpn-fortigate-cisco-asa/ http://blog.webernetz.net/2015/02/02/ipsec-site-to-site-vpn-fortigate-cisco-router/ And non of them really gets me going forward. Do you have Experience with such devices? I have managed the FortiGate until now without any Problems, have created a VPN but from Forti to Forti. But now we need a VPN for a Customer and this is quite Challaging now... Thanks for your Help in advance. Best Regards, Ziga

I have a Cisco core switch which is the one in charge of routing the internal traffic between VLANs everything in the internal communication is working fine I mean VLAN 20 has communication to any other VLAN in my organization nevertheless  I added a VLAN interface in my Fortigate 600C with FortiOS 5.0 build 0271 Patch 6 config system interface     edit "VLAN 20"         set vdom "root"         set ip 10.1.20.2 255.255.255.0         set allowaccess ping https         set snmp-index 35         set interface "port1"         set vlanid 20     next end when I try to ping from a pc in the subnet and VLAN 20 gaves me the following error:# diagnose debug flow show function-name enable # diagnose debug flow filter addr 10.1.20.3 # diagnose de

I have this problem with few remote users of my company. But its very urgent to give him sslvpn access to have work from remote location any time. But when they try to connect forticlient sslvp stop at 98% & disconnect. I have tried uninstalling & reinstalling application, also tried different versions, disabled windows firewall, antivirus and unchecked IPV6 but still no luck. Please tell me the correct solution. I am sick of thisissue.

We are running an old version of FortiOS 4.3 (patch 6) with a known memory leak.  Obviously it needs to be updated.  In the meantime, once a month one of the network engineers was killing the rogue process to free up the memory.  He has since left the company and didn't document what the process was or how to kill it.  All I have is a Fortinet ticket #. I connected to the CLI but the only CLI commands available (both via web and ssh) are config, get, show and exit.  I'm looking at the FortiOS Handbook CLI Reference for FortiOS 4.3 and is says the command I should use is "system performance top".  However "system" isn't valid (5499: Unknown action 0 Command fail.  Return code -1) What might be the reason "system" isn't available? 

 Hi All, I am seeking advice on how I can fine tune our spam settings to help produce a better result.   Our system is setup to send pretty much everything to quarantine as when we had our profile set to discard we were having too many false positive emails and users were complaining about not receiving email.  Unfortunately, this means that many users are getting regular spam going to quarantine and the quarantine reports themselves have become spammy in nature (two reporting periods a day) Now I feel dumb doing it this way as the system is correctly identifying so much spam that we are just pushing to our users quarantine anyways, but I am unsure how to filter those out, while keeping things loose enough that we don't get a high false positive on legitimate mail. Primarily we have trouble with parents emails to schools from local ISP email addresses where the ISP servers are constantly jumping on and off of blacklists. This wouldn't be an issue

Hi All, What is the rule when creating a New FortiAP Profile, if you require multiple SSIDs to be added to the given Profile...how do you balance the SSIDs between the two Radios and Channels? FortiAP = FAP220B.SSIDs = Staff; Guests; Contractors; Auditors. If I enable all of the above SSIDs for both Radio 1 (5GHz Band - All Channels) and Radio 2 (2.4GHz - All Channels) and Apply the New Profile to just one FortiAP...I see the FortiAP Broadcasts all SSIDs from one selected Channel out of the 5GHz available Channels and then one selected Channel out of the 2.4GHz available Channels. Therefore its perfect that all of the SSIDs are available within the 5GHz Band and the 2.4GHz Band. So I am seeing: -FortiAP # 1-Radio 1: SSID = Staff; Guests; Contractors; Auditors  - Channel = 36Radio 2: SSID = Staff; Guests; Contractors; Auditors  - Channel = 12 But the question is, would there not be a conflict between the SSIDs broadcasting over the same

Hello there, Currently testing a Fortigate unit for possible use in production soon.We have a scenario where we need to set URL filtering based on LDAP group membership but the group membership changes frequently. A user could be in and out of a group multiple times in a day, for example. We're using a collector agent with DC polling for collecting user details at the moment, which seems to be working well enough (300 users), and it seems group membership gets updated fairly frequently with Windows users (I'm guessing with the ~5 min workstation checking interval), but Mac OSX users' group memberships don't get updated until a logoff or screen lock/unlock. My question is, is it possible for the Fortigate to update group membership for Mac Users without them having to logoff and back on again? Any other approaches I should be looking at? Help/advice greatly appreciated Cheers.  

Dear Experts, In FortiVew > Summary View > SSL&Dialup IPsec, I can see SSLVPN users and IPsec branch offices successfully connecting to our Fortigate-100D.  But strangely, all the Connection Time of Dialup Session are same."01/01 09:00 - 01/01 09:00" In Fortianalyzer, other time and date of logs like "Top source" "System Events" are  working correctly.I also checked VPN logs in Fortigate, and found that those time are correct.  How can I fix this?  Any ideas?  - Fortianalyzer-200D with 5.2.1(latest) Thanks in advance  

Hi, I've been on a steep learning curve as I work towards implementing a Fortigate 60D running 5.2.2, however I have got to grips with most elements so far.However I've hit a wall in understanding how I can create a policy allowing access to Microsoft & Windows updates for all.Using Microsoft's lists of required URLs (some of which are wildcard) as published here: https://technet.microsoft.com/en-us/library/dd939870(WS.10).aspx I've attempted to create a urlfilter webfilter as below (based on comments in this post https://forum.fortinet.com/tm.aspx?m=122223) :config webfilter urlfilter edit 141 set name WindowsUpdate set comment 'Windows Update URLS' config entries edit 1 [size="2"] set url [link]http://windowsupdate.microsoft.com[/link][/size] set type simple set action allow set status enable next edit 2 [size="2"] set url [link]http://*.windowsupdate.microsoft.com[/link][/size] set type wildcard set action allow set status enable next edit 3

Please see the attached. This message appears with websites that I have blocked. Thanks for your help.