Solved

Hello Please, can you give me an example about the configuration of Wi-fi by CLI in Fortiwifi 60D with wpa2? Thanks in advance Regards!

I have successfully managed to configure FortiGate captive portal authentication through an OpenLDAP server on a 60D firewall. Now the problem I am facing is that I made it to work with individual users that reside on the OpenLDAP server.What I am trying to accomplish now is instead of having to add the LDAP users on FortiGate individually, I would like to have a group on the FortiGate that points to the same LDAP group and any users in that LDAP group to be able to go through the captive portal. I have setup the group on both FortiGate and LDAP but when I am trying to login on the captive portal with a user account that belongs to that group on the LDAP, it says Authentication Failed. Any ideas? 

Yesterday I was at a customer who had a transparent setup for UTM filtering.I am not very familiar with transparent configurations, but the FGTs only had a few commands available to be run. For instance, 'diagnose' and 'get test' amongst others, were not available. What could be the cause of this? They were running FW 5.2.4 on two 310Bs in HA. The admin account had super_admin rights. Another question: A previous administrator had activated Web-Filtering on an inbound rule. What can be achieved from this? I don't understand how that would work.

Dear All, this forum was helping me a lot, my question is previously our company was using ISA server and the reporting was pretty good and they need the same like report. Which is for each user they need to have site, category, hits, browsingtime, bandwidth. I tried preparing the report but the user will come on the left column and they need separate sheet for each user like in the attached report. This will be a great help if we can have it. Thank you for reading and helping me :)

Hello I am running a FortiGate 300C with Firmware Version v5.0, build 0318 (GA Patch 12) in the NetworkIn the NetFlow stats on the network, I am seeing a huge amount of traffic (more than 30%) being used by Apple Software Restore (7800) What do I need to do so that I can block this traffic absolutely? If any one can advise on this will be much appreciated.Please let me know if any further information is needed from my side. Thanks in advance  

Hi,We need to decommission an Active Directory domain controller and are having difficulty removing it from our SSO configuration.  In the Users and Device>>Authentication>>LDAP Servers page, the option to delete the LDAP server is greyed out.  There's no option under the Single Sign-on page to disassociate an LDAP server from the Local SSO agent.  I can't seem to find anything online on using the CLI to remove a server either (lots of info on adding them).  Any help would be appreciated. We're running FortiOS 5.2.4, and are using the Local SSO agent in polling mode.

Hi All; I'm trying to block facebook and youtube https acces, so i flooowed the steps described https://www.youtube.com/watch?v=-7OUDfhtc_g but it's still does not work for me. Reagrads

Hi all, I tried to set up a FortiAP 14C for the first time and have some questions. One of our customers wants to connect a few branches with the HQ, using FortiAP 14C on the remote side and a FortiGate 40C in the HQ. Each FortiAP should connect devices via WLAN and LAN with the company's network as well as offer them access to the Internet. I found several videos and documents describing the setup of 14C as an AP for WLAN and LAN and following them, I could establish connections as wanted. But this works only, when the FortiAP 14C is located in the same network as the FortiGate 40C. My expectation was, that - if this works fine - I could bring the AP to the branch and the same functionality would be available. But unfortunately, the AP does not establish a VPN connection to the 40C. So, obviously, I misunderstood the setup. Unfortunately, I don't find a document or video which describes the necessary configuration tasks for our environment. So my questions are

Hi, i have two fgt600C on A/P cluster running FortiOS 5.2.4, my issue is i have two different license on both FGTs (Primary Bundle, secondary NGFW) so am missing the AV on the 2nd device, now the issue is whenever there is an update it shows expired . how do is solve it is by bringing down (reboot) the slave run the update on master works fine connected back again . is my issue is related to license difference ( since 2nd device does not have AV license so when there is an update it reflect the status on master ) or its something else.  

Hi Back in FAZ v4.2, there was a built-in report called "Top Allowed Categories for Most Active Users" (see attachment).  You could see at a glance who the top offenders were and where they were spending their time.  It was based on web page requests, whereas FortiView now uses sessions, which surely isn't the same (ie. you could potentially have one session open that is generating millions of requests).  There was also a filter called "Include Web Clicks Only", which removed all the other embedded links to advertising, etc.  This was probably the most valuable report the FAZ produced.  Our managers loved it because they knew who to speak to about their web browsing behaviour. Fast forward to v5.2, and while it has many good individual reports on users, categories, etc., it doesn't have a single report that combines these together in a powerful way like the above report did. I've tried to work out how to create my own dataset, but as others have

Hi, I wonder if you can make HA with two FortiGate 30D on the datasheet says no, but I've read several times on the internet people saying they could using text mode, it really is possible?

We have many disconnections of the FortiAp 222B with its controller (Fortigate 500D). The event message is the next: - Control message maximal retransmission limit reached You can see the event in the next image: We have more FortiAp in the same network working well Has Someone had this error and know the solution?  

Hi Is it possible to define a different timezone for a report?Right now it will always use the timezone of the fortianalyzer. We want to send reports to branches in different timezones, and use their local time in the report.And also use a specific local time range, like 'yesterday'. BrgdsSander 

Hi We are using an FAZ1000D with FortiOS 5.2.3.We would like to send out a threat report every morning, but only if threats have been detected. Is this possible? We don't want to receive any empty reports. Additionally we would like to hide pages in a report.The default threat report has 3 categories (Malware, Botnet and Intrusions) would it be possible to hide the categories in a report which don't contain data? Thanks & BrgdsSander

We have a Fortigate 200D running the 5.0 firmware. When I use the Packet Capture, I notice some odd behaviour that I do not understand and wanted to know if this is normal or is there a problem. I select the Packet Capture option via the GUI. System > Network > Packet Capture I create a new packet capture and select my criteria. Sometimes I filter certain hosts and then start the capture. When I attempt to generate some traffic to one of the hosts in the capture criteria, I do not see all of the packets. Particular examples include the following:[ol]I generate a continuous ping to a host, the packet capture captures the first two ICMP requests and responses but doesn't capture anymore than that, even though the ping is still running in the background.I SSH to one of my hosts, the packet capture gets the first few packets (the three-way handshake) and maybe one or two more but then fails to capture any of the rest of the packets.[/ol]I should point out that the firewall

We have a Fortigate firewall in active/backup configuration running FortiOS 5.0.9. TL;DR Firewall intermittently stops passing https packets from iPhone or iPad with message on the firewall of "no session matched". Just posting this here in case anyone else is experiencing this odd issue. More information Recently one of our users noticed that they were unable to access an internal application that is essentially a web site that uses https. They can get to the initial page of the web site but not beyond it using an Apple iPhone or iPad client. We have done a lot of testing at each stage of our network and traced the packets through the network using Wireshark and some network taps. We tap the fibre going into the firewall and we can see packets going in, however they never emerge out of the trust interface, past the initial loading of the web page. Essentially, the packets are getting all the way through the network until they reach the firewall.&nbsp

On my fortimail unit the Anti Spam Definition is 7.00286. How can I check if this is the latest definitions available from fortiguard? 

Hello, I have 5 external IP`s addresses from my ISP. I added those addresses to WAN1 interface. I have several servers in DMZ (e.g. mail server), whose services are accessible from the outside. I created the appropriate VIP addresses and traffic from Internet to DMZ goes to the correct servers. But all the servers from DMZ and LAN internet users go from one address (primary WAN1 address). How can I set different external IP address for outgoing servers traffic?

     I have an IPSec site to site tunnel between a FortiGate 110C and Cisco ASA5510.  There is a single NAT happening on the Fortigate side that translates the LAN addresses to a block of addresses.  All traffic between the hosts on the ASA side and hosts on the FortiGate LAN are working correctly.  The issue comes into play when self originated traffic from the 110C is pushed across the tunnel, in particular sFlow data.  When the source IP is set to default, the traffic is pushed from the WAN IP to the tunnel interface.  When the source IP is set as the LAN interface the traffic is being directed to the tunnel,  however, it is not using the NAT pool of addresses for the tunnel traffic.  As a test I used IMCP to flesh this out.  execute ping-options source 0.0.0.0execute ping ASA HOSTthis failsexecute ping-options source LAN IPexecute ping ASA HOSTthis failsexecute ping-options source TUNNEL NAT POOL e

Hi All, 1. I'm very new to Fortigate2. It's a Fortigate 60D3. I did not configure the router myself and there is no document on how it was done :(4. Some program wants to reach an external website on port 8008. Somehow I have the feeling that the Fortigate is not allowing that. 5. Can anyone point me in the right direction to check this 'blocking' behaviour and make sure this traffic is allowed? All help appreciated,Regards,Gerard

Hello folks, I recently upgraded to firmware 5.2.3 (from 5.0.x) on FG-40C. However, after the upgrade, I no longer see the Advanced option under DHCP Server (System > Network > Interface) I am running the FG-40C ports in internal switch mode (but my understanding bot switch mode and interface mode should have the Advanced options under DHCP Server).   I have attached a screenshot to this post. Has anyone experienced the same issue?  Any help would be much appreciated. Many thanks.  Cheers,Arthur

Hey guys, I have a box which I'm building a site-to-site tunnel on. The remote site has two locations, and my box should be able to 'fail' to the second location if the primary is unreachable. From what I understand, this should be as simple as creating a phase 1 for each location, and using the 'set monitor "primary-phase-1"' on the secondary tunnel - like this: config vpn ipsec phase1-interface    edit "Primary"        set interface "wan1"        set nattraversal disable        set comments "To Primary Location"        set dhgrp 5        set remote-gw XX.XX.XX.XX        set psksecret ENC xxxxxxxxxxxxxxx    next    edit "Secondary"       &nb

I blocked user MAC Reservation + Access Control, but if the user sets himself a static IP address, it uses the Internet and network.How to fix?Fortigate 80c

Hi,I was trying to figure out how I can subtract "from_dtime(dtime)" of "now()" and count the interval in days.I was wondering if somebody knows. Tks folks.

I had this issue before in a version prior to 5.2.2.  Worked perfectly in 5.2.2 updating to 5.2.3.  Looks like it's a problem again. Anyone have any ideas?  Removing the old version to install the new is not really an option.