Solved

Hello All, I have been facing a issue from last few days, i am not able to access https://slack.com, "https://hubspot.com" both URLs.Same URLs are working properly before. We are not using any Webfilter, Application Control, IPS or AV on our firewall. I tried to upgrade the OS to 5.2 but still same the results. There is no issue with internet service provide end. I observed in log that, the connection is closing immediately. What causing this issue ? Here i am sharing log screen shot. Kindly Help. Thanks in advance. RegardsNaveen.D   

Hello,Please I need to know if this vulnerability: "Multiple products cross-site scripting vulnerabilities" annonced by fortiquard, affecte all the fortigate device including Fortios 5.0.x ??

Hello, i have heard that appliances that can upgrade to 5.0 for example FG 110C and are now running fortiOS 4.0 , will soon not be supported anymore. can someone confirm this?

Hello,I have a problem with a fortigate 100D model. I have configured a policy with a VIP for relaying mail. Only SMTP (port 25)The policy has Antivirus enabled in Proxy - Block mode and a Email filter in Proxy mode and Discard mode for SMTP. When there is a normal mail I can see in the Fortigate logging that it has been scanned by the fortigate and then allowed or blocked. But when the client and the Exchange server negotiate a secure TLS connection the mail transported during this session is not being scanned. So the problem is that spam mail send during such a session is forwarded without any problem. What am I doing wrong? Has anybody else this same problem? Fortigate: 100DVersion: 5.2.1 Thanks in advance

I have been on the box all day and after about 4 hours I could not log back in I keep getting this message.  trying to log in through admin just get message. Your account has been lockedCan someone help with this.I have created a profile in the radius server and can log in through that but have no option in it. Cant log in though CLI either just get same message. Your account has been locked

Hi, My fortigate has the LAN IP 172.28.75.1/24. on this interface, I enabled the ping and https service for administration. My admin user has trustedhost specified (172.28.75.0/24). So, I'm able to ping from my LAN network. That's OK. My problem is : I've a VPN with a juniper, and I've configured the VPN monitor (this is icmp request to check if the VPN is UP), but my fortigate don't response, because my juniper's LAN is 10.0.0.0/24 (not in trustedhost). How can I enabling the ping from subnet 10.0.0.0/24, without enabling the administration of my fortigate? I already try with local-in-policy, but it's look like the action "accept" doesn't work.. Thanks in advance Lucas

Hi all i just bought a 92D to replace my 60DI converted config file to match new hardware and connected it to Juniper switch but nothing workedI searched what could be wrong on fortigate but all seems to be OKOn switch side, i saw that when internal1 was connected ( only this port connected to the switch ), MAC address was correctly learnt on the switch port but when internal2 was connected, MAC of internal1 disappeard from the switch and i could only see the MAC of internal2At this instant, my 60D is working perfectly on this switch so i think that the problem does not come from the switchare you aware about this kind of problem ?Is there any parameter to set up ? Thanks in advance 

Hi everyone I spend most of the day setting up a Fortigate 60D with SSLVPN configuration. I am using the FortiClient 5.2.3.0633 and Fortigate firmware is 5.2.2,build642 (GA).The PC I use is a Windows 7 and is not domain joined.  I want to map four network drives when connected to the SSLVPN. When I connect to the SSLVPN from my PC on a external network I get authenticated and the correct IP and DNS settings, even the correct DNS-suffix is pushed out through the tunnel. I am able to ping file server and I am also able to access the directory I want to map by using the UNC path which is the same as I want to map by the script. So everything is in place, but the logonscript in the FortiClient configuration. My XML file looks like this: <on_connect> <script> <os>windows</os> <script> <![CDATA[ net use S: \\SERVER\SHARENAME /user:#username#@domain.local #password# net use P: \\SERVER\SHARENAME /user:#username#@domain.local #passw

 There seems to be 4 firmware images for the 60D: FGT_60D-v5-build0670-FORTINET.outFGT_60D_POE-v5-build0670-FORTINET.outFGT_60D_MC-v5-build0670-FORTINET.outFGR_60D-v5-build0670-FORTINET.out The FGR is probably the rugged modelThe 60D_POE is clear. What is the difference between FGT_60D-v5 and FGT_60D_MC-v5?MC? I am sure this is just me being forgetful but when I search for 60D_MC I hit nothing. Thanks! -N  

Hi everyone, I had a FG 1500D and want to know if theres a way to aggregate my bandwidth from a different WAN Links. I already have load balancing with ECMP and DGD for every interface(4 WANs) and the respective set of policies for every interface. I want to know if theres a way to not only have load sharing and failover, also bandwidth aggregation. Kind Regards,

Hi, I am trying to get 2 FortiVM appliances (latest version) running as HA Active-Active as lab on top of vmware esxi 5.5. However doesnot seem like it is working. I followed handbook with just basic configuration on the virtual appliances but after two vm rebooted, both VM are claiming to be the master (from get system status output)...I login to the cluster but it seems like it is VM1 first time and then later refresh as VM2. It seems like VM2 overtakes VM1 as master while VM1 doesnot want to give up but keep sending G-ARP...Plus under the HA page on Web UI, I only see one unit. Another thing I notices during troubleshooting, both VM have serial number FGVMEV0000000000. Will that cause issue? HA is supported on FortiVM, right? Here attached are the HA configuration and running status of two VMs (rest of the config are Factory default+basic VDOM). Please let me know where I configured wrong...On VM1:FortiGate-VM1 (global) # show system ha config system ha     se

I have a FTG80C in working environment, And I will enter an additional FTG80C. I wonder if someone already set an active-active HA (High Availability) cluster with firmware 5.2.2 over fortigate´s 80C and are an stable solution, or what kind of bugs are find out additional to FTG80C documented on fortinet knowledge base; Does firmware 5.2.2 overwhelm hardware limits of ftg80´s in HA ?, and which one more stable firmware do you recommend to my HA cluster of FTG80C: 5.09, 5.0.11 or 5.2.2 Note: UTM configuration an VPN´s are already using half or my hardware resources on my stand alone FTG80C configuration over a fortios 4.0 MR3 patch 10, I am supporting around 60 LAN user´s 5 VPN IP-sec connections, with medium traffic.

In FortiView the "Top Destinations" report lists "Destination - Application - Sessions - Bandwidth".I'm trying to recreate that same view in a report. Does anyone have this already?

Hi, i'm using a FA VM64 in evaluation modeFortiOS version: 5.2.1I need set up my custom views, but none option is available; so i can't add, delete or do anything thereAll other funcionalities are working good. Thanks for the help. 

A customer of mine has got two seperate internet connections for redundancy, both fiber (one 50mbit, one 10mbit). We've placed two 100D's for routing and they now want redundancy on the IPSec VPN tunnel that goes to our datacenter (which also has two 100D's.The internet redundancy itself is configured with two static routes for 0.0.0.0/0 to the gateway of the provider with a lower priority for the 50mbit line, this works as is.I thought to do the same with the IPSec tunnels, so I created two tunnels, one for each provider. Below are the details:Tunnel 1:Name: CBB-Tele2 Local IP: 87.213.15.74 Remote GW: 212.114.98.85 Outgoing Interface: WAN_Tele2Tunnel 2: Name: CBB-KPN Local IP: 89.255.49.166 Remote GW: 212.114.98.66 Outgoing interface: WAN_KPNI’ve created two routes for the remote subnet and given them the correct priorities so that the Tele2 line is used as a primary interface.I’ve triple checked the Phase 1 and 2 settings on both ends, there are correct.Now for the strange par

Deleted 

Hello, I will install a HA of 1500D for a customer. I have two question about that : - Which bandwith will be used for session synchronization (There is approximately 400 new session per second and 10'000 sessions established) ? Is there a way to know the amount of traffic will be used ? - Is a good choice to use the MGMT1 and MGMT2 interface to HA heartbeat/sync session ? Or there is a hardware/software limitation ? Thanks in advance Lucas

Hi,I've to connect two FortiAP-221B in my wireless networks where there are several Cisco AP managed by Cisco WLAN Controller in bridged configuration with 3 different SSIDs. Now, I'd like configure my FortiAP without change the actual network configuration: now FG is def gw of wireless networks that use different subnets (and VLANs) corresponding to different wireless users. Users obtain IP address from external DHCP server. My problems when I try to configure FG-600C as wlan controller are following:- In my case, I have to configure FG wlan controller in tunnel mode or bridged? - IP address of Wifi SSID (def gw of FortiAP) cannot be the same of Cisco wireless network? FG gives error when I configure the same IP of other intrface as Wifi SSID- Can FortiAP have IP addresses of other subnets than wireless networks (for example IP of wired networks?) thanks!!  

I have a client with about 30-40 users. They dont want any UTM, so just plain firewall. They do have IPsec for both client connections (since they had a 60C and SSL was terribly slow) and a IPsec tunnel to a smaller office. 4 pcs of FortiAPs 221C. I think I will run them bridged, if 90D is chosen, so that the tunnel will not become a bottle neck (since as far as my testing goes the CAPWAP specs in the 90D datasheet only refers to tunneling mode). Money is not as important as speed, so I just want to make the best choice here. I want this unit to be ok for a couple of years. I know they might expand the other office, so there will be more IPsec office to office load, so that needs to be fast. Other than that its just plain internet/surf/download stuff that is important both over cable and wifi in the LAN. So basically, how would you think in this situation?  PS. By looking at the specs... if you say go with the 90D, is it even worth going with that, or would the

Hi, folks, Is there a built-in way of monitoring which version of FortiClient my users are running? We had an issue the other week that was limited to users who were on old versions of FortiClient (5.0.x, vs. 5.3.x).  I'm wondering if there's a systematic way to watch for users lagging behind before they become an issue. (I know there are third-party solutions for monitoring software versions in general, but I'm wondering if there's something specific to Fortinet for FortiClient.) Thanks.

I guess I have a few questions-- How can we check what our 'official' NSE certification level is?  For those of us that hold FNCSPv5, is this converted to NSE 4 already? Will NSE 4s receive express routing codes if partner certification levels are met? How long do partners have to meet the certification requirements laid out at the global conference? The FAQ stated that in addition to FAZ and FAM courses NSE 5 required online tests in the learning center?  Same question for NSE 6. Thanks,Gary

I am wondering how Event Management section set up.  Currently, I only see less than 400 events in the Event Management section and that is like 5 day span. I want to be able to go back in the history of far beyond 5 day span, lets say a month worth of events, including acknowledged ones. What type of issue is this and how can I fix it? 

Hi all, I'm having a weird issue and hopefully someone can help out. Here is my DHCP Server set lease-time 14400 set default-gateway 2.3.4.1 set netmask 255.255.255.0 set interface "DHCP-LINK0" config ip-range edit 1 set start-ip 2.3.4.6 set end-ip 2.3.4.10 next end set option1 224 '6638393565383261616333613637343334336265393336623133666631363436' set dns-server1 8.8.8.8 The "set option1 224" value is f895e82aac3a674343be936b13ff1646 converted to 6638393565383261616333613637343334336265393336623133666631363436 But for some reason, I'm seeing the FortiWifi serial # being handed out instead. I've deleted the option and the dhcp server and recreated. I've tried 3 completely different FortiWifis with the same "base" config and they hand out their own serial instead of the actual value for option1 224. Any ideas?

Hi, What command in gui or cli should I follow in order to see the mac-address of each interface of the fortigate firewall 100D? Like show arp, then show mac-address in a cisco switch.  Thanks,

Hi,This drives me crazy and I didn't find any solution that is working as expected.Our Setup2 FGT 1000C Active-Active Cluster (Firmware v5.2.3,build670)12 Forti Access Points 221B (Firmware: v5.2-build0225)Forticlient 5.2.3.0663Port 12 dedicatet for Forti APsPort 3 Internal LANSSID s24.ito (Enterprise Authenticated)We want to achive that Mobile Devices can connect to several Services (like Fileshare) in the Inside LAN. For security reasons this only would be allowed, if the Forticlient is compliant with the designated profile.What happens...- If I connect my Notebook to the Internal LAN (wired) the Forticlient registers silently to the Fortigate and Status stay On-Net- If I connect to the Wireless Network (s24.ito), the Forticlient doesn't register silent and after a while (about 2mins) the On-Net Status shows offline, thus doesn't allow me to connect to Internal Services- If I register manual (I can see the Fortiagte with IP of the s24.ito Network), it registers successfully, but afte