Solved

Hi I migrated over to my HA Fortigate 100D setup from my Cisco Router. What I have noticed is that with external requests going to my internal NAT server, is it is showing that the external connection is made from the VLAN interface IP address instead of the original external Source IP. this is a bit frustrating because some Linux machines behind the fortigates are blacklisting the interface address due to failed hack attempts because it all seems to come from one address -- hope this makes sense. so an external requests looks like its coming from the interface address 192.168.30.254 and not the original source public address of 41.xxx.xxx.xxx etc. hope this is just me making a noob mistake on the new toys... 

Hello all,I've got a problem with Skype connection. Sometimes it works and sometimes skype can't connect without any clue.. On application control, i've granted acces to Skype I've set a rule that use appsensor, and open a port.  But it change nothing. sometimes i can conenct slype but sometimes no.. Have you got an idea? Regards,Alexandre

Im running V5.2.4 build0688 150722 GA on my FortiWiFi 60D-POE but the packet capture feature is missing from the menu. I have read that you can get to the packet capture util directly via a URL which works but the GUI should have a link to it. Do you have to enable this now like you do with other GUI features? Thanks

Hello, I have sucessfully managed to block http and https traffic on my Fortigate 100D but for some reason, if I open Google Chrome, all blocked HTTPS sites are accessible wile HTTP sites remain blocked !!! I tried with Safari and Firefox and both HTTP & HTTPS sites are blocked... Is there any reason why Chrome is bypassing the firewall settings? The settings on the firewall are:SSL/SSH Inspection ON, blocking HTTPS trafficWebFilter ON, blocking all websites (* wildcard - deny) and allowing only 3 specific ones.IPv4 Policy that incorporates the above rules.

Hello, I am having a problem creating a site-to site VPN tunnel that has one side behind NAT with dynamic public IP.I followed the instructions on the below video as the scenario is exactly as mine and that is what I am trying to accomplish but, the FortiGate firewall never dials in (or it tries but it fails...)  [link]https://www.youtube.com/watch?v=AMVkOVPzOCw[/link] Can anyone please shed some light? Thank you in advance,Thanasis

Using 60C hardware I've been asked to connect to a vendor VPN gateway. The only details I have been provided are IP address, username and password, and the fact that we "are able to connect just by creating a VPN connection in windows".Connecting from a Windows box doesn't suit our needs.I'm familiar with ipsec point to point but not dialup.All the vpn information I can find is either point to point or where forticlient / iOS / M$ etc are the dial up clients and fortigate is the vpn gateway. I've searched this forum, the kb, the handbook and the cookbook.I found the Microsoft VPN section of the handbook but the fortigate is the gateway not the client. Even that mentions username, password and psk but we haven't been advised of a psk. Can the fortigate act like as a dialup client similar to a windows VPN client? Is the information provided to us sufficient? edit - we will have a dynamic IP and traverse a NAT.

Hello, I have configured site to site vpn between Fortigate 200D-800C, and the  tunnel is up, but there is no traffic going out and coming in, after investigating by capturing the icmp traffic, I found that the source address traffic is coming from the Management Interface rather than the required LAN Port 1. please helpThanksAhmed

I'm attempting to setup netflow and am not having any luck. I have a fortigate 80C and am using PRTG for monitoring. I followed these instructions found from Fortinet, but the probe says no information has been sent to it. config system netflow set collector-ip <address> set collector-port <port> set source-ip <address> set active-flow-timeout <integer> set inactive-flow-timeout <integer> end   I set the collector IP as the server address that has the PRTG probe on it, the port to a UDP port that wasn't used, and it matches what PRTG is looking for and I made sure there was a rule in the local firewall to allow it. The source IP I wasn't sure exactly what should be used, so I entered the routers IP address, and the timers I set to 1 and 15 respectively.   Any insights on how to get this fixed would be very helpful, I'm looking forward to collecting the data on my WAN usage.   Thanks   Jon

Hi All, I am a P-12 school and have a 300C running 5.2.3.  We have a mix of PCs, Macs and iPads.  While we have a Windows AD Domain not all of our devices are bound or login to the domain.  We don't have access to our WLC to do any Radius authentication. I'd like to setup the ability for staff to optionally authenticate with the Fortigate to gain extra web access.  This would allow them to access sites that are deemed inappropriate for the students.  I don't want to force the staff to have to authenticate all the time, and I don't want all our students to have to authenticate either. I am quite new to the Fortigate so am wondering how others would go about achieving this? Thanks in advance,Chris.

Hello, we are going to buy a pair of 2 new Fortigate 900D boxes to replace our old devices.Unfortunately, the Fortigate support/ intrusion prevention subscription for our old firewalls will end next month. Now I´m asking myself what will happen with IPS?[ul]Will IPS continue to work with old IPS signatures?Will IPS completely be deactived?[/ul]Thanks

Hi All, Managed to source a brand new Fortimail 100 but very old with V2 firmware.  Upgraded to 3.5.4 (Build 531) which seemed to go OK apart from a user auth prob on POP3 and IMAP.  The upgraded to 4.0.4 (Build 146). The upgrade seemed to go AOK.  Can login via SSH.Can login as a webmail userbut if I go to HTTPS://fortimail/admin I get the login screen, auth AOK but then I get to https://192.168.100.95/admin/FEAdmin.html but the screen is blank!I cannot get any admin view via the web access.Anyone got a suggestion? to make matters worse the box is now refusing SMTP connection attempts with Error 451 4.3.2 Try again later Should I just bite the bullet and do a clean install of 4.3.9 (Build 548) and just start configuring afresh?

Hi,if I try to update our FAP320C to 5.2.4 (build 245) i get an error with wrong Image. on the FAP is FortiAP-320C v5.2,build638,140916 (GA)... RegradsByterunner

We have an FG200B running v5.0.9 and we want to start using the Transparent Web Proxy features again (we do have an SSD in the FG200B).I configured a Policy limited to just a couple of PCs and ticked the appropriate box.  The Monitor in the FG200B shows that the transparent proxy is working.  So far so good.Now I want to configure an Exempt List for URLs which don't work so good with the transparent proxy. Nothing I can see in the GUI, so I check the FortiOS Handbook. It says go to "WAN Opt & Cache > Cache > Exempt List" ... except my GUI doesn't have this option.The handbook also says use "config wanopt webcache" and then "set cache-exemption enable" ... except my CLI doesn't have this option.Can anyone shed any light on this?  Does the FG200B simply not have this level of configuration available?  I know it used to be available back in v4.3, so was it removed for some reason?

Hey,I've been playing around with the new User-Source based policies but unable to make them work.I have the following policy which is placed at the very top of the list but it just doesnt work (see attached image).Instead, it falls through to another policy I have that allows internet for the entire office.What am I missing?ThanksGil 

How can I monitor/see all session of a particular IP?

Hi all I have recently purchased a pair of FortiGate 240D but am concerned about the following limit in the maximum values document: MAC address table size - 200 I plan to run some wireless access points directly into the switch ports of the Fortigates so there will be more than 200 wireless clients and MAC addresses that the unit will need to know about (these will be dynamic ARP entries, not statically defined). Can anyone clarify what exactly the limit above refers to? Thanks

Trying to access EMS from any browser and get an empty page with CONT|0|. Any ideas?  

Hi Fortigate 3240C v5.2.3 As a college I have to make sure that the users can access resources but to restrict them access to sites that they should not have access to. Because of this I have enabled SSL deep inspection which works really well apart from Google.  I have noticed a few Google sites such as Google drive and Google classroom that do not work with deep inspection so I have had to disable it for them. Even though the certificate is correctly deployed to systems, Chrome still complains that its a possible 'Man In Middle' attack. I would like to add *.google.com into the bypass list but I cant because some students have worked out how to search for porn using the following link. Safe search mode is enabled in the web filter, but if I use *.google.com in the bypass list then they can just use the HTTPS site to bypass the web filter.  The URL is an example of a what some of the students have used to bypass the filter. Note: this link will displ

Hello, What I would like to know is how do I set up a default gateway for a WAN that is manual (Static IP?) I know you can go to route --> Static route and just add that as a default route for everything outgoing.However is there a way to set it as let's say PPPOE ? Where we can assign a default gateway?

Hi,Would anyone happen to know if I can assign secondary IPs to a VRRP instance (multiple redundant gateways inside same VLAN) on a Fortigate?In fact we wanted to test a migration scenario from another vendor, now we're already stuck.As far as I can see I can only "set vrip" on a specific instance once.Thanks and best regards,Marki

How can I show interface errors ? the command diagnose hardware deviceinfo nic is not prompted v5.0,build0310 (GA Patch 11)

Hello, i have some strange problems on a 200A 4.0 MR Patch 15. The FSSO is Runnig with a DC Agent on Domain Controller. DC Agen Version 4.3.0129 so the Problem is... The DC Agents collects the User Logons Properly u can see all the users on "Show logon users", The DC Agent is connected to the Fortigate and if i do diag debug authd fsso server-status it is "connected" But the user logons are not passed to the Fortigate. if i do diag debug authd fsso list = there is no users, so my FSSO Firewall policy doesn´t work. do anyone have an idea how to solve this?

Hello, About Port Allocation settings into TS Agent Configuration, we are not sure about the field "Maximum Number of Port Alloc Ranges"! Do you know what this field means exactly?Does it mean the maximum number of separated ranges (of allocated ports) per users, or the maximum of users who can obtain a range of allocated ports? Regards,Christophe 

I'm using XML configuration for my FortiClient profiles.   I created a profile on the FortiGate with the desired settings, push it to the client, then I exported it into XML to use on the FortiClient profile on the FortiGate.   I had Application and Web Filtering set to specific profiles.   I have noticed in the XML, it has the settings from those profiles, but not the profiles themselves.   This is not desired as I want to be able to just update the Application/Web profiles not edit the XML for every little thing.   Is there a way to specify Application and Web Filter profiles in the XML?

client behind FW    --->    their FW     -----------internet------------>    FortiGate FW What ports should be open on FW to let FortiClient make an outgoing SSL VPN connection to FortiGate FW?