Solved

Hello all,i would like to use our fortigate unit in order to Block Tight VNC from entering or leaving our organization.how do i achieve it? Thanks,s.  

Does the 60D not support DOS-Policy GUI? Per the 5.2.3 release notes the following issue was fixed:260342 The DOS Policy ID may be missing in the GUI Thanks!  

Hi All I am new with fortigate 100D ver 5.0 firewall.I need your help how to allow specific users from LAN to access facebook?.step by step procedure would be really helpful. 

Can FG300D support site to site vpn with mikrotik router?I may need to enable site to site vpn with a 3rd party business network.they are using mikrotik brand of router with firewall features.what type of vpn method should i use? from their website, the following technologies are supported  Ipsec – tunnel and transport mode, certificate or PSK, AH and ESP security protocolsPoint to point tunneling (OpenVPN, PPTP, PPPoE, L2TP) Advanced PPP features (MLPPP, BCP) Simple tunnels (IPIP, EoIP) 6to4 tunnel support (IPv6 over IPv4 network) VLAN – IEEE802.1q Virtual LAN support, Q-in-Q support MPLS based VPNs 

Enable multiple IP addresses on VDOM-links VDOMs and VDOM-links are a great feature on the Fortigate Firewalls, however they have limited functionality compared to physical links. The one feature they miss that requires me to use loop-back Ethernet cables on the Fortigate is the inability to add multiple IP addresses. I also tried to workaround this by adding extra VDOM-links but they are not allowed to be in the same IP range. I hope you will add the very useful multiple IP feature to the VDOM-links in the near future.

Adding support for Firewall address and service objects for Virtual IP Fortigate Firewalls have great functionality to limit the firewall rule mess that many other firewalls have. You can create named services and service groups instead of filling in ports all the time, you can create names addresses, address-ranges and group these, and even add colors to the various objects to make the firewall rules transparent and easy to understand.Unfortunately Virtual IPs for Port Forwarding feel like they were forgotten. As here you will need to fill in IP addresses and Ports manually instead of being able to choose from the named and colored firewall objects.The worst part is that to forward a port you will need to add the address and port/service as a firewall object to create the Policy rule but you need to add them manually in the Virtual IP. So as a firewall admin you have to do everything twice. If You want to change a port of address you have to do it twice too.Another disadvantage i

i'm using fortigate 200D in my network and want to do some rules to our groupsI decide to make restricted Internet access to certain groups in particular Time.does it need to be synced with our Time Zone Area?   (specially in daylight saving) and other question ishow can i increase admin TTL?when i login to console after 15 min it will disconnect from web console and i must login againgis there anyway to increase this time? Regards

Hello, after reading this, and looking into the gui, it seems that fortigate only supports monitoring to a single IP. This is quite inconvenient because it can be affected for temporary provider issues, rate limitting, monitored ips that change (i.e a public dns server that stops accepting pings).Are there any plans to change this? Or is there any workaround so I can have a more stable verification?

For example, we have two links 4Mbits, ie the sum of 8Mbits, when we create a maximum bandwidth limit for a group of users 3Mbits this value applies to the sum of links, if the 8Mbits, or every link 4Mbits?

I had to restore a system, and after some time I was missing the certificate options in the menu (see the picture) In case you need to show that section, you just have to:Fortigate# config system global Fortigate (global)# set gui-certificate enable Fortigate (global)# end For the whole information, this is the post where I found this http://www.bauer-power.ne...from.html#.VZUM3N89tQI

hi everyone i'm trying to create dual wan to work with two of them together in format that lan1 always use wan 1 and lan 2 alleys use wan 2 for different department and different secure internet so i connect the wan's to the internet and created two ipv4 policies: lan 1 > wan 1 lan 2 > wan 2 and disabled the wan balancing feature but there still a problem with connection it's seem like the computers chose the wan to use randomly and when they try to use the different wan like lan 1 to wan 2 they cannot use internet because of the policy so what can i do to resolve the problem thanks for help

Hi,Legacy device controlling a simple /24 network using 1 wan connection.Its https certificate ran from 2002-2014 and has expired of course.Its internal java is woefully out of date. (can't load console in browser, but putty is fine) Version: Fortigate-100A 3.00,build0319,060724 Virus-DB: 6.585(2006-07-17 14:44) IPS-DB: 2.305(2006-07-21 11:19) I also cannot find documentation for the FortiGate 100A on docs.fortinet.I assume it is running FortiOs 3? Since business budget is small, and network is small, any recommendations on what to upgrade to?There is no other Forti appliance here (analyzer, manager, etc.) 

when converting FGT > FGT and mapping the interfaces, the SSL.root is not the destination interface list box. Also what do I match phase-1 VPN interfaces to? Do I even need to convert my config at all if I do a FG200B (5.2.3) to a FG200D (5.2.3)???

I just plug my 221c to 60D, but the status of the AP is always connecting:What's more, the warning led keep flickering like this.(Sorry, I can only attach one file.)The OS version of my 60D is:   v5.0,build0292 (GA Patch 9)The OS version of my 221C is: FP221C-v5.2-build475 How can I know what's going on? Is there any cli command or gui setting can I do?Thank you very much!

Clients failing host-checks is a perennial problem for us.  Once a machine starts failing the host check, it can take hours of fiddling to right the situation. Part of the problem is the message is so opaque.  There's no detail as to why the client failed.  Is FortiClient not detecting a local A/V client?  What A/V client does it detect, if any?  Are the virus defs out of date?  Is the scan engine out of date?  Has it been too long since there was a local scan?  Is the FortiClient version itself out of date?  Something else I haven't thought of? Even the logs on the firewall just say "A user has logged into the system, but host checked failed", which isn't real useful. Is there any way we can get more detail out of the host-check results, to help us better troubleshoot?

I am trying to create a custom report that gives me the details on changes made to our FortiGate firewalls.  I have created the following dataset: Detailed-Firewall-Changes -select * from $log-event where $filter and type='event' and subtype='system' and cfgattr!='' order by itime desc Which, when I test I can see the results of something I did specifically to test this dataset.  However, when I create my custom chart and report I receive no results. I created the chart, Detailed Firewall Changes, selected the dataset "Detailed-Firewall-Changes" and selected the fields from the dataset that I want to see.  However, it keeps coming back with "No matching log data for this report".  I don't understand where the disconnect is between the dataset, the chart and the report. Any help would be greatly appreciated.

HI,it is possible to change listening WAN IP for DialUP IPsec VPN?I have few external addresses assigned to WAN port and I want to all VPN traffic passed through other than default external IP address (both incoming and outgoing). regards,kcerb. 

When configuring an Interface in System > Network > Interface below the Administrative Access you also get the option to enable "Auto IPSec Request".What is it? So far neither Google nor any FortiNet Ressource brought any insight.

When I look through datasheets of new FortiGate units I see that they (except low models) have a Management Port, and some have even 2 (i.e. FG-300D, FG-500D,...). I have few questions re. those management ports. 1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces? 2. Can those ports handle regular network traffic? 3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)? I know that I am missing something here... Can someone answer the above questions? Thank you, VA

Hi all,we have a Fortigate-VM with only one Interface dedicated for WAN and a public IPs range (/28) configured with IP PoolsNow we have a new different public IPs range (/28) belong to different public subnet (maybe same router?) and we want to configure this new public range on the same wan interface.Important: other interfaces are already configured.Can I accomplish this task as fast as possible without reconfigure virtual appliance (is not possible in production environment)?ThanksLeo

I have issue with configuring Forti authenticator to get the authentication information from CISCO ACS which will authenticate wireless users . I Have configure the Authenticator and I can see the traffic going from ACS to Authenticator But I'm unable to see the information from Authenticator. I have refer to the Authenticator admin guide to set this up but seems to be not working so far.   

Hi, I am trying to setting up a linux server in our DMZ behind Fortigate. I need to allow connection from Internet to Tcp port 2012 on our public IP address which will be forwarded or translated to linux server private IP TCP Port 22. Here is what I configured. Just need to get some validation from you guys here.Address Object:    edit "Linux-TCP-2012"         set tcp-portrange 2012-2012     nextVirtual IP:    edit "DMZ-Linux-P2012-VIP"        set extip 2.2.2.2         set extintf "port19"         set portforward enable         set mappedip "172.16.24.11"         set extport 2012         set mappedport 22     nextFirewall Policy:    edit 2    &nbs

Hi, I have LDAP and FSSO working on a 100D (windows domains) and I would like to change the Authentication field used for VPN users. At the moment they are required to type in their Full Name and I would like them to just put in there username. How do I achieve this?  Cheers Nathan

Is there any way to produce a report that will return more than 10,000 results?

Hi all. I`m new at forum. Can anybody help with issue? I got FortiWifi 40c. Running HQIP test on my device. Instructions say: Instructions:- Wire the network ports as following for NIC loopback test. [WAN1 -WAN2] [PORT1 - PORT2] [PORT3 - PORT4] [style="background-color: #ccffff;"][PORT5-selfloop][/style] What does it mean port selfloop? Because when I strart my test, it fails: "Network Interface Controller Test:      fail X" Information from log:  ==> Network Interface Controller TestInitializing wan2, MAC:08:5B:0E:15:78:D5 (Linked 1000M) Initializing wan1, MAC:08:5B:0E:15:78:D6 (Linked 1000M) Initializing internal1, MAC:08:5B:0E:15:78:D4 (Linked 1000M) Initializing internal2, MAC:08:5B:0E:15:78:D7 (Linked 1000M) Initializing internal3, MAC:08:5B:0E:15:78:D8 (Linked 1000M) Initializing internal4, MAC:08:5B:0E:15:78:D9 (Linked 1000M) Initializing internal5, MAC:08:5B:0E:15:78:DA (Not linked) Interface wan2 pair: [me=> wan2 08:5B:0E:15:7