Solved

I have a FortiGate 80CM running 5.0 build 0208 Reading the FortiOS hand book and it says: 1. On the FortiGate unit, go to System > Certificates > Local Certificates. 2. Select Import. 3. From Type, select Local Certificate. 4. Select Browse, browse to the location on the management computer where the certificate was saved, select the certificate, and then select Open. 5. Select OK, and then select Return. but "System > Certificates"; is not there.......... How do we get a menu to manage certificates? Kevin

Hello, Just wondering if it's possible to change the management port to something else besides 541. I'm having trouble finding anything on this. ExampleFortiGate Unit sends out its request to FortiManager on 443FortiManager listens for new requests on 443 Thanks!Alan

How do I get rid of the message "Fortigate Detected: Registering to Fortigate"  for my end users when they connect via vpn?   Please and Thanks! Mike

Same setup as my last post -- Fortigate running with full SSL/TLS inspection. How do we limit the cipher suites the Fortigate accepts from the web servers it connects to?  In the current, default configuration, the Fortigate accepts quite a few undesirable combinations including: DES, RC4, SHA, MD5. Why would a security product, produced in the last decade, EVER allow the likes of DES?  How do you change what the Fortigate accepts to a much stronger cipher suite? Thanks.Tom PS.  If you want to check it yourself, turn on full SSL inpsection and head to https://howsmyssl.com  

We have two FG3600C Appliances in HA. The Firmware is 5.0.5. We are running OSPF where the immediate neighbor is HP 12508 Switch. The Master node is learning all routes from Switch. When we do a HA Testing i.e. bring down one of the monitored ports of Cluster. The failover is immediate. However the Slave Device takes lot of time to rebuild the OSPF routing table. It takes approx. 15 ping timeouts. is this default behavior. We want to reduce this. Why does Slave appliance take so much time to learn OSPF Routes.

In the current development versions of Second Life and it's 3rd party viewer Firestorm, it has been noted that Forticlient has been the direct cause of a critical graphics error, involving HTTP Pipelining. This is an exclusive bug that can only be reproduced when Forticlient is used. I would like to refer you to the Phoenix Firestorm Support JIRA: http://jira.phoenixviewer.com/browse/FIRE-15625And the main Linden Lab Support JIRA (registration required): https://jira.secondlife.com/browse/BUG-8631 They contain more details, screenshots, and logs taken from both the Viewers and Forticlient. This has been reproduced by several members of the Firestorm support team with little in common between their systems other than Forticlient. Second Life has roughly 40 million registered users, so even if only 1% use Forticlient the results would be unacceptable resulting in either a  blocked release or users being informed to uninstall Forticlient, should they use it.&

I'm getting hit a lot by miscreants using the OpenVAS scanner as of late.  It eventually triggers one of my IPS/IDS rules and the IP gets banned, but I'd like to do so as soon as it sees a connection with the "OpenVAS" string in it. For example: ==pcap 1 ascii s==.......Uf^..P...P...E..P[.@.7.Ag[...Ap.....P.W.....S.............#......GET./cgi-mod/index.cgi.HTTP/1.1..Connection:.Close..Host:.65.112.26.132:80..Pragma:.no-cache..User-Agent:.Mozilla/5.0.[en].(X11,.U;.[style="background-color: #ffff00;"]OpenVAS[/style].7.0.5)..Accept:.image/gif,.image/x-xbitmap,.image/jpeg,.image/pjpeg,.image/png,.*/*..Accept-Language:.en..Accept-Charset:.iso-8859-1,*,utf-8....==pcap 1 ascii e== Has someone created a custom definition before.  The explanation of the syntax in the Fortigate 5.2 help for this isn't the best. Here is what I'm thinking: [align=LEFT]F-SBID( --name "Block.OpenVAS"; --protocol tcp; --service HTTP; --pattern "OpenVAS"; --no_case; --context uri; )[

I tried installing the 4.0.2317 FortiClient SSLVPN on a Windows 10 client and connected to a device.When I try to resolve Hostnames it sadly uses my normal DNS instead of the DNS set in the SSLVPN settings.Trying NSLOOKUP also returns my normal DNS not the internal one offsite.I installed the same SSLVPN Client version on an 8.1 client and it worked normally. Sadly trying to install the normal FortiClient (5.2.4.0650 x64) results in an error message during installation (Install Error: The process was stopped unexpectadly). Anyone got any ideas? Can anyone confirm that the DNS is not set correctly on a Windows 10 client?

Hi  i can use on below dataset. My problem same user and same destination see a few times. How can edit this dataset for this problem? SELECT TO_CHAR(TO_TIMESTAMP(`itime`)::timestamp, 'YYYY-MM-DD HH24:MI') AS time, COALESCE(NULLIFNA(UPPER(`user`)), IPSTR(`srcip`)) AS user_src, COALESCE(NULLIFNA(ROOT_DOMAIN(`hostname`)), IPSTR(`dstip`)) AS website, COALESCE(NULLIFNA(`catdesc`), 'No Category') AS web_cat, SUM(COALESCE(`sentbyte`, 0)+COALESCE(`rcvdbyte`, 0)) AS bandwidth FROM $log WHERE $filter AND `action`='passthrough' GROUP BY time, user_src, srcip, website, web_cat HAVING SUM(COALESCE(`sentbyte`, 0)+COALESCE(`rcvdbyte`, 0))>0 ORDER BY bandwidth DESC

Hi, I want to implement SSL VPN client to site certificate authentication.The things I tried till now :1. Set the Fortinet_CA_SSL Proxy certificate in the ssl vpn settings as required for clients, downloaded the fortinet ca ssl proxy certificate on a client computer, installed it and tried to connect - didn't work.2. Generate a certificate request, signed it on a windows server certificate authority and then import it on fortigate. I installed the same certificate I imported on fortigate on a client computer and tried to connect - didn't work. I don't think I understanded well the concepts of certificates and what certificate should I use on the fortigate unite and what certificates I should use on client computers. Another thing I tried to experiment related to certificates is setting the certificate for GUI administration of the fortigate and then importing it to a computer. I still get the warning when I connect with a browser on the fortigate. This is not very import

Hi, Fortigate 200D, 5.0.4 and 5.0.5: How and when are devices detected/identified? I' m sure this was working in the past, but now the online column in device definition stays empty. It seems that all my devices were last seen about 10 days ago. Client devices don' t have Forticlient installed Step taken: - Upgrade from 5.0.4 to 5.0.5, so that rebooted my Fortigate. - " diagnose user device clear" . - deleted some permanent entries of device that are currently communicating, they are not detected/added to the list. Any idea? Thanks, Stephane

I have been working with DoS policy for a while now to try and pick up on anomaly traffic.  In my IPS logs I get this message: "anomaly: udp_flood, 12647 > threshold 7500, repeats 98780 times".  Can I use that information to tweak my threshold? I read that as only telling me that I exceeded the threshold but not necessarily by how much.    

Hai i want to restrict torrent download. in this case here we have around 50 system all under static ip. then some of them using DHCP. so i want to block torrent download for 45 users and allow for 5 users. is it possible, then suggest the steps.i am using fortigate 60d

Hi, Is it possible to use a Fortiwifi 40C to bridge a wifi SSID with an internal interface so they can use the same subnet? The document here suggests this is possible with an interface set to type switch but the 40C doesn't seem to allow this command.  Is it because only the larger models support software switches?  Seems unlikely that the 40C cant support this considering all of the Fortigate models come as standard with the internal interfaces bridged together. http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/wifi-ethernet_bridge.058.2.html The command just fails when you enter "set type switch" on a new interface. We are using a Fortiwifi 40C with the latest v5.2.4 software.

Hi, silly question probably: at some point the local disk on the fortigates will get full (both logs and reports). Where can i find the policy for retention? Does the fortigate have a mechanism that if a threshold is breached it will start deleting old logs and reports? thanks 

Hi,I have the szenario that a ssl vpn (tunnel and web mode) is reachable at both wan ports that are connected to the internet. Since 5.2.4 I cannot reach the portal using wan1, but at wan2. A packet sniffer shows only a syn, but no ack. So, a simple https://public.wan1.ip failes, but https://public.wan2.ip works. If this a known issue? I plan to downgrade to 5.2.3 for testing and to reconfigure the fgt using a factory default, but not during the productive time. FGT110C with 5.2.4

I see that "Remote LDAP" groups can be created on the FortiAuthenticator.  Is it possible to import or use LDAP (Active Directory) groups in any way with the FortiAuthenticator? It seems like everything to do with LDAP can only be "managed" by the individual "name" and not a directory. This also applies to the FortiAuthenticator client.  We are implementing the client and I have to individually select EVERY single user that needs to be in bypass.  That is all the users to start while we roll out mobile tokens to everyone. Thanks, Chris

.

Hi All, When I login to my account in support.fortinet.com, I found out that there is a new FortiOS 5.2.4 release and I can't find any release notes yet for this version. Is it a BETA for testing? Can we use that already as latest firmware version in our fortigate? Any comments or info regarding above statement is kindly appreciated. Thank you. Kind regards,JAM

Hello, has anyone successfully created a pcks12 certificate using openssl and VeriSign to install a VeriSign certificate on a Fortigate device for the ssl deep packet inspection? If so, how did you do it? -Chris

Hi,i Really appreciate if someone could Help me, i'm new on the forumWell My probleme is :I have two Fortigate 100d in different site All the configuration is working perfect VPN Ssl Fortiguard....the only problémes that i have actually is With Webfiltering exactly with Youtube, See attached Picture before the filter was working normally without any probleme but actually inside the network youtube is working without by passing the filter, no authentification in the catégorie of Streaming media and download and the problémes is only Youtube .Other streaming website like Dailymotion are using the filter normally.and the problémes is the same with the two Fortigate on defferent site.Firmware V: 4.0Model: Fortigate 100 D Great Thanks for the Help,Best regards,Zito

Hi all,on Fortigate 90D I've configured a WAN1 interface with Public Range an everythings works well.Now I've requested a new connectivity (with another ISP) with a new public Range and I've already configured it on WAN2 interface without static route, only IP assigned to interface.Can you help me to understand this:1- How configure Distance and Priority in order to have WAN1 and WAN2 working together?My Goal is:ServerGroup1 -> WAN1 (already configured with static route 0.0.0.0/0.0.0.0 PRI: 0 DIST: 10)ServerGroup2 -> WAN2 (?) Thanks a lot.Regards.Leo  

Hi Everyone, I recently purchased a FortiGate 60D 3G4G VZW firewall and want to update to the latest firmware version. However, each firmware image I have downloaded fails to install, saying it is the wrong image type. I've tried a number of the 5.0 and 5.2 images for the "FGT_60D-v5-buildXXXX" trains. Each fails to install, despite being listed as a supported model in the release notes. This happens from the CLI or GUI, local upload or from Fortiguard services. Can anyone point me in the right direction to where I can get my hands on the correct firmware for this device?  Thanks!

there is dns server on fortigate 40c ? because when i try to make the router as dns server on my computer it's not getting any addressalso i don't see the feature here:config system global set fgd-alert-subscription advisory latest-threat set gui-antivirus disable set gui-application-control disable set gui-dhcp-advanced enable set gui-endpoint-control disable set gui-implicit-policy disable set gui-wan-load-balancing disable set gui-webfilter disable set gui-wireless-controller disable set hostname "FGT40C3913032173" set internal-switch-mode interface set timezone 04 and this command is not working: config system dns-database [style="background-color: #ffffff;"]command parse error before 'dns-database'[/style] [style="background-color: #ffffff;"]Command fail. Return code 1[/style] this is my firmware version:Firmware Versionv5.2.3,build670 (GA)

Hello, I've been running dual wan connections using ECMP Weighted Load Balance on my FWF80CM (v4 MR3 Patch 15) for a couple of years now. The solution has worked out pretty well but now I want to change this design to a more manual setup to improve control over how traffic flows through the device. My goals:WAN2 - Primary GatewayWAN1 - Failover Gateway Needs:I will still need to Policy route some specific traffic out WAN1I will still need to access VIPs setup on WAN1 externallyI will still need to access HTTPS admin on WAN1 externally To start off I assumed that I could just change ECMP back to Source IP (default) and then give WAN1 administrative distance higher than WAN2. Both WAN1 and WAN2 have static routes with the same distance currently. When I did this working remotely over HTTPS on WAN1 as soon as I applied the Admin Distance on WAN1 I lost my remote connection and found that I was also unable to access HTTPS admin on WAN2. In addition when I arrived at the