Solved

Hello, I want to configure SSL VPN authentication using FreeRADIUS, but I want only users belonging to specific group to have access to the network. Users and groups are stored on FreeRADIUS host as a local linux users and groups. How FreeRADIUS user config file should look like to achieve this?

Re: Webfilter (licensed) vs Application Control Which process looks at the packet first, app control or webfilter.If webfilter, and webfilter exempts a url, will the packet bypass the app control process? Is there any known specific doc on this topic? Thanks.

I have successfully setup our FortiGate with RSA SecureID for SSL VPN however I cannot have more then one type of SSL VPN portal (full access, web access etc). Fortinet explains that in order to have fortigate to communicate with the RSA SecurID server you must create a RADIUS connection (client) to your RSA Server. Then create a Local Group that uses RADIUS as a Remote Server. Under Remote Servers there is the ability to specify the Group in the RADIUS server but I cannot get this function to work. If I change the current value from " Any" to a specified DN all SSL authentication fails. Is there an attribute that my RSA server needs to send back to my fortigate? I know that some vendors have values that they are expecting back to perform validation. My use case is the following: If user A belongs in Group A they get the full access SSL page If user B belongs in Group B they get the web access SSL page Both users require 2 factor authentication with RSA SecurID.

I saw this documentation describing how fortigate IPS can handle SSL traffic for deep content inspection: "......In this schema, is clear that the SSL/TLS handshake is interrupted, and the FortiGate is required to present a certificate for the URL requested by the real client. This certificate is signed by the FortiGate itself. ............. But is needed to be clear that the Full SSL Inspection the certificate used to sign those sites (by default SSL_Proxy_Inspection into the FortiGate) is needed to be recognized as a valid CA. Otherwise, the warning message will be shown everytime an SSL/TLS connection is made. This certificate (SSL_Proxy_Inspection) must be installed in each PC to be used by their Operating System and/or for browsers/applications (Mozilla Firefox or Java JRE) which has its own Certificate repository." I am surprised that the fortigate can't load the cert and private key for our domain and make this appear as if the ssl connection from the client is to our&nbsp

Hello,we done Windows Updates with WSUS, but WSUS is fully terrible. So the plan was to setup fortigate like a proxy that only cache all windowsupdates. That is an easiest way to cache Updates. But i cant find this feature. So is this possible? http://wiki.ipfire.org/de/configuration/network/update-booster Sorry the side is only in german. Thanks and best regards

I'm working on a new deployment of a 30D (running 5.0.2) that will be a spoke and needs to connect to a Cisco ASA as the hub.  I'm was able to configure the tunnel via the cli and confirm I am able to pass traffic between the locations, but I also need the 30D to send all of it's traffic through the tunnel as the goal is to have all the internet traffic go out through the hub.  In an attempt to get this working I created the tunnel, then modified the destination to be 0.0.0.0/0 and updated the policies I had w/ the same.  But when I do a traceroute it is still going out locally.  The WAN interface is getting it's address via DHCP so it's default route is in the routing table and I didn't see a way to modify it.   Also, on a side note, is there a way to do any kind of port-security or MAC filtering on the LAN ports on that device?  I see how to do it for the wireless side, but didn't see how it would be done on the wired ports.

 Hello Forum, just a little hint on naming Dialup-VPN Tunnels regarding the maximun concurrent Users.Since established IPSec Dialup Tunnel Interfaces will be distinguished by adding a Sequence Number (eg. tunnel_0 , tunnel_1)and a VPN Interface Name is limited to 15 characters, the maximum concurrent Users will be limited accordingly. Just take look at the attached screenshots (max. Concurrent Users) and you may get the clue!  Regards,Jan       

Hey guys, how u doing? I got an issue here. Just deplyoed a FortiGate 40C and I need to see the username in the logs from Log & Report (web filter and so on), but I can't find a way do configure the Active Directory server and SSO in the GUI.I got in another client with one FortiGate 60D, and under User & Device menu I can configure this feature. Is there something I can activate to use the GUI for this? Is possible with the CLI?And, is there some matrix that lists the FortiGate model x features available in the GUI/CLI? Thx in advance!

Dear All, Please assist on how to limit access to the Apple AppStore on Fortigate 60D. I would like to allow staff to access the AppStore only after 1300hrs till 0600hrs then block access from 0700hrs till 1300hrs.  Any help is greatly appreciated.

Hi all!Today I discovered that my FortiGate 60C support DES encryption only for IPSec connection. Is it unsupported by firmware of hardware? Firmware version is 5.0 build 3608 (GA Patch 7). Thank you. 

Hi, I feel a bit stupid: Where can I find firmware for the FWF 92D? In the support portal images stop with FWF90D. I have a unit here running FWF92D-5.00-build292 which is quite old and I am desperately trying to update to a 5.2.2... Is there a secret site with really all firmware images? Help very much appreciated! Thanks in advance. Bye,Tim

Dear Friends,                    what is the default ip address of forti ap 221b?

Hi, Fortianalyzer (FortiAnalyzer-VM64) has recently become one of the software I'm overseeing and I see its a very powerful tool.  THIS happened in the morning. Please, let me know about the ways to resolve this logging issue.  Thanks

Hello, We use the FortiGate as a proxy with the FortiAnalyzer logs. We wish to have the reports Detailed of : - The bandwidth of each group, users, subnet, apllication. Great thx

Using 5.2.2For years, we've had load balancing set up on our terminal servers in house using the simple microsoft NLB (172.16.1.45 is address for our NLB addres, 172.16.1.45 is also the secondary ip address on multiple TS servers). Traditionally, we had a simple NAT set up for an external IP to point to 172.16.1.45. This worked just fine and users would log in on either of the TS's without a problem. Since implementing the fortigate 200d a few weeks ago, we've noticed that all users are only connecting to ONE of the TS's. (TS1) I simply created a Virtual IP with the external address and 172.16.1.45 as the internal address, then created a rule that allows traffic from source = ALL to Destination = TS Load Balancer, with only RDP (port 3389) allowed. If I do a netstat -n on the terminal servers, all of the connections are showing the IP address of the Fortigate, instead of the clients actual external IP address. Even connecting DIRECTLY to a TS (without using the NLB)

Hii All, Need your help please.I have 2 fortigate 1000c on HA active-active mode, 2 forticare 24x7 (FC-10-01003-247-02-DD) and 2 fortiguard NGFW service (FC-10-01003-108-02-DD). I've been register it on www.support.fortigate.com .It’s work properly for forticare Support Contract 24x7 (FC-10-01003-247-02-DD) But I have problem with Fortiguard Service NGFW  (FC-10-01003-108-02-DD) licence.On my secondary (slave) it’s work fine. But on my primary I can’t get connection on Antivirus and Webfiltering Database  On my Fortiguard Service antivirus, Email Filtering, and  Web Filtering not update, I think the problem is about port of AV and Web Filtering Database but I’ve check on System > Config > Fortiguard, Web Filtering and Email Filtering Options … I test both of port (53 and 8888) and result is “This unit does not have a valid license”  How can I solve this problem ?  

I'm running a 100D with 5.2.2  We will be upgrading to a 300D later this year.  Overall, I think 5.2.2 is a good release, but there are some improvements that I think would benefit users. We have some Objects\Addresses\Groups with over 100 domains.  When you attempt to add a new domain to one of those lists, it prompts you to add at the bottom which tends to scroll off the bottom of the screen.  Better to prompt at the top of the list so it can be seen. It would be incredibly helpful to be able to import and export lists in CSV or TAB format for review.  (Native Excel would be even better!).  This would help with bulk edits (as long as you could import them back in also!) and make it much easier to maintain large lists and spot discrepancies.  I'm specifically speaking of Addresses Groups lists, and Static URL Filter lists in Web Filters. In 4.3.18, I was able to both block and allow specific files by name or pattern.  In 5.2.2 I'm

Hi I want to add user column below dataset. I didn't add user column. Can you help me for this dataset. select domain, sum(bandwidth) as bandwidth from (###(select coalesce(nullifna(hostname), ipstr(`srcip`)) as domain, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-traffic where $filter and logid_to_int(logid) not in (4, 7, 14) and utmevent in ('webfilter', 'banned-word', 'web-content', 'command-block', 'script-filter') group by domain having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)### union all ###(select coalesce(nullifna(hostname), ipstr(`srcip`)) as domain, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth from $log-webfilter where $filter and (eventtype is null or logver = 52) group by domain having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc)###) t group by domain order by bandwidth desc

Hi there, i need help configuring a new dataset in FortiAnalyzer 5.2.1. It is a very simple query but I don't get it running due to a lack of SQL knowledge  I need a dataset for dial-up vpn (sslvpn and ipsec vpn) which only should show username and date.I tried with the query:select from_dtime (dtime) as date, `xauthuser` as Benutzer, tunneltype from $log where (tunneltype= 'ssl-tunnel' or tunneltype='ipsec') and action='tunnel-up' order by date desc Problem is that for sslvpn the user attribute is "user" and for ipsec vpn it is "xauthuser". So I need a query which gets the attribute "user" for sslvpn and attribute "xauthuser" for ipsec BUT the usernames from both sslvpn and ipsec needs to be put in the column "Benutzer". Could you please help me? Thanks and Cheers,Mattias

.

Hello folks! First off, I'm sure I've done something wrong, fully willing to admit it. I very recently upgraded to a Fortigate 60C from a 60B (Boss gave it to me for training purposes) and I had no issues with port forwarding on the older unit. Worked like a charm.Now I'm running the 60C, I can't seem to get the port forward to work.  First off, I'm running the following:Device: Fortigate 60C (Rev. 1)Firmware: v5.2.2,build642 (GA)Internal Switch Mode: Interface (just to match our work environment for learning/testing purposes)Security Features: All of them have been turned off for this testing (No AV, Intrusion Protection, etc) I'm trying to do a port forward for a game server on my internal network. I've configured the server as a reserved DHCP so it will always have the same IP. I've created a Virtual IP for the port that needs to be forwarded (picture), then created a VIP Group and put the VIP into it. Then, I've created a IPv4 policy to forward traffic from

Hello all, I have to implement policies on a Fortigate 200D (running version 5.2.2).First, I need to allow all Lan users access to some websites they need for work.Some of the websites are specific (www.google.com), some of them use wildcard (ie *.fortinet.com).I created a policy LAN ---> WAN1, source: all, destination: FQDN of the websites, allow all services.This policy is the first in my policy list, from LAN to WAN1.Then i created user identity policies with user groups defined in SSO authentication, with the required web accessrestrictions.However, i do not get any hit counts on my first policy, the one allowing all LAN users to specific web destination.I know u cannot create FQDN address object with wildcard address.Maybe there is a better way to implement my requirements. Any help on this please?ThanksJaures.  

Hi all,Some time back when running v4.3.something firmware, we sent all our syslog(514) data to our Fortianalyzer.  My recollection is that the functionality was lost when we upgraded to v5.0 firmware.  Couple of questions for those running v5.2 now:(1) is the syslog functionality back?  Can you use the Fortianalyzer as a syslog server again?(2) if using this, how does the functionality look to you?  Is it substantially different to what was available in v4.3 firmware?(3) is it possible to filter the incoming syslog data in any way (so that not all data is logged)?TIA for any information you can share,Frosty

In Fortigate VM64 ver October 2014 on port1 and port2.It has PROBE-RESPONSE. QUESTIONS:1. Is PROBE-RESPONSE for checking sync attack2. If yes, that mean I should set it as WAN port instead of LAN port, because attack mostly from internet  tq  

Hi, In F5, I can set it to detect failure of web server based on response.For example, sometime web service is up but database server that it connect to is down.F5 can be programmed so that it can detect if it access this page, the response should be this. QUESTIONS:1. can FortiADC do that instead of detect port alive or can be pinged tq