Solved

I am trying to create a custom report that gives me the details on changes made to our FortiGate firewalls.  I have created the following dataset: Detailed-Firewall-Changes -select * from $log-event where $filter and type='event' and subtype='system' and cfgattr!='' order by itime desc Which, when I test I can see the results of something I did specifically to test this dataset.  However, when I create my custom chart and report I receive no results. I created the chart, Detailed Firewall Changes, selected the dataset "Detailed-Firewall-Changes" and selected the fields from the dataset that I want to see.  However, it keeps coming back with "No matching log data for this report".  I don't understand where the disconnect is between the dataset, the chart and the report. Any help would be greatly appreciated.

HI,it is possible to change listening WAN IP for DialUP IPsec VPN?I have few external addresses assigned to WAN port and I want to all VPN traffic passed through other than default external IP address (both incoming and outgoing). regards,kcerb. 

When configuring an Interface in System > Network > Interface below the Administrative Access you also get the option to enable "Auto IPSec Request".What is it? So far neither Google nor any FortiNet Ressource brought any insight.

When I look through datasheets of new FortiGate units I see that they (except low models) have a Management Port, and some have even 2 (i.e. FG-300D, FG-500D,...). I have few questions re. those management ports. 1. Why someone needs to dedicate a port for sole purpose of management while we could do the same through any other network port or through USB or serial interfaces? 2. Can those ports handle regular network traffic? 3. If the answer to the previous question is " YES" then what make those ports different from other " regular" network ports on the same unit (except word " management" in their name)? I know that I am missing something here... Can someone answer the above questions? Thank you, VA

Hi all,we have a Fortigate-VM with only one Interface dedicated for WAN and a public IPs range (/28) configured with IP PoolsNow we have a new different public IPs range (/28) belong to different public subnet (maybe same router?) and we want to configure this new public range on the same wan interface.Important: other interfaces are already configured.Can I accomplish this task as fast as possible without reconfigure virtual appliance (is not possible in production environment)?ThanksLeo

I have issue with configuring Forti authenticator to get the authentication information from CISCO ACS which will authenticate wireless users . I Have configure the Authenticator and I can see the traffic going from ACS to Authenticator But I'm unable to see the information from Authenticator. I have refer to the Authenticator admin guide to set this up but seems to be not working so far.   

Hi, I am trying to setting up a linux server in our DMZ behind Fortigate. I need to allow connection from Internet to Tcp port 2012 on our public IP address which will be forwarded or translated to linux server private IP TCP Port 22. Here is what I configured. Just need to get some validation from you guys here.Address Object:    edit "Linux-TCP-2012"         set tcp-portrange 2012-2012     nextVirtual IP:    edit "DMZ-Linux-P2012-VIP"        set extip 2.2.2.2         set extintf "port19"         set portforward enable         set mappedip "172.16.24.11"         set extport 2012         set mappedport 22     nextFirewall Policy:    edit 2    &nbs

Hi, I have LDAP and FSSO working on a 100D (windows domains) and I would like to change the Authentication field used for VPN users. At the moment they are required to type in their Full Name and I would like them to just put in there username. How do I achieve this?  Cheers Nathan

Is there any way to produce a report that will return more than 10,000 results?

Hi all. I`m new at forum. Can anybody help with issue? I got FortiWifi 40c. Running HQIP test on my device. Instructions say: Instructions:- Wire the network ports as following for NIC loopback test. [WAN1 -WAN2] [PORT1 - PORT2] [PORT3 - PORT4] [style="background-color: #ccffff;"][PORT5-selfloop][/style] What does it mean port selfloop? Because when I strart my test, it fails: "Network Interface Controller Test:      fail X" Information from log:  ==> Network Interface Controller TestInitializing wan2, MAC:08:5B:0E:15:78:D5 (Linked 1000M) Initializing wan1, MAC:08:5B:0E:15:78:D6 (Linked 1000M) Initializing internal1, MAC:08:5B:0E:15:78:D4 (Linked 1000M) Initializing internal2, MAC:08:5B:0E:15:78:D7 (Linked 1000M) Initializing internal3, MAC:08:5B:0E:15:78:D8 (Linked 1000M) Initializing internal4, MAC:08:5B:0E:15:78:D9 (Linked 1000M) Initializing internal5, MAC:08:5B:0E:15:78:DA (Not linked) Interface wan2 pair: [me=> wan2 08:5B:0E:15:7

Hi all, May you help me how will I configure our fortigate VPN so that all our employees can still print on their home while connected to our office VPN? We're using FG-100D and IPSec VPN (client VPN). I know it actually that they can't really print on their printer (at home) because once connected to vpn, they're already part of office lan network. But I think its possible, I just miss some configuration. Any help will be much appreciated.Thank you. Regards,Jam

Hello everybody, i am keeping on testing FortiManager :=) Now i have problems creating just normal S2S IPsec Tunnels from Manager.  I can Create Phase 1 + Phase 2 and push it to Fortigate no Problem, But then when i want to create the Policies for that new IPsec VPN Interface Lets call it VPN-Example. This interface, that should be created automaticly after you assign the P1 + P2 is just isnt there! you cant find such an interface in FortiManager...  if i log on locally on the Fortigate that i pushed the new IPsec VPN config, i see that interface and can also create new policies with this interface. so then i tried to reinport the Policy from Fortigate, then the new interface is there and you can build the Policies on the FortiManager. So i have to re-inport Policies everytime i create a new S2S - IPsec ???  

Hi, I Have enabled Https deep scan and installed certificate in all end user systems. Now firewall is blocking sites, for few sites IE and chrome throws a mess as "Site is blocked as per internet usage policy". But for other sites it says "Page cannot be displayed". I want message to be displayed in all blocked sites...Please suggest. Thanks,Bharath

Hello, We have a FortiMail VM (v5.2.4) appliance we are implementing and after doing the initial configuration using the wizard in the web UI we are unable to log with the admin account (we get the a message stating login failed). Oddly enough, from the same computer we were able to use the web UI on, we can console in and SSH in just fine with the password we set. It is only the web UI that gives us this error. Any help or guidance on this would be greatly appreciated. Thanks!

Hi,I can't find find Lan Interfcae list in fortigate web consol. It showing only One Interface, so i cant create another Physical interface.so please anybody know how to solve this, please..firmware is in this Versionv5.2.1,build618 (GA) and am using fortigate 60D.

How can I find the config file I uploaded with command:execute upload config ftp <filename_str> <comment> <server_ipv4[:port_int] | server_fqdn[:port_int]> [<username_str> [<password_str>]] [<backup_password_str>] described in this page.Is there any command or other way can I see the configuration file I've uploaded?Thank you！

Good day. Is there a way for logging to happen at session start? We notice that when we do an FTP, until we close the session, nothing appears in the log. Thanks. JM

90d, running firmware 5.2 user complained today that they have been having issues with their outlook connection.when I look at their event viewer, I see multiple instances of an IP address conflict (each time network hardware address of conflicting device is 00-00-00-00-00-00, weird).we only have 10-12 devices on the network, and only one device with static IP (printer) and its address is not in the DHCP scope. I look at DHCP Monitor, and I do not see any conflicts. how do I troubleshoot this?  are their CLI commands I can use, how do I see history of DHCP conflicts? 

Not sure if I should post this in another section, but here goes: Recently I've come across a very strange issue with one of my customers. They have a SIP-solution in place, which, after I set up a new firewall running 5.2.3 (the same that had the infamous IPSec for iOS-issue I posted about here earlier), breaks for a remote site after ~32 seconds. The traffic goes something like this: Internet - Site A Firewall - IP-phone central (Aastra 430) - IPSec Site to Site-link - Site B Firewall - User endpoint handset. All phones to handsets at Site A works fine, both in and out. It is ONLY the handset in Site B, which talks to the Aastra-box over IPSec VPN, had exhibits the 32-second break in connection if you call TO it from either the outside or from Site A. Calling out FROM Site B works fine. I've exported a tracelog from the Aastra-unit and find an entry saying Reason: SIP ;cause=408 ;text="408 Request Timeout" Both firewalls that are in the mix has both SIP-

Hello Sir,Can anybody help to create IPSec Client VPN Report as per attached screenshot.RegardsUpendra Makwana. 

Hi,I'm deploying one each of the above mentioned box. Both will essentially have the same setup, so I'll stick to the 300C for now. My question relates to inbound routing to the DMZ and what Fortinet best practice would be, I don't see anything specifically related to it in the literature I've read through so far. It's a Single WAN connected to the carrier via a /30 point to point link. The box also has a /27 subnet to play with which the carrier advertises for us. My intention is to use the /27 subnet for inbound traffic to Web and edge servers etc. I'm not entirely convinced on how best to config the /27 (relatively new to Fortigate), perhaps a sub interface on the WAN for the /27, perhaps a new zone for the /27 subnet....I'm thinking out loud here. I would be grateful for any suggestions. Cheers. B. 

Hi all, The FortiGuard licenses (IPS & Application Control, Anti-Virus and Web Filtering) for our FortiGate 100D (v5.2.3 build 670) cluster are due to expire on 15th June 2015. We are currently working with our supplier to get these licenses renewed. However, should they expire, can you tell me what will happen? Will our IPS, Application Control, Anti-Virus and Web Filtering policies cease to function altogether? Many thanks, John P

The company I work for is currently going through the Fortinet Partner program and as such, many of us are being told to go as far as we can with the training. I got to admit, im used to working for companies that want me to fund my own training, so im doing my best to take advantage of the free resources. Ive gone through the NSE 1-3 and now feel comfortable that I can talk about Fortinet services and functionality with customers, but I do lack the experience with the Web UI and CLI, so the NSE 4 program in the partner portal has definatley been an eye opener. Question is... Whenever I do these "practice questions" in each module, they seem to throw curve balls. It was the same within the NSE 1-3 series. Asking questions that are not covered within the training, or covered "by proxy". By that I mean you will be given a chart for a Gartner report and in tiny characters down the bottom will list that it was for the 1500 in 2014, but the host made no reference to it. 

...or enforcing per user web filter quotas across login mechanisms. Good Day. I'm nearing completion of the initial configuration of our new Fortinet firewall (FG-200D, FortiOS 5.2.3).  It's my first experience with the product/company and, in all, I'm impressed and pleased with the purchase.  One of a few areas I'm struggling to get the behavior I seek is relative to web filtering. We're using FortiCollector/agent based FSSO for our Windows AD workstations and also support BYOD over wireless utilizing 802.1X with RADIUS authentication. I've configured a policy that allows for 60 minutes of browsing sites in the General Interest - Personal category throughout the workday (with a generous lunch period definition that does not include the timer).  The policy seems to work well, with one exception noticed so far.  When a user consumes their quota on their workstation, a separate quota counter for their same account authenticated through RADIUS to co

Hello I've managed to set a password (copy and paste) - maybe it was too long - on a FortiAP 321C and now I'm not able to login again . I cannot find a reset button or other procedures in the docs. While it is not critical at them moment since the FortiAP is setup and working, there must be a way to reset one of those devices, right ? Thanks for your help!Frederik