Solved

Does anyone know if the FAZ can report on the number of registered/allowed Forticlients on a Fortigate?  I am looking to build a report for management to profile Forticlient registration distribution.  Thanks in advance!

is it possible to use a verisign (or any other CA) for SSL inspection(web filtering, appcontrol) , in order to get rid of annoying certificate warning on https sites when using the inbuilt fortigate CA ssl proxy certificate.If yes what type of certificate needs to be bought , a single ssl certificate etc....from this discussion ,  i am doubtful about the possibility.  Apart from this i see no other way , by which the https certificate warning can be avoided completely. as smartphone, tabs , ipads are never part of domain so its not possible to use active directory infra to push local certificate and its a tedious task to install fortigate ssl proxy cert manually on every single device. 

Hi to all, Can someone post a link where I can find a free trial of Fortigate_VM that I can use for practicing/studying fortinet firewall. As much as possible more on technical side, configurations and its features etc. I want to setup a testing network for fortigate setup/configuration. 'Coz, what I usually do is to read pdf documentations or do watch videos in knowledge base of fortinet but I want to test it actual.Any feedback, comments, suggestions will be much appreciated. Thank you. Regards,Jam

Hi, I use FGT to filter web utilization by users/groups, and in order to optimize bandwidth use i want to block downloading files from internet for some groups. How can i do and manage this by fortigate? Regards,

Hello All, I'm currently testing out FAZ 5.0.10, and I have a couple of HA pairs in my network. Previously, I just used log arrays for these pairs. But now I see the option for HA Clusters. I put the devices in a cluster, and it seems like they are linking their data now. Now for these sets, I only have 1 entry in the Device Manager page. This entry has 2 serial numbers in them, representing both devices in the HA pair.  Is this all I need to do? Will reports pull data against both of these serial numbers? Do I no longer need to do log arrays? Thanks!

Hi guys,I would like to ask if someone can guide me to configure a public ip on a server behind fortinet and it can communicate to & from the internet.Is it possible?Our company subscribe an internet with PPPOE authentication and get 5 public IP. Virtual IP can help mapping the public ip to the private ip but we are looking for a solution that make the server directly expose to the internet.Much appreciated for your help Thanks.

Fortigate 100D running v5.0,build0292 (GA Patch 9) I have created two custom services TCP 9100 and UDP 47808. I created two different policies one policy using each of the custom services. The firewall is blocking both of the services. The only way I can get the traffic through is to change the policy to allow all services. I even tried all allow ALL_UDP but upd/47808 was still being blocked. Currently I do have AV and IPS security profiles assigned to the policies, but I did try disabling all security services and the traffic was still being blocked. I have several other policies that are using custom services. The firmware was upgraded prior to any policies or services being created on this firewall. In other words, a firmware upgrade has not been done between the creation of the policies using custom services that are working and the creation of the policies using custom service that are not working. Any help would be greatly appreciated. Below is a copy of the polici

We have a Fortianalyzer FAZ-100C that has had it's default firmware corrupted.  I booted it up from the backup firmware and it goes into system testing (burn in ) mode.  Everything passes so I know my hardware is all good. I need to know how to restore my firmware so I can get this unit back into action. We were using fw 5.0 and would also like to go to 5.2 (which I believe is the latest) if possible. I am new here so any help would be greatly appreciated. Thanks in advance. Mike.

Hi  i want to add user column on High Risk Application report. I tried to change related dataset but i get an error. Can you help me for this dataset? You can see the error in the appendix. Orginal dataset   My dataset and error select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, appcat, count(distinct app) as total_num from ###(select appcat, app from $log where $filter and app is not null and appcat is not null and logid_to_int(logid) not in (4, 7, 14) and apprisk in ('critical', 'high') group by appcat, app)### t group by user_src, appcat order by total_num desc Error ERROR: column "user" does not existLINE 1: select * from (select coalesce(nullifna("user"), nullifna("u...     

Just purchased a new 100D (build date of Nov 2014) and it came with FW V5.0 Build 0292, 140731 (GA Patch 9) so upgraded it to the latest V5 Build 5.0.11 00310 - so my question is, do I move up to 5.2.2 00642 or leave it at 5.0.11? The unit is about to go into a production environment so would welcome any tips :)  

Hello guys. One client came with this question, if it's possible to do a site-to-site vpn connection between Fortigate and OpenVPN. Since openVPN works only with SSL vpn I think it's not possible, but I can be wrong. Thank you.

Hello, I have a problem using Central VPN console and the global policy: I create a Star VPN with the central VPN console and i want to assign Global policy to this VPN but in global policy I don't have the interface "vpnmgr_Hub_XXi_spoke2hub" which was created by the VPN Console. And I can't create and interface object with the same name , i put me an error that I can't use the prefix "vpnmgr_". So I wanted to know if it's possible to create global policy with the interface created by the VPN console?? thanks, JF

Can 3rd Party tokens be used with the FortiAuthenticator? Thanks, Chris

Hello Fortigurus, Last week we upgraded our FAZ 4000B to 5.2.1 and after the database got done rebuilding a few days later we don't see any UTM logs on the FAZ. The Fortigate is a 3600C and is running 5.0.9 at the moment. The UTM logs are necessary for troubleshooting and reporting. Have any of you experienced this problem or know what can be done to resolve it? Please advise. Thank you, JB.KALM

Hi all,I want to download FSSO Collector Agent.I read that I can do this by an account on support.fortinet but I can't find whre.Do you know where I can download it?  

Hi All, I hava a FGT 100D with the last version 5.2.2, and trying to implement Web filter profiles using Proxy Mode. Could you tell me if i can apply two or more Web filter profiles to a given Group (FSSO groups on my case).My issue is that when i use Policies to do this, only the rule on the top will be applied and the seconde one will be ignored (example in attachment) - this is just an example to illustrate the issue. The ideal would be to combine FSSO groups with Web Filtring Profiles without passing by Firewall rules/policies, is this possible? Many Thanks for your help.   

Hello, short Question. We have to do a VPN in 3 days to a Cisco Gateway. we have exchanged our Setting. and they sai for Phase 2 Key Lifetime 4608000 kilobytes / 3600 seconds. Does it mean that i have to choose in my fortigate Phase 2 Propasals for Lifetime "Both" and wrtite the kilobytes values and second or it will be ok if i only put the 3600 for Lifetime? Thank you

Hello, What I'm trying to achieve is, in each policy, to have different web filter profile. (For example: Sales Dept has sales profile, HR Dept has HR profile)What I have in Fortigate 60D (5.2.2) is, there is no profile (in the old version, I can see the drop down box at the corner). So I'm currently stuck with all user using same Web Filter Profile.Is there anyway to enable the profile feature? So I can use different Web Filter Profile on different policy? 

Hi all, from our account the FTP Download of Fortinet Firmware Images is not available for the moment. 530 Login incorrect HTTPS Download is ok Does anybody know about this? When it will come back?

Hello, soon i have to upgrade an 200D 5.0.9 Active-Passive Cluster to 5.2.2 . Should i realy follow the steps described in the HA Doc? like just push the upgrade on the Master unit and he will do all the job by himself?  what are your experience upgrading a cluster? should i better first upgrade Slave per FortiExplorer and after that upgrade the master ? Thanks

Hello everyone, I'm trying to set up server load balancing on my FGT-60D, with SSL offloading. But, when I try to configure a new virtual server, I don't have an option to select HTTPS type. Here's CLI configuration process:  Is it possible that 60D does not support HTTPS load balancing? Thanks!Slavko

Hello, I try in every mode to come up vpn tunnel between Fortigate with 5.2.2 and pfSense, I receive error before phase 1, with message "ignoring ike request, no policy configured" but I check 100 times... every is correct on both side. This is first time I do vpn to pfSense, I have other vpn with Cisco and Watchguard without problem, then I try change pfSense with Sophos but same result, I know that both use vpn based on openswan. Thanks M.

I need to remotely connect to D-LINK switch currently working on default 10.90.90.90 address (service guys have replaced broken one, but they have forgotten to do initial config). The problem is it's connected directly to one of the internal interface port on my FortiGate 60D where I'm running 10.0.0.0/24 subnet. By using second address of the internal interface and FortiOS CLI on SSH session I was able to initiate telnet connection to the switch but unfortunately D-LINK refuses connection (no account on switch on defaults). The only option right now is to use web GUI of that switch which is available on 80 or 443 port. I've tried to do port forwarding but trafic flowed only to the switch but didn't in the opposite direction. What are your thoughts to accomplish this setup?

Hello, I have a issue with one of our companies people, which has to work from China. We have a FG200D and it's running a ssl-vpn. All our employees are able to connect to the office network through the SSL-VPN but this one fella which works from China isn't able to connect. I'm very much aware that in China they have lots of restrictions but I was just looking for a way to work this out somehow. Any ideas? Thanks.

hi there, need help,can interface on FG-60D change into individual interface, not act as switch?I've 100D, and the interface can be changed to individual port or act as a switch, or both.if can, how to do that? thank you