Solved

Environment:140 Endpoint DevicesForticlient: 5.2.1 & 5.2.2Managed Through Fortigate, package custom deployed with FortiConfiguration Tool We are currently experiencing an issue in which the FortiClient Realtime scanner is blocking access to a InfoPath offline form (.xsn) file.  The file is able to be downloaded, however we attempting to open a dialog appears on screen with the message of access is denied. When the scanner blocks the file no mention of the scanner is noted in the realtime scan log.  We believe that the realtime scanner is blocking the file as when we disable the realtime scanner the file can be opened without issue.   We have also used exclusions to remove a particular folder (%APPDATA%\Microsoft\Infopath) from being scanner, which has also seemed to be a workaround for the file being blocked. My question is if anyone has experience similar behavior and if so what had they done to resolve the false positive.  I understand that I ca

Hello everyone, I was wondering if someone has a hint for me regarding logging on the FortiAnalyzer. We are using it to aggregate Logs from different central Firewalls which are using different UTM Features.We now want to seperate the settings for different types of Logs. This means for example: Traffic Log can be deleted after 10 days but UTM Log (AV, IPS, Botnet) should be stored for i.e. 30 days. Perhaps some other german customers understand why we are looking into that.Since the FA saves all logs as .tlog, there is no way to delete just the logfiles themselves. It does not need to be an option in the settings. Any approach fullfilling the task would be helpful.Any suggestions? Thanks!Daniel

Hi all, I can't see the group under Policy & Objects>Objects. I just want to add in a group the addresses I created.  Thanks

Questions to those who had been brave enough to upgrade their units to FortiOS v5.2.0: How did it handle complex configurations in the course of upgrade (I mean " in-place upgrade" )? Are there any pitfalls to watch for? Does v5.2 work stable? Is there anything to loose in the jump to v5.2? Are you still there on v5.2 or had to go back to v5.0 for one reason or another? What are your overall experiences so far? We have a pure FortiOS v5.0.7 in our environment. It generally works fine but our main headache is new FortiAPs supporting 802.11ac - they are practically unusable on v5.0.7 (we do not want to go with " interim" FortiOS build as it raises a whole bunch of other questions). Thank you all for any feedback, VA

HiI'm trying to create a certificate signing request for a Fortigate 30D but the Certificates option is not showing underSystem > Certificates in the GUI    Where can I generate a CSR from? thanksSimon 

Hi The documentation (http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/wifi-ethernet_bridge.058.1.html) names two different bridge operations:[ol]Bridge SSID to FortiGate wired networkFortiAP local bridging (Private Cloud-Managed AP)[/ol]The setup of the SSID seems identical to me. While in the first variant an interface on the Fortigate is being configured this step is missing in the second variant. My setup would look like: FortiAP (Subnet C) <--> Switch (L3) <--> Fortigate (Subnet I) The point is: when the traffic leaves the FortiAP anyhow (in bridged mode) why should I setup a software interface on the Fortigate? Whats is the intention of this? What do I gain? I have somehow the feeling that I have to choose the first variant if I want to use VLANs (what I do not need in my case). Thank you very much!

HiI have just setup a Fortigate 30D and configured it to use RSA SecurID 2FA which is working. I have enabled event logging for all events. When I check the logs through the GUI and the Console they are all empty. I have also enabled email alerting which is working. any ideas?Simon  

I have used fortigate UTM devices in past which supports URL Filtering and application filtering. In the security tab I could see we can block applications and URLs but I was wondering if it supports a feature using which we can allow the user to access facebook.com but the user then should not be able to hit the LIKE button or do simillar activities inside the HTTP/website. Please guide how to configure this

Hi I own a Fortigate 60D and I think about to add 3 FortiAPs. Since the 60D has only 175 Mbps CAPWAP throughput (roughly 21MB/s) its not an option to tunnel the traffic. Nevertheless I would like to setup a guest network with a tunnel mode to isolate the traffic. So my question: can I have two SSIDs on the same FortiAPs one profile with local bridge and the other one in tunnel mode? Has someone this setup running? Thank you very much.

Hi, We are using a Fortigate 300c. We have configured users to be in a portal e.g. (3 admins in a single portal). Is it possible to restrict the users to be assigned to a specific internal IP address based on their MAC address even if they are in the same portal. Thanks in advance,Pitot

Hi, We have FortiGate 200D (fw v5.2.3,build670 (GA)) and I was wondering if I could setup DNS zone forwarding on this device. Please advise! Thanks!

Hi, Does anyone know what history log field "resolved" means? Emails from our exchange server go out through FML in gateway mode, and they get through without problems (action for outbound mails is BYPASS), but all outgoing mails in history log have same status in resolved field - FAILED. Other statuses for incoming is OK for good mail, FAIL and FORGED usually means spam because of some sort of DNS mismatch. It is DNS resolving issue, but I dont konw why internal exchange isnt resolved. Nslookup form FML shows good PTR and A records. We use internal DNS servers, and all works well exept this thing. Nowhere in documentation is clearly stated what RESOLVED resolves (IP to DNS name, helo/ehlo banner to PTR or some other combination).  This is log example:  Column Content # 14884 Date 2015-05-21 Time 13:21:47 Classifier Not Spam Disposition Accept From xxx@domain.com To xxx@otherdomain.com Subject Subject Subject Se

Hi All, We have a FortiGate 100D Cluster (Active-Active), running Version 5.2.2 Build 642 (GA). We have several IPv4 Policies permitting access to the Internet from several different subnets. On each policy we have Web Cache enabled.However, when I look at the Cache Monitor in WAN Opt & Cache, I see No Data, indicating that nothing is being cached. Could someone please give me some pointers on what I should look at next to troubleshoot this issue. Many thanks, JP

Hi everyone, I'm planning to setup a FG-80C in  transparent mode behind two routers on my network. I just want to know  what are the features of fortigate that will not work in transparent mode setup compared to NAT mode?And what should be the best practice in transparent mode? My purpose is just blocking prohibited sites on my network and control the bandwidth usage on particular users. Is single sign on and traffic shapping works in transparent mode? Can I also access the firewall outside my network while in transparent mode?Any help, tips, suggestions, reactions will be much appreciated. Thank you. Regards,Jam

I've just checked two fortmails with latest OS 5.1.It seems to be vulnerable for LogJam attacks.When will there a new Firmware be available? Patrick

"Cross-domain" request problem about JS...have anyone can get it from beta portal???..

Hi,we have a fortigate 60B with a 4.0mr3 patch 13 firmware and we want to migrate to a fortigate 80C with v5.0,build3608 (GA Patch 7). I don't know if i should migrate the 60B to 5.0 before creating my backup or If i can directly try my backup on the 80C? Thanks

What documentation exists about the forwarding of a authentication on the ssl vpn webportal to services I present in the portal? If you use this, what services do you present with using SSO? We have a lot of internal services, microsoft based, atlassian systems, etc. (all of them are using our active directory for authentication) and we would like the users to only have to sign on on the portal itself.

Hi everyone. I have a FortiWifi 90D currently running the IOS 5.2.3 and I'm having some issues with the Authentication portal after a user login time's out or if the computer is not part of the domain. In the 5.0.X the user had to re-authenticate in a editable portal (Captive Portal), but now when you try to access the internet there's no portal and nothing happens. Is there a new config that I'm not aware of? Thank you in advance.

Hallo, I have a problem in phase 2 with rekeying. I have 7 location and my home office, at the location i have 2 30B v4.0,build0665,  3 80c v5.0,build0310, 1 60d v5.0,build0310 and 1 100D v5.0,build4429, at home i have a Server with Strongswan 4.5.2. between the 100d and Strongswan is a static tunnel, the other Forti's are configured as responder and strongswan as initiator.The keylifetime is 1800s, after this time the 100D delete child_sa and phase 2 ist down, but phase2 don't come up. at the other location's i have a simular problem after rekeying in phase 2, i see phase 2 is up on both sites, when i ping a host, i don't get a answer. The package pass the tunnel and go to the host, the host send an answer, this package go in the tunnel interface from the forti, at home i don't see this package on the lan-interface from my Server. Strongswan is configured with inactivity option (300s). After 300s phase2 go down. if i ping a host, i get an answer. Doe

Hi,does anybody know if it's possible to configure an IP Subnet instead of a single IP or FQDN for a Client in Radius Service? For example, in Freeradius you can define: client 192.168.1.0/24 { secret = VERYSECRETSTRING } or client private-network-1 { ipaddr = 192.168.1.0 netmask = 24 secret = VERYSECRETSTRING shortname = private-network-1 } Thank you. Regards. Jorge.

Hello, from few days I try to set up router to using two ISP. I have virtual IP 79.10.10.245->192.168.1.5 on WAN1. I would like to use WAN2 for only one internal IP (192.168.1.15) and others internal IPs should go out via WAN1. I set up WAN2 (outside IP), added static route and police routes. Now the traffic for 192.168.1.15 goes via WAN2 but there is no routing between 192.168.1.15 and virtual IP 79.10.10.245. From 192.168.1.15 I can ping 192.168.1.5 and WAN1 router IP 79.10.10.242 but I can't ping 79.10.10.245. WAN1 79.10.10.242/28WAN2 80.10.10.242/28Mail server IP: 79.10.10.245 /internal 192.168.1.5/ Static route:WAN1:destination:0.0.0.0/0.0.0.0device: wan1 gateway: 79.10.10.241distance:10priority:0 WAN1:destination:0.0.0.0/0.0.0.0device: wan2gateway: 80.10.10.241distance:10priority:5 Policy routes:Procotol: allInncoming interface: internalSource: 192.168.1.15Destination: 0.0.0.0/0.0.0.0Outgoing interfece: WAN2Gateway:  80.10.10.241&nb

So We updated our Firmware to 5.0.9 not too long ago and we now seem to have issues with https sites. I just need to know if this behavior is normal, or if there is something wrong. The issues we have are that some https sites, not all, when users access them, they will come up with any or all of the following..... A blank white page The will state that there is no Java, or Flash installed, when there is. Or that the incorrect java or flash version is installed, even when we know for 100% sure that the correct version is on the pc. I can do one of 2 things to fix this. 1. I can either create an address object with the site url in it, and put it into a policy in front of our main user policy, that ONLY has AV and IPS turned on. SSL inspection and webcache are turned off in this policy. 2. I can put the url into the url filter the user gets as a wildcard and exempt, and that also makes the site work. Again, on our previous version of firmware, which I BELIEVE was 5.0.6 w

Hi all, new to fortigate products.. trying to get web filtering up and running so I can get rid of Websense and simply use the fortigates features. I'm hitting a little problem though.. so I'm using FSSO in polling mode to AD. Its recognizing the users fine, but it seems to be timing out at some point. For example, I have a windows 7 VM that I have using the fortigate as its gateway for testing. I log this machine in as a test user, test the policies, it blocks me to the appropriate sites, etc.. however after a while, it seems to just "forget" about me and won't let me access any sites at all unless I log off/back on. Annoying. Am I timing out? Any way to prevent this from happening or how do you handle? Using a Fortigate 200D

Hi, there I configured Web Filter override for certain user group. User can now enter username and password to override for 15 min (not user changeable). However from logging/reporting perspective, is there anyway to see who is overriding the web filter? How long left for the override duration and how to revoke the web filter override for certain user if needed? Plus, it doesnot seem like Web override can not use the same user account for authentication? For example, USER1 belong to Group1 which is configured for override authentication. USER1 is browsing to www.abc.com which is blocked by filter profile. USER1 can not use her/his account to override, right? Maybe asking too much but can not find a manual to give me answers...