Solved

Hello,I have a problem with Fortigate 240D v5.2.2,build642 (GA).Sometimes when I open firewall policies or user groups etc... I receive the following erros - see the attached image. What is the problem and how to fix it?

Hi, I have this reject for a new rule wich use both NAT (source and destination) Rule :     edit 4465         set srcintf "any"         set dstintf "any"         set srcaddr "153.65.21.20"         set dstaddr "vip_10.118.247.251-to-192.168.60.219-5901" "vip_10.118.247.251-to-192.168.60.219-5902"         set action accept         set schedule "always"         set service "tcp_5901" "tcp_5902"         set logtraffic all         set nat enable         set ippool enable         set poolname "ippool_10.118.58.217" We want to nat153.65.21.20 --> 10.118.247.251   into:10.118.58.217 --&gt

After installing Forticlient and trying to start a Citrix session the Citrix Receiver returns the following error: "The Citrix Receiver received a corrupt ICA file. The Key (3.0) has no value associated value" After deinstall of the FortiClient the Citrix Receiver works just fine. But after install the Citrix receiver failes again.It does occur when the client register with the fortigate unit and get the profiles and configuration from the fortigate. After install without registration there is no problem. Does anyone has a idea what I can do about this error message?

Hello Folks, today I configured sFlow on a 60D, afterwards I noticed high ESP-Errors (Replayed-Packets) on a far-end VPN Tunnel Fortigate.For me it seems that enabling sFlow on this small SoC Boxes breaks the IPSec "Acceleration". The Box was running 5.2.2 and the sFlow Polling-Interval was configured quite conservative.CPU-Load was O.K. Has anyone seen similar issues yet?  Regards, Jan

Hi to all, I have a FAZ 400B with Firmware 5.0.10 at our central site deployed.I capture logs from the Fortigate 60C at the same site successfully.Now I have about 6 Remote Sites that are connected by IPSEC to my central site.I configured the remote FGTs to log to FAZ in central site, by using it's private IP as target.I added the devices in FAZ successfully, but I received no logs from Remote Sites. Interesting: In one site I have a Fortimail 200D Cluster and I receive logs from this device,but not from the Fortigates... Log Settings Fortigates (all at Firmware Version 5.2.x):-> Send Logs to FortiAnalyzer-> IP is the the private IP of FAZ at central site (i.e. 10.1.1.253)-> Realtime-> Untick "Encrypt Log Transmission"-> Event Logging all-> Local Traffic Logging All-> Policies from central to remote site and revert are open at all for testing purposes-> can ping the fortigate from FAZ successfully-> but I can't ping the FAZ from Forti

Hi All,  I am working on a 300C unit. Pretty standard setup, It is my first time configuring the 300 model. I usually work with 90D and ASA's . I feel there is something basic I'm missing here. Port10 is the WAN and is configured with a Point to Point. SSL VPN portal functioning.Port1 has several Vlan interfaces, all working fine, net reachable, filters behaving etc. Worth mentioning Port1 belongs to it's own Zone. It's when I attempt to create a DMZ on another physical, say port 8 or 9 I get the issue. Some basic testing - even if I put say x.x.x.1 on the interface and connect my laptop direct with x.x.x.2 I get a ping Timeout which suggests my laptop can reach the x.x.x.1. I have read about the "set internal-switch-mode" command but the cli doesn't seem to recognize that syntax. I would be grateful for any suggestions. Many thanks. B.

I set up an SSL-VPN with a Web-only portal; I want users to be able to connect to internal servers using RDP. I created a bookmark for an internal terminal server.The portal itself works fine. When I click on the bookmark, I get the usual Java security warnings, then RDP launches and reports "Configuring remote session" to 127.0.0.1:49152. RDP stays at that message and never connects. Eventually, the portal times out and logs out.I've set up such an SSL-VPN before and got it to work with no problems, but can't figure out what I'm missing this time.FortiOS 5.0 on a FGT 60D.For my testing, the client is Windows 8.1 64 bit with Java 8 Update 45 and Java 7 update 75 both installed. Both the 32-bit and 64-bit versions of Java are installed. I am using IE 11. 

Hello Guys, lust time i worked with FortiManager it was 5.0.6 and everything was ok. now i wanted to Refresh my knowledge because on Friday i have to Troubleshoot some Problems with FortiManager 5.2.2 i just don´t get it how to install Policy Packages on many Devices... i registret 2 FortiVM Devices with FortiManager > Imported the Policy Packages for Each > Created Interface Zones (like Port1 = WAN) > created Dynamic Adress (like LAN Device 1 = 192.168.1.0 and Device 2 = 192.168.2.0 > i created a new Policy Package with 1 Policy for Test. But i just cant install this new Policy to either of the Devices. When i start Install Wizard the "Choose Device" Field is just empty.. i just don´t get it... i have a Guide for 5.0.6 (online Course) and tried to did it just Step by Step. But when i come to the Point whre i have to Install new Policy Package i just can´t add Devices because the Field is Empty...  Can Please somebody explain what am i doi

Greetings! I've recently come across a strange issue with two different Fortigate-boxes, both running 5.2.2. On both of these, I am unable to connect the built-in client on iOS to the iOS Wizard-created IPSec VPN's. On a third box, also running 5.2.2, there is no issue at all even though all three boxes has their iOS-VPNs set up through the wizard and thus exactly the same way (Even checked and followed the tech-article and video for setting this up, as I'm a bit of a noob). The only major difference is that the two Fortigates that will not accept connections to the iOS-tunnel already has IPSec VPN's on them. One box has a Site-to-Site tunnel on it, the other has a Forticlient-dialup tunnel. Both also has SSL-VPN's for FortiClient. Tried to google this as much as possible but has been unable to find a solution or even someone that has the same type of issue. Thus I turn to you :) Anyone able to shed some light on the issue or point me in the correct direction?

Hi, I accidentally checked the "Enable Automatic Execute Type" checkbox when I tried a TCL script.Now it will run every time I install a package, and there is no way of removing it. I also tried with CLI with "execute fmscript delete 0002" but fails as the script is bound to the device. How can I remove it ? 

Environment:140 Endpoint DevicesForticlient: 5.2.1 & 5.2.2Managed Through Fortigate, package custom deployed with FortiConfiguration Tool We are currently experiencing an issue in which the FortiClient Realtime scanner is blocking access to a InfoPath offline form (.xsn) file.  The file is able to be downloaded, however we attempting to open a dialog appears on screen with the message of access is denied. When the scanner blocks the file no mention of the scanner is noted in the realtime scan log.  We believe that the realtime scanner is blocking the file as when we disable the realtime scanner the file can be opened without issue.   We have also used exclusions to remove a particular folder (%APPDATA%\Microsoft\Infopath) from being scanner, which has also seemed to be a workaround for the file being blocked. My question is if anyone has experience similar behavior and if so what had they done to resolve the false positive.  I understand that I ca

Hello everyone, I was wondering if someone has a hint for me regarding logging on the FortiAnalyzer. We are using it to aggregate Logs from different central Firewalls which are using different UTM Features.We now want to seperate the settings for different types of Logs. This means for example: Traffic Log can be deleted after 10 days but UTM Log (AV, IPS, Botnet) should be stored for i.e. 30 days. Perhaps some other german customers understand why we are looking into that.Since the FA saves all logs as .tlog, there is no way to delete just the logfiles themselves. It does not need to be an option in the settings. Any approach fullfilling the task would be helpful.Any suggestions? Thanks!Daniel

Hi all, I can't see the group under Policy & Objects>Objects. I just want to add in a group the addresses I created.  Thanks

Questions to those who had been brave enough to upgrade their units to FortiOS v5.2.0: How did it handle complex configurations in the course of upgrade (I mean " in-place upgrade" )? Are there any pitfalls to watch for? Does v5.2 work stable? Is there anything to loose in the jump to v5.2? Are you still there on v5.2 or had to go back to v5.0 for one reason or another? What are your overall experiences so far? We have a pure FortiOS v5.0.7 in our environment. It generally works fine but our main headache is new FortiAPs supporting 802.11ac - they are practically unusable on v5.0.7 (we do not want to go with " interim" FortiOS build as it raises a whole bunch of other questions). Thank you all for any feedback, VA

HiI'm trying to create a certificate signing request for a Fortigate 30D but the Certificates option is not showing underSystem > Certificates in the GUI    Where can I generate a CSR from? thanksSimon 

Hi The documentation (http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/wifi-ethernet_bridge.058.1.html) names two different bridge operations:[ol]Bridge SSID to FortiGate wired networkFortiAP local bridging (Private Cloud-Managed AP)[/ol]The setup of the SSID seems identical to me. While in the first variant an interface on the Fortigate is being configured this step is missing in the second variant. My setup would look like: FortiAP (Subnet C) <--> Switch (L3) <--> Fortigate (Subnet I) The point is: when the traffic leaves the FortiAP anyhow (in bridged mode) why should I setup a software interface on the Fortigate? Whats is the intention of this? What do I gain? I have somehow the feeling that I have to choose the first variant if I want to use VLANs (what I do not need in my case). Thank you very much!

HiI have just setup a Fortigate 30D and configured it to use RSA SecurID 2FA which is working. I have enabled event logging for all events. When I check the logs through the GUI and the Console they are all empty. I have also enabled email alerting which is working. any ideas?Simon  

I have used fortigate UTM devices in past which supports URL Filtering and application filtering. In the security tab I could see we can block applications and URLs but I was wondering if it supports a feature using which we can allow the user to access facebook.com but the user then should not be able to hit the LIKE button or do simillar activities inside the HTTP/website. Please guide how to configure this

Hi I own a Fortigate 60D and I think about to add 3 FortiAPs. Since the 60D has only 175 Mbps CAPWAP throughput (roughly 21MB/s) its not an option to tunnel the traffic. Nevertheless I would like to setup a guest network with a tunnel mode to isolate the traffic. So my question: can I have two SSIDs on the same FortiAPs one profile with local bridge and the other one in tunnel mode? Has someone this setup running? Thank you very much.

Hi, We are using a Fortigate 300c. We have configured users to be in a portal e.g. (3 admins in a single portal). Is it possible to restrict the users to be assigned to a specific internal IP address based on their MAC address even if they are in the same portal. Thanks in advance,Pitot

Hi, We have FortiGate 200D (fw v5.2.3,build670 (GA)) and I was wondering if I could setup DNS zone forwarding on this device. Please advise! Thanks!

Hi, Does anyone know what history log field "resolved" means? Emails from our exchange server go out through FML in gateway mode, and they get through without problems (action for outbound mails is BYPASS), but all outgoing mails in history log have same status in resolved field - FAILED. Other statuses for incoming is OK for good mail, FAIL and FORGED usually means spam because of some sort of DNS mismatch. It is DNS resolving issue, but I dont konw why internal exchange isnt resolved. Nslookup form FML shows good PTR and A records. We use internal DNS servers, and all works well exept this thing. Nowhere in documentation is clearly stated what RESOLVED resolves (IP to DNS name, helo/ehlo banner to PTR or some other combination).  This is log example:  Column Content # 14884 Date 2015-05-21 Time 13:21:47 Classifier Not Spam Disposition Accept From xxx@domain.com To xxx@otherdomain.com Subject Subject Subject Se

Hi All, We have a FortiGate 100D Cluster (Active-Active), running Version 5.2.2 Build 642 (GA). We have several IPv4 Policies permitting access to the Internet from several different subnets. On each policy we have Web Cache enabled.However, when I look at the Cache Monitor in WAN Opt & Cache, I see No Data, indicating that nothing is being cached. Could someone please give me some pointers on what I should look at next to troubleshoot this issue. Many thanks, JP

Hi everyone, I'm planning to setup a FG-80C in  transparent mode behind two routers on my network. I just want to know  what are the features of fortigate that will not work in transparent mode setup compared to NAT mode?And what should be the best practice in transparent mode? My purpose is just blocking prohibited sites on my network and control the bandwidth usage on particular users. Is single sign on and traffic shapping works in transparent mode? Can I also access the firewall outside my network while in transparent mode?Any help, tips, suggestions, reactions will be much appreciated. Thank you. Regards,Jam

I've just checked two fortmails with latest OS 5.1.It seems to be vulnerable for LogJam attacks.When will there a new Firmware be available? Patrick