Solved

Hi all,i need to limit the physical interface total bandwidth (1Gb for instance).I have a firewall with 4 VDOMS, 1 root with the WAN interface and 3 VDOMS with the LAN interface. Of course the 3 VDOMS are sharing the same physical interface with 3 different VLANS.I would like to limit the VDOMS access bandwidth, for exaple: VDOM A ---- VLAN 10 ---- INT G1 --------- 100MbVDOM B ---- VLAN 11 ---- INT G1 --------- 10MbVDOM C ---- VLAN 12 ---- INT G1 --------- 50Mb Does anyone did something similar? Bye D.

I've got a problem registering a FortiToken on my iPhone 6 Plus. When I try to manually enter the code, or scan the QRCode, it fails with a "runtime error". However, my iPhone 5S will register the token without complaint. Both iPhones are using iOS 8.1.2 and the most recent FortiToken Mobile client.

Hi, I am not able to add IPSec Tunnel interface to any Zones. Its giving "Entry not Found Error". Please suggest.  

Hello, I recently upgraded a Fortigate 40C from FortiOS 4 (the latest release, build 665) to FortiOS 5 build 208. There was an existing configuration with very simple policies (any internal to any over WAN1 using any service with destination interface NAT). Before the upgrade everything worked just fine, however after the upgrade, no communication to the internet was possible because the Fortigate was blocking all traffic. I found the problem: Fortinet decided to rename the service " ANY" to " All" (which makes sense IMHO), but didn' t bother to upgrade my configuration to reflect this change, thereby essentially breaking my Firewall. My question is: Has anyone else noticed this behavior? Is there an official word on this from Fortinet? At work, my team and I manage a larger 3950B Firewall with over 130 Virtual Domains. If this is the normal behavior, upgrading our machine to FortiOS 5 would be a catastrophe, as we would have to go through every single VDOM manually an

Hello, i have a FortiMail VM behind a FortiGateVM in a lab environment. all the DNS Request that goes through the Fortigate generates always the Same IPS Alert "DNS.Invalid.OPcode"  its UDP: 53 it´s realy annoying cause i get all my logs full of this IPS Alerts.  Do you have any idea why that happens and hove to avoid that? Thank you.

Hi All, I am getting all the time intrusion attack alert - Bash.Function.Definitions.Remote.Code.ExecutionWhen I open the alert I am getting to this page:http://www.fortiguard.com/encyclopedia/vulnerability/#id=39294 And I understand that I should do:Upgrade to the latest version available from the website.http://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-025 The problem is how to do this upgrade on my FortinetWifi 90D machine?I looked every where and try to put the file but it say that this is the wrong file. I tried both bash43-001.sig and  bash43-001.txt in the system-Advanced page in the CLI file update. Please advise how to commit this update to the machine?   Thank you, Eitay Cohen  

Hi All,i cannot find a way to customize my reports....i need to set up a customized report,  where i woul like to see the traffic per network, Like for example: the network A during one month made 1Gb traffic in input and 5Gb output the network B during one month made 6Gb traffic in input and 2Gb output Does anyone have already customized the report to something similar or any available to help me??Thanks

Have a fortigate 60D which pushes only smtp /https traffic to our email gateway. However seeing quite a lot of authentication failures on our barracuda the email firewall. IPS and AV is enabled for the UTM . Any way to check this out. Cant do block by ip isnce it is random ip on a daily basis. Running firmware 5.0.10

Hi,First, I am new with fortinet products and I'm beginning the training with this products. Sorry for my english, it's my second language. I have a problem with vpn connection from a customer. After a moment, it disconnect.We use forticlient.But I can access directly to the installation.  I checked the parameters : In phase 1 keylife : 84600 the checked box : dead peer detections and not traversal Phase 2 : keylife : 84600 checked box : enable replay detection and enable PFS   Thank you If you have other solutions or more informations. Regards, Pierre

hello everybody.. today i have upgraded 80C unit to 5.2.2 and i was wonder how to enable disk log as it is logs are being stored at memory. appreciate your cooperate in regards to this mater.

Any report guru's out there tell me how to get the "Estimated Browsing Time" to display by hour or by day rather than for the entire reporting period? 

Greetings, we moved the firmware to 5.0.10 from 5.0 and then to 5.2.2. Internet wasn't working on 5.2.2, hence downgraded back to 5.0.10. ALl seem to work fine except that the internet is very slow. Have a 100 mb connection, however getting very close to 1mb hardly. Have two wan lines, Wan1 leased line for email traffic and wan2 ( adsl) for internet. Fortigate is connected to a ASA and from asa via switch the internet network. Any advice on what needs to be checked is highly appreciated. have tried connecting separately to a laptop from the line and speed is ok. also did a diag deviceinfo command on wan2 for adsl and didn't see any packet errors in the output result.  checked the routing policy. seems the fortigate is taking only single route and that is to the leased line only. The adsl is not being used at all. How can I detect adsl route on the firewall and set the distance and priority .

Hello,i am Using a FortigateVM and a Sophos VM on a ESXI Server in Test Lab. Both appliances have different Public IP´s for WAN Connection. Both are in Internal Network 192.168.1.1 = Fortigate, 192.168.1.2 = Sophos.  Yesterday for some strange Reason i received a lot of logs From Sophos that Fortigate (192.168.1.1) has tried to login via SSH on the Sophos Shell with different login Names like root, admin etc. Here the logs: Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:05 with username admin.Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:00:47 with username monitor.Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username root.Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username rootFailed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username root.Too many failed logins from 192.168.1.1 for facility sshd.Further logins will be blocked for 600 seconds. I Checked the Syst

Hi all I am wondering if someone can point me in the right direction here.I have two Fortigates connected via ipsec vpn. Site B's internal interface is 192.168.3.0/24 , wifi is 10.1.2.0/24Site A's internal interface is 192.168.2.0/24 I have setup firewall policies and static routes for these ip ranges to the VPN objects in each Fortigate.Clients on the internal interfaces can ping / communicate with the other sides internal interface, but clients on the Site B's wifi cannot.I have also updated the remote subnet address group to include the 10.1.2.0/24 in site A's firewall policy Would this be because in my vpn tunnel phase 2 I have specified the local and remote ip ranges instead of using 0.0.0.0/0 ? A tracert from Site B's wifi to Site A's internal will show the first hop as hitting the wifi interface ip at site B , then nothing Thanks for any assistance 

We moved to FC 5.2.1 for pre-logon SSL-VPN after the debacle of the 4.5.3 updater trying to automatically install an entire security suite on top of our existing one.  Someone eventually dug up a registry hack to stop that.  And now I find out that 5.2.1 is still prompting users to add on the additional security features after explicitly installing VPN Components only. How do I turn that off??? At no point in time should a regular user in an enterprise environment ever be prompted or offered the option of changing the security software on their computer; that's strictly an administrative function.  What's so hard about this?  It's completely baffling to me why I have to put so much work into preventing FortiClient from pwning my computers.

I created a new event handler to notify me of all the sslvpn logins, I've rather done that from fortigate but it seems it's only capable of notifying failed logins. The issue is that I can't find a setting so all the events are sent by mail, only the ones triggering the interval defined (see the attached screenshot from the manual)Is there any way to accomplish that? I am currently using 1match in a 1 minute period to get the alerts.EDIT; Forgot to add that I'm using FAZ 5.2.1

Hello community 6 So my question is this: If I have a branch office connected via IPSEC VPN site-to-site, do I need UTM licence on my 60D in the branch office or can I filter everything through my 100D in the main office? Thanks

Hi there I've got a clustered set of FortiGate 90D devices running 5.2.2 that is serving sslvpn.  I have scrounged a Linux client for sslvpn that identifies itself as  forticlentsslvpn_linux_4.4.2297.tar.gz from somewhere, not entirely sure, possibly an old firmware folder on the FortiNet firmware page. It works as advertised on CentOS 6.6 x86_64 systems, however I have some users insisting on using Fedora 20 x86_64, and they can't get it to work -- it doesn't look like the routing table is getting updated after the client connects. Does anyone have any ideas what might be going on, or am I wasting my time trying to get this to work? Thanks for reading.

OK, So I have an Public Wireless interface (Port5: 192.168.16.1/20) that has all my public wireless traffic that is only allowed access to the Internet (Port1: 12.249.1.1).  The DHCP Scope for Port5: is 192.168.16.2 - 192.168. 31.254.   Everything works great UNLESS DHCP assigns me an address in the 192.168.20.x range, then nothing works.  If you look at my routing table you will see:  Now I didn't think much of this because the FW should always prefer a locally connected route over one learned via. a routing protocol (OSPF in this instance).  Though in my environment this is not the case.  I tested this by hardcoding my machine to 192.168.20.125 and tried to ping 8.8.8.8 and did a packet capture on the FW (v5.0,build0128) I see that the traffic flows: Client (192.168.20.125) ->-> Port5 in (inside pub wireless 192.168.16.1)-> Port1 out (outside Internet connection 12.249.1.1) -> Destination (8.8.8.8)-> Port1 in

Dear All,I have fortigate 800c(version 5.00556) and IPS signature has expired and in the process of renewing.There is a poodle vulnerability and it will solve with 5.587..My question is ..1)is it possible to update without renewing?                        2)from where can I download this 5.587 ?                        3)if it is not possible to download wihout renewing..can we get temporally signature till it get renewed? Thanks  

Hi,I have FortiGate 3140B v4.0 (MR2 patch 13). Is there a way to configure a rule which can control number of tcp connections per source IP (something similar to Cisco ASA policy - per-client-max)? Thank youHubert 

Hi All,We have a FortiGate 100D Cluster (Active-Active), running Version 5.2.2 Build 642 (GA). We have just received a pair of FortiCloud Subscription Certificates (200GB).I have been able to upgrade the subscription on the primary (master) unit via the Web GUI. However, I'm not sure how to upgrade the secondary (slave) unit. I attempted to do this via the FortiCloud Web Portal, but that didn't work.Is it possible to upgrade the FortiCloud subscription on the appliance from the CLI?Many thanks, JP 

hi, we have two 1500D with vdom enabled on both, each should have 4 VDOMs (root,vpn,servers,wan) i configured an HA A/P with vcluser2 enabled and moved Servers vdom to vcluster 2 to become the master in the other unit, so basically it becomes like that:  Device Priority Name             Vcluster1                    Vcluster2 FGT_ha_1      200(root,vpn,wan)       100 (servers) FGT_ha_2      100 (servers)              200(root,vpn,wan) which worked great in term of flow, now when testing the vdom failover (port monitor enabled on vdom port lever) we manually unplugged the vdom cables unfortunately the failover did not happened until i moved the vdom manually to the other vcluster e.g: moved vpn to vcluster2 . did i miss something here ( i followed the document of 5.2 HA ) which i believe should be straight

Since enabling the transparent web proxy in our FG200B a few days ago, I noticed this morning that nothing was showing up in the cache monitor.  Suspecting that it had 'crashed' over the weekend, I went into the CLI and ran:[ul]config globaldiag wacs restart[/ul]and sure enough, straight away there was stuff showing up again in the cache monitor screen.  Several questions occur to me:[ol]is the transparent web proxy cache functionality robust, or is it known to be a bit flaky?is there any way I can be sure about my suspicion that the service is crashing?[/ol]I didn't think to run 'diag sys top' before restarting the wa_cs service, but I will do that if I notice problems with it again.

hello which indoor units support wireless AC ?  thanks,