Solved

Hi everyone, I'm planning to setup a FG-80C in  transparent mode behind two routers on my network. I just want to know  what are the features of fortigate that will not work in transparent mode setup compared to NAT mode?And what should be the best practice in transparent mode? My purpose is just blocking prohibited sites on my network and control the bandwidth usage on particular users. Is single sign on and traffic shapping works in transparent mode? Can I also access the firewall outside my network while in transparent mode?Any help, tips, suggestions, reactions will be much appreciated. Thank you. Regards,Jam

I've just checked two fortmails with latest OS 5.1.It seems to be vulnerable for LogJam attacks.When will there a new Firmware be available? Patrick

"Cross-domain" request problem about JS...have anyone can get it from beta portal???..

Hi,we have a fortigate 60B with a 4.0mr3 patch 13 firmware and we want to migrate to a fortigate 80C with v5.0,build3608 (GA Patch 7). I don't know if i should migrate the 60B to 5.0 before creating my backup or If i can directly try my backup on the 80C? Thanks

What documentation exists about the forwarding of a authentication on the ssl vpn webportal to services I present in the portal? If you use this, what services do you present with using SSO? We have a lot of internal services, microsoft based, atlassian systems, etc. (all of them are using our active directory for authentication) and we would like the users to only have to sign on on the portal itself.

Hi everyone. I have a FortiWifi 90D currently running the IOS 5.2.3 and I'm having some issues with the Authentication portal after a user login time's out or if the computer is not part of the domain. In the 5.0.X the user had to re-authenticate in a editable portal (Captive Portal), but now when you try to access the internet there's no portal and nothing happens. Is there a new config that I'm not aware of? Thank you in advance.

Hallo, I have a problem in phase 2 with rekeying. I have 7 location and my home office, at the location i have 2 30B v4.0,build0665,  3 80c v5.0,build0310, 1 60d v5.0,build0310 and 1 100D v5.0,build4429, at home i have a Server with Strongswan 4.5.2. between the 100d and Strongswan is a static tunnel, the other Forti's are configured as responder and strongswan as initiator.The keylifetime is 1800s, after this time the 100D delete child_sa and phase 2 ist down, but phase2 don't come up. at the other location's i have a simular problem after rekeying in phase 2, i see phase 2 is up on both sites, when i ping a host, i don't get a answer. The package pass the tunnel and go to the host, the host send an answer, this package go in the tunnel interface from the forti, at home i don't see this package on the lan-interface from my Server. Strongswan is configured with inactivity option (300s). After 300s phase2 go down. if i ping a host, i get an answer. Doe

Hi,does anybody know if it's possible to configure an IP Subnet instead of a single IP or FQDN for a Client in Radius Service? For example, in Freeradius you can define: client 192.168.1.0/24 { secret = VERYSECRETSTRING } or client private-network-1 { ipaddr = 192.168.1.0 netmask = 24 secret = VERYSECRETSTRING shortname = private-network-1 } Thank you. Regards. Jorge.

Hello, from few days I try to set up router to using two ISP. I have virtual IP 79.10.10.245->192.168.1.5 on WAN1. I would like to use WAN2 for only one internal IP (192.168.1.15) and others internal IPs should go out via WAN1. I set up WAN2 (outside IP), added static route and police routes. Now the traffic for 192.168.1.15 goes via WAN2 but there is no routing between 192.168.1.15 and virtual IP 79.10.10.245. From 192.168.1.15 I can ping 192.168.1.5 and WAN1 router IP 79.10.10.242 but I can't ping 79.10.10.245. WAN1 79.10.10.242/28WAN2 80.10.10.242/28Mail server IP: 79.10.10.245 /internal 192.168.1.5/ Static route:WAN1:destination:0.0.0.0/0.0.0.0device: wan1 gateway: 79.10.10.241distance:10priority:0 WAN1:destination:0.0.0.0/0.0.0.0device: wan2gateway: 80.10.10.241distance:10priority:5 Policy routes:Procotol: allInncoming interface: internalSource: 192.168.1.15Destination: 0.0.0.0/0.0.0.0Outgoing interfece: WAN2Gateway:  80.10.10.241&nb

So We updated our Firmware to 5.0.9 not too long ago and we now seem to have issues with https sites. I just need to know if this behavior is normal, or if there is something wrong. The issues we have are that some https sites, not all, when users access them, they will come up with any or all of the following..... A blank white page The will state that there is no Java, or Flash installed, when there is. Or that the incorrect java or flash version is installed, even when we know for 100% sure that the correct version is on the pc. I can do one of 2 things to fix this. 1. I can either create an address object with the site url in it, and put it into a policy in front of our main user policy, that ONLY has AV and IPS turned on. SSL inspection and webcache are turned off in this policy. 2. I can put the url into the url filter the user gets as a wildcard and exempt, and that also makes the site work. Again, on our previous version of firmware, which I BELIEVE was 5.0.6 w

Hi all, new to fortigate products.. trying to get web filtering up and running so I can get rid of Websense and simply use the fortigates features. I'm hitting a little problem though.. so I'm using FSSO in polling mode to AD. Its recognizing the users fine, but it seems to be timing out at some point. For example, I have a windows 7 VM that I have using the fortigate as its gateway for testing. I log this machine in as a test user, test the policies, it blocks me to the appropriate sites, etc.. however after a while, it seems to just "forget" about me and won't let me access any sites at all unless I log off/back on. Annoying. Am I timing out? Any way to prevent this from happening or how do you handle? Using a Fortigate 200D

Hi, there I configured Web Filter override for certain user group. User can now enter username and password to override for 15 min (not user changeable). However from logging/reporting perspective, is there anyway to see who is overriding the web filter? How long left for the override duration and how to revoke the web filter override for certain user if needed? Plus, it doesnot seem like Web override can not use the same user account for authentication? For example, USER1 belong to Group1 which is configured for override authentication. USER1 is browsing to www.abc.com which is blocked by filter profile. USER1 can not use her/his account to override, right? Maybe asking too much but can not find a manual to give me answers... 

Hi all, Hoping to find an answer here, I'm kind of new to Fortinet and this is my first post here.  I bought 2 x FortiGate 500Ds for a client, running in Active/Active mode with 5.23 FortiOS.  There are 8 SFP slots in each of them, and the units each came with 2 1000BaseSX SFP modules.  Problem is I do not get a link light on these ports when I make the fiber connection and there is no connection detected.  The same cable works fine when connecting it to a Cisco 4507 switch (also a 1000BaseSX module).   This is happening on both FortiGate units, on all ports and all GBICs.  The ports are not shutdown and I'm fairly certain I'm making the connection correctly.  So I'm thinking there must be something I need to configure to make these ports work.  But can't find any info.  What am I missing?

Hi, i have the following situation:WAN1 IP Gateway is 10.10.2.1/24 Wan2 IP Gateway is 10.10.1.1/24 INTERNAL_LAN 192.168.1.0/24 GUEST_LAN 10.1.1.0/24 I'm trying to make computers on INTERNAL_LAN access the internet using WAN1 and GUEST_LAN to WAN2. I created 2 static routes as below: 0.0.0.0/0.0.0.0 Gateway 10.10.2.1 on device WAN1 0.0.0.0/0.0.0.0 Gateway 10.10.1.1 on device WAN2 both having distance 10 and priority 0 2 policies are created, INTERNAL_LAN to WAN1 and GUEST_LAN to WAN2, ALL allowedWhen I connect only WAN1, the computers on INTERNAL_LAN can access internet -> OK When I connect only WAN2, the computers on GUEST_LAN can access internet -> OK When I connect WAN1 and WAN2, the computers on GUEST_LAN can access internet via WAN2, but INTERNAL_LAN can't access via WAN1 -> PROBLEM Why ?Thank you for any help Luca

Hi,i've trouble creating a L2TP/IPSec VPN on our Fortigate(FW 5.2.2,build642) If i use the wizard (Dialup - Android (Native L2TP/IPsec), i cannot select the WAN Interface as incoming Interface.There is only DMZ and INTERNAL available (the fortigate is in Switch-mode).Selecting the iOS (Native) wizard, the WAN Interfaces are available (we use load-balancing). My VPN menu also looks different to the pictures in the documents (i've no "Auto Key(IKE)" option / the "Policy-based IPsec VPN" Feature is enabled). I've also tried to create the tunnel via CLI, but i got a error at "set interface wan1".Is it because the fortigate is in Switch-mode? Hope you can help me. regardsJuergen 

Policy Based NAT might not be the correct term but what I am looking for is: For the VPN tunnel, the remote subnet and local subnet are the same. With Cisco ASA, I would need to configure policy based NAT or identity NAT. However not sure how to do that with Fortigate. Please advise.

Hello, I have a Fortigate 60C and 7 FortiAP. I know i can't add all my AP to the Fortigate in normal mode. I read this http://kb.fortinet.com/kb/documentLink.do?externalID=FD36164But what i don't understand is what involve the bridge mode ? Is there a way to add two differents SSID to an AP, one in bridge mode and the other in normal ? Thanks

Hi Does anyone knows if FortiOS support discontinuous subnet mask like 10.0.128.0/255.0.255.0? Our networking team make use of discontinuous mask since our Cisco switch support it but I can't find any information about the FortiOS documentation.   ThanksDominic

Hello All, At a client, I have some issues adding a "newly" received fortigate 100D after one defective member has been replaced by Fortigate.The problem is that the firewalls now have different buildnumbers and when I try to join the new member, I get the following warning:fortinet HA cannot be formed because the internal ports of box is in different mode with this box, ... I have checked the interface name and they are different on the two boxes.On the primary node, it's name is: internalon the received node, it's name is: lan I have one backup of the primary node that has been working as standalone during a year and a half.The current firmware version = FG100D-5.02-FW-build618-140915I have uploaded the firmware through TFTP in the preboot menu (on received node). How can I restore the HA with these two firewalls?I need to change the cfg file of the working firewall? If so, what and where?I can change the name of the interface on the received firewall? I've b

helloi have strange problem.i have fortigate 60. the problem is i can't ping from CLI console some IP addreses.for example, i have server with ip 192.168.1.15ping to this address gives 100% packet lossif i change ip of the server to 192.168.1.5 the ping working fine.i can't find anything blocking addresses 192.168.1.11-192.168.1.20anyone have idea why is it? thanks.

We are running 5.2.2 on a Fortigate 100D.I have set up at SSL VPN portal with web mode only (no tunnel).In the bookmarks I have added a webpage that is only accessable through a VPN tunnel. I have added a policy that allows the access from ssl.root to the IPsec interface that the website is behind.But I see that traffic from the web mode only portal is originating with a source address of 192.168.1.99 which is the default management IP of the fortigate. I have greped through the whole config an can not find any relation between ssl.root and the management IP. Access to the website is not working (ofcourse) since the management IP is not part of the Phase 2.I have also tried to turn on NAT on the policy, but it still shows the management IP when I run diagnose debug trace. Do anyone have any idea on how I can change the IP that the web mode is using or a way to NAT this correctly?  

I'm having trouble finding a way to change my authentication mode from "Aggressive" to "Main" while connecting via OS X Forticlient. I'm testing with IPSec Remote Access on my Fortigate 200D and my windows workstations connect fine, because I can set them to "Main" mode.  Everything is up to date, including the forticlient application. Any ideas?

Hi all, I am about to implement the SSL Webportal in our environment, but cannot find an answer to the following question:My WAN-interface has a public subnet assigned. When setting up SSL I need to select which interface to listen to, but I cannot see where to assign a specific IP where I want the service to listen. Is this controlled by a policy? I don't want the SSL Webportal to listen to all public IPs. Thanks in advanceRegardsMichael

I have configured my fortigate 80C firewall for SSL VPN...& am able to connect also thru it..only issue is am losing internet connectivity after getting connected to VPN... any idea?? EDIT: I have enabled split tunneling & now everything is working...

I notice that when the FortiMail sends outbound mail, it's using the RC4 cipher: it looks like (version=TLSv1.2 cipher=RC4-SHA bits=128/128) when I view headers for a message sent from the FortiMail. We're using version 5.2. I'm sure it can be set to AES128 or something better, but I'm not sure how to achieve this. Any thoughts?