Solved

Configuration ipsecWan1 - Internet   (vpntunnel1 , and vpntunnel2)Interface 1 - lan1 10.0.0.0Interface 2 - lan2 10.0.3.0I can establish vpn with vpntunnel1 to lan1 but cannot establish vpntunnel2 to lan2in event log vpn when I try establish vpntunnel2 I see there the fortigate is tryining go through vpntunnel1 instead vpntunnel2 (strange). (vpntunnel2 have diffrent adresses and has intrEface 2 which I set in objects)event log: progress IPsec phase 1 success and delete IPsec phase 1 SA but why vpntunnel1 not 2.I think i can set the fortigate to choose vpntunel2 and then everything will be ok ? But how ?p.s SORRY for English 

Hi Guys... SoI' ve gone through the standard charts / datasets and I can' t seem to find one that will give me browsing history. I' m running Fortianalyzer 100c with v5.0.5 I need to be able to check on browsing history for specific users. What websites and when...can anybody help me with this please?? thanks

I try to create a new web filtering but I do not know how to do it because the create New button is missingThe web filtering service is enabled 

Hello Everyone, I just spun up a new installation of FortiManager, version 5.2 build 618. I am using the virtual appliance downloaded from the website. I am trying to import a couple of FortiGate 300D devices, version 5.2.1 build 618. However, I get the following error: This FortiManager does not support the discovered device model and firmware version combination.  Has anyone seen that problem before? Could anyone provide a fix or workaround? Thanks!

Hi All,A heads up here.  We had some downtime for a bandwidth upgrade so at the same time we thought we would upgrade our 200D to V5.2.1. - which we have working fine elsewhere.  This worked fine in most aspects BUT:An Ironport cluster and a VMware application running over an IPsec VPN would disconnect almost every 59mins 23 (ish) seconds.  Then reconnect.  VPN's would stay up no errors or other notifications.   It was so regular we knew it must be a timer or something somewhere - but we could not find it.  We did packet traces of the disconnects and found that at the time of the disconnects 'something' was causing the application(s) to reset all its sessions. We chased the ISP blaming the new link and looking at all manner of things that could be causing this, all to no avail.  Today we reverted to V5.2.0 Build 589 - so far we have not had one disconnect (3hrs).  The config on the Firewall is exactly the same. &nbsp

Hi,Is there any way to forward Event Log via syslog ?Moreover is it possible to filter the export, for instance focusing on events like logins/logouts and export only these ones ?Thanks.  

Looking to script the update of ips signature files, but without ftp or tftp available (which rules out execute restore ips [ftp|tftp] etc..). Can scp be used to deploy ips signature files? If so, what is the destination filename on the FGT, any other steps required?

HelloAs Can I unlock a mac address?I blocked a mac address and I'm looking to unlockThank you very much 

Hello, Please, how I can keep the traffic logs allowed by all the access list, and send just a logs of SOME rules to the FortiAnalyzer ?to better explain:for exemple: keep on the fortigate disk the trafic log of the rules id: 1 and 2 and 3, and send only the traffic log of the rule id 3 to the fortianalyzer.

FGT1 internal1 is directly* connected to FGT2 wan1 and there is an ipsec interface vpn which was working fine but is now down.I see the following debug at FGT1diag deb app ike -1 diag deb en ike 0: comes 172.a.b.122:500->172.a.b.121:500,ifindex=11... [...] ike 0: no IKEv1 phase1 configuration matching 172.a.b.122:500->172.a.b.121 11The full phase1-interface configurations have been verified to be correct and match. I don't know how to resolve ifindex to physical interface (I've seen ifindex mentioned somewhere in doco but can't find it now). The tunnel gateway on FGT1 is a secondary ip address.I have also subsequently forced a psk mismatch with no change to the debug output.FGT1 was recently updated from 4.1.4 to 4.3.18 with no known issues; another vpn is working fine. FGT2 is 4.3.14, update pending.Any tips where to look next? * "directly" is a digital radio link. There are no known issues with the link.

hi , can i restore a vdom settings from a full config backup ? on my FW i have 3 vdoms (Root,VPN and Server_IPS) i need to restore the config for the VPN vdom only but i only have the full backup config not vdom specific so is it possible or can i modifiy the backup file in a way that it restores the vdom only ? BR

Have anyone encountered their fortigate displaying 100% CPU on their system resources? Using a FGT 200B and upgrade recently with 5.2.0. was working fine until today then got this issue. Thought its IPS issue so restart the IPS engine but no help went into diag top 1 100 and found scanunid is using 96% of CPU. tried to kill this process ID but no help. any ideas? Polices have got virus scan (flow control), IPS and web filter running.

I have a Fortigate running 5.2.2 and a FortiAnalyzer running 5.2.0 (multiple customers have the same issue) and I am unable to view the logs on the firewall when selecting "Display logs from: FortiAnalyzer". The logs are sent correctly to the analyzer and we can view the logs from the analyzer but all logs are emtpy on the firewall itself. Is this a known issue ?

Hi, We want use the Fortigate Wireless Captive portal with Self-Registration. The user will register him self on the Captive Portal to get the login for Wireless... I've been configured the FortiAuthenticator with success. But, how is the HTML code that I need put on Fortigate captive portal to users access the self-registration portal?  Regards,Paulo Raponi

I have my VPN's running the way I want, but can't seem to find the right method to enable SNMP access over the VPN. Actually see the source CACTI server connect over the VPN to the "root" device on the LAN side of the remote fortigate, but it's denied. How can I enable SNMP access over the VPN from the tunnel interface?  K

A previously working OSPF area now has issues. Troubleshooting using this KB article but stuck now.FGT1 is an ABR with multiple OSPF areas. Area 0.0.0.3 has 2 neighbors (FGT2 and FGT3) and 3 interfaces - the primary link and two ipsec tunnels (one each neighbor).Routing on the primary link has failed. This is the only problem - all other areas are OK, and the ipsec backups within this area are also OK.Ping is OK to both neighbors' primary interface IP. Also it is possible to ssh* to FGT2 and FGT3. Heavily summarised diagnostic output as followsFGT1 # get router info ospf neighbor FGT1 # <FGT2> ExStart/Backup FGT1 # <FGT3> ExStart/DROther FGT1 # get router info ospf status FGT1 # Area 0.0.0.3 FGT1 # Number of interfaces is 3 FGT1 # Number of neighbors is 2 FGT1 # get router info ospf interface FGT1 # My-Interface is up FGT1 # Neighbor Count is 2, Adjacent neighbor count is 0 <<< I guess this is a problemFGT2 and FGT3FGT2 # get router info ospf neighbor FGT2 # <FG

Hi! I'm trying to crack the code behind this Fortigate, and must admit I'm not there yet.Given the schematic below, how do I get a public IP behind a fortigate in NAT mode without adding a second transparent v-dom.Thanks! 

Hi Everyone,I was wondering if anyone could explain the pros and cons of the two methods of SSl inspectionCertificate Inspection and Full deep Inspection.I read the technical comment howcertificate-inspection which only inspects the SSL handshake,anddeep inspection enables full deep inspection.What I would like to know is if I implement one solution does it have limitations , i.e  blocking  or something similarWhy have two methods ?Many Thanks in advance Paul

Hello, We are using "FortiGate 100D" firewall with "fortianalyzer 100c" for reporting purpose. I want to delete all internet browsing history from Fortianalyzer. I am confused about this Task will perform from which side :  Fortigate  or  Fortianalyzer ?I have done one thing from my side after Googling is that I had given below command on FortiGate Command console:execute log delete-allBut still logs are there and showing after search. so what i need to do ? Please give me exact solution   

Hi, after upgrading FAZ to 5.2.0 we have a problem with an customized dataset. When running a test query we get an error. This is the query:SELECT srcip, msg, service, dstip, count(*) as totalnumFROM $logWHERE $filter AND srcip IS NOT LIKE '10%' AND (subtype='violation' or action='deny')GROUP BY srcip, msg, dstip, serviceORDER BY totalnum DESC Log Type is set to "traffic" The error we get: ERROR: syntax error at or near "LIKE" We want to report all blocked outgoing traffic from inside. The filter on "LIKE '10%' " is essential for the report.Does anybody how to solve this in 5.2.0? Regards, Olav

Good day everyone, I'm not sure if this will be the right to place this post. Anyway, I just want to ask how do you scope your clients needs to propose a certain model of Fortigate that will fit their requirements? Can you have some advice or tips how to handle clients requirements to come up with a good fortigate model. I'm asking this for I'm not certain to some particular model of fortigate if that will fit or overkill for clients requirements. Thank you. Regards,maeLove

Hi,  i have upgraded a 310B Cluster to 5.2.1(v5.2.1,build618 (GA)), but on the FortiView the Threat View is missing (?)  Regards,Pat 

Hi All,I have 311B Fortigate, version 5.2.1.I have recently tryied to configure  PPTP VPN and authenticating with LDAP Domain Controller. After fist creating users then users group and then configuring the LDAP. When I finish LDAP configuration, testing is successful. when I try to connect to VPN, it is failed. After having many times unsuccessful pptp VPN connection, I looked at the policy and I changed the policy any to any policy on WAN interface in the first of the policy list. But this didn't help fixing this problem.In order to delving into this VPN problem, I just create a local user on the Fortigate and PPTP VPN connection is working without making change the current PPTP VPN connection configuation.In other words, Local user VPN is okay but authenticating user with LDAP is not working....As I [provide some logs and configuration at the follow section, can you please advise how I can come over this VPN problem? [style="background-color: #ffff00;"]BAL_FTG # s

We have 4 x FortiAP 220B units running firmware v5.0.7 (build 64) . In the past these unit were spread across a number of WiFi Channels (1, 6 and 11). Just recently I noticed that all of them were using Channel 6 only. I cannot find any option in the Fortigate web interface to set the channel number. I cannot find any option in the FortiAP web interface to set the channel ID, although it does at least display on the Wireless tab that Channel = 1, 6, 11. So ... to my question ... has the ability to set the WiFi Channel been removed from the FortiAP's?

Hello! I want to configure FortiClients to connect to a FortiGate 100D using IPSEC VPN, but so that different users authenticate against different AD-servers. Which means I can' t use " Accept any peer ID" in Phase1 configuration, otherwise all dialup clients will fall into the first policy and/or VPN. If I use Shrewsoft VPN Client, then it has been OK, some clients already authenticate and use the VPN, because in Shrew client there is a special place where to enter that common peer ID. The manual says (fortigate-ipsec-50.pdf, page 45): ------- To configure FortiClient - pre-shared key and peer ID 1. Start the FortiClient Endpoint Security application. 2. Go to VPN > Connections, select the existing configuration. 3. Select Advanced > Edit. Auto Key phase 1 parameters Page 45 IPsec VPN for FortiOS 5.0 4. In the Preshared Key field, type the FortiGate password that belongs to the dialup client (for example, 1234546). The user account password will be used as the p