Solved

Hello,I have FortiOS 5.0.11 but it is not still clear how it works. It has been enabled HTTPS inspection with CA sertificate (Fortinet_CA_SSL_Proxy) but on web filter profile scan encrypted connections is not configured. I can't understand why actually scan encrypted connections is disabled. Maybe a lot of traffic can't be scanned because of this ? Maybe also application control could benefit from enabling scan encrypted connections ? Another question is about the way Fortigate use it's own certificate for ssl inspection. Can Fortigate work as man in the middle to deep scan HTTPS traffic ? Regards

I have a virtual server setup from a public ip to an internal server ( owa ) with ssloffload.  The server has the necessary fortigate certificate and the fortigate is presenting the original server certificate to the clients coming from the web.  It used to work well in 5.0.9 but since I upgraded to 5.2.3 it's no longer working.  Web browser give bad certificate error.   I cannot open the page at all.  Where there any change in the way ssl or certificate are processed in 5.2.x that need to be manually adjusted ? The certificate is not expired. Any idea what could have happened? Thanks

Dear all,i have a fortigate 100D version v5.2.1,build618, i need to set a rules to block all streaming video from YouTube and Facebook YouTube was close, but Facebook video streaming is still open

After automatic installation of 200 FortiClients, every one downloads about 200MB of signatures from Internet. This means: 40 GB have to be downloaded just for FortiClient installation. Can I avoid it? Consequent updates are smaller and are not using that much of Internet so the problem is just installation. I don't want to buy FortiManager only for first signatures update. Is there any way to import current signatures from local file into FortiClient after installation?

Hello everyone, I have been asked to give 2 tenants in our building public IP ranges for their use.Tenant 1 wants 5 public IP addresses and tenant 2 wants 12 public IP addressesWe have 32 public IP's of which we are using 5 on a Fortigate 100D v5.0.9They must have public IP's and not nat'ed private addresses. How would I configure this. Thanks

Hi Guys, I desparetly need your help, I'm trying to create a VPN Connection between the Fortigate 60C and Cisco 881 Router. I have tried everything and there is still no positive result. [>:] Phase 1 negotiation is successfull but there is no Phase 2 Start. I have tried both Links under  http://blog.webernetz.net/2015/02/05/ipsec-site-to-site-vpn-fortigate-cisco-asa/ http://blog.webernetz.net/2015/02/02/ipsec-site-to-site-vpn-fortigate-cisco-router/ And non of them really gets me going forward. Do you have Experience with such devices? I have managed the FortiGate until now without any Problems, have created a VPN but from Forti to Forti. But now we need a VPN for a Customer and this is quite Challaging now... Thanks for your Help in advance. Best Regards, Ziga

I have a Cisco core switch which is the one in charge of routing the internal traffic between VLANs everything in the internal communication is working fine I mean VLAN 20 has communication to any other VLAN in my organization nevertheless  I added a VLAN interface in my Fortigate 600C with FortiOS 5.0 build 0271 Patch 6 config system interface     edit "VLAN 20"         set vdom "root"         set ip 10.1.20.2 255.255.255.0         set allowaccess ping https         set snmp-index 35         set interface "port1"         set vlanid 20     next end when I try to ping from a pc in the subnet and VLAN 20 gaves me the following error:# diagnose debug flow show function-name enable # diagnose debug flow filter addr 10.1.20.3 # diagnose de

I have this problem with few remote users of my company. But its very urgent to give him sslvpn access to have work from remote location any time. But when they try to connect forticlient sslvp stop at 98% & disconnect. I have tried uninstalling & reinstalling application, also tried different versions, disabled windows firewall, antivirus and unchecked IPV6 but still no luck. Please tell me the correct solution. I am sick of thisissue.

We are running an old version of FortiOS 4.3 (patch 6) with a known memory leak.  Obviously it needs to be updated.  In the meantime, once a month one of the network engineers was killing the rogue process to free up the memory.  He has since left the company and didn't document what the process was or how to kill it.  All I have is a Fortinet ticket #. I connected to the CLI but the only CLI commands available (both via web and ssh) are config, get, show and exit.  I'm looking at the FortiOS Handbook CLI Reference for FortiOS 4.3 and is says the command I should use is "system performance top".  However "system" isn't valid (5499: Unknown action 0 Command fail.  Return code -1) What might be the reason "system" isn't available? 

 Hi All, I am seeking advice on how I can fine tune our spam settings to help produce a better result.   Our system is setup to send pretty much everything to quarantine as when we had our profile set to discard we were having too many false positive emails and users were complaining about not receiving email.  Unfortunately, this means that many users are getting regular spam going to quarantine and the quarantine reports themselves have become spammy in nature (two reporting periods a day) Now I feel dumb doing it this way as the system is correctly identifying so much spam that we are just pushing to our users quarantine anyways, but I am unsure how to filter those out, while keeping things loose enough that we don't get a high false positive on legitimate mail. Primarily we have trouble with parents emails to schools from local ISP email addresses where the ISP servers are constantly jumping on and off of blacklists. This wouldn't be an issue

Hi All, What is the rule when creating a New FortiAP Profile, if you require multiple SSIDs to be added to the given Profile...how do you balance the SSIDs between the two Radios and Channels? FortiAP = FAP220B.SSIDs = Staff; Guests; Contractors; Auditors. If I enable all of the above SSIDs for both Radio 1 (5GHz Band - All Channels) and Radio 2 (2.4GHz - All Channels) and Apply the New Profile to just one FortiAP...I see the FortiAP Broadcasts all SSIDs from one selected Channel out of the 5GHz available Channels and then one selected Channel out of the 2.4GHz available Channels. Therefore its perfect that all of the SSIDs are available within the 5GHz Band and the 2.4GHz Band. So I am seeing: -FortiAP # 1-Radio 1: SSID = Staff; Guests; Contractors; Auditors  - Channel = 36Radio 2: SSID = Staff; Guests; Contractors; Auditors  - Channel = 12 But the question is, would there not be a conflict between the SSIDs broadcasting over the same

Hello there, Currently testing a Fortigate unit for possible use in production soon.We have a scenario where we need to set URL filtering based on LDAP group membership but the group membership changes frequently. A user could be in and out of a group multiple times in a day, for example. We're using a collector agent with DC polling for collecting user details at the moment, which seems to be working well enough (300 users), and it seems group membership gets updated fairly frequently with Windows users (I'm guessing with the ~5 min workstation checking interval), but Mac OSX users' group memberships don't get updated until a logoff or screen lock/unlock. My question is, is it possible for the Fortigate to update group membership for Mac Users without them having to logoff and back on again? Any other approaches I should be looking at? Help/advice greatly appreciated Cheers.  

Dear Experts, In FortiVew > Summary View > SSL&Dialup IPsec, I can see SSLVPN users and IPsec branch offices successfully connecting to our Fortigate-100D.  But strangely, all the Connection Time of Dialup Session are same."01/01 09:00 - 01/01 09:00" In Fortianalyzer, other time and date of logs like "Top source" "System Events" are  working correctly.I also checked VPN logs in Fortigate, and found that those time are correct.  How can I fix this?  Any ideas?  - Fortianalyzer-200D with 5.2.1(latest) Thanks in advance  

Hi, I've been on a steep learning curve as I work towards implementing a Fortigate 60D running 5.2.2, however I have got to grips with most elements so far.However I've hit a wall in understanding how I can create a policy allowing access to Microsoft & Windows updates for all.Using Microsoft's lists of required URLs (some of which are wildcard) as published here: https://technet.microsoft.com/en-us/library/dd939870(WS.10).aspx I've attempted to create a urlfilter webfilter as below (based on comments in this post https://forum.fortinet.com/tm.aspx?m=122223) :config webfilter urlfilter edit 141 set name WindowsUpdate set comment 'Windows Update URLS' config entries edit 1 [size="2"] set url [link]http://windowsupdate.microsoft.com[/link][/size] set type simple set action allow set status enable next edit 2 [size="2"] set url [link]http://*.windowsupdate.microsoft.com[/link][/size] set type wildcard set action allow set status enable next edit 3

Please see the attached. This message appears with websites that I have blocked. Thanks for your help.

Hello All, I have been facing a issue from last few days, i am not able to access https://slack.com, "https://hubspot.com" both URLs.Same URLs are working properly before. We are not using any Webfilter, Application Control, IPS or AV on our firewall. I tried to upgrade the OS to 5.2 but still same the results. There is no issue with internet service provide end. I observed in log that, the connection is closing immediately. What causing this issue ? Here i am sharing log screen shot. Kindly Help. Thanks in advance. RegardsNaveen.D   

Hello,Please I need to know if this vulnerability: "Multiple products cross-site scripting vulnerabilities" annonced by fortiquard, affecte all the fortigate device including Fortios 5.0.x ??

Hello, i have heard that appliances that can upgrade to 5.0 for example FG 110C and are now running fortiOS 4.0 , will soon not be supported anymore. can someone confirm this?

Hello,I have a problem with a fortigate 100D model. I have configured a policy with a VIP for relaying mail. Only SMTP (port 25)The policy has Antivirus enabled in Proxy - Block mode and a Email filter in Proxy mode and Discard mode for SMTP. When there is a normal mail I can see in the Fortigate logging that it has been scanned by the fortigate and then allowed or blocked. But when the client and the Exchange server negotiate a secure TLS connection the mail transported during this session is not being scanned. So the problem is that spam mail send during such a session is forwarded without any problem. What am I doing wrong? Has anybody else this same problem? Fortigate: 100DVersion: 5.2.1 Thanks in advance

I have been on the box all day and after about 4 hours I could not log back in I keep getting this message.  trying to log in through admin just get message. Your account has been lockedCan someone help with this.I have created a profile in the radius server and can log in through that but have no option in it. Cant log in though CLI either just get same message. Your account has been locked

Hi, My fortigate has the LAN IP 172.28.75.1/24. on this interface, I enabled the ping and https service for administration. My admin user has trustedhost specified (172.28.75.0/24). So, I'm able to ping from my LAN network. That's OK. My problem is : I've a VPN with a juniper, and I've configured the VPN monitor (this is icmp request to check if the VPN is UP), but my fortigate don't response, because my juniper's LAN is 10.0.0.0/24 (not in trustedhost). How can I enabling the ping from subnet 10.0.0.0/24, without enabling the administration of my fortigate? I already try with local-in-policy, but it's look like the action "accept" doesn't work.. Thanks in advance Lucas

Hi all i just bought a 92D to replace my 60DI converted config file to match new hardware and connected it to Juniper switch but nothing workedI searched what could be wrong on fortigate but all seems to be OKOn switch side, i saw that when internal1 was connected ( only this port connected to the switch ), MAC address was correctly learnt on the switch port but when internal2 was connected, MAC of internal1 disappeard from the switch and i could only see the MAC of internal2At this instant, my 60D is working perfectly on this switch so i think that the problem does not come from the switchare you aware about this kind of problem ?Is there any parameter to set up ? Thanks in advance 

Hi everyone I spend most of the day setting up a Fortigate 60D with SSLVPN configuration. I am using the FortiClient 5.2.3.0633 and Fortigate firmware is 5.2.2,build642 (GA).The PC I use is a Windows 7 and is not domain joined.  I want to map four network drives when connected to the SSLVPN. When I connect to the SSLVPN from my PC on a external network I get authenticated and the correct IP and DNS settings, even the correct DNS-suffix is pushed out through the tunnel. I am able to ping file server and I am also able to access the directory I want to map by using the UNC path which is the same as I want to map by the script. So everything is in place, but the logonscript in the FortiClient configuration. My XML file looks like this: <on_connect> <script> <os>windows</os> <script> <![CDATA[ net use S: \\SERVER\SHARENAME /user:#username#@domain.local #password# net use P: \\SERVER\SHARENAME /user:#username#@domain.local #passw

 There seems to be 4 firmware images for the 60D: FGT_60D-v5-build0670-FORTINET.outFGT_60D_POE-v5-build0670-FORTINET.outFGT_60D_MC-v5-build0670-FORTINET.outFGR_60D-v5-build0670-FORTINET.out The FGR is probably the rugged modelThe 60D_POE is clear. What is the difference between FGT_60D-v5 and FGT_60D_MC-v5?MC? I am sure this is just me being forgetful but when I search for 60D_MC I hit nothing. Thanks! -N  

Hi everyone, I had a FG 1500D and want to know if theres a way to aggregate my bandwidth from a different WAN Links. I already have load balancing with ECMP and DGD for every interface(4 WANs) and the respective set of policies for every interface. I want to know if theres a way to not only have load sharing and failover, also bandwidth aggregation. Kind Regards,