Solved

We are trying to set up a security policy that requires the user to authenticate to the firewall when accessing a particular internal web page. It works fine if the destination site is on port 80, but not when the site is hosted on a different port (port 3000 in this case). I think it's related to the Authentication > Settings where you select the Protocol Support. It allows you to select HTTP and HTTPS, but not a specific port. 

Hi All, We have a FortiWiFi 80C which has been out of support for some time (I guess over a year, although I don't know for sure). I was thinking of getting FortiCare for this box in case something happens. The problem is that I am unable to find out what it would cost me or how renewing an expired box works. I asked FortiNet support but was pointed to their renewals team which seem to push emails back and forth, apparently unable to give me an answer. I then talked to three FortiNet resellers, and got three different replies. One said that I can just buy the 8x5 1yr FortiCare renewal for my box and I'm set. Another one said that I have to purchase the 2yr package and that FortiNet will backdate support for one year.  And the third reseller told me that once support runs out it can't be renewed. Can anyone here shed some light on it? Can I put this box back under support, and if so, how?

 Hi!the company where i work bought a new Fortigate, the 800C versión v5.0,build0291 (GA Patch 8). Before we have 311B with another versión that have the option "Log All URL" on the "Web Filter Profile" but on the new versión is not present.Is possible enabled this option on the v5.0 patch 8?

Dear all, i have a fortigate 100D version v5.2.2, i need to set a rules to block all streaming video but only allow youtube, i have done the web rating overrides youtube.com to custom group. but when i streaming video on youtube keep show video error.

We have a 400B and almost every time we apply a release or patch the configuration either gets wiped or it changes things so much that we have to relearn the new system/interface and/or reconfigure the whole box. For example we just tried to go from 5.2 0330 to 5.2 0442, not a big jump, and the physical server and server farm sections are gone. I don't mean they got wiped, I mean they are not even on the menu anymore. So we rolled it back to 330 while we try to figure out what to do THIS time. We are at the point where we don't want to upgrade the firmware any more for fear of what might happen. Tech support is no help. Not sure if this is a question or just a rant..

Howdy folks, I have created a custom data set to return the number of requests per parent domain (i.e. just the values before the country code) using the regexp_matches function. The results are returned within {} braces, is there a way to suppress these in the results? Here is a sample of the output: # domain visits 1 {bitdefender.net} 66113 2 {pubnub.com} 9583 3 {doubleclick.net} 9192 4 {serving-sys.com} 6127 5 {adnxs.com} 5700 6 {googlesyndication.com} 4765 7 {bing.com} 4530   Many thanks, Nathan

In FortiManager 4.3 you always had an option of creating a script to run at a schedule, but looking at 5.0 and 5.2's configurations I can't seem to find this option anywhere. Even the doco's dont mention script schedules (when they did for 4.3). Do you guys know if it's been disabled in the newer versions, or if I'm just blind?

We have a Fortigate 5.0 firewall and a VPN ssl Configuration, this vpn works with Windows without problems, but with macosx 10.7/8/9 we have trouble. After Client installation on the mac (5.2) we made the same config as in the windows client but when we try to connect we got an error,that there is not enough information for connect, please check User password or certificate. On the mac console we saw these message  04.11.14 11:41:18 [0x0-0x3c23c2].com.fortinet.FortiClientAgent[5679] klist: No credentials cache found while getting the ccache principal  But ridiculous ist, that on some Macclients it switched from work to not work, that means on some mac clients i could connect thru vpn, some minutes later we got an error message.

Hello,Does anyone have configured ssl offloading on the fortigate? I have used the 'cookbook' but it doesn't explain too well how to configure half mode ssl server configuration. I need to decrypt incoming https and forward this unencrypted to backend http server. What I configured:conf firewall policyset dstaddr "vip-to-webserver"  => 157.52.x.x to 172.16.16.15set service httpsset webcache enableset webcache-https ssl-server and:config wanopt ssl-serveredit webserver1set ip 172.16.16.15set port 443 set ssl-mode halfset mapped-port 80set ssl-cert <webserver certificate> Please advise. Thank you in advance, Kind regards, Ralph

I have a Fortigate 200D with FortiOS 5.0 Patch 9 (build 0292). I created address objects & custom service for a particular vendor (EMC), then used them in a policy. if I change the policy to allow "all" services it works and only logs accesses on port 443. The custom service includes (per EMC) ports 443 & 8443. If I change the rule to include the HTTPS service it works. I'm assuming I did something wrong creating the custom service, but I'm including the whole script I used in case someone can spot something else I did wrong. Here's the custom service definition: config firewall service custom edit "EMC_ESRS_Svcs" set category "My Custom Services" set comment "EMC ESRS" set tcp-portrange 443:443 8443:8443 next Any assistance would be greatly appreciated, Roger Morganrcmorgansec@morganemail.net  config firewall address edit "EMC_ESRS_A" set associated-interface "wan1" set type iprange set end-ip 128.221.192.14 set start-ip 128.221.192.13

Upgraded firmware on the Analyzer to 5.0.8 and now when I try running the built in VPN Report, none of the charts return any information.  Says "No Data". Any ideas?

Hello everyone!I have some problem with my Fortinet 80 C, it doesn't boot after firmware update. When I restarting it only "status" led diode blinking on green and after few second all internal ports blinking one second and status led changing color on red and this is happening over and over again...  I read i should try restore firmware image by tftp server, but another problem is I cannot connect to cli interface now, I get the message "device is used by another program" or something like that (I guess because it is starting up...). Connection options are correct (9600, 8, 1, none, none), because before I joined up.Is there any way to solve this problem and recover the firmware? I will be grateful.   

I recently helped a customer go from a completely flat network into a segmented network.  They only have one DNS server which sits on their server network.  I'm finding that over half of my sessions are related to DNS queries coming from clients on other networks trying to get to the server network.   Does it make more sense for me to run a DNS server on the firewall and forward DNS queries or should I continue to let DNS traffic traverse the firewall? I'm running a 300c on 5.0.7 and averaging around 15k sessions during peak usage.  In the current setup it often peaks out the CPU but memory stays around 40%.  

How to classify and mark packet on fortigate firewall.. ?? 

Hi there,I have Fortigate 310B firewall running but the Antivirus is listed as expired as per below. I am having difficulty in uploading the image. So i am going to illustrate how it looks like here : Fortiguard Subscription Services Antivirus        Expired [renew]- AV Definitions 14.00000 (Updated 2011-08-24 via Manual Update) [update]- AV Engine  4.00392 (Updated 2012-02-09 via Manual Update) 1) What does this actually mean? I believe the antivirus should be updated since Fortigate is running on it's own Operating system FortiOS. 2) Does the antivirus definition update require a separate license to run? As this was the reason I got that the license purchased was for firewall feature only, so I would like to verify if there is such thing. 3) If an antivirus update is to be performed, when is the best time to implement the update? I believe it should have some impact on network performances and speed so I reckon it shoul

Hello ,I have a question. I have a running IPSec Between 2 offices ( FG's) Site Mexico - 10.1.10.0/24 Site Ontario - 192.168.100.0/24 Now I need to add a new VLAN in Ontario L3 Switch - 10.1.100.0/24 , And I need to use this VLAN also for the IPSec . How do I achieve? thanks in advance.Nihas

Hi all, I thought I would just share a recent experience we had with our FortiGate 100D Cluster (Active-Active), Version 5.2.1 Build 618. I had created and applied a Web Filter Profile (let's call it Profile No1) to a particular group of users. I then cloned this Web Filter Profile, made a few changes to the cloned profile (imaginatively named Profile No2) and applied it to a second group of users.My reason for two separate Web Filter Profiles was I wanted to impose slightly different Static URL Filters to each profile. However, I noticed when I made a change to the Static URL Filter in either Web Filter Profile it immediately appeared in the other profile (wether I wanted it to or not). This had me confused as I imagined that the Web Filter Profiles were completely separate from each other. I dug around in the configuration and found that in the config webfilter urlfilter section, a urlfilter called 'DefaultWebFilter' had been created. I also noticed that in the co

Hello, After updating firmware 5.0.8 to 5.0.9, unable to retrieve FortiAnalyzer with Fortigate (fortiOS 5.0.9). Please help.

I've setup a new DoS Event handler on my FortiAnalyzer (IPS attack). Rather than change the DoS thresholds on the FortiManager DoS policy to start generating notifications by email and SMS is there anyway you can test directly from the FortiAnalyzer to see if email and SMS work?

hi fellas, im out of direction, how to add custom signatures? im running on fortios 5.2.1 and I want add signature thats block Psiphon3.current version cant block the said application.  Regards,

Hi all,I configured Web filter profile to use FortiGuard category. Everything was fine, but next day Fortigate block all web pages and display this information (in attachement). I hear that if Fortigate lost connection with FortiGuard, by default he is blocking all pages in policy where was this webfilter profile. Do you know is this true? If yes, is there any way to override this? I read about override in Web Filter, but it's not what I am looking for, I mean about some dynamic override which will be apply when the Fortigate lost connection with Forti Guard.

Hello, a short time ago I changed to NAT mode and now I want to connect with SSL VPN from everywhere to my Network.I configured everything and entered the CORRECT username and password in the VPN client on my notebook. I also addet my vpn user to a group which hast full SSL VPN Access. But everytime I connect it says: Can´t login username or password might be wrong (-12)Has anyone a idea why this isn´t working?

Sorry to make my first post a question, I used to be registered on the old forum some time back but haven't used this new one. I've done a little search but can't see anything. We have some old 1000As and they make a good test environment for FortiOS 4, which most of our estate runs. Just yesterday I updated to 4.0MR3 patch 18 on one of these and afterwards lost connectivity to it. It would seem that two of the ports have stopped working. Port 1 as far as the device is concerned now appears on physical port 5, port 2 physical port 6. Ports 7-10 are as per normal and ports 3 & 4 seem to have stopped working completely. Prior to the update this was a 100% functional device. Doing a 'diagnose hardware lspci' shows only eight network devices, not ten like our other 1000A. Completely wiping the system and reinstalling from TFTP was done, mostly as a last guess and it didn't help. This is really weird, any ideas? I'm unconvinced it is a hardware fault as ports 1

I've created config file to automate signatures download. I can't find in documentation which port numer is used to comunicate with FortiManager (bold one below)?  <update>             <use_custom_server>1</use_custom_server>             <server>10.0.10.123</server>             <port>8890</port>             <timeout>60</timeout>             <failoverport>443</failoverport>             <fail_over_to_fdn>0</fail_over_to_fdn>             <update_action>notify_only</update_action>      &nb

Hi, When I need to change the application sensor, IPS sensor or web filter associated with a policy I need to drag the policy line right to the bottom of the ruleset above the implicit deny, change the UTM sensor or policy, then move back to the correct position. If I dont follow this procedure then the policy loses all it's L7 inspection sensors. Is this a bug ? We're running 5.0.7 PJ