Solved

Hi, I am trying to get 2 FortiVM appliances (latest version) running as HA Active-Active as lab on top of vmware esxi 5.5. However doesnot seem like it is working. I followed handbook with just basic configuration on the virtual appliances but after two vm rebooted, both VM are claiming to be the master (from get system status output)...I login to the cluster but it seems like it is VM1 first time and then later refresh as VM2. It seems like VM2 overtakes VM1 as master while VM1 doesnot want to give up but keep sending G-ARP...Plus under the HA page on Web UI, I only see one unit. Another thing I notices during troubleshooting, both VM have serial number FGVMEV0000000000. Will that cause issue? HA is supported on FortiVM, right? Here attached are the HA configuration and running status of two VMs (rest of the config are Factory default+basic VDOM). Please let me know where I configured wrong...On VM1:FortiGate-VM1 (global) # show system ha config system ha     se

I have a FTG80C in working environment, And I will enter an additional FTG80C. I wonder if someone already set an active-active HA (High Availability) cluster with firmware 5.2.2 over fortigate´s 80C and are an stable solution, or what kind of bugs are find out additional to FTG80C documented on fortinet knowledge base; Does firmware 5.2.2 overwhelm hardware limits of ftg80´s in HA ?, and which one more stable firmware do you recommend to my HA cluster of FTG80C: 5.09, 5.0.11 or 5.2.2 Note: UTM configuration an VPN´s are already using half or my hardware resources on my stand alone FTG80C configuration over a fortios 4.0 MR3 patch 10, I am supporting around 60 LAN user´s 5 VPN IP-sec connections, with medium traffic.

In FortiView the "Top Destinations" report lists "Destination - Application - Sessions - Bandwidth".I'm trying to recreate that same view in a report. Does anyone have this already?

Hi, i'm using a FA VM64 in evaluation modeFortiOS version: 5.2.1I need set up my custom views, but none option is available; so i can't add, delete or do anything thereAll other funcionalities are working good. Thanks for the help. 

A customer of mine has got two seperate internet connections for redundancy, both fiber (one 50mbit, one 10mbit). We've placed two 100D's for routing and they now want redundancy on the IPSec VPN tunnel that goes to our datacenter (which also has two 100D's.The internet redundancy itself is configured with two static routes for 0.0.0.0/0 to the gateway of the provider with a lower priority for the 50mbit line, this works as is.I thought to do the same with the IPSec tunnels, so I created two tunnels, one for each provider. Below are the details:Tunnel 1:Name: CBB-Tele2 Local IP: 87.213.15.74 Remote GW: 212.114.98.85 Outgoing Interface: WAN_Tele2Tunnel 2: Name: CBB-KPN Local IP: 89.255.49.166 Remote GW: 212.114.98.66 Outgoing interface: WAN_KPNI’ve created two routes for the remote subnet and given them the correct priorities so that the Tele2 line is used as a primary interface.I’ve triple checked the Phase 1 and 2 settings on both ends, there are correct.Now for the strange par

Deleted 

Hello, I will install a HA of 1500D for a customer. I have two question about that : - Which bandwith will be used for session synchronization (There is approximately 400 new session per second and 10'000 sessions established) ? Is there a way to know the amount of traffic will be used ? - Is a good choice to use the MGMT1 and MGMT2 interface to HA heartbeat/sync session ? Or there is a hardware/software limitation ? Thanks in advance Lucas

Hi,I've to connect two FortiAP-221B in my wireless networks where there are several Cisco AP managed by Cisco WLAN Controller in bridged configuration with 3 different SSIDs. Now, I'd like configure my FortiAP without change the actual network configuration: now FG is def gw of wireless networks that use different subnets (and VLANs) corresponding to different wireless users. Users obtain IP address from external DHCP server. My problems when I try to configure FG-600C as wlan controller are following:- In my case, I have to configure FG wlan controller in tunnel mode or bridged? - IP address of Wifi SSID (def gw of FortiAP) cannot be the same of Cisco wireless network? FG gives error when I configure the same IP of other intrface as Wifi SSID- Can FortiAP have IP addresses of other subnets than wireless networks (for example IP of wired networks?) thanks!!  

I have a client with about 30-40 users. They dont want any UTM, so just plain firewall. They do have IPsec for both client connections (since they had a 60C and SSL was terribly slow) and a IPsec tunnel to a smaller office. 4 pcs of FortiAPs 221C. I think I will run them bridged, if 90D is chosen, so that the tunnel will not become a bottle neck (since as far as my testing goes the CAPWAP specs in the 90D datasheet only refers to tunneling mode). Money is not as important as speed, so I just want to make the best choice here. I want this unit to be ok for a couple of years. I know they might expand the other office, so there will be more IPsec office to office load, so that needs to be fast. Other than that its just plain internet/surf/download stuff that is important both over cable and wifi in the LAN. So basically, how would you think in this situation?  PS. By looking at the specs... if you say go with the 90D, is it even worth going with that, or would the

Hi, folks, Is there a built-in way of monitoring which version of FortiClient my users are running? We had an issue the other week that was limited to users who were on old versions of FortiClient (5.0.x, vs. 5.3.x).  I'm wondering if there's a systematic way to watch for users lagging behind before they become an issue. (I know there are third-party solutions for monitoring software versions in general, but I'm wondering if there's something specific to Fortinet for FortiClient.) Thanks.

I guess I have a few questions-- How can we check what our 'official' NSE certification level is?  For those of us that hold FNCSPv5, is this converted to NSE 4 already? Will NSE 4s receive express routing codes if partner certification levels are met? How long do partners have to meet the certification requirements laid out at the global conference? The FAQ stated that in addition to FAZ and FAM courses NSE 5 required online tests in the learning center?  Same question for NSE 6. Thanks,Gary

I am wondering how Event Management section set up.  Currently, I only see less than 400 events in the Event Management section and that is like 5 day span. I want to be able to go back in the history of far beyond 5 day span, lets say a month worth of events, including acknowledged ones. What type of issue is this and how can I fix it? 

Hi all, I'm having a weird issue and hopefully someone can help out. Here is my DHCP Server set lease-time 14400 set default-gateway 2.3.4.1 set netmask 255.255.255.0 set interface "DHCP-LINK0" config ip-range edit 1 set start-ip 2.3.4.6 set end-ip 2.3.4.10 next end set option1 224 '6638393565383261616333613637343334336265393336623133666631363436' set dns-server1 8.8.8.8 The "set option1 224" value is f895e82aac3a674343be936b13ff1646 converted to 6638393565383261616333613637343334336265393336623133666631363436 But for some reason, I'm seeing the FortiWifi serial # being handed out instead. I've deleted the option and the dhcp server and recreated. I've tried 3 completely different FortiWifis with the same "base" config and they hand out their own serial instead of the actual value for option1 224. Any ideas?

Hi, What command in gui or cli should I follow in order to see the mac-address of each interface of the fortigate firewall 100D? Like show arp, then show mac-address in a cisco switch.  Thanks,

Hi,This drives me crazy and I didn't find any solution that is working as expected.Our Setup2 FGT 1000C Active-Active Cluster (Firmware v5.2.3,build670)12 Forti Access Points 221B (Firmware: v5.2-build0225)Forticlient 5.2.3.0663Port 12 dedicatet for Forti APsPort 3 Internal LANSSID s24.ito (Enterprise Authenticated)We want to achive that Mobile Devices can connect to several Services (like Fileshare) in the Inside LAN. For security reasons this only would be allowed, if the Forticlient is compliant with the designated profile.What happens...- If I connect my Notebook to the Internal LAN (wired) the Forticlient registers silently to the Fortigate and Status stay On-Net- If I connect to the Wireless Network (s24.ito), the Forticlient doesn't register silent and after a while (about 2mins) the On-Net Status shows offline, thus doesn't allow me to connect to Internal Services- If I register manual (I can see the Fortiagte with IP of the s24.ito Network), it registers successfully, but afte

Hello, I want to configure SSL VPN authentication using FreeRADIUS, but I want only users belonging to specific group to have access to the network. Users and groups are stored on FreeRADIUS host as a local linux users and groups. How FreeRADIUS user config file should look like to achieve this?

Re: Webfilter (licensed) vs Application Control Which process looks at the packet first, app control or webfilter.If webfilter, and webfilter exempts a url, will the packet bypass the app control process? Is there any known specific doc on this topic? Thanks.

I have successfully setup our FortiGate with RSA SecureID for SSL VPN however I cannot have more then one type of SSL VPN portal (full access, web access etc). Fortinet explains that in order to have fortigate to communicate with the RSA SecurID server you must create a RADIUS connection (client) to your RSA Server. Then create a Local Group that uses RADIUS as a Remote Server. Under Remote Servers there is the ability to specify the Group in the RADIUS server but I cannot get this function to work. If I change the current value from " Any" to a specified DN all SSL authentication fails. Is there an attribute that my RSA server needs to send back to my fortigate? I know that some vendors have values that they are expecting back to perform validation. My use case is the following: If user A belongs in Group A they get the full access SSL page If user B belongs in Group B they get the web access SSL page Both users require 2 factor authentication with RSA SecurID.

I saw this documentation describing how fortigate IPS can handle SSL traffic for deep content inspection: "......In this schema, is clear that the SSL/TLS handshake is interrupted, and the FortiGate is required to present a certificate for the URL requested by the real client. This certificate is signed by the FortiGate itself. ............. But is needed to be clear that the Full SSL Inspection the certificate used to sign those sites (by default SSL_Proxy_Inspection into the FortiGate) is needed to be recognized as a valid CA. Otherwise, the warning message will be shown everytime an SSL/TLS connection is made. This certificate (SSL_Proxy_Inspection) must be installed in each PC to be used by their Operating System and/or for browsers/applications (Mozilla Firefox or Java JRE) which has its own Certificate repository." I am surprised that the fortigate can't load the cert and private key for our domain and make this appear as if the ssl connection from the client is to our&nbsp

Hello,we done Windows Updates with WSUS, but WSUS is fully terrible. So the plan was to setup fortigate like a proxy that only cache all windowsupdates. That is an easiest way to cache Updates. But i cant find this feature. So is this possible? http://wiki.ipfire.org/de/configuration/network/update-booster Sorry the side is only in german. Thanks and best regards

I'm working on a new deployment of a 30D (running 5.0.2) that will be a spoke and needs to connect to a Cisco ASA as the hub.  I'm was able to configure the tunnel via the cli and confirm I am able to pass traffic between the locations, but I also need the 30D to send all of it's traffic through the tunnel as the goal is to have all the internet traffic go out through the hub.  In an attempt to get this working I created the tunnel, then modified the destination to be 0.0.0.0/0 and updated the policies I had w/ the same.  But when I do a traceroute it is still going out locally.  The WAN interface is getting it's address via DHCP so it's default route is in the routing table and I didn't see a way to modify it.   Also, on a side note, is there a way to do any kind of port-security or MAC filtering on the LAN ports on that device?  I see how to do it for the wireless side, but didn't see how it would be done on the wired ports.

 Hello Forum, just a little hint on naming Dialup-VPN Tunnels regarding the maximun concurrent Users.Since established IPSec Dialup Tunnel Interfaces will be distinguished by adding a Sequence Number (eg. tunnel_0 , tunnel_1)and a VPN Interface Name is limited to 15 characters, the maximum concurrent Users will be limited accordingly. Just take look at the attached screenshots (max. Concurrent Users) and you may get the clue!  Regards,Jan       

Hey guys, how u doing? I got an issue here. Just deplyoed a FortiGate 40C and I need to see the username in the logs from Log & Report (web filter and so on), but I can't find a way do configure the Active Directory server and SSO in the GUI.I got in another client with one FortiGate 60D, and under User & Device menu I can configure this feature. Is there something I can activate to use the GUI for this? Is possible with the CLI?And, is there some matrix that lists the FortiGate model x features available in the GUI/CLI? Thx in advance!

Dear All, Please assist on how to limit access to the Apple AppStore on Fortigate 60D. I would like to allow staff to access the AppStore only after 1300hrs till 0600hrs then block access from 0700hrs till 1300hrs.  Any help is greatly appreciated.

Hi all!Today I discovered that my FortiGate 60C support DES encryption only for IPSec connection. Is it unsupported by firmware of hardware? Firmware version is 5.0 build 3608 (GA Patch 7). Thank you.