Solved

Dear all, I have problem with user identity policy for remote vpn branch users.At branch Fortigate (30D, version 5.0) I have default route pointing to vpn tunnel.My HQ Fortigate is 80C v5.0,build0292 (GA Patch 9). All important policies are implemented on HQ firewall.After HQ firewall upgrade to 5.0 identity policy for VPN subnet started to submit url containing public (WAN) IP address of HQ fortigate - something like http://<public IP>:1000/fgtauth?cgiI think that this is because routing to branch subnet is going by WAN interface, and HQ fortigate considers WAN address as closest to the user.Can You help me? Best regards, Piotr M. 

We use VIPs to port forward traffic to our web servers. When we enable NAT on the policy, it uses the internal network interface IP address as the source IP. Is it possible to specify a secondary IP address as the NAT source rather than the interface default?  

BACKGROUND:Our goal is to use (external) BGP on our FGT 1000D (nat'd) using two existing ISPs.  BGP is functioning now via our customer side BGP router which we wish to eliminate as a point of failure. Because RPF is a problem when we add two ISP connections to our FGT, fortinet techs advised us to enable VDOM and enable asymmetric routing in the VDOM that faces the ISPs. QUESTION:We do not have a fortimanager, how can I copy (or move) all the "as-is" policies and interfaces from the root-VDOM to a new sub-VDOM? Thank you in advance.

Hi,May I know if FG-60D can serve as server load balancer? Our client plan to purchase FG-60D firewall, then they're asking if its possible. Anyway, they do not answering our questions regarding on what particular medium they want to balance (is it isp, workloads, etc) for us to scope it well. Otherwise, they need a dedicated load balancer box to satisfy their network requirements. Note: They're the one who give the model of firewall (which is 60D) that they need. Regards,Jam 

Does anyone know if the FAZ can report on the number of registered/allowed Forticlients on a Fortigate?  I am looking to build a report for management to profile Forticlient registration distribution.  Thanks in advance!

is it possible to use a verisign (or any other CA) for SSL inspection(web filtering, appcontrol) , in order to get rid of annoying certificate warning on https sites when using the inbuilt fortigate CA ssl proxy certificate.If yes what type of certificate needs to be bought , a single ssl certificate etc....from this discussion ,  i am doubtful about the possibility.  Apart from this i see no other way , by which the https certificate warning can be avoided completely. as smartphone, tabs , ipads are never part of domain so its not possible to use active directory infra to push local certificate and its a tedious task to install fortigate ssl proxy cert manually on every single device. 

Hi to all, Can someone post a link where I can find a free trial of Fortigate_VM that I can use for practicing/studying fortinet firewall. As much as possible more on technical side, configurations and its features etc. I want to setup a testing network for fortigate setup/configuration. 'Coz, what I usually do is to read pdf documentations or do watch videos in knowledge base of fortinet but I want to test it actual.Any feedback, comments, suggestions will be much appreciated. Thank you. Regards,Jam

Hi, I use FGT to filter web utilization by users/groups, and in order to optimize bandwidth use i want to block downloading files from internet for some groups. How can i do and manage this by fortigate? Regards,

Hello All, I'm currently testing out FAZ 5.0.10, and I have a couple of HA pairs in my network. Previously, I just used log arrays for these pairs. But now I see the option for HA Clusters. I put the devices in a cluster, and it seems like they are linking their data now. Now for these sets, I only have 1 entry in the Device Manager page. This entry has 2 serial numbers in them, representing both devices in the HA pair.  Is this all I need to do? Will reports pull data against both of these serial numbers? Do I no longer need to do log arrays? Thanks!

Hi guys,I would like to ask if someone can guide me to configure a public ip on a server behind fortinet and it can communicate to & from the internet.Is it possible?Our company subscribe an internet with PPPOE authentication and get 5 public IP. Virtual IP can help mapping the public ip to the private ip but we are looking for a solution that make the server directly expose to the internet.Much appreciated for your help Thanks.

Fortigate 100D running v5.0,build0292 (GA Patch 9) I have created two custom services TCP 9100 and UDP 47808. I created two different policies one policy using each of the custom services. The firewall is blocking both of the services. The only way I can get the traffic through is to change the policy to allow all services. I even tried all allow ALL_UDP but upd/47808 was still being blocked. Currently I do have AV and IPS security profiles assigned to the policies, but I did try disabling all security services and the traffic was still being blocked. I have several other policies that are using custom services. The firmware was upgraded prior to any policies or services being created on this firewall. In other words, a firmware upgrade has not been done between the creation of the policies using custom services that are working and the creation of the policies using custom service that are not working. Any help would be greatly appreciated. Below is a copy of the polici

We have a Fortianalyzer FAZ-100C that has had it's default firmware corrupted.  I booted it up from the backup firmware and it goes into system testing (burn in ) mode.  Everything passes so I know my hardware is all good. I need to know how to restore my firmware so I can get this unit back into action. We were using fw 5.0 and would also like to go to 5.2 (which I believe is the latest) if possible. I am new here so any help would be greatly appreciated. Thanks in advance. Mike.

Hi  i want to add user column on High Risk Application report. I tried to change related dataset but i get an error. Can you help me for this dataset? You can see the error in the appendix. Orginal dataset   My dataset and error select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, appcat, count(distinct app) as total_num from ###(select appcat, app from $log where $filter and app is not null and appcat is not null and logid_to_int(logid) not in (4, 7, 14) and apprisk in ('critical', 'high') group by appcat, app)### t group by user_src, appcat order by total_num desc Error ERROR: column "user" does not existLINE 1: select * from (select coalesce(nullifna("user"), nullifna("u...     

Just purchased a new 100D (build date of Nov 2014) and it came with FW V5.0 Build 0292, 140731 (GA Patch 9) so upgraded it to the latest V5 Build 5.0.11 00310 - so my question is, do I move up to 5.2.2 00642 or leave it at 5.0.11? The unit is about to go into a production environment so would welcome any tips :)  

Hello guys. One client came with this question, if it's possible to do a site-to-site vpn connection between Fortigate and OpenVPN. Since openVPN works only with SSL vpn I think it's not possible, but I can be wrong. Thank you.

Hello, I have a problem using Central VPN console and the global policy: I create a Star VPN with the central VPN console and i want to assign Global policy to this VPN but in global policy I don't have the interface "vpnmgr_Hub_XXi_spoke2hub" which was created by the VPN Console. And I can't create and interface object with the same name , i put me an error that I can't use the prefix "vpnmgr_". So I wanted to know if it's possible to create global policy with the interface created by the VPN console?? thanks, JF

Can 3rd Party tokens be used with the FortiAuthenticator? Thanks, Chris

Hello Fortigurus, Last week we upgraded our FAZ 4000B to 5.2.1 and after the database got done rebuilding a few days later we don't see any UTM logs on the FAZ. The Fortigate is a 3600C and is running 5.0.9 at the moment. The UTM logs are necessary for troubleshooting and reporting. Have any of you experienced this problem or know what can be done to resolve it? Please advise. Thank you, JB.KALM

Hi all,I want to download FSSO Collector Agent.I read that I can do this by an account on support.fortinet but I can't find whre.Do you know where I can download it?  

Hi All, I hava a FGT 100D with the last version 5.2.2, and trying to implement Web filter profiles using Proxy Mode. Could you tell me if i can apply two or more Web filter profiles to a given Group (FSSO groups on my case).My issue is that when i use Policies to do this, only the rule on the top will be applied and the seconde one will be ignored (example in attachment) - this is just an example to illustrate the issue. The ideal would be to combine FSSO groups with Web Filtring Profiles without passing by Firewall rules/policies, is this possible? Many Thanks for your help.   

Hello, short Question. We have to do a VPN in 3 days to a Cisco Gateway. we have exchanged our Setting. and they sai for Phase 2 Key Lifetime 4608000 kilobytes / 3600 seconds. Does it mean that i have to choose in my fortigate Phase 2 Propasals for Lifetime "Both" and wrtite the kilobytes values and second or it will be ok if i only put the 3600 for Lifetime? Thank you

Hello, What I'm trying to achieve is, in each policy, to have different web filter profile. (For example: Sales Dept has sales profile, HR Dept has HR profile)What I have in Fortigate 60D (5.2.2) is, there is no profile (in the old version, I can see the drop down box at the corner). So I'm currently stuck with all user using same Web Filter Profile.Is there anyway to enable the profile feature? So I can use different Web Filter Profile on different policy? 

Hi all, from our account the FTP Download of Fortinet Firmware Images is not available for the moment. 530 Login incorrect HTTPS Download is ok Does anybody know about this? When it will come back?

Hello, soon i have to upgrade an 200D 5.0.9 Active-Passive Cluster to 5.2.2 . Should i realy follow the steps described in the HA Doc? like just push the upgrade on the Master unit and he will do all the job by himself?  what are your experience upgrading a cluster? should i better first upgrade Slave per FortiExplorer and after that upgrade the master ? Thanks

Hello everyone, I'm trying to set up server load balancing on my FGT-60D, with SSL offloading. But, when I try to configure a new virtual server, I don't have an option to select HTTPS type. Here's CLI configuration process:  Is it possible that 60D does not support HTTPS load balancing? Thanks!Slavko