Solved

Hi guys, i look for solution to deploy forticlient on 300 Windows Workstations. i' ve tried to deploy it by GPO ( with msi installer) and using fcconfig.exe -m all -f c:\settings.xml -o import -i 1, but the result it was half a success. So, this method don' t work for me when the xml file is crypted by password. However i need and i want absolutly lock configuration of forticlient on target workstation. I' ve heard that it exist a possibility with .conf or .sconf file but i don' t know how to generate or build this kind of file. do any of you have the solution or have you heard of it? Georges Orwell

Anyone know how to find out the Log size in the Log & Report section? I have a 600C and the question that was asked was how much can the Log file hold? To be honest I wasn't sure. Is there an easy way to find that out?

hello fellows, dumb question actually: sometimes I target alertemails of customer firewalls to me. Now, is there an option to filter which events get reported? Like in 'config log <dev> filter'? I'd love to cut out these webfilter messages which occur in hundreds per day. Setting the alert level higher doesn't work for this as 'status=blocked' is at the 'warning' level, as are other more serious events.

Yesterday everything was fine, I was using fortiexplorer to configure a fortigate 60d and after i was done for the day i ran an "exe shut" on the device to shut it down and i unplugged the power from it leaving the USB cable in place. Today when I plugged the power back in windows tells me the device is unknown and fortiexplorer doesn't see the device anymore. Has anyone run into this before?Does anyone know where I can get the USB driver to manually install it on the "unknown device" since windows is convinced it's already updated...I tried searching google for the driver, but was only able to find driver manager/updater programs that want you to buy them to install drivers...

Where does one go to see if a device is end of life or no longer supports firmware updates?

Hi, OK, FG-60C, FOS v5.0,build0292 (GA Patch 9) in transparent mode (at a remote location unfortunately). I asked the tech on site to enable https administrative access on WAN1 so I could access the firewall for maintennace (other security measures in place to keep the bad guys out). Upon trying this, the tech reports that he gets an error about the configuration needing a " DHCP Server IP" address. He sent me a screen shot that not only shows the missing field but an option to enable and set up a DHCP server...??? See embedded image for more info. Default VDOM, no other configuration done and I had him do a factory reset from the CLI to " start over" (device not in use as of yet...fortunately). I have several other FG-60C system operating with the same build and I do not see this on them....any idea what' s up? It won' t let me set https admin access on WAN1 without this address.... Thanks....

Hi, I want to move VLAN subinterfaces from a 1Gbps port to a 10Gbps port. Is there a way of doing this without having to delete the existing subinterfaces and associated policies and recreating them on the new interface? Thanks, Ferdie

Has anyone seen forticlient fail to quarantine before? I attacked a screenshot of the virus alert. I also had forticlient perform an illegal operation on reboot but i unfortunately don't have the screenshot of that. After the reboot it just had a command prompt window open saying that forticlient performed an illegal operation and the reboot window was up again.  

Hi we have 2 branches ie. Ho and remote branch. I installed fortinet60 in HO and netgear router in branch. I can able to ping from ho to branch but unable ping from branch to ho. Please help to fix this problem. Thanking you.

So, I' ve read about the use of " Profile Groups" and I' m seriously considering using them. However for some reason or another, I can' t figure out how to enable " Profile Groups" in the GUI. I initially thought to enable them via the ' config system global set gui-profile-group' command or something to that effect, however it was to no avail. Can anyone help me out with this? I was going to post this under the UTM section, but didn' t find an appropriate topic for it. Thanks in advance.

Hi, haw do I have to uninstall forticlient on a Windows 8.1 computer? I' m unable to shutdown the forticlient (" shutdown forticlient" is inactive) and the software panel shows " repair" only. The FCremove Tool tells me to shutdown the client first which doesn' t work. I' m a bit confused about this situation. Please, can someone give me a hint? Best regards, Sebastian

Hi, I have a specific request from our new customer and it seems that it cannot be done. I need to create a monthly report for WiFi users traffic only where the MAC address is listed in the report, time and the destination address. It is OK but the problem is that it will return a huge ammount of rows and the PDF will be very big. I made a test were I generated a report for past 5 days, it returned 25686 rows whithin 9 minutes and the PDF has 12.8MB. When I set to generate the report for last 6 days the report did not finish. Now, after 39 hours, the report is still generating. I think it will be never finished. Is there any row limitation or PDH file limitation or something else why the report could not be generated? The CPU and memory are still on low values. FAZ-VM64 v5.0.5

i am using fortigate 1000c i am trying to create a custom signature to block web traffic on windows xp computers. i am getting error invalid index code. please do correct the below syntax. F-SBID( --attack_id 8151; --vuln_id 8151; --name " Windows.NT.5.Web.Surfing" ; --default_action drop_session; --service HTTP; --protocol tcp; --app_cat 25; --flow from_client; --pattern " Windows NT 5." ; --no_case; --context header; )

I have a FWF-60D that i have created a software switch to bridge the Internal and WIFI networks into a single network. I also have a DMZ network, but when I do a file transfer to the DMZ network from the internal, I only get about 23MB/s. While transferring I also see the CPU usage @ 100%. Is this a by product of the software switch? my knowledge leads me to believe in this scenario I am CPU limited and not hardware limited (GbE). Am I on the right track? Are there any other ways to achieve this?

Hello, I' m currently testing single sign on using two collector agents in polling mode monitoring my two domain controllers (the domain controllers don' t have a DC agent installed). All the work is in a test network, so the production environment is not affected, eventually I will need to replace my current firewall and SSO solution with Fortigate. Everything works as expected, except that every 5 to 10 minutes I loose all connectivity through the fortigate cluster to all networks and services and I have to log off and log in in order to have access again. I have set the values of Workstation verify interval and Dead entry timeout, on both collector agents, to 0 (zero), still the problem remains. Has anyone experience a similar issue, where can I look in order to find out what is going on and eventually fix it? Thanks in advance.

Hi There, We are trying to develop a custom IPS Signature to assist in protecting brute force login attempts. We would like to match a URL (e.g. a_login_page.php) if it is accessed X number of times within X number of seconds - and then be able to monitor/block/quarantine from there. Currently we have the following: F-SBID( --name " Website.Login.Brute.Force.Custom" ; --protocol TCP; --service HTTP; --flow from_client; --pattern " a_login_page.php" ; --no_case; --context host; --rate 10,60,limit; --track SRC_IP; ) In theory we are counting 10 accesses within 60 seconds and counting those accesses strictly.. but what we have found is that if a client accesses http://www.awebsite.com/a_login_page.php and the login page includes other elements such as images, the count is including the images as they are refered by the page (we think!). In this case, its easy for a real client to trigger the attack as they might have 2 or 3 attempts to access. I have a feel

FortiGate-60D v5.0,build0271,140124 (GA Patch 6) I am probably missing something, but I seem to be unable to create new security profiles using GUI. Antivirus, Web filter, Application Control, IPS profiles page all offer the possibility to edit the shown profile (which I assume is the ‘Default’ profile) but give no option to create a new one or edit another existing profile. Is this normal behavior with this Fortigate model and have to manage Security profiles in CLI only? Thanks, Sherpa

I' m using 5.03 on a 100D. I' ve set up my LDAP server, which test successfully using the test button and I can authenticate the admin user used to create the LDAP login. I then create two AD groups. One for all access to the internet one with filtered access. I create two firewall groups (as directed by support) with the respective groups specified via cn. My AD groups do not show up in the Forti OS anywhere as to just add them as an FSSO group. I am unable to get anything to authenticate via LDAP. When I use the diagnose dbug authd fsso list command, I get the following: ----FSSO logons---- Total number of logons listed; 0, filtered: 0 ----end of FSSO logons----- I am new to this, but I can read. But the documentation seems all over the place and opposite of what support has directed...now I get no response... Can anyone give me any indication of wth I' m doing?

I have a client that is trying to do something that I have never done before, and I cannot seem to come up with a way to make this work. The scenario is this. They have a remote branch that has two Internet connections (only two available). The first (cable) is fast, but unreliable and the second (DSL) is slow but reliable. The main site has one high speed very reliable connection. There are two tunnels, one for each connection at the branch. They would like almost all traffic to use the DSL and fail over to the cable (easy). But, they want some traffic (offsite backups) to use the cable primarily, and the DSL as backup. This is where I am running into a wall. I have a picture attached for reference, hopefully it makes more sense then the post. I have tried using policy routes on the 60D, but either I am not configuring it correctly (most likely) or it won' t work to choose which tunnel to use. Let me know what snippets of config you would like to see and I can p

I have a FAZ100C in my LAB which has run out of service. now i wanted to test the new release 5, but noticed that the hdd probably went dead, as i am spammed with a2.00: exception Emask 0x0 SAct 0x3 SErr 0x0 action 0x0 ata2.00: irq_stat 0x40000008 ata2.00: cmd 60/08:00:b7:05:7d/00:00:06:00:00/40 tag 0 ncq 4096 in res 41/40:00:b7:05:7d/00:00:06:00:00/40 Emask 0x409 (media error) <F> ata2.00: exception Emask 0x0 SAct 0x3 SErr 0x0 action 0x0 ata2.00: irq_stat 0x40000008 ata2.00: cmd 60/08:00:57:c0:f4/00:00:43:00:00/40 tag 0 ncq 4096 in res 41/40:00:57:c0:f4/00:00:43:00:00/40 Emask 0x409 (media error) <F> ata2.00: exception Emask 0x0 SAct 0x3 SErr 0x0 action 0x0 ata2.00: irq_stat 0x40000008 ata2.00: cmd 60/08:08:57:c0:f4/00:00:43:00:00/40 tag 1 ncq 4096 in res 41/40:00:57:c0:f4/00:00:43:00:00/40 Emask 0x409 (media error) <F> ata2.00: exception Emask 0x0 SAct 0x3 SErr 0x0 action 0x0 ata2.00: irq_stat 0x40000008 ata2.00: cmd 60/08

Hi all, I am new with Fortigate, and I have a question: I have a Fortigate 100A unit in office (internet is provided by ADSL line with static IP), and SSL VPN clients that connect to it. Is it possible for clients to use my office’s public IP “to exit on internet”? For example, my office’s IP is 79.124.56.4, and the client' s public IP is 66.54.45.78: when client connect to VPN I would like that public IP becomes 79.124.56.4 Thanks in advance for help :) Regards, Jack

Hi all. I´ve configured a FL100 and I want to repair database. I Follow this steps: 1- Change logs mode from standalone to collector 2- Disable sql database 3- remove database: execute sql-local remove-db All from cli. But i can not enable database again: 1- Change collector mode: config system global set log-mode standalone end say: start sql database failed. Command fail. Return code -39 2- Start local database: config system sql set status local end say: Do not allowed enable SQL in collector mode. object set operator error, -254 discard the setting Command fail. Return code -254 I cannot change to standalone mode without database and cannot enable database in collector mode. What can i do? Thank you in advance.

So we block the web hosting category for our users. I also have the check box for rate url' s by domain and IP address checked. Lately alot of users, when they try to go to some pages (not sure exactly which ones) get blocked from the sites. In the URL, it has the IP address of the site that is blocked, and the category is webhosting. When I do an nslookup of the ip addresses, they are all either akamai.net or akamaitechnologies.com, which I know are backend servers for alot of sites. So what I have been doing is putting in a ratings override for the IP address into a category that is allowed. If I understand correctly, even though I put in the rating override, if the URL is in a category that is allowed, it will then allow the site. However, if it is something that isn' t, like facebook, it will still block it? Correct?

I' m trying to get rid of any any allow rules (yes there are some). So i thought about using the FA for this, but i am missing an option for Top Source destination by service (by Volume or Sessions) But i only find Top Services by Volume Top Source Desination Pairs by volume Top Desination Source Pairs by volume Top Service by Volume for most Common Sources Top Service by Volume for most Common Destinations Ideally i' d like to get the currently most used " conversations" between source&dest and the used protocol to gather whether create a allow or deny policy. Any hints on how to achive that with FAZ? FGT is a HA Cluster of 110C running 4.2.7 FAZ is a 1000C running 4.2.5

Is it possible to exclude an IP address from being scanned by the IPS/IDS?