Solved

I am trying to segment the network into 2 part: 1) 2 ports (ie: Port 1, Port 2) each on a different private LAN    private IP: 192.168.1.0/24, 192.168.2.0/24    wan: 123.123.123.0-123.123.123.1272) 1 port (ie: Port 3) on "transparent mode"    private IP: 123.123.123.128-123.123.123.255    wan: 123.123.123.128-123.123.123.255 I am wondering if it I should (or if possible to) setup my Fortigate as follow:1) Set it up to run in NAT/Routing mode    Setup Virtual IP for Port 1 and Port 2 to take care of the IP translation.    Setup Routing Policy to direct data going to 123.123.123.128-123.123.123.255 to Port 3    (Is this even possible?) OR 2) Setup 3 V-DOM (ie:Root, Private_VDOM, Public_VDOM)    Connect WAN to Root and set it up as NAT/Routing mode    Setup Private_VDOM in transparent mode    Setup Routing Policy to direc

FG 90D, v5.0,build3608 (GA Patch 7) Small branch office.  Internal interface subnet is 10.5.0.1/24.  The FG internal interface address is 10.5.0.1.  All users are on that subnet and I'm using the FG switch ports and PoE for hubs, APs, etc. I noticed from the logs that a lot of traffic from the internal users to 10.5.0.255 is being denied (137-8, udp).  The logs show that the destination interface is "root" and policy 0 is applied.  There is no "root" interface listed, and I have no internal -> internal policies or a policy 0. Any idea why it's doing that and how I stop it? I never defined a static route for 10.5.0.0/24 since the routing monitor showed it as connected already -- I don't know if that's the problem?

FortiOS 5.2.2 on an FWF40 I'm looking for a way to block a fairly large, and dynamic, list of IP addresses, managed from the CLI. There will probably be 1000 or more individual IP addresses, in various places all over the Internet. The use case is that I want to use the denyhosts script on my Linux servers to detect brute-force attempts, and block the IP addresses it collects not just within the server, but at the Fortigate level. With a small and static list of IP addresses, this is of course fairly straightforward:- config firewall address for each of the addresses- config firewall addrgroup and add each of the addresses to the group- config firewall policy to deny all traffic from that group. I don't think this approach scales well to a large list of IP addresses, nor does it lend itself to frequent updates.Is there a better way I could accomplish the same thing? 

Does anyone know what this means arrow in the interface/port 2 (See figure attached)?  

Dear Fortinet Support Team, I would like to aking you about Fortigate devices problem. Please check file attached & note listed below for more information. 1. Error: User cannot connect Internet  2. Troubleshooting# Firstly, I connected directly between modem and personal laptop, Internet working normally. Therefore error not caused by Internet service provide (100% for sure). # Sencondly, I tried to connect my laptop to Fortigate (via LAN port on Fortigae) Details: Internet -- Modem -- Fortigate 80C (LAN port) -- My laptop Result: cannot connect to Internet. (I also tried to reboot Fortigate devices, but nothing get better) # Next step, I tried to check Cisco Switch Layer 3 (reboot, clear and reload configuration), due to 2 optionsOption1 : Internet -- Modem -- Fortigate 80C -- Switch L3 -- My laptop : cannot connect Internet Option2 : Internet -- Modem -- Switch L3 -- My laptop : cannot connect Internet # Finally : when I connect modem dire

I am trialing a FortiMail and am running 5.2.3. I am trying to determine if the FortiMail can verify inbound recipients a la Barracuda's Exchange Accelerator. I have an LDAP connection setup and it is working correctly. My internal users can login as themselves to check quarantines, etc. However, I'm not seeing how to setup a policy to check that an internal recipient exists via this LDAP connection before processing mail. Is this possible? Any other tips or gotchas for first-time installs? Anything is appreciated. For what it is worth, I do have the device up and processing mail in one direction (inbound). Outbound is planned for phase 2 of my trial. So far it is a fair bit better than my DIY (Kaspersky-based) system. I just need to make sure I get the most out of my 60 days. -rick

Dear All, Anyone can clear me about what is reg.expression in fortigate and how's it working exactly. In which situation we can use this config. And how to configure it Thanks

Anyone know this answer off the top of their head? Thanks in advance.

   Hi, here is my policy in a 200B (see attachment)  Feb 18 12:26:40 192.168.x.x date=2015-02-18,time=12:27:55,devname=FG200B3910604xx,device_id=FG200B3912603xx,log_id=00 38000007,type=traffic,subtype=other,pri=warning,vd=root,src=192.168.x.x,src_port=51488,src_int="portX",dst=200.40.28.16 8,dst_port=443,dst_int="portY",SN=57905425,status=deny,policyid=8,dst_country="Uruguay",src_country="Reserved",service=HTTPS,proto=6,duration=18,sent=0,rcvd=0,msg="replay packet(allow_err), drop" i dont understand why drop this packet? Can you tell me about msg="replay packet(allow_err), drop" ? ThanksMartín.  

Hello Referin to this PDF, you can integrate Net Sight and NAC Solution from Extreme Network with Fortigates.anyone has some experience with that? i couldn´t find a guide that explains how to integrate it properly. Can someone help me with that issue? See attached PDF.https://www.dropbox.com/s...g/Fortinet-SB.pdf?dl=0

Hello, the Integrated IPS fortigate detected an attempted attack: browser.spoofing.IDN.attempt according to the attack report, the source of attack is an internal address and the destination is an external address of a Web site.my question is: how could the internal address be the source of attack if the vulnerability affects the browser ??

Dear all, I have problem with user identity policy for remote vpn branch users.At branch Fortigate (30D, version 5.0) I have default route pointing to vpn tunnel.My HQ Fortigate is 80C v5.0,build0292 (GA Patch 9). All important policies are implemented on HQ firewall.After HQ firewall upgrade to 5.0 identity policy for VPN subnet started to submit url containing public (WAN) IP address of HQ fortigate - something like http://<public IP>:1000/fgtauth?cgiI think that this is because routing to branch subnet is going by WAN interface, and HQ fortigate considers WAN address as closest to the user.Can You help me? Best regards, Piotr M. 

We use VIPs to port forward traffic to our web servers. When we enable NAT on the policy, it uses the internal network interface IP address as the source IP. Is it possible to specify a secondary IP address as the NAT source rather than the interface default?  

BACKGROUND:Our goal is to use (external) BGP on our FGT 1000D (nat'd) using two existing ISPs.  BGP is functioning now via our customer side BGP router which we wish to eliminate as a point of failure. Because RPF is a problem when we add two ISP connections to our FGT, fortinet techs advised us to enable VDOM and enable asymmetric routing in the VDOM that faces the ISPs. QUESTION:We do not have a fortimanager, how can I copy (or move) all the "as-is" policies and interfaces from the root-VDOM to a new sub-VDOM? Thank you in advance.

Hi,May I know if FG-60D can serve as server load balancer? Our client plan to purchase FG-60D firewall, then they're asking if its possible. Anyway, they do not answering our questions regarding on what particular medium they want to balance (is it isp, workloads, etc) for us to scope it well. Otherwise, they need a dedicated load balancer box to satisfy their network requirements. Note: They're the one who give the model of firewall (which is 60D) that they need. Regards,Jam 

Does anyone know if the FAZ can report on the number of registered/allowed Forticlients on a Fortigate?  I am looking to build a report for management to profile Forticlient registration distribution.  Thanks in advance!

is it possible to use a verisign (or any other CA) for SSL inspection(web filtering, appcontrol) , in order to get rid of annoying certificate warning on https sites when using the inbuilt fortigate CA ssl proxy certificate.If yes what type of certificate needs to be bought , a single ssl certificate etc....from this discussion ,  i am doubtful about the possibility.  Apart from this i see no other way , by which the https certificate warning can be avoided completely. as smartphone, tabs , ipads are never part of domain so its not possible to use active directory infra to push local certificate and its a tedious task to install fortigate ssl proxy cert manually on every single device. 

Hi to all, Can someone post a link where I can find a free trial of Fortigate_VM that I can use for practicing/studying fortinet firewall. As much as possible more on technical side, configurations and its features etc. I want to setup a testing network for fortigate setup/configuration. 'Coz, what I usually do is to read pdf documentations or do watch videos in knowledge base of fortinet but I want to test it actual.Any feedback, comments, suggestions will be much appreciated. Thank you. Regards,Jam

Hi, I use FGT to filter web utilization by users/groups, and in order to optimize bandwidth use i want to block downloading files from internet for some groups. How can i do and manage this by fortigate? Regards,

Hello All, I'm currently testing out FAZ 5.0.10, and I have a couple of HA pairs in my network. Previously, I just used log arrays for these pairs. But now I see the option for HA Clusters. I put the devices in a cluster, and it seems like they are linking their data now. Now for these sets, I only have 1 entry in the Device Manager page. This entry has 2 serial numbers in them, representing both devices in the HA pair.  Is this all I need to do? Will reports pull data against both of these serial numbers? Do I no longer need to do log arrays? Thanks!

Hi guys,I would like to ask if someone can guide me to configure a public ip on a server behind fortinet and it can communicate to & from the internet.Is it possible?Our company subscribe an internet with PPPOE authentication and get 5 public IP. Virtual IP can help mapping the public ip to the private ip but we are looking for a solution that make the server directly expose to the internet.Much appreciated for your help Thanks.

Fortigate 100D running v5.0,build0292 (GA Patch 9) I have created two custom services TCP 9100 and UDP 47808. I created two different policies one policy using each of the custom services. The firewall is blocking both of the services. The only way I can get the traffic through is to change the policy to allow all services. I even tried all allow ALL_UDP but upd/47808 was still being blocked. Currently I do have AV and IPS security profiles assigned to the policies, but I did try disabling all security services and the traffic was still being blocked. I have several other policies that are using custom services. The firmware was upgraded prior to any policies or services being created on this firewall. In other words, a firmware upgrade has not been done between the creation of the policies using custom services that are working and the creation of the policies using custom service that are not working. Any help would be greatly appreciated. Below is a copy of the polici

We have a Fortianalyzer FAZ-100C that has had it's default firmware corrupted.  I booted it up from the backup firmware and it goes into system testing (burn in ) mode.  Everything passes so I know my hardware is all good. I need to know how to restore my firmware so I can get this unit back into action. We were using fw 5.0 and would also like to go to 5.2 (which I believe is the latest) if possible. I am new here so any help would be greatly appreciated. Thanks in advance. Mike.

Hi  i want to add user column on High Risk Application report. I tried to change related dataset but i get an error. Can you help me for this dataset? You can see the error in the appendix. Orginal dataset   My dataset and error select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, appcat, count(distinct app) as total_num from ###(select appcat, app from $log where $filter and app is not null and appcat is not null and logid_to_int(logid) not in (4, 7, 14) and apprisk in ('critical', 'high') group by appcat, app)### t group by user_src, appcat order by total_num desc Error ERROR: column "user" does not existLINE 1: select * from (select coalesce(nullifna("user"), nullifna("u...     

Just purchased a new 100D (build date of Nov 2014) and it came with FW V5.0 Build 0292, 140731 (GA Patch 9) so upgraded it to the latest V5 Build 5.0.11 00310 - so my question is, do I move up to 5.2.2 00642 or leave it at 5.0.11? The unit is about to go into a production environment so would welcome any tips :)