Solved

Hello guys. One client came with this question, if it's possible to do a site-to-site vpn connection between Fortigate and OpenVPN. Since openVPN works only with SSL vpn I think it's not possible, but I can be wrong. Thank you.

Hello, I have a problem using Central VPN console and the global policy: I create a Star VPN with the central VPN console and i want to assign Global policy to this VPN but in global policy I don't have the interface "vpnmgr_Hub_XXi_spoke2hub" which was created by the VPN Console. And I can't create and interface object with the same name , i put me an error that I can't use the prefix "vpnmgr_". So I wanted to know if it's possible to create global policy with the interface created by the VPN console?? thanks, JF

Can 3rd Party tokens be used with the FortiAuthenticator? Thanks, Chris

Hello Fortigurus, Last week we upgraded our FAZ 4000B to 5.2.1 and after the database got done rebuilding a few days later we don't see any UTM logs on the FAZ. The Fortigate is a 3600C and is running 5.0.9 at the moment. The UTM logs are necessary for troubleshooting and reporting. Have any of you experienced this problem or know what can be done to resolve it? Please advise. Thank you, JB.KALM

Hi all,I want to download FSSO Collector Agent.I read that I can do this by an account on support.fortinet but I can't find whre.Do you know where I can download it?  

Hi All, I hava a FGT 100D with the last version 5.2.2, and trying to implement Web filter profiles using Proxy Mode. Could you tell me if i can apply two or more Web filter profiles to a given Group (FSSO groups on my case).My issue is that when i use Policies to do this, only the rule on the top will be applied and the seconde one will be ignored (example in attachment) - this is just an example to illustrate the issue. The ideal would be to combine FSSO groups with Web Filtring Profiles without passing by Firewall rules/policies, is this possible? Many Thanks for your help.   

Hello, short Question. We have to do a VPN in 3 days to a Cisco Gateway. we have exchanged our Setting. and they sai for Phase 2 Key Lifetime 4608000 kilobytes / 3600 seconds. Does it mean that i have to choose in my fortigate Phase 2 Propasals for Lifetime "Both" and wrtite the kilobytes values and second or it will be ok if i only put the 3600 for Lifetime? Thank you

Hello, What I'm trying to achieve is, in each policy, to have different web filter profile. (For example: Sales Dept has sales profile, HR Dept has HR profile)What I have in Fortigate 60D (5.2.2) is, there is no profile (in the old version, I can see the drop down box at the corner). So I'm currently stuck with all user using same Web Filter Profile.Is there anyway to enable the profile feature? So I can use different Web Filter Profile on different policy? 

Hi all, from our account the FTP Download of Fortinet Firmware Images is not available for the moment. 530 Login incorrect HTTPS Download is ok Does anybody know about this? When it will come back?

Hello, soon i have to upgrade an 200D 5.0.9 Active-Passive Cluster to 5.2.2 . Should i realy follow the steps described in the HA Doc? like just push the upgrade on the Master unit and he will do all the job by himself?  what are your experience upgrading a cluster? should i better first upgrade Slave per FortiExplorer and after that upgrade the master ? Thanks

Hello everyone, I'm trying to set up server load balancing on my FGT-60D, with SSL offloading. But, when I try to configure a new virtual server, I don't have an option to select HTTPS type. Here's CLI configuration process:  Is it possible that 60D does not support HTTPS load balancing? Thanks!Slavko

Hello, I try in every mode to come up vpn tunnel between Fortigate with 5.2.2 and pfSense, I receive error before phase 1, with message "ignoring ike request, no policy configured" but I check 100 times... every is correct on both side. This is first time I do vpn to pfSense, I have other vpn with Cisco and Watchguard without problem, then I try change pfSense with Sophos but same result, I know that both use vpn based on openswan. Thanks M.

I need to remotely connect to D-LINK switch currently working on default 10.90.90.90 address (service guys have replaced broken one, but they have forgotten to do initial config). The problem is it's connected directly to one of the internal interface port on my FortiGate 60D where I'm running 10.0.0.0/24 subnet. By using second address of the internal interface and FortiOS CLI on SSH session I was able to initiate telnet connection to the switch but unfortunately D-LINK refuses connection (no account on switch on defaults). The only option right now is to use web GUI of that switch which is available on 80 or 443 port. I've tried to do port forwarding but trafic flowed only to the switch but didn't in the opposite direction. What are your thoughts to accomplish this setup?

Hello, I have a issue with one of our companies people, which has to work from China. We have a FG200D and it's running a ssl-vpn. All our employees are able to connect to the office network through the SSL-VPN but this one fella which works from China isn't able to connect. I'm very much aware that in China they have lots of restrictions but I was just looking for a way to work this out somehow. Any ideas? Thanks.

hi there, need help,can interface on FG-60D change into individual interface, not act as switch?I've 100D, and the interface can be changed to individual port or act as a switch, or both.if can, how to do that? thank you

Hi all,i need to limit the physical interface total bandwidth (1Gb for instance).I have a firewall with 4 VDOMS, 1 root with the WAN interface and 3 VDOMS with the LAN interface. Of course the 3 VDOMS are sharing the same physical interface with 3 different VLANS.I would like to limit the VDOMS access bandwidth, for exaple: VDOM A ---- VLAN 10 ---- INT G1 --------- 100MbVDOM B ---- VLAN 11 ---- INT G1 --------- 10MbVDOM C ---- VLAN 12 ---- INT G1 --------- 50Mb Does anyone did something similar? Bye D.

I've got a problem registering a FortiToken on my iPhone 6 Plus. When I try to manually enter the code, or scan the QRCode, it fails with a "runtime error". However, my iPhone 5S will register the token without complaint. Both iPhones are using iOS 8.1.2 and the most recent FortiToken Mobile client.

Hi, I am not able to add IPSec Tunnel interface to any Zones. Its giving "Entry not Found Error". Please suggest.  

Hello, I recently upgraded a Fortigate 40C from FortiOS 4 (the latest release, build 665) to FortiOS 5 build 208. There was an existing configuration with very simple policies (any internal to any over WAN1 using any service with destination interface NAT). Before the upgrade everything worked just fine, however after the upgrade, no communication to the internet was possible because the Fortigate was blocking all traffic. I found the problem: Fortinet decided to rename the service " ANY" to " All" (which makes sense IMHO), but didn' t bother to upgrade my configuration to reflect this change, thereby essentially breaking my Firewall. My question is: Has anyone else noticed this behavior? Is there an official word on this from Fortinet? At work, my team and I manage a larger 3950B Firewall with over 130 Virtual Domains. If this is the normal behavior, upgrading our machine to FortiOS 5 would be a catastrophe, as we would have to go through every single VDOM manually an

Hello, i have a FortiMail VM behind a FortiGateVM in a lab environment. all the DNS Request that goes through the Fortigate generates always the Same IPS Alert "DNS.Invalid.OPcode"  its UDP: 53 it´s realy annoying cause i get all my logs full of this IPS Alerts.  Do you have any idea why that happens and hove to avoid that? Thank you.

Hi All, I am getting all the time intrusion attack alert - Bash.Function.Definitions.Remote.Code.ExecutionWhen I open the alert I am getting to this page:http://www.fortiguard.com/encyclopedia/vulnerability/#id=39294 And I understand that I should do:Upgrade to the latest version available from the website.http://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-025 The problem is how to do this upgrade on my FortinetWifi 90D machine?I looked every where and try to put the file but it say that this is the wrong file. I tried both bash43-001.sig and  bash43-001.txt in the system-Advanced page in the CLI file update. Please advise how to commit this update to the machine?   Thank you, Eitay Cohen  

Hi All,i cannot find a way to customize my reports....i need to set up a customized report,  where i woul like to see the traffic per network, Like for example: the network A during one month made 1Gb traffic in input and 5Gb output the network B during one month made 6Gb traffic in input and 2Gb output Does anyone have already customized the report to something similar or any available to help me??Thanks

Have a fortigate 60D which pushes only smtp /https traffic to our email gateway. However seeing quite a lot of authentication failures on our barracuda the email firewall. IPS and AV is enabled for the UTM . Any way to check this out. Cant do block by ip isnce it is random ip on a daily basis. Running firmware 5.0.10

Hi,First, I am new with fortinet products and I'm beginning the training with this products. Sorry for my english, it's my second language. I have a problem with vpn connection from a customer. After a moment, it disconnect.We use forticlient.But I can access directly to the installation.  I checked the parameters : In phase 1 keylife : 84600 the checked box : dead peer detections and not traversal Phase 2 : keylife : 84600 checked box : enable replay detection and enable PFS   Thank you If you have other solutions or more informations. Regards, Pierre

hello everybody.. today i have upgraded 80C unit to 5.2.2 and i was wonder how to enable disk log as it is logs are being stored at memory. appreciate your cooperate in regards to this mater.