Solved

Hello everyone, I'm trying to set up server load balancing on my FGT-60D, with SSL offloading. But, when I try to configure a new virtual server, I don't have an option to select HTTPS type. Here's CLI configuration process:  Is it possible that 60D does not support HTTPS load balancing? Thanks!Slavko

Hello, I try in every mode to come up vpn tunnel between Fortigate with 5.2.2 and pfSense, I receive error before phase 1, with message "ignoring ike request, no policy configured" but I check 100 times... every is correct on both side. This is first time I do vpn to pfSense, I have other vpn with Cisco and Watchguard without problem, then I try change pfSense with Sophos but same result, I know that both use vpn based on openswan. Thanks M.

I need to remotely connect to D-LINK switch currently working on default 10.90.90.90 address (service guys have replaced broken one, but they have forgotten to do initial config). The problem is it's connected directly to one of the internal interface port on my FortiGate 60D where I'm running 10.0.0.0/24 subnet. By using second address of the internal interface and FortiOS CLI on SSH session I was able to initiate telnet connection to the switch but unfortunately D-LINK refuses connection (no account on switch on defaults). The only option right now is to use web GUI of that switch which is available on 80 or 443 port. I've tried to do port forwarding but trafic flowed only to the switch but didn't in the opposite direction. What are your thoughts to accomplish this setup?

Hello, I have a issue with one of our companies people, which has to work from China. We have a FG200D and it's running a ssl-vpn. All our employees are able to connect to the office network through the SSL-VPN but this one fella which works from China isn't able to connect. I'm very much aware that in China they have lots of restrictions but I was just looking for a way to work this out somehow. Any ideas? Thanks.

hi there, need help,can interface on FG-60D change into individual interface, not act as switch?I've 100D, and the interface can be changed to individual port or act as a switch, or both.if can, how to do that? thank you

Hi all,i need to limit the physical interface total bandwidth (1Gb for instance).I have a firewall with 4 VDOMS, 1 root with the WAN interface and 3 VDOMS with the LAN interface. Of course the 3 VDOMS are sharing the same physical interface with 3 different VLANS.I would like to limit the VDOMS access bandwidth, for exaple: VDOM A ---- VLAN 10 ---- INT G1 --------- 100MbVDOM B ---- VLAN 11 ---- INT G1 --------- 10MbVDOM C ---- VLAN 12 ---- INT G1 --------- 50Mb Does anyone did something similar? Bye D.

I've got a problem registering a FortiToken on my iPhone 6 Plus. When I try to manually enter the code, or scan the QRCode, it fails with a "runtime error". However, my iPhone 5S will register the token without complaint. Both iPhones are using iOS 8.1.2 and the most recent FortiToken Mobile client.

Hi, I am not able to add IPSec Tunnel interface to any Zones. Its giving "Entry not Found Error". Please suggest.  

Hello, I recently upgraded a Fortigate 40C from FortiOS 4 (the latest release, build 665) to FortiOS 5 build 208. There was an existing configuration with very simple policies (any internal to any over WAN1 using any service with destination interface NAT). Before the upgrade everything worked just fine, however after the upgrade, no communication to the internet was possible because the Fortigate was blocking all traffic. I found the problem: Fortinet decided to rename the service " ANY" to " All" (which makes sense IMHO), but didn' t bother to upgrade my configuration to reflect this change, thereby essentially breaking my Firewall. My question is: Has anyone else noticed this behavior? Is there an official word on this from Fortinet? At work, my team and I manage a larger 3950B Firewall with over 130 Virtual Domains. If this is the normal behavior, upgrading our machine to FortiOS 5 would be a catastrophe, as we would have to go through every single VDOM manually an

Hello, i have a FortiMail VM behind a FortiGateVM in a lab environment. all the DNS Request that goes through the Fortigate generates always the Same IPS Alert "DNS.Invalid.OPcode"  its UDP: 53 it´s realy annoying cause i get all my logs full of this IPS Alerts.  Do you have any idea why that happens and hove to avoid that? Thank you.

Hi All, I am getting all the time intrusion attack alert - Bash.Function.Definitions.Remote.Code.ExecutionWhen I open the alert I am getting to this page:http://www.fortiguard.com/encyclopedia/vulnerability/#id=39294 And I understand that I should do:Upgrade to the latest version available from the website.http://ftp.gnu.org/pub/gnu/bash/bash-4.3-patches/bash43-025 The problem is how to do this upgrade on my FortinetWifi 90D machine?I looked every where and try to put the file but it say that this is the wrong file. I tried both bash43-001.sig and  bash43-001.txt in the system-Advanced page in the CLI file update. Please advise how to commit this update to the machine?   Thank you, Eitay Cohen  

Hi All,i cannot find a way to customize my reports....i need to set up a customized report,  where i woul like to see the traffic per network, Like for example: the network A during one month made 1Gb traffic in input and 5Gb output the network B during one month made 6Gb traffic in input and 2Gb output Does anyone have already customized the report to something similar or any available to help me??Thanks

Have a fortigate 60D which pushes only smtp /https traffic to our email gateway. However seeing quite a lot of authentication failures on our barracuda the email firewall. IPS and AV is enabled for the UTM . Any way to check this out. Cant do block by ip isnce it is random ip on a daily basis. Running firmware 5.0.10

Hi,First, I am new with fortinet products and I'm beginning the training with this products. Sorry for my english, it's my second language. I have a problem with vpn connection from a customer. After a moment, it disconnect.We use forticlient.But I can access directly to the installation.  I checked the parameters : In phase 1 keylife : 84600 the checked box : dead peer detections and not traversal Phase 2 : keylife : 84600 checked box : enable replay detection and enable PFS   Thank you If you have other solutions or more informations. Regards, Pierre

hello everybody.. today i have upgraded 80C unit to 5.2.2 and i was wonder how to enable disk log as it is logs are being stored at memory. appreciate your cooperate in regards to this mater.

Any report guru's out there tell me how to get the "Estimated Browsing Time" to display by hour or by day rather than for the entire reporting period? 

Greetings, we moved the firmware to 5.0.10 from 5.0 and then to 5.2.2. Internet wasn't working on 5.2.2, hence downgraded back to 5.0.10. ALl seem to work fine except that the internet is very slow. Have a 100 mb connection, however getting very close to 1mb hardly. Have two wan lines, Wan1 leased line for email traffic and wan2 ( adsl) for internet. Fortigate is connected to a ASA and from asa via switch the internet network. Any advice on what needs to be checked is highly appreciated. have tried connecting separately to a laptop from the line and speed is ok. also did a diag deviceinfo command on wan2 for adsl and didn't see any packet errors in the output result.  checked the routing policy. seems the fortigate is taking only single route and that is to the leased line only. The adsl is not being used at all. How can I detect adsl route on the firewall and set the distance and priority .

Hello,i am Using a FortigateVM and a Sophos VM on a ESXI Server in Test Lab. Both appliances have different Public IP´s for WAN Connection. Both are in Internal Network 192.168.1.1 = Fortigate, 192.168.1.2 = Sophos.  Yesterday for some strange Reason i received a lot of logs From Sophos that Fortigate (192.168.1.1) has tried to login via SSH on the Sophos Shell with different login Names like root, admin etc. Here the logs: Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:05 with username admin.Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:00:47 with username monitor.Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username root.Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username rootFailed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username root.Too many failed logins from 192.168.1.1 for facility sshd.Further logins will be blocked for 600 seconds. I Checked the Syst

Hi all I am wondering if someone can point me in the right direction here.I have two Fortigates connected via ipsec vpn. Site B's internal interface is 192.168.3.0/24 , wifi is 10.1.2.0/24Site A's internal interface is 192.168.2.0/24 I have setup firewall policies and static routes for these ip ranges to the VPN objects in each Fortigate.Clients on the internal interfaces can ping / communicate with the other sides internal interface, but clients on the Site B's wifi cannot.I have also updated the remote subnet address group to include the 10.1.2.0/24 in site A's firewall policy Would this be because in my vpn tunnel phase 2 I have specified the local and remote ip ranges instead of using 0.0.0.0/0 ? A tracert from Site B's wifi to Site A's internal will show the first hop as hitting the wifi interface ip at site B , then nothing Thanks for any assistance 

We moved to FC 5.2.1 for pre-logon SSL-VPN after the debacle of the 4.5.3 updater trying to automatically install an entire security suite on top of our existing one.  Someone eventually dug up a registry hack to stop that.  And now I find out that 5.2.1 is still prompting users to add on the additional security features after explicitly installing VPN Components only. How do I turn that off??? At no point in time should a regular user in an enterprise environment ever be prompted or offered the option of changing the security software on their computer; that's strictly an administrative function.  What's so hard about this?  It's completely baffling to me why I have to put so much work into preventing FortiClient from pwning my computers.

I created a new event handler to notify me of all the sslvpn logins, I've rather done that from fortigate but it seems it's only capable of notifying failed logins. The issue is that I can't find a setting so all the events are sent by mail, only the ones triggering the interval defined (see the attached screenshot from the manual)Is there any way to accomplish that? I am currently using 1match in a 1 minute period to get the alerts.EDIT; Forgot to add that I'm using FAZ 5.2.1

Hello community 6 So my question is this: If I have a branch office connected via IPSEC VPN site-to-site, do I need UTM licence on my 60D in the branch office or can I filter everything through my 100D in the main office? Thanks

Hi there I've got a clustered set of FortiGate 90D devices running 5.2.2 that is serving sslvpn.  I have scrounged a Linux client for sslvpn that identifies itself as  forticlentsslvpn_linux_4.4.2297.tar.gz from somewhere, not entirely sure, possibly an old firmware folder on the FortiNet firmware page. It works as advertised on CentOS 6.6 x86_64 systems, however I have some users insisting on using Fedora 20 x86_64, and they can't get it to work -- it doesn't look like the routing table is getting updated after the client connects. Does anyone have any ideas what might be going on, or am I wasting my time trying to get this to work? Thanks for reading.

OK, So I have an Public Wireless interface (Port5: 192.168.16.1/20) that has all my public wireless traffic that is only allowed access to the Internet (Port1: 12.249.1.1).  The DHCP Scope for Port5: is 192.168.16.2 - 192.168. 31.254.   Everything works great UNLESS DHCP assigns me an address in the 192.168.20.x range, then nothing works.  If you look at my routing table you will see:  Now I didn't think much of this because the FW should always prefer a locally connected route over one learned via. a routing protocol (OSPF in this instance).  Though in my environment this is not the case.  I tested this by hardcoding my machine to 192.168.20.125 and tried to ping 8.8.8.8 and did a packet capture on the FW (v5.0,build0128) I see that the traffic flows: Client (192.168.20.125) ->-> Port5 in (inside pub wireless 192.168.16.1)-> Port1 out (outside Internet connection 12.249.1.1) -> Destination (8.8.8.8)-> Port1 in

Dear All,I have fortigate 800c(version 5.00556) and IPS signature has expired and in the process of renewing.There is a poodle vulnerability and it will solve with 5.587..My question is ..1)is it possible to update without renewing?                        2)from where can I download this 5.587 ?                        3)if it is not possible to download wihout renewing..can we get temporally signature till it get renewed? Thanks