Solved

Hi All,We have a FortiGate 100D Cluster (Active-Active), running Version 5.2.2 Build 642 (GA). We have just received a pair of FortiCloud Subscription Certificates (200GB).I have been able to upgrade the subscription on the primary (master) unit via the Web GUI. However, I'm not sure how to upgrade the secondary (slave) unit. I attempted to do this via the FortiCloud Web Portal, but that didn't work.Is it possible to upgrade the FortiCloud subscription on the appliance from the CLI?Many thanks, JP 

hi, we have two 1500D with vdom enabled on both, each should have 4 VDOMs (root,vpn,servers,wan) i configured an HA A/P with vcluser2 enabled and moved Servers vdom to vcluster 2 to become the master in the other unit, so basically it becomes like that:  Device Priority Name             Vcluster1                    Vcluster2 FGT_ha_1      200(root,vpn,wan)       100 (servers) FGT_ha_2      100 (servers)              200(root,vpn,wan) which worked great in term of flow, now when testing the vdom failover (port monitor enabled on vdom port lever) we manually unplugged the vdom cables unfortunately the failover did not happened until i moved the vdom manually to the other vcluster e.g: moved vpn to vcluster2 . did i miss something here ( i followed the document of 5.2 HA ) which i believe should be straight

Since enabling the transparent web proxy in our FG200B a few days ago, I noticed this morning that nothing was showing up in the cache monitor.  Suspecting that it had 'crashed' over the weekend, I went into the CLI and ran:[ul]config globaldiag wacs restart[/ul]and sure enough, straight away there was stuff showing up again in the cache monitor screen.  Several questions occur to me:[ol]is the transparent web proxy cache functionality robust, or is it known to be a bit flaky?is there any way I can be sure about my suspicion that the service is crashing?[/ol]I didn't think to run 'diag sys top' before restarting the wa_cs service, but I will do that if I notice problems with it again.

hello which indoor units support wireless AC ?  thanks,

Configuration ipsecWan1 - Internet   (vpntunnel1 , and vpntunnel2)Interface 1 - lan1 10.0.0.0Interface 2 - lan2 10.0.3.0I can establish vpn with vpntunnel1 to lan1 but cannot establish vpntunnel2 to lan2in event log vpn when I try establish vpntunnel2 I see there the fortigate is tryining go through vpntunnel1 instead vpntunnel2 (strange). (vpntunnel2 have diffrent adresses and has intrEface 2 which I set in objects)event log: progress IPsec phase 1 success and delete IPsec phase 1 SA but why vpntunnel1 not 2.I think i can set the fortigate to choose vpntunel2 and then everything will be ok ? But how ?p.s SORRY for English 

Hi Guys... SoI' ve gone through the standard charts / datasets and I can' t seem to find one that will give me browsing history. I' m running Fortianalyzer 100c with v5.0.5 I need to be able to check on browsing history for specific users. What websites and when...can anybody help me with this please?? thanks

I try to create a new web filtering but I do not know how to do it because the create New button is missingThe web filtering service is enabled 

Hello Everyone, I just spun up a new installation of FortiManager, version 5.2 build 618. I am using the virtual appliance downloaded from the website. I am trying to import a couple of FortiGate 300D devices, version 5.2.1 build 618. However, I get the following error: This FortiManager does not support the discovered device model and firmware version combination.  Has anyone seen that problem before? Could anyone provide a fix or workaround? Thanks!

Hi All,A heads up here.  We had some downtime for a bandwidth upgrade so at the same time we thought we would upgrade our 200D to V5.2.1. - which we have working fine elsewhere.  This worked fine in most aspects BUT:An Ironport cluster and a VMware application running over an IPsec VPN would disconnect almost every 59mins 23 (ish) seconds.  Then reconnect.  VPN's would stay up no errors or other notifications.   It was so regular we knew it must be a timer or something somewhere - but we could not find it.  We did packet traces of the disconnects and found that at the time of the disconnects 'something' was causing the application(s) to reset all its sessions. We chased the ISP blaming the new link and looking at all manner of things that could be causing this, all to no avail.  Today we reverted to V5.2.0 Build 589 - so far we have not had one disconnect (3hrs).  The config on the Firewall is exactly the same. &nbsp

Hi,Is there any way to forward Event Log via syslog ?Moreover is it possible to filter the export, for instance focusing on events like logins/logouts and export only these ones ?Thanks.  

Looking to script the update of ips signature files, but without ftp or tftp available (which rules out execute restore ips [ftp|tftp] etc..). Can scp be used to deploy ips signature files? If so, what is the destination filename on the FGT, any other steps required?

HelloAs Can I unlock a mac address?I blocked a mac address and I'm looking to unlockThank you very much 

Hello, Please, how I can keep the traffic logs allowed by all the access list, and send just a logs of SOME rules to the FortiAnalyzer ?to better explain:for exemple: keep on the fortigate disk the trafic log of the rules id: 1 and 2 and 3, and send only the traffic log of the rule id 3 to the fortianalyzer.

FGT1 internal1 is directly* connected to FGT2 wan1 and there is an ipsec interface vpn which was working fine but is now down.I see the following debug at FGT1diag deb app ike -1 diag deb en ike 0: comes 172.a.b.122:500->172.a.b.121:500,ifindex=11... [...] ike 0: no IKEv1 phase1 configuration matching 172.a.b.122:500->172.a.b.121 11The full phase1-interface configurations have been verified to be correct and match. I don't know how to resolve ifindex to physical interface (I've seen ifindex mentioned somewhere in doco but can't find it now). The tunnel gateway on FGT1 is a secondary ip address.I have also subsequently forced a psk mismatch with no change to the debug output.FGT1 was recently updated from 4.1.4 to 4.3.18 with no known issues; another vpn is working fine. FGT2 is 4.3.14, update pending.Any tips where to look next? * "directly" is a digital radio link. There are no known issues with the link.

hi , can i restore a vdom settings from a full config backup ? on my FW i have 3 vdoms (Root,VPN and Server_IPS) i need to restore the config for the VPN vdom only but i only have the full backup config not vdom specific so is it possible or can i modifiy the backup file in a way that it restores the vdom only ? BR

Have anyone encountered their fortigate displaying 100% CPU on their system resources? Using a FGT 200B and upgrade recently with 5.2.0. was working fine until today then got this issue. Thought its IPS issue so restart the IPS engine but no help went into diag top 1 100 and found scanunid is using 96% of CPU. tried to kill this process ID but no help. any ideas? Polices have got virus scan (flow control), IPS and web filter running.

I have a Fortigate running 5.2.2 and a FortiAnalyzer running 5.2.0 (multiple customers have the same issue) and I am unable to view the logs on the firewall when selecting "Display logs from: FortiAnalyzer". The logs are sent correctly to the analyzer and we can view the logs from the analyzer but all logs are emtpy on the firewall itself. Is this a known issue ?

Hi, We want use the Fortigate Wireless Captive portal with Self-Registration. The user will register him self on the Captive Portal to get the login for Wireless... I've been configured the FortiAuthenticator with success. But, how is the HTML code that I need put on Fortigate captive portal to users access the self-registration portal?  Regards,Paulo Raponi

I have my VPN's running the way I want, but can't seem to find the right method to enable SNMP access over the VPN. Actually see the source CACTI server connect over the VPN to the "root" device on the LAN side of the remote fortigate, but it's denied. How can I enable SNMP access over the VPN from the tunnel interface?  K

A previously working OSPF area now has issues. Troubleshooting using this KB article but stuck now.FGT1 is an ABR with multiple OSPF areas. Area 0.0.0.3 has 2 neighbors (FGT2 and FGT3) and 3 interfaces - the primary link and two ipsec tunnels (one each neighbor).Routing on the primary link has failed. This is the only problem - all other areas are OK, and the ipsec backups within this area are also OK.Ping is OK to both neighbors' primary interface IP. Also it is possible to ssh* to FGT2 and FGT3. Heavily summarised diagnostic output as followsFGT1 # get router info ospf neighbor FGT1 # <FGT2> ExStart/Backup FGT1 # <FGT3> ExStart/DROther FGT1 # get router info ospf status FGT1 # Area 0.0.0.3 FGT1 # Number of interfaces is 3 FGT1 # Number of neighbors is 2 FGT1 # get router info ospf interface FGT1 # My-Interface is up FGT1 # Neighbor Count is 2, Adjacent neighbor count is 0 <<< I guess this is a problemFGT2 and FGT3FGT2 # get router info ospf neighbor FGT2 # <FG

Hi! I'm trying to crack the code behind this Fortigate, and must admit I'm not there yet.Given the schematic below, how do I get a public IP behind a fortigate in NAT mode without adding a second transparent v-dom.Thanks! 

Hi Everyone,I was wondering if anyone could explain the pros and cons of the two methods of SSl inspectionCertificate Inspection and Full deep Inspection.I read the technical comment howcertificate-inspection which only inspects the SSL handshake,anddeep inspection enables full deep inspection.What I would like to know is if I implement one solution does it have limitations , i.e  blocking  or something similarWhy have two methods ?Many Thanks in advance Paul

Hello, We are using "FortiGate 100D" firewall with "fortianalyzer 100c" for reporting purpose. I want to delete all internet browsing history from Fortianalyzer. I am confused about this Task will perform from which side :  Fortigate  or  Fortianalyzer ?I have done one thing from my side after Googling is that I had given below command on FortiGate Command console:execute log delete-allBut still logs are there and showing after search. so what i need to do ? Please give me exact solution   

Hi, after upgrading FAZ to 5.2.0 we have a problem with an customized dataset. When running a test query we get an error. This is the query:SELECT srcip, msg, service, dstip, count(*) as totalnumFROM $logWHERE $filter AND srcip IS NOT LIKE '10%' AND (subtype='violation' or action='deny')GROUP BY srcip, msg, dstip, serviceORDER BY totalnum DESC Log Type is set to "traffic" The error we get: ERROR: syntax error at or near "LIKE" We want to report all blocked outgoing traffic from inside. The filter on "LIKE '10%' " is essential for the report.Does anybody how to solve this in 5.2.0? Regards, Olav

Good day everyone, I'm not sure if this will be the right to place this post. Anyway, I just want to ask how do you scope your clients needs to propose a certain model of Fortigate that will fit their requirements? Can you have some advice or tips how to handle clients requirements to come up with a good fortigate model. I'm asking this for I'm not certain to some particular model of fortigate if that will fit or overkill for clients requirements. Thank you. Regards,maeLove