Solved

Hello,i am Using a FortigateVM and a Sophos VM on a ESXI Server in Test Lab. Both appliances have different Public IP´s for WAN Connection. Both are in Internal Network 192.168.1.1 = Fortigate, 192.168.1.2 = Sophos.  Yesterday for some strange Reason i received a lot of logs From Sophos that Fortigate (192.168.1.1) has tried to login via SSH on the Sophos Shell with different login Names like root, admin etc. Here the logs: Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:05 with username admin.Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:00:47 with username monitor.Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username root.Failed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username rootFailed SSH login attempt from 192.168.1.1 at 2015-01-18 00:01:04 with username root.Too many failed logins from 192.168.1.1 for facility sshd.Further logins will be blocked for 600 seconds. I Checked the Syst

Hi all I am wondering if someone can point me in the right direction here.I have two Fortigates connected via ipsec vpn. Site B's internal interface is 192.168.3.0/24 , wifi is 10.1.2.0/24Site A's internal interface is 192.168.2.0/24 I have setup firewall policies and static routes for these ip ranges to the VPN objects in each Fortigate.Clients on the internal interfaces can ping / communicate with the other sides internal interface, but clients on the Site B's wifi cannot.I have also updated the remote subnet address group to include the 10.1.2.0/24 in site A's firewall policy Would this be because in my vpn tunnel phase 2 I have specified the local and remote ip ranges instead of using 0.0.0.0/0 ? A tracert from Site B's wifi to Site A's internal will show the first hop as hitting the wifi interface ip at site B , then nothing Thanks for any assistance 

We moved to FC 5.2.1 for pre-logon SSL-VPN after the debacle of the 4.5.3 updater trying to automatically install an entire security suite on top of our existing one.  Someone eventually dug up a registry hack to stop that.  And now I find out that 5.2.1 is still prompting users to add on the additional security features after explicitly installing VPN Components only. How do I turn that off??? At no point in time should a regular user in an enterprise environment ever be prompted or offered the option of changing the security software on their computer; that's strictly an administrative function.  What's so hard about this?  It's completely baffling to me why I have to put so much work into preventing FortiClient from pwning my computers.

I created a new event handler to notify me of all the sslvpn logins, I've rather done that from fortigate but it seems it's only capable of notifying failed logins. The issue is that I can't find a setting so all the events are sent by mail, only the ones triggering the interval defined (see the attached screenshot from the manual)Is there any way to accomplish that? I am currently using 1match in a 1 minute period to get the alerts.EDIT; Forgot to add that I'm using FAZ 5.2.1

Hello community 6 So my question is this: If I have a branch office connected via IPSEC VPN site-to-site, do I need UTM licence on my 60D in the branch office or can I filter everything through my 100D in the main office? Thanks

Hi there I've got a clustered set of FortiGate 90D devices running 5.2.2 that is serving sslvpn.  I have scrounged a Linux client for sslvpn that identifies itself as  forticlentsslvpn_linux_4.4.2297.tar.gz from somewhere, not entirely sure, possibly an old firmware folder on the FortiNet firmware page. It works as advertised on CentOS 6.6 x86_64 systems, however I have some users insisting on using Fedora 20 x86_64, and they can't get it to work -- it doesn't look like the routing table is getting updated after the client connects. Does anyone have any ideas what might be going on, or am I wasting my time trying to get this to work? Thanks for reading.

OK, So I have an Public Wireless interface (Port5: 192.168.16.1/20) that has all my public wireless traffic that is only allowed access to the Internet (Port1: 12.249.1.1).  The DHCP Scope for Port5: is 192.168.16.2 - 192.168. 31.254.   Everything works great UNLESS DHCP assigns me an address in the 192.168.20.x range, then nothing works.  If you look at my routing table you will see:  Now I didn't think much of this because the FW should always prefer a locally connected route over one learned via. a routing protocol (OSPF in this instance).  Though in my environment this is not the case.  I tested this by hardcoding my machine to 192.168.20.125 and tried to ping 8.8.8.8 and did a packet capture on the FW (v5.0,build0128) I see that the traffic flows: Client (192.168.20.125) ->-> Port5 in (inside pub wireless 192.168.16.1)-> Port1 out (outside Internet connection 12.249.1.1) -> Destination (8.8.8.8)-> Port1 in

Dear All,I have fortigate 800c(version 5.00556) and IPS signature has expired and in the process of renewing.There is a poodle vulnerability and it will solve with 5.587..My question is ..1)is it possible to update without renewing?                        2)from where can I download this 5.587 ?                        3)if it is not possible to download wihout renewing..can we get temporally signature till it get renewed? Thanks  

Hi,I have FortiGate 3140B v4.0 (MR2 patch 13). Is there a way to configure a rule which can control number of tcp connections per source IP (something similar to Cisco ASA policy - per-client-max)? Thank youHubert 

Hi All,We have a FortiGate 100D Cluster (Active-Active), running Version 5.2.2 Build 642 (GA). We have just received a pair of FortiCloud Subscription Certificates (200GB).I have been able to upgrade the subscription on the primary (master) unit via the Web GUI. However, I'm not sure how to upgrade the secondary (slave) unit. I attempted to do this via the FortiCloud Web Portal, but that didn't work.Is it possible to upgrade the FortiCloud subscription on the appliance from the CLI?Many thanks, JP 

hi, we have two 1500D with vdom enabled on both, each should have 4 VDOMs (root,vpn,servers,wan) i configured an HA A/P with vcluser2 enabled and moved Servers vdom to vcluster 2 to become the master in the other unit, so basically it becomes like that:  Device Priority Name             Vcluster1                    Vcluster2 FGT_ha_1      200(root,vpn,wan)       100 (servers) FGT_ha_2      100 (servers)              200(root,vpn,wan) which worked great in term of flow, now when testing the vdom failover (port monitor enabled on vdom port lever) we manually unplugged the vdom cables unfortunately the failover did not happened until i moved the vdom manually to the other vcluster e.g: moved vpn to vcluster2 . did i miss something here ( i followed the document of 5.2 HA ) which i believe should be straight

Since enabling the transparent web proxy in our FG200B a few days ago, I noticed this morning that nothing was showing up in the cache monitor.  Suspecting that it had 'crashed' over the weekend, I went into the CLI and ran:[ul]config globaldiag wacs restart[/ul]and sure enough, straight away there was stuff showing up again in the cache monitor screen.  Several questions occur to me:[ol]is the transparent web proxy cache functionality robust, or is it known to be a bit flaky?is there any way I can be sure about my suspicion that the service is crashing?[/ol]I didn't think to run 'diag sys top' before restarting the wa_cs service, but I will do that if I notice problems with it again.

hello which indoor units support wireless AC ?  thanks,

Configuration ipsecWan1 - Internet   (vpntunnel1 , and vpntunnel2)Interface 1 - lan1 10.0.0.0Interface 2 - lan2 10.0.3.0I can establish vpn with vpntunnel1 to lan1 but cannot establish vpntunnel2 to lan2in event log vpn when I try establish vpntunnel2 I see there the fortigate is tryining go through vpntunnel1 instead vpntunnel2 (strange). (vpntunnel2 have diffrent adresses and has intrEface 2 which I set in objects)event log: progress IPsec phase 1 success and delete IPsec phase 1 SA but why vpntunnel1 not 2.I think i can set the fortigate to choose vpntunel2 and then everything will be ok ? But how ?p.s SORRY for English 

Hi Guys... SoI' ve gone through the standard charts / datasets and I can' t seem to find one that will give me browsing history. I' m running Fortianalyzer 100c with v5.0.5 I need to be able to check on browsing history for specific users. What websites and when...can anybody help me with this please?? thanks

I try to create a new web filtering but I do not know how to do it because the create New button is missingThe web filtering service is enabled 

Hello Everyone, I just spun up a new installation of FortiManager, version 5.2 build 618. I am using the virtual appliance downloaded from the website. I am trying to import a couple of FortiGate 300D devices, version 5.2.1 build 618. However, I get the following error: This FortiManager does not support the discovered device model and firmware version combination.  Has anyone seen that problem before? Could anyone provide a fix or workaround? Thanks!

Hi All,A heads up here.  We had some downtime for a bandwidth upgrade so at the same time we thought we would upgrade our 200D to V5.2.1. - which we have working fine elsewhere.  This worked fine in most aspects BUT:An Ironport cluster and a VMware application running over an IPsec VPN would disconnect almost every 59mins 23 (ish) seconds.  Then reconnect.  VPN's would stay up no errors or other notifications.   It was so regular we knew it must be a timer or something somewhere - but we could not find it.  We did packet traces of the disconnects and found that at the time of the disconnects 'something' was causing the application(s) to reset all its sessions. We chased the ISP blaming the new link and looking at all manner of things that could be causing this, all to no avail.  Today we reverted to V5.2.0 Build 589 - so far we have not had one disconnect (3hrs).  The config on the Firewall is exactly the same. &nbsp

Hi,Is there any way to forward Event Log via syslog ?Moreover is it possible to filter the export, for instance focusing on events like logins/logouts and export only these ones ?Thanks.  

Looking to script the update of ips signature files, but without ftp or tftp available (which rules out execute restore ips [ftp|tftp] etc..). Can scp be used to deploy ips signature files? If so, what is the destination filename on the FGT, any other steps required?

HelloAs Can I unlock a mac address?I blocked a mac address and I'm looking to unlockThank you very much 

Hello, Please, how I can keep the traffic logs allowed by all the access list, and send just a logs of SOME rules to the FortiAnalyzer ?to better explain:for exemple: keep on the fortigate disk the trafic log of the rules id: 1 and 2 and 3, and send only the traffic log of the rule id 3 to the fortianalyzer.

FGT1 internal1 is directly* connected to FGT2 wan1 and there is an ipsec interface vpn which was working fine but is now down.I see the following debug at FGT1diag deb app ike -1 diag deb en ike 0: comes 172.a.b.122:500->172.a.b.121:500,ifindex=11... [...] ike 0: no IKEv1 phase1 configuration matching 172.a.b.122:500->172.a.b.121 11The full phase1-interface configurations have been verified to be correct and match. I don't know how to resolve ifindex to physical interface (I've seen ifindex mentioned somewhere in doco but can't find it now). The tunnel gateway on FGT1 is a secondary ip address.I have also subsequently forced a psk mismatch with no change to the debug output.FGT1 was recently updated from 4.1.4 to 4.3.18 with no known issues; another vpn is working fine. FGT2 is 4.3.14, update pending.Any tips where to look next? * "directly" is a digital radio link. There are no known issues with the link.

hi , can i restore a vdom settings from a full config backup ? on my FW i have 3 vdoms (Root,VPN and Server_IPS) i need to restore the config for the VPN vdom only but i only have the full backup config not vdom specific so is it possible or can i modifiy the backup file in a way that it restores the vdom only ? BR

Have anyone encountered their fortigate displaying 100% CPU on their system resources? Using a FGT 200B and upgrade recently with 5.2.0. was working fine until today then got this issue. Thought its IPS issue so restart the IPS engine but no help went into diag top 1 100 and found scanunid is using 96% of CPU. tried to kill this process ID but no help. any ideas? Polices have got virus scan (flow control), IPS and web filter running.