Solved

Have anyone encountered their fortigate displaying 100% CPU on their system resources? Using a FGT 200B and upgrade recently with 5.2.0. was working fine until today then got this issue. Thought its IPS issue so restart the IPS engine but no help went into diag top 1 100 and found scanunid is using 96% of CPU. tried to kill this process ID but no help. any ideas? Polices have got virus scan (flow control), IPS and web filter running.

I have a Fortigate running 5.2.2 and a FortiAnalyzer running 5.2.0 (multiple customers have the same issue) and I am unable to view the logs on the firewall when selecting "Display logs from: FortiAnalyzer". The logs are sent correctly to the analyzer and we can view the logs from the analyzer but all logs are emtpy on the firewall itself. Is this a known issue ?

Hi, We want use the Fortigate Wireless Captive portal with Self-Registration. The user will register him self on the Captive Portal to get the login for Wireless... I've been configured the FortiAuthenticator with success. But, how is the HTML code that I need put on Fortigate captive portal to users access the self-registration portal?  Regards,Paulo Raponi

I have my VPN's running the way I want, but can't seem to find the right method to enable SNMP access over the VPN. Actually see the source CACTI server connect over the VPN to the "root" device on the LAN side of the remote fortigate, but it's denied. How can I enable SNMP access over the VPN from the tunnel interface?  K

A previously working OSPF area now has issues. Troubleshooting using this KB article but stuck now.FGT1 is an ABR with multiple OSPF areas. Area 0.0.0.3 has 2 neighbors (FGT2 and FGT3) and 3 interfaces - the primary link and two ipsec tunnels (one each neighbor).Routing on the primary link has failed. This is the only problem - all other areas are OK, and the ipsec backups within this area are also OK.Ping is OK to both neighbors' primary interface IP. Also it is possible to ssh* to FGT2 and FGT3. Heavily summarised diagnostic output as followsFGT1 # get router info ospf neighbor FGT1 # <FGT2> ExStart/Backup FGT1 # <FGT3> ExStart/DROther FGT1 # get router info ospf status FGT1 # Area 0.0.0.3 FGT1 # Number of interfaces is 3 FGT1 # Number of neighbors is 2 FGT1 # get router info ospf interface FGT1 # My-Interface is up FGT1 # Neighbor Count is 2, Adjacent neighbor count is 0 <<< I guess this is a problemFGT2 and FGT3FGT2 # get router info ospf neighbor FGT2 # <FG

Hi! I'm trying to crack the code behind this Fortigate, and must admit I'm not there yet.Given the schematic below, how do I get a public IP behind a fortigate in NAT mode without adding a second transparent v-dom.Thanks! 

Hi Everyone,I was wondering if anyone could explain the pros and cons of the two methods of SSl inspectionCertificate Inspection and Full deep Inspection.I read the technical comment howcertificate-inspection which only inspects the SSL handshake,anddeep inspection enables full deep inspection.What I would like to know is if I implement one solution does it have limitations , i.e  blocking  or something similarWhy have two methods ?Many Thanks in advance Paul

Hello, We are using "FortiGate 100D" firewall with "fortianalyzer 100c" for reporting purpose. I want to delete all internet browsing history from Fortianalyzer. I am confused about this Task will perform from which side :  Fortigate  or  Fortianalyzer ?I have done one thing from my side after Googling is that I had given below command on FortiGate Command console:execute log delete-allBut still logs are there and showing after search. so what i need to do ? Please give me exact solution   

Hi, after upgrading FAZ to 5.2.0 we have a problem with an customized dataset. When running a test query we get an error. This is the query:SELECT srcip, msg, service, dstip, count(*) as totalnumFROM $logWHERE $filter AND srcip IS NOT LIKE '10%' AND (subtype='violation' or action='deny')GROUP BY srcip, msg, dstip, serviceORDER BY totalnum DESC Log Type is set to "traffic" The error we get: ERROR: syntax error at or near "LIKE" We want to report all blocked outgoing traffic from inside. The filter on "LIKE '10%' " is essential for the report.Does anybody how to solve this in 5.2.0? Regards, Olav

Good day everyone, I'm not sure if this will be the right to place this post. Anyway, I just want to ask how do you scope your clients needs to propose a certain model of Fortigate that will fit their requirements? Can you have some advice or tips how to handle clients requirements to come up with a good fortigate model. I'm asking this for I'm not certain to some particular model of fortigate if that will fit or overkill for clients requirements. Thank you. Regards,maeLove

Hi,  i have upgraded a 310B Cluster to 5.2.1(v5.2.1,build618 (GA)), but on the FortiView the Threat View is missing (?)  Regards,Pat 

Hi All,I have 311B Fortigate, version 5.2.1.I have recently tryied to configure  PPTP VPN and authenticating with LDAP Domain Controller. After fist creating users then users group and then configuring the LDAP. When I finish LDAP configuration, testing is successful. when I try to connect to VPN, it is failed. After having many times unsuccessful pptp VPN connection, I looked at the policy and I changed the policy any to any policy on WAN interface in the first of the policy list. But this didn't help fixing this problem.In order to delving into this VPN problem, I just create a local user on the Fortigate and PPTP VPN connection is working without making change the current PPTP VPN connection configuation.In other words, Local user VPN is okay but authenticating user with LDAP is not working....As I [provide some logs and configuration at the follow section, can you please advise how I can come over this VPN problem? [style="background-color: #ffff00;"]BAL_FTG # s

We have 4 x FortiAP 220B units running firmware v5.0.7 (build 64) . In the past these unit were spread across a number of WiFi Channels (1, 6 and 11). Just recently I noticed that all of them were using Channel 6 only. I cannot find any option in the Fortigate web interface to set the channel number. I cannot find any option in the FortiAP web interface to set the channel ID, although it does at least display on the Wireless tab that Channel = 1, 6, 11. So ... to my question ... has the ability to set the WiFi Channel been removed from the FortiAP's?

Hello! I want to configure FortiClients to connect to a FortiGate 100D using IPSEC VPN, but so that different users authenticate against different AD-servers. Which means I can' t use " Accept any peer ID" in Phase1 configuration, otherwise all dialup clients will fall into the first policy and/or VPN. If I use Shrewsoft VPN Client, then it has been OK, some clients already authenticate and use the VPN, because in Shrew client there is a special place where to enter that common peer ID. The manual says (fortigate-ipsec-50.pdf, page 45): ------- To configure FortiClient - pre-shared key and peer ID 1. Start the FortiClient Endpoint Security application. 2. Go to VPN > Connections, select the existing configuration. 3. Select Advanced > Edit. Auto Key phase 1 parameters Page 45 IPsec VPN for FortiOS 5.0 4. In the Preshared Key field, type the FortiGate password that belongs to the dialup client (for example, 1234546). The user account password will be used as the p

We are trying to set up a security policy that requires the user to authenticate to the firewall when accessing a particular internal web page. It works fine if the destination site is on port 80, but not when the site is hosted on a different port (port 3000 in this case). I think it's related to the Authentication > Settings where you select the Protocol Support. It allows you to select HTTP and HTTPS, but not a specific port. 

Hi All, We have a FortiWiFi 80C which has been out of support for some time (I guess over a year, although I don't know for sure). I was thinking of getting FortiCare for this box in case something happens. The problem is that I am unable to find out what it would cost me or how renewing an expired box works. I asked FortiNet support but was pointed to their renewals team which seem to push emails back and forth, apparently unable to give me an answer. I then talked to three FortiNet resellers, and got three different replies. One said that I can just buy the 8x5 1yr FortiCare renewal for my box and I'm set. Another one said that I have to purchase the 2yr package and that FortiNet will backdate support for one year.  And the third reseller told me that once support runs out it can't be renewed. Can anyone here shed some light on it? Can I put this box back under support, and if so, how?

 Hi!the company where i work bought a new Fortigate, the 800C versión v5.0,build0291 (GA Patch 8). Before we have 311B with another versión that have the option "Log All URL" on the "Web Filter Profile" but on the new versión is not present.Is possible enabled this option on the v5.0 patch 8?

Dear all, i have a fortigate 100D version v5.2.2, i need to set a rules to block all streaming video but only allow youtube, i have done the web rating overrides youtube.com to custom group. but when i streaming video on youtube keep show video error.

We have a 400B and almost every time we apply a release or patch the configuration either gets wiped or it changes things so much that we have to relearn the new system/interface and/or reconfigure the whole box. For example we just tried to go from 5.2 0330 to 5.2 0442, not a big jump, and the physical server and server farm sections are gone. I don't mean they got wiped, I mean they are not even on the menu anymore. So we rolled it back to 330 while we try to figure out what to do THIS time. We are at the point where we don't want to upgrade the firmware any more for fear of what might happen. Tech support is no help. Not sure if this is a question or just a rant..

Howdy folks, I have created a custom data set to return the number of requests per parent domain (i.e. just the values before the country code) using the regexp_matches function. The results are returned within {} braces, is there a way to suppress these in the results? Here is a sample of the output: # domain visits 1 {bitdefender.net} 66113 2 {pubnub.com} 9583 3 {doubleclick.net} 9192 4 {serving-sys.com} 6127 5 {adnxs.com} 5700 6 {googlesyndication.com} 4765 7 {bing.com} 4530   Many thanks, Nathan

In FortiManager 4.3 you always had an option of creating a script to run at a schedule, but looking at 5.0 and 5.2's configurations I can't seem to find this option anywhere. Even the doco's dont mention script schedules (when they did for 4.3). Do you guys know if it's been disabled in the newer versions, or if I'm just blind?

We have a Fortigate 5.0 firewall and a VPN ssl Configuration, this vpn works with Windows without problems, but with macosx 10.7/8/9 we have trouble. After Client installation on the mac (5.2) we made the same config as in the windows client but when we try to connect we got an error,that there is not enough information for connect, please check User password or certificate. On the mac console we saw these message  04.11.14 11:41:18 [0x0-0x3c23c2].com.fortinet.FortiClientAgent[5679] klist: No credentials cache found while getting the ccache principal  But ridiculous ist, that on some Macclients it switched from work to not work, that means on some mac clients i could connect thru vpn, some minutes later we got an error message.

Hello,Does anyone have configured ssl offloading on the fortigate? I have used the 'cookbook' but it doesn't explain too well how to configure half mode ssl server configuration. I need to decrypt incoming https and forward this unencrypted to backend http server. What I configured:conf firewall policyset dstaddr "vip-to-webserver"  => 157.52.x.x to 172.16.16.15set service httpsset webcache enableset webcache-https ssl-server and:config wanopt ssl-serveredit webserver1set ip 172.16.16.15set port 443 set ssl-mode halfset mapped-port 80set ssl-cert <webserver certificate> Please advise. Thank you in advance, Kind regards, Ralph

I have a Fortigate 200D with FortiOS 5.0 Patch 9 (build 0292). I created address objects & custom service for a particular vendor (EMC), then used them in a policy. if I change the policy to allow "all" services it works and only logs accesses on port 443. The custom service includes (per EMC) ports 443 & 8443. If I change the rule to include the HTTPS service it works. I'm assuming I did something wrong creating the custom service, but I'm including the whole script I used in case someone can spot something else I did wrong. Here's the custom service definition: config firewall service custom edit "EMC_ESRS_Svcs" set category "My Custom Services" set comment "EMC ESRS" set tcp-portrange 443:443 8443:8443 next Any assistance would be greatly appreciated, Roger Morganrcmorgansec@morganemail.net  config firewall address edit "EMC_ESRS_A" set associated-interface "wan1" set type iprange set end-ip 128.221.192.14 set start-ip 128.221.192.13

Upgraded firmware on the Analyzer to 5.0.8 and now when I try running the built in VPN Report, none of the charts return any information.  Says "No Data". Any ideas?