Solved

HI Guys,I need someone to advice me on the scenario below.I have configured the OSPF routing protocol on the Fortigate but the output doesn't immediately display on Routing Monitor GUI. However, I was able to see the external route being learn from the CE router on the Fortigate CLI. Can i know why we cant immediately notice the external E1 route? Is there some kind of min wait time frame before it appears on the GUI? Please note that this is a Fortigate 310B firewall. Thank you in advanced. Rgds,Mesh 

Hi, Is it possible to modify LDAP authentication in way that would allow users to authenticate with either their sAMAccountName or their userPrincipalName? Thank you

Hi, is it possible to redefine the LDAP filter in a way that would enable the Fortigate to be aware of nested groups? Thank you

Gents Good evening and thanks already if you got the time to help me out, not sure if this is in the right thread but: Got a internal Active directory domain named, mydomain.com (yes i know not very clever), long story short bought a B200 to satisfy bandwidth managment and content management it owrk like a charm with AD integration, but now i have a small issue. My company web site is hosted externally a suffix that equals my internal domain, i have to point my internal DNS servers to the external www.mydomain.com IP address. if i use any ISP link external to my LAN i can open the web site (E.G. a 3G network), but on my LAN i just get a time out, altough i can resolve the name to the correct IP address internally the page does not open. is there a security mesuare wihtin fortinet causing this situation? what is it? and can you help me to fix it? I say this because if i take fortinet out of the equation and put the old CISCO ASA online all works fine.&

Just updated to 5.0.9 on our Fortianalyzer 1000c and can't seem to find where to view the real time logs as they come across.I use this feature to live monitor student activity at times.  Where can I see the real time logs? 

Hi all We have spend a lot of time trying to get IPSEC FG to FG to work as shown in this video.  http://www.youtube.com/watch?v=01KEgxqC4WI The plan is to use OSPF as the routing protocol, so that should WAN 1 fail WAN 2 becomes the new route etc.We managed to get the tunnel up and working....(we are using the latest version of FW 5.2.1, so we had to add in quick mode selector ip's for the local lan AND the ipsec interfaces) Eventually we managed to pass pings from a PC over the tunnel, but had to use static routes to get it to work.No matter what we tried we cannot get OSPF updates over the tunnel, so without the static routes one side cant reach the other!Having the static routes in place defeats the whole purpose of using the routing protocol.(running cli commands to see the OSPF neighbour show nothing on both sides) Just  a thought, but I suspect the FW rules are restricting OSPF traffic, if I look at the rules they tend to only allow traffic from internal to e

Hi all, I have 2 firewalls configured as active-active HA. Now I need to format disk for it to enable the logging. My question now is; when I do the format disk on the 1st unit (system reboot), will the network get directed to 2nd unit causing 1 ping drop? or will both units go down at the same time? Thanks in advance,D 

Hi Guys,I have just upgraded a FG50B box from 4.2.1 to 4.3.18 directly.I was able to get the internet for a minute , ( I am taking the control remotely as well through team viewer) .but after that it went down, what are the possible things I can ask the ground guy to do? 

We have a Fortigate 600C. At the moment you can get to our Firewall admin page through https from the internet. What is the best way to lock down this access to only allow access from specific IP's? So, we would still like access to the admin page and to get logged in from the internet, but only from specific IP addresses. Thanks in advance. New to Fortinet and need all the assistance I can get. 

Can someone help me out on this? Got a mail from our certificate supplier about SHA1 certificates being phased out.  They supplied us with a new certificate which replaces the old one. However this certificate is only available in .cer-format and is being sent together with just the CA certificate and the intermediate certificate. When I try to import the certificate into the Fortimail unit, the response says: "Certificate upload: importing the CSR response failed". I get that because no CSR was created. Question: How can I replace an existing certificate in the FortiMail with the new one which is in .cer-format only?

When I look at the policies in my Fortigate 60D, I don't see what I expect to see. I expect to see the policies listed in the order they are applied from top (#1) to bottom (#44).  I am forced to use the global view due to how one or more policies are setup. The problem for me is, the policy I expect to see at #1 is actually the last policy #44.  Is it possible that the policies are listed in reverse order?  Meaning that what I see as policy #44 is applied first then policy 43 then... etc.  I expect the policies to be applied the in the same order they are listed in the view, and the way I see it now is not good.   

I have a fortinet 200D with the following status. In this case I believe the OS is installed in flash. So can I perform a hard reboot of the system. Also where does the firewall going to store the logs? get hardware status Model name: FortiGate-200D ASIC version: CP8 ASIC SRAM: 64M CPU: Intel(R) Celeron(R) CPU G540 @ 2.50GHz Number of CPUs: 2 RAM: 3960 MB Compact Flash: 15331 MB /dev/sda Hard disk: 61057 MB /dev/sdb USB Flash: not available Network Card chipset: Intel(R) PRO/1000 Network Connection (rev.0000)

Hi, I just want to know why I am getting the PBA -exhaust -alert every now and then. I have not configured PBA, and I am using One to One mapping NAT. Is this normal? thanks

Hi guys, i look for solution to deploy forticlient on 300 Windows Workstations. i' ve tried to deploy it by GPO ( with msi installer) and using fcconfig.exe -m all -f c:\settings.xml -o import -i 1, but the result it was half a success. So, this method don' t work for me when the xml file is crypted by password. However i need and i want absolutly lock configuration of forticlient on target workstation. I' ve heard that it exist a possibility with .conf or .sconf file but i don' t know how to generate or build this kind of file. do any of you have the solution or have you heard of it? Georges Orwell

Anyone know how to find out the Log size in the Log & Report section? I have a 600C and the question that was asked was how much can the Log file hold? To be honest I wasn't sure. Is there an easy way to find that out?

hello fellows, dumb question actually: sometimes I target alertemails of customer firewalls to me. Now, is there an option to filter which events get reported? Like in 'config log <dev> filter'? I'd love to cut out these webfilter messages which occur in hundreds per day. Setting the alert level higher doesn't work for this as 'status=blocked' is at the 'warning' level, as are other more serious events.

Yesterday everything was fine, I was using fortiexplorer to configure a fortigate 60d and after i was done for the day i ran an "exe shut" on the device to shut it down and i unplugged the power from it leaving the USB cable in place. Today when I plugged the power back in windows tells me the device is unknown and fortiexplorer doesn't see the device anymore. Has anyone run into this before?Does anyone know where I can get the USB driver to manually install it on the "unknown device" since windows is convinced it's already updated...I tried searching google for the driver, but was only able to find driver manager/updater programs that want you to buy them to install drivers...

Where does one go to see if a device is end of life or no longer supports firmware updates?

Hi, OK, FG-60C, FOS v5.0,build0292 (GA Patch 9) in transparent mode (at a remote location unfortunately). I asked the tech on site to enable https administrative access on WAN1 so I could access the firewall for maintennace (other security measures in place to keep the bad guys out). Upon trying this, the tech reports that he gets an error about the configuration needing a " DHCP Server IP" address. He sent me a screen shot that not only shows the missing field but an option to enable and set up a DHCP server...??? See embedded image for more info. Default VDOM, no other configuration done and I had him do a factory reset from the CLI to " start over" (device not in use as of yet...fortunately). I have several other FG-60C system operating with the same build and I do not see this on them....any idea what' s up? It won' t let me set https admin access on WAN1 without this address.... Thanks....

Hi, I want to move VLAN subinterfaces from a 1Gbps port to a 10Gbps port. Is there a way of doing this without having to delete the existing subinterfaces and associated policies and recreating them on the new interface? Thanks, Ferdie

Has anyone seen forticlient fail to quarantine before? I attacked a screenshot of the virus alert. I also had forticlient perform an illegal operation on reboot but i unfortunately don't have the screenshot of that. After the reboot it just had a command prompt window open saying that forticlient performed an illegal operation and the reboot window was up again.  

Hi we have 2 branches ie. Ho and remote branch. I installed fortinet60 in HO and netgear router in branch. I can able to ping from ho to branch but unable ping from branch to ho. Please help to fix this problem. Thanking you.

So, I' ve read about the use of " Profile Groups" and I' m seriously considering using them. However for some reason or another, I can' t figure out how to enable " Profile Groups" in the GUI. I initially thought to enable them via the ' config system global set gui-profile-group' command or something to that effect, however it was to no avail. Can anyone help me out with this? I was going to post this under the UTM section, but didn' t find an appropriate topic for it. Thanks in advance.

Hi, haw do I have to uninstall forticlient on a Windows 8.1 computer? I' m unable to shutdown the forticlient (" shutdown forticlient" is inactive) and the software panel shows " repair" only. The FCremove Tool tells me to shutdown the client first which doesn' t work. I' m a bit confused about this situation. Please, can someone give me a hint? Best regards, Sebastian

Hi, I have a specific request from our new customer and it seems that it cannot be done. I need to create a monthly report for WiFi users traffic only where the MAC address is listed in the report, time and the destination address. It is OK but the problem is that it will return a huge ammount of rows and the PDF will be very big. I made a test were I generated a report for past 5 days, it returned 25686 rows whithin 9 minutes and the PDF has 12.8MB. When I set to generate the report for last 6 days the report did not finish. Now, after 39 hours, the report is still generating. I think it will be never finished. Is there any row limitation or PDH file limitation or something else why the report could not be generated? The CPU and memory are still on low values. FAZ-VM64 v5.0.5