Solved

i am using fortigate 1000c i am trying to create a custom signature to block web traffic on windows xp computers. i am getting error invalid index code. please do correct the below syntax. F-SBID( --attack_id 8151; --vuln_id 8151; --name " Windows.NT.5.Web.Surfing" ; --default_action drop_session; --service HTTP; --protocol tcp; --app_cat 25; --flow from_client; --pattern " Windows NT 5." ; --no_case; --context header; )

I have a FWF-60D that i have created a software switch to bridge the Internal and WIFI networks into a single network. I also have a DMZ network, but when I do a file transfer to the DMZ network from the internal, I only get about 23MB/s. While transferring I also see the CPU usage @ 100%. Is this a by product of the software switch? my knowledge leads me to believe in this scenario I am CPU limited and not hardware limited (GbE). Am I on the right track? Are there any other ways to achieve this?

Hello, I' m currently testing single sign on using two collector agents in polling mode monitoring my two domain controllers (the domain controllers don' t have a DC agent installed). All the work is in a test network, so the production environment is not affected, eventually I will need to replace my current firewall and SSO solution with Fortigate. Everything works as expected, except that every 5 to 10 minutes I loose all connectivity through the fortigate cluster to all networks and services and I have to log off and log in in order to have access again. I have set the values of Workstation verify interval and Dead entry timeout, on both collector agents, to 0 (zero), still the problem remains. Has anyone experience a similar issue, where can I look in order to find out what is going on and eventually fix it? Thanks in advance.

Hi There, We are trying to develop a custom IPS Signature to assist in protecting brute force login attempts. We would like to match a URL (e.g. a_login_page.php) if it is accessed X number of times within X number of seconds - and then be able to monitor/block/quarantine from there. Currently we have the following: F-SBID( --name " Website.Login.Brute.Force.Custom" ; --protocol TCP; --service HTTP; --flow from_client; --pattern " a_login_page.php" ; --no_case; --context host; --rate 10,60,limit; --track SRC_IP; ) In theory we are counting 10 accesses within 60 seconds and counting those accesses strictly.. but what we have found is that if a client accesses http://www.awebsite.com/a_login_page.php and the login page includes other elements such as images, the count is including the images as they are refered by the page (we think!). In this case, its easy for a real client to trigger the attack as they might have 2 or 3 attempts to access. I have a feel

FortiGate-60D v5.0,build0271,140124 (GA Patch 6) I am probably missing something, but I seem to be unable to create new security profiles using GUI. Antivirus, Web filter, Application Control, IPS profiles page all offer the possibility to edit the shown profile (which I assume is the ‘Default’ profile) but give no option to create a new one or edit another existing profile. Is this normal behavior with this Fortigate model and have to manage Security profiles in CLI only? Thanks, Sherpa

I' m using 5.03 on a 100D. I' ve set up my LDAP server, which test successfully using the test button and I can authenticate the admin user used to create the LDAP login. I then create two AD groups. One for all access to the internet one with filtered access. I create two firewall groups (as directed by support) with the respective groups specified via cn. My AD groups do not show up in the Forti OS anywhere as to just add them as an FSSO group. I am unable to get anything to authenticate via LDAP. When I use the diagnose dbug authd fsso list command, I get the following: ----FSSO logons---- Total number of logons listed; 0, filtered: 0 ----end of FSSO logons----- I am new to this, but I can read. But the documentation seems all over the place and opposite of what support has directed...now I get no response... Can anyone give me any indication of wth I' m doing?

I have a client that is trying to do something that I have never done before, and I cannot seem to come up with a way to make this work. The scenario is this. They have a remote branch that has two Internet connections (only two available). The first (cable) is fast, but unreliable and the second (DSL) is slow but reliable. The main site has one high speed very reliable connection. There are two tunnels, one for each connection at the branch. They would like almost all traffic to use the DSL and fail over to the cable (easy). But, they want some traffic (offsite backups) to use the cable primarily, and the DSL as backup. This is where I am running into a wall. I have a picture attached for reference, hopefully it makes more sense then the post. I have tried using policy routes on the 60D, but either I am not configuring it correctly (most likely) or it won' t work to choose which tunnel to use. Let me know what snippets of config you would like to see and I can p

I have a FAZ100C in my LAB which has run out of service. now i wanted to test the new release 5, but noticed that the hdd probably went dead, as i am spammed with a2.00: exception Emask 0x0 SAct 0x3 SErr 0x0 action 0x0 ata2.00: irq_stat 0x40000008 ata2.00: cmd 60/08:00:b7:05:7d/00:00:06:00:00/40 tag 0 ncq 4096 in res 41/40:00:b7:05:7d/00:00:06:00:00/40 Emask 0x409 (media error) <F> ata2.00: exception Emask 0x0 SAct 0x3 SErr 0x0 action 0x0 ata2.00: irq_stat 0x40000008 ata2.00: cmd 60/08:00:57:c0:f4/00:00:43:00:00/40 tag 0 ncq 4096 in res 41/40:00:57:c0:f4/00:00:43:00:00/40 Emask 0x409 (media error) <F> ata2.00: exception Emask 0x0 SAct 0x3 SErr 0x0 action 0x0 ata2.00: irq_stat 0x40000008 ata2.00: cmd 60/08:08:57:c0:f4/00:00:43:00:00/40 tag 1 ncq 4096 in res 41/40:00:57:c0:f4/00:00:43:00:00/40 Emask 0x409 (media error) <F> ata2.00: exception Emask 0x0 SAct 0x3 SErr 0x0 action 0x0 ata2.00: irq_stat 0x40000008 ata2.00: cmd 60/08

Hi all, I am new with Fortigate, and I have a question: I have a Fortigate 100A unit in office (internet is provided by ADSL line with static IP), and SSL VPN clients that connect to it. Is it possible for clients to use my office’s public IP “to exit on internet”? For example, my office’s IP is 79.124.56.4, and the client' s public IP is 66.54.45.78: when client connect to VPN I would like that public IP becomes 79.124.56.4 Thanks in advance for help :) Regards, Jack

Hi all. I´ve configured a FL100 and I want to repair database. I Follow this steps: 1- Change logs mode from standalone to collector 2- Disable sql database 3- remove database: execute sql-local remove-db All from cli. But i can not enable database again: 1- Change collector mode: config system global set log-mode standalone end say: start sql database failed. Command fail. Return code -39 2- Start local database: config system sql set status local end say: Do not allowed enable SQL in collector mode. object set operator error, -254 discard the setting Command fail. Return code -254 I cannot change to standalone mode without database and cannot enable database in collector mode. What can i do? Thank you in advance.

So we block the web hosting category for our users. I also have the check box for rate url' s by domain and IP address checked. Lately alot of users, when they try to go to some pages (not sure exactly which ones) get blocked from the sites. In the URL, it has the IP address of the site that is blocked, and the category is webhosting. When I do an nslookup of the ip addresses, they are all either akamai.net or akamaitechnologies.com, which I know are backend servers for alot of sites. So what I have been doing is putting in a ratings override for the IP address into a category that is allowed. If I understand correctly, even though I put in the rating override, if the URL is in a category that is allowed, it will then allow the site. However, if it is something that isn' t, like facebook, it will still block it? Correct?

I' m trying to get rid of any any allow rules (yes there are some). So i thought about using the FA for this, but i am missing an option for Top Source destination by service (by Volume or Sessions) But i only find Top Services by Volume Top Source Desination Pairs by volume Top Desination Source Pairs by volume Top Service by Volume for most Common Sources Top Service by Volume for most Common Destinations Ideally i' d like to get the currently most used " conversations" between source&dest and the used protocol to gather whether create a allow or deny policy. Any hints on how to achive that with FAZ? FGT is a HA Cluster of 110C running 4.2.7 FAZ is a 1000C running 4.2.5

Is it possible to exclude an IP address from being scanned by the IPS/IDS?

Hi, just a short question: We use the FortiClient SSLVPN (the small Client, only SSLVPN!) for Client to Site VPN. If we have to perform an Update of this client, we need to configure the whole stored Sessions manually after that, because the " old" Client were complete uninstalled. Is there any possibility to backup the sessions and restore this after an update of the Client? It`s a list of round about 12 Sessions with different settings, because these are different customers environments...

We are going to be sharing an office with another company. We are going to have two internet connections that we would like to share with each other. Both connections have 5 static IP addresses. We will use three or four of these on each connection and the other company will use the other one or two addresses on each connection. For simplicity sake lets assume only one connection for now as I should be able to make this work on the other connection once I get it figured out on the first one. I have read through the VDOM guide and unfortunately there are no real good examples using a situation like mine. The way I would like to set this up is with a management VDOM and then a VDOM for each company. Both companies require Virtual IPs setup for some external services. I think I will need to use a Vlink connection between the management vdom and our two companies. I am not sure how to translate the external ip addresses using Virtual IP into the correct VDOMs. If anyone coul

Hi all, As I am relatively new to the subject, please ignore the simplicity of the question: We have a fortigate 110C with 4.0 MR1 Patch7. Recently we installed the FSAE package on our MS-domain controllers to be able to alllow/block access based on AD-users or AD-groups (that is at least what I understand what should be able). Now, if I configure a policy with the Identy Based Policy option activated, I can add a previously AD-group defined to have access to a certain service, for example HTTP/HTTPS. However, all other users not belonging to the selected group are blocked to the HTTP/HTTPS service, while my expectation would be a fall through to the next policy, which would give me the same way of working with IP-based policies. The group used in the Identity Based Policy option is a Directory Service group created through the User, User Group options that includes a group from the AD-server Thanks in advance.

After reading several of the forum post on both Fortinet and Microsoft, I still am not able to get RADIUS authentication from an FLG100B (analyzer) and MS Windows Server 2008 SP2 (not R2). I think I am missing the required fields necessary to validate the admin authentication. *Each device and ping one another *Firewall on the server is disabled *NPS is working for VPN and Dialup access *RADIUS key is eight characters long (attempted with and without special characters) * The default " Use Windows authentication for all users" is present and valid *Referenced http://docs.fortinet.com/fgt/handbook/fortigate-authentication-40-mr2.pdf

I' ve recently modified a route and also deleted a route. Neither change shows in the acting routing table. It still shows what was previous to the changes. Any ideas? FG10CH3G09620149 (root) # sh router static config router static edit 1 set device " port1" set dst 10.98.169.192 255.255.255.192 set gateway 10.98.130.250 set weight 50 next end FG10CH3G09620149 (root) # get router info routing-table static S* 0.0.0.0/0 [10/0] via 172.16.155.33, wan2 S 10.98.139.192/26 [10/0] via 10.98.130.250, port1, [0/50]

Hi All, I' ve set a PPPoE password in FortiGate. Now, when I backup configuration to my local pc, the password had been hash or encrypt into " O+5MYduEK/YD0mpLG3TLu0EqzqaP2h9oByvk8qoRLs4oHzkIdIggVhOClI8T0wRTDbm8V4" If I forgot the original password of PPPoE, can I get the original password from backup configuration ??? thx !!

hi, I have in url filter www.facebook.com block and the url filter is enabled on protection profile, and yet so well is connected to facebook buscar

Hello there, I want to know how i can delete all sessions opened from a particular client IP address, instead of delete single sessions by clicking delete icon on Session Details. Imagine if a client had hundreds of sessions opened. There should be way from CLI. Thanks in Advance. FostiOS v4.0.0,build0092

I' ve got a Fortimail 100 on evaluation for the next week, have it running in gateway mode behind a firewall (Fortigate 300A) and is scanning externally send incoming email no problems on Exchange 2003. The problem I have is that it isnt scanning internally sent outbound mail, the admin guide says configure the email client' s outgoing smtp server to be the Fortimail but I can' t see how Exchange lets you do this. Any replies would be greatly appreciated. Cheers Dan

Is there a way to set up PEAP authentication against Windows AD? For example, the goal we are trying to achieve is for a user who is in wifi range to be automatically connected to the wifi network using WPA encryption and Windows domain credentials. In other solutions the AP talks to the Windows IAS server, which is set up to allow access based on Windows domain groups. Is anything like this possible using the wifi 60a?