Solved

Hi allI am new to Fortigate (this is also my 1st post to the forum) and attempted to setup FSSO. I followed the steps as described in this link (http://cookbook.fortinet.com/providing-single-sign-using-ldap-fsso-agent-advanced-mode-expert/), hiowever after completing all the steps - I can see the logins from my users in the FSSO agent installed on the DC, however I am seeing nothing on Fortigate. There is no user entry under "User & Device > Monitor > Firewall" - and from CLI I get the below: # diagnose debug authd fsso list----FSSO logons----Total number of logons listed: 0, filtered: 0----end of FSSO logons---- Did I miss something or do something wrong? Any advice welcome.

Hi all,On my 100E I ran an update from 6.02 to 6.04 and after the reboot, the web GUI was not available. Running a scan of the ports confirms that HTTPS isn't responding. The firewall appears to be functioning properly otherwise.I was able to access the CLI via the MGMT port, and confirmed that HTTPS was allowed on all the interfaces that I was trying.In Forticloud, under management\config, it has a message saying "device config version does not match device firmware version v6.0.4, build 0231." The device config version is still showing as 6.0.2, but the firmware version is 6.0.4.I'm unable to access the console at the moment (lost cable, looking for another). Does anyone have any thoughts?

Hello, Since FortiConverter is not a free tool, any advise for migrating from Cisco ASA to FortiGate smoothly?   

Introducing FortiMail 6.2FortiMail 6.2.0 has been approved and is being distributed to the support site.  This release adds several new features including:  MS Office 365 Active Threat Remediation FortiMail can now perform post-delivery on-demand scan of the email on MS Office 365 out of band using the MS Graph API (License required). Real-time scan will be added in future releases.  FortiIsolator integration FortiMail is now able to participate in the security fabric with FortiIsolator.  FortiMail can rewrite URLs on a per category basis to FortiIsolator for zero trust browser isolation. Fortinet Security Fabric Added support for the new security fabric integration using in FortiOS 6.2. Note that previous integration with FortiOS 6.0 is no longer supported. Compliance enhancements In order to comply with compliance standards such as GDPR, the following new features have been added: - Detailed  log of all configuration changes - Detailed  lo

Hi there,             I'm new to this community and fortigate. I have a question about sending syslog from public ip router to private ip solarwinds. The port for syslog is UDP 514 and it's already open in fortigate. In order to send syslog from a public ip to a private ip, what else do i need to do? Do I need to setup IPv4 policy? I never used fortigate before, so please forgive if question is stupid. Any advice would be helpful. Thank you!!

Hello guys, I have a VMware ESXi Server on my office, running FortiDDoS v5.2.0 just for testing and personal lab.I tried the same method to create management ip interface by typing "config system interface" then "edit mgmt1" then "set ip/netmask" etc.. but when i finish them all, and when i type "end" top save and exit, the system says "the attribute "type" must be set". i know what that means if that on fortigate, means the type of that interface, like vlan or anything else.. but when i typed "?" after i typed "set", there is no type.. and i tried type it manually, still cant.. i search at the fortiddos handbook, i follow the steps, there is no type.. but the system wont save the config unless i define the interface type.. So now, i cant access the GUI and dont know the management ip is.. i cant even change the mode to dynamic.. the system only gives static mode... i also done defining the gateway. Can someone help and explain to me? i tried reboot and change version to

Hi All Community,  I have a question about License renewal of fortigate Secutiy services, As we are using sonicwall and every 1 or 2 year we need to renew license for the services like content filter , Nodes/user, App control, content filtereing client, DPI SSL, DPI SSH, Boltel Filter and many more security services,  My Question is if i moved to Fortigate from sonicwall do i also need to renew security services after every specific time period? or  its just like one time pay and we can use those services for longer time ?  can anyone please inform me about this confusion that i have .  thanks  Usman Ali.  

Hi connections!!Like every other typical networks all my internal PCs are always sending DNS queries with port 53 to the internet. I want all those PCs' IP addresses and the DNS queries, they are sending to the internet. I have a Fortigate 100E; 2 ISPs; 1 LAN (192.168.1.0/24); No VLAN. For additional info: My Firewall's LAN port IP is - 192.168.1.1 and all the client are having that IP as their default gateway. Can anyone help me out? 

I am trying to generate a report to show the top applications by session count and the destination IPs. Essentially I have :Dataset 1 to show top applications by sessions.select appid, app, appcat, (case when (utmaction in ('block', 'blocked') or action='deny') then 'Blocked' else 'Allowed' end) as custaction, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth,count(*) as num_session from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and nullifna(app) is not null and policyid != 0 group by appid,app, appcat,custaction order by bandwidth desc Dataset 2 to show all the destination IPs by application and number of sessions.select dstip, app, appid, hostname, count(*) as total_num from $log where $filter and logid_to_int(logid) not in (4, 7, 14) group by dstip, app, appid, hostname order by total_num desc Dataset 2 does not sort the results by the *top* applications like in dataset 1 but rather by the session count, i have tried every SQL statement

Hello Dear Members please need to share your experience. i am novice Indeed I installed an open source application on my 2008 server, it works well in my LAN (with port 80), it connects via the internal fixed ip of the server 10.10.10.3:80. The server is connected to an internet network that has a public IP address (xx.xx.xx.xx) and which is also configured on a firewall. the Fortigate 60E Firewall can be accessed from the outside with the Public IP I would like to access the application and my server from outside via the internet. I want to know how to do NAT on Fortigate 60E and write the traffic / port to the internal address of the server,   Thank you for helping me please, I remain available

Hi All Members,  I have question regarting logging and reporting features,  I want to buy Fortigate300E but before buying i want ask few questions ,  i'm not sure if Fortigate300E has an Active Directory Connector and if we can authenticate users through native AD or at least LDAP. Need suggestions about it  and secondly  If i buy Fortigate300E do i also need to buy fortianalyzer or fortimanager for logging , reporting and monitoring ?  thanks 

If you don't create your SDWAN interfaces upfront you have to un-associate the interfaces with every policy to do so. This is a major PITA and wasn't an problem on Sonicwall. Time to step up the FG game here and make a wizard or utility or amend the OS to allow this to happen. This is very frustrating. Does anyone have any clever ideas? I was going to download the config edit it and re-upload it. However that sounds like I might open a can of worms. I called support, no known work-arounds. 

Hi all,I'm proposing the following setup for a small office with a Fortigate 80e. Is this the best way to do it?  They have two Cisco 2960x switches connected with fibre and one Fortigate with a WAN connection.  They need 2 VLANS which I have created on the switches and require one DHCP scope for each VLAN to have them separated and not accessible between each VLAN.  Should I connect each vlan to the FG80e separate lan port? IE VLAN 1 to LAN port 1 on the FG and VLAN2 to lan port 2 on the FG? Or should I only use one LAN por on the FGt and add each VLAN to that port? Whats the best practice here?  Thanks,Rob

Hi there,we recently upgraded our Fortigate from FortiOS 5.6.7 to 6.0.3 but have now problems with several "chat" applications, such as facebook web messenger, whatsapp web and so on. What we have in place- Explicit proxy- Proxy is authentication enabled- HTTPS Deep Inspection is enabled When we analyze the connection in the browsers, we see always that "wss://" connections are broken, such aswss://web.whatsapp.com/wsTherefor it is not possible to start web socket based applications It works when we exclude the domain web.whatsapp.com from deep inspection, but we cant do this for all domains world wide and we never had this problem with 5.6.x. So does anyone know how to resolve this in FortiOS 6.x? Any help is appreciated

I did not find it.and more question - trunk and  Aggregate is the same ?  

.

Hi Everyone, Does anyone know how Fortinet behaves when the FW acts as DHCP relay? I am trying to design a scenario whereas the clients in the branch need to go through VPN tunnel to get to the DHCP server in our HQ. We have a route advertised from HQ branch via OSPF to the branch about how to get to the server, also the branch advertises the route back to HQ, after that the closest route match in the branch will be default route which will go to internet (Which obviously there is no server available, since our server is within private range in HQ) Our concern is what happens if a client requests a DHCP address when the tunnel is down for any reason? I understand that clients won't be able to get an address, but specifically what happens when the tunnel re-establishes?  1. Does the FW maintains the connection from when the tunnel was down, then the clients will be matching the same connection which points to towards the default route, when the tunnel is back up? If

Hi all, we are getting reports from our forticloud, these include reports on possible "high-risk application use" / "Applications by Active Users" The issue is, they only indicate a number or in some reports are blank under the "user" column.  What components do we need the Fortigate so we need configure to be able to track actual user names in these reports?  See attached screenshot. 

Dear all, Im using fortigate 60E with 5.6 firmware. All users can work only for few minutes & the VPN suddenly gets disconnected. No error comes in. I have installed forticlient 5.6 aas well, but it also give same results

We have fortigate 300E ( india office) & 100D (US office) both are connected via IPSEC tunnel. Link speed US  office 10 Mbps down / 3 mbps UP Link speed India office 20 mbps down / 8 mbps now issue is on IPSEC tunnel when i copy file from India office  to US office it give me speed around 1 Mbps But in reverse it gave only 100-120 kbps On SSL-VPN tunnel its even worse when i copy file from SSL-client to US office it give me speed around 800 kbps But in reverse it gave only 30-50 kbps max can anyone suggest me something how can i increase the speed of data transfer from US to india or US to SSL use Thanks in advance  

Hello,I'm new to this forum and discovered fortinet since a few month now and i have several questions about it.We have a licensed Fortigate-90D with firmware 5.2.5 which is quite old, with IPS and UTM enabled.We have around a total of 1200-1300 sessions, and 5 to 15 new session per secondWe have a contracted provider which is supposed to care about anything but : - the firewall is not updated since at least 2 years- cpu load is stuck to 99% since at least 6 months (httpsd is eating 95%), and it's been 4 months i entered the company, the provider just said "change firewall, it's too old" So here is my questions :- We have a 4Mb link which barely goes to 2Mb bandwitdh usage but we have performance issues and disconnections, do the 99% cpu load could be a bottleneck ?- Does upgrading to 5.4.x, 5.6.x or 6.x have performances impact ?- What do you recommend to resolve my cpu load issue ? Thanks for your attention :)

Curious how these compare? Are both versions being widely used? Thanks in advance,

We manage quite a few fortigate's, over time life cycles of the Firewall vs. AP's with some of our clients got staggered. So for example, we have some FortiGate 60E's running FortiAP321C's.....not ideal I know, just the situation that we're in. What that above scenario seems to have created:Fortigate 60E - Latest firmware supported is 6.2.0+FortiAP 321C - Latest Firmware revision is 6.0.0 (Can't go to 6.2.0).  The general consensus among colleagues and myself is we try to follow is matching the FortiAP/Fortigate Firmware, no exceptions. However I can't seem to find any official Fortinet documentation suggesting they need to match. A lot of here-say, and in most cases people are not in this staggered situation we're in. Is it a sin to exceed the capable maximum FortiAP firmware revision with the Fortigate leaving the AP stuck on an older release?  What is the best practice in this scenario? Do we:A) Keep our 60E's one major firmware revision behind and stay

Hi,We have Fortigate with proxy-based inspection mode (FW:5.4.10)When web-filter module blocks a website, client have information in his browser.But when application control module blocks a website it is just blank (white) and after a while - this site is unavailable . Is it possible to change it?  

Hi Guys, I have issue with resolving a hostname using iPhone built in ipsec vpn. I was connected and was able to ping the ip address of the network but if we are accessing via hostname, it was not being resolve. I already configured the internal DNS in the phase-1 field but no success. Tried testing it in laptop using Cisco VPN Client and it works, the hostname was resolved. Please let me know what configuration I missed so that I can make it work. Thanks in Advance! Raquel