Solved

I am going to upgrade our fortinet boxes from 5.4 to 5.6 in upcoming weeks.our FSSO  agent running on our server  is on version 5.0.0247do I need to upgrade the fsso agent or is that version compatible with all 5.x versions?

I try to eplain this to you: if you create a mapping in the objects section of FMG Policy & Objects and you use an interface that already has a mapping you get notified about this and FMG reports that if you save this you are going to replace the old (=existing) mapping. So far this is fine. You get to know that there already is a mapping and you could choose wether you want to replace it or not. Everthing ok here. If you use an interface e.g. in a policy but forget to do a mapping for all FGT this policy is to be rolled out to, the FMG will notice that upon its integrity checks it does before it rolls out anything. It will then prompt you for the missing mappings so you can complete them. So far this is fine too. When you then choose an interface of the FGT to complete the mapping you get all interfaces of the corresponding FGT in the drop down and you do not see which already have a mapping. Also you get interfaces that cannot be used as destination or source

Hi all, I am trying to fetch raw logs using the FortiAnalyzer SOAP API and the searchFazLog API method, but I am unable to authenticate: I keep getting the -101 error code and "Invalid user/password or adom" error message. I have tried authenticating using local account credentials as wel as a domain account credentials, both without any success (these creds work when logging in via the web interface). I have also tried adding the HTTP basic authentication header, no game unfortunately. We are currently using FAZ 5.2 (https://docs.fortinet.com/uploaded/files/2091/fortianalyzer_admin_520.pdf) Here is the example of my request and the response: [link]https://pastebin.com/Tr57D2Lv[/link] Can anybody point me in the right direction, as I'm sure I'm missing something trivial. Cheers,deacs

Hi  As I understand it a user logs on to the domain, the FSSO agent captures this logon and sends it to the Firewall, does anyone know how long this event stays live. I have an issue where users are in the list of logged on users in the morning but later in the day the seem to be missing and therefore lose internet access. Nick. 

https://docs.fortinet.com...os-6.0.2-release-notes

I believe this was an issue with older versions of FortiOS previously. When going to Authentication -> User Management -> User Groups, I hit create and target my remote LDAP (Windows AD), and try to specify the LDAP filter. The filter returns nothing when trying to use the memberOf property to grab members of a specific AD group. When using the information from the Administration Guide to create the filter as per the example, it also fails. I can add the group directly (Windows AD group under User Group), but it won't recognize the users within the group when I try to use FortiToken. If I go to Authentication -> Remote Auth. Servers -> LDAP -> My Win AD Setup -> Remote LDAP Users -> Import users by group memberships, this will work. Is there a way around this, or to make it work? The best I've come up with is to import the users by group memberships, and then in User Groups select the "Set a list of imported remote LDAP users". But this is a manual proces

Hi, I've got a short question regarding the ForitAuthenticator. We are setting this device up for ourself and for one of out customers. The customer needs to have it's own Admin Profile to create users and should only see it's own organization. The problem we are facing right now is that the customer admin can see all the users even outside it's own organization. Is there something we're missing? Kind regards,Tim

Hi everybody, I've got a strange problem with an Authenticator and Fortigate. We've configured an Authenticator as LDAP Server.The Fortigate authenticates against the Authenticator. When I create a new user this user is discovered by the LDAP connection, this works fine and I'm able to login with this user. But when I creat a token (mobile app) for this user and try to logon, I get the message "Permission Denied".Unassign the token and the user is able to login again. I also tried to change the token to e-mail verification, after entering the credentials I immediately get premission denied.2 seconds later I get an e-mail with the token but can't enter it. So the Fortigate does authenticate agains te FAC and sees the user has a token setup but it's stuck on the permission denied.This is a part of the log:[344] start_next_dn_bind-Trying DN 1:uid=tim,cn=LOCATION,ou=EXAMPLE,dc=EXAMPLE,dc=EXAMPLE [1701] fnbamd_ldap_get_result-Going to USERBIND state [2832]

Hello, I'm currently running on 1.2.5 version of FortiClient EMS and I would like to update it to 6.0.2. I was wondering if there was any procedure to follow to complete the update without major trouble ? Thank you for your help, have a nice day. B.

Dears,I was creating a services in object tab and I saw option of specifying multiple port number by choosing TCP or UDP in one service object, then y we need the service group object when we get an option to specify tcp and udp multiple port number in one service. Please find the attached service config snapshot thanks  

Hi all, I just want to ask if policy based routing replaces static routes? We have 12 or so remote sites on IPSEC site to site VPN's and we have recently had done so ALL traffic goes up via the VPN to our data centre and out through our main firewall. but we also want to do so all remote sites can get to all the other 11 remote VPN sites.  Now for ALL traffic to go out via the VPN up to our main firewall we used policy based routes that is configured like the attached picture shows. But i am sure i had a firewall about a month ago when i could not get to another remote VPN site that i had to add a static route in as well. can someone please confirm/deny this behaviour? I do not really want to add in all our 26 networks into each remote VPN site into static routes if i dont have to. Thank you in advance   

Hi All, I'm familiar with Hardware Switch mode on the FG200D series, however in 5.2 firmware have seen VLAN Switch mode. What is the difference, as you can create VLAN's on a hardware switch interface too? From the GUI there doesnt appear to be a difference, unless you can tag and untag VLANs on members in the VLAN Switch mode from the CLI ?

Anybody successfully set up Additional DHCP Option 43 (config sys dhcp server > config options) to map a url to IP for a third party vendor? I'm trying to make setting up some Ubiquity (UniFi) devices behind a FortiGate somewhat simpler, by providing info in DHCP Option 43 to point the UniFi devices to the UniFi controller (which is not on the same subnet). Per the UniFi docs, I could do this by having DHCP Option 43 look like the following Linux example pulled from their docs: # ... option space ubnt; option ubnt.unifi-address code 1 = ip-address; class "ubnt" {     match if substring (option vendor-class-identifier, 0,     option vendor-class-identifier "ubnt";     vendor-option-space ubnt; } subnet 10.10.10.0 netmask 255.255.255.0 {     range 10.10.10.100 10.10.10.160;     option ubnt.unifi-address 201.10.7.31; ### Unifi Controller IP ###     option routers 10.10.10.2;     option broadcast-addres

Hello, I need to completely remove a switch interface and replace it with an aggregated Interface that must use the same IP address. The new aggregated interface have to provide all the services and access that the switch interface currently have and provides. That includes, DHCP service, NTP, relations to VPNs, policies, relations with address objects and groups, etc. I extracted the information running the command "show | grep switch_interface_name -f". 1) Should I consider any other command to extract more configuration information related to the switch interface? 2) What is the quickest way to completely remove the switch interface from the system? 3) After removal, if I take the extracted information related to the switch interface from the configuration and replace the name value with the name of the new aggregated interface, Will that recreate everything with the new aggregated interface? again routing, NTP, relation with the VPNs, DHCP server, policies, everything Best regar

hello all, I've got a pair of FG-200B running v4.3.18 in A-P HA mode. Each cluster member is at a different location, HA links are across a dedicated line. On each site, there is one Cisco access router (19xx) in front of the FGT providing WAN access. These routers form a VRRP pair. (No VRRP for the FGTs as config sync is requested.) Now, when the WAN line on one site closes down the routers fail over in about 15 s. But, as the link status of the FGT WAN port does not change, the FGTs do not fail over. So I configured a pingserver (gwdetect) on the FGT which is the next hop router. That doesn't work as expected though. When one WAN line is down, the FGT still can reach the next hop router because the Ciscos have failed over, providing internet access across the HA link line. That's a catch22 I guess. One solution would be that the router, when detecting it has to fail over, pulls it's port to the FGT down. FGT would sense a link failure and fail over as well. Q

Hi all, still in pre-production but I was wondering how I can turn off the now(since 5.6) forced SSL/SSH inspection. I know it is becoming more and more necessary, but for now, in our environment, it is causing us much more headaches than benefits. Eventually, we want to get there, but the time isn't now. I was told there is a way in the CLI to turn it off. I can't seem to find the right cookbook/Document explaining how.  Anybody running 5.6 that might know where to look to get this turned off? All the info I can find dates back to 5.2 and the same commands don't apply to 5.6 anymore. Any help will be greatly appreciated. Ben

today v5.6.3 has been released... I'm curious...starting from this version, are you using lazy-loading to improve page loading???

Hello, many confusing posts and discussions regarding the proper way to handle Comcast's EDI with /30 PTP network for connection to the Ciena Router and the public user block provided with the same service.  In our case it's a/28 block of useable ips.  We have also put a L3 switch in front of the Fortigate and connected the Ciena PTP to the switch on one vlan, and provided for the useable ips on another vlan.  I have been wanting to eliminate the L3 switch in between and directly connect the Fortigate WAN1 port to the Ciena, which I have done, but want to use the other block of ip's.  I setup Port 14 (was available, no other reason) on the FG with one of the ip addresses from that block and have connected a device to that port with another ip from that block.  I can ping the FG port from my laptop while on the lan.  I have created a policy that allows all traffic from the wan side to the port14 interface with the public ip address on it but I can not ping

So, I have at least 3 FortiGates (5.6.x) in my environment where they are miss-categorizing URLs as "Phishing" even though FortiGuard says they "Government and Legal Organizations".  Manual overrides can be created and do work; sites are also categorized as "Government and Legal Org" in the Original Category column; it's like my FortiGates are not accepting FortiGuard's categories for some reason or another.  [Support Ticket Number: 2931401]

Hello,I was suggested that I test the following commands: config firewall settingsset sip-helper disableset default-voip-alg-mode kernel-helper-basedend However I get that the command isn't recognized for config firewall settings. This is on a FortiWifi 30E running 5.6.5. How can I disable the sip-helper on this OS version? @Fortinet - Please for the love of god, update your website documentation for each version. 5.6+ Has a completely different interface and a lot of commands have changed. Makes the documentation almost useless. So frustrating.

I was running out of disk space on my FortiAnalyzer VM, so my VM Admin doubled up the space.  I did a reboot and it did not see the increase, so I upgraded it to 5.0.10, and it still does not see the increase in space.   What do I need to do for it to recognize the expanded disk space? Thank all of you for any assistance! Travis

Hi Guys First post here so please go easy on me! ;) I'd like to be able to create a report that contains a chart the number of denied connection attemps that are made, per country, from the internet.   From Log View I'm able to see this information by putting in either of the following filters:smart_action="Policy violation" -srccountry=Reserved orsmart_action="Policy violation" -srcip=172.16.0.0/12,10.0.0.0/8,192.168.0.0/16 When I click on 'chart builder' I see the following queries: select `srccountry`, `dstip`, `service` from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and ( ( ( (`action`='deny') )) AND (lower(`srccountry`) != lower('Reserved'))) select `srccountry`, `dstip`, `service` from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and ( ( ( (`action`='deny') )) AND (not (`srcip` <<= inet('172.16.0.0/12'))) AND (not (`srcip` <<= inet('10.0.0.0/8'))) AND (not (`srcip` <<= inet('192.168.

Hello, we have a bunch of Fortigate devices which are logging several times (about 100k logs in 15 minutes, each device) on our logging platform (we use ELK), and this is overwhelming the disk space. How can we disable the logging on the "default deny policy' in order to stop these logs? Below is the log message that is filling our disk space: <189>date=2015-07-30 time=10:24:41 devname=fw01-xpto devid=FGT60XXXXXXXXXXX logid=0001000014 type=traffic subtype=local level=notice vd=root srcip=XXX.XXX.XXX.XXX srcport=137 srcintf="internal1" dstip=YYY.YYY.YYY.YYY dstport=137 dstintf="root" sessionid=2253947840 action=deny policyid=0 dstcountry="Reserved" srccountry="Reserved" trandisp=noop service="137/udp" proto=17 app="netbios forward" duration=0 sentbyte=0 rcvdbyte=0 sentpkt=0 Thanks!!

Hi, Fortinet GURU's    Could anyone please help me out here?     I created FortiAnalyzer (BYOL) instance on AWS and allocated 200G volume for the instance in the first place. Then I created 2 50G ADOM's on FortiAnalyzer. Everything worked fine. Each VDOM was assigned to one ADOM and logs were sent to FortiAnalyzer.     I wanted to create more ADOM's with 50G each, however, there's only 1GB available left. I stopped the instance and increase the volume from 200G to 250G and then restart the FortiAnalyzer instance. The weird thing was that FortiAnalyzer didn't seem to detect the increased volume. It still showed "1GB available".     What should I do next? I searched some documents which mentioned "RAID". But from my 5.6.5 FortiAnalyzer GUI, there's no such "RAID management" option under "system settings"...     Much appreciate for any guidance! 

hello there, I am wondering if it is possible to get multiple sites connected to one HQ with VPN. As i only see the Site-to-Site wizard, where you have to say what is the IP of the branche office, I am not sure how to do that. DO i just need to redo the same wizward, with the same local IP but different branche IP? Thanks,Raffael