Solved

Hi , I have a 200Dbox which is running 5.2.1. Problem is ,in log the time is not appearing properly. Please see the below. Please help to fix this issue?

https://docs.fortinet.com....6.5-release-notes.pdf

Hello, I would like to know the difference between the internal ports and DMZ/WAN ports on the FortiGate 60E. Is it possible to create multiple VLANs on one internal port or it's only possible on DMZ/WAN ports ?See this picture for exemple : [link]https://i.imgur.com/NjusR2x.png[/link] Regards.

hello, i've configured syslog server on of our clients' vdom,including the configuration - config log syslogd override-setting <---     set override enable     set status enable     set server "CUSTOMER EXTERNAL SERVER IP (OMMITED for security measurments) "     set reliable enable     set port 601     set facility syslog <---     set source-ip "OUR VDOM EXTERNAL IP ( OMMITED for security measurments) "     set format default end config log syslogd override-filter <---     set severity notification     set forward-traffic enable     set local-traffic enable     set multicast-traffic enable     set sniffer-traffic enable     set anomaly enable     set voip enable     set dns enable     set filter ''    

Hello I am having a Samsung Galaxy S9+ with Android 8 and FortiClient VPN app is not working properly. Immediately after connecting I get disconnected again. On other phones it is working fine. Do any others have problems with Android 8, or have a solution for my problem? thx for help! 

When using "SSL Full Inspection" Question)1. Is it possible to set using "Trusted Public CA"?2. If possible   What kind of product should I buy? The only way to apply "trusted pravice ca" is to the manual. (http://cookbook.fortinet.com/preventing-certificate-warnings-cacert-56/) Thank you.

Hello, I've a question regards WAN failover and HA A/P design that I can't find the answer anywhere in the documentation.  Please check the attached diagram designed, the question that comes in mind is:[ul]If the link WAN1 from CORE1 to Port1 on of FS-1 goes down, then the Internet connectivity will be done through CORE1 - WAN2 as far as I understand.Is it possible to set it up, that instead of failover to use CORE1-WAN2 it uses CORE2-WAN1? The only way I've seen to set up this scenario is to enable port-monitoring on CORE1-WAN1 and then failover to CORE2. But in my opinion it seems a bit of extreme use to failover to CORE2 just only because the link between CORE1 WAN1 / FS1 Port1 fails.[/ul] Thanks for your help.

Hello, i want to ask, i have a fortigate with 2 internet connections,i want to make WAN 1 for server database and Active directory and WAN 2 for client, server database and AD is one segment with client, can i make that with fortigate? please help me.

Hi, We recently upgraded Fortimanager VM from v5.4.3 to v5.4.5.  While v5.6.x is in the plan, we haven't started our testing yet. One thing we noticed with FMG v5.4.5 is that there isn't any indication when a policy is Disabled.  It looks the same as enabled policies. In FMG v5.4.3, a disabled policy had both a Red 'X' and the policy line information appeared "greyed out". Has anyone else noticed this?  Is there a work around? Thanks for your time.Larry

.

Hello guys, I was trying trying to automate some tasks with Ansible module for FortiManager (https://github.com/networktocode/fortimanager-ansible), but stucked and need your help. My playbook successfully gets information from FMG and locks ADOMs, but I can't perform any changes because I get this kind of error:failed: [192.168.1.1] (item={u'bpm': u'12345', u'name': u'Customer1', u'addr': u'1.1.1.1'}) => {"changed": false, "fortimanager_response": {"result": [{"status": {"code": -10147, "message": "no write permission"}, "url": "/pm/config/adom/IBB/obj/firewall/address"}]}, "item": {"addr": "1.1.1.1", "bpm": "12345", "name": "Customer1"}, "msg": "Unable to Apply Config"}My user has all necessary permissions: FortiMgmt.dn.ukr # show system admin user ansibleconfig system admin user    edit "ansible"        set password ENC bla-bla-bla        set profileid "Super_User"  &nbsp

We have this issue with our Fortigate. After crashing iked we can't login to WWW interface and all IPSec tunnels are down. Is any idea why this happens? For fixing this issue need to restart iked and httpsd process or reboot device. P.S./ The CPU isn't overloaded and memory usage around 33% 816: 2018-06-16 04:53:33 <03432> firmware FortiGate-200B v5.2.13,build0762b762,171212 (GA) (Release) 817: 2018-06-16 04:53:33 <03432> application iked 818: 2018-06-16 04:53:33 <03432> *** signal 6 (Aborted) received *** 819: 2018-06-16 04:53:33 <03432> Register dump: 820: 2018-06-16 04:53:33 <03432> EAX: 00000000   EBX: 00000d68   ECX: 00000006    EDX: 40248ff4 821: 2018-06-16 04:53:33 <03432> ESI: 00000d68   EDI: ffffffc8   EBP: bffff658    ESP: bfffee8c 822: 2018-06-16 04:53:33 <03432> EIP: 40001012   EFLAGS: 00000246 823: 2018-06-16 04

hello there I'm completely new to Fortigate, and have some very limited experience.I configured a bunch of FG60E with very basic stuff, because they were meant to act like basic routers.I used to configure an ANY ANY All sources All destinations Allways allow policy on those FG60E running 5.6.3 The thing is that I had to aply the same "router" config to a FG100E (again running 5.6.3), and there is no "any" interface option under IPV4 Policy.Is that normal? or am I missing something. thank you very much in advance regards 

When the PC is connected via SSL VPN, it gets an IP (ie. 192.168.1.101).  The PC can ping any devices on 192.168.1.0/24, however when I tried to ping to the PC (192.168.1.101).  it is not reachable.  Not sure if there is some additional setting that I need to config? Remote PC (192.168.1.101)  <=> FortiGate FW <=> network elements (ie. 192.168.1.50) PING from 192.168.1.101 to 192.168.1.50 worksPING from 192.168.1.50 to 192.168.1.101 is not working (unreachable)

Hello, I am trying to determine if there is an firmware/OSVersion update available for one of our FortiAPs (FAP423E)[ul]It is attached to a FortiGate FGT81E on v5.4.8,build6501 Logged in to the FortiGate, under WiFi & Switch Controller > Managed FortiAPs I see the current OSVersion as: FP423E-v5.4-build6037Yesterday when I right click > Upgrade Firmware it was saying Failed to retrieve FortiAP recommended firmware updates. Today it just takes me to the Upgrade Firmware screen with Upgrade File with +Upload buttonSupported Upgrade Paths – FortiAP and FortiAP-S doesn't show anything matching build6501 and search shows No matching records foundSimilarly, SYSADMIN_NOTES search doesn't bring up anything[/ul]How can I find out if there is an update for our FAP423E in the 5.4xx stream (we are not currently looking at doing a point or major upgrade, just ensuring it is fully patched in the 5.4xx stream). Any help would be much appreciated!

Hello guysIn Fortigate, I'm using cache functionality in our navigation rules. The fact is that cache hits are small and the "non-cacheable" slice is very large.Would deep inspection help increase cache hits?What are the best practices for using cache in Fortigate?Is there a way to view what is this "non-cacheable" traffic is too large? hugs

Hi, We're running a pair of 1000C's in A-P (v5.0,build3608 (GA Patch 7)). We currently manage both FW's using MGMT1 with one dedicated IP. Does anyone how to give the primary and secondary separate dedicated MGMT IP's ? I'd like to use MGMT 1 on Primary and MGMT 2 on secondary - each with a different IP address. Thanks,PJ

Hello,I upgraded recently my FAZVM64 to 5.4.4 version. I have this alert message Log disk usage reached 90%, over threshold 80% and I want to increase the threshold to 95% in order to stop this alerts messages. When we configured the disk utilisation policy we calculated the disk usage at 95%. Does anyone have some clue about it? Thanks in Advance  

Hello, Actually we are moving on a dynamic VPN tunnels topology. We configured site A with B tunnel successfully, with OSPF over IPSec configuration. Then, we started to configure site A with C, but when we finished, no route was added. We did exactly the same we did between sites A - B, but no same result. Trying to resolve this, we did a get router info ospf interface and there is not the tunnels interfaces listed on both sites, just A - B interfaces and internal routing, but then we made an get router info protocols and there are listed network prefixes for sites A - B. Checking everything, is the same configuration on both cases, but one works but the other doesn't. I appreciate your answers. Thanks.

Hi experts, I have a FortiGate and I want to create firewall policies based on device detection for mobile devices. I realized that FortiGate can detect only some iPhone and Android devices. I have made a test with two iPhones of different models and iOS version. FortiGate recognizes iPhone 5 but not iPhone 6. The same with two Android phones. They all connect via Wi-Fi to Meraki APs, and the APs are connected to one Meraki switch and then this switch is connected to FortiGate. I know this is due to fingerprinting, but I don't know how to solve this, since right now I cannot create my firewall policies per mobile device detection due to this limitation. Any idea? Regards,Julián

hi, I would like to know if there is a way for my fortigate 800c to backup the config automatically every time I apply changes or maybe every period of time? Thank you, Raz.

Hello, Kindly refer to my attached picture. Recently I had installed the Point to Point Wireless from our plant 1 to plant 2. I've a planning to forward all HTTP traffic from Site A go out through Site B Internet. I have created a policy route. But the traffic still can't route to Site B. Please if there is anyone who can assist me i will be grateful. Thanks.

We upgraded our Fortigate 200D to firmware v6.0.0 on Tuesday and since then, some users have been unable to connect to the VPN. In my testing I've found what I think is the cause but haven't been able to fix it.   After the upgrade, when some users authenticate to the LDAP server(s) the password check succeeds but no AD group membership information is returned. For example: diag test authserver ldap LDAPSERVER username1 password1 gives us:authenticate 'username1' against 'LDAPSERVER' succeeded!Group membership(s) - CN=group1,OU=blahblah,DC=contoso,DC=com                                   CN=group2,OU=blahblah,DC=contoso,DC=com                                   etc. howeverdiag test authserver ldap LDAPSERVER username2 password2 gives us:authenticate 'username2' against

Hi We're considering swapping out our Palo Altos for Fortigate, one very useful feature on the Palo Alto's is its Dynamic Block List, which can download a text file filled with IPs/CIDR from our server which are then added to the Firewalls block list (blocks are removed each time the list is re-downloaded), this list is generated from a script that correlates all the different IP threat lists, such as DShield, Shadow Server etc. How can we achieve this with Fortigate, i.e. downloading the list adding the IPs to the block list. I've search high and low, but can't see a similar feature. Thanks

Hello, i have a problem sending out FortiToken email confirmations...It was working fine and for the last two days, the emails that are sent are not correct and the users can't activate their FortiTokens on their accounts.The email has the wrong expiry date for the Token (1970!) as well as there is no serial number or QR Code to activate the token... Below I have  a copy of an automated email sent from a Fortigate 200D running OS v5.4.0,build1011 (GA) and has the correct time in the system Mon Apr 11 19:11:04 2016 (FortiGuard) Any help would be much appreciated! Regards,Thanasis Welcome to FortiToken Mobile - One-Time-Password software token. Please visit [link]http://docs.fortinet.com/ftoken.html[/link] for instructions on how to install your FortiToken Mobile application on your device and activate your token. Your Activation Code, which you will need to enter on your device later, is "" You must activate your token by:  Thu Jan  1 01:00:00