Solved

Hi guys, According to NSE4, FortiGate will generate traffic logs once a firewall policy closes an IP session. What does that mean? Does that mean when FortiGate sends a FIN packet to the server? Or does that mean when FortiGate sends an ACK packet after it has received a SYN-ACK from the server? I guess is the second option. Could you confirm? Regards,Julián

I learned about the ha checksum on Fortinet , the "link". some of the contents as follow : The following command output is for the primary unit of a cluster that does not have multiple VDOMs enabled:diagnose sys ha checksum showis_manage_master()=1, is_root_master()=1debugzoneglobal: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e 0b 9b 77root: 43 72 47 68 7b da 81 17 c8 f5 10 dd fd 6b e9 57all: c5 90 ed 22 24 3e 96 06 44 35 b6 63 7c 84 88 d5 checksumglobal: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e 0b 9b 77root: 43 72 47 68 7b da 81 17 c8 f5 10 dd fd 6b e9 57all: c5 90 ed 22 24 3e 96 06 44 35 b6 63 7c 84 88 d5The following command output is for a subordinate unit of the same cluster:diagnose sys ha checksum showis_manage_master()=0, is_root_master()=0debugzoneglobal: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e 0b 9b 77root: 43 72 47 68 7b da 81 17 c8 f5 10 dd fd 6b e9 57all: c5 90 ed 22 24 3e 96 06 44 35 b6 63 7c 84 88 d5 checksumglobal: a0 7f a7 ff ac 00 d5 b6 82 37 cc 13 3e

Hi, I would like to block www.facebook.com, but I would like to only allow access to a specific facebook URL eg www.facebook.com/radiowave So Users should not be able to access facebook but should be able to access the company facebook page. How can I accomplish this? Thanks

Hi I have Fortigate 500d with 5.6.2. When captive portal without any authentication is enabled on an interface and someone clicks through the disclaimer page an Undefined user gets listed in the Monitor > Firewall Users page in the firewall. This also makes it so that page will not load it just sits with the loading icon forever. Can anyone else verify this happens with their system as well.  

Hi all, I need to set up a disclaimer only captive portal for our public wifi users. Now the thing is that our wifi infrastructure is based on Cisco and I want to use the FortiGate as default gateway for our public wifi. I need the FortiGate to provide the captive portal and to do the traffic filtering. This means that I want to set up the captive portal on the lan interface of the FortiGate where the wifi traffic comes in. I don't want an authentification captive protal it just has to be a disclaimer that the user has to accept so he can connect to the internet. Unfortunatley I am only able to choose "Authentication Portal Local or External" and there is no option to choose the disclaimer only type. How can I solve this? Thanks for your help! Br, Alex 

Hello, I have a FortiGate 60E, but I need to add 2 devices on the LAN, that works as WAN, instead of the WAN port, that has only one port. Can I create a Hardware switch interface, add two physical ports and use it as WAN ?? I mean, as a L2 interface with a virtual IP included ? Thanks

Have a Fortigate 60D running 5.6.3.In the User Groups I have three groups, I can edit two of the groups but when I try to edit the third group I get the spinning ball of death.Nothing happens. Is there a way around this?

Hi,I know, it's possible in Fortigate that user could get Authentication Page prior to accessing the internet. But i want to know if it is possible that user would get the 'Logout' page after work is done and the user itself will Logout so that the bandwidth will not be used and there will be no load on network. The user could be a AD or Workgroup.Thank You

I have a test environment that has restricted navigation, I would like to avoid sending the logs to forticloud because the are confusing when looking for something.Is there any way to exclude that interface or a range of ips from sending the logs?

I have a problem with the SSL VPN application. The application does not contain some security headers. X-XSS-Protection X-Content-Type-Options Strict-Transport-Security I opened the call with the support, but the attendant did not help with anything effective. Just said that there are some fixes in version 5.4.8. So I asked him to send me the result in the "curl -I https: //IP_OF_FOTIOS_5.4.8: PORT_OF_SSL_VPN --insecure" command, as evidenced by this being corrected.  Note that the headers are not present in the response sent by the support. So no correction was applied for this.As an example, I put the output of the command executed in google, showing how it should be a safe response. I would like to know if anyone knows if this is configurable in FORTIOS, and how does it work? I have FG 80C.

Hi experts, How can Application Control detect applications over encrypted traffic? I am using Application Control and works fine, I can block youtube videos, facebook and so on, over HTTPS, so the traffic is encrypted. But I am not enabling deep inspection and it can detects applications anyway. How can Application Control do this without enabling deep inspection? Regards,Julián

Hello Team, I am using Fortigate 50e Model in SOHO environment and would like to block all the cryprocurrency related website. I am seeing 'Monero Cryptocurrency' logs. Any recommendation how to do that? Thank You! Mayur

hi there,I want to make certain host (based on IP) can't accessible from some IPs.the purpose is, DHCP user can't access certain hosts on the same interface. the user only can use/connect public hosts (such as network printer).already try to make :- policy interface_1 to interface_1, from dhcp IP to IP public hosts.- policy interface_1 to interface_1, from dhcp IP to certain IP, blocked.- policy route, from dhcp IP to certain IP, blocked.alll policy use subnet mask 255.255.255.0 those policies not work. any advice would be grateful. thank you.

Dear IT Folks, I'm facing with issue while trying to allow https URL on my FW Fortigate 300C. I'm using v5.2.13,build762 (GA).Firstly, due to company policy, we have to block all of URL. I was set up URL ="*", Type=Wildcard, Action="Block"; Hence, no one can access to internet.However, I allow multiple certain URL for accessing. For example: I was set URL= *.meeting.nice2meet.us/*, Type=Wildcard, Action="Allow".But user can only access it if those website is using HTTP, they cannot access if website using HTTPS.Please help me to take a glance and give me some idea.Thanks a bunch.

Hi,I'm planning upgrade 600c cluster from 5.2.11 to 5.4.8 firmware. What is the best upgrade path ?Because in https://support.fortinet.com/Download/FirmwareImages.aspx Upgrade path tab I even cannot select 5.4.8 firmware 5.4.7 is available only, and suggested uprgade path looks like this: 5.2.11->5.4.6->5.4.7  

I'm trying to configure IPsec VPN on a Fortigate 80C, and on a Cisco ASA 5505 firewall. Fortigate 80C is running v4.0, build0646, and Cisco ASA 5505 is running 8.2(5), with ASDM 7.12.I configured Site-to-Site on ASA and assigned a peer IP address of the FortiGate unit. I assigned a pre-shared key as well. ASA and FortiGate, both have matching pre-shared keys and identical phase 1 and phase 2 settings. When I log into FortiGate using web interface, I go to Log & Report and click on Event Log. For Action I see negotiate with a message saying IPsec phase 1 error, and Error Reason no matching gateway for new request. It has ID 37124.  ASA can ping outside WAN IP 172.16.1.6, ASA can also ping IP 192.168.131.77 located inside its LAN network.FortiGate can ping outside ASA IP 172.16.1.3, and it's internal LAN of IP 192.168.161.7.My goal is to be able to ping from FortiGate internal IP 192.168.161.7 to ASA's internal IP 192.168.131.77.Any help is greatly appreciated. I'm wil

In the process of upgrading a FortiGate 60E from 5.4.6 to 5.4.7. It looks as though I need to get a special build to do this as the upgrade page of the UI says that I can not upgrade from FortiOS v5.4.7 build1167 from FortiOS v5.4.6 build6408. I presume that I need to download FortiOS v5.4.7 build6453. Is this correct? While looking for the correct image to download I noticed a listing for 5.4.8.https://support.fortinet....ad/FirmwareImages.aspx Has this been released? Has anyone tried 5.4.8 yet?

Hello,Can you enligth me on this problem, I have a Fortigate 80E and I have also many switch, I need to connect my switch on the fortigate ( with VLAN 192.168.1.X/24 ) for example , and I also have an equipment directly connected to the fortigate from the same vlan (192.168.1.XX/24).It is possible to make a solution on the fortigate to connect these two equipment ?I tried to make an hardware switch (IP :0.0.0.0) and a VLAN( ip :192.168.1.X) on the hardware switch but It don't work (vlan work but not the equipment).I also tryed only an hardware switch (IP 192.168.1.X) but only the equipment work and not the VLAN.Do you have an idea about this problem and how I can solve it ? Nathan

Hello,I am trying to know if it is possible to do SDWAN for Internet trafic and trafic going through two IPsec tunnels (the endpoint on the other side will be MX Meraki).  The remote subnets for the two IPsec tunnels will be the same so if i am configuring static routes for this same subnet with as next hop the two tunnel interfaces (route-based vpn), I do not think I will be able to loadbalance the trafic, there will be always a preferred route and I will not have atcive-active links for VPN IPsec trafic. But with the SDWAN feature, maybe there is a subtility which can make this possible :) So the purpose is to loadbalance the Internet trafic and VPN trafic between the two WAN interfaces thanks to the SDWAN feature. Besides, I do not have a way to test it for the moment so this is just a theoritical question.  Thanks in advance, Thomas

I have two types of traffic using the same ports but need to filter in different ways and not sure exactly on the best way to do this. I will explain below: What I want to achieveWeb browsing (80/443) should be restricted to a specific site (bbc.co.uk for example)Citrix Reciever (80/443) should be restricted to certain IP Addresses This applies to all pcs on network  Where I'm at[ul]I have a IPv4 policy with web filtering for specific site allowing all HTTP/HTTPS traffic (as the sites IP changes regularly)I have a second IPv4 policy allowing traffic on 80/443 if going to specific IP Addresses[/ul] For some reason application control does not seem to work as thats what I initially tried and Ive tried the policies in different orders to see if that fixes it but understand they will be conflicting but there must be a way i'm missing?

Hi all, I was looking through the forum and couldn't find any similar discussion. Please let me know if this has been addressed elsewhere. I am working with a customer who is very particular when it comes to Active Directory permissions for service accounts. When using Regular binding for LDAP servers (using FSSO in polling mode), what are the minimum permissions I can assign to the bind account for the solution to function properly? I have tried using regular users before and it didn't work so since then I have always used Domain Admin privileges. Unfortunately this won't fly with these guys. Thanks!Xavier

I have uninstall my forticlient version 4, because i want install the new version but that is not work and i get notification "No updates found. You already have the latest version of.." Now i dont have forticlient aplication because i can't install any forticlient application. please help m.thx

Hi All, I have issue, when I move User&Device\Device\Device Definitions\ only 1 user abc@local.com & mac address for multi device. I using command "diagnose user device list", i find out "user abc@local.com src pop3" Can you help me fix it? 

Dear Support Team, I am a employee of DECE Sotfware Company. We have developed GEODI which it is a next generation smart enterprise content management system. Issue is;When our customer trying to install our GEODI product, Fortinet Firewall defined "servis2.dece.com.tr" is a news site and stopping install process. Could you please investigate issue and fix. Awaiting your valuable reply Website : www.dece.com.trGeodi Download : [link]http://update.dece.com.tr/GEODI/GEODI_Setup.exe[/link] Kind Regards, Bugra GONCAProject Managerbugra.gonca@dece.com.tr 

Hi,  We newly connected via IPsec VPN with multiple subnets on both sides. I used the VPN Wizzard to establish the VPN and the Tunnelstatus shows up But of course this is only an indication of the whole as multiple Phase 2 Selectors have been entered. Most of it is working fine. But yes you guessed it 1 of the 9 Subnets on my side is unreachable.Is there a way to see the status of the indvidual Phase 2 Selectors ??