Solved

I have a task coming up to migrate a HA pair of 200B's to 1200D's, I have seen a link on the Fortinet Cookbook site about being able to copy the config over. http://cookbook.fortinet....ile-one-model-another/ I plan to ensure they are all on FortiOS 5.2.9 Can anyone comfirm if they have done this and did it go well? Also as they are a HA pair do I need to build the new boxes as HA pair before or after I attempt to copy the config across Thanks

Hello,I'm trying to upload CLI scripts from FG in 5.6.3 and I have noticed that when the script fails, the GUI reports the failure in the script execution history, but it does not tell me wtf the error is inside the script. As you can imagine, without this information in hand it is very difficult to locate CLI script errors in very large scripts. Does anybody know where/how can I locate this information? ThanksAndreas

Hello All. We have Firefox installed on our systems for some of our internal web-based systems (don't ask long story) but we do not want people accessing the internet through Firefox. I've tried adding Firefox to through the Application Control but the signature list does not have Firefox listed on it. Am I missing something? Is browser access restricted else where? Or am I going mad in thinking that access can be blocked to an individual program through FortiGate. Any helps would be great. Kind regards Matt

Hello,ipsec/interface mode - site to site between 100D and 90Dtunnel is up but I'm unable to reach the remote networkI have policies and route on both units, and i can ping the remote network only from the Fortigate clibut not from the network. The NAT is on the tunnel setting but i tried it also on the policies - did not workon the logs P1 P2 is up - and cant see any errors on the logs  Anybody has any suggestions? Thank you.                                               

.

I have a customer that would like a web usage report in a format like such; Top source (user)       Most requested site (or bandwidth used)       2 most requested site (or bandwidth used)       3 most requested site (or bandwidth used)       4  etc...       5  etc...2nd top source (user)       Most requested site (or bandwidth used)       2  etc...       3  etc... I think you get the idea. I've been messing with the charts and think either the "Ranked" or "Drilldown" might be the way, but not having any luck. Also have not found any good explanation on what "Ranked" or "Drilldown" means. Any help would be appreciated.       

we have a 200D Fortigate in my company, until this week we have 2 ISP and 2 default route to internet and they work fine.this week we got a new internet link .i write a new default route for this link with administrative distance 10 and priority 0 as like as old default routes. so there is not any deference between default routes, and then write a policy for new link as like as old policiesbut it seems fortigate device can not send traffic to ISPs like each other, i reset policy counter and i see deference between bytes sent so new link transfer a little traffic and most of time not used its bandwidthi attach  my policy picture . i want my fortigate device sent traffic to internet from all ISP links what is my mistake? and what i should do to correct my fault?

Hi, Please forgive me if this has been covered before. I tried to search around before this post. Is there a way to run a script against global policy in FMG 5.4/5.6? The older documentation seems to say yes but I cannot find a successful way to accomplish it without importing into the root adom first and then promoting into the Global. Thank you

We have some computers that are configured with public IP address, the current setup looks like top left corner of the attachment.Because these servers are directly on the Public Internet, we would like to apply some policy to the incoming traffic, so I'm wondering if it is possible to do something like bottom left of the attachment  Currently, I have 1 server connected to port 21 with the following configuration of system interface and policy.  When I do a test ping to the server 73.xxx.xxx.100 I do see the IMCP packet come into port 27 but I don't see the ICMP to port 21.  I am guessing port 21 is not configured correctly or I'm missing some other policy? config system interface edit "port21" set vdom "root" set allowaccess ping set vlanforward enable set type physical set description "Test Server NIC1" set alias "WebServer" set snmp-index 31 next end config firewall policy edit 55 set srcintf "port27" set dstintf "port21" set srcaddr "all" set dsta

Hello everyone, I am trying to create a custom line graph that will show occurrences of a certain log message over time, so you can easily see the spikes of when this event occurs a lot. I started by creating a custom chart from Log View section showing the log results I care about. But I end up with a graph that doesn't work - there are no lines on it. Running the test query function in the dataset does show me the log results I care about. Guessing the issue is related to grouping/aggregating somehow. If anyone can shed some light I would appreciate it! These are 3 raw log entries, showing the log messages I care about: itime=2018-02-21 14:35:05 vd=root rcvdbyte=0 craction=262144 app=443/tcp dtime=2018-02-21 14:35:04 date=2018-02-21 dstip=20.20.20.10 crscore=5 duration=0 sentbyte=0 crlevel=low proto=6 devid=FG200D4Q00000000 poluuid=460bde16-0364-51e7-c774-a7aab6ae4cd1 dstport=443 type=traffic devname=customerFirewall trandisp=noop sessionid=477839005 itime_t=

Hi i just upgrade EMS server to 1.2.4 and now i have Unprotected status on all my endpoints, any idea why?Clients are connected to EMS server, up-to-date, telemetry is OKM 

Hi folks,We're using the WAN1 interface on our FortiGate only, with IP 72.x.x.1. The internal subnets 10.x.x.x all go through this interface and IP. However, I've set up a new subnet on interface Dorm1, 192.168.1.x, and I want it to utilize a different WAN IP, 72.x.x.6 (which is in the same subnet as the primary WAN1 IP with the same ISP gateway). How can I accomplish this? I've read about creating VIPs, which we do use to map one external IP to one internal IP, but I'm not sure how to handle an entire subnet, AND ensuring that the outgoing traffic is through the other WAN IP as well. Thanks for any ideas, - Eric

I'm getting ready to replace an ASA with an FG200E. On the ASA I have a portchannel of all 6 GBE interfaces and all my firewall interfaces are vlans beneath that portchannel. Before I do the same thing on the FG I thought should see if there are any reasons not to do that. I know from experience that FG has some pretty goofy restrictions on how interfaces can be configured, like not being able to use aggregated and individual interfaces in the same vlan. So here are my concerns in particular: I have 14(ish) vlans. I want to create each vlan interface under a 6 port aggregate (PortChannel1).I will be enabling things like LDAP/AD authenticated browsing, virus, forticlient, etc. Are the WAN1/2 interfaces “special” in some way that I should be concerned about?Is there any performance hit on the FG in using a lacp aggregate of 6 physical interfaces rather than individual interfaces?I may want to add a second 200E for HA. Anyone know if there are any problems/re

Do we have a general idea of the impact of the recent processor vulnerabilities to fortinet systems, specifically in my case a FortiADC 200D?  Do we have a timeframe of patches being available in the meantime?

Hello all, I just created site to site tunnel to trainning but now i can' t delete it. Can you help me? Fortigate 200D Forti OS 5.2. Thank you Georges Orwell

I want to Login to my FG-300D with user authenticated via LDAP. I've tried this before with FG-60E and works fine there.But the FG-300D always asks me to Change Password because account is using Default Password."This account is using the default password, it is strongly recommended that you change your password."But this is not a local account, this is my user in LDAP.Any suggestions?Thanks. 

Hi Guys Does anybody know where I can purchase a replacement power supply from? Or a "name" for the type of power supply? Preferably looking for a UK supplier, but happy to purchase from elsewhere as long as they can ship to the UK. Thanks

Hi community, How does FortiGate verify the credentials of a remote LDAP user? 1. I understand that FortiGates queries or fetch the LDAP server for credentials.2. According to NSE4 course, for server-based authentication the FortiGate sends the user's entered credentials to the remote authentication server, then the server responds if they are valid or not. Then which is correct? Regards,Julián

Every time when there's a power outage at my home, FG 40C crashes.This is annoying, I have to upload firmware and config over an over again :(Is there a way to replace internal flash or to use external usb disk as primary storage space? FortiGate-40C (16:48-12.14.2011)Ver:04000005Serial number: [hidden]CPU(00): 525MHzTotal RAM: 512MBInitializing boot device...Initializing MAC... nplite#0Press any key to display configuration menu.........Reading boot image... 1088044 bytes.USB read block failed.** ext2fs_devread() read error - blockrootfs read size wrong: 11c3771->ffffffffBoot failed. Please check boot device or OS image ...Please power cycle. System halted.  

Hello team ,im not so aware with fortigate upgrade/downgrade process.The second part of my cluster got down because the image got crashed and i proceed with installation of another image.The previous version was 5.2.4 buld0688 - now is 5.4.2 build 1100 and my environment now use the Active node from the clusterwhich is 5.2.4 build068.The only thing  that i want to do is to downgrade the crashed fortigate  to 5.2.4 build0688 version but my roaming over internet doesnt take effect because cant find this version and build.Does somebody can navigate me how i can take one of this images. Version: FortiGate-90D v5.2.4,build0688,150722 (GA)  

The title says it all. How do I delete created SD-WAN Rules? I can't seem to delete any rule I created. FG 500D v5.6.3 build1547 (GA) 

HiI'm trying to create 2 different Dialup VPN (ios Native) with different user group and different IP rangeso one VPN will only access a web server and the other VPN will have full control over the network for now it seems that i can only creat one VPN the users that trying to connect to the second VPN gets Negotiation Failed.what is the correct way for doing that?Is there any way to do so with one VPN?  

F-Gate 5.4.1Inspection Mode: Proxy-basedSec Profiles: SSL (full-inspections), Web, Proxy.Client Firefox: version 46,47,56Symptoms: All HTTPS connections failing.Firefox error message: Secure Connection FailedPacket Sniffer result (attached): Client-to-FG => 3 way handshake ok, Client SSL hello, FG ACK, FG RST. FG-to-Server=> 3-way handshakeDebug WAD (attached): Failing to load default Untrusted CertificateWorkaround: Use the Fortinet_CA_SSL default certificate (which is by default used for trusted re-sign) for untrusted as well, however this will workSolution (1): Regenerate the default Untrusted Certificate (not sure if possible). Solution (2): Generate a new self-signed certificate for the Untrusted Certificate (not sure if possible). Solution (3): Generate a new CA-signed certificate for the Untrusted Certificate.

Hi All,I'm the network administrator at a school. We recently got a Fortigate 30E device to control the network.  I need help with the Fortigate. I'm struggling to create an IPv4 Policy to allow staff to access the internet all the time and disallow students to access the internet on certain times. I know how to do the scheduling and groups from the Active Directory.  My concern, however, is that some staff members work on LAN connected devices... These LAN devices are not joined to the domain.  By the IPv4 Policy when selecting the source, I select the source as Staff (from the Active Directory group) and NONE. When I apply the policy, LAN connected devices have no access to the internet... I have added their MAC and IP Addresses to the Custom Devices and added them to the policy as the source, but still no internet.  Any help regarding this please??  Thanks in advance :)    

Hi all :) we have a fortigate with fortiOS 5.2.2 and we need to upgrade it to 5.6.3i have a question about it :     "can we directly install fortiOS 5.6.3 on it if our firewall has no config ? or we should go through the upgrade path?"