Solved

Hi,I have recently come across a doubt regarding whether, FortiNet Web Filtering can be used for blocking the access to various social media sites like, Facebook, Twitter, Instagram, etc. If yes, may I know the process involved, please. Thanks in Advance.

Hello everyone, I noticed in Log&Report -> Forward Traffic pretty many (2-3 entries per second) Deny:DNS error. That is what it looks like: On the FortinetGuide Twitter Account I found information: "If you see #FortiGate forward traffic log Deny:DNS Error, it's not the 'gate blocking DNS traffic. It's just not forwarding failed response." https://twitter.com/forti...tus/912853368636366850 But what exacly it is? Why these errors are so much? Mail server is not configured properly? Thanks in advance for your feedback. Regards, Lucas

Hi experts, I have a doubt about the "Workstation verify interval" and "Dead entry timeout interval":  1. So if user A closes his laptop without logging off, the collector will not be able to connect to the workstation and his status will change to "not verified". This will trigger the dead entry timeout interval and it will last 8 hours (by default) until the user is purged from the collector. If within this period of time an attacker connects his laptop with an static IP equals to that of the user A, now the collector will be able to connect to the workstation, the status will change to "OK" and the attacker will gain access to the network. Am I correct? 2. What happens when the "Workstation verify interval" is set to 0? The collector will not check if users are still logged on, but what will be the status of them? 3. What happens when the "Dead entry timeout interval" is set to 0? Will the users be never purge? Regards,Julián  

Is there a way to generate a complete list of units in FA across all ADOMS?  I would like to be able to find a unit by serial number, if I could make a list based on name I could figure out what ADOM it's in from there. 

Hello,I have some questions about the Configuration and Rebranding Tool.According to the FortiClient docummentation the Configuration tool is free and can be downloaded from the FNDN site.Does it mean that I can create an MSI installer and provide it to hundreds of our customers for deploying via Active directory for free?Does it matter that the configuration tool was downloaded under my account and I can user it for unlimited customers to create custom installer? The Rebranding tool should be available to download with FNDN site license. What does it mean? Where to obtain this license and where to put/upload the license on the FNDN site?

  Does this exists? I've found http://kb.fortinet.com/kb/documentLink.do?externalID=FD39996, but couldn't found the files they're mentioning (even as a partner). I also found several references to packages for some distros, but couldn't find anything "official" that confirm nor denies Linux support.  Or is it unofficial (like "open-vm-tools" on vmware)?  

Hi experts, In my work I have never seen two FortiGates in HA Active-Active mode, always Active-Passive mode. There is documentation for both modes, but the Active-Passive is always more common. According to me Active-Active mode is better since it provides redundancy, like Active-Passive, and also load balancing, unlike Active-Passive, which I guess it enhances the performance of the two FortiGates. Why is Active-Passive mode more common? Is there any downside of using Active-Active mode? Many thanks in advance,Julián 

We have a pair of 1500d units and FortiAnalyzer. Last night one of our web servers started throwing errors. I *think* the Fortigate failed over to the other node, but I haven't be able to find any log to prove this. How does one configure the Fortigate, or FortiAnalyzer, to alert someone when LB monitoring logs a failure with a web server? Denny

HiI have a Fortigate 80C Firewall.This is having all the Internal Ports configured as Internal Switch. Just to note Fortigate 80C Internal Switches are 100Mbps each. My target is I need to make the bundle with 2 of these ports so that it can be more than 100Mbps. Is there any way that in Fortinet 80C I can make the 2 Internal Switch Port as Link Aggregation or Bundle ? If Yes what are the syntax could be ? I attached 2 port internal switch screen shot in case it helps to understand the scenario. BR//Subrun

In our organization we have clients that do not connect to internet and we only have our infrastructure with out internet facility due to security reasons. How can we install forticlient without connecting to internet. Means where is offline installer (Full installation)

Forticlient 5.6.2 blocks *.local domains as 'newly observed'.  I can't log into VMWare console now. Also, there's no category for this to be allowed.  Where in the EMS server is the setting to "allow" or "warn"?  EMS server is not completely up to date.  

Hi guys, When trying to activate the CASI feature I noticed it is not visible under System > Feature Visibility. My Fortigate is working in proxy-based mode, but the NSE4 course says it is OK:  However, the Fortinet Help says the following: Unfortunately CASI does not work when using Proxy-based profiles for AV or Web filtering for example. Make sure to only use Flow-based profiles in combination with CASI on a specific policy.http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-whats-new-54/Top_CASI.htm But I am not sure if that means CASI doesn't work with proxy-based mode at all or if it can be used within a profile without proxy profile. What do you think about this? By the way, I am running firmware v5.6.2. Regards,Julián 

Hey y'all, I'm new here so bear with me I'm looking for a solution to automate setting up a FortiGate machine - i.e. spin it up and have it automatically set rules, VIPs, etc. without ever necessarily having to log onto it. The obvious solution is Ansible/Chef/Puppet and the like but I've no experience using these tools on FortiOS, only Linux distros. Has anybody tried this? Or even better does anybody have a different solution to my conundrum? Thanks in advance!- Chloé  

New to Fortigate, have a 30E running latest 5.6 firmware. I am trying to understand the process of creating VLANs on the device. It appears to me that, from the hardware switch containing LAN ports 1-4, you can create VLANs with VLAN IDs and unique router IP addresses for each VLAN. Then you can connect to the "trunk" port of another switch to any of the 4 ports and configure matching VLAN IDs on the separate switch. This works as far as I can tell. But how would I configure a port on the Fortigate to be in "access" VLAN mode? For example, I create VLANs 10, 20, and 30 under the Hardware Switch. I don't see a way to have port 1 assigned to VLAN 10, port 2 to VLAN 20, port 3 to VLAN 30, and then maybe port 4 would be a trunk of all VLANs to a separate switch. If I remove a port from the hardware switch, I don't see any VLAN settings at all in the GUI config (no option for native VLAN, default VLAN, or anything at all.) So is this scenario not possible on the 30E?

I have to set up a NAT-intensive box, using FMG + ADOM, 5.6.2 (FG 5.6.3)Firewall is connected to many worlds, and trying to make everything without central NAT turned up to be quite a mess.However, on Central NAT, I can not resolve the following situation: If a private-addressed server goes to the internet on SMTP, it should masquerade its source IP as (e.g.) 1.1.1.1, if going out with HTTP request then it has to be masked as 1.1.1.2, if DNS, then 1.1.1.3. Without central NAT, one only has to separate SMTP, DNS and HTTP rules giving every NAT field its own pool. Any ideas? Martin

I have a successful SSL inspection policy enabled with AV scanning as well on my Fortigate 50E. I have the following policy configured on the LAN-Internet policy. SSL inspection is configured to inspect all ports: edit 1        set name "LAN-Internet"        set uuid 3fb6d2ee-fc17-51e7-e50e-699ed85aaff6        set srcintf "lan"        set dstintf "wan1"        set srcaddr "all"        set dstaddr "all"        set action accept        set schedule "always"        set service "ALL"        set utm-status enable        set av-profile "default" &nbs

HA StatusStandaloneSystem TimeThu Jan 25 11:11:12 CET 2018 [link=https://10.240.1.26/cgi-bin/module/launchpad/dashboard?nocache=0.6431283330759745][Change][/link]Firmware Versionv5.2.7-build0757 160408 (GA) or can I do it during office hours if I take a snapshot. Thanks

Hi,I want to create one DMZ with 2 vlans on foortigate 600d unit; is it possible?or whats the best way to do with 2 servers (mail server and database server)?Thanks

Hi guys:   We want to implement two factor authentication in forticlient vpn, may be done using Fortitokens ?Thanks in advance. Hugo

Greetings all,   We're trying to update our Fortigate D200 from v5.6.2 to v5.6.3.  When we do this, regardless of the method used to send the firmware (USB, web update / via web interface, boot and pull from USB) our fortigate hangs at "Firmware upgrade in progress ..." after it reboots and nothing else happens after that.  We've let it sit as long as 30 minutes and it does not progress past that point.  If we reboot, the system detects that the firmware update failed on the backup partition and proceeds with a normal boot process. We've had a history of firmware update issues on this device and I wanted to check with the community here to see if anyone else has had similar issues with this update or the D200 in general, and if so, if anyone knew of anything else I should try to resolve the issue.  If there are also any diagnostics I should run that could give me more insight into the condition of the flash, or logs that could show me more d

Hi Team,I am searching a solution for my client. He is having 5 sites in different - 2 countries. Now IPsec Site to Site VPN tunnels and (One site) Dial-up User IPsec VPN are working fine from HO office. Today client has requested for Intersite communication also. I don't want to make VPN tunnel between sites because some sites having low bandwidth.  How I can archive the solution now. I got a solution as VPN Concentrator on the fortigate website: http://help.fortinet.com/fos50hlp/52data/Content/FortiOS/fortigate-ipsecvpn-52/Hub_and_Spoke_Config/Config_Hub.htm#ToDefineVPNConcentrator Please help me. Is it a good solution for me? Do I need any dynamic routing?Regards,Deepak Kumar   

FortiMail 5.4 has been approved for release and will be uploaded to the support site in the next few hours.This version of FortiMail is a major rework focused on enhancing the GUI, removing the need for plugins and improving the configuration workflow: In addition to the GUI enhancements,  the following new features have been added:[ul]Extreme virus database supportFortiGuard Virus Outbreak Protection Service (licensed feature)Dynamic Adult Image Analysis Service (licensed feature)SAML SSO Support for FortiMail webmail.Password decryption for archive and PDF filesAV and FSA rescan for released quarantine email[/ul]See the release notes and admin guides once uploaded for details of these and many more new features.  Carl

Hello,Can we combine two (or more) policy packages in the same FG or group of FGs with FMG? My ultimate goal is to have the following functionality in the FMG, regarding the security policy management:a. Have a common policy package for a group of FGs on my network andb. Selectively add firewall policy lines to some FGs in the group. I remember in FMG 5.2 that we could do that by using different device-targets per firewall policy line, but I don't see this in 5.6. I hope I was clear in explaining my requirement. I consider this requirement very important for FMG, because otherwise we are forced to use different policy package per FG device. ThanksAndreas 

I have a 200E appliance that I have been asked to create a specific SSL VPN rule to allow a third party access to only one of our servers. How can I restrict their access so that they are unable to reach any other devices on our network?

I've seem similar questions asked, but never answered adequately, so I thought I would bring it up again.We are using FGM 5.4, and have an ADOM with all our 5.2 FGT systems, objects and policies. We are about to introduce our first 5.4 FGT into the mix, which means we HAVE to create a new ADOM on the FGM (you can't mix major versions in the same ADOM). So we have created the new (empty) ADOM, and now need to somehow get all our existing objects into it. One suggestion is to take a new FGT, downgrade it to 5.2, apply policies etc. from the 5.2 ADOM, upgrade the FGT back to 5.4, and then import it into the 5.4 ADOM.  Hmmm.  This might work if the policy we applied to the downgraded FGT contained ALL of the objects we need to transfer to the new 5.4 ADOM but....FGM has this wonderful scripting interface, so there has to be (doesn't there??) a way to script dump the objects, policies etc. from our 5.2 ADOM and script import them all into the new 5.4 ADOM.  I have looked