Solved

I've seem similar questions asked, but never answered adequately, so I thought I would bring it up again.We are using FGM 5.4, and have an ADOM with all our 5.2 FGT systems, objects and policies. We are about to introduce our first 5.4 FGT into the mix, which means we HAVE to create a new ADOM on the FGM (you can't mix major versions in the same ADOM). So we have created the new (empty) ADOM, and now need to somehow get all our existing objects into it. One suggestion is to take a new FGT, downgrade it to 5.2, apply policies etc. from the 5.2 ADOM, upgrade the FGT back to 5.4, and then import it into the 5.4 ADOM.  Hmmm.  This might work if the policy we applied to the downgraded FGT contained ALL of the objects we need to transfer to the new 5.4 ADOM but....FGM has this wonderful scripting interface, so there has to be (doesn't there??) a way to script dump the objects, policies etc. from our 5.2 ADOM and script import them all into the new 5.4 ADOM.  I have looked

Hello to you all. After trying the advised method of restoring a snapshot within VMware the machine corrupted. So the question is easy is there another method of making a backup of the FortiAuthenticator config. Because there is no simple CLI command for doing so or I missed it. Thanks I advance.

I am trying to figure out what version our Web Filter database is at and it is not listed when running get system status via the CLI. This is on a Fortigate 600C [Firmware Version: v5.4.5,build1138 (GA)].

Is possible to enrol fortigate  with Linux LDAP server?

Hello, Can someone tell me what the default session-ttl value is?  When I run config system session-ttl and show I get nothing.(session-ttl) # show config system session-ttl end I see it set in various firewall policies as "set session-ttl 0" which tells the policy to use the default.  If the default above is not set what happens?  Is there a built in default it's not showing me?  I do not want to set a default and break anything.  The issue I am having is users are occasionally getting timeouts when using a web application from outside > DMZ.  Sometimes it works fine and other times they get timeout errors.  When looking at FortiAnalyzer traffic logs I see some sessions as "firewall action: close" and others as "firewall action: timeout"  The current policy that I am having issues with does NOT have any session-ttl values set.  The service (http) under config firewall service custom has "set session-ttl 0" which again

Something likesrcip==192.168.0.0/16doesn't seem to be working in a generic text filter. Is it at all possible any way ?

Working to update a FortiWiFi 60D. It is currently on FortiOS 5.4.5. In the System Information section on the Dashboard it says:Firmware Version: v5.4.5,build1138 (GA). There is no [Update] Button. In the License information it says that Registration, IPS, AntiVirus, etc. expires 2018-03-30. Any ideas why the [Update] link is missing? Any suggestions on updating the FortiOS without the button? Thanks,

Hi All if you know please tell me how to add static route to PPPoE interface.I want to add 1 static route prefer to 1 PPPoE interface but I can't. There is no pppX interface in the device list.If I choose device is wan1 (the interface that run PPPoE), that static route doesn't work, Firewall cannot reach the destination. 

Hello Forum :) I have a problem with a Forticlient doing an ssl vpn to a fortinet after a firewall update to 5.6.3The client also updated to the latest fortclient. Now, when trying an ssl connection, it stops after 40% with error (translated from german...) : The server needs an authentication, please choose a certificate (-5).This happens only on one client and is not a user problem. The user login works on other workstation, also other user credentials on this client have the same problems. I tried then also to do a ssl vpn connection to a fortinet from another customer, same problem. It stucks after 40% with same error. So I think a client problem. Do you have any idea for me, what I can do? I will not reinstall Windows 7 Client. Thx in advance

 Hello, friends. I have a fortigate 60D, in which I want to connect some AP's, model FAP21B, only that it does not give me the opportunity to authorize them. If you selected it and I click on "authorize" I get the error "Value conflicts with system settings" and in the properties of the AP I see the error of the image that I attached. I have other AP's connected and I have no problem with them.The firmware version I have is v5.2.1, build618 (GA) Thank you very much in advance

Hello. I have successfully enabled SSL inspection by creating a new deep inspection policy, then ticking the slider to enable it on the default LAN-WAN policy. Now, every HTTPS site is verified by the default Fortinet certificate. Do I now need to create a "WAN-LAN" policy and enable SSL inspection there? Or will just having SSL inspection on the LAN-WAN policy be enough? One thing, the device datasheet lists SSL inspection throughput to be 130mbps, but with the above configuration I can still get ~940mbps of WAN-LAN throughput on out AT&T 1G/1G fiber connection....

Good morning     we are currently experiencing high cpu utilization on our Fortigate 300C. How can we check to see what resources, policies is causing this. Thanks!

Dear all I have a fortiwifi 60d, I form a sofware switch and add a vlan into this software switch, however I notice that when I bind the Wi-Fi into this software switch, it will not use the vlan, how can I turn it into the vlan, thanks.

I have a FGT 3600C and a FAZ VM, I imported some logs from FGT to FAZ and I can see these logs in the option Log View > Log Browse, however I can´t see these logs in Fortiview and I can´t generate reports from imported logs.  Does anyone have any idea how to generate reports from the logs imported from Fortigate? Thank you  Maria

Does anyone know how to improve the completeness of the diagnostic sniffer? Is there some system type setting that impacts this functionality? I have noticed the output of the diagnostic sniffer often seems to only include session establishment type traffic, or perhaps it deliberately excludes in-session traffic (TCP obviously). I noticed this more often using capture level 4 (header and interface). Level 6 (bytes and interface) seems to more often include in-session traffic, but not in my current scenario.The diagnose doco site does not mention anything about this although I'm sure I've seen disclaimers somewhere. Currently I am fault-finding an application issue and packets I know are traversing a firewall are not being logged. I do see arp, session establishment and teardown, but not session traffic, and in this case I need to see that.I am using commands of the form:diagnose sniffer packet internal1 'host a.b.c.d' 6 0 aThe hardware is 60C, the unit is very lightly loaded

Hello,  I have a question for the group and, yes, i've checked the documentation. The second option isn't there.  When creating a local administrator for remote authentication i have two options:  "Match a user on a remote server group": i got it working and i understood (it isn't that clear in the documentation) that my user must exists and be member of such group. "Match all users in a remote server group": not sure of what this does.  What does this option means? How do i use it?  TIA.

Has anyone managed to connect Fortigate to Mikrotik device or it has working config? I lost whole day debuging IPSEC errors and I still cannot connect to Mikrotik via tunnel. Encryption is not important I just need working tunnel, so please share your knowledge if you managed to connect. All info on Internet is not very useful. Thanks

We would like to be able to scheduled automated full-config backups to be offloaded to an FTP server. I do not want to use fortimanager. Is there any other way?

Hi There, I am trying to work out whether I should use a FortiGate to pair with two upstream Cisco routers over BGP and I seem to have hit a snag.  Currently, where I plan to put the FortiGate in the topology, there is a 3600 series Cisco router which is paired with the two upstream Cisco 4500 series routers VIA BGP. The 3600 series router distributes IPv4, IPv6 and Multicast routes to the upstream routers via the address-family ipv4 multicast, address-family ipv4 unicast and address-family ipv6 commands. MBGP is supported on Cisco equipment and this all works quite nicely.  Having tried to mimic the configuration on the 3600 series Cisco router on a FortiGate, I have discovered it is fine for IPv4 and IPv6 but I cannot find any reference to multicast over BGP. Has anyone had any experience of this issue or have I missed something? It may be that MBGP simply isn't supported on FortiGate and I have to bin the idea.

 We have a Fortigate 110C configured for Remote Access. We have configured Web Access Portal and published a bookmark to access a Windows 2008 R2 virtual Machine with RDP Native protocol. All was working fine when the Fortigate was under FortiOS 4.0 MR3 Patch 10. Since we upgraded our firewall to FortiOS 5.2.2, we are now unable to connect through RDP. When we use RDP Native, after having clicked on the bookmark, we are prompted to enter the Windows 2008 user and password. Then, the dialog box displays "Securing remote connection" indefinitely and never displays the Remote Desktop. When we use RDP, after having provided the required information, a Java applet is started, we can see the Remote Desktop for 1 or 2 seconds and the Java applet crashes with the following error messages :    - javax.net.ssl.SSLException Connection has been shutdown: javax.net.ssl.SSLException:javax.net.ssl.SSLException: Software caused connection abort: recv failed (see attached screen

Hello all,So we are testing using fortigates as DNS servers for remote sites. Our test site is as follows.A Windows Domain Server Hosted in Azure 192.168.1.10 (HQ Server)Site to Site VPNFortiGate 60D in the remote site 192.168.10.254 The DNS Server on the Domain controller is configured to use the fortigate as a Second Name server. Zone Transfer is set to use the Name servers of the Zone and so is Notify DNS Database is turned on, on the 60DA salve database is configured on the DNS Server settings below:Type: salveView: ShadowDNS Zone: company.localDomain: company.localIP of Master: 192.168.1.10Authoritative: Enabled Interface Services configured for the internal interfaceI also added in the Set Source-ip to the internal interface and set forwarder to the HQ DC But users could not long on and where getting no name servers found. I then also configured the _msdcs Zone Type: salveView: ShadowDNS Zone: _msdcs.company.locallDomain: _msdcs.company.local <-- I had

Hi Everyone, I have a fortigate 100D and need help configuring a rule correctly. I have 1 IP address that is the root IP of a server (its a Xenserver). I want to restrict access to this server to only a subnet of IP addresses and 1 specific one, for example; 1.1.1.1/241.1.1.1 Nothing else should be able to talk to that device. I'm on firmware v5.6.0, currently in my addresses I have a group called Servers which covers the IP addresses that are assigned to all the potential servers, I'm assuming if I split this into, Xenserver and Servers then i can lock down the Xenserver address specifically? Any help would be appreciated, i don't want to do this blind as the server is an hour away by car and would rather not have to go there everytime i wanted to do anything Thanks

Hello, In our company we have Fortigate 60D (v5.4.1) and I'm trying to setup the VPN with Cisco router. Cisco router is owned by other company and I do not have access to it. Phase 1 seems to work as expected ([...] - text cut for better visibility):ike 0:phase-1-int:193473: negotiation resultike 0:phase-1-int:193473: proposal id = 1:ike 0:phase-1-int:193473: protocol id = ISAKMP:ike 0:phase-1-int:193473: trans_id = KEY_IKE.ike 0:phase-1-int:193473: encapsulation = IKE/noneike 0:phase-1-int:193473: type=OAKLEY_ENCRYPT_ALG, val=AES_CBC, key-len=256ike 0:phase-1-int:193473: type=OAKLEY_HASH_ALG, val=SHA2_512.ike 0:phase-1-int:193473: type=AUTH_METHOD, val=PRESHARED_KEY.ike 0:phase-1-int:193473: type=OAKLEY_GROUP, val=ECP384.ike 0:phase-1-int:193473: ISAKMP SA lifetime=28800[...]ike 0:phase-1-int:193473: VID CISCO-UNITY [...]ike 0:phase-1-int:193473: peer supports UNITY[...]ike 0:phase-1-int:193473: DPD negotiatedike 0:phase-1-int:193473: NAT not detectedike 0:phase-1-int:193473: PSK

Hello everyone,I need to enable application control profile on all my policies, how can i do this in one step? 

Hi, First, please let me say, i have gone over the forum and read many posts about this issue, and i just can't find a recommended solution for CLI backups for my system.We have some Fortigate firewalls, all are configured with VDOMs and running in a 2 device cluster (some as active/active and the other as active/passive)Backing up the device should not be so hard. i am trying to log-in to the machine using CLI and running a backup to TFTP operation (Later, i would like also to run an automataed script , but thats the next step)I created a user for the backup. It has a dedicated admin profile (i dont think it is a good idea to give the backup admin user a super admin permission) When i log in with that user, i cannot run the "config global" command , which makes me wonder : 1) what is the difference between running "execute backup full-configuration" from VDOM menu , and running "execute backup config " from global menu? From where should i execute the backup operation? 2) What i