Solved

FortiSandbox 2.5.0 is out!!

Hi guys, I wonder if enabling IPS in the direction LAN --> WAN is necessary or not in order to protect my PCs againts attacks. I mean enabling IPS from LAN to Internet, like this:  Is it ok? Regards,Julián

Hello, We are encoutring high CPU usage on many 60D Fortigates. The firmware version is 5.2.3.The process responsible of this high CPU charge is httpsd (screenshot attached).Killing the process will reduce the charge but after few days, the same issue will start again. Did anyone have the same issue ? Thank you for your help. Regards,Hatim 

Hi. We're developing a custom solution for a customer and we're trying to use the XML API to retrieve log data.We're new to the Fortinet products and currently trying to get the correct data through trial and error. We've managed to get one of the result sets with the searchFazLog request.Unfortunately, we're struggling to find documentation on the syntax that the <searchCriteria> must be written in so we can filter the results more. For instance how do we filter for values <searchCriteria>subtype=system AND date=2017-06-11</searchCriteria> correctly? Regards, 

Hi I have a strange problem with the 200D Fortigate (FortiOS 5.4.3 build1111)Until a few days ago, the graphics section (GUI) of the device was working properly But today I saw it does not work properly I mean, this device has more than 20 static route in static route section that they showed in this sectionbut today GUI show just 4 static routebut when i login in CLI mode I see all static route device work properly, static route show in CLI mode but did not show in GUI ModeI'm worried about future events can you help me?thank you

Hi guys, I know if I enable Radio Resource Provision under FortiAP profiles, the APs will scan the frequency range and select the channel with less interference between the other APs, this is well documented in Deploying Wireless Network Guide.But what happens if this feature is not enabled? I have several APs working with this feature disabled:  The APs have selected a channel, some on channel 1, some on channel 11... Do you know what the criteria or algorithm is for this channel selection? Regards,Julián 

Hi,  I'm having an issue with establishing an FTP connection through my Fortigate 600c running FortiOS 5.4. I have the Session Helper configured:set name ftpset protocol 6set port 21 And a policy configured:set name "Internet to FTP Server"set srcintf "External" set dstintf "local" set srcaddr "all" set dstaddr "VIP for FTP" set action accept set schedule "always" set service "FTP Services" (Also tried "ALL") "FTP Services" has all members for "FTP"edit "FTP Services" set member "FTP" "FTP_GET" "FTP_PUT" next But I cannot establish an FTP Connection.  I can connect to the server, but there is no data transfer (i.e. to get directory listing).  Here is a log from FileZilla Status: Disconnected from serverStatus: Connecting to <Correct Fortigate IP Address>:21...Status: Connection established, waiting for welcome message...Status: Logged inStatus: Retrieving directory listing...Command: PWDResponse: 257 "/<valid directory>" is current d

Hi Guys, One of our company office Wifi users are facing slowness and low performance of Wifi. We are using Fortigate 100D as a controller for FortiAP's(221C). No mesh topology. in total 4-5 AP's are there. there us no difference in any AP config or firmware.  As of now I ran hrping and other ping plotter tool to see packet drop. - in hrping I don't see any packet drop in hrping result to local gateway/firewall/ wifi controller.- in Hrping results for internet google dns I see few packets drops randomly and high ms around 50, 200, 300,  upto 500.- In Ping plotter  I see latency  of avg 40 ms to local gateway/ firewall/ controller.- In Ping plotter I see latency of avg 60ms to google dns.  what do you think about above results. Is it normal? - what are the other possible best quick way to find out  wifi performance issue or to find out any  rouge AP any pointer please thanks A    

Forticlient 5.6.1 and EMS 1.2.2 is out...We are going to upgrade tonight and will let you now the feedback

We use Forti Authenticator as a radius server for our wireless authentication. I did give the realm and in the query elements under Remote auth. servers -> LDAP as user authentication attributes. For some reason, the authenticator is also checking for machine authentication and getting failed. This machine authentication logs are being piled up increasing the memory usage to over 95% which is slowing down the authenticator performance.  We had to reboot the authenticator couple of times in 2 weeks span just because of the over memory utilization. Can someone help me figure the issue and not allow the authenticator to try checking for machine authentication?  

We are using a Fortigate 60D in our work place. The 60D is used as our UTM/core router and is using one WAN link to provide internet access. The company plans to add a second firm in the current location. The new firm will have a separate internet connection for its users. The plan is to setup 2 VLANS, one for the current business and the second for the new firm and create my policies according to business’s needs. My question is can(and how) I setup the fortigate to route internet traffic out separate WAN interfaces according to the VLANs being used? Thanks

I've been asked if any of the POE FortiSwitches are Plenum rated and I cant seem to find any documentation about this at all, even on the Rugged FortiSwitches.. Can anyone advise if any of them are please? 

Hi everyone, we would like to allow our employees to watch youtube videos and we work with the category based fortigate webfilter system (Fortigate 1000C). The category "bandwidth consuming" is generally blocked. Youtube.com belongs to this category, which is not a problem at all, because I am able to overwrite this category for single domains. So I allready made an overwrite entry for the domains youtube.com, youtube.de, youtu.be and put them into the category "entertainment", which is generally allowed. Accessing youtube.com is now possible for the users, but the videos do not start to play. I guess that the videos will be loaded from another url wihtin the "bandwidth consuming" category, but I cannot find any information about where exactly. When I allow this category for testing, then youtube works fine. But the CIO do not want to allow this category in general. Does anybody know anything about the youtube video urls or has any hint to find more information?Getting support fro

My fortigate is FG200D, version is v5.4.1,build1064 (GA) . I have two leased lines and two ADSL circuit, I've finished the  configuration of  the ports show in the below picture . And I've configured four static routes for each wan port and policies. When I want to add them into WAN LLB, I can't see them in the list show in the below picture Who can tell me what's wrong with my configuration so that I can't add them into WAN LLB.I hope configure a static monitor like SLA and track, how can I do? Thanks.    

Hi Everyone, I have searched the internet far and wide and have been unable to find some really useful datasets and I was wondering if a more skilled mind could assist me. I was searching for the following simple datasets - Weekly report of top users for youtube bandwidth usageweekly report for top users of facebook usage Thankyou   

Hello, I have the following dataset which shows top bandwidth users. I am converting source IP addresses to FSSO usernames for ease of interpretation. I want to strip out any lines with source address users that do not correlate to FSSO usernames i.e. those that show up as source IP addresses instead of usernames.How would I do that ?Thank you kindly for any help. select coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and logid_to_int(logid) not in (4, 7, 14) group by user_src having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc screenshot attached.  

Hello Community! I'm hopeful someone can kick-start my brain around traffic shaping and how I might practically apply it to my use case. For starters, I've perused the standard documentation as well as the Limiting Bandwidth with Traffic Shaping cookbook article as suggested in other posts. I've also taken a dive into some of the community posts to see if there's a similar situation. For the life of me, I can't seem to wrap my brain around the correct shaper settings, even to simply prove the concept. To that end, I've attempted to prove the concept by creating a traffic shaper for the VLAN I'm currently on. I created a Traffic Shaper object that applies "high priority" and guarantees 2048Kbps with no maximum. I've turned on "per policy" in the CLI as suggested in the documentation, cookbook, and several community posts. Then, I created a Traffic Shaping Policy with the following settings:Source: My VLAN ObjectDestination: "All"Service: "All"Outgoing Interface: "Any"Shar

Hei, am new here and have a question to EMS and clienter.I see that Clients are online but EMS do not see them as active.DNS is OK, firewall is disabled, its possible to ping the Clients with their domanenames, Remote registry service is running.What is the problem and how can I fix that.Was surching now for many hours...Thanks Peter

Hi guys I have x2 FSSO collector agents installed on 2 DCs (for redundancy) that monitor 5 DCs via DC Agent. This works well and LAN users show up on the Fortigate nicely. To get Wifi Devices/Users identified on the Fortigate and usernames associated to devices I have done the following 1. On my Unifi AP I have pointed Radius Accounting direct to the firewall with a new psk2. On the Fortigate I have setup an RSSO Agent in Single Sign-on. I have added the same psk to this3. I set rsso-endpoint-attribute User-Name on the Fortigate This works nicely as well. My question is how do I get groups working with this? For example I have multiple AD groups for web filtering. Examples are: proxy_allowall, proxy_allow media, proxy_standard etc - A user can only be a member of 1 group. I want to be able to use these groups to match against web filtering polices. How can I associate RSSO groups with NPS? I get I need to add the class attribute to NPS but how do I handle

Hi All,  Brand new here :) I need a hand to an issue I am having with my Fortimail appliance, where large volume emails (legitimate!) are being refused by Fortimail.Error: Deferred Queue              (host %FORTIMAIL%[%FORTIMAIL IP%] refused to talk to me: 421 4.7.0 Too many concurrent connections.)This is doing my head in, as I cannot find the option anywhere to increase throttling!Fortimail: 400EMy Session and SMTP limits are put to the maximum, but the issue still persist. I keep reading the cookbook, but I cannot find where to increase throttling overall, or for a particular SMTP address (That would be FireEye in our case). Any ideas or pointers? Many thanks,  Fred

We have contract a new fibre optical data line with 300Mb symetrics, we have configured the fortinet mod. 60D with a policy and object like attached picture, with this configuration the speed of our line goes down a lot. (35Mb upload and 37Mb download)Any sugestion for not lost our speed?Thanks in advance.  

Hi,   I have this fortigate 90E (Part number: P19061-03) having some unknown reason of rebooting itself at least once at random time throughout the day and causing some disruption to our network.   This fortigate is managing a users of around 80 users. The firmware is v5.4.4,build6019 (GA).     At Alert Message console it only states this: 2017-11-16 12:39:24 System start   It does not provide any clue nor reason of the reboot.     Please advice what should i do.

Hi all,    I am having issues with a policy rule for ssh, the rule is to accept ssh traffic from internet to an internal sftp service, we have some ip allowed, and all ip's are running with that rule less one ip than when try to go to the sftp server, all i can see in the log is: date=2017-10-26 time=12:38:23 devname= devid= logid="0000000013" type="traffic" subtype=" forward" level="notice" vd="root" logtime=1509014303 srcip=xxxxxx srcport=53440 srcintf="wan1" srcintfrole="wan" dstip=xxxxxxx dstport=22 dstintf="dmz" dstintfrole="dmz" poluuid="cf827494-ba2e-51e7-eb01-4fc04f2ee2c8" sessionid=30414454 proto=6 action="server-rst" policyid=19 policytype="policy" service="SSH" dstcountry="xxxx" srccountry="xxxxx" trandisp="dnat" tranip=xxxxx tranport=22 duration=5 sentbyte=92 rcvdbyte=92 sentpkt=2 rcvdpkt=2 appcat="unscanned" what do "action=server-rst" mean?? Thanks in Advanced

ROUTER: FGT60EFirmware: v5.6.2 build1486(GA) Problem: incoming traffic towards internal mail server (i.e. ports 25, 143, 993, 995 etc.) has flowed normally for several days after router installation and configuration. It happened twice as of today that the router started blocking incoming traffic without apparent reason - looks like it sometimes lets traffic actually flow, as the incoming mail is slowed by several minutes to hours and then finally manages to sneak in, although with a heavy delay. This is an example of a reply from a connection attempt to port 25 SMTP: > telnet mail.customer.com 25Trying 123.456.789.74...Connected to mail.customer.comEscape character is '^]'.421 4.7.0 Connection refusedConnection closed by foreign host. Is there a way to understand WHY is this traffic is blocked? I tried to have blocked traffic logged and displayed, but didn't manage to do it. The first time it happened we remotely rebooted the router, and it got back to

While reading the NSE8 Exam description (http://www.fortinet.com/sites/default/files/NSE8_Certification_ExamDescription.pdf), some questions popped up. Apparently the tested topics and firmware versions can change any time without notice.Is there already a NSE8 update planned this year? If the topics and firmware versions would change, would these changes have a different exam number? So that you can choose to take the old or new exam? It seems that the written exam can already be scheduled at pearson vue. Is the practical exam already out of beta?How would a remotely scheduled session look like?