Solved

I have installed 5.4GA on a test 60D unit, all is kind of okay, i have turned on Advanced Routing under features.. i see no place though where i can configure ECMP (inc. health monitor)? does anyone know where this feature has gone?! it used to be under settings in Static routing on 5.2... but is missing on 5.4 even when Advanced routing is turned off..

Before upgrading to EMS 1.2.1, when one clicked on the forticlient tray icon and selected "Connect to VPN", the VPN window opened in order for the user to enter the appropriate credentials (username/password). Now, after the upgrade, when the "Connect to VPN" is selected a small window appears saying: "Empty username is not allowed" !!! Do I miss something or every EMS upgrade creates more bugs than corrects?!

Hi, I have a question. I will enable DHCP option 191 with 2 IP address. I can set 1 IP address. This is my dhcp config:config system dhcp server edit 1 set ntp-service local set default-gateway 10.6.34.1 set netmask 255.255.255.0 set interface "lan" config ip-range edit 1 set start-ip 10.6.34.30 set end-ip 10.6.34.70 next end set timezone-option default set option1 191 '0a01221d' set dns-server1 10.1.34.60 set dns-server2 10.1.34.61 next end The Cisco command for option 191 is: option 191 ascii pool1=10.1.34.22,10.1.34.29;level=2 Does anybody know how to do it? Thanks a lot Regards

Hello.Is there a way to FortiGate logs to a second or third syslog server, syslogd2 or syslogd3?  I don't see how to do that in the 5.4 web console or CLI.  It seems that 5.2 had that feature.http://help.fortinet.com/fgt/handbook/cli52_html/index.html#page/FortiOS%25205.2%2520CLI/config_log.16.19.html

I would like to know if anyone has already managed by SSH to enable in fortigate authentication via SSH with local certificate

Hello everybody :), I want to connect via ssh to the fortigate and make a reboot. code: sshpass -p 'password' ssh admin@192.168.209.155 exec reboot The fortigate expects y or n, how do I get the fortigate said y or n?

Hi,I've got a strange problem with my Fortigate 800. When I try to ping from the wan interface : FGT800-XX-XX $ execute ping-options source <WAN-IP>                                                                FGT800-XX-XX $ execute ping 8.8.4.4The ping doesn't work and I use diagnose debug flow trace to see where the icmp packet are going.Here the result :msg="enter IPsec tunnel-FGT-XXXX-XXXX" 2017-07-24 15:04:09 id=36871 trace_id=12559 func=ipsec_common_output4 line=595 msg="No matching IPsec selector, drop" ICMP packet from wan interface are encapsuled in a VPN Tunnel instead of going to Internet directly. I need this to configure Dead Gateway Detection option.&nbsp

hi all we are using 1000D fortigate and observing high memory usage(86%) but CPU&Disk usage is normal(3% & 9%).IPS,Application & web-filter are enable on that. can anyone explain what is exact reason behind this miss behavior & how to resolve? Thanks in advance.   

Hello, I have a report#1 which shows the top 10 bandwidth users of the category 'social networking'.Now, I want to create a second report#2 which details which social networking sites each of report#1's users went to. My question is, how do I tell my second report#2 to only use the top 10 users that were selected in report#1 ? Thank you kindly for any help. 

We do a lot of mobile development so our users tend to be on OS previews/beta's a lot and the current FortiClient FC's on Android O (8.0) when you open it. Anyone aware of a beta or something for the client by chance that might work with Android O or a work around? Thanks in advance!

http://docs.fortinet.com/uploaded/files/3614/fortios-v5.6.0-release-notes.pdf 

What firewall ports are used for push authentication?We use Cisco AnyConnect and use the FortiAuth for 2 factor.  If the users phone is on the corporate network, then it will communicate with the FortiAuthenticator for 2 factor with push messages.  If the phone is connected to the public network, then it fails.  Where are the server name settings specified that the app is going to use to communicate back to the Authenticator? SOMEBODY has to have the detailed process.  My support ticket has been open for over a week with no response. Chris

Hello,I can't import FGT 5.6 to a FortiManager 5.4.3.Is there a solution?Thanks.

Hello, I've a FGT100D and wanna configure it like a Cisco switch.1、Port 1：switchport access vlan 102、Port [11-14]：switchport mode trunk, channel-group 1 mode on3、Interface Vlan10, ip address 192.168.10.254/24 How to configure FGT100D to solve this issue ?Thanks for your response.  

Good morning,Yesterday I've updated Fortimail, to v5.3,build634,170228 (5.3.9 GA ).Since then there seems to be some extra spam, which could be a coincidence or it could be related to the update.The thing that worries me is the anti-spam status. the license status looks like this :AntiSpam:Trial (Expires Unlimited)AntiSpam definition:7.00370 (Updated 2017-07-20) By the looks of it, the anti-spam definition is updated, same goes for AV.However AV is green, antispam is yellow. is this normal? should I update / renew the license?Thanks!

That might sound like I need to verify IP addresses, but that is not the case.  I have an interesting problem that I need to address and was wondering if anyone had any insight or experience with this issue.  We recently purchased a 100e to replace an old, and dying, ASA5510.  The initial setup went smoothly and all traffic was flowing as expected.  I had to add a second, separate but similar, network for SFTP traffic.  The IP scheme was close but not an exact match.  This part also went smoothly. I have recently been tasked with configuring a test network for training purposes.  I went about the same process as I did adding in the second network, but ran into a small issue.  Even numbered IP addresses can hit the internet, but odd numbered IP addresses are stopped at the firewall.  For simplicity sake, I opened the ports up to all traffic but still get blocked when using an IP address that has a final octet that ends in an odd num

Hi, We started out with all of our FGs and FM running v5.2.  We have since worked through upgrading all FGs to v5.4.4 and FM to v5.4.3.  Yet our Global Database is still aligned with v5.2.  So, we tried upgrading it to v5.4 and surprisingly all of the Global objects and policies were reset in the process.   Fortunately, it's a VM and we took a snapshot prior to the upgrade.  So, we rolled back and are running again with Global Database at v5.2 level. Does anyone have any guidance on upgrading the Global Database, while preserving the existing objects and policies? Thank you,LarW63

good morning, we have used the conf decribed in the title for a while to allow external users to connect to an internal samba share. the setup followed the cookbook example. this worked very well until we changed the internet provider.the new provider uses ppoe, to support this we had to add a static route: Destination 0.0.0.0/0 Device wan1 Gateway 123.123.123.9  the ip of wan1 is 123.123.123.10. this works for everything (wlan, internal network, rdp from external clients, internal web servers ...) except for the vpn connections. after adding a second policy to allow traffic from wan1 to the vpn interface i'm able to connect with forticlient and there's some data transfered in both directions. the client gets an ip address  but i'm not longer able to see the internal network resources. any ideas how to fix this? thankslorenz

Hi, I just upgraded my VMWare FM to 5.4.3.  Now, in the dashboard I see message "hard drive allocated for this VM instance...is less than the licensed VM storage volume...".  Does anyone know how to resize the volume?  The disk size set in VMWare is even larger than the licensed volume size. Thanks,LarW63

Hi ! We are beginning to migrate to IPv6 in a /48 switch with about 30 primary subnets and 100 secondary subnets. We use 2 FG-800C (Firmware 5.4.4) and 2 FG-600D (latest Firmware) as FW and OSPF for internal routing subject to NAC rules. Drawing our address assignation plan, the question we have is whether those boxes are capable of /127 addressing for point-to-point communication with internal and border routers.Yes/No will do for an answer, but I'd be extra grateful is someone could also point me to the relevant Fortinet documentation. (I did search the knowledge base online to no avail.) Cheers, -giogia

Hi, We upgraded EMS from 1.05 to 1.2 but after upgrading we get the error below when we go to the console/webgui Anyone an idea what to do?Internal Server ErrorThe server encountered an internal error or misconfiguration and was unable to complete your request.Please contact the server administrator at admin@yourcompany.com to inform them of the time this error occurred, and the actions you performed just before this error.More information about this error may be available in the server error log.

I have got a Fortigate 100D appliance with v5.0,build0271. The issue is that I cannot see all the websites that are being visited by users in the Security Log -> Web Filter. However, the URLs IP addresses do appear in the traffic log -> Forward Traffic. Anyone can help on this please?

Hi All, We have successfully migrated our existing configuration to new fortigate 300. But, 1 big issue is the policy in 300d now required "Name" which in the previous firewall is not required. I Would like to seek your assistance regarding this issue.  What would be the best and easiest solution to name all the configured policy rather than edit/putting it manually and one by one?  thank you and Regards

Good afternoon, I'm new in the Fortinet world and I need some help setting up my FortiWiFi 90D. I am trying to find a way to configure several subnets (or VLANs) in my equipment, for example, adding ports 1, 2 and 3 to one of them and ports 4, 5 and 6 to another one (with different IP ranges). I have tried changing to "interface mode" ("set-internal-switch-mode interface") and creating a pair of VLANs and assigning ports to them directly (both in graphic mode and through CLI) but I did not get any results (i always get some kind of failure or directly did not appear the option in the corresponding menu). If someone could give me some kind of information about it I would greatly appreciate it. Thank you so much. Greetings.

Hi guys,I have this small issue with viewing top web sites from fortimanager 5.4.3 for my HQ fortigate 300D with fortiOS 5.6.0.I have other fortigates in remotes sites, and everything works fine. But when it comes to my HQ fortigate It displays "No entry found".I tried to compare the config with the remotes sites, everything seems all right. I found nothing with my fortimanager or fortigate. Please HELP, my boss want to view the visited web sites with the amount time that users spend browsing those sites. Thank you for your answers ^^