Solved

I have an 80D unit and I want to configure it to allow HTTPS/HTTP/SSH services hosted on 2 difference internal servers. I have been reading a lot of the forums but still can not quite get the 2nd pubic IP to do what I need. To hide my Public IPs a bit I'll use the "Public.56" && "Public.58" as the externally assigned IPv4 addressesPort 1: Public.56Port 4: Internal 192.168.242.1I can successfully port forward 22 (SSH) and 80(HTTP) from Port 1 to Port 4 and to the internal server at 192.168.242.120. This has been working just fine for a while now. No issues there. I now have a physical 2nd server that also serves up SSH and HTTPS. For reasons beyond my control when accessing the SSH the port MUST be 22 from the outside. Clients have made FW rules on their end for their developers to connect on our port 22. I have 4 more Public IPs available to us so I thought I would fire up another set of physical ports on the 80D: Port 2: Public.58Port 3: Internal 10.0.242.1 I ne

Fortinet released IPS signature ISC.BIND.TKEY.Query.Reponse.Handling.DoS to address this vulnerability. How can i create custom IPS signature?

Hi,does anyone have a full list of forticlient update servers? we have a "safe" network with no internet access, but i want to make a policy that will allow the forticlient to update, but in order to do so i need a list of forticlient update servers. currently i allow "update.fortiguard.net, service.fortiguard.net" but no updates. I can ping the servers from the safe network. anyone?

Hello! I have a Hardware Switch "internal" with two Physical Interfaces Members and I need one of the Physical Interface to create a new Phisical Vlan. It´s possible to remove one of thems , Could I have a Hardware Switch "internal" with only one physical interface? or... Could I delete the Hardware Switch "internal" ?? thanks

Hi, I'm new to the forums so I bid you all a good hello first and foremost. I'm currently seeing an issue due to the aggressive nature in which our 100D ha cluster is reusing source nat ports for address translation.  This is causing an issue with one of our web services, where by the source port is reused too quickly and causes the session data to be dropped. I believe the issue is caused by the server we are connecting to having TIME_WAIT configured for a 2 minute interval and our fortinet reusing the source port after a few seconds. Would creating a policy to increase the time to live session timer help in this instance ? I'm just concerned by increasing the amount of time sessions are able to sit within the firewall's memory this will potentially have a negative effect on the performance even if it does rectify our issue. We had a Cisco ASA HA setup previously which we never encountered this issue, it seems its related to the way fortios applies port addres

Greetings to youI would like to know how mach forticlient take to update their AV database!? now there as new ransomware called [size="3"]WannaCry hitting computers ! did forticlient update their AV signature ? to detect this attack ? [/size]

Hi Everyone, I'm a new network admin and new user of Fortinet, can you guide me on how can I get a monthly report (Top destination, Top source, etc) on my unit. Is there any other tool I need? Version: v5.4.4,build5968Also, can you suggest a monitoring tool for my network traffic.  Thank you.

If I need to make a change in the VPN phase II, this change must be execute at the same time at both ends of the vpn tunnel otherwise the tunnel go down? 

Hello, We use FortiGate 3700D running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415. We've deployed the builting Fortinet certificate "Fortinet_CA_SSLProxy.cer" on all workstations.We've a policy with "SSL/SSH Inspection" and "Application Sensor" Profile to manage WebEx communications (allow audio/video and deny remote control or other features). But we obtain a certificate error when we use WebEx (see attachment): "you cannot connect to audio or video because we cannot validate the security certificate to your WebEx site". Do  you know how to avoid this pop-up? Regards, Chris

In my company we have an Fortigate 100d can someone please help me so that i can isolate this ports due to the ransomware attack that happened the last days.Thank you very much.

Hello, I recently upgraded my fortiOS to 5.6.0 in my 300D, so now I receive logs from the fortigate I get the logs with the actual date but when I want to display them I get "No entry found". Like I stated before I have fortimanager/analyzer 5.4.2 it's the latest version.Is there anything to do? Is it a compatibility issue? In that case, should I wait until a new release for the fortianalyzer? I tried everything else, removing and rebuilding the DB but didn't work.Thank you for your answers. Regards.

Hello, I have 2x Fortigate 200B with firmware  v4.0,build0632,120705 (MR3 Patch 8). not too much traffic and sessions: Ca 200 Mb/s , up to 10k ip packets/s , up to 15k active session. I have noticed that sometimes cpu is very high but only user part. It happens mostly, every 5-10 minutes for more less 10-20s but sometimes it takes much more time as You can see on day graph  I did some debug but i can't see nothing wrong.   I turn off: snmp access, widget in dashborad, tune tcp timers but without success.  Still high cpu user. What can be reason of that? How can i debug this more deeply ? Below some of my ouputsBig thanks for help  # get system performance statusCPU states: 1% user 25% system 0% nice 74% idleCPU0 states: 1% user 25% system 0% nice 74% idleMemory states: 64% usedAverage network usage: 72437 kbps in 1 minute, 114673 kbps in 10 minutes, 110949 kbps in 30 minutesAverage sessions: 7546 sessions in 1 minute, 7650 sessions in 10 min

I'm looking for a little clarity on this after we've come across an intermittent issue on 5.2.7 with SSL Inspection enabled. We serve a number of SSL websites to external customers from a single web server. Up until last week the server was running Windows 2008 SP2 Standard and customers had no issues accessing the site from any of the main browsers (IE, Edge, Chrome, Firefox). Unfortunately we had an issue with the server and were forced to quickly implement a Windows 2012 R2 web server to serve the same sites. This was locked down (using IISCrypto) to offer appropriate encryption and cipher combinations, including TLS 1.2 (which was not supported on the older machine). No changes were made on the Fortigate configuration. Since implementation we have had intermittent connectivity issues reported by customers which we have occasionally been able to replicate as they are not happening consistently. These occur across all browsers - in Firefox reporting an SSL_ERROR_B

Hello, In our environment we have a Fortigate 100 D, I'm planning to deploy in all laptop a VPN client, ideally at the end, would be great to get this done: - Detect if user is in our facilities or not, there's no need to connect vpn if users are in the office.  So if any user goes away, vpn tunnel should connect automatically. - Should use AD credentials, as you all know, the more passwords we have, the more support requests IT department will suffer, all laptops are protected by Active Directory credentials, so somehow security in VPN connection should be automated. The goal is to offer VPN benefits but without any user interaction...all traffic should be routed to VPN, even Internet connectionsAnyone have any experience on this? Thank you. 

Hello guys, I am having a very strange problem with my wireless connection. We currently have an Exchange-On-Premises server in our network. When we open Outlook, it connects to this server to handle emails. The thing is that my Outlook client takes a very long time to connect to the server when i am connected through wifi, usually 20 minutes. We have a FortiWifi 90D that manages 2 FortiAP14C. This problem happens no matter to what signal emitter we connect to (FWF90D or FAP14C). This only happens when we connect to the SSID that has access to the local network. It doesnt happen when we are connected through wire. I am certain that it isnt a firewall rule or anything like that. I contacted Fortinet support to solve the problem, but they couldnt neither. We tried everything: allowing unrestricted access to the SSID, packet debug, upgrading firmware (we are currently using 5.6), etc. Anyone with the same problem?   

Hello everyone, just want to clear a small doubet that I could not find anywhere. Lets say I create an aggregate interface and have 10 Vlan interfaces under that aggregate interface.When on the IPV4 policy if I select the Source or Destination interface as the aggregate interface that is a shortcut to selecting all the VLAN interfaces under that aggregate, correct? Many Thanks

I'm looking for a way to block applications based on the "Hostname", but the "Hostname" has a space in it. For example, there is a Just Proxy VPN that is getting through our firewall. If I filter the Application Control log, the Application is SSL_TLSv1.2, and in the details, the Hostname is "Just Proxy VPN" and the URL is "/", and the Category is Network.Service. It uses different IP addresses and ports, so I can't block using those. I can't block all of SSL_TLSv1.2, but I want to block any application using hostname= "Just Proxy VPN". I can filter for it in the logs, but I can't seem to setup a block for it. Is there a way to create an Application using this information to then block it? Here is a detail log for one instance: itime=2017-04-10 20:44:54 vd=root app=SSL_TLSv1.2 date=2017-04-10 dstip=139.59.64.226 apprisk=medium group=FSSO_NoNetscape service=tcp/7624 proto=6 eventtype=app-ctrl-all devid=FG1K5D3I15800570 dstintf=port25 applist=BlockYouTube msg=Network.Servi

Hi everyone, proud new owner of a pair of 1500D that I am going to implement in the coming months. My current test setup is Active/Active HA with a single 1G port connected to the LAN side(to a Cisco 6509 VSS Core). The production environment(Active/Passive) currently has 2 x 10G port per firewall appliance to each Core. So example, FW1 to Core1(active) and FW1 to Core2(redundant). Same thing goes for FW2. My goal is to have redundant connections in a similar fashion with the Fortigates. I know it supports 802.3ad, but I want to make sure it is implemented correctly, especially as this will change all the rules and static routes currently being sent to a single port.  I haven't been able to find good information(cookbook,tech docs,...) to truly determine the Best practices, so before I open a ticket with support, I thought checking with the forums would probably be better. Is anyone currently running A/A HA with redundant LAN ports to their Core's or am I over-compl

Xmas surprise Upgraded all E-series + 80D. Will see...

There are 5 sites IPsec between all of them.There is a DC at the head office with a collector agent.I am trying to get FSSO to work between all sites. The fortigate at headoffice has FSSO working correctly however the remote fortigates wont.I can ping the Head office DC from remote sites but its as if the fortigates cant communicate with the head office DC on port 8000 looking at th debugs : [fsae_server_init_spec:116]: num 1, idx 0, 127.0.0.1:8000 disconnect_server_only[KCM FSSO]: disconnecting _event_error[Local FSSO Agent]: error occurred in read: Connection refused  All policies do not have specific ports configure(all ports allowed)The Windows firewall on the DC is turned off.Please help

Hello, I have a 100E (5.4.4) and there is no  "packet capture" under "Network", now i cant find if this supported or not, i know in the past fortigate disabled this feature for small models in relation to process power, but a 100E isn't small or slow in my opinion. Can someone point me to the right document? Sorry, i really have to work on my search skills. Thanks in advance

hi allsee attached diagram, it'll help explain it better i don't know how to "attack" thisthank you

Hi everybody,The VPN section is divided in to two groups: tunnel mode and interface mode.Which is the difference between to the two?Thank you.

I'm going to visit some 100Ds in a rather remote location. They are currently at 4.3.11 and would like to upgrade the FortiOS 5.2 or 5.4? I've looked and have not found anything outlining pros and cons of each. I'm sort of leaning to 5.2, but would like some input. Thanks in advance....CB

Hello together, I'm trying to get my Fortigates registered via LLDP in my Switches.This works perfectly on two FGT-50E, currently on 5.4.1.It does not work on 3x FGT-90D and on one 110C. These are all on 5.4.somewhat firmware.What I did:    edit "internal14"        set vdom "root"        set type physical        set device-identification enable        set lldp-transmission enable    next and:config system global    set lldp-transmission enableend Then:diag lldpx restart We use HP ProCurve switches. Any idea?