Solved

We user FSSO to authenticate users for web traffic. We don't use explicit proxy because of office365 performance.When there are multiple users on one server, user traffic from a user will be identified as traffic from another user on the same server. This is not what we want. Did anyone run into the same problem and is there a solution? We use FSSO with a Collector Agent on one of our DC's and agents on the other DC servers. 

We have 1 FortiGate that handles the routing of our internal networks as well as the outside world. I'm looking for a way to allow server A on network A to know who server B on network B is when they communicate. With NAT on, when this communication happens, server A sees the communication as coming from the FortiGate instead of from server B. I need to be a to set something like an X-Forwarded-For header on the traffic, or be able to to NAT just the external traffic and set the inside networks to transparency. My understanding is that since we just have the single device which handles inside and outside, I have to have NAT but the FortiGate seems to only allow yes or no when it comes to NAT. Can anyone shed some light on this issue? 

I have a Fortigate 90D with firmware 5.4.1. I am new to the Fortigate firewalls. My problem is the following:I have two Active Directory groups called FacebookUsers and TwitterUsers. SSO is correctly configured.So, I’ve set up this rules for testing purposes:1- Allow rule, from internal interface to external, all services, all destination addresses, all source addresses and FacebookUsers group. I’ve attached a web filter profile called “Allow Facebook” with a static URL filter for the *.facebook.com wildcard domain set to allow. I’ve also assigned an SSL inspection profile.2- Similar rule to allow Twitter with a web filter profile for the *.twitter.com wildcard domain.3- Deny rule, from internal interface to external, all services, all destination addresses, all users, no web filter profile.A user who belongs to the group FacebookUsers can browse the Facebook domain. But he can also browse Twitter and any other URL. Rule number 1 is applied.A user who belongs to the group TwitterUsers

Looks like FortiAuthenticator 4.3.0 (build 0216) firmware is out. Per release notes, it now allows you to turn off FTM push notifications for radius users.  There are a number of bug fixes, including better logging and reports of push notifications. Unfortunately for me, "Known Issues" still lists the bug I ran into with EAP, and a possibly related one:   375401 Password authentication fails for admins in EAP.   392437 SSH FAC login fails using CHAP/MS.CHAP/MS.CHAPv2 authentication to Cisco ACS remote RADIUS users. Anybody upgraded to 4.3.0 yet?  I'd like to not be the first this time!

Starting eval of FortiManager and imported two of my Fortigates.  Everything pretty straightforward, except the imported IPSec VPN tunnels.  I have custom IPSec VPN tunnels created manually for Fortinet > Juniper SSG firewalls.I can see the imported tunnels under VPN Manager > Monitor and the status is Up. But how do I modify these imported tunnels or create new tunnels?  I do not want tunnel created with a wizard due to it will not work with Juniper Networks SSG firewalls. The FortiManager I am evaluating is 5.4.1 build 1082 Thanks in Advance!Joe

Dear all,I can't see this in the PDF brochure for this product and was wondering if it features FortiASIC SoC2 or newer implementation of the SoC. Thanks in advance.

Hello We are enabling SSL VPN in our environment.  In previous FortiGate versions there was an option to establish the tunnel through a browser plugin. Please attachment left-hand-side.... Note the 'Tunnel Mode' section with 'Connect' 'Disconnect' and 'Refresh' options. This option is not present anymore on current 5.4.2 version. Please attachment right-hand-side. Our remote users are not permitted to install software, so the full client will not work for us. Can anybody advise how we can enable the browser tunnel plugin. Many thanks

After update to 5.4.4 on FAP221B and FAP321C the web console will not load.Has it been removed or disabled??Cleared computer cache and it still will not allow me to connect.I tried SSH, TELNET, HTTP and HTTPS.. none of them worked.

First of all, thanks for the help. I do not use Fortinet much, but I have a problem handling a simple Blacklist. My idea is to connect SIEM, Fail2ban, TOR exit nodes and other internal systems to Fortigate via SSH. Create a policy, a group of addresses and run, as is done with other manufacturers. I've mounted a script that does that, it passes an ip, and creates it as an object and puts it in a group: https://github.com/kinomakino/Ban-ip-Bash-Scripts/blob/master/ban_fortinet.sh Now I have several problems: 1.- the maximum limits for Fortigat in groups of addresses is 300. VERY LOW. If for example I want to block all the nodes out of the TOR network every night (one of the things I need to implement in Forti) I can not do it. 2.- In the case of making a "stack", I do not know how to list in CLI the current ip addresses in a group and have that data in bash to handle loops and conditions. 3.- I can not "remove" all the ip addresses of a group from CLI,

Hi guys,I have a FGM running 5.4.2 and just turned ON FortiAnalyzer features .Now can someone please share from its XP the difference between this and a dedicate FortiAnaliyzer unit (actually VM).All our FGTs are used for: Firewall and VPN only - no UTM at all. Thanks!

Hi, On a fortigate running FortiOS v3.0, it is possible to specify an IP range for ssl-vpn user groups using these commands :edit "Group1" set group-type sslvpn set sslvpn-tunnel enable set sslvpn-tunnel-startip 172.16.0.1 set sslvpn-tunnel-endip 172.16.0.10 I upgraded my firmware to v5.4 and these commands are not available anymore. (sslvpn group type doesn't exist)Where can I specify IP range for my user groups in this version ? ThanksAlvi

Hi all, after a power outage an Active-Passive cluster of FGs shows the "File System Check" message at the login. If I perform the File System Check, only one of the firewall will reboot and check for errors or I will have both of them offline? I'd like to avoid service interruption but I don't know if this is possible in this case. 

We have a Fortigate 100D firewall (Fortios 5.2.x) with Dual WAN (WAN1 and WAN2 interfaces) connectivity to 2 different ISP’s. It is acting as active/passive. WAN1 is the primary WAN link (distance 10) WAN2 is our failover link (distance 20)All is working well but we want to monitor our WAN2 link with third-party monitoring software (Paessler PRTG) Because WAN2 is passive, ICMP ping doesn’t work. This would be the simplest method for proactively monitoring the WAN2 link with other monitoring software. I want to know if there are other methods before considering FortiAnalyzer. Is it possible to enable ICMP ping to a passive WAN2 link? Are there other methods to achieve proactive alerting (e.g. e-mail, snmp) when a passive WAN2 interface fails? What I’ve learned so far:[ul]I’ve been using dead gateway detection/link monitor. It writes a message to the Fortigate event log when an event happens, but I can’t extract this specific log alert with SNMP or receive an alert with aler

Le'ts say i want to see Logs for specfic Ip address.i have fortigate 80c.Thank!

i have 100-D fortigate and it is behind Router. i want to create Ipsec vpn (access vpn) for my remote users. static ip/public is given on router. how can i achieve this. if you could explain and share example if possible..

We are trying to replace a Cisco router with a FortiGate running 5.4 but are unable to get subnet translation to work as before. Here's the scope:[ul]It's an internal router used to route traffic between three different interfaces:[ul]This branch office's VLAN 192.168.100.0/24 with FortiGate's IP 192.168.100.254.Server VLAN 172.24.0.0/24 (connected through an IPSEC tunnel on a different FortiGate and reached with static route 172.24.0.0 255.255.255.0 192.168.100.1).MPLS network to HQ 10.100.0.0/24 with FortiGate's IP 10.100.0.254. Static route 10.3.0.0 255.255.255.0 10.100.0.1.[/ul][/ul]The subnet translation comes into play when HQ doesn't want to use 192.168.100.0/24 and 172.24.0.0/24 in their end to avoid risk of overlapping subnets so they have assigned subnets for each:[ul]192.168.100.0/24 = 10.100.1.0/24172.24.0.0/24 = 10.100.2.0/24[/ul]In the Cisco router this was simply managed at our end with these two lines: ip nat inside source static network 192.168.100.0 10.100.1

 I'm considering changing the primary WAN interface on one of my 100-Ds from manual mode to PPPoE mode. I've not used this mode in a Fortigate device before. Does the firewall behave any differently when using an interface in PPPoE mode vs manual mode? In case it's relevant I use a lot of the features on these firewalls. That includes site to site VPNs, advanced routing, SSO, most of the UTM features, etc etc etc.  Thanks for any help.

Hi everyone,I had a problem that my Forticlient was getting stuck at 98% (common issue). I have followed this guide to fix it: http://kb.fortinet.com/kb/documentLink.do?externalID=FD36630 I have also uninstalled and installed VPN client again.Now I have a working VPN solution, but also a machine does not go to sleep.In device manager I see miniport WAN drivers with exclamation marks. They seem to be duplicates. I have like miniport WAN driver #7If I uninstall Forticlient, computer sleeps. Any help in the subject appreciated.

Hi there, Does anyone know If it is possible to create/edit datasets from the cli? I'm running a FortiAnalyzer with the version 5.2.7 I've found below outdated document for the version Version 4.0 MR2, which includes the cli procedure (config sql-report dataset) but that's not working for my version.http://docs.fortinet.com/uploaded/files/1177/fortianalyzer-fortigate-sql-technote-40-mr2.pdf  I've tried a few variants of the command with the cli help but no luck. Thanks,Mari

I have a FG 100D running v5.2.9I have 2 WAN connections connected.Is it possible to route traffic to a certain IP address over the 2nd WAN link, and use the 1st WAN for all other traffic?I have tried but can't get this to work, do I just use static routes or policy routes?Also the traffic over the 2nd WAN needs to be source NAT'd Any help would be great

I'm seeing a FAC 200D regularly attempting TCP 2196 (and get blocked) repeatedly to a set of IP's in the 17.188.*.* range.   Most resolve to gateway.push.apple.com. or others in the APPLE-WWNET range. Anybody know if the FAC should be using Apple Push Notifications?  This seems a little odd to me.

Just updated our FAC to 4.2.1(v4.00-build0155-20161228-patch00), and FTMv4 Push appears to be enabled.  Kind of annoying on FTM iOS.  SSLVPN login using FortiClient 5.4.2 still appears to need the token, but when logging in the push notifications now get in the way.  Does anyone know how to tell the FAC to NOT send the FTMv4 push notification?

Hi to all,I am quite new to the FGT world. My Company bought a FGT 100D three months ago, that came with v. 5.2.4 installed. The GUI has shown the message about the update to 5.2.7, but nothing about 5.4. What do I need to update to 5.4? Do I need any support contract?Thank you all.

Hello,I am new to Fortinet world. I would like to configure fortigate to use different wan interfaces depeding on source address. For example, servers placed in DMZ should use wan2 interface, users in lan/guests should use wan1. So, I configured (see picture at the bottom of this post):- WAN-LLB: I set wan-load-balance interface with wan1 and wan2 interfaces- Static Route: I set for destination 0.0.0.0/0.0.0.0 the device wan-load-balance- WAN-LLB Rules: for test purpose, I created two rules:[ol]source: LAN subnet, destination: www.dnsstuff.com, outgoing interface: wan1source: DMZ subnet, destination: www.dnsstuff.com, outgoing interface: wan2[/ol]In this case, all seems to work. Clients in lan that surf in www.dnsstuff.com see in the web page that the public ip address used is the one of wan1, clients in DMZ see public ip of wan2. Then I changed destionation address from "dnsstuff" to "all". In this case, all firewall rules don't work. I ran a traceroute from a client lan add

Hi, I am using a FortiWiFi 60D with the firmware version v5.2.5,build701 (GA). Is there any method to filter or sort by the Source IP (not Source NAT IP) in Forward Traffic Log & Local Traffic Log? Thanks!Hung