Solved

Hi Everyone, I'm here to seek your kind help in understanding what's going on between "VPN connections" and "Windows' CPU Timer Resolution", and especially when it's connecting via FortiClient (latest, 5.4.2.0860). I recently noticed that whenever I'm connected to VPN, my notebook battery seems to be draining much faster than when I'm not. Then after some googling I've come up with a possible cause related to "CPU Timer Resolution" of Windows (I'm on Win10 - 1607 - 14393.693)  ClockRes (a utility to display the current Timer Resolution)https://technet.microsoft...nternals/bb897568.aspx When VPN is connected via FortiClient in my case, CPU Timer Resolution would *persistently* go to ~5ms (fine), as oppose to the disconnected state at ~15ms (normal idle) (see attached screenshot). To my limited knowledge, unnecessarily fine/short timer resolution would drain battery, just like what Chrome did some versions ago: https://arstechnica.com/g...raining-bug-in

Hello,I'v got a fortigate 100D which is unable to assign a IP for management in the same vlan as the LAN.its a single 100D ( no HA ) which I want to manage from vlan 10, the same subnet as the current management IP on LAN side.the gui is slow, probably due to production traffic going over the same port.hence I want to mitigate the management port to where it is supposed to be.however altho I'v enabled subnet overlap, which solves the issue shown below  I still can't get it to work, when I press ok the 100D comes with item not found ; your assist or opinion is very welcome, thanks in advance!

I decided to roll the dice and upgrade a FortiAnalyzer 200D to the new 5.4.2 firmware.I followed the upgrade guide and rebooted before the upgrade, etc. Everything seemed fine till I noticed that all authentication against RADIUS on the FortiAuthenticator 200D 4.1.2 was failing.  I mostly use this to give me two-factor authentication with FortiTokens for admins on the FAZ. Checking further, everything seemed to be going through, but the FAC always reported "Invalid Password".  Note that my FortiGate is still working with the FAC without problem. I tried a number of things, all without success:[ul]Re-entering the RADIUS secret for the FAZ and the FACCompletely recreating the FAC's RADIUS client and the FAZ's Remote Auth (RADIUS) serverRemoving and recreating local users on the FAC, removing and recreating the RADIUS users on the FAZUpdating the FAC to the most recent firmware (4.2.0)Trying users without two-factor authenticationTrying different EAP methodsVerify

Hi, I want to configure a policy based VPN from a remote site to a central firewall. All traffic from the remote site should be tunnelled, no local internet access. To my knowledge the only reliable way to do this is with policy based VPN, and it worked perfectly in 5.2. So i've set up the vpn tunnel and created the policy with action: IPSEC and specified the tunnel. local net 10.x.y.0/24, remote net: 0.0.0.0/0 (i want to tunnel all traffic to central site, remember?), but this breaks the fortigate's own initiated traffic, so it can't reach the vpn remote peer because it's trying to reach it over the VPN, which isn't up because it can't reach the peer... catch 22. This did not happen in 5.2. Config below: hostname # config vpn ipsec phase1hostname (phase1) # show config vpn ipsec phase1 edit "vpn-something" set interface "wan1" set keylife 28800 set peertype any set proposal aes128-sha256 aes256-sha256 set remote-gw x.y.z.x set psksecret somepsk next end&nbs

   Hi, all, on the Fortigate 310b (5.2.3,build670 (GA)) with two vdoms, i make this:config vdomedit vdom1config user settingset auth-timeout 30set auth-timeout-type idle-timeoutendfgt310b (setting) # showconfig user setting    set auth-timeout 30endBut the time-out doesn't work with 30 minutes! (i thinks is the default: 5m) In global configuration doesn't have this configuration:fgt310b (global) # config user setting ?device-category Configure device categories.What i'm doing wrong? Thanks! 

Hi - I've seen Out of band posts but my question are: 1) For the out of band management of Fortigate 500D and 1000D firewalls is the recommendation to configure a separate PSTN line (is it even possible to configure a connection via a PSTN line?),or is the recommendation to configure a separate IP address on the 2nd RJ 45 management interface and to use this? The reason I ask is that these appliances will be managed as part of a Firewall Management Service and need a OOB option. 2) Are there any issues we need to consider with OOB management (PSTN or the 2nd management interface) in a HA configuration (active/active or active/passive)?Many thanks, Larry  

Make/Model: Fortinet 60DIssue: I'm having trouble port-forwarding to my Xbox. No matter what I do it seems as though it doesn't work because my NAT type stays moderate, my goal is to get it to open. I need help with port-forwarding and also using MAC addresses to assign a permanent static IP to my Xbox. Please. if anyone can help me. I've been attempting things for months and am at my wits end.Note: I am not technologically savvy when it comes to this sort of router, so if anyone has a solution please "dumb it down" for me, haha. Any help is much appreciated and I hope to get this fixed, thank you.~ Connor Edit: Willing to pay for services.

Hello, Could you please let me know. How can I give bandwidth Priority to certain IP addresses ?  Regardless of other users consume bandwidth this "VIP" users should get accurate and guranteed bandwidth of 20 MBPS.I am using Fortis OS 5.4 

Hi Guys, I'm facing a problem replacing my old Cisco 1921 to Fortigate 90D. I have a public IP range from ISP, i.e.: 76.252.105.128/26. I divided this range to multiple subnets. Between Fortigate and ISP router there is 76.252.105.128/28 subnet (ISP router 76.252.105.129 and fortigate WAN: 76.252.105.130). The rest of public IPs were divided into small 4 IP subnets and assigned to LAN interfaces, i.e. LAN_1 76.252.105.176/30. The problem is that I cannot access internet servers from LAN_1 and opposite way - I cannot access internet server in LAN_1 (76.252.105.178) from the internet. I have 2 IPv4 policies ISP -> LAN_1 (without NAT) and LAN_1 -> ISP (Without NAT) allowing all traffic. I also have a private LAN_2 (192.168.1.0) which is overloaded to 76.252.105.130 and it works great! I don't have ideas why public IP routing doesn't want to work. On old Cisco everything works great. Do you have any ideas? 

Hi Fortigate Gurus ;) I d'like to block some "bad" sources. For that, I've added some addresses and georegions to a group and created a policy and ordered as first from wan1 to lan. For example I d'like to block China name                : bad2lan srcintf             : "wan1" dstintf             : "internal" srcaddr             : "bads" dstaddr             : "all" rtp-nat             : disable learning-mode       : disable action              : deny status         &

I use a Fortigate  100D with OS  5.4 I'm trying to create a new Custom Category on the Web Rating Overrides, only two default categories appear (Custom 1 and Custom 2) and there is no way to create another. According to the documentation (Security Profiles for FortiOS 5.4 Page 77), there should be a button labeled as Create New, but as you can see, there isn't any on my interface :(   Is there any other way to create and configure a Custom Category for Web Rating Overrides? 

Hello,I want to delete FortiClient traffic logs stored on FortianAlyzer that are visible in Log View->Security->Fortclient_>Traffic. eventually all FortiClient logs.Fortianalyzer v5.4.2-build1151 161213 (GA)Fortclient v5.4  

HiWe have fortiweb 1000D and upgrade firmware to 5.6.1we want to archive local log(Store in fortiweb internal hard disk) in remote Sitein this version fortiweb add ftp/tftp Policy in Log & report menu but when create ftp we do not assign it for any kind of logand we can use ftp policy only for archive config logI want to find best solution for archive all log in remote host?we do not have fortianalyzerthanks

Hello,I am preparing a PoC for test all features of FortiWeb. This lab there isn't outside to Internet so I need to find out any web application to run on Server located behind of fortiweb.Anybody knows any web application for install in any windows domain server? Thanks in advance!

Hello, I have a fortigate 100D. Can you tell me the difference between forward traffic and local traffic in Log & Report section?      

Hi,Im about to install a FortiWeb, to handle OWA, Reverse proxy etc.Where should I place the appliance...?[ul]Directly on Internet with an external IP?Behind Fortigate firewall with NAT?[/ul]If I place it behind the Fortigate, is it possible to use the Servers Certificate on the FortiWeb or do I need to do the HTTPS decyption on the Fortigate?If I place it behind the fortigate, the FortiWeb will have an internal (NAT:ed) address. Whats the best practice here? 

Hello, I've followed the cookbook instructions "Overriding a web filter profile" and the question that has come up is this.  Can I add this to an existing IPv4 Policy?  Meaning can I simply add the user group to the "source" fields instead of going on to step 4 etc. Link: http://cookbook.fortinet.com/overriding-web-filter-profile/ I have a FG800C with 5.4.0GA -Stephen

Greetings to you My problem in brief :We have EMS server with 600 endpoint licenses, My computer is connected to EMS and getting update for AVI want to use VPN from OUT Side to Company! I create user in fortigate user1,pass11$$$&^, I create policy to allow vpn to connect!I tested via browser is working  but from forticlient software it will connect to VPN ! but I can't ping any subnet which I added, Although I can ping my subnet via VPN Browser  My question is ----> in fortigate 200D device i don't have license for VPN, but I have license in EMS 600 EndPointand my Forticlient software it showing registered to EMS  but I'm not able to connect VPN! actually it will connect and I'm getting Alert --> Configuration update was received from FortiGate but I can't ping the subnet which I added ,Although I can ping my subnet via VPN Browser!  Thanks

Fortiauthenticator 400C in Active/Standby Configuration.v3.00-build0121-20141128-patch00 Is there a way to detect a Fortiauthenticator failover from the active unit to the standby unit using SNMP polling or traps? I have looked at the various Fortinet MIBs and although it looks possible with other Fortinet products, it does not seem to be straightforward with the Fortiauthenticator itself. I have also looked at the FAC specific MIBs but nothing stands out as being for that purpose. The 1.3.6.1.4.1.12356 OID is filled with interesting possibilities, but none of them seem to supported on the FAC 400C. I've also considered some secondary methods, such as monitoring the CPU, memory or interface usage on both boxes and comparing them to check for indications of a failover. Again, no particular variable stands out as being suited to that purpose. Is anyone aware of a way that I might be able to achieve the above? Darren.

Hello, The Fortigate NGFW we are using in our current location is a 60D. The 60D is being used as the main firewall, DHCP and DNS device. I have been tasked to separate 2 departments into different networks but keep the same DHCP scope for the new networks. My plan is to divide these departments into VLANs however I don’t know if/how you can setup the Fortigate to provide one DHCP scope to separate VLANs.Can I setup one VLAN to relay DCHP to the other VLAN?

Hello all, We have a Fortigate 100D. I am setting up some port forward & port address translation rules. In looking at the documentation in the KB and the cookbook, I see some differences to the recommendations: * KB article:  http://kb.fortinet.com/kb/documentLink.do?externalID=12945 * Cookbook article: http://cookbook.fortinet.com/using-virtual-ips-configure-port-forwarding-54/  They basically recommend the same process of 1) Create VIP 2) Create Firewall Policy to allow traffic to VIP.The cookbook says to create the policy and limit the services allowed to only the ports/services needed by the VIP, however the KB articles says when creating the policy that it is not necessary to specify a service to allow, and that it can be left to "ANY" since the VIP (with Port Address Translation turned on) only forwards packets using the specified port.  So my questions are this:  1) Is this ok to leave as the "Action=Accept" for "Servic

 Hi, I cannot install Forticlient on my PC. I have the message in french "une opération d'entrée/sortie avec chevauchement est en cours d'exécution" which corresponds to the English message "Overlapped I/O operation is in progress" :  After researches, it sounds be the KB2918614 update that in cause according to different messages on different forums. But after tried, the same message appears, and i can't install it on my PC. Please could you help for this issue ? My OS is Windows 7 Enterprise Service Pack 1. Thank you.

http://docs.fortinet.com/...2.10-release-notes.pdf

Hello everyone, Can someone explain to me why I can't add two default static routes with the destination 0.0.0.0/0.0.0.0 when there is a default route via a WAN Load Balancing "interface"? For example, here's my WAN LB configuration:  Here's how the routing table looks like (please disregard the missing gateway): This is how the new default route should look like:  And here's the error I get when I click OK on the previous screenshot:  This is the system info: Thank you,Slavko

Hello,Does FortiOS support PPTP server functionality. I know that it supports PPTP passthrough, but customer requirements demand PPTP server.ThanksAndreas