Solved

Hi all, is there any way to create new firewall policy via 'config firewall policy' without having to specify a policy id; i.e., let it just take the next available number?  I'm trying to either mass clone or mass create new rules to break multi-interface rules into individual rules so 'interface pair view' becomes usable again in the web interface.  Doing this while having to come up with unique numbers for each clone or edit command is a nightmare.

Hello, we are experiencing an issue with a multi site VPN setup. The central office has a Digium PBX and Digium VoIP Phones are deployed throughout the company. We are quite frequently experiencing issues where our traffic drops and the VoIP Phones at the remote locations are unable to reconnect. The cause of the drops appears to be our Comcast Cable internet connection. It cuts out for a short period of time, maybe 30 seconds or less. Once the VPN tunnel is restored, all traffic can resume as normal (we have RDP Traffic back to the central office as well), but some of the phones will not reconnect. Not all phones. Even rebooting the phones has no effect. The only thing that helps these phones is either waiting maybe 20-30 minutes or more, or to reboot the Firewall at that particular remote location.   Does this sound like anything anyone has come across before? I have a ticket open with FortiNet support, I'm waiting to coordinate getting a packet capture at th

Hi Guys, I am new in Fortigate firewall, is there way to monitor the bandwidth from the settings of the firewall or a software that you can suggest? Thank you guys. 

Hello all, Recently I started to use FortiClient for SSL VPN Connection.Yesterday I tried to install the version 5.4.1 on a XP Client but I'm getting the error attached. I'm using a Forti Client Online Installation tool and basically after that the image download finish this pop-up is shown: "The digital signature on the installer package is invalid. Installation aborted."  In internet I found this solution:- From Internet Options- Select the “Advanced” tab.- Scroll down to the Security section and check the box next to “Allow software to run or install even if the signature is invalid.” This didn't solve..  So I checked for a same issue in this forum but actually I'm not still able to solve. I tried to follow the resolution suggested in this topic:Unable to install FortiClient 5.4 on Windows 7 SP1 x64  The solution is to upgrade windows to the kb3033929, but of course no new kb are available for Win XP. Can you help me t

I'm looking to find out how many concurrent site to site vpn connections can be handled by a FortiGate 100D.  It would be acting as a vpn concentrator The current WAN connection is 100Mb. Each connection would be using on average 1Mb/s.  Is there a hardware or software limitation on the number of connections?The WAN speed can be increased if needed. Thanks!

Heyoo, We have a stock "full-access" portal we use that enables split tunneling. We have a single user that has an application on her laptop that much appear to come from within our network in order to work. All I am trying to do is create another portal, just for her, that disables split tunneling. Portal is created..no problem.I create a new SSL VPN firewall policy specifying the user and info and authentication rule specifying the SSL portal to use and I am unable to save it without error about range not valid... Is this the correct procedure to do this? I'm following the cookbook for 5.0.7 and I thought it was pretty staightforward but I guess not. All I want is a second portal for a single user that doesn't use split tunneling. Thanks!

Hello!We are running EMS 1.0.1.0077 with client versions 5.4.1.0840 and 5.4.1.0860. I've noticed that unless a user is logged in, all of the machines show as offline, which includes our servers. Does anyone know if this is a known bug or a configuration change that I can make on either the hosts, EMS server or within the forticlient configuration? We have AV, Webfilter and vulnerability enabled for servers and will soon add the application firewall. We also have the EMS server communicating with our Fortianalyzer.

Hello I'm new to the forum and also to Fortinet products. I've a customer that have a  request that i couldn't find an answer online. our scenario:  In our network the lan interfaces are lan and lan2 and the ip is 172.16.x.x, wan port is our internet My customer want when he telnet to 10.0.0.x the packet will get to fortigate and the destination ip will change from 10.0.0.x to legal ip on the internet 34.x.x.x and also the source ip change with NAT. I've tried many things and the last one was using VIP and configure the incoming interface as lan and have a policy from lan to wan where the source ip is 172.16.0.0 and destination is 10.0.0.x. we have 100D, ver 5.2.8 Does anyone knows if this is possible and how to accomplish this? Thanks  

Hi! I'm using FG600D Firmware Version 5.2.9 and using VDOMs.According to this KB, this can be achieved creating an LDAP server and then configuring the administrator making the ldap server and the administrator in the same group.It seems that the ldap server cannot be configured in the global section, this can only be done in VDOMs. Is this correct? Is there any way to authenticate global administrators against an LDAP server? Many thanks in advanceEnrico

Hi all, Does anyone know if it's possible to show URLs or hostnames in reports as clickable hyperlinks?

Hello! Could you please help me with creating custom report templates.I want to create report with specific columns (example is in attached file). And one more question - Can I add to report some of Active Directory atributes?tel  +7 7222 600006fax  +7 7222 604740

http://docs.fortinet.com/uploaded/files/3285/fortios-v5.2.9-release-notes.pdf The list of the resolved issues is important IMHO, just some tips:297421 HTTPs traffic is blocked after AV/IPS database update from FortiGuard.306929 Fortigate memory logging is automatically enabled after reboot.382828 When trying to access internal server through SSL VPN in web mode, the login page is not371264 Modify user ran into lock when trying to change user's password during sslvpn connection.376599 Keep IPSec traffic on the hardware during rekeying causes kernel panic.

Hi,see attachment for an overview of my scenario. Using Fortigate 92D on 5.4.1. Configuration was done via GUI. I have one WAN interface with multiple public IP addresses available and a DMZ with a few servers that all listen on 443, plus SSLVPN listen on the primary address (10.10.10.116). I configured 4 additional secondary IP addresses on the WAN interface (10.10.10.117 - 10.10.10.120). I created VIPs to map those addresses to the internal addresses of my servers, and inbound IPv4 policies to allow traffic on those VIPs. Everything is working so far as intended.  Now I'm trying configure outbound NAT for those servers, and this is where I'm not sure which configuration would be considered best practice. I would like that all outbound traffic of each server is NATed to the same IP address that is used for the inbound VIPs (10.10.10.117 - 10.10.10.120). [ul]I created 4 overload IP Pools (one for each external address)I created 4 IPv4 Policies DMZ -> WAN, from th

Dear all, on a Windows 10 machine Forticlient VPN sometimes works and sometimes get's stuck at 98%. The progress window stops at 98% and simply returns to the login screen. This is different from other posts. Since the Windows 10 machine is located at a remote spot, I cannot simply go there and try the not-always-working WAN port workarounds or reboot the machine. We always use the newest Forticlient installer. What to do? We run FortiOS 4.0.4 on a FG310B. Any help appriciated.

Hello, I am basically trying to create a report which will have the networks displayed in one column and beside that the values of who the maximum band width user is , the maximum session an so on will be there. The network which I am working on is a /22 network for which I am editing the data set so that I get reporting based on /22 subnets , select ip_subnet(`srcip`) as subnet, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(rcvdbyte, 0)) as traffic_in, sum(coalesce(sentbyte, 0)) as traffic_out, count(*) as sessions from $log where $filter and logid_to_int(logid) not in (4, 7, 14) and ( ( `srcip` <<=inet('10.22.64.0/22') OR `srcname` = '10.22.64.0/22'))  group by subnet having sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0))>0 order by bandwidth desc The Analyzer instead of taking the /22 subnet mask it is taking as /24 and giving me a report which obviously is not the one what I want. Would be great if someone could point

Hi, We have a Fortigate 600D and would use the two 10Gbit ports for connecting to our network. Over this two Ports (in link aggregation mode) i need to communicate with three VDOMs (VLAN-based). So my idea was to create the trunk in the root-vdom (named rootTrunk) and create an VLAN-Interface on this trunk (named Trunk_VLAN20).So i have create it and assigned an ip address to the interface Trunk_VLAN20 and (yeah!) can ping the IP from a Client in VLAN20. Now i would like to move the ip adress to the correct vdom behind the root-vdom by create a VDOM Link between root-vdom and vdom_1. Also i create a VLAN interface on npu0_vlink0 (port for root-vdom named vlink0_20) and a VLAN interface on npu0_vlink1 (Port for vdom_1 named vlink1_20).After this i assign the ip adress to virtual port vlink1_20. this was not possible to ping. Thus i think thats was a problem in root-vdom by a missing policy. Now i create a policy (in root-vdom) from Trunk_VLAN20 to vlink0_20

Hi guys, Not sure if anyone' s noticed, but it seems that Fortinet will be moving away from the FCNSA and FCNSP certification levels, and going towards an eight level ' NSE' cert. More details can be found here: http://www.fortinet.com/sites/default/files/basicfiles/NSE-Learning-Path.pdf To go-to the next certification level, you would need to hold all the previous ones. So to reach NSE-6 for example, you would need to be NSE-5 certified. The levels in a nutshell are: NSE-1: Completed FCNSA on-line material NSE-2: Passing FCNSA exam NSE-3: Achieving ' Silver' status on the Fortinet forums NSE-4: Passing FCNSP exam NSE-5: Attending FortiManager & FortiAnalyzer training and pass the exams NSE-6: Attending the FortiOS Troubleshooting course and pass the exam NSE-7: Achieving ' Gold' status on the Fortinet forums NSE-8: Pass an oral and practical exam (that has yet to be created) I personally think it' s a great idea and the courses/exams required are perhap

Hello everyone, i have installed for a rist time the EMS and we are now Testing 20 Workstations with a customer. i must say EMS seems to be very cool improvment in comparison to managing FortiClient from FortiGate. But we have one Big Issue now.  We activated Application Control and Also Exploit Protection. and now a lot of "good" and well known Applications like Veem, Outlook, TeamViewer, Apple Mobile Device Service etc. will be blocked as Exploit or P2P (Veem Backup for example) So the question is how can we override this Applications if they will be threated as Exploit??? Thank you very much.  

Hey, who is going first ?  Some small models like 40C are not support.Just have a quick look at release notes, there is a loooooot of know issues...

Is it possible to bind users to a specific IP with IPsec VPN?

Hi everyone, I have recently installed FortiClient 5.4 in a virtual machine running Windows 7 in order to connect to an external VPN. I have configured the settings of the connection (VPN-SSL), and I receive the email with the FortiToken correctly. However, once I try to log in using the six digit code, I always get the same error message (I'm from Spain, so this is more or less what it says): "Unable to connect to the VPN, VPN server may not be available (-8)". Also, in the logs I get the following message: "msg=SSLVPN tunnel connection failed (Error=-8)" At first, I thought that the origin of the problem was the server, but they have used my credentials from another network to check them, and apparently it worked. I don't use any antivirus program in the host, and Windows Firewall is completely disabled. Any leads of what could I do to solve the issue? Best regards

Hi all,I'm very new to this forum so I want to say hello to everyone first and I'd be very happy if I can get some help here :)We have 4 Sites, all connected to each other (mesh) via Site-to-Site IPsec VPN Tunnels. Everything works without problems except one thing:Let's say site B is using VoIP phone system over site A. In site A all phones are working without interruptions, but site B faces the issue of phones go offline and then reconnecting themselves. I monitored with the sniffing option and found that VoIP packets some-when just aren't transmitted for at least 40s. Usually it's running fine, they can do phone calls etc. but then irregularly packets aren't sent anymore.I've monitored the connection between the phone system (192.168.8.30) and one desk phone (192.168.12.50). In the attached picture you can see the packets which are transferred (left side is site A, right side is site B).For any help to find out more about this problem I'd be very happy as this is very annoying :(&nb

I am in this situation. I created IPsec SiteToSite  VPN  with FG60D v.5.2.9  and MikroTik Router. Tunnel is UP and hosts in routed subnet(FG 192.168.1.0/24 MikroTik 192.168.2.0/24) are reachable. Traffic is on. There is only one trouble. From FG60D (192.168.1.1) I am not able ping anything in MikroTik subnet. But from PC (192.168.1.2) in FG's lan ping works. From MikroTik Site all works perfectly. Only from Fortigate ping not response. What is default IP for traffic generated from fortigate(source IP) ?

I have an Action:DENY policy setup at the top of the ruleset for inbound traffic from WAN1 to DMZ. The source address for this policy is a group which consists of some geography-based networks and " bad addresses" that come up frequently in the IPS. However, this policy doesn' t ever seem to get matched and hosts I have explicitly added to the blacklist group--or even as their own entry--are matched against policies further down in the chain. I know this has to be something easy, but after staring at it for a couple of days I' m just not seeing it. Hopefully one of you fellows can see what I' m missing. This is on a FortiGate 80C running FortiOS 5.0.7 (build 3608). I' ve attached a screenshot of the rule set, but the relevant bits of code are here: config firewall address edit " all" next edit " outside.blacklist.121.139.0.0" set subnet 121.139.0.0 255.255.0.0 next edit " outside.blacklist.96.8.126.97" set subnet 96.8.126.0 25

I want to remote to a server on DMZ. Here is my scenario: As shown in the attached image, We have a fortigate 100D firewall which gets its internet from ADSL TP-link modem. There is also a valid IP set on the modem and the modem itself is connected to fortigate's WAN1 interface. The server which I want to remote to is located on DMZ. Please help me configuring and getting my scenario work properly.thank u