Solved

I have an Action:DENY policy setup at the top of the ruleset for inbound traffic from WAN1 to DMZ. The source address for this policy is a group which consists of some geography-based networks and " bad addresses" that come up frequently in the IPS. However, this policy doesn' t ever seem to get matched and hosts I have explicitly added to the blacklist group--or even as their own entry--are matched against policies further down in the chain. I know this has to be something easy, but after staring at it for a couple of days I' m just not seeing it. Hopefully one of you fellows can see what I' m missing. This is on a FortiGate 80C running FortiOS 5.0.7 (build 3608). I' ve attached a screenshot of the rule set, but the relevant bits of code are here: config firewall address edit " all" next edit " outside.blacklist.121.139.0.0" set subnet 121.139.0.0 255.255.0.0 next edit " outside.blacklist.96.8.126.97" set subnet 96.8.126.0 25

I want to remote to a server on DMZ. Here is my scenario: As shown in the attached image, We have a fortigate 100D firewall which gets its internet from ADSL TP-link modem. There is also a valid IP set on the modem and the modem itself is connected to fortigate's WAN1 interface. The server which I want to remote to is located on DMZ. Please help me configuring and getting my scenario work properly.thank u 

I'm having trouble getting a custom app ctrl sig to work on 5.4.1. Basically i want to identify the use of a special type of browser, it's present in the user-agent field as 'Shield' and the header includes the unique field 'X-SHIELD-ID:'I've got an app ctrl sensor that passes everything and a custom override with the sig below set to monitor, however the log identifies the app as http.browser_ie , which it basically is.Can anyone see anything wrong in the syntax i've used, if not, is there another reason why this is getting logged at IE and not the custom sig? GET /favicon.ico HTTP/1.1 Accept: */* Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; Touch; rv:11.0) like Gecko; Shield X-SHIELD-ID: d0131c8c-fa23-4e74-9e1d-d6b8fa9489ed F-SBID( --name "Shielded_Browser"; --protocol tcp; --service HTTP; --flow from_client; --parsed_type HTTP_GET; --pattern "Shield"; --context header; --no_case; --app_cat 25; )

Multiple incoming static IPs @ WAN1, forwarding to specific servers. VIPs / VGroup / Port Forwarding set up (No NAT), and forwarding works internally using secondary IP (can connect to web server), but can't access from outside... times out. My experience with this is limited, so I am not prone to experiment too much.. ;) Read somewhere that specifying a secondary IP on the WAN1 interface should not be necessary, is that true? That's the only idea I have left, so if that's not it, maybe someone can point me in the right direction.. Thanks!CW Jones

I have FortiMAil 100c in Gateway mod with Exchange2007. How to block or is there some option to limit wrong SMTP auth for mail accounts on fortimail ?

I was pointed to http://docs.fortinet.com/uploaded/files/2041/using-a-custom-certificate-for-SSL-inspection.pdf by support when I asked about using cert for ssl inspection. Are these instructions only meant for someone who has an internal CA that is trusted by clients? It seems that no Public SSL CA company would grant this type of cert. If that is the case the directions don't really say that. I am just trying to do web filtering of my clients and was hoping to not have to install cert on them. Also how does it work with web filtering on guest network / byod where you can't install cert on client machines?

I am prepping a new Fortigate 240 running 5.2.9 to be installed. I have two WAN links. One is primary incoming with public IP and outgoing web. The second is mostly for VOIP and redundancy. I setup a WLLB with the two interfaces. I am now trying to setup policies. I have 1-2 rules that I want to do source (IP / domain) filtering on with Virtual IP NAT to internal server from WAN1. In the address object setup you cannot choose interface wan-load-balance only wan1 / wan2 or any. I know the traffic will come in WAN1 since that is where public IP is. Then when I create policy I must choose incoming interface of wan-load-balance since wan1 / wan2 aren't available in drop down. When I do this however it removes the address I created for wan1 from the drop down list of source addresses? Since I am using WWLB with the two wan interfaces do I need to choose any as interface for address object? Is there something I am missing here? I just want to make sure I am load balancing outg

Hello there, I`ve upgraded our FGT60C from Firmware v5.2.7 to v5.2.8. Now in ssl-vpn-portal rdp-native doesn`t work anymore. There comes the message "Failed to launch rdp-native" Java is installed correct and works. SMB-access to shares works as well. Has anybody the same experience? Thanks for comments. Nik

Hi all We have a site with a FG 60D with a few FP221c'sThe FGT is running version 5.4.1 build 5447 Users are complaining that they are having intermittent wireless connectivity issues.They noted the following The wireless remains connected, but access to the internet and internal resources is lost and later returns. They verified that when connected to the wired network they are not having any issues.This could happen several times a week. Anyone experience this issue ? Thanksggntt

I have a vpn config with forticlient... days ago worked well but today not. I review the events in the fortinet but does not tell me much. When the client tries to connect it reaches 98% and closes the application can you help with any idea?attachment the print screen

Hi! I uninstall Forticlient 5.4 on Windows 8.1, during uninstall it notice what services are running and I need to restart my PC.After I accepted Forticlient uninstall correctly but after restart ALL my network devices failed to start (code 10). WTF?  

All: We are trying to get an estimate of daily syslog log volume in GB with all logging options enabled on the 3700D for roughly a 500mbps throughput.  Could someone give us a rough estimate?  We realize there are many variables but are just looking for an estimate to make a comparison. Thanks!

I am working with a new client who's user community is big. When I am try to generate log for 1 day the log report has only 10,000 entries in it. But it would definitely have more than that. Is there any way to increase it ?. It would be great if someone could help me on that. 

Just acquired a Fortigate 70D and setting it up for the first time. Have not configured anything as complicated or powerful as this firewall before. Tablo is a device for capturing over-the-air TV broadcasts and streaming them to your viewing devices. It requires some port forwarding when you want to reach the device from outside. Specifically, it requires port 21101->8887 and 21100->80. I have tried to configure this on our Fortigate 70D but the device still says it is not properly configured. Here are all the sections of the config that pertain to the Tablo device. Please help me find where I have done something incorrect (or made it more complicated than it needs to be)! config system dhcp server     edit 1         config reserved-address             edit 1                 set ip

Hello all,I have trouble with FC 5.4.0.0780 on Win 7. When I'm trying to connect to FG I'm getting the following warning, and it stuck at 40% :"Unable to establish the VPN connection. The VPN server may be unreachable. (-5)" Does anyone have the similar issue ? Thank you in advance.

Hello, I have a fortianalyzer on version 5.2.7. I'd like to see what the top services (https, smtp, ftp, etc) are every hour over the course of a day, and how much bandwidth each is using per hour. Is there a custom dataset, or might someone help me create one, which will allow me to view the top 5 or so applications / services in use broken down by bandwidth and hour of day?  Thanks for any help.

Hello all,I am running firmware 5.2.8 what the benefit and impact of enable "heuristic quarantine" in Antivirus profile?What do I need to do it? Thanks

Hey folks. Newbie here. I'm not a networking person (more software pm and technical sales), so please excuse my ignorance on the subject. Our IT consultancy says that we should considering purchasing new firewall appliances to replace our 60D models; the organization has grown over the past few years, but not astronomically. My understanding from networking friends is that problems are often more related to software license limits than CPU. Its justification is that mobile device traffic isn't being covered (they say our firewalls couldn't handle the extra coverage) and that we're 'on the edge' of normal operation. We see no evidence that they're operating "on the edge". What are the signs we should look for that will tell us we do need a new firewall and how can we monitor that and be alerted when it happens? Thank you. -d 

I manage 7 separate sites servicing around 10,000 users in total with internet services through WiFi enabled equipment using Fortinet and Fortigate devices at each site. 9,996 users seem quite happy with the service, but 4 of them have reported an error when connecting to what I assume is the Authenticator, as the error comes up with the captive portal login option - the error reads 'Error (EBNCaptivePortalHandler) Unknown Error' (screenshot attached). The users are able to 'OK' the error and login successfully. The devices are iOS 9 and 10 (happened on both versions) to this small user group. These users have logged in successfully at other sites, without the error, so its just on this one site that they get this error. I have raised this with the service provider (we pay for this internet/WiFi service to be installed and managed for us) but since it is not all users at all sites, they argue that it is a personal handset issue not a system/infrastructure issue. Any thoughts

Hello, a customer asked me if it is possible to block / deny senders which have numbers in their email adresses like (mike445@example.com) . is it possible to build like a regex for that? is it possible to say if Sender has more than 2 Numbers or more than 3 numbers in his email adress? Thank you very much

Our new Fortimail appliance (400) refuses the typical https://192.168.0.99 admin login on port 1 SSH admin works fine. We have tried all major web browsers.We executed a factory reset.Yes, password is blank.Yes, "admin" Any suggestions????  

Hello, Is anyone running 0.0.0.0/0.0.0.0 as the source and destination for a P2 selector? I have a growing list of about 30 P2's that would be much easier to manage if it were just the one wildcard entry. I would still be controlling the traffic on my policies. Any pros/cons to doing it this way? The unit on the other side of the tunnel is a Fortigate as well.   Thanks

Hello everyone, I'm a newcomer. I come from a sonicwall tz205! I'd need some tips for setting up a new fortigate 100d... :)I will explain briefly the situation. I always had a very simple network. Now at work I have created a new network for voip phones. At the moment so I have two physical networks. 1 for PC in 192.168.1.0/24 2 for voip phone 192.168.3.0/24 I had the interfaces on sonicwall x0 x1 x2 ... on the new fortigate 100d I do not have that kind of division.I currently have 16 port switch hardware dedicated to the "LAN" with the address 192.168.1.0/24. How can I bind a port for the VoIP network? I neet to create a new interface ? zone ? vlan ? The other thing that I must say is that I wish the two networks were able to communicate.I did several tests but I can not do a ping from one network to another. Thank you all!

The fortigate 5.x documentation states that when you create a virtual IP address (VIP) and do NOT specify port mapping, that traffic should be translated for both inbound (dnat) and outbound (snat) traffic. If says: " if you leave the ' port forwarding' checkbox unchecked it is therefore mapping all ports, it will do bi-directional NAting, so the single VIP entry will control both inbound and outbound address translation." Overall this seems like a very good thing for reducing the complexity of configuration for standard internet-accessible servers. However, we' re finding that this doesn' t seem to work unless you issue " set nat-source-vip enable" from the CLI for every VIP (it defaults to disable). By default, outbound traffic just falls through to the general nat pool that we have set up for all other clients. Is this the expected behavior? If so, I can' t see how the reference manual is correct. If this is needed, is there a way to change the

Hello, I would like to ask some advise and recommendations as well with our Site-to-Site IPSEC VPN.Below are the scenarios. Please refer on the attached diagram. We have an existing Site-to-Site IPSEC which is Site A going to Site C. Since we are expanding our site, we are creating a new site which is site B. The problem is, it has the same IP segment, 192.168.18.xx. [strike]Also, our main goal is to be able to communicate site A and site B without changing the IP Networks on both sites. Meaning, we will use 192.168.18.xxx on both sites. Is it possible?[/strike] Already achieved this goal. Next, let's say we were able to achieve our main goal above. [strike]Our next goal is to be able to communicate site B to site C without changing configurations on site A to site C which is our existing site-to-site IPSEC.[/strike] Mission complete. :D  Thank You.