Solved

Hello, I'm currently building a site-to-site IPSEC VPN but I would like to know if its possible to use a private IP (10.10.10.0/30) network. Below is my current configuration. Firewall A:Port 10: 10.10.10.1/32 Firewall B: Port 9: 10.10.10.2/32 Both port interface is connected using a cross-cable. Problem: I tried to create an IPSEC - Phase 1 but the tunnel is still down. Thank You

I'm pretty new to setting firewall policies and I'm not sure if I'm looking in the right places to solve this problem. I have the below configs in my Fortigate 90D. For policy 6 I defined a group of schedules to cover all after-hour periods. However no one can access the internet on weekends. They can ping as far as the firewall, but not any external addresses. My question is, did I set the schedules correctly? Everything else appears to work fine, including "morning hours" and "evening hours". # show firewall policyconfig firewall policy    edit 1        set srcintf "internal"        set dstintf "wan"        set srcaddr "all"        set dstaddr "all"        set action accept        set schedule "working hours"        set ser

Hello everyone, i want to allow access to only one facebook page and block other pages...i've been looking for a solution but nothing worked, is there any way that i can do this. Im using URL filter.Fortigat 80D v5.2.7,build718 (GA) thank you for your answers 

Hi, I have a VPN between 2 Fortigate and I notice a strange behaviour : Some machines on one network can ping machines on the other side of the VPN while others can't.Checking in Fortiview / sessions, I discovered that some of them correctly execute the ping through the VPN while the other are trying to connect through WAN (and so it doesn't work). I configured policies for traffic going from and to the other side of VPN, and route to remote network using the corresponding vpn interface. In attachment is an example of what happens. My local network is 10.1.0.0/16 and the remote network is 192.168.0.0/16. Do you have any idea on how to solve this problem ? THank you very much, Regards, Fred

Hi all,I have a Fortigate 90D with Web filter and SSL Inspection enabled. I can't reach https://www.giustizia.it: with Chrome I receive "ERR_CONNECTION_CLOSED", with Firefox instead "Cannot create secure connection". If I turn off SSL Inspection I can navigate to the site; I have tried to add an exception in web filter's rules (wildcard, simple, exempt, allow...) but with no luck. How I can solve this issue?Thanks in advance

Anybody seen any cool tools that will grab fwpolicies and dump them into a format to import into xls, or csv or any other method?

Hi, I'm trying to configure webmail access for end users, to allow quarantine access.I have set gateway mode.LDAP profile works good, it means I can browse LDAP tree and LDAP Query Test (Authentication) works for me too (test result = Bind successful).When I try to login to webmail I get login failed message.Event log shows only that webmail login was failed, no more details.I'm not sure if FM even tries to authenticate webmail user by LDAP.Perhaps something is missing in my configuration, I looked inside AntiSpam/Quarantine Settings for allow end user access settings, but I found nothing like that.What is missing in my config? Regards, Piotr M. 

Hello all, I've recently implemented a number of FG-100s and FG-300s and am trying to move my web filtering service over to these devices. We require that all web traffic be tracked back to the user and so I'm also trying to implement the FSSO service to provide a seamless browsing service to my users. This has worked well so far for windows systems but has proven troublesome for Mac systems. Mac logons do usually show up in the FSSO user list but the "system name" column shows their IP addresses instead of their system name. Web browsing in this situation, to put it succinctly, does not work for the Macs.  Does anyone else successfully use Mac systems with the FSSO service, and if so then what's the trick to getting them to play nicely together? I should mention that we are using the FSSO polling mode recommended by Fortinet to work with Mac systems. Thanks for any help!

I have a FG 800C that was working fineI Backup my configuration, edit it and restore itnow I cannot login to the unit,every try resolve i wrong user and passwordI Try to Login using Fortiexplorer with user "maintainer" to recover my password.I can login, but when trying to reset password i get this massage: FG800C # config system adminFG800C (admin) # edit admin 'maintainer' account can only edit existing admins. node_check_object fail! for name adminvalue parse error before 'admin' Command fail. Return code -37 It seems like there is no user name "admin"is there any way to recover the user? or even restore everything to default? 

Hi, I was wondering how disruptive it is to enable vCluster2 on a production Fortigate installation which is already up and running. Does it affect the existing traffic in any way? Cheers!Emil

I've got a couple of 60C's in HA running 5.0.4.  I tried to log in to the web interface today and it logs me in and loads the top toolbar and sits there with two empty frames for a while before it finally returns a "Error 500: Internal Server Error" in the left frame.  I've tried killing all the httpsd processes but it hasn't made a difference.  A diag debug on the web-ui shows the following when the error shows in the web interface:-[httpsd 27319] http_config.c[573] ap_invoke_handler -- handler 'fastcgi-script' completed (result==500)[httpsd 27319] http_request.c[1443] ap_internal_redirect -- internal redirect to '/p/pubredir/httperror/' Trying to avoid rebooting the firewall at all costs.  I've considered a forced failover to the secondary device but want to exhaust any other possible options before going down that road, and I'm not sure it will fix it anyway.   The web interface was working fine a day or two ago and nothing has changed since then.

 What is the CLI cmd to determine the transceivers installed in a fgt?

In the latest MacOS Seirra beta 5- FortiClient breaks!I'm running version 5.2.3.370. The screen shows empty content, no buttons or text. Any ideas? 

Hello i want to ask,yesterday user in my office cannot browse to internet and use VPN  connection, after i check in my fortigate dashboardantivirus , IPS UTM is unlicensed but i have subscription until 2019, after i check to my policy and routing nothing wrong with my seeting , after that i refresh a browser an antivirus and IPS is licensed again and user in my office can browse to internet again,i dont  know what my problem is, can anyone answer me why subsciption in my fortigate suddenly unlicensed ? please help me.

I need to add a new Isp on Wan 2 and then i would that clients use Wan2 to surf the web but servers and services (exchange server,web server etc etc)  keep on use Wan1.It's enough to:-set the network interface for wan2-add a static route for wan2-change the policies internal---->wan1 and set the outgoing interface to wan2  ??Thanks for your helpFrancesco

Hi guys, I have a customer who needs to block a specific excel file from leaving their network. We have v5.4.1 running on their firewall and I'm busy reading up on DLP and came across the watermarking feature / option, but I do not find it anywhere in the GUI. must this be enabled in CLI or has this been removed from 5.4? they still mention it in the FortiOS 5.4.0 Handbook - Security Profiles. Is there another way I can go about creating the DLP filter for this specific Excel file? bearing in mind anybody could potentially rename the file as well... thanks,theG

HelloI'm really struggling to get a VPN up and running between our 100D with firmware version 5.2.4. and Azure.  I have followed a number of instructions but none seem to work.  The Azure end was created using resource manager.  When I look in the logs I just see IPsec phase 1 errors.  My config looks like this.  any help would be much appreciated.  config vpn ipsec phase1-interfacenext    edit "Azure_P1"    set interface "wan2"    set ike-version 2    set keylife 28800    set proposal aes256-sha256 aes256-sha1 aes128-sha256 aes128-sha1    set dhgrp 2    set remote-gw xxx.xxx.xxx.xxx    set psksecret ENC xxxxxx nextendconfig vpn ipsec phase2-interfacenext    edit "Azure_P2"    set phase1name "Azure_P1"    set proposal aes256-sha256 aes256-sha1 aes128-sha256 aes128-sha1  &nbs

My fortigate 100d is not forward traffic between Guestlan and lan.Guestlan is on a seperate lan.Wan adresses are 200.200.200.2 255.255.255.240One webserver is on 200.200.200.3 and traffic is going fine. From the internet as from the guestnetwerkthe second webserver is on 200.200.200.2From the internet this website is accessable. But when we try to acces the website from the guestnewerk it is not accessable. When we look at the log and report we see it is getting in the Implicit Deny rule. The guest network is 192.168.1.1 and external adres is 200.200.200.13. We have internet acces and eveything is working fine.When I put the webserver from 200.200.200.2 to 200.200.200.4 it is working fine. When I change this back to 200.200.200.2 it stops working. Is this a bug because we use the first address in the range. https on the webinterface is not enabled.System settings https port 443 is changed to 8443 for Administration logon. Please assist

It seems whenever FC updates its databases, it briefly "turns off" according to Windows, which prompts a notification. It shows every minute or so while scanning, and if you watch Action Center while it's doing so, the AV status 'flickers' between on and off. Has anyone else had this/have a solution for it?

Hello, We just proceed with DLP implementation.We create DLP rules to examine and supress mail wich content .js, .bat ... inside archives .zipHowever, how can we add exception for single sender identified by his email adress or his IP ? Thanks for the answer. Best regards Fortigate 500D Firmware v5.2.4

I have a cluster of 3 x FG5001D using 4 VDOM. we was on version 5.0.9 when we realized that the option "Packet Capture" under any VDOM (Vdom -> System -> Network) was not there.After this, we proceed to update to the actual version 5.2.8 and the menu option "Packet Capture" does not appear. trying through CLI, the packet capture works well. but the user of packet capture don't have intimacy with CLI, then we need the GUI working.i checked the user permissions, clear browser caches, other navigator and nothing was effective Any clue of what i have to do?

Hi everybody. I'm setting up a new Fortigate HA cluster (300D) and i have a strange issue. Each time i have to reboot a node of the cluster, he came back as a standalone Fortigate.  Any idea how i can resolve that ? This is pretty annoying. Here is the HA configuration. config system haset group-name "Toto"set mode a-pset password ENC totoset hbdev "mgmt1" 50 "mgmt2" 50 set session-pickup enableset ha-mgmt-status enableset ha-mgmt-interface "Management" <= this is actually a vlan interfaceset ha-mgmt-interface-gateway x.x.xset override disableend

I am wondering if there is anyone that knows a good way to export firewalls rules with comments to a readable format ? copying the rulebase from the gui and paste it to excel works but to get the comments you need to copy the rule base from the CLI and then filter and so on which takes time. Checkpoint for example has many good ways to export the rulebase to HTML. Is there any scripts that can read the config file and export id,src int,dst int,src,dst,port and comment ?

I'm using 5.4.1. I setup fsso and trying to view user activity in forward traffic logs but the user column is blank. I know it is seeing the user because the policy allows that user and the web-filter logs display the user. Is this just a cosmetic bug in 5.4.1 or am I missing something here?

Hello ,My problem is when i reboot my SLAVE fortigate  in a HA cluster config , all of physical ports are down ( with no lights ),  so there is no connection with a master fortigate  , i have restored a last good configuration  to the master HA - GF  but the problem is not resolved .please it is a hardware problem or a software pblm : thank you