Solved

I have WiFi controller HP, wireless users are identified by the RADIUS server (Windows NPS). I want to see these WiFi users on FortiGate, is this possible?Thank you!

Hi,Just replaced my old firewall (Zywall) with a Fortigate 100DOn the Zywall there were 2 vlans 6 and 99I rebuild this on the Fortigate. Connected the same cabeling to the fortigate but the vlans are not working.Lan port 1 is connected to a HP switch and on the switch vlan 6 and vlan 99 are tagged on this port (this was already set)My question is why is there no traffic between the fortigate and the lan.Vlan6 Type is Vlan, interface is lan, id is 6. ping is enabled. DHCP is also enabled. ip is 192.168.101.1Vlan99 Type is Vlan, interface is lan, id is 99. ping is enabled. DHCP is also enabled. ip is 19268.99.254lan itself is 192.168.1.1have a policy from vlan6 and vlan99 to Internet and a policy from vlan6 to vlan99 visaversa.Any why i cannot ping from internal netwerkserver to 192.168.101.1?

Hello,i have issue when open some website like yahoo.com For example but not limited to ,from Chrome i found  error  below:"The certificate for this site expires in 2017 or later, and the certificate chain contains a certificate signed using SHA-1". what should to do to solve this issue ? thanks

hello all, I'm planning to place the slave unit of a Fortigate HA cluster into a remote location. There is a leased line (layer 2) for the HA connect. Can anybody confirm that I can run the HA traffic across a VLAN between the access switches on each side of the line? I know that HA traffic uses a non-standard ethertype, and I've tested that HA traffic is transfered unchanged over that line. But now there will be VRRP traffic between 2 routers on this line as well, and I'd like to isolate the HA traffic on a VLAN of it's own. There is the option to enable authentication and encryption of the HA traffic but this will cost performance. Though it will isolate the traffic I guess. I appreciate any advice, esp. from someone who has already separated a HA cluster geographically.

Hi All,I am having some issues with websites not rendering correctly behind a Fortigate 200D (5.0.7) Basically the pages are screwed up with text over the top of other text and the layout of the page changing. I have attached an image of what I see for reference.  The only features that are turned on on the Fortigate are, WiFi and Switch Controller and Web Filter. I have tried disabling the web filter and this made no difference. I'm hoping someone else has seen this behaviour and knows of a fix ThanksRob

Can someone tell me, which algorithm uses fortinet to choose between two suppliers connected one in each wan? How it makes the desition?  Thanks 

Administration Guide says "Server Override Mode Select Strict (Access Override Server Only) or Loose (Allow Access Other Servers) override mode. " and CLI documentation for "config fmupdate server-override-status" isn't much more helpful. Clarification of what this does, would be much appreciated.

Hi All, We recently started installing the Forticlient due to a virus outbreak that was not caught by Symantec.  On top of the virus, for a week I have been dealing with random IGMP storms on the LAN and I cannot seem to track it down.  I was worried a couple of our servers had something malicious on them that was causing them to send out all this traffic.  It would cripple our server vLAN and it is very random.  Sometimes I can do a day without any storms, but other times it happens an hr or two after rebooting the servers. I did find one post about someone having a broadcast, or multicast storm and it was the Forticlient that seemed to be the culprit.  Has anyone else noticed this type of behavior, especially when installed on a VMware VM? I started installing two new Server 2012 VM's on Friday.  The only thing I installed, aside from Windows updates, was the Forticlient and later on the network was flooded with IGMP traffic again.  I

Hi, I am new with Fortigate. Fine product. But I have the follow challange.I have 8 public ip addresses and one to assigen one public address to a guest lan.Should I use Vdom's? What is the best way to accomplish this? using a Foritgate 100D Thanks in advance.

Hello,We have run into a problem with a custom dataset, and we don't know how to solve it. It would be great if someone with good query-skills could have a look at it. A customer wants a more detailed version of the "threat-Top-Virus-Source"-dataset, where srccountry also should be listed. We suspect that the problem is that "srccountry" only exists in the DB "log-traffic", not in "log-virus", but we are pretty clueless about what to do right now... The original dataset "threat-Top-Virus-Source":[code lang=sql]select srcip, hostname, sum(totalnum) as totalnum from (###(select srcip, hostname, count(*) as totalnum from $log-traffic where $filter and logid_to_int(logid) not in (4, 7, 14) and utmevent is not null and virus is not null group by srcip, hostname order by totalnum desc)### union all ###(select srcip , ipstr(`dstip`) as hostname, count(*) as totalnum from $log-virus where $filter and (eventtype is null or logver>=52) and nullifna(virus) is not null group by srcip,

Sir , we are using FOrtiAnalyzer VM64 with multiple Fortigate FW's   .kinldy help me create following Reports 1) Create Daily Total Bandwidth Used   ( Inbound   & OutBound ) Like Downloaded :  X GB Uploaded  :   X GB Currently there are reports which showing Top 20 Bandwidth Users 2)In Fortiview Tab when filtering  via Proxy Policy ID 571  it is showing other connection Blocked events also instead of showing Just Events  with Proxy Policy ID 571  , how to 3)In threats Reports its showing Malware source IP , Hostname   , Is is possible to show MAC Address also  [when i go to fortiview >Select malware > Select IP > i am able to see details like source Hostname & Mac address 4)Reports of  VPN /P2p Users Like    catagory = Utorrent Hostname & Ip address Hostname & Ip address catagory = Vuze Hostname & Ip address orHostname - IP - Utorrent thank y

Good afternoon. I am not a networking guru, so I hope ask these questions in the correct manner. I have a port that I want open and forwarding to a specific client machine. I have gone through and done the VIP, VIP Group and entered the policy. Everything seems good according to what I read in the cookbook. Running v4.0 MR3 Patch 12. When I do an external port test, I get a time out error, and that the port is not available.  Subscriptions are not up to date. Am I missing something to open this specific port?  Lets say it is port 4080.  Is there a specific area in the panel that I need to specifically open that port before port forwarding will even work, or is the set up of port forwarding essentially opening that port? I just know there is also the Services\Custom set up, and I have done nothing in that area... Help is deeply appreciated.

FG-100D is configured with two WANs combined via WLLB. ISP for WAN1 has been flaky lately, dropping out for 30 seconds or so occasionally. I expected traffic to be immediately routed to WAN2, but in reality I have to manually disable WAN1 in the GUI in order for this to happen. The relevant parts of the config is below. I'm trying to determine whether I have something configured incorrectly in the Fortigate, or if the misconfiguration is occurring between my ears. Thanks in advance. Eric 5.04-FW-build1064 config system interface    edit "wan1"        set vdom "root"        set ip 74.143.138.236 255.255.255.248        set allowaccess ping fgfm        set type physical        set alias "isp1"        set estimated-upstream-ban

Hi Everyone,I am trying to create a report of all keyword searches ,there is a dataset "webfilter-Top-Search-Phrases" in 5.2.2 however produces no data.Has anyone had success with tis dataset or any other method. As I previously said I just want to know what the top 20 -30 keyword searches are in Google or likewise. Many thanks In advance

We left setting up our wireless networks for after we had the pre-existing wired networks duplicated and working when we made the switch from Cisco to Fortinet. It seems now that this may have been a mistake.We want 2 networks. One for guests, and one for corporate users. The one for guests is no problem. It's up and running. The one for corporate users isn't.We'd like the corporate wifi to be on the same network as the internal wired network. The problem is that this was already setup as it's own dedicated interface. From what I've read, the usual solution is to make the wired and wireless part of the same virtual switch. This isn't an option for us due to the current setup.How can I make the wireless bridge that internal network? Or maybe make that wireless network separate, but have access to the internal network as if it was a member?

Folks - Exchange 2010 lets you restrict use of internal Distribution Lists to authenticated *senders* only.  However, when an outside user replies to a message that includes the internal distribution list as well as external addresses, Exchange allows that message. This leads to unwanted Reply to All scenarios occuring. Can I blocked mail to ADistributionList@ourdomain.com, where ourdomain.com is a protected domain in our Fortimail configuration? Running Fortimail v5.2, Build 404. Thanks for any assistance, it is appreciated.  I did review the admin manual but wasn't able to find any item which appeared germane. Regards - Pete

Hi, I am trying to create a report from a filter/view on the Traffic Log page in Log View. The steps I am taking is as follows:1) Add Filter > Service: SMTP 2) Add Filter > Destination Country: China3) Last 30 days. I get the results back that I expect, all SMTP traffic going to China.4) Tools > Chart Builder 5) Give it a name "SMTP to China". 6) Keep all over settings as deafult, preview appears, click Save. Receive a message stating "Error in creating the chart and dataset" I'm not sure what I am doing wrong, and don't currently have the knowedge of FAZ to create this report myself. Any ideas? This is a FAZ-300D running v5.4.1-build1082 160629 (GA)

I've searched for a long moment but couldn't find answer to my question below.  It would be nice if someone could help me. I have a FortiGate 80c whose firmware (O/S) is vers 4.3.15.  Its web management UI is using some default certificate.  Of course, I could:1. put an exception in every browser I'm using to manage the device, or2. import the certificate to every browser I'm using But I think there's a 3rd option: use a better certificate with a well-known CA.  However, I'm unable to see where I1. I assign the SSL certificate,2. I import this SSL certificate (in System > Certificates > Local Certificates like those cert for SSL-VPN?) Thanks in advance NB: In case it's not clear, I'm not talking about the SSL certificate assigned to SSL-VPN.

Hi,How  to reduce bad  syn rate to the minimum ? Thanks

Hi I have fortigate 60D running 5.4.12 fortiswitches 124D with S124DN-v3.4-build192 running2 forti aps 321 with FP321C-v5.4-build0339. the fortiaps are connectect through the fortiswitches with the fortigate. The reason why I bought fortinet solutions because of the good security and the central management.Problem is that the capwap tunnels are instable. Once they are up they stay up, but dont reboot any of the systems or you risk that switch or AP is not able to establish capwap again. date=2016-07-28 time=19:16:29 logid=0100022900 type=event subtype=system level=notice vd=root logdesc="CAPUTP session status" msg="session join: S124DN3W15000064 is connected date=2016-07-28 time=19:16:19 logid=0100026001 type=event subtype=system level=information vd=root logdesc="DHCP Ack log" interface="root-sw" dhcp_msg="Ack" mac=08:5B:0E:E4:68:BA ip=169.254.254.2 lease=604800 hostname="S124DN3W15000064" msg="DHCP server sends a DHCPACK" date=2016-07-28 time=19:16:10 log

We have a need to use VDOMs, which I'm not currently using. I have a fairly extensive configuration (IPSec, VPN clients, email and web filtering, etc.).  When enabling  VDOMs, what exactly happens to my current configuration?  If I have all that sort of logic set up, how disruptive is it going to be?  I'd like to get my current config going in a single VDOM before I start experimenting with an additional VDOM.   The documentation is kind of unclear about this, so forgive me if this is a FAQ that I just can't locate a good answer to.  I'm a total newbie with VDOMs, and don't have an extra Fortigate to use in a lab so I'm unfortunately experimenting with production here.  Thanks in advance! - Steve 

In fortiOS 5.4, how to link a schedule to a Traffic Shaping Policy ? Thank's 

Hi, thank you for your time...someone told me that there is a solution for setting Quota in New FortiOS, but i can't find anything to do that.i just want to know, is there anyway to set Quota for my local internet users, or not?thank you.

i am not new to the Fortigate line of routers but have questions regarding IPS and how/when to implement it. if i am configuring a new fortigate router for a client that has a small office network /w domain server (IE: 10pc / 1DC)  how should IPS be implemented...if need be?  port forwards that would be set up for the server would be port 80 and port 443 and nothing for the desktop clients except maybe RDP access. #1 would it be needed?#2 would i just apply the default IPS filter on the WAN to LAN policy for the port forward? any info would be greatly appreciated. Thanks,Gary.

Hi all good news for everyone which uses SSL Offloading with Virtual Server. FortiOS 5.2.8 is supporting new TLS 1.2 which was until now not the case and which is only the case under FortiOS 5.4 All devices which are able to use SSL Offloading (consult software matrix) have under FortiOS 5.2.8 this possibility.# get system status | grep VersionVersion: FortiGate-300D v5.2.8,build0727,160629 (GA) # config firewall vip(vip) # edit testnew entry 'test' added(test) # set type server-load-balance(test) # set server-type https(test) # set ssl-min-versionssl-3.0 SSL 3.0.tls-1.0 TLS 1.0.tls-1.1 TLS 1.1.tls-1.2 TLS 1.2. hope this helps have fun Andrea