Solved

Hi, we have been running different VDOMS for handling different SSLVPN for some customers, with LDAP to their own AD.Would like to get rid of these VDOMS and use one VDOM for all customers but with different portals. There´s two drawback with this that I´m aware of and that is that you can´t have different domain suffixes and the other one is the seperation of, in our case, LDAP servers. We can live with the domain suffix "issue" but is it possible to filter which LDAP server that will be used based on the username? For example, if we would use firstname@domain1.com it would use LDAPServer1 and if the username is firstname@domain2.com use LDAPServer2? I haven´t seen this possibility but without it we can´t change the design since the customers LDAP servers will log and try the credentials for the "wrong domain". Best Regards

   Hi, i have FGT310B (v5.2.3,build670 (GA)) and i can't see the memory logs.FGT310B (setting) # show full-configuration config log memory setting    set status enable    set diskfull overwriteendFGT310B (setting) # show fullconfig log setting    set resolve-ip disable    set resolve-port enable    set log-user-in-upper disable    set fwpolicy-implicit-log disable    set fwpolicy6-implicit-log disable    set log-invalid-packet disable    set local-in-allow enable    set local-in-deny-unicast enable    set local-in-deny-broadcast disable    set local-out enable    set daemon-log disable    set neighbor-event disable    set brief-traffic-format disable    set user

Hello, Having issues keeping a VPN Site-to-Site tunnel up.. My devices are a FG100D and the remote device is a FG30, both have been updated to v5.2.3 firmware. I set up the site-to-site with the VPN wizard, the VPN tunnel was working for about 3 days and then it stopped. Tried debugging on the near end (Remote end FG30 device is about an hour drive away, I would like to resolve it from this end if possible without having to drive there). In the debug it says: P1_RETRANSMIT about 3 times then goes to a negotiation timeout, deleting... Connection expiring due to phase1 down. Tried setting the VPN interface to IKE V1 and aggressive mode but same result. Set it back to IKE2. Not sure if that is the default because setting up with the wizard does not specify. I figured it would default to IKE V2. Looked at a few forum threads and this one had some interesting commands to restart the VPN tunnel: https://forum.fortinet.com/tm.aspx?m=107918 # execute router restart# di

Hi allFG v5.4.1 In policy can not set traffice shapping mac

Hello all, I have a situation  Site Asubet 192.168.100.x/24subnet 10.80.14.x/24 Site B Subnet 192.168.100.x/24 traffic will only be initiated from site A --> 10.80.14.x  The vpn is up and running, but we want to NAT from site A to B.If a user from site A pings to 10.80.255.254  it must be natted to 192.168.100.6 over the vpn to the other side. We have all the policies in place. But it is still not working. Could someone send me in the right direction?Which settings do i need to make to change the destination adress 10.80.255.254 natted to 192.168.100.6? The package should be changed from:src addr: 10.80.14.x --> dest addr: 10.80.255.254src addr: 10.80.14.x --> dest addr: 192.168.100.6 (translated on the fortigate) Thank you very much for spending time !

I have FGT300D, her power is off, I installed two transceivers  FG-TRAN-GC (her out-put is RJ45) in the port SFP (port 5 and port 6), then, I start the power on.I configured port5 (192.168.1.254/24) and port6 (192.168.5.0/24), each port is in her LAN, I put PC1 or switch2 in port5, it’s connected,  if I put PC2 or switch2 in port6 will be connect and will be down after 4 secondsIf I reverse interconnection PC/switch, I connect  PC1 in port6 then PC2 in port5, the PC1 is connected and the PC2 not connected (same problem).I conclude, if I install two transceivers  FG-TRAN-GC in Port SFP, one port  will be connect and the other port will be not connect.

I tried to generate a report within URL field but i'm not able to looking for the right query to use in the dataset.At the log View I see the URL field.Someone can help me?Thank's

Hi after installing new Windows 10 Preview 14251 latest FortiClient 5.4. doesn't work anymore. I deinstalled and reinstalled the same Problem."Your system has been quarantined." error message after starting. It seems that the Network Driver is incompatible.  Anyone with the same experience ?

Hello, I'm about to place an order for FG-51E. I'm planning to install FG-51E in my home office (~12 servers and a few users) with 75mbps internet connection. Will FG-51E be able to sustain 75mbps internet traffic with all features on?Especially, what throughput should I expect  from  SSL traffic inspection? Thank you!

Hey all, I've inherited a Fortigate 80C and recently I've lost all login access to this device. Everything else seems to work, like VPN access and our VLAN. I found a way online to reset the lost admin password using the Maintainer login to change it but I'm getting an error:  Domain1 login: maintainer Password: ******************** Welcome !Domain1 # config system adminDomain1 (admin) # edit admin new entry 'admin' addedDomain1 (admin) # set password Pass1Domain1 (admin) # end User must have a profile object set operator error, -56 discard the setting Command fail. Return code -56 I've tried this a couple of times with the same result. I even tried it with my own login but no joy. I'm not a Fortigate guy so I'm not familiar with the device or any of its idiosyncracies. Am I missing a step here or is there a better way to do this?  Thanks, Joe B 

I'm a little confused about how setting the config from the command line works. Specifically, when I enable router logging, the option disappears from the config. See below: Fortigate (eventfilter) # showconfig log eventfilter    set system disable    set vpn disable    set user disable    set router disable    set wireless-activity disable    set wan-opt disable    set endpoint disable    set ha disableend   (eventfilter) # set router enable   Fortigate (eventfilter) # end   Fortigate (eventfilter) # show config log eventfilter     set system disable     set vpn disable     set user disable     set wireless-activity disable     set wan-opt disable     set endpoint disable     set ha disable end  Why does this happen? &n

Hi,   Does anyone know if I can user social login guest registration along with administration approval? I mean, the guest user register itself using social login (FB, Linkedin, etc) then some administrators receives an email to allow the user to navigate ?  I am using a FortiAuthenticator v4.00-build0019-20151007-patch00.   PS: I have "Require administrator approval" on Self-service portal -> self-registration ENABLED but only works in the regular form. Thanks in advanced. Ronald

I am running two reports on user activity, detailed web browsing, and web usage report.both are full of category Information Technology, most of it is MS office related and such. I have been asked to exclude that category, so the report is easier for management to read.I do not see anywhere to exclude categories, can someone point me in the right direction? 

Hello, We use two FortiGate 3700D (HA cluster) running FortiOS v5.2.3 build670 (GA), managed from FortiManager v5.2.2-build0706 150415.We run a FortiAuthenticator v4.00-build0019-20151007-patch00 We 'd like to upgrade all to last versions: FortiManager and FortiOS to v5.4, FortiAuthenticator to 4.1. These upgrades are validated for FortiManager and FortiOS.http://docs.fortinet.com/uploaded/files/2902/fortimanager-compatibility.pdf About FortiAuthenticator, the Release Notes v4.1 (last version) says:FortiAuthenticator™ 4.1 supports the following FortiOS versions: FortiOS v5.0 Patch Release 12 FortiOS v5.2 Patch Release 4 Other FortiOS versions may function correctly, but may not be supported by Fortinet.http://docs.fortinet.com/...c-release-notes-41.pdf Does someone try and run a FortiManager/FortiOS v5.4 with FortiAuthenticator to 4.1? Regards, Chris

Anyone here set this up? I have tried, get the authentication from Duo, but the 40Gate denies entry. Any hints or tips would be appreciated. Thanks in advance. Using SSL VPN connectivity through the firewall with LDAP authentication, by the way.Fortigate 800C HA Firmware Version v5.2.3,build670 (GA) 

Hi, "diag sys session list" shows this:    session info: proto=6 proto_state=01 duration=722 expire=28077 timeout=28800 flags=00000000 sockflag=00000000 sockport=0 av_idx=0 use=3origin-shaper=reply-shaper=per_ip_shaper=ha_id=0 policy_dir=0 tunnel=/ vlan_cos=0/7state=log may_dirty npu synced none log-startstatistic(bytes/packets/allow_err): org=1031/6/1 reply=659/6/1 tuples=2orgin->sink: org pre->post, reply pre->post dev=31->41/41->31 gwy=192.168.x.x/192.168.y.yhook=pre dir=org act=noop 172.x.x.x:61697->192.x.x.x:1521(0.0.0.0:0)hook=post dir=reply act=noop 192.x.x.x:1521->172.x.x.x:61697(0.0.0.0:0)pos/(before,after) 0/(0,0), 0/(0,0)misc=0 policy_id=1 auth_info=0 chk_client_info=0 vd=4serial=00863f17 tos=ff/ff ips_view=0 app_list=0 app=0dd_type=0 dd_mode=0npu_state=0x003000npu info: flag=0x81/0x81, offload=8/8, ips_offload=0/0, epid=128/129, ipid=129/128, vlan=0x801e/0x801cvlifid=129/128, vtag_in=0x001e/0x001c in_npu=1/1, out_npu=1/1, fwd_en=0/0 Afte

Hi'llI'm using a fortigate 92D with the latest image 5.4 I connect my client's with the Forticlient using IPSEC.This all works I narrowed down in my rules who can connect and to what.But I want to allow only SMB (found that) and SQL traffic to a named instance on a SQL 2012 R2 server.As long as I use the All services rule it works but I would like to limit it to SMB and SQLWhich service and ports are we talking about ??Rene

Hi guys... I have one question. I need to know whether fortigate 60D got mac access filter or not?I have tried to search in system>network>interface>(please refer attachment)...but under dhcp setting, there is no option for mac acees filter. Thanks for help in advance

Hello everybody, I use CatTools for the automatic configuration backup for over fifty Fortigate 60D devices with the Firmware 5.2.2 and 5.2.4.I used the Device.Backup.RunningConfig activity, which connects to the devices via ssh and everything worked fine. However after upgrading most of the devices to Version v5.2.5,build0701 the backup doesn't work anymore. An upgrade to newest Version 5.4.0 also didn't help. I compared the new and the old configuration and also looked for some clues in the Release Notes but couldn't find any reason for this behaviour. CatTools always brings the "Failed to connect to 212.x.x.x. No Response from remote host. Will try again." error message. I would be very grateful if somebody has an idea on how to solve this issue. If you need any additional Information, I will provide it as fast as possible. Thanks in advance and best regards,brigadax

Hello guys, we should enforce TLS to a specifig Domain and verify a specific Certifikate. We have a mail from that Partner he gave us his TLS Certificate CN, TLS Certificate Issuer CA and a link to download the Root CA (its a public CA).  so we must now konfigure TLS for that Specific domain. It should be that way? goint to Access Policy > Delivery > create new > sender pattern * > recipinet patter "*domain of the partner > TLS Profile > Secure . But on this TLS Secure level profile are so many possible options + you have to import a CA first. So we should import that Root Public CA into FortiMail and then choose it there? What should we wright in Check CA Issuer? its a Verisign CA, will it be ok if we chosse "Contain" + "Verisign" ? Whats the Certificate Subject means? is that the Certificate CN? The Domain of our Partner? Did someone have already expierience with such setup?  Thank you 

Hi all,I'm very new on fortigate firewall.I'm configuring a FG100D, it's running in "interface mode" and I need to bridge 2 interfaces, so I created a virtual-switch: I tried both GUI and CLI, then I set an IP Address on the interface "Virtual-Switch".Testing with a ping, I can reach 2 devices connected to virtual-switch, but in "Routing->Monitor" there is not entry with the net assigned to VS, I also create some static routes and, of course, those routes are not in routing table. Software-switch works well. Do you have any suggestion? This my virtual-switch config: config system virtual-switch edit VS01 set physiscal-switch sw0 config port edit port 9 end edit port 10      

Hello, You have blocked zip and. EXE using DLP but I have a problem I can not even download from trusted sites such as Microsoft, please help to exclude these sites from the ban. We also need exception specific domain if Send us e-mail contains a zip attachments  thanks

Hello I was going to upgrade a 200B firewall this evening at one of our branch offices. Going from v4.3.12 to v5.2.6This is a single firewall that was at one time part of an active-passive HA pair.  The slave had been removed a while ago but The HA config on this FW, says that it is still MASTER and that HA Config is 'Active-Passive'.  I was concerned that if I applied an upgrade of the firmware and did a reboot, this could cause a possible failure or crash.  Could it have?  My main question:  How do I set the firewall to 'STANDALONE' without impacting the current config(attached)? Is it as simple as going into HA Config and changing the Mode from Active-Passive to Standalone and hitting OK? Of course my main concern is doing something improperly that brings down the firewall. Thanks!

Hi: I´m planing to implemente HA virtual clustering, and as far as i can read on the documentation, fortigate cluster uses a special set of mac addresses on the interfaces, i have an scenario where i need to specify a specific mac address on some interfaces, so, my mayor concern is about compatibility of this custom mac address with HA functionality, should it work? We are planning to use 2 x FG100D, 5.2.6, virtual clustering, 3 vdoms, we use just firewall, ipsec, and ssl vpn, and have implemented wan failover and balancing, all of this already working fine in a stand alone FG100D. It would be great to hear from your experiencies regarding this. Thanks in advance for any feedback on this  Victor 

Hi, how I can enable extended log of web filtering ?   I got Fortigate 60D (firmware 5.2.5)I enable webfilterI add webfillter monitor-all to interface But I do not have UTM under Log & Report :(I try google  and CLI# config dlp sensor  # edit [Name of Profil]  # set extended-utm-log [enable | disable]  # set dlp-log [enable | disable]  # set nac-quar-log [enable | disable]  # end   BUT : # config webfilter profile  # edit [Name of Profil]  # set extended-utm-log [enable | disable] I get error -61 after this command. :( Also I can't change profile under web filter in security profiles :( Please advise..  Thanks