Solved

Hi, on Fortigate 100D ver 4.x we used a FSSO with FSSO Agent installed on Active Directory server with no trouble. After change firmware to 5.2 and FSSO Agent to 4.3.0159, users started complain about websites: sometimes websites opened and sometimes not. I decided to change SSO method to Polling. I configured everything with no luck. no users are shown in User & Device -> Monitor -> Firewall -> Show all FSSO Logons. The " diagnose debug authd fsso server-status" command shows only " Local FSSO Agent" !! which is not visible under User & Device -> Single Sign-On (I even deleted everything I created before): LDAP test: pass. When I add a SSO, the status is always grey X mark.

new release is available in the download portal...

Hello,I have successfully connected site to site IPsec connection to azure and everything working fine except the dns. I have my windows DNS server in Azure network So my client have to get dns query through IPsec tunnel I am confused configuring DNS in FG60D See the attached image for current config Please let me know how to configure DNS on FG60D to get query from azure vm. ThanksNihal     

Several people convinced me that the next platform I should learn is Fortinet's, so I just got a used FortiGate 90D. Amusingly enough, it still has support and contracts for a few more weeks, so I updated it to 5.4, build 1011. I can't seem to find a way to set up a VLAN that is tagged on one physical interface and untagged on another. On JunOS, I would do this: set interfaces ge-0/0/0 unit 0 family ethernet-switching port-mode trunk set interfaces ge-0/0/0 unit 0 family ethernet-switching vlan members userVlanset interfaces ge-0/0/1 unit 0 family ethernet-switching port-mode accessset interfaces ge-0/0/1 unit 0 family ethernet-switching vlan userVlanset interfaces vlan unit 10 family inet address 192.168.10.1/24set vlans userVlan vlan-id 10 set vlans userVlan l3-interface vlan.10 That would tag the VLAN out port 0/0/0, not tag it out port 0/0/1, and the router would have a layer 3 interface on the VLAN that can be reached from either to act as the gateway for all traffic on

I have configured LACP link (2 port) on Cisco 3560 and FG310B, everything seem be fine, but when I put traffic on this LACP link, traffic just rided on one physical link, when I shutdown one port of LACP, traffic switch to another. It didn't load share!Do I have to config somthing futher on Fortigate ?

Hi there Specialists,I have a question regarding custom IPS rules. I've wrote multiple IPS custom rules to prevent locky infections. The rules contains a pretty common attachment name, but for now it's being used by the locky ransomware so we would like to block all the SMTP attachment containing the name we defined ( see rules ). The rules are:#SMTP F-SBID ( --name "ITCustom.Locky.SMTP.TCP.Feb21-1"; --protocol tcp; --ipver 4; --pattern "invoice*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "IT.Custom.Locky.SMTP.TCP.Feb21-2"; --protocol tcp; --ipver 4; --pattern "invoice_*-*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "ITk.Custom.Locky.SMTP.UDP.Feb21-1"; --protocol udp; --ipver 4; --pattern "incoice*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) F-SBID ( --name "IT.Custom.Locky.SMTP.UDP.Feb21-2"; --protocol udp; --ipver 4; --pattern "invoice_*-*.doc"; --context body; --service SMTP; --log DNS_QUERY; ) #HTTPF-

Hi, Im trying to use Open Directory LDAP authentication for VPN logins.I've set it up for multiple Active Directories and it works great.But Open Directory does not have a memberOf attribute on user object.I have found a couple of suggestions on google, but have found nothing that works. my config is:config user ldap   edit ldap_name      cnid mail      dn dc=server,dc=domain,dc=local      type regular      username uid=username,cn=users,dc=server,dc=domain,dc=local      password *      group-member-check group-object      group-object-filter "(&(objectclass=posixserver)(memberUid=*))"      member-attr gidNumberend If I allow any LDAP group in Group on Fortigate it works.If I try to specify a group it doesn't match.&

Hello,How to block access to my device using a public address from the Internet?just i want access it form my internal network.  thanks in advice 

Hi Everyone, The IP addresses on our internet facing physical interface, as well as on the VIP IP addresses recently got flagged as vulnerable DNS open resolver servers. This surprised me, as we do not run any internet facing DNS servers and have never explicitly configured the Fortigate (FortiOS 5.2) firewall to listen on port 53, or forward port 53 traffic to an internal DNS server. But when I checked an IP address with openresolver.com, sure enough, that says the IP address is listening on port 53, and is vulnerable to a DNS amplification attack. Anyone know what gives? Thanks!

I've started yesterday by installing Forticlient, "VPN only feature". Was not working at all. I mean in console was not usable, just a "Navigation to the webpage was canceled", settings again displayed nothing.After trying to run it in compatibility mode or as admin, gave up, uninstalled it an reinstalled "full flavor". Now some things started to work, it was showing some messaged. But still not working.So next was to let windows update to latest build, "Version 10.0.14257 Build 14257" (Insider build)Now I was able to view the screens configure a VPN connection (SSL-VPN) and try to connect to it.1st attempt caused a windows crash. Next attempts ended with connection going up to 48% and then show a "Access denied.  (-455)" message.As a side note, when trying to click on systray icon and select "connect to .... vpn" I only got a "Failed to start Forticlient Console." message. (does not take UAC into account?) Is this software suppose to work somehow? Is there one being able to

hello everyone,  I am a newbie to Fortigate VPN connections. We have a VPN  connection (Fortigate 200D) with our partners usine Cisco ASA. I need to add a second subnet at our end to the VPN and also additional remote subnets to the VPN tunnel. I really need all the help i can get with this.  Thanks 

Hello everyone I am all new to Fortinet and FortiGate, though i am a quite old Networks "user" Right now i am in the process of swapping a Juniper SRX100 with a Fortigate 92D and a Juniper SRX240 with a Fortigate 140D-POE (+FAP321C)In general i find all the configuration points i wish (and can dream of) and  always amazed how easy and efficient everything is (especially coming from Cisco, Juniper and other Checkpoint products) The only thing i am struggling with right now is the setup of the LANs and VLANs (i didn't think that going full VDOM was necessary) I attached a quickly drawn high level concept of the network to give an idea of what i am trying to achieve I am working with 3 VLANsGreen - 192.168.1.0/24 - DHCP server activeAmber - 192.168.10.0/24 - DHCP server activeRed - 192.168.100.0/24 - DHCP server active Green is reserved for trusted devices (PCs, Macs, iDevices, ...)Amber is reserved for internet facing servers and other de

I'm experiencing an issue with FortiClient where it has suddenly completely stopped working. [see screenshot below].I've searched everywhere for a solution to this issue but haven't found any solutions. I've tried disabling all my anti-virus applications as well, and that still doesn't help.I've also tried installing just the SSL VPN application but it gets stuck at 98% for about a minute and then switches back to disconnected. Thanks in advance to anyone with a solution! 

Hi, We are using Fortigate 200A with version 4.0 (MR2 Patch 2) and active fortiguard license.Is it possible to configure web filtering (restrict the torrents, streaming contents) based on time period, likeblock between 6 AM to 6 PMallow between 6 PM to 6 AM next day If its possible, how to configure ?Can any one of you help me here. Thanks in-advance.

Major bug in glibc affecting DNS lookups, potential remote code execution - https://access.redhat.com/security/cve/cve-2015-7547 Is FortiOS vulnerable, and if yes, what versions?

Hello, I'm newbie here. I need some technical advise from you all. Our company is based in Singapore and just implemented SSL VPN using fortigate 90D. Our goal is to access google drive and some trade markets websites when my users were in china. As you guys know china got blocked a lot of websites. Today i have tested google drives can access once ssl vpn is connected back to Singapore but other websites is still not able to access (for example- bloomberg, facebook and others. Is there anyway to by pass china firewall to unblock all those websites? Really appreciate your advise. Thanks you. Have a nice day. :)

Hello, is ist possible to disabling the whole Wlan-Module of the Forti, not only disabling the SSID Broadcast? THX

We were doing some penentration tests on our systems and we found out that on our FortiGate 200D which has SSL VPN enabled it is susceptible to the LongJam attack. In the SSL VPN Settings, the below values have been set:    set algorithm high     set sslv2 disable     set sslv3 disableIn the Global COnfig, the below settings have been set:    set strong-crypto enable Yet, when we perform the test again, the below output is presented to us:Vulnerable connection combinations :   SSL/TLS version : TLSv1.1   Cipher suite : TLS1_CK_DHE_RSA_WITH_AES_256_CBC_SHA   Diffie-Hellman MODP size (bits) : 1024     Warning - This is a known static Oakley Group2 modulus. This may make     the remote host more vulnerable to the Logjam attack.   Logjam attack difficulty : Hard (would require nation-state resources)   SSL/TLS version : TLSv1.1 &n

Hi, I found an extremely strange behavior in the FortiOS 5.2.3 on our FGT 110C.FG-GW # diagnose sys link-monitor statusLink Monitor: gwdetect-upg-1 Status: alive Create time: Sun Mar 29 01:17:53 2015Source interface: wan1 (3)Interval: 5, Timeout 5Fail times: 0/5Send times: 0[...]    protocol: ping, state: alive[...]Link Monitor: gwdetect-upg-2 Status: alive Create time: Sun Mar 29 01:17:53 2015Source interface: wan2 (10)Interval: 5, Timeout 5Fail times: 0/5Send times: 0[...]    protocol: ping, state: alive[...] seems to be correct, but FG-GW # diagnose sys link-monitor interface wan1Interface(wan1): state(down, since Sun Mar 29 01:18:21 2015), latency(8.96), jitters(18.33), session count(639), bandwidth(55977)FG-GW # diagnose sys link-monitor interface wan2Interface(wan2): state(down, since Sun Mar 29 01:18:22 2015), latency(21.22), jitters(8.04), session count(81), bandwidth(30896) show's down links. The same output are shown

The purpose of the Learning forum is to promote informal learning within our user community: **Prototype new training material prior to formal training release **Provide just-in-time learning updates to partners who have already attended formal training. Training Services will post regular updates and moderate this forum. You are welcome to post references to any learning resource which has helped you learn Fortinet products and technology, and ask questions to the learning community. Many thanks.

Hi,I am wondering if there is a CLI commando to change country on the AP? reason I ask is that when i change country on the profile the Accesspoint will not change, i have 10 223B accesspoints and one of them is not changing country to NO(norway). 

FNGFortianalyzer 5.2.4 FortiView:What are the list of values for the Action column?  I see Accept and Close for example.And what are the list of values for the Security Action column?  I see Allow or it's blank.And when you see something like the Action column has Close in it, and the Security Action column has Allow in it.  What does this mean?And I've searched the manuals for the values and I didn't find them.   

Greetings! Good day to everyone! Our school is currently setting up a topology similar to Ken Felix's article on this link - http://socpuppet.blogspot...arent-using-inter.html > Awesome article by the way :) We were able to make the said topology from the article to work but we need to modify it for the setup that we want. Our servers are connected to the Root VDOM through an independent interface. We have another VDOM in transparent mode connected to the Root VDOM through a virtual link. DHCP service is provided through the virtual link. Internet connection is provided by a separate firewall connected to the transparent VDOM.With the current setup, we didn't have any problems in terms of connecting to the internet. But the challenge would now be accessing the servers. We can't seem to connect to them. Running a traceroute from the LAN shows that the traffic goes out to the internet through the gateway 10.199.199.254. We are still getting accustomed at configurin

We upgrade our Fortigate 60D to 5.0.4 version, put it in " Interface Mode" and create 2 ipsec vpn tunnels with 2 phases ok to connect to our old cisco router (using dial up vpn) The problem is i cant create the vpn policy for IPSEC, it only show me te SSL VPN options. We have a 60 C with 4.12 with this configuration working ok. Thanks in advance

Hello,i have fortigate 200D ver5.2.3 i want to know the antivirus take update or not and also for the other fortigaurd services   thanks