Solved

Hi All, As per subject above does inter vlan communication is required policy for configuration as screenshot attached below?. Thanks       

Hey guys, Question about the fortigate 100D cluster we have.Outside ip is part of a subnet (18X.xxx.xxx.100 / 255.255.255.128) We are in the process of starting a new hosting platform, that will get multiple outside ip's from that range.Above the fortigate there are 2 cisco switches, on wich the range is configured in a vlan.Is it possible to let the new hosting platform traffic to go through the Fortigate, and be protected by IPS and other features?Í'm not seeing it at the moment so maybe one of you can point me in the right direction. NAT is also in place, and needs to stay in place for some other functions, so transparent mode is not an option. Any help is much appreciated

I have lots of objects. They are, for example, Object_1 - 10.0.0.10Object_2 - 10.0.1.10Object_3 - 10.0.2.10Object_4 - 10.0.3.10...Object_n - 10.n.n.10 They I put all the objects on a Group, and then on a Firewall Policy. Is there any way to do this better/easier?I want to avoid having a slow Firewall (I have a 900D). Thanks!

Hi all, I'm using a fortigate unit with Ipv4, IP are manually entered in every-one's computer. I have two interfaces, (1) with 10.18.x.x IP and (2) with 172.25.1.x IP. Im suspecting an IP conflict occured on the 172.21.1.x range but when I go to the Fortigate administration panel, User & Device > Device > Device Definition,  no devices connected to the interface (2) are shown, when there are at least three servers.Where can I find information about the devices connected to my interface (2) (or actually every interfaces) ?I access the administration panel with a computer connected to interface (1), I don't know if it's relevant. Thanks, 

Hello, We are trying to establish a VPN between a Fortigate 900D and a Juniper. It must be a DialUp VPN since the Juniper has PPPoE (not a static IP) and the version of JUNOS the device has don't support dynamicdns. The Juniper has the following configuration:security { ike { proposal ike-phase1-proposal { authentication-method pre-shared-keys; dh-group group2; authentication-algorithm sha1; encryption-algorithm 3des-cbc; lifetime-seconds 28800; } policy ike-phase1-policy { mode aggressive; proposals ike-phase1-proposal; pre-shared-key ascii-text "12345678"; } gateway gw-test { ike-policy ike-phase1-policy; address 189.1.1.1; local-identity hostname TEST; external-interface fe-0/0/0.0; } } ipsec { proposal ipsec-phase2-proposal { protocol esp; authentication-algorithm hmac-sha1-96; encryption-algorithm 3des-cbc; lifetime-seconds 3600; } policy ipsec-phase2-policy { perfect-forward-secrecy { keys group2; } proposals ipsec-phase2-proposal; } vp

Hello!I havn´t found any rough numbers for VM Sizing.For example, let´s say we have 150 Devices, logging about 15Gb logs/day with about 5000 logs/s. We are currently planning on getting a VM license and hardware for the build. But I am uncertain about the memory/CPU config.Looking at a current 400C with roughly 30 devices and about 5GB/day, the memory in use is not much. The cpu usage is higher when generating reports. So I am thinking about a 6 Core with HT, 16GB mem and ofc something like Intel 3510 drives in Raid 5.Anyone have any VM data to share?

I'm new to the Fortigate Family. So, please bear with me. I have a website (Doodle.com), that's blocked, but I don't know how to check why? I get the error message from FortiAnalyzer and it does say Policy ID # but I can't seem to find that number in my fortigate's firewall policies. Does anyone know how to figure out why it's being blocked? Thanks!

Hi, I'm trying to install Forticlient in a Windows 7 computer. The problem is that, during the installation, it fails once it reaches the "Starting services" phase. The installation software shows an error message that says: "Service Fortishield failed to start. Verify that you have sufficient privileges to start system services". After that, the installation just rollbacks. The computer only has one user account (Administrator), and I have tried running it explicitly as an administrator, but the situation doesn't change. Any solution? Best regards

Hello, Where can I find the downloads for the FortiGate VM?  I can find the page with all the different firmware versions, but I seem to be struggling to find the VM. Any help? Thanks,ponder

Hello, I currently use a QoS configuration on a Cisco device and I wish to move this function on a Fortigate firewall (Fortigate 200B v5.2.0). On the Cisco device, QoS is defined as following: - services class are defined:  GOLD (trafic to prioritize) / OTHER (trafic to "unprioritize") / SILVER (all other trafic) / (policy-map) - the network traffic is selected by ACL (access-list). - each ACL is associated to a service class (class-map) - dedicated ACL are apply on interfaces On the Fortigate firewalll, I would like to know how to define the same QoS policy with following requirements: - for a simple managing, I wouldn't like manage several QoS profile on the rules. - Is it possible to configure a global QoS policy in other place than rule filter configuration ? - on each rule, I would like to manage only a global QoS policy. - this feature seems not describe in the documentation, is it possible to do that ? May be in CLI configuration mode with dedicated commands ? Thank yo

We have WiFi networks with WPA2 Enterprise security successfully working in our environment. After recent firmware upgrade from v.5.2.3 to v.5.2.5 on all our FortiGate and FortiWifi boxes, old computers with Windows XP on them cannot connect to the wireless networks any longer. Although we do not have many Windows XP installations left - none of them cannot connect to WPA2 Enterprise wireless networks. There was no such a problem before the upgrade. All our FortiAPs units (FAP 220B, 320C, 321C) have the latest (v5.2.4 build 0245) on them. Does anyone experience the same issue? Thank you for any thoughts and ideas.

Dear All,I am setting a test policy that required FSSO AD authentication.I have done the following successfully1) LDAP Server created successfully and test was success 2) Single Sign-On Created sucessfully with status connected. 3) FSSO using DC-Agent is installed successfully in my DCverified from CLI[FORTIGATE] # diag deb auth fsso server-status [FORTIGATE] # Server Name Connection Status Version ----------- ----------------- ------- FORTINET_AGENT1 connected FSSO 5.0.0241but when i do the following :[FORTIGATE] # diag deb auth fsso list ----FSSO logons---- Total number of logons listed: 0, filtered: 0 ----end of FSSO logons----it seems to me that the FSSO agent is not working successfullyi verified the data of the logon users in FSSO Agent i can retrieve a list of AD users that is logon in my environment.i double checked all the steps and configuration. everything is as per specified in official guide.what went wrong here ?any pointer ?

Hey guys, Brand new to Forti products and I have a short time line. I am looking for a good how to in order to setup S2S VPNs in fortimanager. I have only been able to find pieces can someone help?

I could be drawing a blank here: Is there an event handler or setting somewhere to alert when logs are not populating to the FAZ? - i.e. turning Red under Device Manager?

Hi everybody! Just a short question. A customer is asking us if it is possible to change the size of the mtu packets to 1500 in a gre tunnel. As far as I know, there's an overhead at the beginning of these packets depending the type of encryption used, so it wouldn't be possible to do this. Am I right? Thanks in advance.

Hi,I try to route a server via WAN1. Standard is wan2 When I try to enter so I always get a message Invalid IP range. Can someone help me pleaseRegardsSebastian

Hi all! I'm currently using FortiGate 800C with firmware v5.2.1 in transparent mode and created one Ipsec VPN tunnel. Is it possible to automatically assign IP addresses to VPN clients with FortiClients? I've checked "set assign-ip-from", "set mode-cfg" and "set dhcp-ipsec", but all seem unavailable in policy-based VPNs. Thanks! 

Hi, I need to use FortiClient IPSEC VPN using the new version, however, I have only the old configuration - extension - vpl. The new configuration on FortiClient 5 is conf (it seems).  I was not able to find out any information in how to import this vpl extension to the new one, it seems that there is a tool - FortiClient Tools that allows to convert it, but when I try to get this tool on FTP, an USER and PASS is requested.  ftp://support.fortinet.com/FortiClient/Windows/v4.00/4.0MR3/MR3_Patch_5 FortiClientTools_4.3.5.0472.zip Does anyone know how to convert it or make it available from vpl to new one? or at least to provide me this file to do it? thank you. John.

Hi there is anybody actually using the central VPN console mode in fortimanager? I am trying to convert VPN Configurations and have all sorts of trouble, e.g. creating a phase 2 to an external (non managed) Hub that needs a src-subnet and dst-subnet. Seems to be impossible, however...?

Hi Guys Has anyone SAT the NSE4 exam so far, i am taking this exam next month, please share experience and tips for all the people like me. RegardsSandeep 

Dear All, few months ago I configured VLAN on my network and it worked corectly. After I have changed router to FTG 80C (5.2.5) the VLAN stopped working. I use HP switch which supports VLAN - I didn't change the configuration on it. I use on FTG advanced routing. Idea is:LAN - 192.168.1.0/24VLAN - 192.168.5.0/24 - access to Internet but no access to LAN Fortigate 192.168.1.99 <-> hp switch 192.168.1.106 (VLAN 192.168.5.2) <-> tp-link switch (WAN 192.168.5.3) I added on FTG VLAN interface 192.168.5.1 and policy VLAN -> WAN. When I am connected to tp-link I have no access to Internet - I can ping 192.168.5.2 but I can't ping 192.168.5.1 (VLAN interface on Fortigate). I think that I should add some Static Routes or Policy Routes? Thank You in advance,Bart. 

I'm somewhat new to Fortinet products so I seem to need some help that is not obvious to me in the documentation.  We've had FortiAnalyzer for about 6 months.  Logs from various Fortigate devices are forwarded here.  But the oldest logs I can find are only 38 days old.  I'd like to have at least 90 days of logs available.  The dashboard shows 8% Hard Disk Usage and has stayed at that level for quite a while so it certainly has space to spare.  How can I increase our Hard Drive Usage, that is, retain logs longer? File Management?  None of the File Management settings are set.  Would I achieve my goal by changing the File Management's "Automatically Delete" setting for "Device log files" to "older than 3 months"? 

i have FG 500 A  and i try to restore the conf file to 80C   from USB but it give me Copy config 1.conf from USB disk ... Get config file from USB disk OK. Invalid config file Command fail. Return code -39 can any one help thanks 

Is the FGT60D V 5.2.5 capable to scan antivirus in https? I don't see any hints in the Antivirus Profile which point this out. When i take Proxy mode i see only the standard protocols but no https for example. In other words how can I see if FGT 60D can ssl-deep scan?

When configuring an SSLVPN in tunnel mode why do we have to specify source IP information in the VPN > SSL > SETTINGS screen under Tunnel Mode Client Settings as well as in VPN > SSL > PORTALS in the Source IP Pools field when checking Enable Tunnel Mode?  If I don't get an answer I will lab it up and find out but I'm hoping to save some time. I suspect it has to do with Authentication/Portal Mapping but I would like some confirmation on that.   Does the settings config assign the IP ranges that WILL be used when a tunnel mode client connects and the Portal setting is used separately to define configuration sent to the Forticlient for remote policy definition? Are they purely redundant configuration fields? Does one setting just give you more granular control over assigned IPs to specific users/groups?  ie Does the IP pool in the portal config trump the IP Ranges value in the