Solved

Hi,if I try to update our FAP320C to 5.2.4 (build 245) i get an error with wrong Image. on the FAP is FortiAP-320C v5.2,build638,140916 (GA)... RegradsByterunner

We have an FG200B running v5.0.9 and we want to start using the Transparent Web Proxy features again (we do have an SSD in the FG200B).I configured a Policy limited to just a couple of PCs and ticked the appropriate box.  The Monitor in the FG200B shows that the transparent proxy is working.  So far so good.Now I want to configure an Exempt List for URLs which don't work so good with the transparent proxy. Nothing I can see in the GUI, so I check the FortiOS Handbook. It says go to "WAN Opt & Cache > Cache > Exempt List" ... except my GUI doesn't have this option.The handbook also says use "config wanopt webcache" and then "set cache-exemption enable" ... except my CLI doesn't have this option.Can anyone shed any light on this?  Does the FG200B simply not have this level of configuration available?  I know it used to be available back in v4.3, so was it removed for some reason?

Hey,I've been playing around with the new User-Source based policies but unable to make them work.I have the following policy which is placed at the very top of the list but it just doesnt work (see attached image).Instead, it falls through to another policy I have that allows internet for the entire office.What am I missing?ThanksGil 

How can I monitor/see all session of a particular IP?

Hi all I have recently purchased a pair of FortiGate 240D but am concerned about the following limit in the maximum values document: MAC address table size - 200 I plan to run some wireless access points directly into the switch ports of the Fortigates so there will be more than 200 wireless clients and MAC addresses that the unit will need to know about (these will be dynamic ARP entries, not statically defined). Can anyone clarify what exactly the limit above refers to? Thanks

Trying to access EMS from any browser and get an empty page with CONT|0|. Any ideas?  

Hi Fortigate 3240C v5.2.3 As a college I have to make sure that the users can access resources but to restrict them access to sites that they should not have access to. Because of this I have enabled SSL deep inspection which works really well apart from Google.  I have noticed a few Google sites such as Google drive and Google classroom that do not work with deep inspection so I have had to disable it for them. Even though the certificate is correctly deployed to systems, Chrome still complains that its a possible 'Man In Middle' attack. I would like to add *.google.com into the bypass list but I cant because some students have worked out how to search for porn using the following link. Safe search mode is enabled in the web filter, but if I use *.google.com in the bypass list then they can just use the HTTPS site to bypass the web filter.  The URL is an example of a what some of the students have used to bypass the filter. Note: this link will displ

Hello, What I would like to know is how do I set up a default gateway for a WAN that is manual (Static IP?) I know you can go to route --> Static route and just add that as a default route for everything outgoing.However is there a way to set it as let's say PPPOE ? Where we can assign a default gateway?

Hi,Would anyone happen to know if I can assign secondary IPs to a VRRP instance (multiple redundant gateways inside same VLAN) on a Fortigate?In fact we wanted to test a migration scenario from another vendor, now we're already stuck.As far as I can see I can only "set vrip" on a specific instance once.Thanks and best regards,Marki

How can I show interface errors ? the command diagnose hardware deviceinfo nic is not prompted v5.0,build0310 (GA Patch 11)

Hello, i have some strange problems on a 200A 4.0 MR Patch 15. The FSSO is Runnig with a DC Agent on Domain Controller. DC Agen Version 4.3.0129 so the Problem is... The DC Agents collects the User Logons Properly u can see all the users on "Show logon users", The DC Agent is connected to the Fortigate and if i do diag debug authd fsso server-status it is "connected" But the user logons are not passed to the Fortigate. if i do diag debug authd fsso list = there is no users, so my FSSO Firewall policy doesn´t work. do anyone have an idea how to solve this?

Hello, About Port Allocation settings into TS Agent Configuration, we are not sure about the field "Maximum Number of Port Alloc Ranges"! Do you know what this field means exactly?Does it mean the maximum number of separated ranges (of allocated ports) per users, or the maximum of users who can obtain a range of allocated ports? Regards,Christophe 

I'm using XML configuration for my FortiClient profiles.   I created a profile on the FortiGate with the desired settings, push it to the client, then I exported it into XML to use on the FortiClient profile on the FortiGate.   I had Application and Web Filtering set to specific profiles.   I have noticed in the XML, it has the settings from those profiles, but not the profiles themselves.   This is not desired as I want to be able to just update the Application/Web profiles not edit the XML for every little thing.   Is there a way to specify Application and Web Filter profiles in the XML?

client behind FW    --->    their FW     -----------internet------------>    FortiGate FW What ports should be open on FW to let FortiClient make an outgoing SSL VPN connection to FortiGate FW?   

I have a FortiGate 80CM running 5.0 build 0208 Reading the FortiOS hand book and it says: 1. On the FortiGate unit, go to System > Certificates > Local Certificates. 2. Select Import. 3. From Type, select Local Certificate. 4. Select Browse, browse to the location on the management computer where the certificate was saved, select the certificate, and then select Open. 5. Select OK, and then select Return. but "System > Certificates"; is not there.......... How do we get a menu to manage certificates? Kevin

Hello, Just wondering if it's possible to change the management port to something else besides 541. I'm having trouble finding anything on this. ExampleFortiGate Unit sends out its request to FortiManager on 443FortiManager listens for new requests on 443 Thanks!Alan

How do I get rid of the message "Fortigate Detected: Registering to Fortigate"  for my end users when they connect via vpn?   Please and Thanks! Mike

Same setup as my last post -- Fortigate running with full SSL/TLS inspection. How do we limit the cipher suites the Fortigate accepts from the web servers it connects to?  In the current, default configuration, the Fortigate accepts quite a few undesirable combinations including: DES, RC4, SHA, MD5. Why would a security product, produced in the last decade, EVER allow the likes of DES?  How do you change what the Fortigate accepts to a much stronger cipher suite? Thanks.Tom PS.  If you want to check it yourself, turn on full SSL inpsection and head to https://howsmyssl.com  

We have two FG3600C Appliances in HA. The Firmware is 5.0.5. We are running OSPF where the immediate neighbor is HP 12508 Switch. The Master node is learning all routes from Switch. When we do a HA Testing i.e. bring down one of the monitored ports of Cluster. The failover is immediate. However the Slave Device takes lot of time to rebuild the OSPF routing table. It takes approx. 15 ping timeouts. is this default behavior. We want to reduce this. Why does Slave appliance take so much time to learn OSPF Routes.

In the current development versions of Second Life and it's 3rd party viewer Firestorm, it has been noted that Forticlient has been the direct cause of a critical graphics error, involving HTTP Pipelining. This is an exclusive bug that can only be reproduced when Forticlient is used. I would like to refer you to the Phoenix Firestorm Support JIRA: http://jira.phoenixviewer.com/browse/FIRE-15625And the main Linden Lab Support JIRA (registration required): https://jira.secondlife.com/browse/BUG-8631 They contain more details, screenshots, and logs taken from both the Viewers and Forticlient. This has been reproduced by several members of the Firestorm support team with little in common between their systems other than Forticlient. Second Life has roughly 40 million registered users, so even if only 1% use Forticlient the results would be unacceptable resulting in either a  blocked release or users being informed to uninstall Forticlient, should they use it.&

I'm getting hit a lot by miscreants using the OpenVAS scanner as of late.  It eventually triggers one of my IPS/IDS rules and the IP gets banned, but I'd like to do so as soon as it sees a connection with the "OpenVAS" string in it. For example: ==pcap 1 ascii s==.......Uf^..P...P...E..P[.@.7.Ag[...Ap.....P.W.....S.............#......GET./cgi-mod/index.cgi.HTTP/1.1..Connection:.Close..Host:.65.112.26.132:80..Pragma:.no-cache..User-Agent:.Mozilla/5.0.[en].(X11,.U;.[style="background-color: #ffff00;"]OpenVAS[/style].7.0.5)..Accept:.image/gif,.image/x-xbitmap,.image/jpeg,.image/pjpeg,.image/png,.*/*..Accept-Language:.en..Accept-Charset:.iso-8859-1,*,utf-8....==pcap 1 ascii e== Has someone created a custom definition before.  The explanation of the syntax in the Fortigate 5.2 help for this isn't the best. Here is what I'm thinking: [align=LEFT]F-SBID( --name "Block.OpenVAS"; --protocol tcp; --service HTTP; --pattern "OpenVAS"; --no_case; --context uri; )[

I tried installing the 4.0.2317 FortiClient SSLVPN on a Windows 10 client and connected to a device.When I try to resolve Hostnames it sadly uses my normal DNS instead of the DNS set in the SSLVPN settings.Trying NSLOOKUP also returns my normal DNS not the internal one offsite.I installed the same SSLVPN Client version on an 8.1 client and it worked normally. Sadly trying to install the normal FortiClient (5.2.4.0650 x64) results in an error message during installation (Install Error: The process was stopped unexpectadly). Anyone got any ideas? Can anyone confirm that the DNS is not set correctly on a Windows 10 client?

Hi  i can use on below dataset. My problem same user and same destination see a few times. How can edit this dataset for this problem? SELECT TO_CHAR(TO_TIMESTAMP(`itime`)::timestamp, 'YYYY-MM-DD HH24:MI') AS time, COALESCE(NULLIFNA(UPPER(`user`)), IPSTR(`srcip`)) AS user_src, COALESCE(NULLIFNA(ROOT_DOMAIN(`hostname`)), IPSTR(`dstip`)) AS website, COALESCE(NULLIFNA(`catdesc`), 'No Category') AS web_cat, SUM(COALESCE(`sentbyte`, 0)+COALESCE(`rcvdbyte`, 0)) AS bandwidth FROM $log WHERE $filter AND `action`='passthrough' GROUP BY time, user_src, srcip, website, web_cat HAVING SUM(COALESCE(`sentbyte`, 0)+COALESCE(`rcvdbyte`, 0))>0 ORDER BY bandwidth DESC

Hi, I want to implement SSL VPN client to site certificate authentication.The things I tried till now :1. Set the Fortinet_CA_SSL Proxy certificate in the ssl vpn settings as required for clients, downloaded the fortinet ca ssl proxy certificate on a client computer, installed it and tried to connect - didn't work.2. Generate a certificate request, signed it on a windows server certificate authority and then import it on fortigate. I installed the same certificate I imported on fortigate on a client computer and tried to connect - didn't work. I don't think I understanded well the concepts of certificates and what certificate should I use on the fortigate unite and what certificates I should use on client computers. Another thing I tried to experiment related to certificates is setting the certificate for GUI administration of the fortigate and then importing it to a computer. I still get the warning when I connect with a browser on the fortigate. This is not very import

Hi, Fortigate 200D, 5.0.4 and 5.0.5: How and when are devices detected/identified? I' m sure this was working in the past, but now the online column in device definition stays empty. It seems that all my devices were last seen about 10 days ago. Client devices don' t have Forticlient installed Step taken: - Upgrade from 5.0.4 to 5.0.5, so that rebooted my Fortigate. - " diagnose user device clear" . - deleted some permanent entries of device that are currently communicating, they are not detected/added to the list. Any idea? Thanks, Stephane