Solved

I have been working with DoS policy for a while now to try and pick up on anomaly traffic.  In my IPS logs I get this message: "anomaly: udp_flood, 12647 > threshold 7500, repeats 98780 times".  Can I use that information to tweak my threshold? I read that as only telling me that I exceeded the threshold but not necessarily by how much.    

Hai i want to restrict torrent download. in this case here we have around 50 system all under static ip. then some of them using DHCP. so i want to block torrent download for 45 users and allow for 5 users. is it possible, then suggest the steps.i am using fortigate 60d

Hi, Is it possible to use a Fortiwifi 40C to bridge a wifi SSID with an internal interface so they can use the same subnet? The document here suggests this is possible with an interface set to type switch but the 40C doesn't seem to allow this command.  Is it because only the larger models support software switches?  Seems unlikely that the 40C cant support this considering all of the Fortigate models come as standard with the internal interfaces bridged together. http://docs-legacy.fortinet.com/fos50hlp/50/index.html#page/FortiOS%25205.0%2520Help/wifi-ethernet_bridge.058.2.html The command just fails when you enter "set type switch" on a new interface. We are using a Fortiwifi 40C with the latest v5.2.4 software.

Hi, silly question probably: at some point the local disk on the fortigates will get full (both logs and reports). Where can i find the policy for retention? Does the fortigate have a mechanism that if a threshold is breached it will start deleting old logs and reports? thanks 

Hi,I have the szenario that a ssl vpn (tunnel and web mode) is reachable at both wan ports that are connected to the internet. Since 5.2.4 I cannot reach the portal using wan1, but at wan2. A packet sniffer shows only a syn, but no ack. So, a simple https://public.wan1.ip failes, but https://public.wan2.ip works. If this a known issue? I plan to downgrade to 5.2.3 for testing and to reconfigure the fgt using a factory default, but not during the productive time. FGT110C with 5.2.4

I see that "Remote LDAP" groups can be created on the FortiAuthenticator.  Is it possible to import or use LDAP (Active Directory) groups in any way with the FortiAuthenticator? It seems like everything to do with LDAP can only be "managed" by the individual "name" and not a directory. This also applies to the FortiAuthenticator client.  We are implementing the client and I have to individually select EVERY single user that needs to be in bypass.  That is all the users to start while we roll out mobile tokens to everyone. Thanks, Chris

.

Hi All, When I login to my account in support.fortinet.com, I found out that there is a new FortiOS 5.2.4 release and I can't find any release notes yet for this version. Is it a BETA for testing? Can we use that already as latest firmware version in our fortigate? Any comments or info regarding above statement is kindly appreciated. Thank you. Kind regards,JAM

Hello, has anyone successfully created a pcks12 certificate using openssl and VeriSign to install a VeriSign certificate on a Fortigate device for the ssl deep packet inspection? If so, how did you do it? -Chris

Hi,i Really appreciate if someone could Help me, i'm new on the forumWell My probleme is :I have two Fortigate 100d in different site All the configuration is working perfect VPN Ssl Fortiguard....the only problémes that i have actually is With Webfiltering exactly with Youtube, See attached Picture before the filter was working normally without any probleme but actually inside the network youtube is working without by passing the filter, no authentification in the catégorie of Streaming media and download and the problémes is only Youtube .Other streaming website like Dailymotion are using the filter normally.and the problémes is the same with the two Fortigate on defferent site.Firmware V: 4.0Model: Fortigate 100 D Great Thanks for the Help,Best regards,Zito

Hi all,on Fortigate 90D I've configured a WAN1 interface with Public Range an everythings works well.Now I've requested a new connectivity (with another ISP) with a new public Range and I've already configured it on WAN2 interface without static route, only IP assigned to interface.Can you help me to understand this:1- How configure Distance and Priority in order to have WAN1 and WAN2 working together?My Goal is:ServerGroup1 -> WAN1 (already configured with static route 0.0.0.0/0.0.0.0 PRI: 0 DIST: 10)ServerGroup2 -> WAN2 (?) Thanks a lot.Regards.Leo  

Hi Everyone, I recently purchased a FortiGate 60D 3G4G VZW firewall and want to update to the latest firmware version. However, each firmware image I have downloaded fails to install, saying it is the wrong image type. I've tried a number of the 5.0 and 5.2 images for the "FGT_60D-v5-buildXXXX" trains. Each fails to install, despite being listed as a supported model in the release notes. This happens from the CLI or GUI, local upload or from Fortiguard services. Can anyone point me in the right direction to where I can get my hands on the correct firmware for this device?  Thanks!

there is dns server on fortigate 40c ? because when i try to make the router as dns server on my computer it's not getting any addressalso i don't see the feature here:config system global set fgd-alert-subscription advisory latest-threat set gui-antivirus disable set gui-application-control disable set gui-dhcp-advanced enable set gui-endpoint-control disable set gui-implicit-policy disable set gui-wan-load-balancing disable set gui-webfilter disable set gui-wireless-controller disable set hostname "FGT40C3913032173" set internal-switch-mode interface set timezone 04 and this command is not working: config system dns-database [style="background-color: #ffffff;"]command parse error before 'dns-database'[/style] [style="background-color: #ffffff;"]Command fail. Return code 1[/style] this is my firmware version:Firmware Versionv5.2.3,build670 (GA)

Hello, I've been running dual wan connections using ECMP Weighted Load Balance on my FWF80CM (v4 MR3 Patch 15) for a couple of years now. The solution has worked out pretty well but now I want to change this design to a more manual setup to improve control over how traffic flows through the device. My goals:WAN2 - Primary GatewayWAN1 - Failover Gateway Needs:I will still need to Policy route some specific traffic out WAN1I will still need to access VIPs setup on WAN1 externallyI will still need to access HTTPS admin on WAN1 externally To start off I assumed that I could just change ECMP back to Source IP (default) and then give WAN1 administrative distance higher than WAN2. Both WAN1 and WAN2 have static routes with the same distance currently. When I did this working remotely over HTTPS on WAN1 as soon as I applied the Admin Distance on WAN1 I lost my remote connection and found that I was also unable to access HTTPS admin on WAN2. In addition when I arrived at the

Hello, i have a big trouble with fortiwifi 80CM, its a new product to me, I did the installation myself, only have default configurations.. I have a 20mb internet speed, and before to install this forti my download speed was arround 20mb and 23 mb, and my upload speed was around 20mb to, so I introduce a fortiwifi 80CM, and I create 2 new SSID for internet access point, but when Im connected via wifi, my connections decreased, somethimes 10mb download speed and 2 or 2 upload speed, I dont know whats wrong, If fortiwifi doesnt work like a access point or what ? please HELP MEEE! regards!

If I buy extra VDOM licenses for a Fortigate 1000D and wish to buy a spare Fortigate 1000D to act as hardware failover do I have to buy seperate VDOM licenses for the hardware replacement or in the event of a failure would I be able to to transfer the VDOM license over? Thanks

I have an iOS Dialup VPN set up. I can connect to the VPN and ping/rdp to any host on the network if I use an IP but DNS doesn't work. I've configured the network's local DNS server in the settings but this didn't work. I can't ping by name, I also can't ping by FQDN. Any ideas?

Hello, Is there any CLI command(s) I can use to fully reset/purge one ADOM including the device, the package and the objects?Note I'm using FMAN v5.2.1. Thanks and regards.

HiI'd like to create second ospf process on FG 100d and 60C. Is this posible?How to do that?

Hi everyone,I've got a 600D that is used at a DC and a 300C that's used at the remote sites. The issue I'm running into is my vulnerability scanner is being stopped by the IPS, obviously, defeating the purpose. The scanner resides at the DC and scans the pcs on the LAN at the remote sites.  How would I go about creating an exclusion for my scanner? Thanks!

Traffic shaper in my FortiGate is not accurate and sometimes it doesn't work. I create several Per-IP traffic shapers profiles, then i apply in into policy. When i test internet speed in website speedtest.net. The speed is under what i limit. when i monitor it for one more day, all traffic shapers doesn't work and user can access the internet with full speed, while i haven't changed any configuration. Sometimes traffic shapers is under what is limit. sometimes all user can access the internet with full speed.Here is my configuration. config firewall shaper per-ip-shaper     edit "3-MB"         set max-bandwidth 3072     next config firewall policy     edit 16        set srcintf "port11"         set dstintf "port9" "port10"         set srcaddr "200.200.4.1-200.200.4.30_3MB"     &

Hi all,I was wondering if there is a kind a of all-in-one device with ADSL router and WiFi (dual radio) device in the FortiGate portfolio.It would be nice equip a small/home office with one device only to manage ADSL and WiFi connection. Thanks for all your answers M.

I created a new dataset to show the country for each logged in vpn-user. As the country is not stored in the vpn log I had to use the traffic log additionally. the problem is that I cannot use the $filter macro because I am getting an error: ERROR:  column reference "itime" is ambiguous LINE 1: ...om "FGTADOM3-elog-0" a, "FGTADOM3-tlog-0" b where itime >= 1... The dataset:select b.srccountry, count (distinct coalesce(nullifna(`xauthuser`), `a`.`user`) ) as f_user from $log-event a, $log-traffic b where $filter and a.subtype='vpn' and (a.tunneltype='ipsec' or left(a.tunneltype, 3)='ssl') and coalesce(nullifna(`xauthuser`), nullifna(`a`.`user`)) is not null and a.action = 'tunnel-up' and a.remip = b.srcip group by b.srccountry With a.$filter I am getting this error: ERROR:  column reference "itime" is ambiguous LINE 1: ...GTADOM3-tlog-0" b where a.itime >= 1435906800 and itime <= 1... Did anybody know how to solve this problem?

Hey Guy's, I am noticing consistent attempts to log into our device from our wan link (shown by the alert message console widget). I have not been able to figure out how to drill down and look at the IP that is trying to gain access. Any help would be greatly appreciated.  For now I have blocked all telnet and ssh attempts to the wan link and have the https access limited to static public IP's. Thanks in advance!

Hello all,i would like to use our fortigate unit in order to Block Tight VNC from entering or leaving our organization.how do i achieve it? Thanks,s.