Solved

Hello everybody, i am keeping on testing FortiManager :=) Now i have problems creating just normal S2S IPsec Tunnels from Manager.  I can Create Phase 1 + Phase 2 and push it to Fortigate no Problem, But then when i want to create the Policies for that new IPsec VPN Interface Lets call it VPN-Example. This interface, that should be created automaticly after you assign the P1 + P2 is just isnt there! you cant find such an interface in FortiManager...  if i log on locally on the Fortigate that i pushed the new IPsec VPN config, i see that interface and can also create new policies with this interface. so then i tried to reinport the Policy from Fortigate, then the new interface is there and you can build the Policies on the FortiManager. So i have to re-inport Policies everytime i create a new S2S - IPsec ???  

Hi, I Have enabled Https deep scan and installed certificate in all end user systems. Now firewall is blocking sites, for few sites IE and chrome throws a mess as "Site is blocked as per internet usage policy". But for other sites it says "Page cannot be displayed". I want message to be displayed in all blocked sites...Please suggest. Thanks,Bharath

Hello, We have a FortiMail VM (v5.2.4) appliance we are implementing and after doing the initial configuration using the wizard in the web UI we are unable to log with the admin account (we get the a message stating login failed). Oddly enough, from the same computer we were able to use the web UI on, we can console in and SSH in just fine with the password we set. It is only the web UI that gives us this error. Any help or guidance on this would be greatly appreciated. Thanks!

Hi,I can't find find Lan Interfcae list in fortigate web consol. It showing only One Interface, so i cant create another Physical interface.so please anybody know how to solve this, please..firmware is in this Versionv5.2.1,build618 (GA) and am using fortigate 60D.

How can I find the config file I uploaded with command:execute upload config ftp <filename_str> <comment> <server_ipv4[:port_int] | server_fqdn[:port_int]> [<username_str> [<password_str>]] [<backup_password_str>] described in this page.Is there any command or other way can I see the configuration file I've uploaded?Thank you！

Good day. Is there a way for logging to happen at session start? We notice that when we do an FTP, until we close the session, nothing appears in the log. Thanks. JM

90d, running firmware 5.2 user complained today that they have been having issues with their outlook connection.when I look at their event viewer, I see multiple instances of an IP address conflict (each time network hardware address of conflicting device is 00-00-00-00-00-00, weird).we only have 10-12 devices on the network, and only one device with static IP (printer) and its address is not in the DHCP scope. I look at DHCP Monitor, and I do not see any conflicts. how do I troubleshoot this?  are their CLI commands I can use, how do I see history of DHCP conflicts? 

Not sure if I should post this in another section, but here goes: Recently I've come across a very strange issue with one of my customers. They have a SIP-solution in place, which, after I set up a new firewall running 5.2.3 (the same that had the infamous IPSec for iOS-issue I posted about here earlier), breaks for a remote site after ~32 seconds. The traffic goes something like this: Internet - Site A Firewall - IP-phone central (Aastra 430) - IPSec Site to Site-link - Site B Firewall - User endpoint handset. All phones to handsets at Site A works fine, both in and out. It is ONLY the handset in Site B, which talks to the Aastra-box over IPSec VPN, had exhibits the 32-second break in connection if you call TO it from either the outside or from Site A. Calling out FROM Site B works fine. I've exported a tracelog from the Aastra-unit and find an entry saying Reason: SIP ;cause=408 ;text="408 Request Timeout" Both firewalls that are in the mix has both SIP-

Hello Sir,Can anybody help to create IPSec Client VPN Report as per attached screenshot.RegardsUpendra Makwana. 

Hi,I'm deploying one each of the above mentioned box. Both will essentially have the same setup, so I'll stick to the 300C for now. My question relates to inbound routing to the DMZ and what Fortinet best practice would be, I don't see anything specifically related to it in the literature I've read through so far. It's a Single WAN connected to the carrier via a /30 point to point link. The box also has a /27 subnet to play with which the carrier advertises for us. My intention is to use the /27 subnet for inbound traffic to Web and edge servers etc. I'm not entirely convinced on how best to config the /27 (relatively new to Fortigate), perhaps a sub interface on the WAN for the /27, perhaps a new zone for the /27 subnet....I'm thinking out loud here. I would be grateful for any suggestions. Cheers. B. 

Hi all, The FortiGuard licenses (IPS & Application Control, Anti-Virus and Web Filtering) for our FortiGate 100D (v5.2.3 build 670) cluster are due to expire on 15th June 2015. We are currently working with our supplier to get these licenses renewed. However, should they expire, can you tell me what will happen? Will our IPS, Application Control, Anti-Virus and Web Filtering policies cease to function altogether? Many thanks, John P

The company I work for is currently going through the Fortinet Partner program and as such, many of us are being told to go as far as we can with the training. I got to admit, im used to working for companies that want me to fund my own training, so im doing my best to take advantage of the free resources. Ive gone through the NSE 1-3 and now feel comfortable that I can talk about Fortinet services and functionality with customers, but I do lack the experience with the Web UI and CLI, so the NSE 4 program in the partner portal has definatley been an eye opener. Question is... Whenever I do these "practice questions" in each module, they seem to throw curve balls. It was the same within the NSE 1-3 series. Asking questions that are not covered within the training, or covered "by proxy". By that I mean you will be given a chart for a Gartner report and in tiny characters down the bottom will list that it was for the 1500 in 2014, but the host made no reference to it. 

...or enforcing per user web filter quotas across login mechanisms. Good Day. I'm nearing completion of the initial configuration of our new Fortinet firewall (FG-200D, FortiOS 5.2.3).  It's my first experience with the product/company and, in all, I'm impressed and pleased with the purchase.  One of a few areas I'm struggling to get the behavior I seek is relative to web filtering. We're using FortiCollector/agent based FSSO for our Windows AD workstations and also support BYOD over wireless utilizing 802.1X with RADIUS authentication. I've configured a policy that allows for 60 minutes of browsing sites in the General Interest - Personal category throughout the workday (with a generous lunch period definition that does not include the timer).  The policy seems to work well, with one exception noticed so far.  When a user consumes their quota on their workstation, a separate quota counter for their same account authenticated through RADIUS to co

Hello I've managed to set a password (copy and paste) - maybe it was too long - on a FortiAP 321C and now I'm not able to login again . I cannot find a reset button or other procedures in the docs. While it is not critical at them moment since the FortiAP is setup and working, there must be a way to reset one of those devices, right ? Thanks for your help!Frederik

Hello,I have a problem with Fortigate 240D v5.2.2,build642 (GA).Sometimes when I open firewall policies or user groups etc... I receive the following erros - see the attached image. What is the problem and how to fix it?

Hi, I have this reject for a new rule wich use both NAT (source and destination) Rule :     edit 4465         set srcintf "any"         set dstintf "any"         set srcaddr "153.65.21.20"         set dstaddr "vip_10.118.247.251-to-192.168.60.219-5901" "vip_10.118.247.251-to-192.168.60.219-5902"         set action accept         set schedule "always"         set service "tcp_5901" "tcp_5902"         set logtraffic all         set nat enable         set ippool enable         set poolname "ippool_10.118.58.217" We want to nat153.65.21.20 --> 10.118.247.251   into:10.118.58.217 --&gt

After installing Forticlient and trying to start a Citrix session the Citrix Receiver returns the following error: "The Citrix Receiver received a corrupt ICA file. The Key (3.0) has no value associated value" After deinstall of the FortiClient the Citrix Receiver works just fine. But after install the Citrix receiver failes again.It does occur when the client register with the fortigate unit and get the profiles and configuration from the fortigate. After install without registration there is no problem. Does anyone has a idea what I can do about this error message?

Hello Folks, today I configured sFlow on a 60D, afterwards I noticed high ESP-Errors (Replayed-Packets) on a far-end VPN Tunnel Fortigate.For me it seems that enabling sFlow on this small SoC Boxes breaks the IPSec "Acceleration". The Box was running 5.2.2 and the sFlow Polling-Interval was configured quite conservative.CPU-Load was O.K. Has anyone seen similar issues yet?  Regards, Jan

Hi to all, I have a FAZ 400B with Firmware 5.0.10 at our central site deployed.I capture logs from the Fortigate 60C at the same site successfully.Now I have about 6 Remote Sites that are connected by IPSEC to my central site.I configured the remote FGTs to log to FAZ in central site, by using it's private IP as target.I added the devices in FAZ successfully, but I received no logs from Remote Sites. Interesting: In one site I have a Fortimail 200D Cluster and I receive logs from this device,but not from the Fortigates... Log Settings Fortigates (all at Firmware Version 5.2.x):-> Send Logs to FortiAnalyzer-> IP is the the private IP of FAZ at central site (i.e. 10.1.1.253)-> Realtime-> Untick "Encrypt Log Transmission"-> Event Logging all-> Local Traffic Logging All-> Policies from central to remote site and revert are open at all for testing purposes-> can ping the fortigate from FAZ successfully-> but I can't ping the FAZ from Forti

Hi All,  I am working on a 300C unit. Pretty standard setup, It is my first time configuring the 300 model. I usually work with 90D and ASA's . I feel there is something basic I'm missing here. Port10 is the WAN and is configured with a Point to Point. SSL VPN portal functioning.Port1 has several Vlan interfaces, all working fine, net reachable, filters behaving etc. Worth mentioning Port1 belongs to it's own Zone. It's when I attempt to create a DMZ on another physical, say port 8 or 9 I get the issue. Some basic testing - even if I put say x.x.x.1 on the interface and connect my laptop direct with x.x.x.2 I get a ping Timeout which suggests my laptop can reach the x.x.x.1. I have read about the "set internal-switch-mode" command but the cli doesn't seem to recognize that syntax. I would be grateful for any suggestions. Many thanks. B.

I set up an SSL-VPN with a Web-only portal; I want users to be able to connect to internal servers using RDP. I created a bookmark for an internal terminal server.The portal itself works fine. When I click on the bookmark, I get the usual Java security warnings, then RDP launches and reports "Configuring remote session" to 127.0.0.1:49152. RDP stays at that message and never connects. Eventually, the portal times out and logs out.I've set up such an SSL-VPN before and got it to work with no problems, but can't figure out what I'm missing this time.FortiOS 5.0 on a FGT 60D.For my testing, the client is Windows 8.1 64 bit with Java 8 Update 45 and Java 7 update 75 both installed. Both the 32-bit and 64-bit versions of Java are installed. I am using IE 11. 

Hello Guys, lust time i worked with FortiManager it was 5.0.6 and everything was ok. now i wanted to Refresh my knowledge because on Friday i have to Troubleshoot some Problems with FortiManager 5.2.2 i just don´t get it how to install Policy Packages on many Devices... i registret 2 FortiVM Devices with FortiManager > Imported the Policy Packages for Each > Created Interface Zones (like Port1 = WAN) > created Dynamic Adress (like LAN Device 1 = 192.168.1.0 and Device 2 = 192.168.2.0 > i created a new Policy Package with 1 Policy for Test. But i just cant install this new Policy to either of the Devices. When i start Install Wizard the "Choose Device" Field is just empty.. i just don´t get it... i have a Guide for 5.0.6 (online Course) and tried to did it just Step by Step. But when i come to the Point whre i have to Install new Policy Package i just can´t add Devices because the Field is Empty...  Can Please somebody explain what am i doi

Greetings! I've recently come across a strange issue with two different Fortigate-boxes, both running 5.2.2. On both of these, I am unable to connect the built-in client on iOS to the iOS Wizard-created IPSec VPN's. On a third box, also running 5.2.2, there is no issue at all even though all three boxes has their iOS-VPNs set up through the wizard and thus exactly the same way (Even checked and followed the tech-article and video for setting this up, as I'm a bit of a noob). The only major difference is that the two Fortigates that will not accept connections to the iOS-tunnel already has IPSec VPN's on them. One box has a Site-to-Site tunnel on it, the other has a Forticlient-dialup tunnel. Both also has SSL-VPN's for FortiClient. Tried to google this as much as possible but has been unable to find a solution or even someone that has the same type of issue. Thus I turn to you :) Anyone able to shed some light on the issue or point me in the correct direction?

Hi, I accidentally checked the "Enable Automatic Execute Type" checkbox when I tried a TCL script.Now it will run every time I install a package, and there is no way of removing it. I also tried with CLI with "execute fmscript delete 0002" but fails as the script is bound to the device. How can I remove it ? 

Environment:140 Endpoint DevicesForticlient: 5.2.1 & 5.2.2Managed Through Fortigate, package custom deployed with FortiConfiguration Tool We are currently experiencing an issue in which the FortiClient Realtime scanner is blocking access to a InfoPath offline form (.xsn) file.  The file is able to be downloaded, however we attempting to open a dialog appears on screen with the message of access is denied. When the scanner blocks the file no mention of the scanner is noted in the realtime scan log.  We believe that the realtime scanner is blocking the file as when we disable the realtime scanner the file can be opened without issue.   We have also used exclusions to remove a particular folder (%APPDATA%\Microsoft\Infopath) from being scanner, which has also seemed to be a workaround for the file being blocked. My question is if anyone has experience similar behavior and if so what had they done to resolve the false positive.  I understand that I ca