Solved

Hello there, Currently testing a Fortigate unit for possible use in production soon.We have a scenario where we need to set URL filtering based on LDAP group membership but the group membership changes frequently. A user could be in and out of a group multiple times in a day, for example. We're using a collector agent with DC polling for collecting user details at the moment, which seems to be working well enough (300 users), and it seems group membership gets updated fairly frequently with Windows users (I'm guessing with the ~5 min workstation checking interval), but Mac OSX users' group memberships don't get updated until a logoff or screen lock/unlock. My question is, is it possible for the Fortigate to update group membership for Mac Users without them having to logoff and back on again? Any other approaches I should be looking at? Help/advice greatly appreciated Cheers.  

Dear Experts, In FortiVew > Summary View > SSL&Dialup IPsec, I can see SSLVPN users and IPsec branch offices successfully connecting to our Fortigate-100D.  But strangely, all the Connection Time of Dialup Session are same."01/01 09:00 - 01/01 09:00" In Fortianalyzer, other time and date of logs like "Top source" "System Events" are  working correctly.I also checked VPN logs in Fortigate, and found that those time are correct.  How can I fix this?  Any ideas?  - Fortianalyzer-200D with 5.2.1(latest) Thanks in advance  

Hi, I've been on a steep learning curve as I work towards implementing a Fortigate 60D running 5.2.2, however I have got to grips with most elements so far.However I've hit a wall in understanding how I can create a policy allowing access to Microsoft & Windows updates for all.Using Microsoft's lists of required URLs (some of which are wildcard) as published here: https://technet.microsoft.com/en-us/library/dd939870(WS.10).aspx I've attempted to create a urlfilter webfilter as below (based on comments in this post https://forum.fortinet.com/tm.aspx?m=122223) :config webfilter urlfilter edit 141 set name WindowsUpdate set comment 'Windows Update URLS' config entries edit 1 [size="2"] set url [link]http://windowsupdate.microsoft.com[/link][/size] set type simple set action allow set status enable next edit 2 [size="2"] set url [link]http://*.windowsupdate.microsoft.com[/link][/size] set type wildcard set action allow set status enable next edit 3

Please see the attached. This message appears with websites that I have blocked. Thanks for your help.

Hello All, I have been facing a issue from last few days, i am not able to access https://slack.com, "https://hubspot.com" both URLs.Same URLs are working properly before. We are not using any Webfilter, Application Control, IPS or AV on our firewall. I tried to upgrade the OS to 5.2 but still same the results. There is no issue with internet service provide end. I observed in log that, the connection is closing immediately. What causing this issue ? Here i am sharing log screen shot. Kindly Help. Thanks in advance. RegardsNaveen.D   

Hello,Please I need to know if this vulnerability: "Multiple products cross-site scripting vulnerabilities" annonced by fortiquard, affecte all the fortigate device including Fortios 5.0.x ??

Hello, i have heard that appliances that can upgrade to 5.0 for example FG 110C and are now running fortiOS 4.0 , will soon not be supported anymore. can someone confirm this?

Hello,I have a problem with a fortigate 100D model. I have configured a policy with a VIP for relaying mail. Only SMTP (port 25)The policy has Antivirus enabled in Proxy - Block mode and a Email filter in Proxy mode and Discard mode for SMTP. When there is a normal mail I can see in the Fortigate logging that it has been scanned by the fortigate and then allowed or blocked. But when the client and the Exchange server negotiate a secure TLS connection the mail transported during this session is not being scanned. So the problem is that spam mail send during such a session is forwarded without any problem. What am I doing wrong? Has anybody else this same problem? Fortigate: 100DVersion: 5.2.1 Thanks in advance

I have been on the box all day and after about 4 hours I could not log back in I keep getting this message.  trying to log in through admin just get message. Your account has been lockedCan someone help with this.I have created a profile in the radius server and can log in through that but have no option in it. Cant log in though CLI either just get same message. Your account has been locked

Hi, My fortigate has the LAN IP 172.28.75.1/24. on this interface, I enabled the ping and https service for administration. My admin user has trustedhost specified (172.28.75.0/24). So, I'm able to ping from my LAN network. That's OK. My problem is : I've a VPN with a juniper, and I've configured the VPN monitor (this is icmp request to check if the VPN is UP), but my fortigate don't response, because my juniper's LAN is 10.0.0.0/24 (not in trustedhost). How can I enabling the ping from subnet 10.0.0.0/24, without enabling the administration of my fortigate? I already try with local-in-policy, but it's look like the action "accept" doesn't work.. Thanks in advance Lucas

Hi all i just bought a 92D to replace my 60DI converted config file to match new hardware and connected it to Juniper switch but nothing workedI searched what could be wrong on fortigate but all seems to be OKOn switch side, i saw that when internal1 was connected ( only this port connected to the switch ), MAC address was correctly learnt on the switch port but when internal2 was connected, MAC of internal1 disappeard from the switch and i could only see the MAC of internal2At this instant, my 60D is working perfectly on this switch so i think that the problem does not come from the switchare you aware about this kind of problem ?Is there any parameter to set up ? Thanks in advance 

Hi everyone I spend most of the day setting up a Fortigate 60D with SSLVPN configuration. I am using the FortiClient 5.2.3.0633 and Fortigate firmware is 5.2.2,build642 (GA).The PC I use is a Windows 7 and is not domain joined.  I want to map four network drives when connected to the SSLVPN. When I connect to the SSLVPN from my PC on a external network I get authenticated and the correct IP and DNS settings, even the correct DNS-suffix is pushed out through the tunnel. I am able to ping file server and I am also able to access the directory I want to map by using the UNC path which is the same as I want to map by the script. So everything is in place, but the logonscript in the FortiClient configuration. My XML file looks like this: <on_connect> <script> <os>windows</os> <script> <![CDATA[ net use S: \\SERVER\SHARENAME /user:#username#@domain.local #password# net use P: \\SERVER\SHARENAME /user:#username#@domain.local #passw

 There seems to be 4 firmware images for the 60D: FGT_60D-v5-build0670-FORTINET.outFGT_60D_POE-v5-build0670-FORTINET.outFGT_60D_MC-v5-build0670-FORTINET.outFGR_60D-v5-build0670-FORTINET.out The FGR is probably the rugged modelThe 60D_POE is clear. What is the difference between FGT_60D-v5 and FGT_60D_MC-v5?MC? I am sure this is just me being forgetful but when I search for 60D_MC I hit nothing. Thanks! -N  

Hi everyone, I had a FG 1500D and want to know if theres a way to aggregate my bandwidth from a different WAN Links. I already have load balancing with ECMP and DGD for every interface(4 WANs) and the respective set of policies for every interface. I want to know if theres a way to not only have load sharing and failover, also bandwidth aggregation. Kind Regards,

Hi, I am trying to get 2 FortiVM appliances (latest version) running as HA Active-Active as lab on top of vmware esxi 5.5. However doesnot seem like it is working. I followed handbook with just basic configuration on the virtual appliances but after two vm rebooted, both VM are claiming to be the master (from get system status output)...I login to the cluster but it seems like it is VM1 first time and then later refresh as VM2. It seems like VM2 overtakes VM1 as master while VM1 doesnot want to give up but keep sending G-ARP...Plus under the HA page on Web UI, I only see one unit. Another thing I notices during troubleshooting, both VM have serial number FGVMEV0000000000. Will that cause issue? HA is supported on FortiVM, right? Here attached are the HA configuration and running status of two VMs (rest of the config are Factory default+basic VDOM). Please let me know where I configured wrong...On VM1:FortiGate-VM1 (global) # show system ha config system ha     se

I have a FTG80C in working environment, And I will enter an additional FTG80C. I wonder if someone already set an active-active HA (High Availability) cluster with firmware 5.2.2 over fortigate´s 80C and are an stable solution, or what kind of bugs are find out additional to FTG80C documented on fortinet knowledge base; Does firmware 5.2.2 overwhelm hardware limits of ftg80´s in HA ?, and which one more stable firmware do you recommend to my HA cluster of FTG80C: 5.09, 5.0.11 or 5.2.2 Note: UTM configuration an VPN´s are already using half or my hardware resources on my stand alone FTG80C configuration over a fortios 4.0 MR3 patch 10, I am supporting around 60 LAN user´s 5 VPN IP-sec connections, with medium traffic.

In FortiView the "Top Destinations" report lists "Destination - Application - Sessions - Bandwidth".I'm trying to recreate that same view in a report. Does anyone have this already?

Hi, i'm using a FA VM64 in evaluation modeFortiOS version: 5.2.1I need set up my custom views, but none option is available; so i can't add, delete or do anything thereAll other funcionalities are working good. Thanks for the help. 

A customer of mine has got two seperate internet connections for redundancy, both fiber (one 50mbit, one 10mbit). We've placed two 100D's for routing and they now want redundancy on the IPSec VPN tunnel that goes to our datacenter (which also has two 100D's.The internet redundancy itself is configured with two static routes for 0.0.0.0/0 to the gateway of the provider with a lower priority for the 50mbit line, this works as is.I thought to do the same with the IPSec tunnels, so I created two tunnels, one for each provider. Below are the details:Tunnel 1:Name: CBB-Tele2 Local IP: 87.213.15.74 Remote GW: 212.114.98.85 Outgoing Interface: WAN_Tele2Tunnel 2: Name: CBB-KPN Local IP: 89.255.49.166 Remote GW: 212.114.98.66 Outgoing interface: WAN_KPNI’ve created two routes for the remote subnet and given them the correct priorities so that the Tele2 line is used as a primary interface.I’ve triple checked the Phase 1 and 2 settings on both ends, there are correct.Now for the strange par

Deleted 

Hello, I will install a HA of 1500D for a customer. I have two question about that : - Which bandwith will be used for session synchronization (There is approximately 400 new session per second and 10'000 sessions established) ? Is there a way to know the amount of traffic will be used ? - Is a good choice to use the MGMT1 and MGMT2 interface to HA heartbeat/sync session ? Or there is a hardware/software limitation ? Thanks in advance Lucas

Hi,I've to connect two FortiAP-221B in my wireless networks where there are several Cisco AP managed by Cisco WLAN Controller in bridged configuration with 3 different SSIDs. Now, I'd like configure my FortiAP without change the actual network configuration: now FG is def gw of wireless networks that use different subnets (and VLANs) corresponding to different wireless users. Users obtain IP address from external DHCP server. My problems when I try to configure FG-600C as wlan controller are following:- In my case, I have to configure FG wlan controller in tunnel mode or bridged? - IP address of Wifi SSID (def gw of FortiAP) cannot be the same of Cisco wireless network? FG gives error when I configure the same IP of other intrface as Wifi SSID- Can FortiAP have IP addresses of other subnets than wireless networks (for example IP of wired networks?) thanks!!  

I have a client with about 30-40 users. They dont want any UTM, so just plain firewall. They do have IPsec for both client connections (since they had a 60C and SSL was terribly slow) and a IPsec tunnel to a smaller office. 4 pcs of FortiAPs 221C. I think I will run them bridged, if 90D is chosen, so that the tunnel will not become a bottle neck (since as far as my testing goes the CAPWAP specs in the 90D datasheet only refers to tunneling mode). Money is not as important as speed, so I just want to make the best choice here. I want this unit to be ok for a couple of years. I know they might expand the other office, so there will be more IPsec office to office load, so that needs to be fast. Other than that its just plain internet/surf/download stuff that is important both over cable and wifi in the LAN. So basically, how would you think in this situation?  PS. By looking at the specs... if you say go with the 90D, is it even worth going with that, or would the

Hi, folks, Is there a built-in way of monitoring which version of FortiClient my users are running? We had an issue the other week that was limited to users who were on old versions of FortiClient (5.0.x, vs. 5.3.x).  I'm wondering if there's a systematic way to watch for users lagging behind before they become an issue. (I know there are third-party solutions for monitoring software versions in general, but I'm wondering if there's something specific to Fortinet for FortiClient.) Thanks.

I guess I have a few questions-- How can we check what our 'official' NSE certification level is?  For those of us that hold FNCSPv5, is this converted to NSE 4 already? Will NSE 4s receive express routing codes if partner certification levels are met? How long do partners have to meet the certification requirements laid out at the global conference? The FAQ stated that in addition to FAZ and FAM courses NSE 5 required online tests in the learning center?  Same question for NSE 6. Thanks,Gary