Solved

Hi all,Some time back when running v4.3.something firmware, we sent all our syslog(514) data to our Fortianalyzer.  My recollection is that the functionality was lost when we upgraded to v5.0 firmware.  Couple of questions for those running v5.2 now:(1) is the syslog functionality back?  Can you use the Fortianalyzer as a syslog server again?(2) if using this, how does the functionality look to you?  Is it substantially different to what was available in v4.3 firmware?(3) is it possible to filter the incoming syslog data in any way (so that not all data is logged)?TIA for any information you can share,Frosty

In Fortigate VM64 ver October 2014 on port1 and port2.It has PROBE-RESPONSE. QUESTIONS:1. Is PROBE-RESPONSE for checking sync attack2. If yes, that mean I should set it as WAN port instead of LAN port, because attack mostly from internet  tq  

Hi, In F5, I can set it to detect failure of web server based on response.For example, sometime web service is up but database server that it connect to is down.F5 can be programmed so that it can detect if it access this page, the response should be this. QUESTIONS:1. can FortiADC do that instead of detect port alive or can be pinged tq

Hi I have fortigate 80d running 5.2.1 and fortiAP 221C. The 221C support 14 SSID but when i create mora than 8 SSID. it gives me error that "maximum value has been reached".  Any Idea ?? Thanks 

Are there any commands to easily reveal what diagnose commands are enabled and/or active? Part 2:  Will all diag commands be disabled (inactive) upon FGT reboot? Part 3: Expanded question: (global) # diag debug info debug output:           disable console timestamp:      disable console no user log message:    disable zebos debug level:      306783954 (0x124926d2)   <<??? CLI debug level:        3 (global) # diag debug reset (global) # diag debug info debug output:           disable console timestamp:      disable console no user log message:    disable CLI debug level:        3 What does "zebos debug level:      306783954 (0x124926d2)"   me

Trying to load Forticlient on a new laptop and the download install ends with: No updates found. You already have the latest version of FortiClient Installed. I cannot find any installation of this product on the new system.  It's not in Start>Programs, it's not in the Uninstall area of the Control Panel, it's nowhere in my C: drive. What can I do to trigger the correct install?Windows 7 enterprise, SP1

Hi At the moment I use BGP over my VPNs as I have Verizons Private IP network using BGP.I have backup VPNs back into my main site to backup the Private IP with Manual switchover, we have (LTE for primary backup)should I be using a second, different weighted routing protocol?What Routing do you all use? Thanks 

Hi, We have Fortigate Version: FortiGate-300C v5.0,build0292,140801 (GA Patch 9)and FortiAnalyzer-VM, Version: v5.2.0-build0618 140826 (GA) We have problems with this logs:"User Report" ant all "Detailed User Report reports" Issue with User Report: We found that only Traffic summary tab and user name is different. Other tables is same for all 5 users. Is it some bug? Or it's ok with it? Issue with Detailed User Report reports - empty, we try all approaches from this post https://forum.fortinet.com/tm.aspx?m=116340except to change fortianalyzer version. Please help me to resolve this issues. Thank you 

Hello community I have been trying to setup my AC340U dongle in a 60D router with no success. The dongle is currently supported on the official list.  # diagnose sys modem detect Can not read modem device: timeout modem is attached. dialtone is not detected. I believe I have found the problem.. There is no dial tone to the dongle. If I try do dial to the modem this is what I get: modemd: run_state_machine state 6(stopped) modemd: modem state changed: 6(stopped) -> 0(uninit) modemd: redails:1 isp:0 dev:/dev/ttyusb0 tel:7875856666 modemd: run_state_machine state 0(uninit) modemd: modem state changed: 0(uninit) -> 1(inactive) modemd: Launch modem due to auto-dial. modemd: Begin dialing: redials left = 1 modemd: dev=/dev/ttyusb0 tel=7875856666 modemd: modem state changed: 1(inactive) -> 2(dialing) chat: abort on (BUSY) chat: abort on (NO DIAL TONE) chat: abort on (NO DIALTONE) chat: abort on (NO ANSWER) chat: abort on (ERROR) chat: send (atz^M) chat:

Hi, I am new to fortigate environment.I have configured the SSL-VPN & able to log-in to web-mode & can ping & use RDP etc thru web, but when i am connecting via client its not working & my internet connection also going down.  Any idea or understood my problem?

Hello, I have one problem, and I do not understand how to solve it:I have to create one policy (IPv4) with application control. This policy must be triggered by single application.For example: By this policy I would like to control YouTube traffic.  allow some AD group to visit youtube pages.Another rule would be do same for Facebook, for twitter, etc. how I can implement granular application control? I can allow, block, or monitor applications. but I would like to use one application - (for example YouTube family). Any ideas? May be I have to use completely different way?PS: FGT100D, with active contract. No explicit proxy. Update: forgot to mention: latest firmware for today, v5.2.2,build642 (GA) Just example, what I speaking about - application control. I do not like to check or monitor categories. I would like to allow youtube only, nothing more. [broken image deleted]

Hi all,I'm new in this forum and also with Fortigate. I know very well screenOs.I have to migrate some ScreenOs FW to Fortigate, and I've some problem with VPN.At a moment I try to test a VPN Interface mode between two Fortigate. In my case I need to terminate a VPN to a secondary IP of FGT-B.The tunnel goes UP, but when I tried to ping a PC on the other side on FGT-A the packet go throught the VPN, on FGT-B I get this error : id=20085 trace_id=106 func=init_ip_session_common line=4522 msg="allocate a new session-00026962" id=20085 trace_id=106 func=vf_ip4_route_input line=1596 msg="find a route: flags=00000000 gw-2.0.2.70 via port3" id=20085 trace_id=106 func=fw_forward_handler line=545 msg="Denied by forward policy check (policy 0)"The policy is present but I don't understand why this traffic don't match the policy. The configuration of FGT-A is :    edit "wan1"         set vdom "root"      &nbs

Hey guys. I have a firewall with TONS of tunnels of it. I know from experience with smaller boxes that the power of diag debug app ike -1 is fantastic. However, I know as soon as I run it on this box it's gonna just absolutely be insane due to the number of tunnels.  Can I filter down to the ones I want in some way? Edit - Totally might have just found my own answer - seems like diag vpn ike log-filter has what I'm after. Can anyone confirm?

I am trying to segment the network into 2 part: 1) 2 ports (ie: Port 1, Port 2) each on a different private LAN    private IP: 192.168.1.0/24, 192.168.2.0/24    wan: 123.123.123.0-123.123.123.1272) 1 port (ie: Port 3) on "transparent mode"    private IP: 123.123.123.128-123.123.123.255    wan: 123.123.123.128-123.123.123.255 I am wondering if it I should (or if possible to) setup my Fortigate as follow:1) Set it up to run in NAT/Routing mode    Setup Virtual IP for Port 1 and Port 2 to take care of the IP translation.    Setup Routing Policy to direct data going to 123.123.123.128-123.123.123.255 to Port 3    (Is this even possible?) OR 2) Setup 3 V-DOM (ie:Root, Private_VDOM, Public_VDOM)    Connect WAN to Root and set it up as NAT/Routing mode    Setup Private_VDOM in transparent mode    Setup Routing Policy to direc

FG 90D, v5.0,build3608 (GA Patch 7) Small branch office.  Internal interface subnet is 10.5.0.1/24.  The FG internal interface address is 10.5.0.1.  All users are on that subnet and I'm using the FG switch ports and PoE for hubs, APs, etc. I noticed from the logs that a lot of traffic from the internal users to 10.5.0.255 is being denied (137-8, udp).  The logs show that the destination interface is "root" and policy 0 is applied.  There is no "root" interface listed, and I have no internal -> internal policies or a policy 0. Any idea why it's doing that and how I stop it? I never defined a static route for 10.5.0.0/24 since the routing monitor showed it as connected already -- I don't know if that's the problem?

FortiOS 5.2.2 on an FWF40 I'm looking for a way to block a fairly large, and dynamic, list of IP addresses, managed from the CLI. There will probably be 1000 or more individual IP addresses, in various places all over the Internet. The use case is that I want to use the denyhosts script on my Linux servers to detect brute-force attempts, and block the IP addresses it collects not just within the server, but at the Fortigate level. With a small and static list of IP addresses, this is of course fairly straightforward:- config firewall address for each of the addresses- config firewall addrgroup and add each of the addresses to the group- config firewall policy to deny all traffic from that group. I don't think this approach scales well to a large list of IP addresses, nor does it lend itself to frequent updates.Is there a better way I could accomplish the same thing? 

Does anyone know what this means arrow in the interface/port 2 (See figure attached)?  

Dear Fortinet Support Team, I would like to aking you about Fortigate devices problem. Please check file attached & note listed below for more information. 1. Error: User cannot connect Internet  2. Troubleshooting# Firstly, I connected directly between modem and personal laptop, Internet working normally. Therefore error not caused by Internet service provide (100% for sure). # Sencondly, I tried to connect my laptop to Fortigate (via LAN port on Fortigae) Details: Internet -- Modem -- Fortigate 80C (LAN port) -- My laptop Result: cannot connect to Internet. (I also tried to reboot Fortigate devices, but nothing get better) # Next step, I tried to check Cisco Switch Layer 3 (reboot, clear and reload configuration), due to 2 optionsOption1 : Internet -- Modem -- Fortigate 80C -- Switch L3 -- My laptop : cannot connect Internet Option2 : Internet -- Modem -- Switch L3 -- My laptop : cannot connect Internet # Finally : when I connect modem dire

I am trialing a FortiMail and am running 5.2.3. I am trying to determine if the FortiMail can verify inbound recipients a la Barracuda's Exchange Accelerator. I have an LDAP connection setup and it is working correctly. My internal users can login as themselves to check quarantines, etc. However, I'm not seeing how to setup a policy to check that an internal recipient exists via this LDAP connection before processing mail. Is this possible? Any other tips or gotchas for first-time installs? Anything is appreciated. For what it is worth, I do have the device up and processing mail in one direction (inbound). Outbound is planned for phase 2 of my trial. So far it is a fair bit better than my DIY (Kaspersky-based) system. I just need to make sure I get the most out of my 60 days. -rick

Dear All, Anyone can clear me about what is reg.expression in fortigate and how's it working exactly. In which situation we can use this config. And how to configure it Thanks

Anyone know this answer off the top of their head? Thanks in advance.

   Hi, here is my policy in a 200B (see attachment)  Feb 18 12:26:40 192.168.x.x date=2015-02-18,time=12:27:55,devname=FG200B3910604xx,device_id=FG200B3912603xx,log_id=00 38000007,type=traffic,subtype=other,pri=warning,vd=root,src=192.168.x.x,src_port=51488,src_int="portX",dst=200.40.28.16 8,dst_port=443,dst_int="portY",SN=57905425,status=deny,policyid=8,dst_country="Uruguay",src_country="Reserved",service=HTTPS,proto=6,duration=18,sent=0,rcvd=0,msg="replay packet(allow_err), drop" i dont understand why drop this packet? Can you tell me about msg="replay packet(allow_err), drop" ? ThanksMartín.  

Hello Referin to this PDF, you can integrate Net Sight and NAC Solution from Extreme Network with Fortigates.anyone has some experience with that? i couldn´t find a guide that explains how to integrate it properly. Can someone help me with that issue? See attached PDF.https://www.dropbox.com/s...g/Fortinet-SB.pdf?dl=0

Hello, the Integrated IPS fortigate detected an attempted attack: browser.spoofing.IDN.attempt according to the attack report, the source of attack is an internal address and the destination is an external address of a Web site.my question is: how could the internal address be the source of attack if the vulnerability affects the browser ??

Dear all, I have problem with user identity policy for remote vpn branch users.At branch Fortigate (30D, version 5.0) I have default route pointing to vpn tunnel.My HQ Fortigate is 80C v5.0,build0292 (GA Patch 9). All important policies are implemented on HQ firewall.After HQ firewall upgrade to 5.0 identity policy for VPN subnet started to submit url containing public (WAN) IP address of HQ fortigate - something like http://<public IP>:1000/fgtauth?cgiI think that this is because routing to branch subnet is going by WAN interface, and HQ fortigate considers WAN address as closest to the user.Can You help me? Best regards, Piotr M.