Solved

Hi All,I have 311B Fortigate, version 5.2.1.I have recently tryied to configure  PPTP VPN and authenticating with LDAP Domain Controller. After fist creating users then users group and then configuring the LDAP. When I finish LDAP configuration, testing is successful. when I try to connect to VPN, it is failed. After having many times unsuccessful pptp VPN connection, I looked at the policy and I changed the policy any to any policy on WAN interface in the first of the policy list. But this didn't help fixing this problem.In order to delving into this VPN problem, I just create a local user on the Fortigate and PPTP VPN connection is working without making change the current PPTP VPN connection configuation.In other words, Local user VPN is okay but authenticating user with LDAP is not working....As I [provide some logs and configuration at the follow section, can you please advise how I can come over this VPN problem? [style="background-color: #ffff00;"]BAL_FTG # s

We have 4 x FortiAP 220B units running firmware v5.0.7 (build 64) . In the past these unit were spread across a number of WiFi Channels (1, 6 and 11). Just recently I noticed that all of them were using Channel 6 only. I cannot find any option in the Fortigate web interface to set the channel number. I cannot find any option in the FortiAP web interface to set the channel ID, although it does at least display on the Wireless tab that Channel = 1, 6, 11. So ... to my question ... has the ability to set the WiFi Channel been removed from the FortiAP's?

Hello! I want to configure FortiClients to connect to a FortiGate 100D using IPSEC VPN, but so that different users authenticate against different AD-servers. Which means I can' t use " Accept any peer ID" in Phase1 configuration, otherwise all dialup clients will fall into the first policy and/or VPN. If I use Shrewsoft VPN Client, then it has been OK, some clients already authenticate and use the VPN, because in Shrew client there is a special place where to enter that common peer ID. The manual says (fortigate-ipsec-50.pdf, page 45): ------- To configure FortiClient - pre-shared key and peer ID 1. Start the FortiClient Endpoint Security application. 2. Go to VPN > Connections, select the existing configuration. 3. Select Advanced > Edit. Auto Key phase 1 parameters Page 45 IPsec VPN for FortiOS 5.0 4. In the Preshared Key field, type the FortiGate password that belongs to the dialup client (for example, 1234546). The user account password will be used as the p

We are trying to set up a security policy that requires the user to authenticate to the firewall when accessing a particular internal web page. It works fine if the destination site is on port 80, but not when the site is hosted on a different port (port 3000 in this case). I think it's related to the Authentication > Settings where you select the Protocol Support. It allows you to select HTTP and HTTPS, but not a specific port. 

Hi All, We have a FortiWiFi 80C which has been out of support for some time (I guess over a year, although I don't know for sure). I was thinking of getting FortiCare for this box in case something happens. The problem is that I am unable to find out what it would cost me or how renewing an expired box works. I asked FortiNet support but was pointed to their renewals team which seem to push emails back and forth, apparently unable to give me an answer. I then talked to three FortiNet resellers, and got three different replies. One said that I can just buy the 8x5 1yr FortiCare renewal for my box and I'm set. Another one said that I have to purchase the 2yr package and that FortiNet will backdate support for one year.  And the third reseller told me that once support runs out it can't be renewed. Can anyone here shed some light on it? Can I put this box back under support, and if so, how?

 Hi!the company where i work bought a new Fortigate, the 800C versión v5.0,build0291 (GA Patch 8). Before we have 311B with another versión that have the option "Log All URL" on the "Web Filter Profile" but on the new versión is not present.Is possible enabled this option on the v5.0 patch 8?

Dear all, i have a fortigate 100D version v5.2.2, i need to set a rules to block all streaming video but only allow youtube, i have done the web rating overrides youtube.com to custom group. but when i streaming video on youtube keep show video error.

We have a 400B and almost every time we apply a release or patch the configuration either gets wiped or it changes things so much that we have to relearn the new system/interface and/or reconfigure the whole box. For example we just tried to go from 5.2 0330 to 5.2 0442, not a big jump, and the physical server and server farm sections are gone. I don't mean they got wiped, I mean they are not even on the menu anymore. So we rolled it back to 330 while we try to figure out what to do THIS time. We are at the point where we don't want to upgrade the firmware any more for fear of what might happen. Tech support is no help. Not sure if this is a question or just a rant..

Howdy folks, I have created a custom data set to return the number of requests per parent domain (i.e. just the values before the country code) using the regexp_matches function. The results are returned within {} braces, is there a way to suppress these in the results? Here is a sample of the output: # domain visits 1 {bitdefender.net} 66113 2 {pubnub.com} 9583 3 {doubleclick.net} 9192 4 {serving-sys.com} 6127 5 {adnxs.com} 5700 6 {googlesyndication.com} 4765 7 {bing.com} 4530   Many thanks, Nathan

In FortiManager 4.3 you always had an option of creating a script to run at a schedule, but looking at 5.0 and 5.2's configurations I can't seem to find this option anywhere. Even the doco's dont mention script schedules (when they did for 4.3). Do you guys know if it's been disabled in the newer versions, or if I'm just blind?

We have a Fortigate 5.0 firewall and a VPN ssl Configuration, this vpn works with Windows without problems, but with macosx 10.7/8/9 we have trouble. After Client installation on the mac (5.2) we made the same config as in the windows client but when we try to connect we got an error,that there is not enough information for connect, please check User password or certificate. On the mac console we saw these message  04.11.14 11:41:18 [0x0-0x3c23c2].com.fortinet.FortiClientAgent[5679] klist: No credentials cache found while getting the ccache principal  But ridiculous ist, that on some Macclients it switched from work to not work, that means on some mac clients i could connect thru vpn, some minutes later we got an error message.

Hello,Does anyone have configured ssl offloading on the fortigate? I have used the 'cookbook' but it doesn't explain too well how to configure half mode ssl server configuration. I need to decrypt incoming https and forward this unencrypted to backend http server. What I configured:conf firewall policyset dstaddr "vip-to-webserver"  => 157.52.x.x to 172.16.16.15set service httpsset webcache enableset webcache-https ssl-server and:config wanopt ssl-serveredit webserver1set ip 172.16.16.15set port 443 set ssl-mode halfset mapped-port 80set ssl-cert <webserver certificate> Please advise. Thank you in advance, Kind regards, Ralph

I have a Fortigate 200D with FortiOS 5.0 Patch 9 (build 0292). I created address objects & custom service for a particular vendor (EMC), then used them in a policy. if I change the policy to allow "all" services it works and only logs accesses on port 443. The custom service includes (per EMC) ports 443 & 8443. If I change the rule to include the HTTPS service it works. I'm assuming I did something wrong creating the custom service, but I'm including the whole script I used in case someone can spot something else I did wrong. Here's the custom service definition: config firewall service custom edit "EMC_ESRS_Svcs" set category "My Custom Services" set comment "EMC ESRS" set tcp-portrange 443:443 8443:8443 next Any assistance would be greatly appreciated, Roger Morganrcmorgansec@morganemail.net  config firewall address edit "EMC_ESRS_A" set associated-interface "wan1" set type iprange set end-ip 128.221.192.14 set start-ip 128.221.192.13

Upgraded firmware on the Analyzer to 5.0.8 and now when I try running the built in VPN Report, none of the charts return any information.  Says "No Data". Any ideas?

Hello everyone!I have some problem with my Fortinet 80 C, it doesn't boot after firmware update. When I restarting it only "status" led diode blinking on green and after few second all internal ports blinking one second and status led changing color on red and this is happening over and over again...  I read i should try restore firmware image by tftp server, but another problem is I cannot connect to cli interface now, I get the message "device is used by another program" or something like that (I guess because it is starting up...). Connection options are correct (9600, 8, 1, none, none), because before I joined up.Is there any way to solve this problem and recover the firmware? I will be grateful.   

I recently helped a customer go from a completely flat network into a segmented network.  They only have one DNS server which sits on their server network.  I'm finding that over half of my sessions are related to DNS queries coming from clients on other networks trying to get to the server network.   Does it make more sense for me to run a DNS server on the firewall and forward DNS queries or should I continue to let DNS traffic traverse the firewall? I'm running a 300c on 5.0.7 and averaging around 15k sessions during peak usage.  In the current setup it often peaks out the CPU but memory stays around 40%.  

How to classify and mark packet on fortigate firewall.. ?? 

Hi there,I have Fortigate 310B firewall running but the Antivirus is listed as expired as per below. I am having difficulty in uploading the image. So i am going to illustrate how it looks like here : Fortiguard Subscription Services Antivirus        Expired [renew]- AV Definitions 14.00000 (Updated 2011-08-24 via Manual Update) [update]- AV Engine  4.00392 (Updated 2012-02-09 via Manual Update) 1) What does this actually mean? I believe the antivirus should be updated since Fortigate is running on it's own Operating system FortiOS. 2) Does the antivirus definition update require a separate license to run? As this was the reason I got that the license purchased was for firewall feature only, so I would like to verify if there is such thing. 3) If an antivirus update is to be performed, when is the best time to implement the update? I believe it should have some impact on network performances and speed so I reckon it shoul

Hello ,I have a question. I have a running IPSec Between 2 offices ( FG's) Site Mexico - 10.1.10.0/24 Site Ontario - 192.168.100.0/24 Now I need to add a new VLAN in Ontario L3 Switch - 10.1.100.0/24 , And I need to use this VLAN also for the IPSec . How do I achieve? thanks in advance.Nihas

Hi all, I thought I would just share a recent experience we had with our FortiGate 100D Cluster (Active-Active), Version 5.2.1 Build 618. I had created and applied a Web Filter Profile (let's call it Profile No1) to a particular group of users. I then cloned this Web Filter Profile, made a few changes to the cloned profile (imaginatively named Profile No2) and applied it to a second group of users.My reason for two separate Web Filter Profiles was I wanted to impose slightly different Static URL Filters to each profile. However, I noticed when I made a change to the Static URL Filter in either Web Filter Profile it immediately appeared in the other profile (wether I wanted it to or not). This had me confused as I imagined that the Web Filter Profiles were completely separate from each other. I dug around in the configuration and found that in the config webfilter urlfilter section, a urlfilter called 'DefaultWebFilter' had been created. I also noticed that in the co

Hello, After updating firmware 5.0.8 to 5.0.9, unable to retrieve FortiAnalyzer with Fortigate (fortiOS 5.0.9). Please help.

I've setup a new DoS Event handler on my FortiAnalyzer (IPS attack). Rather than change the DoS thresholds on the FortiManager DoS policy to start generating notifications by email and SMS is there anyway you can test directly from the FortiAnalyzer to see if email and SMS work?

hi fellas, im out of direction, how to add custom signatures? im running on fortios 5.2.1 and I want add signature thats block Psiphon3.current version cant block the said application.  Regards,

Hi all,I configured Web filter profile to use FortiGuard category. Everything was fine, but next day Fortigate block all web pages and display this information (in attachement). I hear that if Fortigate lost connection with FortiGuard, by default he is blocking all pages in policy where was this webfilter profile. Do you know is this true? If yes, is there any way to override this? I read about override in Web Filter, but it's not what I am looking for, I mean about some dynamic override which will be apply when the Fortigate lost connection with Forti Guard.

Hello, a short time ago I changed to NAT mode and now I want to connect with SSL VPN from everywhere to my Network.I configured everything and entered the CORRECT username and password in the VPN client on my notebook. I also addet my vpn user to a group which hast full SSL VPN Access. But everytime I connect it says: Can´t login username or password might be wrong (-12)Has anyone a idea why this isn´t working?