Solved

Sorry to make my first post a question, I used to be registered on the old forum some time back but haven't used this new one. I've done a little search but can't see anything. We have some old 1000As and they make a good test environment for FortiOS 4, which most of our estate runs. Just yesterday I updated to 4.0MR3 patch 18 on one of these and afterwards lost connectivity to it. It would seem that two of the ports have stopped working. Port 1 as far as the device is concerned now appears on physical port 5, port 2 physical port 6. Ports 7-10 are as per normal and ports 3 & 4 seem to have stopped working completely. Prior to the update this was a 100% functional device. Doing a 'diagnose hardware lspci' shows only eight network devices, not ten like our other 1000A. Completely wiping the system and reinstalling from TFTP was done, mostly as a last guess and it didn't help. This is really weird, any ideas? I'm unconvinced it is a hardware fault as ports 1

I've created config file to automate signatures download. I can't find in documentation which port numer is used to comunicate with FortiManager (bold one below)?  <update>             <use_custom_server>1</use_custom_server>             <server>10.0.10.123</server>             <port>8890</port>             <timeout>60</timeout>             <failoverport>443</failoverport>             <fail_over_to_fdn>0</fail_over_to_fdn>             <update_action>notify_only</update_action>      &nb

Hi, When I need to change the application sensor, IPS sensor or web filter associated with a policy I need to drag the policy line right to the bottom of the ruleset above the implicit deny, change the UTM sensor or policy, then move back to the correct position. If I dont follow this procedure then the policy loses all it's L7 inspection sensors. Is this a bug ? We're running 5.0.7 PJ

Hi ,we are using a Fgt 1000c ,our company renew the ssl cert. to Globalsing OrganizationSSL , but when the certificate file adding to fgt unitonly Remote and CA Certificate tabs.It couldn't accept to local Certificate . thank you

I've written a custom dataset SQL query that produces me a count of how much traffic (GB) goes In/Out through our Internet link (port 16 on our FG200B) per day.  It works great.Then I created two Charts based off this Dataset:  one is a Table format (lists the data values tabular format); the other is a Bar Graph.Then I created a Report utilising the Charts ... and here is where it has gone pear-shaped:If I embed the tabular data Chart by itself into the Report, it works.If I embed the bar graph Chart by itself into the Report, it works.If I embed BOTH of the charts into the Report, only ONE of them is displayed; the other has "No data".I had expected that if I created a Dataset, then multiple Charts from that dataset, the FL100C would be smart enough to run the SQL query once, then reuse the results multiple times to drive the charts ... but it seems I am mistaken.I don't really want to needlessly duplicate datasets, just so I can use that data multiple times in a report.Sug

Hi! I've found the information about VLAN interfaces in "The FortiGate CookBook" brochure page 75.http://kb.fortinet.com/kb/microsites/search.do?cmd=displayKC&docType=kc&externalId=Fortigate-Cookbook-40-mr3Part2pages75-159pdf&sliceId=&docTypeID=DT_PRODUCTDOCUMENTATION_1_1&dialogID=65331582&stateId=0 0 65329902 But why I can not to add a new interface VLAN-type in Fortinet 40C? There is not such menu in "System > Network > Interface". 

Hi all,I want to create two groups which will be authenticated with RADIUS server with different level of accesibility to the network.I know that if I creating authentication with LDAP server I can create two groups and associated them with different groups od LDAP server by specifying indyvidual CN.Could you tell me, if I could to this the same with RADIUS? If yes, how can I do this?

Demo'ing a 100d recorder and a bunch of cams and cannot find any support.  All the equipment is demo equipment so I cannot create a ticket to get help. 

A simple question I hope, how do I disable Fortiguard completely (globally) from the command line.I would like to turn every Fortiguard function off. FW (global) # config system fortiguard FW (fortiguard) # set port                          Port used to communicate with the FortiGuard servers. service-account-id            Service account ID. load-balance-servers          Number of servers to alternate between as first FortiGuard option. antispam-force-off            Enable/disable forcibly disable the service. antispam-cache                Enable/disable FortiGuard antispam cache. antispam-cache-ttl     &n

I have just received the redemption certificate for a recent FortiToken Mobile purchase and see that the first requirement is to make sure that the FortiGate is connected to the internet.  Our units are buried into process control networks that do not (nor should) have connections to the internet.  Is there another method to activate the tokens? --Ron

Please find the final version of the FGT 5.2.1 Firewall Policies module.  Comment and feedback always welcome. https://www.brainshark.com/fortinet/FGT_5-2-1_Firewall_Policies Mike

Is it mandatory that I chose WAN interface for Outside segment, DMZ interface for DMZ segment. Is there any hard coded settings such as security levels for these interfaces?

Hey guys, got a little problem. I use my Fortigate now in NAT mode, and I want to go to the Internet from the LAN interface.In the DNS settings I entered 10.0.0.138 (which is my DSL modem) In DHCP I configured 10.0.1.1 as Gateway and range 10.0.1.2-.99. The lan interface has the ip 10.0.1.1 and my Interface where I connectet the modem has 10.0.0.99. I createt a policy: source: lan adress: all destiantion: wan adress: all protocoll: any NAT: onBut I cant connect to the Internet. I can only connect to 10.0.0.138. Do I use the wrong DNS server or has anyone a idea whats wrong? -thanks

Hi, I need to remove uneeded configuration from my FG 1000c for audit purposes. We do not use the wireless controller features so I would like to remove the two section's below. I have tried to remove but get the error's at the end of this post - i have searched the config and the mesh.root interface only seems to be referenced in two places...(the two below) How can I delete these? config wireless-controller vap edit "mesh.root" set vdom "root" set mesh-backhaul enable set ssid "fortinet.mesh.root" set alias "m" set passphrase XYZ****** next config system interfaceedit "mesh.root" set vdom "root" set type vap-switchset snmp-index 31  FG01 (vap) # delete mesh.test Can not delete a static table entry Command fail. Return code -61  FG01 (interface) # delete mesh.test Can not delete a static table entry Command fail. Return code -61

Does it matter if two units in a HA cluster are different generations of the same model? Say 60C generation 3 and 4.The Handbook doesn't mention it:All cluster units must be the same FortiGate model with the same FortiOS firmware build installed. All cluster units must also have the same hardware configuration (for example, the same AMC modules installed in the same slots, the same number of hard disks and so on) and be running in the same operating mode (NAT/Route mode or Transparent mode).Each generation appears to have different size memory - does that count as a different hardware configuration or it simply doesn't matter at all? I prefer to ask _before_ I get it wrong...

HI Guys,I need someone to advice me on the scenario below.I have configured the OSPF routing protocol on the Fortigate but the output doesn't immediately display on Routing Monitor GUI. However, I was able to see the external route being learn from the CE router on the Fortigate CLI. Can i know why we cant immediately notice the external E1 route? Is there some kind of min wait time frame before it appears on the GUI? Please note that this is a Fortigate 310B firewall. Thank you in advanced. Rgds,Mesh 

Hi, Is it possible to modify LDAP authentication in way that would allow users to authenticate with either their sAMAccountName or their userPrincipalName? Thank you

Hi, is it possible to redefine the LDAP filter in a way that would enable the Fortigate to be aware of nested groups? Thank you

Gents Good evening and thanks already if you got the time to help me out, not sure if this is in the right thread but: Got a internal Active directory domain named, mydomain.com (yes i know not very clever), long story short bought a B200 to satisfy bandwidth managment and content management it owrk like a charm with AD integration, but now i have a small issue. My company web site is hosted externally a suffix that equals my internal domain, i have to point my internal DNS servers to the external www.mydomain.com IP address. if i use any ISP link external to my LAN i can open the web site (E.G. a 3G network), but on my LAN i just get a time out, altough i can resolve the name to the correct IP address internally the page does not open. is there a security mesuare wihtin fortinet causing this situation? what is it? and can you help me to fix it? I say this because if i take fortinet out of the equation and put the old CISCO ASA online all works fine.&

Just updated to 5.0.9 on our Fortianalyzer 1000c and can't seem to find where to view the real time logs as they come across.I use this feature to live monitor student activity at times.  Where can I see the real time logs? 

Hi all We have spend a lot of time trying to get IPSEC FG to FG to work as shown in this video.  http://www.youtube.com/watch?v=01KEgxqC4WI The plan is to use OSPF as the routing protocol, so that should WAN 1 fail WAN 2 becomes the new route etc.We managed to get the tunnel up and working....(we are using the latest version of FW 5.2.1, so we had to add in quick mode selector ip's for the local lan AND the ipsec interfaces) Eventually we managed to pass pings from a PC over the tunnel, but had to use static routes to get it to work.No matter what we tried we cannot get OSPF updates over the tunnel, so without the static routes one side cant reach the other!Having the static routes in place defeats the whole purpose of using the routing protocol.(running cli commands to see the OSPF neighbour show nothing on both sides) Just  a thought, but I suspect the FW rules are restricting OSPF traffic, if I look at the rules they tend to only allow traffic from internal to e

Hi all, I have 2 firewalls configured as active-active HA. Now I need to format disk for it to enable the logging. My question now is; when I do the format disk on the 1st unit (system reboot), will the network get directed to 2nd unit causing 1 ping drop? or will both units go down at the same time? Thanks in advance,D 

Hi Guys,I have just upgraded a FG50B box from 4.2.1 to 4.3.18 directly.I was able to get the internet for a minute , ( I am taking the control remotely as well through team viewer) .but after that it went down, what are the possible things I can ask the ground guy to do? 

We have a Fortigate 600C. At the moment you can get to our Firewall admin page through https from the internet. What is the best way to lock down this access to only allow access from specific IP's? So, we would still like access to the admin page and to get logged in from the internet, but only from specific IP addresses. Thanks in advance. New to Fortinet and need all the assistance I can get. 

Can someone help me out on this? Got a mail from our certificate supplier about SHA1 certificates being phased out.  They supplied us with a new certificate which replaces the old one. However this certificate is only available in .cer-format and is being sent together with just the CA certificate and the intermediate certificate. When I try to import the certificate into the Fortimail unit, the response says: "Certificate upload: importing the CSR response failed". I get that because no CSR was created. Question: How can I replace an existing certificate in the FortiMail with the new one which is in .cer-format only?