Search Results

Search found 29 results on 2 pages for 'fortigate'.

Page 1/2 | 1 2  | Next Page >

• Fortigate restrict traffic through one external IP

  - by Tom O'Connor

  I've got a fortigate 400A at a client's site. They've got a /26 from British Telecom, and we're using 4 of those IPs as a NAT Pool. Is there a way to say that traffic from 172.18.4.40-45 can only ever come out of (and hence go back into) x.x.x.140 as the external IP? We're having some problems with SIP which looks like it's coming out of one, and trying to go back into another. I tried enabling asymmetric routing, didn't work. I tried setting a VIP, but even when I did that, it didn't appear to do anything. Any ideas? I can probably post some firewall snippets if need be.. Tell me what you want to see. SIP ALG config system settings set sip-helper disable set sip-nat-trace disable set sip-tcp-port 5061 set sip-udp-port 5061 set multicast-forward enable end Interesting Sidenote VoIP phones, with no special configuration can register fine to proxy.sipgate.co.uk, which has an IP address of 217.10.79.16. Which is cool. Two phones are using a different provider, whose proxy IP address is 178.255.x.x. These phones can register for outbound, but inbound INVITEs never make it to the phone. Is it possible that the Fortigate is having trouble with 178.255.x.x as it's got a 255 in it? Or am I just imagining things?

  Read the article

• Fortigate 80C multi wan

  - by emamdouh

  I've Fortigate 80c and two internet lines from two separate ISPs. I'm trying to distribute sessions between both internet lines following http://docs-legacy.fortinet.com/cb/html/index.html#page/FOS_Cookbook/Install_advanced/routing_ecmp_basic.html , but it seems connections go through just one of two internet lines. I have "wan1 as it's configured first, and I could edit static route table to be wan2 instead of wan1", but not both of internet lines I have. Any ideas why this happens? Thanks in advance

  Read the article

• Allow traffic from ssl-vpn to enter ipsec tunnel on fortigate

  - by Sascha

  we configured our FortiGate 50B to route traffic from our local net 192.168.10.* (which is our office) to a remote network 172.29.112.* using an ipsec tunnel. Everything works fine as long my computer has an ip from 192.168.10.*. We can also connect to the office network from at home using a ssl vpn connection. Once connected we receive an ip from 10.41.41.*. Now I want to allow the traffic flow from 10.41.41.* to 172.29.112.* just like it does from the office network. Could somebody point me in the right direction what I would need to do? Thanks, Sascha

  Read the article

• Fortigate VPN Routing issue

  - by user1571299

  I have 200B Fortigate unit with 2 internet WAN connections. I also have a remote site which I'm connected to via IPSEC VPN through WAN1. This site has only one GW IP address. I'd also like to setup a VPN ontop of WAN2 with that specific site as it's destination. The default route for my end is WAN1. My problem is I cant figure out how to have both tunnels up at the same time. What's the best practice for achieving this? Thanks

  Read the article

• How to activate Virtual Desktop on Fortigate 100A ?

  - by Deniz

  We did recently update the firmware on our Fortigate 100A box and after the upgrade we tried to use the "Virtual Desktop" feature. (This isn't a new firmware feature) We can't find a way to activate or use it. Does anyone have any experience on "Virtual Desktop" of Fortigate devices ?

  Read the article

• Port forwarding on Fortigate 50B

  - by sindre j

  I have serious problems setting up port forwarding on a Fortigate 50B. The unit is basically running as factory default, the wan1 interface is connected to my fibre optic internet modem, and my lan is connected to the internal switch of the Fortigate. The factory default firewall policy allowing traffic from the internal interface to wan1 is kept and I'm able to access the interet as normal. Then I added a virtual ip and a firewall policy for allowing access from the internet to my local servers (ip 192.168.9.51) webserver (standard port 80). The settings I made are as follows. Edit Virtual IP Mapping Name : Server VIP External interface : wan1 Type : Static NAT Extermal IP Address/Range : 0.0.0.0 Mapped IP Address/Range : 192.168.9.51 Port Forwading : not checked Firewall policy Source interface/Zone : wan1 Source address : all Destination interface/Zone : internal Destination address : Server VIP Schedule : always Service : HTTP Action : ACCEPT no other settings checked What happens now is that I'm unable to access internet from my server, I'm not getting through to the webserver from internet either. I'm able to ping a site on the outside, but all web traffic is blocked, both ways. I've checked the documentation, but as far as I can tell I have set this up correctly. Anyone here with knowledge of Fortigate port forwading/NAT?

  Read the article

• Fortigate - Accessing a Virtual Server address from several interfaces

  - by Jeremy G

  I am setting up a new application in its own DMZ on our Fortigate 300C firewalls. I have defined a load-balancing configuration for part of the application, and this works fine for traffic coming in from our internal network. However, I would also like this application to be reachable from other DMZs, for inter-application traffic, and from the SSL VPN interface. I can't seem to define the required policy, and it seems this is due to Virtual Servers being bound to the client interface on the Fortigate rather than the server interface (and so my virtual IP is not accessible from any of these other interfaces) Does anyone have an idea how I might go about this ? I guess I could create other virtual IPs for each interface, but this gets complicated to handle as clients need to change the address they use depending on how they are connecting. Thanks, Jeremy G

  Read the article

• Fortigate 200A firewall CPU high resource usage

  - by user119720

  This morning I'm receiving complaints from several end users that saying their whole department network are slow and have intermittent. Therefore I've checked our firewall to see whether if something goes wrong with the device.From my observation in the FortiGate dashboard status, the CPU resources is very high (99 percent). My first assumption is to clear the log since in the alert log the Fortigate log mention that it is already 90% full.Based on my understanding,the log can be cleared by restarting the firewall. After restarting the firewall the network seems okay again but then after several minutes it went up again.The condition still persist until now. Can someone show me where else I can check to fix this issue? I've really appreciate any help that I can get here.Thanks. Edit: diag sys top command

  Read the article

• Fortigate Remote VPN : no matching gateway for new request

  - by Kedare

  I am trying to configure a Fortigate 60C to act as an IPSec endpoint for remote VPN. I configured it like this : SCR-F0-FGT100C-1 # diagnose vpn ike config vd: root/0 name: SCR-REMOTEVPN serial: 7 version: 1 type: dynamic mode: aggressive dpd: enable retry-count 3 interval 5000ms auth: psk dhgrp: 2 xauth: server-auto xauth-group: VPN-group interface: wan1 distance: 1 priority: 0 phase2s: SCR-REMOTEVPN-PH2 proto 0 src 0.0.0.0/0.0.0.0:0 dst 0.0.0.0/0.0.0.0:0 dhgrp 5 replay keep-alive dhcp policies: none Here is the configuration: config vpn ipsec phase1-interface edit "SCR-REMOTEVPN" set type dynamic set interface "wan1" set dhgrp 2 set xauthtype auto set mode aggressive set proposal aes256-sha1 aes256-md5 set authusrgrp "VPN-group" set psksecret ENC xxx next config vpn ipsec phase2-interface edit "SCR-REMOTEVPN-PH2" set keepalive enable set phase1name "SCR-REMOTEVPN" set proposal aes256-sha1 aes256-md5 set dhcp-ipsec enable next end But when I try to connect from a remote device (I tested with an Android Phone), the phone fail to connect and the fortinet return this error : 2012-07-20 13:08:51 log_id=0101037124 type=event subtype=ipsec pri=error vd="root" msg="IPsec phase 1 error" action="negotiate" rem_ip=xxx loc_ip=xxx rem_port=1049 loc_port=500 out_intf="wan1" cookies="xxx" user="N/A" group="N/A" xauth_user="N/A" xauth_group="N/A" vpn_tunnel="N/A" status=negotiate_error error_reason=no matching gateway for new request peer_notif=INITIAL-CONTACT I tried searching on the web, but i did not find anything revelant to this. Do you have any idea of what can be the problem ? I tried many combinaisons of settings on the fortigate without success..

  Read the article

• How to delete IPSEC VPN tunnel from Fortigate 60

  - by Björn

  I have had a IPSEC connection setup between two firewalls. Now I want to remove the tunnel in my firewall, a "Fortigate 60". There are two phases, "Phase 1" and "Phase 2" for each IPSEC connection. I can delete the "Phase 2" entry by clicking the trashcan icon (in the web interface), but there is not such icon for "Phase 1". Is it possible to delete that? When I look at the log it alerts about this tunnel not working (after deleting "Phase 2") and it would be nice not ta have loads of such events in the log. All ideas are appreciated.

  Read the article

• Configuring Fortigate OS4 for FTPS

  - by Paul

  I configured iis7 ftp to allow ssl connections. I set the ssl firewall to use ports 50000-50050. If I set up a custom service on my fortigate firewall for ftps with source ports 990-50050 and destination ports 990-50050, set it to a firewall policy and connect from a client it connects and works successfully. If I create a service FTPS Control with source port 990 and destination port 990 and another service,FTP Data with source ports 50000-50050 and destination ports 50000-50050 add them to a group FTPSSL, replace the ftps policy with FTPSSL and try connecting it tries to connect to port 990 and eventually times out. Is there a way to configure the service to only use the ports I need and not every port from 990 up?

  Read the article

• Configuring Fortigate OS4 for FTPS

  - by Paul

  I configured iis7 ftp to allow ssl connections. I set the ssl firewall to use ports 50000-50050. If I set up a custom service on my fortigate firewall for ftps with source ports 990-50050 and destination ports 990-50050, set it to a firewall policy and connect from a client it connects and works successfully. If I create a service FTPS Control with source port 990 and destination port 990 and another service,FTP Data with source ports 50000-50050 and destination ports 50000-50050 add them to a group FTPSSL, replace the ftps policy with FTPSSL and try connecting it tries to connect to port 990 and eventually times out. Is there a way to configure the service to only use the ports I need and not every port from 990 up?

  Read the article

• IPSec tunnel between FortiGate and iPhone / iOS - Works except for DNS / Wins

  - by user57988

  I have configured my Fortigate with a new VPN IPSec tunnel to allow the iOS Cisco client to connect. That works fine. I can RDP to my servers, browse to my servers via IP address, etc. But, the iPhone does not resolve my internal IP addresses. I have added the DNS servers that serve addresses for my internal users, as well as the WINS servers, but the iPhone acts like it doesn't see them at all. config vpn ipsec phase1-interface edit "iPhone_VPN" set type dynamic set interface "wan1" set dhgrp 2 set proposal 3des-sha1 3des-md5 set xauthtype auto set mode-cfg enable set authusrgrp "iPhone_VPN_Users" set ipv4-start-ip 10.10.99.100 set ipv4-end-ip 10.10.99.199 set ipv4-netmask 255.255.0.0 set ipv4-dns-server1 10.10.2.1 set ipv4-dns-server2 10.22.1.80 set ipv4-wins-server1 10.10.2.1 set ipv4-wins-server2 10.22.1.80 set ipv4-split-include "Dialup_VPN_Networks" set psksecret ENC xxxxx next end For whatever reason, as far as I can tell, the iPhone does not 'see' the DNS or WINS entries. I don't know how to check it...

  Read the article

• FortiGate firewall configuration with /30 and /28 networks

  - by slyderc

  I have fiber coming in from a new ISP which is being handed off via Ethernet on a single physical port. I'm having doubts about how to approach the configuration on my FortiGate 200A firewall because I've been given a /30 containing the ISP's gateway and another /28 for external IPs I can use: x.y.76.12/30 (.13 is the GW) x.y.76.64/28 (public IP space) How do I configure the FG200A's WAN1 interface to be aware of the two networks? As I only have one physical ISP port, will I need to plug it into a switch to break-out two cables and use a DMZ port on the FG200A for setting up the /28? Thanks in advance for your insight!

  Read the article

• Configuring port forwarding on Fortigate 50B

  - by GomoX

  I can't for the life of me get port forwarding to work on my Fortigate 50B. I followed the setup tips described on this other SF thread with no success. The only specific difference I can find is we are using load balancing through 2 different internet uplinks. Is there any caveat specific to this scenario that I might be missing? If you need any specific additional information please ask because I think I have checked everything: Virtual IP mapping on external interface wan1 ACCEPT all from any on wan1 to the corresponding server on internal No seeming offending firewall rules (any specific pitfalls that I might want to check for?)

  Read the article

• How to activate the Virtual Desktop feature on Fortigate 100A ?

  - by Deniz

  We did recently update the firmware on our Fortigate 100A box and after the upgrade we tried to use the "Virtual Desktop" feature. (This isn't a new firmware feature) We can't find a way to activate or use it. Does anyone have any experience on "Virtual Desktop" of Fortigate devices ?

  Read the article

• ASE reports messages as spam?

  - by Adam

  Outside users are attempting to send to our domain (www.lrffpd.com). It's getting rejected sporatically. All of the senders are getting some variation of the error "Unagi.teksnax.com has rejected the message. This message has been blocked because ASE reports it as spam". The error number varies. -Our firewall is a Fortigate and it runs the built-in Fortigate AntiSpam software. I don't this problem is becuase of the firewall because the error is coming from the server, not the firewall. -On the Exchange 2003 server we run ESET NOD32 for Exchange (only for AntiVirus). We also run the IMF filter built into Exchange. I've NEVER heard of ASE and can't find any information about them. What do you think this could be?

  Read the article

• Windows VPN - NO internet access

  - by sharru

  I host a network of servers behind a Fortigate 200a firewall in the DC. I connect to those servers via a VPN connection. The problem is that when i connect to the VPN, I lose my internet connection on the local PC (windows 7). I would like to be connected to the VPN and still surf the web. i guess this means to only forward a range of ip to the VPN connection. I've read other answers on serverfault, talking about "un-check the 'Use default gateway on remote network' option in your Windows 7 PPTP network connection settings". When i do that , i get internet access but no access to the servers in the VPN. Any idea how to get both working? Should i change something on the fortigate 200a config? Do i need two networks cards? Is there a place in windows to define ip range for the vpn connection?

  Read the article

• NAT cause huge External (actually internal) bandwidth usage

  - by user67953

  We have 4 servers running in a data center, with internal IP: 192.168.3.* assigned. A hardware (FORTIGATE) firewall configured NAT, and it will lead the traffic as: external IP: 111.222.333.10 -> 192.168.3.10 www.server1.com 111.222.333.11 -> 192.168.3.11 www.server2.com 111.222.333.12 -> 192.168.3.12 www.server3.com In DNS, we have www.server1.com A 111.222.333.10 Now if I send a lot of data to www.server1.com from www.server2.com, the data will be send through 111.222.333.10 (external IP) and this cause our bandwidth usage huge (expensive!). The work around I have is to add a local host mapping to server2: 192.168.3.10 www.server1.com. That way when send files from server2 to www.server1.com, it will be internal. However, we are having more and more servers, it would be hard to manually add mapping to every server. Just wondering do we have another solution for this? Can we do something in the FORTIGATE firewall? ps. The DNS server being used is public, such as opendns, Google dns etc.

  Read the article

• Port forwarding with multiple IP's

  - by Jon

  I work at a company which uses a Fortigate 60 router, something I'm not really familiar with. Everything worked fine with it until a week ago when Comcast came in and replaced our modem. It seemed as though the process went smoothly - our connection came back up and our static IP remained the same. However, none of our port forwarding is working. What has me confused is the Comcast modem apparently has two IP addresses. The WAN2 interface for it in the Fortigate router is set to 10.1.10.10. However, all of our port forwarding settings are set to an external IP address of 10.1.10.50. Now this setup used to work fine, so something with the Comcast modem must have changed. How can I find out what? I tried setting a computer to a local IP of 10.1.10.15 so I could open up the web interface for the modem, but I can't even ping 10.1.10.10 when I do that. Any ideas? Thanks!

  Read the article

• VMWare ESXi virtual machine can contact the gateway but not the DNS server

  - by Nathan Palmer

  I am having a bit of a strange issue. I have a VMWare ESXi server with two virtual machines running on it. They are running just fine and can communicate on the network without a problem. I am now trying to add a third. I am installing Ubuntu 8.04 Server. I assign it a static IP address and it's a fresh installation. Once installed I can ping the gateway but I cannot ping the DNS server. It's on the same network with the other two VMs which are communicating just fine. I have tried to reinstall the operating system but it still fails to connect. Here is /etc/network/interfaces auto eth0 iface eth0 inet static address 192.168.1.23 netmask 255.255.255.0 network 192.168.1.0 broadcast 192.168.1.255 gateway 192.168.1.1 dns-nameservers 208.67.222.222 #opendns dns-search mydomain.com Here is route Destination | Gateway | Genmask | Flags | Metric | Ref | Use | Iface localnet | * | 255.255.255.0 | U | 0 | 0 | 0 | eth0 default | 192.168.1.1 | 0.0.0.0 | UG | 100 | 0 | 0 | eth0 Since I'm running this behind a FortiGate this is what the sniff command gives me when I try to ping 208.67.222.222 arp who-has 192.168.1.1 tell 192.168.1.23 arp reply 192.168.1.1 is-at MAC 192.168.1.23 -> 208.67.222.222: icmp: echo request 192.168.1.23 -> 208.67.222.222: icmp: echo request 192.168.1.23 -> 208.67.222.222: icmp: echo request 192.168.1.23 -> 208.67.222.222: icmp: echo request 192.168.1.23 -> 208.67.222.222: icmp: echo request As you can see it looks like I never get a response. One interesting thing I notice is the arp reply's MAC doesn't look right. I have cleared the FortiGate's ARP cache though and checked the entry and it seems correct. The MAC it lists is the one for the router. However if I ping from a different virtual machine that is also Ubuntu 8.04 with a nearly identical configuration I get this. 192.168.1.22 -> 208.67.222.222: icmp: echo request 208.67.222.222 -> 192.168.1.22: icmp: echo reply 192.168.1.22 -> 208.67.222.222: icmp: echo request 208.67.222.222 -> 192.168.1.22: icmp: echo reply 192.168.1.22 -> 208.67.222.222: icmp: echo request 208.67.222.222 -> 192.168.1.22: icmp: echo reply So, what could I be missing? Thanks.

  Read the article

• Routing between same networks

  - by osmandfj

  I have two different sites: NetA has a subnet 192.168.2.0/24 NetB has 192.168.1.0/24. The two sites connect each other via IPsec VPN with fortigate devices. I need to move a server with IP address 192.168.2.240 from NetA to NetB and I cannot change its IP address due to some specific reasons. My question is; if I move that server from NetA to NetB, is it possible to reach that server from NetA?

  Read the article

• Managed hosting firewall vs managing own firewall

  - by ddawber

  I posted on stackoverflow as to the overall benefits of managed hosting vs non-managed hosting. The more I think about it, it seems to boil down to one question: should I use a managed host because they take care of the firewall, or would I be okay managing my own, software firewall? The sites on the box do get quite a lot of traffic but as for throughput and what-not, it's not something I know much about. Ideally, i'd take my sites over to a Linode stack and manage incoming connections using iptables or an alternative. Here are some example hardware solutions a managed host would provide: Cisco Pix 501, Pix 506, Pix 515 and ASA 5505 and ASA 5510 Firewalls, configurable in a control panel the likes of an enterprise firewall such as FortiGate 110C Aside from this, I do not need managed hosting, so I appreciate your suggestions.

  Read the article

• IPSEC Windows 2008 <--> Fortinet 60B

  - by Elijah Glover

  I am trying to establish a IPSEC vpn, between an office DSL connection and a single virtual machine. I have done hub-spoke stuff before with cisco and fortinet routers, never hardware <-- software. Fortigate 60B - 10.20.1.1/24 Windows Server 2008 r2 Installed On VM I have seen some guides, to do this with juniper screenos (guide uses first release of 2008, they introduced windows firewall with advanced security), but none using fortinet equipment. Anyone ever been successful? Or should I install RAS/PPTP, so I can dial in?

  Read the article

• How does one guarantee a remote client the same local IP address every time when connecting to a VPN?

  - by Joe Carroll

  I need to configure a VPN for secure remote access to a PACS serving DICOM radiological images. The DICOM standard requires that any clients accessing the PACS must be using a fixed IP address that is pre-registered in PACS. I haven't implemented this solution before and would appreciate any guidance. I believe it should be possible to use RADIUS on the server to authenticate users connecting to the VPN and with it assign each user their own specific local subnet IP address, which would be registered with the PACS. The server runs Windows Server 2003 R2 Enterprise Edition SP2 and the VPN device is a FortiGate 60C. The What would be the best and/or simplest way to set this up?

  Read the article

1 2  | Next Page >