Recently active topics

Issue: I’m deploying the FortiSIEM 7.5.0 Headless Windows Agent on a Windows machine in an OT environment. The communication path is Headless Agent → Diode Collector → L2.5 Virtual Collector → Supervisor. The Windows agent installation completes successfully, and the host is discovered in FortiSIEM, but no Windows Event Logs are being ingested. Objective: I’m trying to collect Windows Event Logs using the Headless Agent through the Diode Collector architecture. The OT Host Template is configured for Windows Event Logs. Has anyone encountered this issue or are there any additional configuration steps or prerequisites required for this deployment?​@AEK   

Description This article describes how to import a specific FortiClient VPN profile to FortiClient without affecting/losing other profiles. Scope FortiClient Solution As per the below screenshot, currently, there is only one profile configured 'LDAPS-FGT': Solution:   Create a backup file of the current FortiClient configuration: Backing up the full configuration file. To back up the full configuration file: Go to Settings. Under System, select Backup. Select the file destination. Enter a password to save the file in an encrypted format with a password. Select OK. Similarly, create a backup file of the FortiClient from which the profile will be imported.   Open both the files with Notepad, as below: In the left notepad file, there is profile 'LDAPS-FGT', and in the right notepad file, there is profile 'Imported-Profile'. Copy the configuration part from <connection> to </connection> (from the config file that is desired to be imported into the

Hi,after upgrading our FortiGate HA cluster from 7.4.12 to 7.6.7, we noticed a significant increase in the daily log volume sent to FortiAnalyzer.Environment:FortiGate: 2x FG-200F in HAFortiOS: 7.6.7FortiAnalyzer: VM, currently 8.0.0Logging: FortiAnalyzer​Before the upgrade, our daily log volume was normally below the licensed GB/day limit (15 GB). After the upgrade, the daily log rate increased by approximately 8–10 GB per business day, without any intentional configuration changes on the FortiGate side.For a normal business day we now see approximately: Application Control log: ~10 GB/day, Traffic log: ~9 GB/day​No firewall policies were intentionally changed, and we did not enable any additional logging options manually after the upgrade.We have already checked the following:- no known configuration change was made on the FortiGate before/after the upgrade- application Control logging is enabled as before- SSL inspection is enabled- FortiAnalyzer is receiving logs correctly- The inc

Regarding a FortiGate system configured in an active/standby high-availability (HA) setup,we initially set the Device Priority value for Unit 1 to 200 and the Device Priority value for Unit 2 to 128 (the default).However, even though we hadn’t made any changes, the priority value on the standby unit had changed to 200, the same as the active unit. We attempted to manually change the priority value on the standby unit back to its original value of 128, but an error message stating “The entered value is incorrect” appeared, and we were unable to make the change.The system recognizes the active/standby configuration and no abnormalities are apparent in the HA setup, but what is the cause and how should we proceed?

How to Protect Fortigate from IPv6 Security Risks

Working on a branch office to HQ redundant vpn setup.  Each location has 2 ISPs and I had planned on following this: Manual redundant VPN configuration | FortiGate / FortiOS 8.0.0 | Fortinet Document Library just using 2 tunnels (primary ISP to primary iSP, backup ISP to backup ISP) with static routes to force the backup tunnel over the secondary WAN at each location.  Is there any drawback to this approach?  I had considered using SD-WAN for the vpn traffic or possibly BGP but wasn’t sure if either offered a significant advantage in this situation.  The branch office has a single /23 network and HQ has only 3 or 4 networks that need to be accessible.  And the request is for the tunnels to utilize ISP1 as the primary when available.

Description This article describes the addition of a server certificate verification capability for Virtual Server and ZTNA Access Proxy in FortiOS. Scope FortiOS. Solution Starting in FortiOS v7.4.9 and v7.6.3, FortiGate introduces a new capability that allows administrators to verify the server certificate of backend real servers used by Virtual Server (firewall VIP) and ZTNA Access Proxy configurations. This enhancement addresses modern deployment scenarios where backend servers may reside not only on internal networks but also on external or cloud-hosted environments, where certificate validation is an important security requirement.   To support these scenarios securely, FortiOS now provides an option to ensure that the backend server presents a valid and trusted certificate before the connection is established.   The following configurations have been enhanced with the newly introduced verify-cert option: Virtual Server (firewall vip → realserver).   conf

Where I can find click house schema file for FortiAnalyzer ?According to docs.fortinet.com:Each log table stored in an SQL database contains log fields that can be used in datasets.You can view a full list of the fields available for each log type in the FortiAnalyzer ClickHouse Schema file available from the FortiCloud Support page.But I cannot find it.

Description This article describes how to identify the web filter category of a website or domain. This step is crucial for effectively utilizing the web filter feature in FortiGate. Scope FortiOS, FortiGate, Web Filter, FortiGuard. Solution Users may be uncertain about the category of a specific website or domain while configuring the web filter in FortiGate.   To instantly query the category of a website or domain, use the FortiGuard web filter lookup tool.     Enter the website or domain and select the relevant FortiOS version.     Press Enter or select the 'Search' button to display the relevant category. It is highly recommended to verify this information when configuring Web filtering on FortiGate to avoid blocking websites the business needs access to:   It can also be viewed from the FortiGate GUI as well.   Make sure that the FortiGate can connect to the FortiGuard server for the Lookup Rating to be successful.Navigate to Securi

Good day, everyone.I have been experiencing intermittent SPF false positives in **FortiMail 8.0.0**. In some cases, FortiMail reports that the sender's domain does not have an SPF record. However, after verifying the domain manually using both our internal DNS servers and public DNS servers, the SPF record is available and resolves correctly.I would like to know if there is any configuration or best practice that could help reduce these false positives. For example:* Is it possible to increase the DNS query timeout used by FortiMail?* Is it possible to adjust or reduce the DNS cache timeout?* Are there any recommended DNS-related settings for improving SPF validation reliability?One behavior I have noticed is that multiple emails from the same sender domain, received at nearly the same time, may produce different SPF results. Some messages pass SPF successfully, while others are rejected because FortiMail reports that no SPF record was found.Our environment consists of **two FortiMail

Can Fortisiem be integrated with PowerBI for reporting? if yes, how? or which reporting tool can be integrated with Fortisiem?

Hello dear community, I got a new customer that has an unlicensed FortiGate 50E and FortiAPs 221E on firmware 6.0.x. They want to replace the FortiGate with the 50G model but want to keep the APs for now. The target FortiOS for 50G would be 7.4.12. As the config would be converted/migrated, what would be the best upgrade path to avoid losing the APs management?Put the 50G on 7.4.12 and convert the 50E configuration as is Upgrade the 50E and 221E APs to latest possible 6.2 branch and then convert the 50E configuration for 7.4.12 Upgrade the 50E and 221E APs to latest possible 6.2 branch, convert the 50E configuration for 7.0.19, then upgrade the 50G to 7.4.12 Please let me know if more details are needed. Best Regards

Hello everyone,I am using a FortiGate 40F running FortiOS 7.4.12.I would like to know if there is any supported or unsupported method to prevent the FortiGate from saving Alert, Error, and Critical logs in the local memory.My goal is to stop these logs from being written to the internal log storage, not just hide them in the GUI or change their display.Has anyone found a solution, workaround, hidden CLI command, or TAC recommendation that can completely prevent these logs from being stored locally?Any help or experience would be greatly appreciated.Thank you.

Hi I tried migrating the FAZ-400E config to a FAZ-1000G, but after rebooting, the configuration wasn't applied.but migrating the same config to a FAZ-VM works without any issues.(OS versions are identical).

DescriptionThis article describes the issue when FortiAnalyzer logs fail to load on FortiGate HA cluster after upgrading FortiAnalyzer to v7.4.11.ScopeFortiGate HA running v7.4.9, v7.4.11, v7.4.12.FortiAnalyzer v7.4.11.SolutionMatching criteria:FortiGate are in HA pair. Standalone FortiGates are not affected.FortiAnalyzer running v7.4.11.Logs appearing in FortiAnalyzer. The output of 'execute log fortianalyzer-cloud test-connectivity' from the FortiGate shows real time or recent Log: Tx & Rx. When navigating to FortiGate Log & Report > Forward Traffic Logs > Set source as FortiAnalyzer, no logs are displayed. Selecting 'Memory' or 'Disk' (if available) displays logs.FGT # execute log fortianalyzer-cloud test-connectivity Testing connectivity to fortianalyzer-cloud ... FortiAnalyzer Host Name: FAZ-FTNT-CLOUD FortiAnalyzer Adom Name: root FortiGate Device ID: FG101FTKxxxxxxxx Registration: registered Connection: allow Adom Disk Space (Used/Allocated): 1184120B/80530636800B

Hi,I recently implemented FPAM and I have a strange behavior with all the web launching sessions.The FPAM is in a subnet dedicated.My pc is on another subnet and the internal services and external(obviously) are on other subnets.In the middle there’s a Fortigate.I have also an ACL for deny the traffic to the internal services from my pc, so I must traverse the FPAM to reach the services.I launch multiple web launching sessions to multiple sites internal and external and after so much time, I can’t define how much, I receive some ERR_CONNECTION_TIMED_OUT from random sites.If I try to reopen the site, I can no longer access it; I have to wait a long time before it starts working again.From what I've gathered so far, connections are more stable if I use the site's IP address directly instead of the FQDN, but sometimes are slowly(But at least they don't time out.)When I have the reset, the FPAM is capable of ping and resolve the destination internal or external site, seems to be a problem

Hello Guys,I’m encountering two issues while trying to retrieve incidents from FortiSIEM. I’d appreciate your assistance with these matters.1. When ingesting data, even though I specify a count for “pull request” and “per page,” when I click “trigger,” it tries to retrieve all incidents, and the count in the alert suddenly spikes. How can we resolve this? 2. We wanted to retrieve specific incidents from FortiSIEM using the Incident ID, but we observed that the content does not include the entire raw log from FortiSIEM—only the incident details. For example, we cannot see fields such as “source” and “dest IP” from the raw log in SOAR, so we are unable to create a map even if we wanted to. Can we expand the content of the raw log sent to SOAR? Thanks in advance

DescriptionThis article describes how to fix an issue where the user encounters the error message Fail(errno=0):invalid value during a FortiManager's FortiProxy ADOM (Administrative Domain) upgrade.Scope FortiManager.SolutionADOM upgrade can fail with the error as in the image below:Error: 'Fail(errno=0):invalid value'. At the moment, FortiManager does not have support for FortiProxy ADOM upgrade, as stated on its administration guide: FortiProxy ADOMs'FortiProxy ADOMs cannot be upgraded or downgraded. If another FortiProxy ADOM version is required, you can move your FortiProxy device(s) into another FortiProxy ADOM created on the selected version.'To address the error and manage upgraded FortiProxies, a new ADOM in the target version needs to be created. Depending on the situation, devices can be imported and configured again or ADOM migration should be performed.For the migration, follow the steps in the referenced articles: Move scripts:Technical Tip: How to transfer a FortiManager

How i renew or get a new FortiGate trial license in VmWorkstation that i launched before with my Forticare account and now expired ??   

DescriptionThis article describes the requirements and configuration needed to integrate the OMI Kerberos authentication successfully.Scope FortiSIEM v7.5.0 and v7.5.1.SolutionPrerequisites:Active Directory Server is configured for Kerberos authentication.DNS Server configured to resolve hostnames.OMI user permissions are configured in the Windows host.See the WMI/OMI Configuration and Kerberos Configuration for OMI guides for more information.FortiSIEM configuration:Create OMI Kerberos credentials:See the OMI Access Credentials configuration guide for more information.Create an IP range association template:Run the Association and Credentials test: Ensure the test is run on the correct SIEM node by using the Use drop-down menuNote: NTLM has been deprecated by Microsoft; therefore, OMI authentication for only local accounts is not supported. See this document: What's New in 7.5.0 for more information in the release notes v7.5.0 documentation guide.

If the endpoint was idle for some time then when i change the group on the NAC, I can see the fortinac not send the CoA to the switch.We can see here the last fnac send the CoA is 14:02:18 then i change the group for that host at 14:30 and there is no CoA bsend to the switch  

Can Fortinac do the Revocation List to block certificate was revoked?

My scenario for contractor is they login to the network and get isolation network, then after enter the credential the device will connect to guest network and we must change the Host Role from Guest to Contractor then the device can access to the network.Vlan changing from isolation to guest and to contactor network is working fine except if vlan guest doesn’t have internet access then after credential entered then there are pop up in the browser say ‘Failed to detect a change in your network setting’ but vlan already changed to guest. When guest network have internet access then there no popup.Anyone know what url used by fortigate to detect that change ? My goal is to give internet access on guest network to specific url so the popup will not showing.

DescriptionThis article describes how to unlock a user account after multiple wrong login attempts during the initial login through the invitation link that is used to log in through FortiClient. ScopeFortiIdentity Cloud (former FortiToken Cloud).SolutionAfter receiving the FortiClient (Standalone) invitation code that is sent by FortiIdentity Cloud and attempting to log in, the user will be redirected to the FortiIdentity Cloud user login page. If a user inputs the wrong password multiple times, depending on the 'Max Login Attempts Before Lockout' value that is set in the Realm settings, then the account gets locked. In this case, the user's account can be unlocked by administrator(s) on the FortiIdentity Cloud by checking the following button in the user settings. After unlocking the user account, that button will be greyed out, and the user should log in using the correct credentials. The following authentication log entries will be generated for the wrong attempts.

Hi, I have FortiGate-VM64 v7.6.7 running on VMware Workstation. When I access the GUI the page loads (no timeout) but it's completely white/blank.In Chrome DevTools Console I see:401 Unauthorized on all /api/v2/ calls Events websocket closed unexpectedly Reconnecting attemptsCLI works perfectly fine, I can login and configure via console. The interface has allowaccess http https ssh ping configured on the management port.VM has no active license (eval). Could this be causing the blank GUI?Anyone seen this before?