Fortinet Community

Hi guys. So I’m new to firewall management and had a question. I’ve put some deny rules the firewall and have added some source ips and some destination ips. The thing is, if the rules are not being hit even after the policy has been pushed. The destination ips are NATed, so I need to know, do I put the IPs the real IPs are mapped to ( from the NAT pool)? Or the real IPs in the rule?

Hello Team,                 I am paloalto more guy and I used to utilize Paloalto's EDLs, so I wanted to ask about any Dynamic group that contains Malicious IP addresses, URLs, or domain lists that are included in the FortiOS and I can use them in my policies.If not, what are recommeded other sources "feeds" to add as External groups as feed that I can use for more protection in my policies?or also any  Malware Hash feeds that are valuable.TIA                  

I've been trying to transfer the FMG appliance firmware via TFTP in the boot loader, but hitting a road block with "Return to BIOS menu." when attempting to initiate the transfer. Backup firmware returns empty unfortunately. So long as I could resolve that return to BIOS, I'm pretty much golden.  

Good day, team,I have a question. I am currently implementing an SSL VPN and an L2TP VPN on a FortiGate 200F. My question is: can I use the same user group and the same IP address pool for both, or what would you recommend?

Hello all. I have for long time thinking about how i can remove the bundles of dedicated interfaces per VDOM and relying only on vdom-link to go and come from other VDOMS and a single or dual 10/25G interface to go to DC and internet for all VDOMs.My structure is as follow:2x FGT 600F in HA.VPN VDOM 1: 2 UTP cables (interfaces) in LAGServer VDOM 2: 4 UTP cables (interfaces) in LAGUser VDOM 3: 4 UTP cables (interfaces) in LAGMPLS VDOM 4: 2 UTP cables (interfaces) in LAGI have a BGP /24 ASN running on a pair of Mikrotik, and it is broken with /27 and /26 pointing via routes to VDOMs.Each VDOM has a dedicated VLAN transit to my DC network and each of them receives my "internet VLAN from my Mikrotik" so every vdom has a public IP address on an vlan interface (same vlan id on all vdoms and on the Mikrotic so the internet gateway of every vdom is reachable from another) (outgoing internet policies are natted with this IP). My future goal is to have a s

Good day, team,I have a question. I am currently implementing an SSL VPN and an L2TP VPN on a FortiGate 200F. My question is: can I use the same user group and the same IP address pool for both, or what would you recommend?

I am seeking guidance on using the FortiGate automation feature with FortiOS event log. I have configured a stitch to trigger on OSPF neighbor changes, specifically when a neighbor goes up or down. This setup works as intended for individual OSPF neighbors. After the trigger, then it performs the CLI script that does what it supposed to do and it works great. However, I want to adjust the configuration so that the stitch triggers only when two individual OSPF neighbors are down simultaneously. I have attempted to create this condition, but I am encountering an issue where only the first message field activates correctly, while the second message field does not do anything. Also, this is setup using the parallel option. Does anyone have guidance on how to set up the automation so it triggers correctly when both OSPF neighbors are down? Are there specific configurations or troubleshooting steps I should follow to address this issue?

Hello.I need help, we are receiving more than 10k alerts about this signature app.control.signature.testOur Hosts generate traffic to various IPs belonging to Symantec, Rapid7, etc. This signature app.control.signature.test does not exist and no information appears on the fortiguard page http://www.fortinet.com/ids/VID27840

Hello  I am getting a large number of entries related to the DNS.PTR.Records.Scan signature. The origin is one of my servers making requests to 8.8.8.8 or 1.1.1.1 What actions do you recommend? eventtime=1725978564223549647 tz="-0400" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="low" srcip=19.19.12.101 srccountry="Reserved" dstip=8.8.8.8 dstcountry="United States" srcintf="z2" srcintfrole="wan" dstintf="Internet" dstintfrole="wan" sessionid=88096527 action="dropped" proto=17 service="DNS" policyid=229 poluuid="79818ba8-59a9-51ef-f294-51bc44ab72d9" policytype="policy" attack="DNS.PTR.Records.Scan" srcport=59436 dstport=53 direction="outgoing" attackid=51391 profile="high_security" ref="http://www.fortinet.com/ids/VID51391" incidentserialno=45804839 msg="name_server: DNS.PTR.Records.Scan" crscore=5 craction=32768 crlevel="low"

Hello.I upgraded my gate firewall to 7.2.9->7.4.3->7.4.4 and the SSL VPN menu is gone.I can't find it when I look for it in Feature Visibility.Does anyone know?I've done 7 of them, and this is an issue with 2 devices that don't use a VPN.I also found that it is enabled in the preferences below. ----config vpn ssl settingssetstatus enable------ Does anyone know anything about this? Oh , For gate is 101F.

Hi everyone,I need to plan upgrade of FMG/FAZ and since it's my first time I am trying to gather as much info as possible.Can anyone please tell me if I can do direct upgrade to 7.2.7 as stated in the release notes or do I follow upgrade path tool which has FMG/FAZ as well? In this case it suggests I should go via 7.0.12 first and then 7.2.7.Thank you.

Hello everyone, I have a problem with our fortiGate 60E in the office. I found when I arrived this morning that no connections were going through, after looking for the problem we found that the fortiGate was down. Currently we have disconnected all the cables and turned it back on but the LEDs do not light up. When we turn it on only the three-line LED on the left at the bottom of the FORTINET logo lights up. Thanks in advance.Forti concerné 

Hi Fortinet Community,I have a FortiGate 60F with a 7.4.4 with a Trusted Hosts configured for admins.But in Log & Report>System Events I see Alerts every 3 mins:Administrator remote2 login failed from https(188.124.36.193) because of invalid user name.How can I block this specific IP from login attempts?GUI tutorials are from couple of years old.Maybe someone can make CLI tutorial?Thanks in advance.

Customer has an existing Cert for CN a url eg ras.banatesystems.com Requested to generate a new csr as the above due to expire When creating this on the fortigate , unable to name as ras.banatesystems.comAmended to new_ras.banatesystems.com Resent to get this signed , however customer has asked that the name should be ras.banatesystems.com. Is there an issue using new_ras.banatesystems.com get it signed and imported then change name back ?Or does it have to be explicitly "ras.banatesystems.com" Is there any documentation to support this ?  

Hi all ¡¡ I have not worked with BGP on a regular basis and I would like to know your opinion. In brief, I'm going to connect my firewall to 2 different ISPs routers(same provider) and I'm going to obtain from each of them a default route (0.0.0.0). One of them (Router2), gives me the same default route with prepend (less preferred) using another BGP session. Router 1 gives the default route witouth prepend. In the other hand, I'm going to add these 2 default routes to my SDWAN (I have more defaults than these 2). Is there a simple way to configure these 2 default routes on sdwan , so it routes traffic allways to the default, witouth prepends (Router 1), and only routes traffic to the other default when the Router1 is down. I've read about route maps, route tag etc, but maybe there is a more easy way to do it? Can SDWAN check the prepend to choice the active route? Thanks for your help ¡¡¡  

Hello community I am trying to STOP / START ipsec tunnels via API. I sucessfully connected to the API and sent a "tunnel_reset_stats" command to the API and the tunnl statistics get reset. So far so good. I was choosing "tunnel_reset_stats" since that commad requires additional parameters via http POST and so does the tunnel_down and tunnel_up command which ist my goal to achieve. I am using Powershell and the following code to reset the stats and it works: ==== CODE ====$ApiToken = "[redacted]"$body = @{"p1name" = "[Phase1Name]"}$EndPoint = "https://[firewall-ip]/api/v2/monitor/vpn/ipsec/tunnel_reset_stats?access_token=$ApiToken"$header = @{ "Authorization" = "Bearer $ApiToken" }$action = Invoke-RestMethod -Method POST -Uri $EndPoint -Headers $Header -Body ($body|ConvertTo-Json) -ContentType "application/json"==== CODE ==== Now accoring to the API documentation the  tunnel_up and tunnel_down command needs 2 parameters (p1name and p2name). so I adapted my scrip

Solution overview The Landing Zone Accelerator on AWS (LZA) for Canadian Centre for Cyber Security (CCCS) Cloud Medium is a specialized deployment designed in collaboration with national security entities and government agencies. It facilitates compliance with strict security requirements, offering a comprehensive AWS cloud architecture for handling sensitive workloads. The CCCS Medium Reference Architecture addresses identity and access management, governance, data security, logging, and network design in alignment with various security frameworks, including NIST 800-53, ITSG-33, FEDRAMP Moderate, CCCS-Medium, IRAP, and other medium-level security profiles.   Please refer to the CCCS Medium Reference Architecture document for the full detailed design.   Note: This solution will not, by itself, make you compliant. It provides the foundational infrastructure from which additional complementary solutions can be integrated.     Solution Detail This version of

Hello,on friday one of our clients performed an update from Client 7.2.4 to 7.2.5 which ended in a problem. The other Clients connected to our FortiClientEMS (7.4) had no problems.This client only showed "Messages", "Settings" and "About" in the left pane. But this is a "Zero Trust Fabric Agent"!So I uninstalled the client, did a reboot and reinstalled the client 7.2.5. The only change was that "VPN Connection" now showed up (but does not work). I then used the SupportUtilities did a FCRemove and also RemoveFCTID. The FortiClient_Diagnostic_Toolx64 does no collect any information - I can click on Start a 100 times - nothing happens. I do not get this client to run as a "fresh" client with "Zero Trust Telemetry". Do you have any hints for me?

Hi there Using Microsoft Entra and InTune, I am able to deploy the Forticlient v1.0.1041 app, from the microsoft store. Question is though - is it even supported? I saw a post from, I think it was 2019, where it said that it was no longer supported. But it linked to a different Forticlient App. So before I start explaining the issues I have with it, then is it even supported? BrThomas

I have a site in Azure connected to my on-prem fortigate via site to site VPN. That is working. I have a second physical site connected to the main on-prem fortigate via site to site VPN. That is working also. I cannot get traffic to pass from Azure VM to the second site. I am trying to do this without setting up another site to site VPN from secondary to Azure but if thats the answer I can try and figure something out there. I just figure passing traffic through the main site would be fine.

Has anyone been able to import a list of devices via CSV file but using Ansible instead of manually adding the CSV file into FortiManager GUI?I am in the process of creating our SoT using Netbox, and ideally I'd like to have a playbook that gets all the IPAM for a new site and creates a CSV file which is imported to FortiManager automatically.I was looking at the Ansible modules but I was not able to find one that does this. Has anyone been able to do it? Or maybe is their another way?

I have implemented fortigate 100F. I was trying to upgrade firmware version 6.4.6 to version 7.2. Currently, the firewall does not boot, neither does it provide any menu to select. Below is the message it shows when I restart it: failed verification on /data/datafs.tar.gzfos_ima: System Integrity check failed...CPU1: stoppingCPU2: stoppingCPU0: stoppingCPU7: stoppingCPU6: stoppingCPU3: stoppingCPU4: stopping Kindly help.

Hello, We have a production FortiGate with multiple vdom configured. And we would like to use the Security Fabric Automation feature. However, its only visible under the global vdom and not in any other vdoms like root and custom vdoms that were configured. Is there a way this automation can be turned for specific vdom? Thanks,

I have for testing Fortigate F80 (7.6.0) where I created ipsec VPN for clients.I can connect correctly to FGWhen I enable/disable split tunel I have always the same ISP ip address. About what I have forgotten.I have created ipsec with wizzard and doc from Fortinet.    

Hi, I am looking to increase security for my BGP set up and found validated ROA payload, which can make a BGP announcement Valid or Invalid. Is this something that can be configured/done in FortiGate? I hope you can share official links about it. Valid ROA links:Using RPKI Data — RPKI documentationValidated ROA Payload - Glossary | CSRC (nist.gov) Thank you!