Solved

Hi @ all, we have a Customer running FortiClients on their Endpoints and using an EMS-Server (v7.2.4 build 0983),in the GUI section, Administration > Log Viewer, i can only see EMS-Server generated Events,LDAP queries, admin logon Events, Settings updated etc., but no "on Endpoint x generated FCT Logs", like Security Events, FCT Web Filter block events as example. Correct me please if i wanna see this events "FCT WebFilter" i have to go GUI: Endpoints > all Endpoints > search for Endpoint which got issues > execute >Action request FortiClient Logs, then search in the fclog.dat for the related log? I was wondering because in the GUI Section Quarantine Managment > Files, in this Tab are Files and Endpoint listed, so the FortiClient forward this information via FortiTelemetry to the EMS-Server, triggered by scheduled AV-Scan or may on-prem Scan.So is there the possibility to see this FCT-WF "Block" Events without the need of this Steps: GUI: Endpoints

 Hi, I'm trying to import FortiManager (Xen Server fork) appliance on my XCPNG with XOA. Appliance imported successfully, but when I start the VM, I have a Kernel Panic. I tried to another host, and another storage, no luck... I also tried a older version of FortiManager VM without success Do you know about this problem ?

Hi Community, I am testing fortiAI, installed and configured it using openAI api key, but receiving this error " I'm sorry, it seems like there was an issue generating a response. Please try your request again, or refer to the advisor troubleshooting documentation for assistance. "in response form AI.Do someone has any idea ? I am using the free Open AI API key. 

Hi, we have some issues with FortiAPs after upgrading to 7.4.3 and from the support we got like just wait until 7.4.4 to solve this problem but nobody has given us an official release date? I mean like if it takes until May, maybe we have to plan to do some downgrades. Thanks!

FortiSOAR Hi Experts,The idea is to create a shift handover using FortiSOAR. Lets say, in current shift 05 alerts triggered, out of those, 3 were closed successfully, 02 were in progress/investigating. Lest say, during the investigation of those 2 alerts, shift time is over. The current shift SOC analyst would initiate the shift handover and would handover the "in progress/investigating" alerts to next shift. Need to create the above scenario in FortiSOAR. Please help! I shall be extremely grateful. Regards,MFaruqi 

Hi. Do anyone knows how to check the FortiCare support period(expiration date) in CLI ? In the GUI, we can show it in the following menu, but there looks no commands for CLI. System->FortiGuard->FortiCare Support-Hardware Version : Return to factory - expires on XXXX/XX/XX-Enhanced Support: 8x5 support - expires on XXXX/XX/XX Thanks,Tomioka

Hello,I'm hoping to find any information on the type of connector used on the end of the AC/DC power supply provided with these firewalls.We have our own fully redundant DC power plant at some sites that we'd like to connect directly to 12VDC without the need for the AC adapter - doesnt make sense for us to go from AC->RedundantDC->Inverter->AC-adapter->FG60F. We'd like to source our own part so that we can go AC->RedundantDC->12V->FG60F

Hi, I currently have a Fortigate with a /29 public IP pool on my WAN interface. I have requested more IP addresses from my ISP. I need some help to determine the best configuration scenario for an ongoing installation. Here are the details provided by our supplier: Direct Routing: The supplier suggests that the IP packs be directly routed to our equipment. For this, I need to provide them with the IP addresses of our equipment for our three sites.Secondary Configuration: Another option is to configure the IP packs as secondary on the LAN of their routers.I would like to know:Which option is better in terms of performance and security for our Fortigate equipment?Are there any specific implications (such as NAT configuration, routing, etc.) that I should consider for each option?Any experiences or recommendations on managing this type of configuration would also be highly appreciated.Thank you in advance for your advice and feedback!

Good morning friends, based on your experience:Why is it important to not have all "ALL" ports enabled in fortigate firewall policies? I greatly appreciate your comments.

Hi guys, Fortimail is POWERFUL. Been getting some calls now from staff, that some of their mails are being blocked, required for work. Fortimail is working great i tell you, spam is being caught well, anything looks off, it is snatched for quarantined or blocked. I used an antispam inbound profile that is not so robust, but it seems like it is STILL kinda robust lol. However, i would like to create some exceptions for certain email domains so these mails can pass via. Some mails are not even being quarantined; they are just blocked totally. How can i set these exceptions and where specifically?  

Hello, We need to migrate an existing FWB-VM from ESXi 6.5 to7.0. Do you know if this hypervisor version is supported? At https://docs.fortinet.com/document/fortiweb-private-cloud/latest/fortiweb-vm-on-vmware-esxi/670068/system-requirements it seems that FWB-VM supports up to 6.7. Thanks

Hello! Need help with reset admin password. Previous administrator disable sim-card and leave to another country.read topic:Resetting a lost admin password - Fortinet Communitybut version of firmware another or maintainer is disable.If my fortinet start, i'ill see in console menu: FortiGate-81F (17:40-07.27.2021)Ver:05000025Serial number: FGT81FT*********CPU: 1200MHzTotal RAM: 4 GBInitializing boot device...Initializing MAC... NP6XLITE#0Please wait for OS to boot, or press any key to display configuration menu.[C]: Configure TFTP parameters.[R]: Review TFTP parameters.[T]: Initiate TFTP firmware transfer.[F]: Format boot device.[I]: System information.[B]: Boot with backup firmware and set as default.[Q]: Quit menu and continue to boot.[H]: Display this list of options. Then if i choose "Q" system starting full and login maintainer and pass "bcpbFGT81FT*********" not working. How i can reset password without hard reset config? 

Hi,Please can you help to integrate checkpoint firewall to my FortiSIEM.I have logs in my siem but it's unknown_EventType .How can I parse thé logs?

Started getting these network connection errors every hour on EMS.  Anyone experience?  Can ping 173.243.143.6.   [04-15 00:28:13][ ERROR]: Network connection error [04-15 01:28:27][ ERROR]: Network connection error [04-15 02:28:20][ ERROR]: Network connection error [04-15 03:28:04][ ERROR]: Network connection error [04-15 04:28:28][ ERROR]: Network connection error [04-15 05:28:21][ ERROR]: Network connection error [04-15 06:28:25][ ERROR]: Network connection error [04-15 07:28:18][ ERROR]: Network connection error [04-15 08:28:22][ ERROR]: Network connection error [04-15 09:28:16][ ERROR]: Network connection error [04-15 10:28:10][ ERROR]: Network connection error [04-15 11:16:28][ DEBUG]: attempt 1 of 3 [04-15 11:16:28][ DEBUG]: Try to connect to server 173.243.143.6:443 [04-15 11:16:40][ DEBUG]: Connection result to server 173.243.143.6:443 = -1 [04-15 11:16:40][ DEBUG]: Try to connect to server using failover 173.243.143.6:8000 [04-15 11:17:01][ DEBUG]: Co

We are doing analytics on ADFS logon failures - Windows event ID 364. We are interested the Relying Party specifically. We want to get counts of the logon failures by the Relying Party. We can see the relying party in the raw event message but it cannot be queried on in the analytics or selected as a display column. Does anybody know how to handle this situation?

 I need to setup ADVPN (using iBGP) between a Hub and 10 Spokes. Hub to Spokes and Spoke to Spoke (shortcut tunnel) communication is needed.Hub and Spoke's Wan Interfaces are connected via Layer 2 VPLS network.Would you please advise if ADVPN setup is feasible in such topology where Hub and Spokes FTG's WAN interface is connected by Layer2 VPLS?  Thank you

Hello, everyone!I hope you are all doing great. I have the task of creating a new SSID for our campus accommodation. This SSID must have limited access, meaning the users should only access the Internet, not local resources, such as servers, PCs, network devices, such as printers, etc. We already have three other SSIDs with two lines coming from the ISP, meaning we also have SD-WAN.The main line is 100Mbps while the backup is 30Mbps. The backup is used for employees with limited access and guests.After business hours, most of the time, there could only be a few people working, so I was thinking of using the main line so it could handle the tens to hundreds of users. I am also planning to give the access points at the building only this new SSID with a schedule to work after business hours until the next day's morning. My questions are:1- Should I create a WPA2 Personal or WPA2 Enterprise to have the best monitoring and logs? The WPA3 implementation will be more head

Good afternoon friends, a question.I have a fortimail version 7.0.2, could you recommend which version I should update the device?Thanks for your comments.

Hello Expert, I have a 2 400E box that are configured as an active/passive cluster.Recently we are seeing in the HA log a lot of lost heartbeat errors. As per redundancy  we quick at another heartbeat interface to the Ha configurationWe are still receiving error message. (see screen shots . i humbly request some urgent feedback on the way forward, Thank you.

Hello, I tried to authentication a test user with local FNAC database using dot1x EAP-PEAP and always i get this error  The allowed authentication protocols :  The client supplicant is setup correctly for EAP-PEAP(MS-CHAPv2) as inner method. Thank you!Regards!@ebilcari              

Hello, I have  a use case where i have Cisco switch port configured with dot1x and mab and i need to seq 1 if the user is AD then vlan 25seq 2 if Printer then vlan 26seq 3  Guest access portal registration logged successfully then vlan 27 The issue i have is if i connect a laptop without dot1x supplicant i always get mac authentication success with the same default vlan on the port, i can access the guest portal and self register/login without any issue but the vlan change never occurs, only after shut no shut the port then on the new authentication procces FNAC detect and change the port vlan to 27 since the host already registered on the last portal authentication. Do you have any thought ?Thank you!Regards! @ebilcari 

A staging website (to display the business website first and do changes before applying it to the actual website) created by administration for has been blocked as "phishing" and despite several attempts we are unable to whitelist the url, with nothing changing. It reads: "Access to the site you have requested has been blocked by your policy." I cannot find where the conflicting error is within the policy, firewall or web filter. I'm not too familiar with group setting changes, so maybe that could be it.I've contacted Fortigate and they've even managed to change the flag for the specific site we've created to Information Technology instead of Phishing but the website is still blocked for Phishing (both externally and on our intranet).Does anyone have any idea how to fix this or what we could try to fix it with?

On my Fortigate, under Security Fabric, Security Rating, Security Posture, Failed, the Fortiguard IoT Vulnerability Category is reporting Aindows devices with Android vulnerabilities. Is anyone else seeing this? The Fortigate knows it is a Windows device, so why is it reporting Android IoT?   

I got a wonderful suggestion (kudos to the Fortinet community, excellent place) from previous post which I have not tried as yet, where i can turn off "check sender domain" to resolve the session domain(classifier) error where a particular mail is being rejected. Before doing this change though, after doing some reading, I tried using the block/safe list domain wide under security->block/safe list, but mails from that specific sender still being blocked. I need these mails as they are financial in nature. Is there any other way to exclude selected mail domains/senders from being blocked rather than turning off "Check sender domain"? Community member is experiencing the same issue, but received no response 

Our customer is using 100F  firewall with os version of  v7.0.14,build0601,240206 (GA.M).  Recently, we noticed that memory consumption is spiked up to  71.5% of the total memory. Upon checking  the processes, we noticed that fnbamd process is consuming 12.2 % of the total memory. What should I  do to solve this issue.  Your assistance would be greatly appreciated.