Solved

why the formula that allows to get column's names from log: select * from $log .... doesn't work   

I would like to know if there is a site on which I could have the possibility of paying for labs with the possibility of repeating them several times. The courses concerned are the following: FortiGate Security 7.2 and FortiGate Infrastructure 7.2. I don't want the Fortinet Institute labs because you can't start again once you start.

Hello everyone :) As the name suggests, I'm trying to recover the ip addresses of my fortigate's interfaces.I found this command but it only returns the interface name: /api/v2/cmdb/system/interface/Overlay-A/ "results": [{"name": "Overlay-A","q_origin_key": "Overlay-A","q_limited_permission": true}],I've seen in the GUI via the API Preview button that there are formats with ip, remote-ip, etc. fields, but the following command doesn't return anything satisfactory: /api/v2/cmdb/system/interface/Overlay-A?format=ip"results":[{"q_limited_permission":true}], Can you please help me with this? Hyjaal

Has anyone been able to move FortiSwitch interfaces to a different VDOM than where FSW is?  I added FortiSwitch to root VDOM and moved some interfaces to another VDOM following this guide: https://docs.fortinet.com/document/fortiswitch/7.4.2/fortilink-guide/801172/multitenancy-and-vdoms I created a VLAN on the new VDOM and assigned to the switch ports. However, when connecting a device to one of these ports, I'm unable to get the device to have an IP assigned from the VLAN.  When checking "FortiSwitch Clients" list, I find the connected device under "root" instead of the new VDOM, and It's assigned the default VLAN 1 from root, rather than the VDOM assigned to the port. I'm running FortiOS 7.4.3 on FGT and FortiSwitch 7.4.2.

after login and getting session id i will upload an 1,5 MB file with the following code: def sendSmallFile(file_content_as_base64, file_name): print("try to send small file to sandbox") print(f"start of base64 content: {file_content_as_base64[:100]}") print(f"got filename: {file_name}") submitURL = "https://fortisand-api.our-domain.de/jsonrpc/" submit_json_data = { "method": "set", "params": [ { "file": file_content_as_base64, "filename": file_name, "skip_steps": "2", "url": "/submit-file", "type": "file", "vrecord": "0", "enable_ai": "", "forcedvm": 1, "browser": 0 } ], "session": session_id, "id": 11, "ver": "4.4.0" } response = requests.post(submitURL, json=submit_json_data) sid = getValueFromResponse(response.json(), "sid") print(f"sid: {sid}") the b

Hi team, Is there a way to exempt traffic for certain apps like Teams from going via SASE? there are issues reported by end users that teams calls are getting disconnected and there is loss in audio sometimes.  

I am currently working on FortiGate Captive Portal with Guest Users, and wondering if I can edit the email received by the guests. This is my reference link - https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Captive-Portal-with-Guest-Users/ta-p/278606On step # 2, a sample output is provided when the credentials are sent to the guest. I am looking at removing the sponsor and company field. Is that possible? Thank you!    

Reports started rolling in on Monday, 22 April 2024, at approximately 07:00 AWST (Sunday, 21 April 2024, 23:00 UTC) that people could not access HTTPS websites but could access HTTP websites.We found that the common denominator was that only customers with a PPPoE dialler for the WAN/Internet service were impacted.We've seen this in the past and resolved it by adding "set tcp-mss 1452" to the LAN/INSIDE interface/s configuration of our Fortigates.We provide Internet to many of the customers, but not all - it does not seem to be isolated to a specific network or ISP.I wasn't involved in the initial information gathering, so I'm unsure if it was limited to specific sites, but I was aware that sites such as office.com (all of Microsoft), www.bom.gov.au, and www.news.com.au were impacted.The question is, why is it only impacting Fortigates (we have customers with different firewall vendors who didn't have the same issue), & why were they working fine before when the repo

Hello everyone, I was trying to make a Windows Deployment Services server working in my infrastructure with my Fortigates.We have two different interfaces: One for the servers and another one for the Clients Computers.I did a lot of tests and it's working without any problem when the computer is into the server interface. On the Client interface, I tried commands "next-server" and "filename". the computer is seeing well the WDS and the image as attached, but stuck at downloading and fail...  I saw from internet that when it's 2 differents network the ip helper is helping, but in this case should I have to do that? I tried with dhcp relay etc but didn´t work, maybe I did it wrong... Many thanks

Hi everyone,I'm looking to enhance the security of my FortiGate device. I want to set up a rule or policy that automatically blocks the source IPs trying to log in as admin and failing multiple times. For instance, if someone tries to log in with the wrong password 3 times(or more), the source IP should be automatically banned for a certain period of time.Could someone guide me on how to configure this on my FortiGate? Is it possible to do this directly from the admin interface, or do I need to configure any additional security profiles? Detailed instructions or any advice would be greatly appreciated.Thanks in advance.

Hi wireless adminsAnyone knows what can be the following FAP log?Log Description: Wireless bridge intrusion detected Action: wids-detect-firstThreat Type: wl_bridge Manufacturer: LoopcommMessage: WIDS wl_bridge: data/DS chan 11  

My goal is to skip emails only when either SPF or DKIM is correct (or both of whem). And the answer to this is DMARC. But what if some sender does not have it? For example: sender №1 with SPF, DKIM and DMARC, sender №2 with SPF, DKIM and without DMARC. Mail from sender №1:... (some antispam techniques) ...1) FortiMail checks DMARC for domain and find it.2) After this FortiMail look into SPF with DKIM and allow email only if either SPF or DKIM is correct (or both of whem).... (some antispam techniques) ... Mail from sender №2:... (some antispam techniques) ...1) FortiMail checks DMARC for domain and can't find anything because it's not published.2) FortiMail anyway checks SPF and DKIM, and allow email only if either SPF or DKIM is correct (or both of whem).... (some antispam techniques) ... How can I configure policies to achieve this result?

Hello Team,I am new to FortiSIEM and i could be making some obvious mistake but kindly help. We onboarded a custom application onto FSM and wanted to build custom parser so that we can get notified of failed logins. I tried building one and i Keep running into the same issue "Failed to execute node: collectFieldsByRegex. Please check the usage of API and attribute name." Not sure why.. My xml is as below:<eventFormatRecognizer><![CDATA[SOE: BAD\s+]]></eventFormatRecognizer> <parsingInstructions> <collectFieldsByRegex src="$_rawmsg"> <regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<reptDevName:gPatHostName>\s+SOE:\s+<_body:gPatMesgBody>]]></regex> </collectFieldsByRegex> <collectFieldsByRegex src="$_body"> <regex><![CDATA[?:SIGN-ON <srcIpAddr:gPatIpAddr>\s+\(<:gPatStr>\)\s+<:gPatStr>\s+-\s+d+\s+<:gPatStr>\.<:gPatStr>:

Hi FortiSwitch adminsI have a new FSW 124F with OS 7.2, standalone.When I go to menu Switch > Physical Ports, when I select one port and click edit I have this error.(URL https://1.2.3.4/switch/physical/edit?name=port1).Any of you has seen such error?500 Internal Server ErrorThe server has either erred or is incapable of performing the requested operation.

Hello Fortinet Community   So under the main network hood we have a FGT100F with a specific subnet policy towards the sd-wan interfaces with APP Control,WEB Filter and AV modules enabled.   More specifically on the APP Control module we have enabled between others HTTP/HTTPS.Browser as allowed SSL also allowed and Web Browsers category as allowed. Certificate Inspection Enabled   The problem now is that SPECIFICALY the Vivaldi browser wont reach any wabpage from ANY PC on the targeted subnet.Furthermore in inserted both in the PC and the certificate store of the browser the FGT SSL Cert. Disabled all of the track privacy settings of the Vivaldi browser,no webpage reached still. I also tried to disable all of the above mentioned modules in the policy,restarted the browser on a test PC with no avail.   Any ideas?     Thanks in advance!

Observed that using my domain address like xxx@xxx.com having the bad IP, multiple emails has been send to bulgaria, japan etc. How to resolve that issue. 

 Hi, I want to filter GTP traffic on the Fortigate 201F device used in the Telco system. When I examine the forward traffic logs, I only see GTP as the protocol. Ssh, ping, data, etc., are coming over GTP. However, I want to allow data access and block ping access. How can I do this? Thanks

Hello FortiCommunity, I am desperately searching for the currently recommended release for the FortiMail 200F.Is there a document or something where I could regularly look this up? Thank you very much for your help. FortiMail 

Hi, I need to understand the risks of enabling tcp-session-without-syn for asymmetric environment. Can someone help to explain to me all the risks if I enable this? Thank you 

Hi all,We have upgraded our windows server in 2022 version and since this update, no MacOs can't access to the file share.  No firewall activated on windows server.No specific Gpo are set on windows server.I tried to connect the share with the short name, fqdn name and IP address, no success. (smb://shortname...) No problem with windows computer. We have a file share on windows server 2012R2 (not upgraded) and MacOs can access to the file share. thank you for your help.  

Fortigate Version : 7.2.8 Strange thing we are seeing is that everytime there is a blocked connection to a destination - could be via any of the security profile, Fortigate initiates a local traffic to the same destination. The traffic does get denied eventually but what could be the reason for this behaviour. I have put a screenshot of the example. Line 2 and 3 are the user initiated forward traffic and Line 1 and 4 are local traffic initiated from the fortigate itself. Its a vdom based setup - that is the reason for multiple line of logs.   

Hi Team,I blocked many IPs on FGT daily is it applicable to send daily report of the blocked IPs in that Day with the Reputation associated with each IP Thanks in advance,FortiSOAR#Schedule

NGFW performance is measured with Firewall, IPS and Application Control enabled.Threat Protection performance is measured with Firewall, IPS, Application Control and Malware Protection enabled.

Hi!Unlike Fortigate VM, neither FortiManager nor FortiAnalyzer VM respond to KVM "qm shutdown" command that "send an ACPI event for the guest OS". Is this by design - if so, why?This is required when the Host is required to perform emergency shutdown of all Guests.FerenX 

Hi i've a Forti 60F,i've to create manage 2 WAN for the customer.The first WAN have an internal LAN where NAT is enable, and I have no problems with this network.The second WAN have an unique cable but Is a trunk of 2 LAN, with 2 different gateway. In the lan side of the 60F i've to configure both lan and direct, with 2 different gateways, always to the same outgoing wan port 2. How is it resolved? By making internal VLANs?   Thanks