Solved

Hi,After upgrading to FortiOS 7.2.8 we are having some issues with the WAF filter on some of our services. It seems that the filter in this version is setup harder or that the exceptions we built in the past based on event ID's are being ignored.I noticed that when an event has been blocked no Event ID is showing up. On previous versions I could use the event ID to create an exception but now I can't. Any ideas?Thank you in advance.

Hi, we Have a F600E, which is the single main router, firewall and DHCP server to a single LAN. What we want is when a group of VPN clients connect with FortiClient VPN to this device and network, they should only be able to communicate with one machine in that LAN, which is a file server. We don't want VPN connected clients to have access to any other local machines in that network. How can we achieve this ? Thanks

I have a FortiGate configured with two tunnels on two Ethernet ports with the intention to do load balancing or traffic steering on them. They go through a router to converge onto one port/IP at another FortiGate (a.k.a. server). The server is configured with one dynamic tunnel, and I left the dst-subnet in phase2 empty.I can connect to the server fine, and the server "spawns" logical tunnel interfaces _0 and _1 for each dial-up. However when I ping from client to server or initiate any TCP connections, the responses all come back on _1 even if the origin is from tunnel _0. When I look at the FortiView Sessions list in GUI it just shows the session from the parent tunnel name. The Debug Flow shows the origin point of the session was from the right tunnel but it chooses to output on the other tunnel. It is as if it is using the routing table to pick the interface, not the origin tunnel, and I don't know what makes it pick _1 all the time either.Is this a misconfiguration on my part or F

I was sent this article. It is amazing to me the amount of time that was invested in hiding the script and the related activity. Are there any tips or tricks to stopping melicious code like this? https://threatresearch.ext.hp.com/raspberry-robin-now-spreading-through-windows-script-files/ 

Hi,I've configured ipv6 for the first time on my Fortigate 50E with 6.2.16 firmware.My ISP doesn't give me the option to delegate /56 or /60 subnet but only eight /64 subnets for internal use. So I've connected the wan1 port to the ISP bridge and using link local IPV6 address of the Fortigate WAN1 port I've I've delegated one of the /64 prefix to the Fortigate.Then I've configured the WAN1 port via CLI in dhcp as follows: config system interface edit "wan1" config ipv6 set ip6-mode dhcp set ip6-allowaccess ping set dhcp6-prefix-delegation enable end next end Next I've configured my lan interface: config system interface edit "lan" config ipv6 set ip6-mode static set ip6-address xxxx:xxx:xxxx:f2f1::1/64 //the subnet is the same of the one delegated by the ISP set ip6-allowaccess ping https ssh set ip6-send-adv enable set ip6-other-flag enable config ip6-delegated-prefix-list edit 1 set upstrea

I have a company that has about 200 VPN users and we are wanting to push the IPSec configuration to them. I can deploy the Forticlient using Windows Group Policy but I also was to push the IPSEC configuration. Can that be done using Group Policy or is there another way to push it so I do not have to touch 200 machines. FortiClient 

Hi, we have a customer who has >20 FG30E and FG50E units to connect ther small branch offices. They are in the middle of a ERP change, so the trade up for new FG models was planed for the end 2024. Yesterday they told us that in 2 offices (1 x FG30 and 1 x FG50) their internet is really slow. We connected from outside and for us everything seemed normal. We sent a technician and he found out that connecting directly to a LAN port he got like 25-50% ping loss to the FG unit.  We had once a similiar case and we needed an RMA. It seems clear that this is a hardware failure but for us doing an RMA is also bad timing and bad process for the customer. Anybody else got the same issue and found a work around or is the RMA the only solution? Thanks!

I am trying to get an api call to FMG to get statistics for FortiAP from the FMG or FAZ. The document online states the use of IP addresses but we cant use that for our case. Is there anymore info on api calls for FortiAPs from FMG or FAZ

Am I the only one who is really unhappy with the 35 character limit at firewall rule names? We have different vendors and always on the FortiGates I have to think how I can shorten the rule name.... I doubt Fortinet is changing this soon?

Hi FG adminsOn my FortiGate 7.2.3, freshly transferred to another FortiCloud account successfully, when I click force update license & signatures it doesn't work and it shows the below output.Any idea on what can be the issue before I open a ticket?upd_daemon[1808]-Received update request from pid=1621upd_daemon[1628]-Found cached action=00000002do_update[665]-Starting now UPDATE (final try)__update_upd_comp_by_settings[480]-Disabling FLEN components.__update_upd_comp_by_settings[484]-Disabling NIDSDB/ISDB/MUDB components.__update_upd_comp_by_settings[488]-Disabling APPDB/IOTDB/OTDB components.__update_upd_comp_by_settings[492]-Disabling AVEN components.__update_upd_comp_by_settings[496]-Disabling AVDB/FLDB/MMDB components.upd_fds_get_next_server[609]-no route, skip addr=[[2620:101:9000:140:173:243:140:6]], weight=1073736430upd_fds_get_next_server[609]-no route, skip addr=[[2620:101:9000:140:173:243:140:6]], weight=1073736430upd_fds_get_next_server[609]-no route, skip addr=[[2620:1

Dear all, I have a problem with a FortiMail  VM. I use my Fortimail as a gateway. Unfortunately, I have a loop when sending emails, which I cannot solve. The following error scenario:When I send an email from my M365 mailbox to another M365 mailbox this email goes into a loop and rejected with this error: "Remote server returned '554 5.4.6 < #5.4.6 SMTP; 554 5.4.6 Too many hops>'". When sending from my M365 to email addresses outside the Microsoft Cloud, the sending is successful.Can you help me to solve this problem? I suspect the problem is because the 365 accounts are all accessible via the same IPv4 address? Thank you very much for your help.David

I have Custom Tunnels from B1 (1.0) to B2(2.0) that is 1ms latency.I have a custom tunnel from B1 to B3 (3.0) that is 13ms latency.I have a custom tunnel from B3 to B2 that is a 54ms latency. I want to send the connection from B3 to B2 through B1 to reduce the latency between these two buildings. I need the latency to be under 20ms.I created a route forB2 2.0 traffic going to 3.0 to use the tunnel through 1.0I created a route on B3 for 3.0 traffic going to 2.0 to use the tunnel through 1.0In the firewall policy on B1 Lan traffic from 2.0 going to 3.0 to go through the 3.0 tunnel and reversed cloned.I also created a policy on B1 Lan traffic from 3.0 going to 2.0 to go through the 2.0 tunnel and reversed cloned as well. On B2 and B3 I created the Policies for any Lan going to B2 or B3 to pass through the B1 tunnel and also reversed cloned these two policies.It didn’t work. What am I missing here?

Hello,I have a strange behavior with our FortiClient's tunnels.Created a Remote Access profile on our FortiEMS, it's a VPN Tunnel with 4 remote gateways.Created DNS records for our public IP addresses from FortiGates via Let'sEncrypt.  Now when I try to connected to that one tunnel it will prompt me the "Security Alert" on 40% before it makes the connection.But if I create 4 separate tunnels and not 1 tunnel with multiple gateways then I don't get the prompt with "Security Alert", the connection is established normally.Does anybody have a clue what this can be, probably some limitations with multiple gateways..

I have found this article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-policy-routes-for-route-based-interface/ta-p/193376 But it is not 100% clear to me. Static routing is no problem. But policy based is not working for me. As I understood, in policy route, I have to select "Outgoing interface" (ipsec interface) and "Gateway address". Now, when I did not fill in the GW, the policy route was skipped and only static routes was evaluated. Than I found the article stating: "The solution is to configure an 'IP' and 'Remote IP' on the virtual tunnel interface". So I did it, only on my side of tunnel, and policy route was being hit after that and also data was flowing the correct way (so it seems at least, but it is not returning back).From the article it is not clear to me, if the IP and remote IP on interface and using gw of remote IP in policy routing is just a requirement, so the policy route is evaluated or does the remote IP have to exist in reality on

Hi, Does anyone tried to run globalprotect while connected to FortiSASE? Is it possible to run 2 VPN connections on windows simultaneously?  

Dear All. I have doubt why we configure - config firewall addressedit "test-reservedset country zzend  thank you.

How Fortinet Blocks ICMP Error Reporting Packets thanks.

Hello there, it should be possible to create this same VLAN ID and IP on both interfaces Hardware Switch and FortLink?Because I made it and not sure this is correct way and traffic between this interfaces but same VLAN will work.FortiLink:Hardware Switch:Basically I need to make connection between new network on FortiSwitches connected with Fortilink to FortiGates  and old network on different vendor switches there.VoIP phones from new network need to connect with server on with VoIP central that is located with old network. How is best to achieve this:Create new VLAN on FortiLinkAssigne to Port on FortiSwitchMake policy with NAT one to one?Normally that should be the way but I need it to work with LLDP profile with CDP (Cisco Discover Protocol) so that Phones after connecting to port will automatically connect with VoIP central and download config.

Hello All, Do we have an option to limit the TCP/UDP connections limit on FortiGate? likewise of Cisco ASA Firewalls. 

Hello I currently have a Fortigate managed through Fortimanager with 1 Uplink ISP router (let's call it OLD router), I use it for outgoing traffic to have my servers reach internet, and I also use Virtual IPs to NAT incoming trafic to some web servers on a public-ip basis.default route 0.0.0.0 -> interface going from forti to the OLD ISP routerFor bandwidth reasons, I Need to add another Router (NEW router) with the same specs and needs, to my fortigate.So I can have 3 specific LAN servers use the NEW router and not the OLD one.  I wonder what is the best course of action to do so (I'm ok about the ports/vlans/creating the interface) : - Should I just add another default route 0.0.0.0 -> interface going from forti to the NEW ISP routerand create policies using this interface ? - Or would I also need to create some policy routing (which I never did ever) ? What would these policy have to look like to make sure using my new isp router does'nt break the

Hello, is there any way to suspend the transport mail delivery and keep mail in queue on my fortimail ? Indeed, i need to stop mail delivery to my mail server to be able to make some maintenance operation. My mail server is in the cloud and can't be stop or suspend. Thanks by advance for your answers !

There is no problem with the web filter, but it still cannot be connected, and the query finds that there is a problem with the DNSDomain Name 「donate2.ncku.com.tw」 dns response blockBut this site is a university in Taiwan, how do I apply for a re-evaluationv7.4.3

I'm seeing the eap-proxy daemon utilizes high CPU usage. Suspecting that this may cause of the flapping on the IPSec tunnel phase 1. # diagnose sys top-all 1 100 1Run Time: 235 days, 16 hours and 28 minutes4U, 0N, 10S, 83I, 0WA, 0HI, 3SI, 0ST; 7979T, 3432Feap_proxy 1218 R 99.9 0.1 7 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 the killed daemon is /bin/eap_proxy: status=0x0 My question is we only have issue with one tunnel that also flaps once or twice in an hour. Rest of the tunnels are fine. What impact this command "fnsysctl killall eap_proxy" will have on the firewall ? WIll it kill all the VPN tunnels ? TIA. :)     

Hi, I noticed i unable to access the FortiSandbox at my office. Previously it working fine and the hardware is up and running. The network port is blinking, but the LED status no light & HDD status blinking red. I already restart the hardware but still same. Any idea ?  TQ

How can I access the database and examine various tables? I require this information for configuring osquery. I have installed FortiSIEM 7.1.3 with ClickHouse.  Detail steps along with creds (if any default) would be helpful.