Solved

Hi community! I've been using the FAZ handlers and they've been a great help. I am trying to exclude the notifications for a specific network, so according to documentation it has to be inserted with Regex in Generic https://docs.fortinet.com/document/fortianalyzer/7.4.2/administration-guide/157132/using-the-generic-text-filter For example this one works fine without adding the following sintax: and !(srcip~"10.39.14\.[1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]")   I was trying to exlude network any notification from a host within this network: 10.39.14.0/24 Bolded text is what comes in the handler, the rest is added by me (catdesc=='Malicious Websites' or catdesc=='Phishing' or catdesc=='Spam URLs' or catdesc=='Newly Observed Domain' or catdesc=='Newly Registered Domain' or catdesc~'Dynamic DNS' or catdesc=='Proxy Avoidance') and !(srcip~"10.39.14\.[1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]") However after the change I stopp

Hello All. I need to deploy Fortinet solution in small factory ( FG, FS ) and I have a question , How to connect exist ring to MCLAG cluster ( this red Ring ) - Can I mix Ring redundancy with MCLAG redundancy ?  or option 2  ofc in this ring will be more installed FSwitches. I know that in some point STP discard link , but how to avoid often recalculations of STP.part of infrastructure exist and I don't want to install new cables everywhere  What happened if I connect another ring next to red one ?

Please provide the specific KB for configuring  " sflow " in Fortigate analyzer .# FortiAnalyzer 

Hello!I have a simple WiFi for legacy devices working well with Cisco WLC, Cisco AP's and SSD with static WPA password.Today I started to integrade this WiFi with FortiAuthenticator for MAC Authentication - MAB. But i am having problems.The problem is that the authentication is working well, but the DHCP server is not delivering IP when on this mode.When I just break this integration from Cisco Wireless and FortiAuthenticator, this returns to deliver IP from dhcp.Has anyone here already implemented one of these?

Hello, I have an SSID set up on my AP that is only password protected. I've set the new DHCP server to Fortigate. School laptops and tablets connect to this SSID. However, my wifi password has been leaked to the world and I would like to ask...Can I use the DHCP options to set the IP address assignment? If I know that my laptops were made in a series and therefore have the same start of mac address, can I use Option 60 to give the devices with the specified start of mac address an IP Address? Alternatively, if the laptops and tablets are named similarly could I do the same using Option 12?Did I understand this correctly?Thank you for the answer.

Hello team, The Fortigate firewall's application control recognizes the MMS application on port 3389, I would expect it to recognize RDP. How does MMS get recognized as an application?Thank youBR

Hi   We recently upgraded from 6.0.5 to 6.0.9 and then changed the Fortiguard protocol from UDP to HTTPS.  Since then we are occasionally getting block messages 'An error occurred while trying to rate the website using the webfiltering service.   I've looked at the kb article https://kb.fortinet.com/k....do?externalID=FD33528 but am slightly confused about the sentence "This will allow users to access the web sites when a rating error occurs, and will allow the FortiGate unit to use the FortiGuard Web Filtering database that it has stored on the unit to rate the web site."   Can I just confirm that it means when it can't reach fortiguard it will rate the website using the local db and will allow/block access accordingly.  Just looking at the option on the FG "Allow websites when a rating error occurs" suggests that it is going to allow it whatever the rating is.   Thanks for your time

I have a 6 fortiswitches managed by fortilink that all show the same device info for each port multiple times. I have no idea what is causing this. This site is having multiple issues and my logs show nothing unusual. Any help or suggestions would be greatly appreciated.     

I am experiencing challenges in setting up a functional IKEv2 for dialup iOS devices. I have an IKEv1 tunnel which is working normal but I'd like to switch to IKEv2. The device is 80E running 7.2.7.Maybe one of you here have faced with similar issues before or have enough experience to point me to a right solution to fix this issue would be great.  Below are details you might need to assist me with. FWTPRFP001 # ike 0: comes 174.X.X.X:12615->19.X.X.X:500,ifindex=5,vrf=0....ike 0: IKEv2 exchange=SA_INIT id=b48f14cf6bade837/0000000000000000 len=370ike 0: in B48F14CF6BADE8370000000000000000212022080000000000000172220000A402000024010100030300000C01000014800E01000300000802000005000000080400001302000024020100030300000C01000014800E01000300000802000005000000080400000E0200002C030100040300000C0100000C800E01000300000802000005030000080300000C00000008040000130000002C040100040300000C0100000C800E01000300000802000005030000080300000C000000080400000E28000048001300003ABC9D4D7D45EB721372

Hi All, I'm in the process of migrating from a Sonicwall to a FortiGate and I have come up against a NAT setting on the Sonicwall that I'm not too sure how to recreate on the FortiGate. On the Sonicwall I have several NAT policies that will do for example.Translate ports that are not in a range or sequential, but are members of Service group.  E.g. Public IPOutside Port/Service GroupPrivate IPInside Port/Service1.2.3.4PhoneSystemPorts192.168.1.10PhoneSystemPorts Service Group: PhoneSystemPortsMembers:PhoneSystemPort1 : TCP 80PhoneSystemPort2 : TCP 8000 Is this possible to recreate with Virtual IPs, Optional Filters and Services?Do I just leave the Port Forward option switched off? Or do I need to create multiple ViPs to recreate this? Any advise welcome.

Hi, What could be the reason that the switch appears not registered after updating a version to FW? to 7.4.3

We have 2 FortiADC 220 in our network .  We noticed that no clients could connect to our Application server.  When we failed over from master to slave everything started to work.  We noticed master was not allowing any new sessions.  Any help in this matter would be great.   Any suggestions please?

Hi Everyone, Currently we Utilized NPS Extension (Microsoft Entra ID) to provide the MFA when Access SSL VPN, It works perfect. Now, I am planing to migration SSL VPN to ZTNA (TCP Forwarding) and intend to reuse the NPS extension to provide the MFA when off network access. can someone please provide the guidance for me? is it possible with AZURE SAML can be authenticator to provide the MFA? Thanks  

Hey folks,   Ever since upgrading my 200D to 6.0.5 (now 6.0.9) when using the FC to connect to the SSL VPN, I have constant disconnects with Outlook and RDP sessions. Pings never fail or timeout, but I get disconnected from my RDP sessions every minute or so, making it completely unusable. I have a ticket open with support, but honestly, they seem to be dragging their feet. Anyone else seen this behavior and figured out a solution? I have 150 users about to be forced to WFH and this is completely unacceptable. The only work-around I've found is using an IPSEC connection, but that's not realistic. 

Really simple set up. I have a VIP which is just the interface (PORT 3) and I have a policy, that uses the VIP and a server pool of 1 backend web server, which is on the same VLAN, (one arm deployment I believe its called) this server is up and listening on port 80, the FWEB does nothing with it, so I must of missed something simple?I do a capture, and can see the client come in, targeting port 8080. I see the 3-way handshake, but nothing get sent to the backend webserver?I can ping the web server and do a telnettest on port 80 and it comes back "connected" really struggling to see whats wrong, back end server pool is all correct and listening on port 80any silly mistakes I may have made?

Hi, I just want to know how to fix the greyed out SWG Configuration Tab on FortiSASE. 

Got a site which has a FortiGate 60F with a configuration which we would like to enhance by adding a secondary FortiGate 60F in an active-passive cluster. Main goal here is to leave the site up-and-running while performing a firmware update or something of the sort. The FortiOS active (at present) is 7.0.13. So I found this: https://docs.fortinet.com/document/fortigate/7.0.13/administration-guide/900885   Seems pretty straight forward, but rather than dive in head first on site, I figured... I have two spare FortiGates and a Fortiswitch, so I can just build a testcase and see what happens. Not that we're playing with an HA cluster anyday, so we'd rather make sure I have a reproducable result before trying it in the liver environment. So did just that, and while I needed to accomodate for the test environment (by authorizing the switch and adding a couple of VLANs to facilitate the topology), I managed to get the existing (non HA FortiGate) situation up and running with a copy of t

Hello everyone, I need your help in order to see if my approach, as title explains, is correct.We have a client that have in his possession 2 FGT 3400E that are working in virtual cluster with VDOM A on Primary & VDOM B on Secondary.For the conversion my initial thought is to shutdown the Secondary FGT, so VDOM B will go to Primary, and then change Primary to Active-Passive HA with the hope that when Secondary comes back online will take the configuration.Is this approach viable?? or destined to fail??? Thanks in advance for your time & answers

Hello,   I have an issue with my set-up. I have a FortiGate 40F connected to 1 FortiSwitch 124F and a FortiSwitch 108E-PoE.My FortiGate (7.4) is physically connected to the FortiSwitch 124 on port 2 and the FortiSwitch 108 (both running 7.4) is connected to port 1. The Fortigate can see both switches, both switches are connected and authorised through the fortilink.   I can manage VLANs and ports on both switches.   I have also 3 Unifi UAP6 Pro accesspoints managed by a Unifi controller on a local server. Those accesspoints used to serve 4 VLANs. I'm saying "used to" because lately I replaced my old Zyxel switch with the FortiSwitch 108. On the first 3 ports I've connected the 3 AP's because of the PoE. I've added a trunk with those 3 ports, allowing all VLANs (1-4094), however no traffic is flowing over the AP's. The first traffic I would like, is to receive DHCP addressing, provided by the Fortilink interfaces.Can someone provide some guidance?#FortiGate #FortiSwitch

Recently I have upgraded FG-81F from v.7.4.0 to v.7.4.1. After upgrading the Automation logs that I have configured to send email alerts displays the UUID instead of the Threet Feed names. Is that a known bug or workaround available to resolve. Pasted below as quick reference for better understanding.The differences can be noticed in "msg" that on v.7.4.0, it displays the names as FINANCE_URL but UUID in v.7.4.1. On v.7.4.1date=2023-09-20 time=12:36:20 devid="FGT81FTxxxxxxxxx" devname="FGT-PRIMARY" eventtime=1695193580831034046 tz="+0530" logid="0100022220" type="event" subtype="system" level="information" vd="root" logdesc="Threat feed updated" status="success" msg="Threat feed 'ext-273ce776-2493-51ee-de2f-eff2ada4c0b4' updated successfully" desc="threat-feed" On v.7.4.0The log displays as followsdate=2023-09-20 time=11:30:22 devid="FG101FTxxxxxxxxx" devname="FGT-PRIMARY" eventtime=1695276021981973499 tz="+0530" logid="0100022220" type="event" subtype="system" level="informa

Hello Community Normally I'm using a prefix-list in combination with route-map to filter prefix advertisements when configuring BGP.For fun and to expand my knowledge, I was looking into the docs article about 'Route filtering with a distribution list'.Link: http://docs.fortinet.com/document/fortigate/7.2.7/administration-guide/170065/route-filtering-with-a-distribution-list In my lab I have 3 FortiGates, running v7.2.7.FGT1, FGT2 and FGT3.FGT2 and FGT3 have eBGP peering established with FGT1.FGT1 receives prefixes from both FGT2 and FGT3 and advertises everything. FGT1 also advertises a local originating prefix. For testing, I would like to try and use the distribution list on FGT1 towards FGT3. I would like to filter out only the prefix received from FGT2. The local prefix that FGT1 advertises, still needs to go to FGT3. However I can't seem to get it to work.My ACL matches the prefix from FGT2 with exact-match enabled and action set to deny.If I set the ACL on th

All:   I understand the admin access restrictions - but I don't want anyone to even see that the device is a Fortigate on the WAN.  How to do this simply?  And - if it's involving CLI mangling of the local policy - is this something on target to be usable in the GUI in the future?   Thanks!

Hello team, I have the users of a branch office that to go out on the Internet they do this circuitVLAN_Client --> FGT-200F --> MPLS Circuit --> FGT-400FOn the 400F firewall various browsing profiles are configured which according to the AD group they belong to are assigned a Lite,Full or Basic browsing profile.Now looking at the logs on the 200F side (defult gateway VLAN_Client) I see correctly the IP address with the domain usernameWhile looking at the logs from the 400F side I see the local ip, the natted ip but not the domain user and as a result it never matches the policy for the browsing profile since there is an ad group as the source.How do I see the ip-AD user mapping on the 400F as well? Any suggestions? ThanksBR    

Hi everyone, We want to block all connections to WhatsApp web in Fortigate. We tried to block them by blacklist, but the problem is that when we create the FQDN with the WhatsApp web url, and we apply it to the black list, it's not working. Our temporary solution was to block the public IP of the WhatsApp web url, but it changes quite fast. Any ideas? Thanks in Advice

What is website ##rating error in Forti guard ? What is the root cause of rating error ? How I can avoid this rating error permanently