Solved

I have configured destination IP detection using IP Reputation on FortiGate. I detected IPFS.Gateway at Reputation Level 2. I assume that IPFS.Gateway is classified at Reputation Level 2 because it involves peer-to-peer (P2P) communication. Could someone confirm if my assumption about the expected content is accurate?

Hello,I'm trying to grab IP address from the log after ssl-login-fail and create new Firewall->address and append it to existing group using CLI script:Log event looks like this:date=2024-01-17 time=11:11:19 id=7325007792115286044 itime="2024-01-17 11:11:19" euid=1049 epid=3 dsteuid=3 dstepid=3 logver=700130566 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="admin" remip=5.153.183.36 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_permission_denied" eventtime=1705486279485398543 tz="+0100" devid="FG100E4Q17012295" vd="root" csf="TCCM_SF" dtime="2024-01-17 11:11:19" itime_t=1705486279 devname="EDGECLUSTER_FG100E" I see that IP address in question is named remip My script follows:config firewall address edit %%remip%%_SSL_VPN set subnet %%remip%% 255.255.255.255 next end config firewall addrgrp edit Banned_SSLVPN append member %%remip%% nex

I am currently trying to configure FortiNAC to authenticate 802.11 for devices using Wifi. The topology is as follows: Client -> Cambium AP -> Forti NAC (Radius) -> Active Directory (User Database). FortiNAC has been configured to join AD and LDAP authentication has also been integrated with AD. When the client sends an authentication request, the log on FortiNAC may show some errors such as:ERROR: No NT-Domain was found in the User-Name rest_reject: EXPAND Registration - Access Deny (Post-Auth) rest_reject: --> Registration - Access Deny (Post-Auth) rest_reject: Module-Failure-Message := “Registration - Access Deny (Post-Auth)”I’m not sure where I have misconfigured this. Please help me resolve this issue. I also attach detail log for deeper analysis in the follow linkhttps://drive.google.com/file/d/1EdOrojp-KYVcHPYxujuEdkmjEBjYpiKD/view?usp=drive_link

Hi all ¡¡ I'm trying to configure an email alert when WAN2 interface from my fortigate with 7.0.11 goes dow, but its not working. Probably I'm forgetting some steps or doing something wrong. This is the article: Technical Tip: E-mail alert when WAN interface wen... - Fortinet Community I attach you my trigger, action and stich. I have tried it using the LOG ID 22922 as in the example. Cause it doesn't  work I've noticed that the event ID changes in my FW (I attach you an image). I've changed it. Finally I attach you my mail server configuration (default configuration).  What am I doing wrong? The mail doesn't arrive (I've checked the spam folder).Thanks ¡¡      

Hi Community Member,   Hope all are doing well. I am currently facing an issue with FortiSIEM office365 integration I have followed each steps in the below provided documentation but still unable to fetch events. Appreciate if someone has come over resolution. followed docuement: http://docs.fortinet.com/document/fortisiem/7.1.1/external-systems-configuration-guide/514932/microsoft-office365-audit   Issue screenshot is attached <forum admin removed screenshot as may contain sensitive information>

We're building a new network and need to support directed broadcast messages. Essentially, some broadcast traffic shall need to be forwarded between different network segments. From my research, I believe our FortiGate firewalls will support the forwarding of this broadcast traffic through the configuration of a multicast policy. However, we will also be using FortiSwitch network switches. My question is, will the FortiSwitches support the forwarding of this broadcast traffic when managed through FortiOS via Fortilink? I have provided an example diagram below to illustrate, broadcast traffic from Host A must be able to reach Host B. Thanks :)

Hello team, I have an argument to share and would also like your opinion.If I create a wildcard FQDN object *.pluto.com qwhen the client does dns traffic I also get sub domains resolved for example foo.pluto.com duck.pluto.com etc.Now if by chance a subdomain is malevo this is resolved anyway and the fqdn wildcard object is updated with the malevoo ip. What advice can you give me to fix this problem? Or maybe it is not necessary if you configure other security profiles ad hoc? ThanksBR

Hello team!!! I hope you are fine!I have the following question, if I configure an sd-wan rule with the "maximize bandwidth" strategy, configuring in the cli, the "set hash-mode inbandwidth", how fortigate determines the interface with most available bandwidth if I have no licence for "SD-WAN Network Monitor" ?Is it possible? Thanks in advance.Regards!Damián

Hi Folks! Need to know the CLI command to check the FSR current version. Regards,MBF FortiSOAR 

Hi all,   Is there a way to restrict SSL-VPN access solely to the FQDN, disallowing users from accessing the web portal via the IP address? We prefer users to only use the FQDN for access. OR Can we use multiple server certificates that cover both IP and FQDN, eliminating certificate warnings?   Any lead?

Hello all,  Affected: FortiOS 6 to 7.2.4. Webbrowser, Devices, everything that is not Windows.If you have Certificate Inspection, deep inspection enabled, Windowsupdates are not possibel anymore. To only way is to import the CA in the Fortigate. But the question arises, why was this CA not integrated into any Windows devices? Example: https://sls.update.microsoft.com i noticed that the Microsoft Update Secure Server CA 2_1 certificate is not trusted by Fortigate.But not only that. This certificate is not trusted at all. From no device, no website, no tool. Only Microsoft Windows itself has this CA on board. How can that be?  https://www.ssllabs.com/ssltest/analyze.html?d=sls.update.microsoft.com&s=52.165.165.26&hideResults=on openssl s_client -connect sls.update.microsoft.com:443 CONNECTED(00000003) depth=1 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft Update Secure Server CA 2.1 verify error:num=20:unabl

Hello all,  i'am using here a Fortigate 60E with some Fortiaps 433F. The Fortgate is linked with LDAP and Radiusserver. WLAN Entperprise WPA2 and WPA3 works with this auth methods:  TTLS + PAPTTLS + GTCPEAP + GTC I have tried to find reasonable info's as to what the difference is, but have not found it. So my question is: "What is the difference between the methods, what should I use?". Thanks a lotBest Regards :)

Hello, I cloned the existing "Windows Security Log Cleared" rule in the rules and created it in a new name, only I made the within value 120, not 600, and made the rule in the default disable. However, this time, when the rule was triggered, it created an incident with the name in the default and gave a sync error error in the rule. What could be the reason?

Dears, What is the best way to connect a TP-Link 1600 VDSL ISP router to a FG90EI want to use the FG for VPN, DHCP and other policies. the ISP router is providing a nated IP 192.168.0.xI tried connecting a wire from the router to WAN1 port after disabling DHCP on the router and set a static IP on the WAN port, is this the way to go or I should be doing something else? I read posts saying that I should be changing the connection mode to bridge. what is your recommendation  Thank you in advance  

 Hello, All my users are in a LDAP group "Users".All my admins are in LDAP group "Admins" and "Users" I have a SSL VPN portal for all users (Group Users).I have created a specific portal for all admins.But the admins are recognized like simple users. They are a possibility to do this ? Because i tried to change order but nothing change, my admins are seen like simple users. Thks

Hello everyoneI am running a Fortimanager with 7.4.2On the Fortimanager I have div ADOM.I have entered an address object in an ADOM (Any Interface) and want to synchronize it with the Fortigate (100F). Now that works. Does anyone have a tip why this does not work?

Hi All,I have a syslog server and I would like to sent the logs w/TLS.My syslog server has a certicate assigned to it from my local cert authority which is a Windows CAI uploaded my cert authority cert to the Fortigate but still does not work.THas anyone gotten TLS syslog to work when the CA is a local Windows CA that shows under remote certificates?

We are doing FSSO on a gate. I have DC agents on the AD servers.  In the external connector FSSO Agent, the user group source is set to Local LDAP with proactive retrieval enabled. The gate sees all the users, no problem there. In my FW policy we want to allow ALL authenticated users. What is the most scalable way to accomplish this without having to manually add new individual users to a defined group or directly to the policy? Would changing the config from Local LDAP to Collector Agent work ? Thanks for any help here.    

 Is it normal for a private virtual machine not to access the internet in edit mode?The license wants to verify but cannot verify because there is no access?Also how can I connect the virtual machine to my local license server?

HelloI have some questions regarding FortiNAC-F.I see the main difference is in the new FortiOS like shell, but what are the most important added values in FortiNAC-F?How do I choose between FortiNAC and FortiNAC-F? Is FortiNAC suitable for some customers and -F suitable for others?As Fortinet has now 2 NAC products, I guess the legacy FortiNAC will be discontinued, right?If FortiNAC will be discontinued, when and what will be its last version?Since FortiNAC-F is relatively new, is the latest 7.2.5 version considered as mature? Does Fortinet recommends it more than FortiNAC 9.2.8?

Hello,   Can a FortiGate use a proxy server to activate a FortiToken mobile code? In the documentation (https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/492260/configuring-a-proxy-server-for-fortiguard-updates) I read that: "Proxy tunneling is supported only for registration, AV, and IPS updates. For FortiGate virtual machines, proxy tunneling can also be used for license validation." and I'm not sure if FortiToken activation is supported in proxy tunneling or not.   Thanks

HelloIs it possible to change my forum nickname to "stasy" ?Thank you

Hello forum,I would like to know how many of you are dealing with upgrades of firmware from Fortinet Devices.We have a range of Fortinet equipment, FortiGates, FortiAZ, FortiSwitches, FortiAPs.We have them on multiple locations.How you guys are dealing with upgrades, where to look if the upgrade is suitable for us, what type of automation you use, etc..It's really hard to catch up with everything since I'm not just a Fortinet guy. I'm System Admin so I have a lot of other task's and its getting overwhelmed..  

Hello, how can I use an FQDN for NTP?

hi,i would like to constantly monitor our WAN utilization in a certain VDOM.i already added a widget under dashboard > network > interface (added WAN subif).my question are:1.is this widget permanent? or is it auto removed after my login session?2.can other admin see/view the widget i created? or is this view only exclusive to my profile?3.i can only see 1 hour, 24 hour and 1 week view option? is this fix or can i adjust this view to 12 hours or 30 days/1 month, 12 months?