Solved

Hello Community Normally I'm using a prefix-list in combination with route-map to filter prefix advertisements when configuring BGP.For fun and to expand my knowledge, I was looking into the docs article about 'Route filtering with a distribution list'.Link: http://docs.fortinet.com/document/fortigate/7.2.7/administration-guide/170065/route-filtering-with-a-distribution-list In my lab I have 3 FortiGates, running v7.2.7.FGT1, FGT2 and FGT3.FGT2 and FGT3 have eBGP peering established with FGT1.FGT1 receives prefixes from both FGT2 and FGT3 and advertises everything. FGT1 also advertises a local originating prefix. For testing, I would like to try and use the distribution list on FGT1 towards FGT3. I would like to filter out only the prefix received from FGT2. The local prefix that FGT1 advertises, still needs to go to FGT3. However I can't seem to get it to work.My ACL matches the prefix from FGT2 with exact-match enabled and action set to deny.If I set the ACL on th

All:   I understand the admin access restrictions - but I don't want anyone to even see that the device is a Fortigate on the WAN.  How to do this simply?  And - if it's involving CLI mangling of the local policy - is this something on target to be usable in the GUI in the future?   Thanks!

Hello team, I have the users of a branch office that to go out on the Internet they do this circuitVLAN_Client --> FGT-200F --> MPLS Circuit --> FGT-400FOn the 400F firewall various browsing profiles are configured which according to the AD group they belong to are assigned a Lite,Full or Basic browsing profile.Now looking at the logs on the 200F side (defult gateway VLAN_Client) I see correctly the IP address with the domain usernameWhile looking at the logs from the 400F side I see the local ip, the natted ip but not the domain user and as a result it never matches the policy for the browsing profile since there is an ad group as the source.How do I see the ip-AD user mapping on the 400F as well? Any suggestions? ThanksBR    

Hi everyone, We want to block all connections to WhatsApp web in Fortigate. We tried to block them by blacklist, but the problem is that when we create the FQDN with the WhatsApp web url, and we apply it to the black list, it's not working. Our temporary solution was to block the public IP of the WhatsApp web url, but it changes quite fast. Any ideas? Thanks in Advice

What is website ##rating error in Forti guard ? What is the root cause of rating error ? How I can avoid this rating error permanently

Hello,Issue description:Fortigate 60E (7.2.7) with 2 interface configured1) WAN 151.22.102.209/29 public address (connected to Internet) 2) Port1 address 192.168.4.254/24Secondary ip address 192.168.5.254/24 Internal Server1 192.168.4.200Internal Server2 192.168.5.200------------------------------------------------------------------------------------------------Trying from the Internet:Vip 151.22.102.210 to 192.168.4.200 WORKS!by modifying the VIP in:Vip 151.22.102.210 to 192.168.5.200 IT DOES NOT WORK I can ping 192.168.5.200 from Fortigate Thank You in advanced.RegardsMS

Dear team I working with FortiSIEM version 7 , I have  2 issue first one , I setting scheduled for some report to generate report weekly and this is done , recently the weekly report is not generated although I re-scheduled setting the report again but the same issue. second issuewhen I   generated analysis and I want to export by PDF , the error appeared as I attached.  

how do i generate a report based on high bandwidth usage?eg. i want to find out what is causing my bandwidth to be congested during certain time of the day?heavy bandwidth user or application

hello I want to configure the DHCP server of my 80F  firewall, for this purpose I need to set options 60, 66 and 67,especially for options 67 I can't set it via the web interface, it recamnds me to use the CLI console.i followed this technical tips Technical Tip: Configure DHCP option 60, 66 and 67... - Fortinet Community But when I run a command bellow a get  "Attribute 'interface' MUST be set."   and "Command fail. Return code -56", config system dhcp server    edit <>        set filename {string}    next endhow and where to set the interface attribute, I tried with set interface "interface_name"  ?  but it doesn't work

Hi All, I have a fortimail 900f and we've noticed that when users emails are compromised the malicious actors use said email accounts to send mass spam between 1 am and 5 am.  From what we can see no users are sending emails during that period so we'd like to implement a rule that blocks all traffic for a specific time period, is something like this possible with the fortimail 900f? 

NULL

Trying to use FortiToken Hardware Tokens for Azure MFA for users who do not have company phones. Has anyone had success with this?    I was able to upload a CSV file with Microsoft's required information, however i cannot activate a token.    format example. upn,serial number,secret key,time interval,manufacturer,modelHelga@contoso.com,1234567,1234567abcdef1234567abcdef,60,Contoso,HardwareKey   I have Fortinet for manufacturer and FortiToken-200B for model.     

Hello,Using Forticlient VPN 7.0, we got a weird issue with some users. We can connect to our VPN fine but for the first 10min nothing works (access to internal server, network share...) then at 10:00 everything unlocks.It happens on Windows 10 and Windows 11; tried rolling back to Forticlient 6.4 and 6.2, same issue.Can't seems to find any fix or workaround other than reinstalling windows from scratch...Does anyone got a similar issue or have any idea on how to fix this?

Hi, I would like to change my nickname to hdoforumusr Best regards, 

Hello, Two Fortigate are linked by an IPSec Tunnel. LAN traffic passes well through the tunnel, but the fortigate cannot communicate with a syslog server located on the other site. How to specify to sent this local traffic into the tunnel ?

Hello colleagues, maybe someone can help. I have configured an SDWAN, which consists of two WAN interfaces. Everything is working properly. I want to force a route to the specified IP addresses through one link and the rest through the other. I configured SD-WAN rules, a rule on the firewall internal-->sdwan with NAT and it works fine. Now on one of them I made an ipsec VPN. Also I added it to SDWAN and I am trying to force the same operation. The problem is that I need to add the same rule for ipsec VPN but without NAT, only on FG I see only one SDWAN interface. So if I don't set NAT then WAN2 works, and if I don't set NAT then IPSEC works. I watched a tutorial for SDWAN with two VPNs, but that is not applicable here. Fortigate 60f and  7.0.13 firmware on board.  

Fortigate 201F on 7.0.14 firmware.Website: www.reliafund.comWe use this site for ACH transactions on a daily basis, so it's pretty important. According to the Fortiguard webfilter, this site was updated to a malicious category on Feb 12, 2024. Prior to that we never had an issue. So, starting yesterday, this site is no longer accessible. I’ve submitted three requests for reliafund.com to be recategorized and all three are denied due to a supposed infection. I’ve escalated those requests only to be denied again. We see two different block pages, seen below. Not sure if that's relevant. Here's what I've tried...Multiple browsers have the same experience. Yes, I know it wouldn't matter, but I'm only stating what I've tried.Multiple PCs accessing the internet through different outgoing firewall policies WITH different security profiles are blocked.Forward traffic logs so success, although that IP is related to Fortiguard. Creating a URL filter bypass is not successful. 

I am attempting to deploy the free FortiClientVPN via Intune without EMS.   I have deployed the individual registry keys via powershell using the new-item cmdlet with the DATA1 and DATA3 keys empty   Any deployed client will not connect to the VPN server. If i delete the profile within FortiClient and recreate it the client connects and I am prompted for EntraID credentials, the only difference I can see if that DATA1 key gets populated. I have tried deploying the registry settings without the DATA1 and DATA3 keys without success. I have tried deploying the keys then the client software but it still will not connect.   I am assuming this DATA1 value is supposed to be unique to each machine so what's the work around or can I deploy the same value to all machines?   Edit: Found a solution. Install the ForticlientVPN on a machine and create a VPN profile. Open regedit on this machine and find the VPN config in the registry under the Software\fortinet tree. Clear t

Please let me make sure the order a FGT examine policies.If there is a specific policy from a specific interface like "lan" to another specific interface like "wan1" with "any" source and "any" destination, it would be examined before another policy from "any" interface for a specific source IP set to "any" interface for "any" destination, even if the source IP matches one of those specified. Right?I just want to make sure my basic/fundamental understanding is correct.Toshi

I have a 101f with 7.2.6. User cannot be added to user groups. Under User and Authentication, User DefinitionI select a user that is an LDAP user,I select the User Group button and the list of available user groups pops up.  I select a group      from the list and when I save it I get an entry not found error. if I do the opposite from the groups:Under User and Authentication, User GroupsI select the same user group I was selecting above and edit.  there is no option to add users.  If I jump out to the CLI and manually try to add the user I get: entry not found in datasourcevalue parse error before 'xxxxxx'Command fail. Return code -3 The listed LDAP servers are connected successfully and can authenticate users through the FG interface under Under User and Authentication, LDAP Servers. what did I miss?

Hello, Is it possible if i want to create separate interface for management in Fortimail?Example: i want to use ETH1 only as Management interface and ETH2 for traffic. Thanks,Bram

I have a Fortigate being managed by a Fortiportal.The WiFi clients show in the Fortigate and the Fortiswitch monitoring in the Fortiportal but donot show up in the WiFi monitoring section of the Fortiportal.Is there a service that I need start or enable for this to work.

Hello,does anyone have done the integration between ServiceNow and FortiSOAR using oauth? The ServiceNow administrator created ClientID and Secret but the connector configuration also requires Username and password.

When we logon to the unit we receive an error that the Firmware was not signed by Fortinet. This was after an upgrade to FortiOS 7.2.7. The previous FortiOS version is 7.0.12 the resolution for this is to update on 7.0.13 and the error message still appears and now we upgrade it to FortiOS 7.2.7 still having the error message. The unit is part of a HA cluster. The second unit of the cluster does not have the error. Any workaround or recommendation would highly appreciated.    

I have a central site (A) with a static IP and many other sites (B, C and D) that create dialup IPsec tunnels back to site (A)   Subnets at site (A) can reach subnets at sites (B, C and D) and sites (B, C and D) can reach subnets at site (A)   But I have not seen a config or a topic which would allow sites (B, C and D) to learn they can reach each other via site (A)   Static routes and policies would be a good start. Does anyone have a recipe to allow traffic to to route from Site (B) to Site (C) via Site (A)?   In an ideal world it would be great to have a vpn direct  between site (B) and Site (C) but as both are on dynamic addresses this would introduce the use of a dynamic DNS service which I would like to avoid   It would be a great feature if site (A) would be able to act as a dynamic DNS