Solved

After upgrading our Fortigate 600E (two firewalls in HA) first to FortiOS 7.0.4 then later 7.0.5 we are experiencing what I suspect is memory leak issues. Over time the memory usage goes up gradually to the point where the firewall goes into "conserve mode" and traffic forwarding stops. After reboot (HA failover) the memory usage is back down and then after about three weeks it goes into conserve mode again. Anyone else experiencing the same problems?Do you think I should just roll back to 6.4.x or wait for the next patch?    

how do i edit the message header from the email alerts sent from the fortigate?the subject header is Message meets Alert conditionmy ForitOS version is 7.2.5 Message meets Alert conditiondate=2024-02-14 time=01:57:14 devname=100F devid=FG1000337 eventtime=17077209 tz="+0800" logid="0100032003" type="event" subtype="system" level="information" vd="root" logdesc="Admin logout successful" sn="17219" user="admin" ui="http(127.0.0.1)" method="http" srcip=127.0.0.1 dstip=127.0.0.1 action="logout" status="success" duration=1815 reason="timeout" msg="Administrator admin timed out on http(127.0.0.1)" 

Hi All,I'm relatively new to FortiNet and have a question about enabling the "Quarantine Host" option on an SSID configured on a FortiGate Firewall. I noticed when I enabled the "Quarantine Host" option, a wqt.root interface was created with an IP address of 10.253.255.254/20 and a connected route was added to the routing table. I don't recall configuring the wqt.root interface or assigning an IP address in the 10.253.240.0/20 subnet (this overlaps with other subnets in our network). I'd like to know if the interface and IP address are configured automatically by the FortiGate when "Quarantine Host" is enabled on an SSID. Any information about this is much appreciated.   

Hi All,   We are deploying FortiAP's, so I would like to monitor the WLC side of the FortiGates. I have SNMP(v3) running just fine, but some of the WLC MIB variables puzzles me a bit.   fgWcInfoWtpSessions "Represents the number of WTPs that are connecting to the AC." This seems to be the AP's acually Online & Aurhorized, as listed in the GUI. This is consistent and as expected.   fgWcInfoStationCount "Represents the number of stations that are accessing the wireless service provided by the AC." This seems to be All Known AP's, Online/Offline&Authorized and UnAuthorized&Online..   fgWcInfoWtpManaged "Represents the number of WTPs being managed on the AC." This number does not make sense - it fluctuates up and down, not following what is on/offline.. Anyone care to explain what it actually tells me?   It seems there is no (direct) MIB entry for Offline+Authorized AP's, and since there is no entry for Authorized APs, it's a bit hard to calcu

Today we updated all our FortiGate devices to 7.0.14 due to the security concerns with the ongoing attacks worldwide. Unfortunately after the upgrade we are facing a lot of blocked connection to applications which were working without problems before.What I have noticed is the type of block -> local-in-policy. Is there some new feature that I am missing or is there a way to enable such traffic.One of the blocked connection is video surveillance system, running on HTTPS:  ActionAction Policy violationFirewall ActiondenyPolicy ID0Threat262144 ApplicationApplication HTTPSApplication Category unscannedProtocol 6Service HTTPS DataDuration 0 secondsReceivedReceived Packets0SentSent Packets0.....FortiClient UUIDPolicy Type local-in-policy  

FG 100D fw:6.2.15MS AD domain usersThere are two domain controllers and FG agent is installed on them. Ver: 5.0.0312The user gets Internet access via AD groupProblem:From time to time, the user loses access to the Internet and is blocked by the default rule.The logs show that the user field is not filled in.The user accesses any domain resource and Internet access appears.There are no new records about the user's logons on the domain controllers.How can I fix the problem of periodic Internet loss?

Hello,   We have a Fortigate (100F) and multiple FortiAP (231F) access points. We recently ran into a problem. Almost all of our access points are working normally, but there is one that had slow Wi-Fi speeds. We tested the cable and the switch port, but it seemed they were not a problem. We tested another brand AP, and it had high speeds. With a reset, the FortiAP felt a bit different, but still has unstable speeds.   We wanted to upgrade the firmware of that particular FortiAP, but it seems it's hard to get the file. Can someone guide me for how to get the actual file as many tutorials just show me where I can upload the file on Fortigate without telling me where to get it.   Note: Its current version is 7.0Thank you!#FortiAP #Fortigate #Firmware-Upgrade

Hi, is there a way or command I can check who make the changes under Schedule Updates?My FW perform auto updates and I need to find out who have amended the schedule updates to auto, Thanks 

Hello,When external users have to logon, I give them https://firewall.mydomain.com:1003 (I've load a 3rd party certificate).but they are redirect to https://IP-ADRESS:1003 with a certificate error Is there a way to fix the name used by FG to match my FQDN ? Thanks !

I understand that (almost?) everything should be configured and deployed via FortiManager for any devices that are managed. Are there any configuration elements that cannot be done through FortiManager and must be done independently at the device level? Specifically ... I have a device that cannot connect to FortiAuthenticator, so I have to log in using local credentials.  I'm pretty sure the problem is that I need to set a source-ip for the RADIUS connection via CLI: config user radiusedit "<authentication string>"set source-ip 192.168.100.1 Of course when I log into the remote device locally and open the CLI, I get the message that "changes will cause this device to be out of sync with FortiManager." I guess I have four questions:1. Can this setting for an individual device (that is part of an ADOM with other devices) be set via FortiManager?2. If so, how?3. If it cannot be set via FortiManager and I set it on the device itself, will it cause any "

Hi all,We were forced to re-import the configuration of a firewall into the manager. As a result, many address objects have now received a per-device mapping. Is there a way to remove these per-device mappings in the address objects, e.g. using a script?

Hello guys, I have a multitenant structure and I have defined a JDBC with MSSQL in my organisation. I got success in Credential, Discovery. When I test it in the monitoring I have created, it gives successful results, but I cannot see it in pull events and events do not come. What do you think I should do?

After SSL-VPN Webmode authentication, https bookmark login fails.After a failure, the login screen will be displayed again.I can log in correctly on the http bookmark login site.I will add debugging, so if you have knowledge please help. Equipment used: FG60EVersion: 7.0.10   FortiGate-60E #FortiGate-60E # diag debug enable FortiGate-60E # [210:root:d1]req: /remote/logincheck <----------------SSL-VPN Login[210:root:d1]rmt_web_auth_info_parser_common:492 no session id in auth info[210:root:d1]rmt_web_access_check:760 access failed, uri=[/remote/logincheck],ret=4103,[210:root:d1]User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67[210:root:d1]rmt_logincheck_cb_handler:1283 user 'user01' has a matched local entry.[210:root:d1]sslvpn_auth_check_usrgroup:2967 forming user/group list from policy.[210:root:d1]sslvpn_auth_check_usrgroup:3013 got user (0) group (1:0).[210:root:d1]sslvpn_validate_u

Hi Community,   I would like to setup two different Phase1 IPSEC Interfaces which divides the peers via identifiers based on certificate matching. Suppose we have two companies and the structure of the CN is basically a String formatted like a FQDN of the Computer. Is there a chance to divide peers from company A and company B based on two peer-groups with a CN-Match Substring?   The CN has the classic form of computername.companyA.com or computername.companyB.com. In my test it was perfectly fine to use the full CN but a match based on substring matching does not do the job. Off Course the config vpn certificate setting Entry cn-match and subject-match is set to substring.   So what syntax, wildcard-Characters or even maybe regex can be used for the CN-Matching? Is there a way to go on the substring  "companyA.com" or can the cn Value in config user peer only be a whole string separated by whitespaces? Is there a knowledgebase Article or a more descriptive Article

Hello, allAs I am preparing for the new FCP exam and going through the material about IPSEC VPN and found the option of the FEC. This is on the version 7.2.x.Can anybody explain the purpose of this, where to use and what does the noisy links means at the expense of using more bandwidth and the use case for the ingress and egress.The screenshot is also attached for the reference. 

Hi all,Actually I'm testing my new fortigate 60f and for test I have this configurations:modem -> oldFirewall (wan ip 10.0.0.10; lan 20.0.0.1) -> fortigate (wan ip 20.0.0.10; lan 192.168.10.1)I can can connect to forticlient but actually I cannot ping any device in the same subnet of wan connection. for example I cannot ping 20.0.0.20-254 devices)  can some one help me which setting let clients to reach all devices also that devices connected to the old firewall?many thanks in advance

Dear   We have Fortigate FG200E firewall, we need to access the Firewall through FQDN for that we have added the A records in our local and public DNS.   But now we need to stop the access direct from public IP, and the administrators must use the FQDN to access the Firewall management page.   Can anyone please help that how can I achieve this?

Hello guys. Quick question about fortiweb: can it interpret any script flavor? I've read somewhere that FortiManager supports TCL scripting, but haven't found anything related with FortiWeb. So, if I need to recreate lots of similar objects (ex.: similar profiles), how can I automate that task? Thanks.  

Hi all, If you can not understand what i'm saying,I apologize for my poor English.   I have a ha cluster using 1500D with version 5.0.14 and without ntp server. When I adjust system time to real time.My slave forti starting appear error log like   date=2016-11-07 time=11:16:55 logid=0100035010 type=event subtype=system level=error vd="root" msg="HA slave sync failed in 3 turns"   Logs like this appear 2-3 times daily. After I config time before change,this log still appear. I've tried re-build HA cluster but looks like didn't work.   Really need help.Thanks   I've show checksum in both of forti,and they are the same

Hello, I'm unable to uninstall FortiClient, the uninstall button is grayed, as far as the only session on the computer is an admin one, I don't understand why I can't uninstall it...

Hello Community, The setup is a FortiWiFi 80F running v7.2.6 firmware. My goal is to know which port the SD-WAN has chosen and get that data from the API. From the GUI, I access Network > SD-WAN > SD-WAN Rules In the 'IPv4' Column and 'Members' Row this cell shows two ports along with a check mark. The check mark tells which adapter the SD-WAN rule is using.   How can I know what the SD-WAN has chosen from the API?   I have tried health check but have not seen what I am looking for         https://192.168.50.1:443/api/v2/monitor/virtual-wan/health-check?access_token=nwm3N6Nfsjp5szxtdG64hqn8g9s8sx             Appreciate it

Hi  I already created an ipsec remote access tunnel and it is working. I want to create second tunnel for a different group but it does not connect. How can i do that?

Good day guys.I have the following setup.200F with dual WAN4 tunnels to AWS (the usual IPSEC with 2 tunnels).Probably, next year, hopefully, I will have AWS Direct Connect.Let´s begin with the IPSEC tunnels first:I´m having issues with the ECMP on the AWS TGW, what I need is just failover between the tunnels, but I want to setup the priority in which they are used under normal conditions, like in the following graph:  I want to influence the traffic (inbound and outbound) so it has the Tunnels in this order of preference: Main_Tunnel01Main_Tunnel02Secondary_Tunnel01Secondary_Tunnel02OrMain IPSECSecondary IPSECRight now, what I´m having (with ECMP disabled) is that I´m loosing traffic partially if I lose a Tunnel. If I enable ECMP, I get traffic through all the tunnels, and I do not want that. I found the Technical Tip : Difference between asymmetric routing and auxiliary sessions., I will testing that also, but right now I´m confussed with this AWS documentatio

Hi,   i was wondering.  Is there a way to put a ha cluster in maintenance mode?  With maintenance mode i mean, there will be no response to heartbeat failures for example.  Primary member remains active.  Secondary remains not active.  This would be handy in a situation where there is maintenance on the networking infrastructure between two sites, impacting the hearbeats between the nodes.  And we want to prevent split brain scenario's...   Ofcourse, we can shutdown the secundary node.  But since the used Fortigates cannot be powered on again remotely without someone going physically onsite to press the power button...

I try to solve a (maybe) edge case for a customer:   The Customer has multiple Website behind a Fortigate which he would like to make public available: web1.domain1.tld web2.domain1.tld web3.domain2.tld There is only 1 public IP Address. All the Website should be available on Port 443 (HTTPS). The Websites should be protected by WAF.   What I have tried: I can make the first two Websites (web1, web2) available with "Virtual Servers" and by using a Wildcard (public signed) certificate. Then I used a Firewall Rule with a Web Application Firewall Profile to secure the Servers. But then web3 cannot be added because it is using a different Domain.   I also tried it with ZTNA, Proxy Policy and by disabling the Client Certificate requirement by setting "set client-cert disable". This way I was able to publish all of the 3 Domains. But that way i cannot use any protection as Web Application Firewall cannot be used together with ZTNA as far as i know. Also, i noticed, that when