Solved

Does anyone ever use Web Vulnerability Scan in FortiWeb? Generated repoerts looks pretty poor (user friedly about 0%). How I can customize it? For example: one of the reports has about 8000 pages and it's not good at all (test report with test web-server). It is include full html http-response, but sometimes (in some vulnerabilities or suspected vulnerabilities) i don't need it at all. Can anyone help with it? Maybe in future versions of FortiWeb reports customiztion will be improved.I can't do anything except write a some script that will be parse report and delete extra data, but this doesn't seem like a good solution.

Hello everyone We still have some FP421E active which are managed by a fortigate. We are aware that those are end of support, end of sale, end of everything... Unfortunately I have difficulties to find an official (old) compatibility list with these FortiAPs listed, to find out how far I can update the managing fortigate in order to have those FP421E (on 6.4.9) still being supported (fortios wise) so that we can prepare the fortigate for newer FortiAP models... So far in the compatibiilty lists I found the only legacy models mentioned are the FAP221 and FAP223, but no FP421E... Anyone an idea where to find something official?

Hi guys,   Could anyone explain the difference between Shared and Per-IP traffic shapers? I ask this because the Fortinet documentation is different depending on the origin.   According to the Fortinet cookbook: A Shared shaper affects upload speeds whereas Per-IP shaper affects both upload and download speeds.   According to the FortiOS Handbook and NSE4: Shared Shaper: A shared shaper applies a total bandwidth to all traffic using that shaper. The scope can be per-policy or for all policies referencing that shaper. Per-IP Shaper: A per-IP shaper allows you to apply traffic shaping to all source IP addresses in the security policy, and bandwidth is equally divided among the group.   Do you see the difference? What is correct?   Regards, Julián

Dear All,   My Fortiswitches are not listed in the Fortimanager anymore after a swap of ADOM between 6.2 to 6.4 (FMG v6.4.12 The manager notices two switches are added to the switch-controller, but does not show them at all. Looking at the CLI I do see the switches listed in the switch-controller, afterwards tried to add them manually based on SN to the manager but I do get the notification; "failed to sent to device".   Anyone experienced this before? 

Good day The client is experiencing issues when switching between LAN and wireless via FSSO. Seems as if firewall is not refreshing/updating this correctly.When user switches off wifi moving to lan ip address the fsso entry on the firewall is not updated. Still keeps original ip address received on the wifi network even when the wifi device is switched off Please assist Thank you

We have a Device Profile rule acting as our catch all for rogue devices. We have enabled 'Notify Sponsor'. This rule works and sends emails to a shared email account. I need to change this email to something else and I can not seem to find this setting within 'Events & Alarms'.Any help is appreciated  NAC version 9.4.4.0767 Any help is appreciated Thank you

We have had a few issues with connections to FortiGuard. Recently we had to revert to default HTTPS/443 communication, after the UDP/53 we used as a workaround for previous issues became broken for unknown reason.    We have now activated the 'Allow websites when a rating error occurs' option, and would like to add the FortiGuard status of all of our FGT's in our monitoring tool. I can't seem to find any related OID though, does somebody have suggestions how to tackle this?   (ticket ongoing concerning the issue with TAC, but I'm not very confident in a permanent solution)

Hi guys I'm experiencing this kind of issue with FortiSIEM agent on Windows 2022 Server, the agent is not able to send logs related to Sysmon or any other kind of logs, even with different windows agent template associations.When SNMP is configured to send info, the Supervisor is able to show this on performance and analytic real-time dashboards, but when the filter is like "Event type  NOT CONTAIN PH", I can't see any logs, is supposed to be the event, system events, etc... The CMDB show the server with agent status "Running active", the method "snmp, agent, ping", so no connectivity problem here. How can I get some tips to solve this??  Thank you!

HiI installed Forti-Analyzer VM64. When I attempt to login with: admin and no password, the message is "Authentication failure. Please try again..."When I registered virtual machine I set private IP address, is it wrong? Does it need Public IP Address? Thank youMarco 

Hi, I want to know if it is possible to bypass VPN when you are in internal network without using public IP addresses as reference because we have multiple branches using different public IP addresses.

Hi Everyone, I am being tested at work for my networking skills with a huge lab and I dont have any experience in firewalls, I have a ccna routing and switching only and I am being asked to design a 2 site network(site one> fortigate, core switch and access switch, site 2 is a single switch). I think I found a (Second) mistake in the lab(the first was an IP that made no sense and I found in like 15 min of looking). The scenario is that we have a snmp server in our server subnet that is getting attacked and I must block the relevant ports, I only have one fw policy that allows anything from the internet at all that isnt a vpn client(really its 2 because of a redundant backup ISP connect but doesnt affect this), this uses 2 a virtual ips I have for a webserver in a dmz. Internal users and the webserver have internet access. There are no other allowed policies from either internet port, just the ones from the isp to the webserver dmz. Does the implicit deny already cover this attack?&n

Hi, I have been working on a demo project and am trying to configure IPS on my fortigate. I had to turn the feature on and I can configure a fw policy with the profiles. I am very new to firewalls and I have not placed the ips sensors on all the correct policies. I want to modify those policies but when i go into them they no longer have options to change the security stuff(av, webfiltering, ips, ect) do I have to delete the rule and recreate it every time or is there a way to edit? 

Hello! As an MSP we wish to manage the firmware and maintenance for our Fortigates from the Cloud in a central portal.I know there is a way to manage the Fortigates through a VM with a license but we do not wish to setup infrastructure for it. We are looking for a Cloud service so we probably need to have the correct licenses for the Fortigates. I've read about the FortiManager Cloud, but does anyone have some good information about what we need?Like FortiManager licensing or FortiCare per firewall? Many thanks! Best regards,Tim

Hey guys, sorry if this has been answered before, I searched the forums and couldn’t find my case. I’m about to purchase a used fortigate 61e for a very atractive price. The owner is willing to transfer account to me. Current subscription expired in june 2023. My question is whether I can purchase a new subscription now? Would I have to pay for the gap  of 8 months?

Is there an archive with older VM images?In the support -> VM Images the oldest images that are available for download are:7.0.136.4.14 Is there an official or unofficial place where older VM images can be downloaded?

I've reserved specific IP addresses for our company machines based on their MAC addresses in FortiGate's Network > Interfaces > LAN > DHCP > Advanced > Reservations. However, these reserved entries aren't showing up in the DHCP Monitor tool.Key Points:Reservations made for company machines (not smartphones)Machines have connectivity from PC and Server via LANReservations confirmed in LAN DHCP settingsPC reservation on LAN visible in DHCP MonitorSmartphone reservation on Wi-Fi visible in DHCP MonitorWhy are reserved IPs for company machines not showing up in the FortiGate DHCP Monitor? Any suggestions for troubleshooting? Does it even matter when they have connectivity? What does it mean?I appreciate any insights and assistance you can offer. Thank you in advance for your time and expertise!Sincerely,

Is it possible to add wildcards when creating a web rating override? Im trying to make new categories for easier administration of some requirements but I cant add a wildcard when setting a domain for a rating override, for example if I were to try to block amazon.com without a wildcard other sites like amazon.co.uk or amazon.co.jp will still load. Is it only possible to add wildcards on the url filter section? If its only possible here then can I make categories on the url filter so I can groups different filters like you can do on the web rating override? Thanks

Hello, I havent seen such weird behavior on FGT before. I have S2S VPN with another location where there is some Local network - all is working good with s2s, but the problem is with local asset. After sometime one of IP is unreachable.Debug commands says:.."id=20085 trace_id=161 func=init_ip_session_common line=6043 msg="allocate a new session-00bf3a66, tun_id=0.0.0.0"id=20085 trace_id=161 func=vf_ip_route_input_common line=2611 msg="find a route: flag=80000000 gw-10.0.201.2 via root".."id=20085 trace_id=161 func=fw_local_in_handler line=500 msg="iprope_in_check() check failed on policy 0, drop" I do have enabled "snat-route-change enable" - for SDWanI dont know why there is some problem with routing, where all is done as I used to do it regarding IPsec. Ive notice it after upgrade to 7.0.13(Mature)Ive got a temporary workaround, I must flush iprobe routing with "diagnose firewall iprope flush".Can someone point out what the hack? :)

I am curious about the status value of "diagnose sys ha dump-by group". "diagnose sys ha dump-by group"state/o/chg_time=3(waiting)/2(working)/1706239048I understand status and chg_time.What does "/o/" mean?FortiGate 

Hello team,   I configured snmp. I enabled snmp in the management interface, after which I went under "System > SNMP" and configured as follows:   When test with snmpwalk command via cli from my monitoring system, Fortigate side capture this traffic:     it is as if the fortigate is not responding to snmp traffic. Maybe some policy is missing? Thanks for the support   BR

Currently, it looks like the unit (3001F on 7.2.6) will use a different seed or other value when outputting configuration in a 'show' or 'show full-configuration'. This makes it different to watch for changes/etc. if tracking the configuration in an external system. Is there any way to get a consistent seed/encryption so that they aren't different values on every invocation? I'm open to retrieving the configuration using some other mechanism/api endpoint/etc. if needed.

When I enter the auxiliary-session command on the fortigate 50e device, it does not work. I would like to know if the auxiliary-session command is not set on the fortigate 50e device or if it is a version issue.

Hi all, I'min the process of replacing hardware for a customer. Right now their netwerk is based on Aruba CX switches (see diagram below), the have 2 core switches opering VSX with MCLAG to the access switch layer. The access switches are Aruba CX6200 stacks with lik 3/4/5 switches network closet.The Aruba switches are stacked and have an LACP trunk o the MCLAG on the core switches. The customer  recently switched their firewall to a Fortigate cluster and they are considering replacing their swithing network to Fortinet as well. So far I have found a decent replacement for the core switch but for access layer switches I can't quit grasp the concepts that fortnet is using. From what I understood so far is that I should use MCLAG on the access switches as well. If there are more than 2 switches in a network closet, how would include these in this network?Should I just create a ring network and have Spanning-tree take care of the loop?Are there other alternatives to co

Hi Experts, In FrotiSOAR (FSR version 7.2.2) GUI, in System Health Dashboard, under the "Playbook Execution Monitoring", I see Queued Workflows and Active Workflows. The Active Workflows count remains quite high above 200K and Queued Workflows count ascends up when I perform any bulk operation. It goes up to 400 to 450 and comes back to 0 when Bulk operation is finished.  I just want to know what are the typical values for these parameters in a mid sized enterprise environment, and can we see these workflows running, through CLI (if possible)?  BR,MBF #FortiSOAR

Hi All,Our conference sites are starting to look into upgrading older equipment and move towards new, modern, protocols for audio and video. We actually just got 4x 1024E & 2x 1048E with 100G backbone to replace the core switches in one location.In this location, they have Meyer Sound equipoment that use AVNU's Milan/AVB protocols, and they say the switched need special - certified - support for this.I can't seem to find details for this for FortiSwitches, can anyone help with information about this?IEEE 802.1BA-2011 – Audio Video BridgingIEEE 802.1Q-2014 – Bridge and Bridged NetworksIEEE 802.1AS-2011 – Timing and Synchronization for Time Sensitive ApplicationsIEEE 1722-2016 – Transport Protocol for Time-Sensitive Applications in Bridged Local Area NetworksIEEE 1722.1-2021 – Device Discovery, Connection Management, and Control Protocol for IEEE 1722(TM) Based DevicesHope we don't need to buy Netgear.. ;)