Solved

FortiManager Version: 7.2.4, FortiGate Version: 7.0.13Hello,We encountered issues with FortiManager 7.2.4, so we decided to perform a fresh setup, but unfortunately, the problems persist.The Logs Filter is not functioning correctly, consistently displaying "No logs found." Additionally, we are unable to activate or view logs for the default deny policy.Within the logs, we observed an unknown interface for certain policies. Although template groups are present, there is no visible content. Despite a background loading process, nothing is displayed, and it remains grayed out! What could be the underlying problem?Thanks for helping! 

Hello, I want to change one of the VDOM from Transparent to NAT. I plan to do this step : 1. Login web UI 2. Choose Global Mode 3. Go To System > VDOM 4. Edit VDOM 5. Change Operation Mode from Transparent to NAT Mode 6. Configure IP Address in the VDOM interface   is there anything else that needs to be done ?   Thanks

Hi, Im currently working with a Fortigate, which has 2 ISP's working on and SD-WAN, ports being used are Wan1 and Wan2. The rule I have setup is that Wan1 is prefered over Wan2, Wan1 has better bandwith and Wan2 is used as a backup. I need to have admin access via Wan2 with https (Wan2 works with a private ISP so the public IP is safe from outside intrusion). I have already configured Wan2 with the Admin access with https enabled and have confirmed with a remote user that the connection works, but it only works if Wan1 is down. If Wan1 is up the remote user can still ping the Wan2 address, but is not able to enter the GUI via https. What config could I be missing for this setup to work? Thanks

Dear Community, I need to decommission a FortiGate Cluster from FortiManager and before that, I would like to explore the recovery process when deleting it from Device Manager panel and the Policy Package.  1. is there any feature to backup/export all device settings (including advanced settings like dynamic interface binding) ir order to fast recovery in case of future demand (reinstall the cluster, audit..)?  2.  Related to Policy Package, creating a new ADOM revision is the only and best practice to be used as recovery? or there is any chance to backup/recovery the Policy package related to this cluster only? The goal here is to created secure points/fast recovery related to all settings from Device Manager and Policy Package to this individual Cluster only.We know the FMG backups haven the entire settings for all devices but will take so long to be activated touching config for all devices and also there are considerable impacts during the procedu

Dear All,                 I have a to fulfil the security policy on the fortigate of the following, just wonder what firewall policy i need to create in order to meet below security concern ? any help would be appreicated    Ensure firewall policy denying all traffic to/from Tor, maliciousserver, or scanner IP addresses using ISDB    Rationale:FortiGate includes Tor or malicious server related IP address using ISDB. The idea is tofilter out malicious traffic using firewall policies as first level filtering. This is done withoutinvolving more resource intensive processes such as IPS inspection, hence optimizingFortiGate's performance.Audit:Go to "Policy & Objects".Validate that there is a firewall policy created to block inbound connections fromsources named "Tor-Exit.Node", "Tor-Relay.Node", "Censys-Scanner", "ShodanScanner", and "Malicious-Malicious.Server" on "All" services.Validate that there is a firewall policy c

Hi We have a vip server facing outside of our company. I created a policy and enabled waf with all high severity enabled. When a user from outside submits a form, FGT waf recognizes it as sql injection extended and won't let the user submit the form and webpage crashes after. What should i do?

Hi   I have configured ipsec remote access vpn and I want to allow only IPs from united kingdom to be able to connect to my FGT. how can i do that?

Hello Everyone,   I am looking into how to connect several sites to each other, who all have a primary broadband WAN connection and a 5G backup WAN connection, all with static IPs. Our current site-to-site connections are only configured to use one WAN connection on each end, so when the office broadband connection goes down on occasion, the office has internet access via the 5G but no VPN access because it is configured for the single interface. There seem to be multiple paths i could take here and none of them seem as simple as i thought they would be.    Our network mainly consists of all Fortigate devices. F40s, 60Fs, a 61F, a 71F, and some 81Fs at our two data centers.   Approximately 15 of our sites, including our data centers, LANs are already connected to eachother via L3VPN managed by Windstream, connected to their SDWAN solution, VeloCloud, and routed to eachother via BGP.   The other 15 sites are not on any kind of managed SDWAN solution at this time

I upgraded our FortiClient EMS server from 7.2.2 to 7.2.3 on Friday, but the new FortiClient 7.2.3 patch is not available to push out to clients even though "Keep updated to the latest patch" is selected for the deployment package.  I know I could create a custom installer and manually download the new client, but I haven't had to do this previously.   Previously, I would receive an email notification from EMS that a new FortiClient version was available, I would be able to see the new patch in the deployment selection list, enable auto update, and all endpoints configured for that deployment package would update.   This time around, I just happened to notice FortiClient 7.2.3 was released on the website, so I upgraded EMS to 7.2.3 and expected FortiClient 7.2.3 to be included as a deployment patch option to select, but it isn't.  It's been 3 days now and EMS still hasn't downloaded FC 7.2.3.  Am I just jumping the gun, and FortiNet has not yet made it availabl

Hi All,  I'm familiar with the CLI commands to move policy IDs before or after another specific ID, but is there a way to script a move a newly created policy to the top, regardless of what the other IDs are?  I'm trying to create a script to add an ISDB block rule to the top of every policy list on about 40 FortiGates via FortiManager scripts, because this environment isn't yet using standardised policy sets so IDs differ from location to location.  e.g. below: # creating a new policy is simple enough:config firewall policyedit 0set name "** Block IP Reputation DB **"set srcintf "any"set dstintf "any"set srcaddr "all"set internet-service enableset internet-service-name "Botnet-C&C.Server" "Malicious-Malicious.Server"set schedule "always"set logtraffic allnext# But here is where I'd like to avoid making 40 manual changes:move !bottom to !topend Has anyone had this use case or something similar before?

Hello everyone I turned on the IPv4 DoS Policy module on my 60F a few weeks ago. So far, I have created one "monitoring" policy only for packet flows above certain thresholds (other than the factory ones, of course).At the beginning, I gave some small thresholds and I try to observe it all, possibly increasing the counter thresholds if I see when some desired service exceeds them. Sometimes the "test" policy catches an "anomaly" udp_flood from IP addresses 46.134.193.80, 142.250.186.194 or 173.194.164.202 (Google) having counters at the level of counters for sources with real threats. I don't really know what could be the cause of such behavior... I don't think there are any real "attacks" either. Maybe some hints? Below are two sample logs. Do you also use DoS Policy? What meter thresholds do you use for a small network of ~20-25 computers? I know that this is an individual approach for each case, but maybe at least some indicative range as it is with you. date=202

Hi All, I've been trying to figure out what Online and Offline exactly means in FortiClient EMS. As I can see, if I keep EMS connected at the FortiClient end, it will be shown Online, no matter what the VPN connection status is. If I manually disconnect the EMS from the FortiClient end, it will be in Not Registered list. So, what does Online and Offline exactly means here?  Thanks for any help.

Hello,I have use my phone SONY 1 V , Android 14,and newest Forticlient VPN app,then I need to connect VPN but app show error:revoked by android reboot,what can I do to deal with this problum?

Dear support We have Forti SIEM version 7.1 and we are prepared threat intelligence for MISP project and we need to connect the FortiSIEM with MISP to pull the IoC's i you can help us to provide us the steps with details 

I purchased a used FortiSwitch 108D-POE but have been unable to perform a factory reset on it. There is an unlabeled reset button on the left side of the front. Pressing and holding it for 60 seconds or longer has no effect. I have also tried unplugging it and holding the reset button down while it boots. I have tried pressing and holding the reset button for 10 seconds right after a reboot, and also tried the same after waiting five minutes. In its current state, when I connect it via port 10 to my laptop (set to 192.168.1.2), I get a link activity light but I cannot ping 192.168.1.99 nor access it by HTTPS or SSH. Looking to factory reset it so I can gain access to it. Thanks for any tips or suggestions!     

Hi All, In FortiSwitch OS, you can nicely search in the Forwarding Table under Switch: Monitor... but it seems like it 'only' support wildcard searches.Is there anyway to specify 'exact' searches or 'vlan=NNN' searches? If not, in my world, it calls for a feature request.   I often need to see what is on port1, not 'port1-19', or what MAC's is on a specific vlan, and putting '10' for vlan 10 into the search field gives me vlan 10, MAC's including '10' and port10... ;) 

Hi FortiSOAR team, I try to connect fortisoar to cisco ise server.I've created an api user in cisco ise. By using this user, I make api call from both python script and postman. But when I try this credential in connector, I get 401 error.What is the missing or wrong?FortiSOAR  

Hello everyone! Please help me if anyone has experience or worked with implementing Fortinet ZTNA. I want to implement ZTNA in my network. but I don't know which subscription is necessary for that. Do I need valid subscription on my FortiGate? which subscription should I purchase for Endpoints or Forti Client EMS?  Any of Fortinet Support Can help me? I need a Comprehensive guide, please. Thanks. 

Hi I want to exempt one of my local web server facing internet from SQL Injection (Extended) signature , because it causes so many errors when users want to submit forms. How can I do that?

Hi Everyone , I am facing a strange issue with sync rules. I have created sync rule to import the remote LDAP users. Sync is not happening correctly  because it does not reflect the correct users of the remote LDAP group.I move the user to another OU  which is not part of the filter and the user is not removed from the group. I have also deleted the user for test purposes and user still remains in the remote users. 

Hello there! related link:wpa3-enhancements-to-support-h2e-only-and-sae-pk-7-2-1  I have recently purchased Fortigate 40F together with FortiAP 231F, to set up a WLAN environment in my laboratory to test iot equipments. What I am interested in is "SAE public key" as introduced as part of WPA3 R3 spec, and it is introduced as a new feature since FortiOS 7.2.0. My question is:Has anyone ever tried to associate a SAE-PK-capable STA with a FortiAP(7.2.1 or newer) that support SAE-PK? If so, is there any tutorial simple enough to guide us through the first integration with regard to this SAE-PK authentication. For example, how to configure wpa_supplicant and what is the wireless sniffer capture like? P.S:Whenever I unclick the local standalone option, the SSID turns OFF automatically.Somehow there is a rule between the "SAE-PK authentication" and "local standalone" parameter?However, it can be found nowhere in any document. Thank you very much, experts.

Hi   I have 2 wan links in a sdwan zone. I also created a sla check to 8.8.8.8 and selected the manual mode on policy. So if one wan link fails the defined sla, is that going to failover to other wan link automatically?

Hello, How fortigate DNS setting should be configured when there is a central AD DNS server in network, all pc computers get DNS from AD DNS server, so I configured Fortigate DSN to point to AD DNS server, and on domain DNS server I configured forwarder to 8.8.8.8 - it this good? I thought to configure in different way, I mean, point AD DNS forwarder to Fortigate IP, and on Fortigate DNS set any public DNS servers, but I couldn't configure it, I had not internet. I don't know how to configure ipv4 policy from AD DNS server to Fortigate itself, and without that as I said my all computers did not have internet access. Please advice me, thanks.

Hello, I was wondering if someone could shed some light on how the following can be achieved, if it can.When 2FA is configured for users that are connecting to SSLVPN, that are either via RADIUS/FortiAuth/FortiToken or using a 3rd party OTP app, I noticed that you can change the banner message that is being displayed in FortiClient, specifically instead of the standard from below to a custom one: Enter token code or no code to send a notification to your FortiToken Mobile  Can anyone point in the right direction on how to achieve this ? I searched in the Replacement Messages in FortiAuth and FortiGate, but couldnt find it.Thank you.

I've had 2FA working again Authenticator for some time but recently was tasked with turning on the push notifications but my FortiClient does not have a "Push" button and I really never knew it was supposed to. I thought when you made the authentication request (logged in when prompted by the VPN config) that it would go ahead and ask you to input the token AND still accept the push, but from the 6.4.8 Release Notes it would appear that I should have the option to select "push" OR to enter my code:   To connect VPN with FortiToken Mobile using push notifications:1. On the Remote Access tab, select the VPN connection from the dropdown list.2. Enter your username and password and click the Connect button. The Click on 'FTM Push' or enter token code box displays.3. Click FTM Push. Your device with FortiToken Mobile installed receives a notification.4. On your device with FortiToken Mobile installed, tap the notification and follow the instructions to allow the authentication request