Solved

Hi there,I have updated the Fortigate 101F to version 7.4.X. Since then there have been problems with the homeoffice access points FAP-C24JE.Whenever the routers get a new WAN IP, all devices on the LAN ports of the APs are offline or cannot connect to the Internet or the Fortigate.The AP is displayed as online in the FGT and the WLAN clients can also connect and are online.It seems as if the AP has forgotten the configuration for the LAN ports.After restarting the AP, everything works again.

Hi All, We are setting up a new Virtual FortiGate for use as WLC, and I have enabled Advanced Wireless Features. 1: The GUI in FG 7.0.n - 7.4.2 has a time-display bug:When running on 24-h system, editing a schedule still show time as 12-h am/pm input in the schedule editor.Time shown in Schedule List: Time shown in Editor: Time shown in CLI, when editing Schedules there, is in 24h format..  2: Time Schedules does not seem to manage the FortiAP LED's?First off: The schedule seems to control when the LED's are ON - right?Second: When I enable LED Enable and set a schedule, it seems that the LED's does not turn on/off within the minute of the time set. If I set a schedule, that turn off the LED's, they turn off instantly, same if I remove the schedule so the LED's turn on.When the schedule then hit the target time to tunr on/off the LED's, it's not happening.. at least not within the same minute..So, to understand this:Is this schedule pushed to the AP's

Hi!   I have got a fairly simple question, the situation is as following.   We have two core server/network-rooms inside the same building. Each room has a FortiGate Firewall and a MikroTik or HPE core-switch. Between these two switches we ran a 10Gbit fiber.   Can I setup HA (Active/Passive) on a Fortigate 70F or 80F over a VLAN between these two sever/network-rooms over the core-switches instead of directly interconnecting the heartbeat interfaces?   The last thing we want is issues like a split brain. How stable is a solution like this?   Best regards, Tim   

Hey All Has anyone come across the issues with pushing templates to the latest firmware. Looks like there are settings required in the new up date (7.4.2) but are not set on the Forti manager   Copy device global objects Post vdom failed: error dot quic- inspect:-999 - invalid value - prop[quic]: binary option(inspect) Copy objects for vdom root This make sense that it is to do with the ssl profile but cannot find what setting it is pointing too

Hi,     I am new to the fortigae 100F. I am trying to setup my laptop to access the internet. My issue is that from my laptop, i can ping 8.8.8.8 but i cannot surf any of the webpage.    Does anyone have any idea what could be the most possible issue?     Secondly, i discovered this firewall rule that cannot be deleted. Will this rule does anything?    Really hope someone can enlighten me, Thanks 

Hi Guys I've a problems with vDOM on FortiGate 60E 1. I did not see Virtual Domain option in System Operation Settings" section but I can enable vDOM on CLI.    I tried to enable on CLI with the command below, it's not working. config system global set edit-vdom-prompt enable end 2. I did not see vDOM type option (Admin and traffic), how can I enable it?3. I got a message when I try to enable it. FortiWiFi (settings) # set vdom-type adminadmin type cannot be set on the FortiWiFi.node_check_object fail! for vdom-type admin value parse error before 'admin'Command fail. Return code -651

I have configured destination IP detection using IP Reputation on FortiGate. I detected IPFS.Gateway at Reputation Level 2. I assume that IPFS.Gateway is classified at Reputation Level 2 because it involves peer-to-peer (P2P) communication. Could someone confirm if my assumption about the expected content is accurate?

Hello,I'm trying to grab IP address from the log after ssl-login-fail and create new Firewall->address and append it to existing group using CLI script:Log event looks like this:date=2024-01-17 time=11:11:19 id=7325007792115286044 itime="2024-01-17 11:11:19" euid=1049 epid=3 dsteuid=3 dstepid=3 logver=700130566 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="admin" remip=5.153.183.36 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_permission_denied" eventtime=1705486279485398543 tz="+0100" devid="FG100E4Q17012295" vd="root" csf="TCCM_SF" dtime="2024-01-17 11:11:19" itime_t=1705486279 devname="EDGECLUSTER_FG100E" I see that IP address in question is named remip My script follows:config firewall address edit %%remip%%_SSL_VPN set subnet %%remip%% 255.255.255.255 next end config firewall addrgrp edit Banned_SSLVPN append member %%remip%% nex

I am currently trying to configure FortiNAC to authenticate 802.11 for devices using Wifi. The topology is as follows: Client -> Cambium AP -> Forti NAC (Radius) -> Active Directory (User Database). FortiNAC has been configured to join AD and LDAP authentication has also been integrated with AD. When the client sends an authentication request, the log on FortiNAC may show some errors such as:ERROR: No NT-Domain was found in the User-Name rest_reject: EXPAND Registration - Access Deny (Post-Auth) rest_reject: --> Registration - Access Deny (Post-Auth) rest_reject: Module-Failure-Message := “Registration - Access Deny (Post-Auth)”I’m not sure where I have misconfigured this. Please help me resolve this issue. I also attach detail log for deeper analysis in the follow linkhttps://drive.google.com/file/d/1EdOrojp-KYVcHPYxujuEdkmjEBjYpiKD/view?usp=drive_link

Hi all ¡¡ I'm trying to configure an email alert when WAN2 interface from my fortigate with 7.0.11 goes dow, but its not working. Probably I'm forgetting some steps or doing something wrong. This is the article: Technical Tip: E-mail alert when WAN interface wen... - Fortinet Community I attach you my trigger, action and stich. I have tried it using the LOG ID 22922 as in the example. Cause it doesn't  work I've noticed that the event ID changes in my FW (I attach you an image). I've changed it. Finally I attach you my mail server configuration (default configuration).  What am I doing wrong? The mail doesn't arrive (I've checked the spam folder).Thanks ¡¡      

Hi Community Member,   Hope all are doing well. I am currently facing an issue with FortiSIEM office365 integration I have followed each steps in the below provided documentation but still unable to fetch events. Appreciate if someone has come over resolution. followed docuement: http://docs.fortinet.com/document/fortisiem/7.1.1/external-systems-configuration-guide/514932/microsoft-office365-audit   Issue screenshot is attached <forum admin removed screenshot as may contain sensitive information>

We're building a new network and need to support directed broadcast messages. Essentially, some broadcast traffic shall need to be forwarded between different network segments. From my research, I believe our FortiGate firewalls will support the forwarding of this broadcast traffic through the configuration of a multicast policy. However, we will also be using FortiSwitch network switches. My question is, will the FortiSwitches support the forwarding of this broadcast traffic when managed through FortiOS via Fortilink? I have provided an example diagram below to illustrate, broadcast traffic from Host A must be able to reach Host B. Thanks :)

Hello team, I have an argument to share and would also like your opinion.If I create a wildcard FQDN object *.pluto.com qwhen the client does dns traffic I also get sub domains resolved for example foo.pluto.com duck.pluto.com etc.Now if by chance a subdomain is malevo this is resolved anyway and the fqdn wildcard object is updated with the malevoo ip. What advice can you give me to fix this problem? Or maybe it is not necessary if you configure other security profiles ad hoc? ThanksBR

Hello team!!! I hope you are fine!I have the following question, if I configure an sd-wan rule with the "maximize bandwidth" strategy, configuring in the cli, the "set hash-mode inbandwidth", how fortigate determines the interface with most available bandwidth if I have no licence for "SD-WAN Network Monitor" ?Is it possible? Thanks in advance.Regards!Damián

Hi Folks! Need to know the CLI command to check the FSR current version. Regards,MBF FortiSOAR 

Hi all,   Is there a way to restrict SSL-VPN access solely to the FQDN, disallowing users from accessing the web portal via the IP address? We prefer users to only use the FQDN for access. OR Can we use multiple server certificates that cover both IP and FQDN, eliminating certificate warnings?   Any lead?

Hello all,  Affected: FortiOS 6 to 7.2.4. Webbrowser, Devices, everything that is not Windows.If you have Certificate Inspection, deep inspection enabled, Windowsupdates are not possibel anymore. To only way is to import the CA in the Fortigate. But the question arises, why was this CA not integrated into any Windows devices? Example: https://sls.update.microsoft.com i noticed that the Microsoft Update Secure Server CA 2_1 certificate is not trusted by Fortigate.But not only that. This certificate is not trusted at all. From no device, no website, no tool. Only Microsoft Windows itself has this CA on board. How can that be?  https://www.ssllabs.com/ssltest/analyze.html?d=sls.update.microsoft.com&s=52.165.165.26&hideResults=on openssl s_client -connect sls.update.microsoft.com:443 CONNECTED(00000003) depth=1 C = US, ST = Washington, L = Redmond, O = Microsoft Corporation, CN = Microsoft Update Secure Server CA 2.1 verify error:num=20:unabl

Hello all,  i'am using here a Fortigate 60E with some Fortiaps 433F. The Fortgate is linked with LDAP and Radiusserver. WLAN Entperprise WPA2 and WPA3 works with this auth methods:  TTLS + PAPTTLS + GTCPEAP + GTC I have tried to find reasonable info's as to what the difference is, but have not found it. So my question is: "What is the difference between the methods, what should I use?". Thanks a lotBest Regards :)

Hello, I cloned the existing "Windows Security Log Cleared" rule in the rules and created it in a new name, only I made the within value 120, not 600, and made the rule in the default disable. However, this time, when the rule was triggered, it created an incident with the name in the default and gave a sync error error in the rule. What could be the reason?

Dears, What is the best way to connect a TP-Link 1600 VDSL ISP router to a FG90EI want to use the FG for VPN, DHCP and other policies. the ISP router is providing a nated IP 192.168.0.xI tried connecting a wire from the router to WAN1 port after disabling DHCP on the router and set a static IP on the WAN port, is this the way to go or I should be doing something else? I read posts saying that I should be changing the connection mode to bridge. what is your recommendation  Thank you in advance  

 Hello, All my users are in a LDAP group "Users".All my admins are in LDAP group "Admins" and "Users" I have a SSL VPN portal for all users (Group Users).I have created a specific portal for all admins.But the admins are recognized like simple users. They are a possibility to do this ? Because i tried to change order but nothing change, my admins are seen like simple users. Thks

Hello everyoneI am running a Fortimanager with 7.4.2On the Fortimanager I have div ADOM.I have entered an address object in an ADOM (Any Interface) and want to synchronize it with the Fortigate (100F). Now that works. Does anyone have a tip why this does not work?

Hi All,I have a syslog server and I would like to sent the logs w/TLS.My syslog server has a certicate assigned to it from my local cert authority which is a Windows CAI uploaded my cert authority cert to the Fortigate but still does not work.THas anyone gotten TLS syslog to work when the CA is a local Windows CA that shows under remote certificates?

We are doing FSSO on a gate. I have DC agents on the AD servers.  In the external connector FSSO Agent, the user group source is set to Local LDAP with proactive retrieval enabled. The gate sees all the users, no problem there. In my FW policy we want to allow ALL authenticated users. What is the most scalable way to accomplish this without having to manually add new individual users to a defined group or directly to the policy? Would changing the config from Local LDAP to Collector Agent work ? Thanks for any help here.    

 Is it normal for a private virtual machine not to access the internet in edit mode?The license wants to verify but cannot verify because there is no access?Also how can I connect the virtual machine to my local license server?