Solved

Hello, it looks like I am doing something wrong and I was not able to find my answer on the internet, so please if someone could enlighten me :)I have web server, behind nat. Rule set like this:incoming: wanOutgoing: lansource: alldestination: virtual IP of the serverservice: httpssecurity profiles: ips high security (modified to quarantine most threats)    ssl inspection: specific "protecting ssl server" profile From time to time when there is IPS attack blocked, the IPS puts into quarantine the internal IP of the web server (ie. 192.168.x.x , it is visible in quarantine monitor and can be removed there manually). See below ips log - i suppose the "source" should be blocked, and not "destination" :( Do you please know what am I doing wrong?Thank youRegardsMartin

Hello, I have a Fortigate 401F that I currently have access to via the mgmt interface. This interface is connected to one of my core switches (catalyst 9300) via cat6 and I can reach it at 10.Y.X.115/25. The Fortigate and my switches are all in the same subnet 10.Y.X.0/25I can ping the Fortigate from every switch in my network, so I know that all the switches can reach the fortigate. My question comes into play because I am attempting to use the x3 interface (with an SFP transceiver from Fortinet) to connect to one of my switches (for example, SW-30). I have fiber run from SW-30 to the MDF in my primary server room, and when I plug in my NetScout, the interface on SW-30 comes up.When I insert the fiber into x3 on the Fortigate, the interface on SW-30 goes down, and x3 continues to stay down.At first I thought this was because x3 does not have an IP assigned to it, but when I attempt to put it on 10.Y.X.31 /25 it says I can have it on the same subnet as mgmt.I will admit I am

date=2023-12-13 9 time=11:56:25 devname=FGT200xxxxxxxxx=FG200xxxxxxxxx eventtime=1885229385635990681 tz="+0100" logid="0122032002" type="event" subtype="system" level="alert" vd="root" logdesc="Admin login failed" sn="0" user="admin" ui="https(89.248.192.55)" method="https" srcip=xxx.xxx.xxx.xxx. dstip=xxx.xxx.xxx.xxx action="login" status="failed" reason="passwd_invalid" msg="Administrator admin login failed from https(xxx.xxx.xxx.xxx) because of invalid password"     How can i block that IP on FORTIGATE?

Hi community,   I have a problem regarding authentication via TACACS+ on FGT units (FGT40F).I have two WAN interfaces, but their're no members of a SD-WAN.   If the primary interface goes down, the login via TACACS+ is not possible anymore.Also I configured the same lines on the secondary one. Here is the entire TACACS configuration:   config user tacacs+edit "RAGTAC1"set server <ip of primary server>set secondary-server <ip of secondary server>set key ENC vnm4VKB0FI5aNL1cBxRAngfqZtn75GS2aLWuFn7Va7KhhK0avUJGMG/JHVRyy+AGFKKvJ7xbAuDmM4+V6m4iTv76iUGgMssbNKpcBq+BLcluknE61I5r6emPmIwu6J04hP+qWiglAlc/QlA==set secondary-key ENC xBDZhp1GT9MnrQpkBHe342XbjGcb/YLoMHuXP5PmK7ALnDEvUmYcsEGy+4BJmJZdDKRX56sJWXzIbVmYEPwekPgXWlECqGWkPnMnoVyanbFrsoZG1xE0w==set authen-type asciiset authorization enableset interface-select-method specifyset interface "wan"nextedit "RAGTAC2"set server <ip of primary server>set secondary-server <ip of secondary server>set key ENC fI8pEqi

I recently acquired a Fortigate 80F firewall appliance and have been working on configuring the Librenms system to retrieve certain metrics from the 80F. I have successfully set up the SNMP protocol and can view most of the interfaces on the Librenms dashboard, but unfortunately, the WAN2 and only WAN2 interface is not appearing. The firmware version I am using is v7.2.6 build1575. here is the screenshot from librenms I would greatly appreciate any guidance on resolving this issue. Thank you!

Hello to all,I would like to secure a bit more our traffic from Clients to internal Servers.What are your recommendations with applying security profiles between clients and servers.We have restricted only certain ports etc but would like to implement Security Profiles as well.Can't seem to find something on these topics.Also topics for security profiles differences for clients and for servers specficily for outside access to internet

Dear All,          Would like to ask if i have dual internet circuits and want to enabled link redundancy and no load-sharing, and i have followed below guide and seem work as expected, but i have one question, if wan1 down, and its will failover to wan2, and if wan1 resumed, will it be able to failover back to wan1 itself ? would it be possible to achieve that ? https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/360563/dual-internet-connections#Security Piaakit 

Hi everyone,I want to create a geo-cluster.two of the FortiGate are in one location and another FortiGate is in a different location.do I need to create a specific VLAN for the ha traffic? and if I do need it, which subnet should I choose for this vlan?Thank you

Hello community,Since 2 week I  update Forticlient from version 7.2.1 to 7.2.2 but using the package with Intune all new installed computer ask Key for telemtry, and because I have a lot of computer I can do one by one, is there any way to insert Telemtry key using command line ? then I can write a script can be used with Intune for all installed machine. thanks a lot thanks 

Hello,Could you please help me if there is any possibility to copy the complete settings of one ADOM in FortiManager to a newly created ADOM? Thank you very much.

Hello guys, I played a bit around with the Split-Task VDOM Option on a new Fortigate we received. However I just read the following in another forum post: "Just a side note, not an answer to your questions, the Split Task mode was discontinued in the FortiOS 7.2, and will no longer be available"Does anyone know if this is true? Will the Split-Task VDOM Option be no longer available with 7.2?Thanks!

Why can I not see the interface config in the show or show full-configuration CLI outputs? There seems to be a relationship between the following 2 command formats:show <<pathway>>config <<pathway>>So for instanceconfig vpn ipsec phase1-interfaceshow vpn ipsec phase1-interfaceThe <<pathway>> paragraph can also (usually?/Always?) be found in the show  and/or show full-configuration CLI output.  This relationship holds for the <<system interface>> pathway but this configu is missing from from the show and show full-configuration.I am speaking of the production VDOM in this case (FG-traffic) as you can see below) but I have checked the root VDOM as well. Nothing.What am I missing?

Hello all! I'm trying to delete a Fortigate device from FortiAnalyzer in the GUI but it results in an error message: "deldeverror". Have anybody any idea why I can delete the device?  

Hi i followed this docs https://docs.fortinet.com/document/fortigate/7.0.11/administration-guide/556915/installing-firmware-from-system-reboot to installing firmware from system rebootbut it doesn't show step 10. and show Fatal error: Loading FOS fails!i'm sure the firmware was upload success from tftp serverand the firmware filename is FGT_100F-v7.0.11.M-build0489-FORTINET.out also i tried this https://community.fortinet.com/t5/FortiGate/Technical-Tip-Installing-firmware-from-system-reboot/ta-p/190793 but it doesn't have "G" optionPlease help me.

I assume that the layer3 interface is tagged with vlan 1? What happens if I put an access vlan on a another switch port that is connected to this firewall port?

Hi,If I wanted to return to NAT mode after configure the Fortigate in transparent mode with firewall policies, security policies, etc.. What are the steps?Obviously remove the commands of transparent mode and assign ip addresses on interfaces. Other things? Thanks

Hi,   I ma trying to allow inter-vlan communication in firewall policy and wrote this policy. is that correct?     config firewall policy edit 6 set status enable set name "Vlan--->Vlan" set uuid 19f0b5c8-93f3-51ee-dc48-59756c056159 set srcintf "Vlan3" "Vlan20" "Vlan30" "Vlan40" "Vlan50" "Vlan60" "Vlan70" "Vlan90" "Vlan100" "Vlan101" "Vlan110" "Vlan172" set dstintf "Vlan3" "Vlan20" "Vlan30" "Vlan40" "Vlan50" "Vlan60" "Vlan70" "Vlan90" "Vlan100" "Vlan101" "Vlan110" "Vlan172" set action accept set nat64 disable set nat46 disable set ztna-status disable set srcaddr "Vlan100 address" "Vlan101 address" "Vlan110 address" "Vlan172 address" "Vlan20 address" "Vlan3 address" "Vlan30 address" "Vlan40 address" "Vlan50 address" "Vlan60 address" "Vlan70 address" "Vlan90 address" set dstaddr "Vlan100 address" "Vlan101 address" "Vlan110 address" "Vlan172 address" "Vlan20 address" "Vlan3 addres

Hello   i want to know   what are the steps to configure reverse-proxy in fortigate ?   i wait a reply from expert fortigate   Thanks     

Hello Expert,   I have to two fortigate 400e in HA setup, but I am unable to connect to standby one when I use the Management port on the device, How can I log into the device when it is standby mode?.   Thank you   Regards

I know this in an unsupported configuration, but I have a bunch of old firewalls that are running 6.4 firmware and no matter how hard I push, I haven't been permitted to upgrade them.  We will be swapping out hardware soon to new firewalls but that is going to be a slow process.  I have a FortiManager running 7.2.2 and have tried to add FortiGates running 7.2.6 firmware, but they fail every time.  I wanted to upgrade the FortiManager to 7.4.1 but wanted to leave the 6.4 ADOM in place.  We don't use FortiManager like we should, we are using it like a backup solution and importing the policy packages from each of the old firewalls.  The new ones we are rolling out will be managed by the FortiManager, but I need to still backup the old firewall configs.  If I upgrade FortiManager to 7.4.1, can I still run imports on a 6.4 ADOM?

Hello to all, I need a little help with configuration of captive portal for our SSID for guest.I already created everything, user, add it to group, create SSID with captive portal, create policy for network access and it's working perfectly.Now the only problem is that I can't find a way to set and test authetication timeout.It only asks for authetication on the first login with the new device, even if I configure set auth-timeout 2 (2 minutes for testing only) and it is still logged in and have access to network. Also when I forget the network and connect again it doesnt ask me for authetication and don't display Captive Portal.Any help is welcomed :)

We would like to be able to better identify users with our Fortigate, when we view FortiView, rather than just getting IP addresses to hunt down. Sometimes, the device name is shown, but not always and often I have to hit "Sources" under FortiView a second time for that to happen.  If Fortigate can't do that , on it's own, is there another product or plug-in that would facilitate this ?  

Hi guys, In fortisiem, some of the log sources are sent to supervisor and some to collector. Is there any way to see this on the GUI other than getting a dump?

HiI have all my interface vlans on my 200f port1 and I am looking for a way to config mgmt port to connect to fortigate. What should i do?

Hello all,Can Fortigate syslog receive routing or VPN "configuration change" notifications?I know that syslog can receive status change notifications, and change notifications can be sent via email alerts, but I don't know if syslog can receive them.I've checked, and I don't seem to have seen any instructions for this.