Solved

HiI have all my interface vlans on my 200f port1 and I am looking for a way to config mgmt port to connect to fortigate. What should i do?

Hello all,Can Fortigate syslog receive routing or VPN "configuration change" notifications?I know that syslog can receive status change notifications, and change notifications can be sent via email alerts, but I don't know if syslog can receive them.I've checked, and I don't seem to have seen any instructions for this.

We need to access our server via VPN and internal Network only, no need to access an external network, Please suggest the following steps to access our server port.  

Hi Everyone, Our company is running FortiEDR and FortiClient.  FortiEDR detected AsyncRAT and WGZ!tr on one of the workstations.   In FortiEDR, the device was moved to the High-Security Collector Group with the protection enabled. However, the vulnerability scan using FortiClient Endpoint did not detect the AsycRAT and WGZ!tr.   What can cause these inconsistencies and how do we resolve this?   Thanks for your responses.

Hello to all,I would like to know you're best practices and approaches on configuring Firewall Policies to be as restricted as possible.I want to restrict access as much as I can.Examples would be to allow only certain Services for certain Servers (for DNS servers only port 53 etc), For Pirnters only SMB and so on.From Clients to Servers also only needed services for specific Servers (AD, Print Servers, File Servers)IT to have adminsitration rights for all serversRestricted for others that don't need anything else that servicesI think you get the point what I want to achieve.We already have something like that for  our branch office, but I want to see if there are some better recommendations.And also I don't have zoning concept. Don't know if granular restrictions can be a lot of work with zoning since I'm going to have few VLANs etc. This is an example of our branch office: Like this our Firewall Rules are getting larger and more difficult to manage.over 100 rulesBest R

Hi youI cannot access some websites using Chrome browser, but other browsers like EDGE or Firefox are normal.I Determined the cause was due to the Web filter and created a ticket for the Fortinet but it has not been resolved. Can anyone help me fix this error? Chrome reports an error ERR_TIMED_OUT

Hi, I have created a schedule as follows and assigned it to a policy but after time reaches to 06:00 PM the policy do not disable. config firewall schedule recurring edit "DNat Schedule" set start 08:00 set end 18:00 set day sunday monday tuesday wednesday thursday friday saturday set color 6 set fabric-object disable next end 

I followed these steps to import a CA certificate and key for decryption:   https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-import-the-CA-certificate-for-full-SSL/ta-p/189786   The certificate now shows up in Local CA certificates. However, in FortiManager > Policy & Objects, I do not see this certificate as available in the SSL Inspection profile.    How can I use this certificate for SSL decryption when configuring from FortiManager?   If I try to do it locally on the firewall, the CA certificate is available in the profile, just not in FortiManager.   Thanks,

Hello,  I get a remote server certificate validation error when connecting to our VPN provider. I checked their certificate with https://www.sslshopper.com/ssl-checker.html#hostname=healthconnect.vpn.cloudgateway.co.uk, and it seems to be valid and issued by the GoDaddy I linked Ubuntu's certificate storage as suggested in https://community.fortinet.com/t5/FortiClient/Technical-Note-Certificate-warning-when-connecting-to-SSLVPN/ta-p/197402 but to no luck, as you can see on the screenshot below.   This is with #forticlient vpn 7.2.2.0753 on Ubuntu 22.04 Any tips are appreciated!  

Hi, I have created a SD-WAN and put 2 WAN links as members in SD-WAN Zone. I want to have Dnat some of my servers and created a virtual IP pointing from Valid IP address of WAN1 to my internal server. Then I went to firewall policy and created a policy to allow Dnat, but when I want to select WAN1 port as incoming interface, it does not show the wan1 port and only shows the SD-WAN port instead. I should mention that I want to Dnat from valid IPs from my WAN1 to internal servers. what is the problem? Thanks.

hi,just wondering if i can delete the "lan" hardware switch in a fortigate 40F?can't seem to delete it even when it's disabled.i'm trying to do this setup:WAN: internet/ISPA: HAport 1: MGMT (out of band)port 2 and 3: 802.3AD aggregate/Port-Channel to switch the port-channel interface (ports 2 and 3) will be my "inside" interface with a private layer 3 IP.is this scenario possible? appreciate your advise.    

Hi,   Someone know what means interfering SSIDs in my dashboard ?   In my dashboard it show me many "High" interfering SSIDS.

Hi   We have 2 Vdoms in our FortiGate and I wanted to backup my device. So should I backup only the global or all 3 of them individually?

Hello, We received a "set_dns_retcode" error on one of our devices while installing the collector, but when we ping over the hostname, it resolves the ip. what can we do?

Hi,   If I select manual mode on sd-wan policy, in what circumstances fortigate changes the wan1 to wan2?  As far as I know, there is no SLA in manual mode. So when the wan1 link has high latency and lots of packet loss, how it is going to change the WAN link?

Hello i want to know how fortigate can work with layer 7 ( layer application ) !!  or what are feature security that allow fortigate work  with layer 7!! i wait a reply from expert security Thanks

Steps to reproduce.   Use Phishing Email solution pack and enable extract attachment option on. Exchange Mailbox defaults to HTML format for emails. Create a text file and add a line into it like "https://gumblar.cn" Attach above text file and send it to the mailbox, which is configured to read emails through Exchange connector. Observer "03 Enrich - Extract Indicators From Attachment" Playbook. In "result" key , we will see a value as "https://gumblar.cn/<p>" "<p>" is getting wrongly appended to the url. Test Playbook is attached with sample string for testing, please unzip it and import into playbook collection. Screenshot is attached.

Hi I have port1 (LAN) and created 10 sub-interfaces for Vlans. So in Source interface selection box on all fortigate configuration, should I select Port1 or should I select Vlan interfaces?

Hello, I have a problem with the OneDrive Application.OneDrive not sync the all files.I think the problem comes from the HTTPS inspection. FortiOS : 5.4.5 Thank you for your helpCordialy,

Hi,   I created a traffic shaper and applied it on a traffic shaping policy and hit ok. but when I open the policy, it is empty but from outside as you can see in the image , source and destination and all other information are available. what is the problem?    

I bet that I am missing an simple solution. Via the FortiGate, I would like to filter for ports that are Down on one or more managed FortiSwitch's using the WiFi & Switch Controller / FortiSwitch Ports page. The column Port displays the port number and the up/down status. I see that I can use the funnel to filter by port number. Can we filter by up/down status instead? If not here, is there another way to accomplish this?

Any ideas why I get "entry not found in datasource"? The cert is present:       config vpn certificate local edit ourCA get Valid from: 2022-xxxx Valid to: 2024-xxx Root CA: Yes CA:TRUE state : OK range : vdom config firewall vip edit rule2 set type server-load-balance set extintf xxx set server-type https set extport 443 config realservers edit 1 set ip xx set port 443 next end set ssl-mode full set ssl-certificate "ourCA" end # set ssl-certificate "ourCA" entry not found in datasource value parse error before ourCA command fail. Return code -3          

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/388078/transfer-a-device-to-another-forticloud-account   In this article is guide to transfer one device. How to transfer both devices? I have tried and one device has been transferred. Backup device have status that is transferred, but it does not appear on Cloud Asset Management.   

Hello everyone,  I have some questions about how to configurate a Vlan for CCTV IP. Currently I have one only Vlan for my all devices, but for security I wanna implement a second Vlan for security cameras, my questions are: 1. if a wanna create a second vlan, Will I need another switch? 2. Will i need a administrable switch?3. in case of no, what i need for this implementation? sorry but i have some questions, than if you can, please add a connection graphics. or if only needs configuration in fortigate please tell me. 

Dear Team,Whether FortiSIEM support the default logon report of Supervisor/Collector Terminal/CLI?I know that FortiSIEM GUI(admin) supports a Default Report "All FortiSIEM GUI Logon Attempts",But I can't find any report that shows the logon of Supervisor/Collector Terminal/CLI.I would like to know whether this default report exists.Or How I can create a report template to meet it.