Solved

Hello guys, I'm new here.I have a doubt about default value for hb-lost-threshold, from experience I notice that virtual FortiOS has 20 and physical ones 6, but I don't find any documentation about that difference.I compared the values of some clients that I manage, but I need an official document to support me in making a change recommendation on cluster hosted on Azure. I'm confused because even the Admin and CLI Guide in the same FortiOS version 7.2.5 diverge about the default values, informing 20 and 6, respectively.Admin Guide on page 2346CLI Guide on page 1255Can anyone clarify or have any documentation on this?Roni MatosFCSS - Network Security

Hi   Currently, all interface vlans are on cisco 3750 switch and I want to move all interface vlans to fortigate. I have created all sub-interfaces on fortigate but do not know how to move them all to fortigate. Also what should i do about switches vlan ? All access switches's default gateway is the interface vlan on 3750.

Hello. I'm inquiring because I found something strange while setting up the product.The model is 101f.I test in IDS mode  (license retention) , I used 4 sfp ports and set up 4 spins.But the power (state) LED doesn't turn on. The product UI all works normally!! The version 7.2.6. I tested the LED with HQIP and the LED turns on normally. When it reboots, it turns off again.Is this a bug? Or does it turn off when it's IDS mode operation? This version also has bugs where HA LED doesn't turn on (randomly).Does the LED work differently depending on the license?

Hello to you I want to set my WAN port to be accessible for the firewall management interface, so that I can access the firewall with its external address, but only from a specific external address. How can I do this?I thought using acl but the rule there only says to block and not to open to a specific address Thank you

Hello, what is the best way to search all ADOMs in FortiManager for a particular device e.g. you have a Fortigate's serial number, but no idea of what ADOM it belongs to ?is there any way apart from changing system settings to enable global search ?

FortiToken Mobile Push (ftm-push) is no longer working after updating from Forticlient 7.0.7 to 7.2.  We are in an all Windows 11 22H2 environment.   When connecting to an SSL VPN, the FortiToken Mobile approval request appears on the phone, but after approving the connection from the phone, the client just stays at the “A FortiToken code is required for SSL-VPN login authentication” prompt.   Oddly enough, after approving the request from the phone, if you then click on Cancel to cancel the connection attempt in FortiClient itself, you get a VPN Connection failed message, BUT it then connects successfully right after.   Because the client thinks it failed, after disconnecting from the VPN, it clears the username and password.   Alternatively, instead of using the ftm-push approval you can manually enter the FortiToken code when prompted and all works as normal.   Additionally, the mobile push authentication does work correctly if using the connect to VPN

I have been trying to create a local IPSec VPN connection (no connection through internet) as my previous attempts at getting it to work over the internet have not worked. I wanted to prove first that i can get it working without introducing the complexities of opening up ports on my edge firewall or contacting my ISP to troubleshoot. I configured the VPN to use Internal2 (port 2) as a WAN interface and i have connected an (offline, Windows Firewalls off) Windows machine (A) to this port with FC (FortiClient) installed. Having followed this video FortiGate Remote Access IPsec VPN (youtube.com) to create the IPSec tunnel, I tried to initiate a VPN connection to the Fortigate with no joy. I can ping the IP address i have given to internal2 from the machine A to prove connection. I have checked that both Phase 1 and 2 of the VPN config match on FW (version 7.4.1) and FC agent (version 7.2.2.0864).   I installed Wireshark on machine A and can see the pings appearing in the w

Hello team, anyone help me resolve this issue i have loaded the VM license but it can not be validated  FGVM01TM24000015 # get system statusVersion: FortiFirewall-VM64-KVM v7.2.6,build1575,230926 (GA.F)Security Level: 1Serial-Number: FGVM00UNLICENSEDLicense Status: No LicenseLicense Expiration Date: 2024-03-04VM Resources: 1 CPU/0 allowed, 985 MB RAM/0 MB allowedLog hard disk: Not availableHostname: FGVM01TM24000015Private Encryption: DisableOperation Mode: NATCurrent virtual domain: rootMax number of virtual domains: 10Virtual domains status: 1 in NAT mode, 0 in TP modeVirtual domain configuration: disableFIPS-CC mode: disableCurrent HA mode: standaloneBranch point: 1575Release Version Information: GAFortiOS x86-64: YesSystem time: Wed Jan 3 23:45:17 2024Last reboot reason: power cycle

FortiManager Version: 7.2.4, FortiGate Version: 7.0.13Hello,We encountered issues with FortiManager 7.2.4, so we decided to perform a fresh setup, but unfortunately, the problems persist.The Logs Filter is not functioning correctly, consistently displaying "No logs found." Additionally, we are unable to activate or view logs for the default deny policy.Within the logs, we observed an unknown interface for certain policies. Although template groups are present, there is no visible content. Despite a background loading process, nothing is displayed, and it remains grayed out! What could be the underlying problem?Thanks for helping! 

Hello, I want to change one of the VDOM from Transparent to NAT. I plan to do this step : 1. Login web UI 2. Choose Global Mode 3. Go To System > VDOM 4. Edit VDOM 5. Change Operation Mode from Transparent to NAT Mode 6. Configure IP Address in the VDOM interface   is there anything else that needs to be done ?   Thanks

Hi, Im currently working with a Fortigate, which has 2 ISP's working on and SD-WAN, ports being used are Wan1 and Wan2. The rule I have setup is that Wan1 is prefered over Wan2, Wan1 has better bandwith and Wan2 is used as a backup. I need to have admin access via Wan2 with https (Wan2 works with a private ISP so the public IP is safe from outside intrusion). I have already configured Wan2 with the Admin access with https enabled and have confirmed with a remote user that the connection works, but it only works if Wan1 is down. If Wan1 is up the remote user can still ping the Wan2 address, but is not able to enter the GUI via https. What config could I be missing for this setup to work? Thanks

Dear Community, I need to decommission a FortiGate Cluster from FortiManager and before that, I would like to explore the recovery process when deleting it from Device Manager panel and the Policy Package.  1. is there any feature to backup/export all device settings (including advanced settings like dynamic interface binding) ir order to fast recovery in case of future demand (reinstall the cluster, audit..)?  2.  Related to Policy Package, creating a new ADOM revision is the only and best practice to be used as recovery? or there is any chance to backup/recovery the Policy package related to this cluster only? The goal here is to created secure points/fast recovery related to all settings from Device Manager and Policy Package to this individual Cluster only.We know the FMG backups haven the entire settings for all devices but will take so long to be activated touching config for all devices and also there are considerable impacts during the procedu

Dear All,                 I have a to fulfil the security policy on the fortigate of the following, just wonder what firewall policy i need to create in order to meet below security concern ? any help would be appreicated    Ensure firewall policy denying all traffic to/from Tor, maliciousserver, or scanner IP addresses using ISDB    Rationale:FortiGate includes Tor or malicious server related IP address using ISDB. The idea is tofilter out malicious traffic using firewall policies as first level filtering. This is done withoutinvolving more resource intensive processes such as IPS inspection, hence optimizingFortiGate's performance.Audit:Go to "Policy & Objects".Validate that there is a firewall policy created to block inbound connections fromsources named "Tor-Exit.Node", "Tor-Relay.Node", "Censys-Scanner", "ShodanScanner", and "Malicious-Malicious.Server" on "All" services.Validate that there is a firewall policy c

Hi We have a vip server facing outside of our company. I created a policy and enabled waf with all high severity enabled. When a user from outside submits a form, FGT waf recognizes it as sql injection extended and won't let the user submit the form and webpage crashes after. What should i do?

Hi   I have configured ipsec remote access vpn and I want to allow only IPs from united kingdom to be able to connect to my FGT. how can i do that?

Hello Everyone,   I am looking into how to connect several sites to each other, who all have a primary broadband WAN connection and a 5G backup WAN connection, all with static IPs. Our current site-to-site connections are only configured to use one WAN connection on each end, so when the office broadband connection goes down on occasion, the office has internet access via the 5G but no VPN access because it is configured for the single interface. There seem to be multiple paths i could take here and none of them seem as simple as i thought they would be.    Our network mainly consists of all Fortigate devices. F40s, 60Fs, a 61F, a 71F, and some 81Fs at our two data centers.   Approximately 15 of our sites, including our data centers, LANs are already connected to eachother via L3VPN managed by Windstream, connected to their SDWAN solution, VeloCloud, and routed to eachother via BGP.   The other 15 sites are not on any kind of managed SDWAN solution at this time

I upgraded our FortiClient EMS server from 7.2.2 to 7.2.3 on Friday, but the new FortiClient 7.2.3 patch is not available to push out to clients even though "Keep updated to the latest patch" is selected for the deployment package.  I know I could create a custom installer and manually download the new client, but I haven't had to do this previously.   Previously, I would receive an email notification from EMS that a new FortiClient version was available, I would be able to see the new patch in the deployment selection list, enable auto update, and all endpoints configured for that deployment package would update.   This time around, I just happened to notice FortiClient 7.2.3 was released on the website, so I upgraded EMS to 7.2.3 and expected FortiClient 7.2.3 to be included as a deployment patch option to select, but it isn't.  It's been 3 days now and EMS still hasn't downloaded FC 7.2.3.  Am I just jumping the gun, and FortiNet has not yet made it availabl

Hi All,  I'm familiar with the CLI commands to move policy IDs before or after another specific ID, but is there a way to script a move a newly created policy to the top, regardless of what the other IDs are?  I'm trying to create a script to add an ISDB block rule to the top of every policy list on about 40 FortiGates via FortiManager scripts, because this environment isn't yet using standardised policy sets so IDs differ from location to location.  e.g. below: # creating a new policy is simple enough:config firewall policyedit 0set name "** Block IP Reputation DB **"set srcintf "any"set dstintf "any"set srcaddr "all"set internet-service enableset internet-service-name "Botnet-C&C.Server" "Malicious-Malicious.Server"set schedule "always"set logtraffic allnext# But here is where I'd like to avoid making 40 manual changes:move !bottom to !topend Has anyone had this use case or something similar before?

Hello everyone I turned on the IPv4 DoS Policy module on my 60F a few weeks ago. So far, I have created one "monitoring" policy only for packet flows above certain thresholds (other than the factory ones, of course).At the beginning, I gave some small thresholds and I try to observe it all, possibly increasing the counter thresholds if I see when some desired service exceeds them. Sometimes the "test" policy catches an "anomaly" udp_flood from IP addresses 46.134.193.80, 142.250.186.194 or 173.194.164.202 (Google) having counters at the level of counters for sources with real threats. I don't really know what could be the cause of such behavior... I don't think there are any real "attacks" either. Maybe some hints? Below are two sample logs. Do you also use DoS Policy? What meter thresholds do you use for a small network of ~20-25 computers? I know that this is an individual approach for each case, but maybe at least some indicative range as it is with you. date=202

Hi All, I've been trying to figure out what Online and Offline exactly means in FortiClient EMS. As I can see, if I keep EMS connected at the FortiClient end, it will be shown Online, no matter what the VPN connection status is. If I manually disconnect the EMS from the FortiClient end, it will be in Not Registered list. So, what does Online and Offline exactly means here?  Thanks for any help.

Hello,I have use my phone SONY 1 V , Android 14,and newest Forticlient VPN app,then I need to connect VPN but app show error:revoked by android reboot,what can I do to deal with this problum?

Dear support We have Forti SIEM version 7.1 and we are prepared threat intelligence for MISP project and we need to connect the FortiSIEM with MISP to pull the IoC's i you can help us to provide us the steps with details 

I purchased a used FortiSwitch 108D-POE but have been unable to perform a factory reset on it. There is an unlabeled reset button on the left side of the front. Pressing and holding it for 60 seconds or longer has no effect. I have also tried unplugging it and holding the reset button down while it boots. I have tried pressing and holding the reset button for 10 seconds right after a reboot, and also tried the same after waiting five minutes. In its current state, when I connect it via port 10 to my laptop (set to 192.168.1.2), I get a link activity light but I cannot ping 192.168.1.99 nor access it by HTTPS or SSH. Looking to factory reset it so I can gain access to it. Thanks for any tips or suggestions!     

Hi All, In FortiSwitch OS, you can nicely search in the Forwarding Table under Switch: Monitor... but it seems like it 'only' support wildcard searches.Is there anyway to specify 'exact' searches or 'vlan=NNN' searches? If not, in my world, it calls for a feature request.   I often need to see what is on port1, not 'port1-19', or what MAC's is on a specific vlan, and putting '10' for vlan 10 into the search field gives me vlan 10, MAC's including '10' and port10... ;) 

Hi FortiSOAR team, I try to connect fortisoar to cisco ise server.I've created an api user in cisco ise. By using this user, I make api call from both python script and postman. But when I try this credential in connector, I get 401 error.What is the missing or wrong?FortiSOAR