Solved

I upgraded Forticlient from 7.0 to 7.2.2 on our servers and found that only on windows 2012 servers, I can't start Forticlient console. It gives following error when try open. I wanted to try uninstall and reinstall but to uninstall Forticlient I have to disconnect telemetry from the console. Is there any solution to fix issue.  "the procedure entry point DiscardVirtualMemory could not be located in the dynamic link library in C:\Program Files\Fortinet\FortiClient".  Problem signature:Problem Event Name: APPCRASHApplication Name: FortiClient.exeApplication Version: 7.2.2.864Application Timestamp: 6452884fFault Module Name: net\FortiClient\FortiClient.exe!DiscardVirtualMemoryFault Module Version: 6.3.9600.21620Fault Module Timestamp: 65175333Exception Code: c0000139Exception Offset: 00000000000ed170OS Version: 6.3.9600.2.0.0.272.7Locale ID: 3081Additional Information 1: ac05Additional Information 2: ac0507478d1c5bd693cfc4fe3987e900Additional Information 3: ac05A

Hello to all Cybersecurity enthusiastic,I would like to get some best practices, advices for my next project.On one location we didn't do barely any segmentation since last IT Manager so it's time to make it more secure and better.Current Situation is like this:VLAN 1 "Clients"Here in our Clients VLAN we have regular clients (notebooks, workstations), printers, VoIP devices, meeting devices (cameras, microphones etc)VLAN 2 "Servers"Here in Servers VLAN we have domain controllers, file servers, backup servers, repositories etcWhat would be a general recommendation?I would like to segment it a bit more and create separate VLANs for Printers, VoIP, IoT, Backup Network etc.Our Infrastructure is as follows:2 x FortiGate 200F in an HA Cluster (Active/Passive)2 x Core FortiSwitches in an MC-LAG3 X Access FortiSwitches I'm new to this forum.I'm NSE4 certified. 

two fortigate 3240c，v5.4.10,build1220,180821 (GA)，created ha . All config is all right.   and i enable these set ha-mgmt-status enable set ha-direct enable   when i found both of them had  two conflict snmp-index. master:port27 and mgmt had the same snmp index salve:mgmt and vlan11(a logic port) had the same snmp index So i first do the config on the slave to make sure all snmp-index are independent. And machine did not reset ,but why the slave sync the master.Usually the slave does not sync the master. Why it happened.And change snmp-index will not cause the machine reset,right? master and salve have the same snmp-index with them mgmt,what will it effect? thank you for your answer

We have a pair of 1101E's in HA (A-P) currently in production.  They are connected to Meraki MS450's.We purchased some fortiswitches that we want to manage in the gate via fortilink, but we did not enable fortilink on our 40gbps LAG configuration before adding subinterfaces, policies, etc.  So we are now unable to configure fortilink on this interface.We talked to support and they recommended that we take a backup of the current config, add "set fortilink enable" to our LAG in the config file, and then restore the gates from the modified config file.Does anyone have experience doing anything like this?The fortiswitches will not be diretly connected to the gate, they will be downstream and connected to MS225's/MS425's.  Our gate is currently on 7.0.13.Thanks!

Hello,   We have fortigate In azure, we would like to Prevent Port Scanning. Is it possible and how I can do it?I tried create IPS policy and select Port.scanning, but it didn't work    Is it possible prevent port scanning with IPS Profile? 

Good day everyone, hope you all are doing well. I created a Github repo where will collect scripts, tools, anything that helps in daily work with Fortinet products.So far put a collection of Fortigate automation stitches (21) you may find helpful. Next is the collection of FAZ Incident Handlers.I hope this to become a community effort, so if you have found a tool or implemented some automation, please share with me via email and I will update the repo.The repo: https://github.com/yuriskinfo/Fortinet-tools So far automation stitches:  Send email on admin-level user being created/addedBack up configuration when changed to external server via SFTPBack up configuration daily to external server via SFTPLocal TLS Certificate is about to expire email alertSend alert on Fortigate configuration changed by administrator without detailsSend alert on Fortigate configuration changed by administrator with detailsemail alert on Fortigate entering conserve modeSend email alert on F

Will there be any impact if i change the HTTPS port to any other number. eg 6443 and change web service certificate to Fortinet Local cert ?    

Hello all...We are looking to organize our config repository and wanted to have our FortiGates backup their configs to their respective "device" folders...and not just land them all at the root of our FTP server.Our current script line looks like this: execute backup config sftp Fw1-confg.txt our.ftpserver.local backupuser passsword If I simply append a folder name to the server path...it failsexecute backup config sftp fw1-confg.txt our.ftpserver.local/FW1 backupuser passsword Am I missing something is this not possible to do in this way (??)Appreciate any insight you may have...!Thanks in advance and look forward to your response !   

In the UK the default MTU value from most ISP's is 1492 for FTTP & FTTC connections.Do I need to tweak the MTU value on the WAN interface when using PPPoE to 1492 or will the fortigate cope with the lower value as I can see the default MTU is 1500. Or will I experience issues such as packet loss if I do not lower the value.  TIA

Hi,   We are using FortiAnalyzer version 7.0.8, wherein logs are being forwarded to a syslog server for traffic learnt from Fortigate firewalls. Amount of logs being forwarded are quite huge per minute as seen from forward traffic logs learnt on Fortigate firewall (source FortiAnalyzer to destination Syslog server).   Log rate seen on the FortiAnalyzer is approximately 500.   Can we have only incremental logs being sent from FortiAnalyzer to the syslog server.   Thanks, Naved.

We recently upgraded our FortiManager-VM from 7.0.8 to 7.2.4 and have discovered the Meta Field we've been using to "plug" values per device into CLI templates are not supported any more and have to migrate all those per-device mappings from Device Manager to Policy & Objects, now called "Meta Variables".The upgrade process just copied used variable names to the Policy & Objects side but all those mappings were not copied at all (why not???). I know it's too late and useless(hopeless) to argue why they're not automatically migrated during the upgrade process. So now I just want to know what's the best way to copy those values for 500+ devices on the FMG. Ideally there is a tool existing to do it. But if so, it could have been run during the upgrade. Therefore I have to assume that doesn't exist. Then, is there any good CLI command to dump all Device Managers Meta Field values to the console/SSH session so that I can have a list to copy them from then create script to paste

Hi,I have a very strange problem with Forticlient when I use it from MacOS (Sonoma). It was ok earlier (with Ventura) but because I tried to debug some another strange IPSec VPN issue, I had to uninstall it (using the official method) and install an older version. Since then when I press connect button for my SSL VPN it seems Forticlient is freezes (stuck in connecting phase) and the disconnect button also not working, so I have to shutdown Forticlient.... Unfortunately due to Fortinet strange policy, support can't help (forticlient-vpn is not covered by support contract), so all my hope is in this community :) Have you ever seen something like this? Any suggestion to fix? ThanksL: 

I want to record all the searches that employees do in search engines like Google or Yahoo, etc. In web filter I have the proxy option and in search engines I have Log all search keywords enabled but it doesn't work, do I have to enable or disable something else somewhere else or should that work? What should I check? Thank you

hi everyone I have a problem firewall down and led port Lan slow blink, Fortios 7.2.2 .I check even log find last log  date=2023-11-15 time=00:01:00 eventtime=1699981260853228885 tz="+0700" logid="0100020025" type="event" subtype="system" level="notice" vd="root" logdesc="Report generated successfully" msg="Report generation succeeded for layout:default." file="/var/log/log/root/report/generated/Schedule-default-2023-11-15-000100/default.pdf" filesize=422522 datarange="14-Nov-2023 00:00 To 14-Nov-2023 23:59" reporttype="Scheduled" processtime=0date=2023-11-15 time=00:01:00 eventtime=1699981260853198775 tz="+0700" logid="0100032040" type="event" subtype="system" level="information" vd="root" logdesc="Report deleted" action="delete" msg="System deleted 1 oldest reports"date=2023-11-15 time=00:00:00 eventtime=1699981200050441536 tz="+0700" logid="0100032011" type="event" subtype="system" level="notice" vd="root" logdesc="Disk log rolled" action="roll-log" reason="file-

Hi everyone, Have anyone got any clue on how to validate that the configure ISL is working fine for FortiSwitch & Fortigate?Thanks in advance.

hi,on FortiGate 60D, I want allow web filter from URL filter.but I try for setting and is not working? is still blocking! may know do have sample or how to solve it? thanks.

How to check if a particular website is blocked by fortigate AV or web filter?Perhaps I can enter the url into the firewall and check?Or is there an external website where i can check?Or do I have to do it from the local network?Assume that default settings of av and web filter are applied.  

Hi all,Hope you can give me a hand with this.I have a fortigate 90D. But untortunately I can not get renewal because is out of date.So I purchased a fortigate 80F.Here comes the question: can I export the configuration I had on the 90D to the new one (80F)?.I downloaded a conf file. Thanks and best regards, 

Hi All,  We realised that the connector was upgraded but an older version is required for compatibility. Had a look at the sites FortiSOAR Content Hub (fortinet.com) and Fortinet - FortiSOAR Integrations · GitHub to find the connector to download and therefore upload into the SOAR. How do I find an older version of the FortiSIEM connector? Thanks in advance,Craig

Hello good morning. Please, I wanted to ask the following question. I have a router connected to port 5 on my Fortigate in the following IP range: 192.168.30.100/24. On the other hand, I have on port 3 (configured as an interface) an output to a switch in the range 192.168.1.0/24. I am trying to communicate each subnet with the other by establishing a firewall policy that has port 3 as output and port 5 as input, but I cannot access it. What am I doing wrong? Thank you.

We have two old devices: Fortigate 111C and FortiAnalyzer 100B. They are currently offline (as they have been replaced by other models). We are going to try sell them via auction (being a public organization we have such rules). But we need to safely remove our data and yet have it still usable, so it is worth a purchase for someone. I have read about Factory reset command, but i'm not sure it will wipe all the data. Is it only resetting a configuration? Should i still wipe the logs and other stuff somehow? I have also read in the forums about running format on FortiAnalyzer to get rid of logs, but won't it render the device unusable after that? With personal computers we are just wiping out HDDs securely as installing OS is a trivial task. Probably not so trivial with Fortigate. Or is it possible to completely wipe its memory and then install fresh FortiOS?

I am seeing some strange ARP requests from our Fortigate using Wireshark. I'm not sure the best way to describe it. It's as if the Fortigate has a cooldown of 1 second in between ARP requests. So when a device doesn't respond, it keeps sending requests exactly every 1 second. The IPs that it's trying to contact appear to be random DHCP devices that joined the network and then left. The IPs that it's trying to contact do change some over time. It's like it has a list of the last 10 devices that it can't find and just keeps repeating those until other devices leave the network. I've checked the ARP table on the Fortigate while it's sending these ARP requests and the IPs it's sending the requests to are not in the ARP table. It's not a network loop. No other devices are showing this kind of behavior. The amount of traffic generated by this isn't causing network disruptions, but I don't want the Fortigate to be this noisy. Any thoughts?  

Hi all!Maybe a simple question, but I don't see it: Why is the traffic to Cloudflare-Web implicitly denied while the traffic to Xbox is allowed?   Both connections use port 443...Policy 44: config firewall policyedit 44set srcintf "Name1"set dstintf "wan1"set action acceptset srcaddr "Name1 address"set dstaddr "all"set schedule "always"set service "HTTPS" "HTTP"set utm-status enableset ssl-ssh-profile "deep-inspection"set av-profile "default"set webfilter-profile "block some & monitor-all"set dnsfilter-profile "default"set ips-sensor "high_security"set application-list "block-high-risk"set logtraffic allset nat enablenextend  I guess, that it has something to do with the item "Action" and "Security" below:  What engine performs this deny? Why is the security log empty? Thanks for your help! Oliver 

Generally from a given vdom it is possible to issue the following to get the config including ALL DEFAULT settings:show full-configurationI know also that I can get what I would understand to be NON DEFAULT settings for given sections of the config from commands such as the following (this is by no means of course an exhaustive list):show system interfaceshow vpn ipsec phase1-interfaceshow vpn ipsec phase2-interfaceshow router bgpEtcMy question is there a command equivalent to show full-configuration above that will give just the NON DEFAULT settings i.e. all that has changed since the last factory-reset?Hope this makes senseThanks

Hi All ,  As a new guy on Fortigate appliances, I need your help. I have a customer with internal AD DNS servers. All endpoints are configured to use the AD DNS servers.   The issue that I'm facing is that in Fortiview, I can only see the IP Address of the endpoints I'm wondering how to setup the fortigate to get the FQDNs of those IP addresses from the internal AD DNS. ThanksPadelis