Solved

Good day!Would like to check if we can now rename the FortiSIEM admin account.We want to rename it since we dont want to use "admin" as username.Thank you.

Hey, everybody!anyone have any experience? I set up an ipsec tunnel between FG and AWS. The tunnel is up, static route and policies are in place. Ping from aws to fg is pinging. but from fg to aws is not.I started looking, I saw an outgoing ip during the ping from the management port. although it is not even connected. there is no such route. even if I turn off the mgmt port, traffic to the tunnel still comes from it. I put 0.0.0.0.0/0 on the mgmt port.Now traffic started coming from FortiLink port (802.3ad Aggregate), also disabled port, also put 0.0.0.0.0/0 ip on it. now traffic went to vpn tunnel from wan port. How can this be fixed? I don't have such routes, does fg make them up by itself)?model 400F - os v7.2.6

As in what version should I upgrade firewall to for a recommended stable and not necessarily latest version

Hello, this is the first time I use Forticlient.When I establish a VPN connection, I can reach the server but I can't navigate internet from my PC.Is there a way to solve this issue without make changes on the Forticlient server side? I'm using Windows 10.Please, give me puntual instructions as I am not expert in configuring net and firewalls.Thank you

We recently moved a clients local server infrastructure to a collocate.  Currently they are connected to the infrastructure over a site-to-site VPN (soon to be a point-to-point connection).   As a result, their RADIUS server (NPS) is now across the VPN tunnel.  Their main site (outside the Collocate) has a number of FortiAPs that were configured to use WPA/Enterprise with the RADIUS server.  This stopped working after we converted them and I've been trying to fix this and we've temporarily implemented a different wireless network for them to work.  I can't seem to get the RADIUS working across the tunnel.   It seems to me - if I can control what IP the local Fortigate sends out to the Collocate, and the NPS servers, I should be able to resolve this by configuring the NPS server with a client corresponding to the IP.  I don't see anything in the NPS logs referencing this traffic, so it's like it's not even reaching the server.  The tunnel between

Hi,Any ideas on how to apply a Nat Souce based on the destination port, in version 7.0 with Central SNAT enabled?In version 7.4.x, a new functionality was released so that in the Central SNAT policies you define the destination port using the CLI.But in previous versions is there a similar way to do this?It is required that the source IP be changed when the request is made to a specific destination port.Example.When I launch a request from the computer with the IP 192.168.1.10 to destination 10.10.10.5 and destination port 5302, the source ip change 172.16.1.10.When the request is launched between the same source and destination but with a different port (5555), a nat source with 172.16.1.20 is applied.

I'm experiencing intermittent issues with link monitor failover on my FortiGate device. I have four WAN connections (internal7, wan1, dmz, and wan2) set up with the following link monitor configuration: config system link-monitor edit "1" (internal7) set srcintf "internal7" set server "8.8.8.8" set protocol ping set gateway-ip 0.0.0.0 set source-ip 0.0.0.0 set interval 5 set timeout 1 set failtime 5 set recoverytime 5 set ha-priority 1 set update-cascade-interface enable set update-static-route enable set status enable next edit "wan1" set srcintf "wan1" set server "8.8.8.8" set protocol ping set gateway-ip 0.0.0.0 set source-ip 0.0.0.0 set interval 5 set timeout 1 set failtime 5 set recoverytime 5 set ha-priority 2 set update-cascade-interface enable set update-static-rou

I did FortiEMS deployment and installed Forticlient for 1000 machines. After I did Vulnerability scanning im got some Vul with Auto and others as manual. My question is, how can I do manual patching through EMS? Is there a way to install the patch from the internet manually and upload the MSI or patch file to EMS to push it automatically to all machines? OR does manual patching mean that users have to do it by themselves only?In addition, can I create a custom message to show to users once they log in to their machines including a message and link to download the patch of vulnerability manually? #ems #vulnerability #patch

I tried disabling 1 interface of another admin computer in Fortigate GUI but it accidently disabled mine too, I couldn't reconnect with changing interfaces, even the console interface didn't work, am I required to reset the device ? 

I have FortiGate v7.2.5, where in the firewall can you whitelist the Pentester IP with the IPS Security Profile. Or is the best way to create a firewall policy to allow that traffic for the engagement?

Hi Everyone,I have a unique and frustrating situation with an ISP that can only provide service via DHCP - and that DHCP is provided by another 3rd party as their last mile provider who refuses to acknowledge their mistake because "it still works for others"I have a remote site fortigate that loses it's WAN DHCP lease every other day or so because the upstream relay is providing an unreachable internal IP (10.x.y.z) as the server and relay IP in the original DHCP lease.  I have packet captures of this and watching the fortigate constantly trying to renew the lease with direct IP packets to this address, obviously being dropped by the next hop.  It's only when the fortigate loses its lease completely and finally falls back to broadcast discovery / requests that its able to recover. Question:  is it at all possible to configure the DHCP Client on the fortigate to do "broadcast requests" for leases exclusively, without trying to renew via unicast?I know this is not the

How to check temperature values on FortiGate 200F ?

Hi everyonei need someone to see what i am doing wrongi have a fortiauth as a radius server , and the fortigate is a radius client.i have many groups in the fortiauth.when i create a group in hte fortigate using remote server fortiauth , there is two opitions (any, specify)when using any everything works fine and good, but i want to specify certain groups for the policywhen i choose specify it gives me and emtpy tab to write a group with no choices , ive written one of the groupsmanualy but when i try it gives me access deny from ssl portalcan anyone help me with that ?thanks

I have a setup with one FortiManager that today manages internal firewalls. It has an interface connected to a mgmt network where most of our internal networking equipment are connected to. We want to use this FortiManager to also manage other Fortigates from different customers.  My initial plan is to create a private VLAN and let a new interface on the FortiManager be behind a promiscious port,.It's only used for adding the units to the Fortimanager.  My consern is that the FortiManager becomes a bridge between our internal mgmt network and customers mgmt network. Example someone makes a static route on the customer Firewall that points to our internal mgmt network with the FortiManager as next hop. I have not yet found any way to have an ACL directly on the FortiManager and would in this case be only dependent on the customer Fortigate ACL. Another solution would be to route the traffic towards the FortiManager through a firewall, but I want to kee

Hi team,   I´ve installed FortiSOAR, configured some connectors (icluding VirusTotal and IPQuality), created soem playbooks and everyhting seemed working well. Then, I installed the Phsihing Solution Pack and run it. When I opened the indicator "http://demo.gumblar.cn/", I realized the system was to slow to enrich the indicator. So, I opened the Playbook execution viewer and realized the playbook "Enrich Indicators (Type All)" stopped on "Compute Reputation Data" with a Jinja error code (CD-WF-8) - attached.   After that, I went to the Indicators module and tried to create a manual indicator for IP. I´ve created the new indicator, but again realized the Enrichment has stopped int he same playbook step (and same playbook).    I talked to a colleague of mine who suggested me to change the Global Variable "Demo_mode" to false. However, I realized this variable was still as false.   Would like to ask your help for solving this issue. The interesting thing that

Hello Everyone,   Anyone can share with me the guidelines on how to configure SDWAN in VDOM?  and limitation feature when FortiGate firewalls enable vdom mode?   Best Regards Thanks

 Trying to install the FortiClient VPN from https://www.fortinet.com/support/product-downloads keeps showing this error. I'm on Windows 11 22H2

My website is WordPress, added the Wordfence WAF and it shows only my Firewall IP as the traffic hits. I am doing IP & port forwarding on the firewall 60F. The following is my firewall policy and VIP: FG-60F (IPS1-website) $ show config firewall vip edit "IPS1-website" set uuid 486s855e-c968-54gl-692f-36157e21b9c0 set extip XX.XXX.XXX.XX set mappedip "192.168.1.54" set extintf "any" set portforward enable set extport 80 set mappedport 84 next end FG-60F $ config firewall policy FG-60F (policy) $ edit 2 FG-60F (2) $ show config firewall policy edit 2 set name "WAN1-WP-web" set uuid 31b74efe-c96a-5wed-a157-fddc795fb4c0 set srcintf "SD-WAN" set dstintf "internal" set action accept set srcaddr "all" set dstaddr "IPS1-website" set schedule "always" set service "ALL" set utm-status enable set ssl-ssh-profile "certificate-insp

Dear community, Maybe anyone else already wrapped his/her around this on FortiSIEM:I am looking for an aggregation function in the analytics/report generation that behaves like the SQL "concat" command, meaning writing all the values of all rows into the single result row.My usecase, to make it a little bit clearer:From the FortiClient EMS, I receive all endpoint's vulnerabilities (search criteria is Event Type = FortiEMS-Vuln-Detected)As Group By/Display Fields, I selected:COUNT DISTINCT( Vulnerability Id )COUNT DISTINCT( Host Name )ProductThis generates a wonderful list of all the products which need to be patched on the endpoints and I can sort it by how many hosts are affected (COUNT DISTINCT( Host Name ) )What I cannot see here, is which hosts exactly I need to go to and patchIf I used "Host Name" as display field, this would obviously split up my list into dozens of single lines with the same product just on another deviceI'd prefer keeping the single line, but instead of&nb

we would have to make the website www.aurena.at accessible to our colleagues for a longer period of time.The website works normally except for the images.Example: https://aurena.s3.amazonaws.com/m73k/public/auction/9176/1ce4f53d-72a7-4867-962c-17af8d601414_a.JPGThe URL is blocked by Fortigate Application Control (S3 Amazon Cloudservices).I have therefore created an exception policy that looks like this and precedes the Application Control Block Policy: The user has also not had any old sessions open according to Fortigate.What can we do so that we don't have to unblock the whole Amazon S3 Cloud on Fortigate?  

Hi all Have a strange problem with SSL VPN not answering. Have set it up multiple times on other system but only with only one WAN IP. Problem here i think is that it listens on all WAN IP's (11 Wan IPs). Everything is standard otherwise than the port (444) but the service doesn't answer. It's a FG81 running 7.2.5 Best regards Henrik 

I am working on a 30E with the built in local WiFi radio and although bridging is an option for the SSID I cannot for the life of me get it to advertise even with broadcast enabled. Tunneled works but I'd prefer bridging using the internal software switch. Any ideas? 

I have a Fortgate connected with others using OSPF, this one have some static routes that need to be redistributed over OSPF, so I configured to redistribute all. But now I need to add some static routes that will not to be redistributed.   I found this Technical tip https://community.fortinet.com/t5/FortiGate/Technical-Tip-OSPF-static-routes-redistribution-example/ta-p/191525    Is not exacly what i need but i try to adjust like this....       config router access-list edit "NOT-Redistribute" config rule edit 1 set prefix 10.241.224.0/19 set exact-match enable set action deny next edit 2 set prefix 192.168.192.0/20 set exact-match enable set action deny next edit 3 set prefix 10.241.48.0/20 set exact-match enable set action deny next end end edit "Redistribute-ALL" c

I have a single IPsec tunnel with Phase 1 and Phase 2 up.It is not passing traffic so something is wrong.When I do a get vpn ipsec tunnel name XXXX command I am used to seeing one SA in the output.Now I have 4 see below.It might be on account of issuing diagnose vpn ike restart a couple of times.What are these extra associations?thanks..... 

Hi, I have some forticlient installed on pc's without internet connection so i need to know if i can use fortiems as a source to update forticlient av signatures or if internet connection is required. best regards,