Solved

Hi all, Lately some emails containing URLs seem to skip the URL filter and rewrite that is configured.Nothing concerning the URLs show up in the logs, so it seems that they just go undetected. Yet, they hit exactly the same policies as emails that are getting processed.I suspect it might have something to do with "Content-Transfer-Encoding: quoted-printable" that is used in at least two of the cases I've been able to track down. Has anybody seen this behaviour? Is this expected? We are running Fortimail v7.4.1 on a VM. Not sure if the behaviour was the same in older versions. Many thanks,Imre

I want to implement a simple FortiNAC deployment and place the ETH0 (FortiNAC Mgnt) and ETH1 (FortiNAC Service) interfaces in the same VLAN for a "L3 network type". It seems to me that there will be no problem but I want to know if anyone here has done something like this and if it is working. I plan to use this table of IP Address:MGMT10.47.0.60/24CAPTIVE REGISTRATION10.47.0.61/24CAPTIVE REMEDIATION10.47.0.62/24CAPTIVE DEAD END10.47.0.63/24Is there anyone here who can point to a document describing this? I will be very grateful if there are contributions. 

I am looking for an indicator of uptime for my IPSec tunnel.I find these 3 commands but I can see nothing that can act as such.Any ideas greatly appreciated 

Nice people what can go wrong. I configured on fortigate 100 VPN native windows according to this guide. https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-establish-VPN-connection-between-Windows-10/ta-p/200001And it connects nicely to windows. But I only have access to the router. I ping his address I can access his site. For that I no longer ping any host on the local network. What did I forget?

Dear FortiExpertsWhy when my new VPN spoke sends IKE initiation packets to my existing Hub, does my hub not reply?I have found this "IKEv2 exchange=SA_INIT id" of 4f0472f511bd4d4a in debugs on both spoke and hub.So I can related the debugs to each other.The spoke is repeatedly sending IKE packets as seen with this pattern: 2023-11-03 12:08:37.961125 ike 3:pri_bms: schedule auto-negotiate 2023-11-03 12:08:38.970872 ike 3:pri_bms: auto-negotiate connection 2023-11-03 12:08:38.970996 ike 3:pri_bms: created connection: 0x8806da0 5 192.168.1.23->203.57.169.172:500. 2023-11-03 12:08:38.971031 ike 3:pri_bms:pri_bms: chosen to populate IKE_SA traffic-selectors 2023-11-03 12:08:38.971095 ike 3:pri_bms: no suitable IKE_SA, queuing CHILD_SA request and initiating IKE_SA negotiation 2023-11-03 12:08:38.971166 ike 3:pri_bms:613: generate DH public value request queued 2023-11-03 12:08:38.971515 ike 3:pri_bms:613: out 4F0472F511BD4D4A00000.. <<<truncated>>> 00000804000005

hello guys .I have two internet links with which I bgp The first question is that it says igp is in the original part of the best route table!!!The second question is that, when entering our network, it comes from a different link. Is it possible to change the entry route?  

GreetingsWhen I enable the various debugs as shown and I run diagnose debug info command I am expecting to see all currently enabled debugs in the location shown but I do not. Is this how it should be?Where or how can I obtain feedback to confirm what debugs are turned on at any given point?Thanks  

Hello Team, i have configured threat feed with "update method" external feed.I need to enable a connection coming from an ip that is inside the dynamic list. Is it possible to exclude this ip from the threat feed list? Thanks for the supportBR

Hi everyone I am trying to use the REST API to add IP addresses on our Firewall.  I have this python code:  import os import requests import urllib3 import getpass urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) baseURL = "REDACTED URL" apiURL = "/api/v2/cmdb/firewall/address" token = "REDACTED TOKEN" headers = {'Authorization':'Bearer ' + token,} params = { "datasource":1, "vdom": "root" } def createNewIpAddressData(ipAddress): data = { "name":"ext-" + ipAddress, "subnet":ipAddress + "/32", "comment": "New IP", "color":"0" } return data def addNewIpAddress(postData): try: r = requests.post(baseURL + apiURL, headers=headers, params=params, verify=False, data=postData, timeout=5) except requests.exceptions.Timeout: print("Timeout!") return None if r.status_code != 200: print("Error code:{}".format(r.status_code)) print(r.content) return Non

Dear Community,Which browser Dark Mode theme for working with FortiGate's would you recommend?kind regardsliswar

Hi!   I am configured HA on my Fortigate 100E running 5.6.   The CLI command get system ha status shows that it looks ok .   HA Health Status: OK Serial number Device 1(updated 3 seconds ago): in-sync Serial number Device 2(updated 2 seconds ago): in-sync   Master: Primary , FG100E4Q170444845, cluster index = 0 Slave : Secondry , FG100E4Q17044540, cluster index = 1   But on GUI the status is showing as Not Synchronized.   One more thing is that I used device priority for my selection of primary. I know that up time comes before the priority but my thought was that once I set higher priority then it will take that as first option of choice or I am missing point here.   Thanks        

Dear Colleagues,In almost every guide I found about adding a ZTNA Destination Gateway, "SaaS Applications" there is a screenshot of a long prefilled List with well known services where you should select yours from. But for me the List is empty. What can I do to populate the List of SaaS Applications? I'm using FortiEMS Cloud version. beststephan

We have FortiGate-200F with Firmware 7.2.5 at HQ Our office have 4 site. Every site have 2 AD server. We install FSSO DC agent on every server.Main server at HQ can monitor on other server normally. But we have problem with 1 user that show correct user but wrong IP address in FSSO DC agent. It show user: Cxxxxxx , IP: 192.168.0.109but the correct was user: Cxxxxxx , IP: 192.168.0.127 We have try de-authentication from Fortigate and restart client laptop but FSSO DC agent still show wrong IP address Please advise how can we solve this issue.

hello there,we use FG-60F with firmware 7.2.4 I searched internet how to apply policy to block activity download/upload for certain file size.But I can't find menu/settings as told by them. anyone can help please?I've tried to check DLP setting, file filter, also can't be found. thank you

I'm sorry if my English is difficult to read. We use Fortigate 50E to provide Wi-Fi services to our customers.The DHCP range is 172.16.0.2 - 172.16.1.254.More than 500 DHCP addresses will be assigned.Last weekend, Some devices were unable to connect to the Internet even though they had IP addresses assigned.DHCP addresses were not exhausted. this is- Have you exceeded the number of sessions?- Has the number of NAT tables been exceeded? First of all, can this 50E handle more than 500 PCs? Is it better to think that there was something beyond the product specifications?Is there a way to find out the cause?

Hi all,Hope ur doing well. I need your help for my issue of updating Antivirus signature of Forticlient. I have Forti client EMS server 7.2.1, and forticlient 7.0.9 deployed on different laptop etc…We have fortimanager 7.2.1 connected to Fortiguard throught proxy server. I have configured profiles on EMS server for using fortimanager fort client signature update. I dont understand why but if i used port 80 or 443, forticlient deployed on laptop doesnt work. My fortimanager is uptodate if i check fortiguard's version.but its empty, i dont know if its normal  : if i try signature update forticlient its failed. There is no firewall for this forticlient, same LAN. Wireshark show me that for https configuration on fortimanager, BAD REQUEST, i dont know why its not working.  If you have an idea :)Thanks a lot !

Topology is as follows:Site A: subnet 192.168.1.0/24. has a fortigate appliance (FortiOS7). It has no servers on it and no DNS servers. Desktops are assigned IP address by HTTP.Site B: subnet 192.168.2.0/24. has no desktops, only server. has a checkpoint appliance. has a domain controller and DNS server in it (192.168.2.10). the domain there is site-b.loc Site A is connected to site B via IPsec site to site VPN. What is the best way to have any desktop on site A reach anything on the internet using the ISP DNS server for example, but have anything on site-b.loc request the DNS server on site B.   

I already followed the official document to set ipsec phase1 and firewall policy,the server side still can't enable.But on the client side,fec enabled and working.System is fortigate 7.4.1 and licensed.this is debug log: and this is my config:  But on the other side.the client,FEC is enabled and working.This is debug log: and this is my config:  

Running v7.4.1 build2463 on an 80E and found out that when changing/adding a Destination directly from Firewall Policy page from the "edit" icon, the services on the policy changes to ALL. It bewildered me and I was beating myself up over why I would have set this policy to ALL. So I set it to what it should have been, then noticed it on the next change. Happened every time I tested after. Hopefully helps someone from a headache and inadvertently opening up security. I've already submitted a ticket so they can be aware as I couldn't find anything about it online.

I am looking to enable IPv4 DoS policies which are recommended practice.  However, I am concerned about impact. Does anyone have any recommendations for enabling these?  Should I do them one at a time? Is it safe to do them all at once? Are there some I should not enable etc? Should I leave them at the default thresholds?    Thanks,

I have a list of < 300 IP numbers that I know about. We're not using DHCP, so there should be no addresses outside of those 300. I am really curious if there is any traffic going to IP numbers that I don't know about. If there is it could indicate something that is broken, or a hacker trying to discover something. This is obviously would work only on internal ports.  Any ideas?

Hi Community, I am looking for deep info about the relation between FortiManager discovery process & FortiGate local credentials after the discovery process. During the discovery process (onboarding new FGT) we use the local super user „123test“ and it works fine completing the discovery process but the question is what happens if we change the password of „123test“ on managed FGT? Is this local credential is still needed? FMG training said, the discovery credentials (123test) is used to collect info about the device (version, config, model..) AND also to push new configs BUT we are using RADIUS authentication for managed proposes on FMG and FGT, that means from my best understanding the config push runs over RADIUS authenticated users (Events Logs on FGT) and NOT via local credential „123test“ anymore. If this is true, the local credentials used during the discovery process should NOT be necessary anymore, right? or FortiManager still needs this local credentia

Dear All,   Searching the web I found nothing. Before I jump to FAC as an option. Is it possible to migrate my token from FG on-prem to FortiToken Cloud? I want all my tokens assigned to my FGs to be centrally managed by FortiToken Cloud.   I appreciate your help and immediate feedback.    

Hi All,How can we verify if IPS/antivirus signature are up to date in Fortigate firewall.  Regards,Fortigate Firewall learner 

Hi All,I created an IPSec VPN tunnel for remote Access "VPN for MAC" and Client Address Range 172.30.1.1-172.30.1.254.Soon after that I deleted it as all of a sudden it stopped working. Now I'm trying to re-create IPSec VPN tunnel with the same name "VPN for MAC" and the same Client Address range but getting the error on the screenshot.   Could you please advise how to delete the original tunnel entry.