Solved

Hi All,   Hope you can give some light on the following issue which I'm facing with some fortigates, we have some Fortigates 101F, 100F, 60F and 40F, where after update to OS 7.4.1 we are not able to select VoIP profile on firewall rules, before update it was working fine and VoIP service was ok. This is only happeing on 60F and 40F fortigates, on 100F and 101F we are capable to still using VoIP profile on firewall profiles (this is being used on the IPSEC rules created)   These are the settings we have on fortigates for VoIP: config system settingsset sip-expectation enableset sip-nat-trace disableset h323-direct-model enableset default-voip-alg-mode kernel-helper-basedset gui-implicit-policy disableset gui-voip-profile enableCurrently VoIP service is not operational between remote office due to this, traffic is passing on tunnels but SIP sessions looking not be linked as expected. Can someone can let kmoe if maybe there is a command to force/reload VoIP profile be visible o

I have a FortiGate, I have 2 interfaces that connect to 2 different ISP/modems. When the primary ISP is down, the other is automatically used.I have set up Email Alerts through Stitch using the trigger "Interface status changed"I am able to receive email alerts if the interface is down (example: powering off the modem). But if there is no internet connection (example: due to ISP maintenance) I don't get any alert, because the interface is still up. How do I receive alerts on lost connectivity for an interface?

Hi  I have a fortigate 40F that is having problems communicating with the fortianalyser. When I perform a connectivity test I receive the "Unauthorized" message. I have already added the device to Fortianalyser. The output of the "exec log fortianalyzer test-connectivity" command displays:    Failed to get FAZ's status. Authentication Failed. (-19)     The OFTPD debug in fortianalyser: diag debug app oftpd 8 x.x.x.xdiag debug timestamp enablediag debug enable     [OFTP_try_accept_SSL_connection:1831 x.x.x.x] SSL clienthello incoming on sockfd[56] [OFTP_SSL_CTX_dft:1240 x.x.x.x] dft-idx=0 inited=1. [__create_ssl_context:1666 x.x.x.x] SSL socket[56] pid[1846] ssl[0x15b7a60] SSL_new() success. [__SSL_info_callback:301] before SSL initialization [__SSL_info_callback:301] before SSL initialization [server_sni_cb:1255] server_sni_cb(): sni='0x1434250/fortinet-ca2.fortinet.com' [server_sni_cb:1269] --

Hello I configure HA design active-passive       There is no communication + port e0/3 in switch in suspended which connect to passive firewall, how solve this problem or there is another better design HA .

Hi all, I decided to run a factory reset to an azure fortigate, to avoid license problems deploying new one.But after the factory reset the default admin without password is not working, how can I login now to the fortigate.I triyed to reset the password from Azure without success. Thanks

Dear community, At the moment, we only have one public IPv4 address left to put the FortiSIEM cluster behind.This has some implications:- We cannot differentiate user traffic from collector traffic (which I would like to use to limit the source IPs or even allow users through VPN only)- As I cannot define different IPs for supervisor or worker cluster, load balancing the collector traffic seems to be impossible - so I will have issues scaling some time in near future (if I don't get more IP addresses) I do see that there is a property for the port on the collector setting (phoenix config), but I am not sure if this works correctly. My idea would be to hand over different IP-ports for user, collector to supervisor and collector to worker.Then, I could create VIPs on the firewall that match (and for the workers, load-balance) the ports to the internal IPs.Because, as far as I can see, the HTTP Host header is not present in the http-request itself, which would be the only method

This post is to seek help to generate some debug output.The context is an attempt to setup a new IPsec tunnel on a new site to connect into an existing SD-WAN hub.I believe that I have copied the config of any existing site to a new setup but upon adding the first tunnel it remains status = down.I am wanting to generate some debugs but not seeing any output.All I have done is the following command:diagnose debug enableDo I need to do anything else?I have left the IKE filter at default i.e. No filtering.I am not sure if there is somewhere I need to specifically turn on IKE debugging?Appreciate any help

Hello team,   i have a question abount policy match. I have sniffed packets from fortigate CLI and the result is:   6.891062 port3 in 195.xx.xxx.xx -> 172.xx.xx.xxx: icmp: echo request7.892226 port3 in 195.xx.xxx.xx -> 172.xx.xx.xxx: icmp: echo request8.892875 port3 in 195.xx.xxx.xx -> 172.xx.xx.xxx: icmp: echo request   So I created a firewall policy having as source port3 and source ip address 195.xx.xxx.xx and as destination 172.xx.xx.xxx with service ICMP_ALL. But the policy not match.   Any suggestion?   Thanks for the support    

Im trying to configure an IPS Profile to block a Signatunre on whicht we can see under Protocols just unencrypted Protocols such as ftp, http, stmp, etc. Since those arent encrypted im assuming that we do not need ssl inspection at all.Is this correct or did i miss something here?Thanks in advanced.   

Hello,My four Active Directory accounts were successfully joined to Fortisiem using LDAP and WMI credentials, but up until this point, I was unable to get the users and groups from the AD to Fortisiem; nothing was visible on the CMDB>Users page. FortiSIEM 

Hi Guy, I have an error about forticlient: Unable to logon to the server. Your user name or password may not be configured properly for this connection. (-12) I sure username and pass is right. My 100D ver: v5.4.3,build1111 (GA) Forticlient ver: 5.4.2.0860 Thanks for help. 

When looking at the results from "Show matching logs" from the firewall policy, the Result field doesn't say Accept or Deny - it's just blank. I tried to telnet from the firewall to the destination of the blank Result field rule, but it shows the console line is in use. FortiGate-80F # exec telnet 10.51.0.156 13155Trying 10.51.0.156...Failed to connect to specified unit.Console line is in use. Clear it before next try. I did a search on Google and got no hits. How do I clear the console line? Thanks

FortiManager  FortiGate Dear friend,Add FortiGate 7.2.6 to Fortimanger 7.4.1 under adom adom_1 instead of root; all FortiGate(s) and FortiManager are deployed on AWS. Confront bug all the way as following: Understand one can (1) FortiGate add FortiManager  by searching FortiManager's ip address -- this only adds to adom root? (2) FortiManager add FortiGate by searching FortiGate's ip address -- never works (even for adom root, confront the bug above) for AWS deployment, but used to work for VMware ESXi deployment for Adom root (no can have no access to ESXI deployment in short term).Neither can help so far.  

Hi guys, I'm trying to make a server accessible from WAN, I configured virtual ip and port for the server, and then  I created a local in policy to test : config firewall local-in-policyedit 1set intf "port1"set srcaddr "all"set dstaddr "all"set action acceptset service "ALL"set schedule "always"nextend but I cannot access the server and related traffic still matches policy 0 : id=20085 trace_id=114 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=6, [my ip]:2084->[FW IP]:50022) from port1. flag [S], seq 2666835964, ack 0, win 64240"id=20085 trace_id=114 func=init_ip_session_common line=5993 msg="allocate a new session-01e45466"id=20085 trace_id=114 func=vf_ip_route_input_common line=2615 msg="find a route: flag=80000000 gw-[FW IP] via root"id=20085 trace_id=114 func=fw_local_in_handler line=447 msg="iprope_in_check() check failed on policy 0, drop"  Am I doing it wrong? Please help, thanks!

Hi All, For HA Reserved interface, can we use a totally different subnet as below?FortiGateA Mgmt: 192.168.1.100/24FortiGateB Mgmt: 192.168.2.200/24 Thank you so much

I apparently cannot change the VDOM for this interface presumably due to the Reference shown. Is it on account of the reference? What should I do? Much appreciate any help...  

Hi everyone, I'm experiencing a very frustrating problem with route redistribution from eBGP into OSPF.  Consider the below diagram.  The goal is to route traffic as directly as possible to the Azure networks 10.24.0.0/16 and 10.25.0.0/16.  This was all going well until I connected a non-Area 0 (R5) router to R2 and/or R3.  See referenced links A and B in the diagram.   Once R5 brought up an adjacency with R2 and/or R3, R1 and R4 decided the best path to these /16 networks was via R5.  An ospf path cost much larger than any direct path.  I've attempted to redistribute using External type 1 and type 2, no difference.  All ospf areas are "normal".   If I take the link A and B down, all goes back to normal and routing makes sense again.  R5 in this case chooses R1 > R2 > 10.25.0.0/16.  Also R5 chooses R1 > R3 > 10.24.0.0/16.   R5 is only a member of Area 40.  R1, R2, R3, and R4 are all ABRs.  R2 and R3, ASBR

When creating firewall policies, it can be tedious and error prone to have to keep adding in common internet service databases. For example, I would like to have one group/object that has the Botnet-C&C.Server, Malicious-Malicious.Server, and Phishing-Phishing.Server. Is it possible to do this?

Hello team, is it possible change version of NetFlow from cli FGT?I would specified version 5 of NetFlow, is possible? Thanks for the support

Hi there, are there any plans to support MacOS 14 anytime soon?Would be great so our client users can upgrade their machines.  Thank you!

hello everyone.i have a fortiswitch 224E PoE connected on fortilink to a fortigate 60f. initially i used an cisco switch which allowed on the same port voice vlan and data vlan so desktop can access is vlan through the ip phone second port.now with the fortiswitch i tried the voip vlan for native vlan and the pc vlan as allowed vlan and the pc cant access his network. if i reverse vlans my pc access his network but the ip phone doesn't reach his.need some help please

I have been attempting to create a custom report that shows all firewall configuration changes made for tracking purposes. I do not see a built in way to use a custom search and output to it a daily report with all detailed results. Can anyone point me in the right direction? I have been using the query below in Log View >> Event >> Systemlogdesc="Object attribute configured"  I am interested in these columns: Date/Time, Message, User, Config Attributes, Config Object, Config Path and Log Description Product: FortiAnalyzer-200D Version: 5.4.1 GA   Thank you.

im trying to set domain on phase1-interface but i get the error command parse error before 'domain' Command fail. Return code -61 From what ive found only mode cfg should have to be enabled and type dynamic?Am i missing anything this is the config: edit "<Withdrawn>" set type dynamic set interface "wan" set ip-version 4 set ike-version 2 set local-gw 0.0.0.0 set keylife 86400 set authmethod psk unset authmethod-remote set peertype any set net-device disable set exchange-interface-ip disable set aggregate-member disable set mode-cfg enable set ipv4-dns-server1 <Withdrawn> set ipv4-dns-server2 <Withdrawn> set ipv4-dns-server3 0.0.0.0 set ipv4-wins-server1 0.0.0.0 set ipv4-wins-server2 0.0.0.0 set ipv6-dns-server1 :: set ipv6-dns-server2 :: set ipv6-dns-server3 :: set proposal aes192-sha256 aes256-sha256 set add-route enable set localid '' set localid-type auto set negotiate-timeout 30 set fragmentation enable set ip-fragmentation post-encapsulation

Hi team, Anyone here have the experiance on integrating nagios core with fortigate firewall. I try using fortinet plugin in nagios community website but it seems like my model is not yet supported by the script. I try using the MIB file to locate OID for the hardware but I only found trap OID only (FORTIGATE-CORE-MIB). If there is any suggestion and advice on this issue please let me know. Thanks in advance. 

Hello,   We have deployed Fortigate in Azure environment. In azure Fortigate has just 2 Interface (1 WAN, 2 LAN). We would like to use zone for Policy. We already have several zones and use them for policy (For example VPN zones). We would like to apply zone also to LAN interface and just want to be sure that noting will be affected during this procedure (of course if there is no any misconfigurations). Are there any coveats from azure side for Azure-fortigate?