Solved

Running v7.4.1 build2463 on an 80E and found out that when changing/adding a Destination directly from Firewall Policy page from the "edit" icon, the services on the policy changes to ALL. It bewildered me and I was beating myself up over why I would have set this policy to ALL. So I set it to what it should have been, then noticed it on the next change. Happened every time I tested after. Hopefully helps someone from a headache and inadvertently opening up security. I've already submitted a ticket so they can be aware as I couldn't find anything about it online.

I am looking to enable IPv4 DoS policies which are recommended practice.  However, I am concerned about impact. Does anyone have any recommendations for enabling these?  Should I do them one at a time? Is it safe to do them all at once? Are there some I should not enable etc? Should I leave them at the default thresholds?    Thanks,

I have a list of < 300 IP numbers that I know about. We're not using DHCP, so there should be no addresses outside of those 300. I am really curious if there is any traffic going to IP numbers that I don't know about. If there is it could indicate something that is broken, or a hacker trying to discover something. This is obviously would work only on internal ports.  Any ideas?

Hi Community, I am looking for deep info about the relation between FortiManager discovery process & FortiGate local credentials after the discovery process. During the discovery process (onboarding new FGT) we use the local super user „123test“ and it works fine completing the discovery process but the question is what happens if we change the password of „123test“ on managed FGT? Is this local credential is still needed? FMG training said, the discovery credentials (123test) is used to collect info about the device (version, config, model..) AND also to push new configs BUT we are using RADIUS authentication for managed proposes on FMG and FGT, that means from my best understanding the config push runs over RADIUS authenticated users (Events Logs on FGT) and NOT via local credential „123test“ anymore. If this is true, the local credentials used during the discovery process should NOT be necessary anymore, right? or FortiManager still needs this local credentia

Dear All,   Searching the web I found nothing. Before I jump to FAC as an option. Is it possible to migrate my token from FG on-prem to FortiToken Cloud? I want all my tokens assigned to my FGs to be centrally managed by FortiToken Cloud.   I appreciate your help and immediate feedback.    

Hi All,How can we verify if IPS/antivirus signature are up to date in Fortigate firewall.  Regards,Fortigate Firewall learner 

Hi All,I created an IPSec VPN tunnel for remote Access "VPN for MAC" and Client Address Range 172.30.1.1-172.30.1.254.Soon after that I deleted it as all of a sudden it stopped working. Now I'm trying to re-create IPSec VPN tunnel with the same name "VPN for MAC" and the same Client Address range but getting the error on the screenshot.   Could you please advise how to delete the original tunnel entry.

Why would an IPsec tunnel not come up?I have configured such a tunnel copying a production setup I know to be working.The symptom I am troubleshooting is why the new tunnel interface remains inactive.I can ping from the 40F CLI over the internet to the underlay tunnel endpoint (.172)This is confirmed with traceroute showing path to the internet (192.168.1.1 is the Starlink next hop)Starlink obviously implements NAT on the way out to the net.The new tunnel interface remains inactive.Sniffer tracediagnose sniffer packet wan 'host 203.57.169.172'Show no packets IKE or otherwise being sent (or received)It will show the pings out and back if I ping the .172 tunnel destination as mentioend above.What am I doing wrong?Please let me know if you want other CLI/GUI outputs.Much much appreciate any help.....

I'm currently in the process of migrating from our data centre to the cloud, at the moment we have two public facing DNS servers lets use 1.1.1.1 and 2.2.2.2 for there external IP addresses which are currently NAT'd to 10.1.1.1 and 10.1.1.2 this works fine. What I need to do for testing is to keep the traffic flowing to 1.1.1.1 and 2.2.2.2 but instead of NAT'ing to the internal IP addresses I want to forward to two external DNS servers in the cloud say 10.10.10.10 and 20.20.20.20. I'm sure in the past when I did this test I merely changed the two NATS from 1.1.1.1 -> 10.1.1.1 to 1.1.1.1 -> 10.10.10.10 and the other 2.2.2.2 -> 10.1.1.2 to 2.2.2.2 -> 20.20.20.20 This isn't working now for some reason, when I try and resolve a name I get a time out, but if I change the VIP back to the internal address it works again. Does anyone know what I'm missing (eventually the firewall will be cut out from this and the DNS servers will be referenced by their external

Dear good afternoon.Currently, a vulnerability has been released that affects fortigate computers CVE-2023-37935In the official Fortinet documentation it indicates that it must be updated to 7.0.13, however it is not yet available to download the firmware image from Fortinet support, so for security reasons we must update to version 7.2.6Likewise in the case of version 7.2.6. We need to know the compatibility with your fortiAP but in the release notes we do not locate the matrix where version 7.2.6 is includedWhen will the compatibility matrix of 7.2.6 with the fortiap be released?    

Hello, we have fortigate, deployed in Azure. We have configured SAML for authentication/authorizations for FortiVPN. Now we are also planning delpoy another fortigates on ESXi infrastructure, where we also need to configure FortiVPN with SAML. Qsuestion is Can I have one SAML application on azure which will be mapped with both fortigates? AD groups, and policies will be the same. 

We have this topology and we are having connectivity problems to get from the LANs (below) to the WANS (above). The L3 Nexus Switches are using HSRP, so each one has its own IP and the virtual one floats between them. In the case of the catalysts, they are in a stack and have a single IP.The problem is that we have connectivity for about 5 minutes but after that time the services drop. We perform a clear arp on the catalysts, and we recover connectivity for another 5 minutes and then it drops again.We eliminate the firewall cluster and connect the Nexus to the Catalyst directly and everything works ok.We suspect that firewalls are not letting HSRP's gratuitus ARPs through.  We foun this article  Technical-Tip-Transparent-mode-with-VRRP-HSRP-or-Network-Load  But we have some differences: The connection with the HSRP in the Nexus is through a vlan in port1, the same vlan in the port2 to the catalyst (both are in the same forward domain) Wich is rig

I marked a post solved in error.OMG what an error that was!Is there a way to unsolve that post?Alternatively, would one of you moderators mind doing the honours for me?Why does my new tunnel interface not come up or at least try and negotiate?  Thanks!!!!

We have a web application firewall (WAF) profile applied to incoming traffic to our web application server.  This server hosts several different applications all using the same FQDN (and IP) but they are accessed by different sub directories as shown below: https://example.com/Application1/https://example.com/Application2/https://example.com/Application3/ In the example above, there are 3 different web applications.  Is there a way to make the WAF profile exclude inspecting traffic to Application 2?  Looking through the FortiOS CLI options for the WAF profile, there doesn’t appear to be, but wanted to double check.  I was hoping there would be a way to exempt WAF inspection based on a specific URL or URL pattern (in this case https://example.com/Application2/*). We do not have FortiWeb, but rather are relying on the WAF features baked into FortiOS 7.2.X. Thanks in advance.

I go here and download a 60F datasheet:I do a get system status:How do I relate the 2 together?What hardware model do I in fact have?Is the System Part number something I can look up anywhere?Are there models other then that specified on the datasheet?I have reason o believe that there is an LTE interface on this unit (I don't see a FortiExtender configured)

Greetings Forti PeopleWhy does my Rugged 60F-3G4G have more options available in theSystem > Feature Visibility section?See below.Both are running 7.0.11 as you can see. 

Hi, I am trying to add multiple WAN interfaces under SD-WAN Zone to distribute internet traffic but one of the two WAN interfaces is not available. Is there a problem with 7.0.12? How to use multiple WAN Interfaces to distribute internet traffic in this case? I need to use WAN1 for 192.168.1.0/24 and WAN2 for 192.168.2.0/24 and if WAN1 goes down, the traffic of 192.168.1.0/24 should automatically shift to WAN2 Interface. Thanks.

Hello, Please take a look at the diagram. The requirement is for Server-1 to connect to Server-2. I need some suggestions for the issue. The 'Local Gateway" for the tunnel is a public IP defined inside the LAN. So the ISP doesn't matter for the "local gateway". But when creating a tunnel, Fotigate needs me to select an interface. So the only option for me is to create 2 tunnels on FGT-1 corresponding to each interface/ISP. I have to select the same "remote gateway" with the same "local gateway" over 2 different local interfaces (one corresponding to ISP1 and the other corresponding to ISP-2. The remote end has only one ISP, meaning it won't be able to accept 2 tunnels with the same encryption domains. How do I solve this issue?

Hi,One of my Windows virtual servers suddenly lost network connectivity and started showing "Duplicate after its ipv4 address". When I checked the ARP, it was showing the Fortigate LAN Interface Mac address. The Server IP Address is not added to any of the Fortigate Interfaces. Any Suggestions? Thanks.

HelloWe have 2 pairs of FortiGates, FGCP over FGSPWhat can be the side effects of having HA1 & HA2 ports for synchronizing both FGSP and FGCP at the same time?

Hello,We have virtual FortiGate, deployed in Azure. We activated Remote Access VPN (FortiVPN) and integrated it with SAML Azure. Authentication don based Group. And I have question regarding these groups. For example:If i Have group_1 which have access to server_1 and server_2, also i have user_A which is member of group_1.Also I have group_2 which has access to Server_3, and user_B.  And User_A can access to servers which is provided be group_1And User_B can access to servers which is provided be group_2But If I then need to provide for User_A access to the Server_3 what do I need to do? Do I need to add this user also to Group_2? or I need to create Group_3, provide for this group accesss to server_1, server_2, server_3 and then add to this group User_A?  

Dear community, We are using FortiAuthenticator as External Authentication source for our FortiSIEM-users, providing us MFA. At the moment, we followed the guide for External Authentication Settings and set up this integration via RADIUS.It works fine, but of course entering the 6 digits of FortiToken is not very appealing to users ;) So, we'd like to move to SAML. I am not deep into the information that needs to be exchanged between both tools. The FSM docs focus on Okta and Azure AD which work a little different to FAC. Has anyone here experience in connecting these two components and likes to share the general config steps? If not, we will figure out and I will share our experience in a few weeks... Best,Christian

 Hi Community, I'm running into a problem while testing a customer setup. Customer is using a 3rd party device between FG and FortiSwitches, so I'm testing that setup. FortiLink mode over a layer-3 network is working fine with 2 FS224D-FPOE, but the FS108F is making some trouble. Fortigate is running version 7.2.5, all FortiSwitches are running 7.2.3. As you can see in the screenshot, CAPWAP is coming up, but after some time there are some error messages and the CAPWAP is down again. Anyone an idear what's wrong here? When connecting the FS108F direct to another fortiswitch, it's working fine. Thanks RegardsNico

Good day!I have non-critical but pretty annoying issue which is connected with Fortimanager, which displays application IDs instead of application titles in Fortigate Security policies. So for example if I want to provide RDP access and create a policy using Application (not service), Fortimanager shows id 15511, not RDP (you can see it on the screenshot). This bug appeared after Fortimanager upgrade to version 7.2.3, but I can't find any information how to fix it.Maybe someone has already faced such problem and know how to solve it? Any help is appreciated.Thanks! 

I have a 60F-3G4G in production and a 40G on test.I want to do a diff on the show full-config output but I find the output so different that I do some digging.Why is there such a massive delta in the config system ? output ?Thanks