Solved

I have been attempting to create a custom report that shows all firewall configuration changes made for tracking purposes. I do not see a built in way to use a custom search and output to it a daily report with all detailed results. Can anyone point me in the right direction? I have been using the query below in Log View >> Event >> Systemlogdesc="Object attribute configured"  I am interested in these columns: Date/Time, Message, User, Config Attributes, Config Object, Config Path and Log Description Product: FortiAnalyzer-200D Version: 5.4.1 GA   Thank you.

im trying to set domain on phase1-interface but i get the error command parse error before 'domain' Command fail. Return code -61 From what ive found only mode cfg should have to be enabled and type dynamic?Am i missing anything this is the config: edit "<Withdrawn>" set type dynamic set interface "wan" set ip-version 4 set ike-version 2 set local-gw 0.0.0.0 set keylife 86400 set authmethod psk unset authmethod-remote set peertype any set net-device disable set exchange-interface-ip disable set aggregate-member disable set mode-cfg enable set ipv4-dns-server1 <Withdrawn> set ipv4-dns-server2 <Withdrawn> set ipv4-dns-server3 0.0.0.0 set ipv4-wins-server1 0.0.0.0 set ipv4-wins-server2 0.0.0.0 set ipv6-dns-server1 :: set ipv6-dns-server2 :: set ipv6-dns-server3 :: set proposal aes192-sha256 aes256-sha256 set add-route enable set localid '' set localid-type auto set negotiate-timeout 30 set fragmentation enable set ip-fragmentation post-encapsulation

Hi team, Anyone here have the experiance on integrating nagios core with fortigate firewall. I try using fortinet plugin in nagios community website but it seems like my model is not yet supported by the script. I try using the MIB file to locate OID for the hardware but I only found trap OID only (FORTIGATE-CORE-MIB). If there is any suggestion and advice on this issue please let me know. Thanks in advance. 

Hello,   We have deployed Fortigate in Azure environment. In azure Fortigate has just 2 Interface (1 WAN, 2 LAN). We would like to use zone for Policy. We already have several zones and use them for policy (For example VPN zones). We would like to apply zone also to LAN interface and just want to be sure that noting will be affected during this procedure (of course if there is no any misconfigurations). Are there any coveats from azure side for Azure-fortigate?

Hi there When I connected and setup a FortiExtender this tunnel seemed to be configured automatically. I say seemed to as I only noticed some time after. What is it?

Are VDOMs supported on all FG devices?The Fortigate Product Matri makes reference once only in respect of Fortimanager.Documentation (In my case 7.0.11) refers to such GUI locations asSystem > GlobalBut this is not present on my 40FI have enabled all switches hereSystem > Feature VisibilityBut no change.I am logged on as the default admin account in Super_User group.Is this perhaps a licensing related question?Thanks for any reply

Hi, guys, What is the root cause of session clash? 1: date=2022-06-13 time=16:51:53 eventtime=1655110313757822439 tz="+0800" logid="0100020085" type="event" subtype="system" level="information" vd="root" logdesc="Session clashed" status="clash" proto=1 msg="session clash" new_status="state=00010200 tuple-num=2 policyid=258 dir=0 act=2 hook=0 1.1.1.39:15120->2.2.2.1:8(10.113.1.115:8) dir=1 act=1 hook=4 10.113.1.115:8->1.1.1.39:0(2.2.2.1:15120)" old_status="state=00010200 tuple-num=2 policyid=258 dir=0 act=2 hook=0 1.1.1.39:15102->2.2.2.1:8(10.113.1.115:8) dir=1 act=1 hook=4 10.113.1.115:8->1.1.1.39:0(2.2.2.1:15102)"  Thanks a lot

Hi Team, I have observed Update Alert Record step is failling with an error :[Internal Server Error. Check log 'prod.log' for more details URL: https://localhost/api/3/alerts/30f2ae33-36cf-46f0-a098-47e9ef4669df], in one of our client setup, attaching the screenshot for the same.  When we checked in the prod.log we can see the below error: Uncaught Error: count(): Argument #1 ($value) must be of type Countable|array, null given {"exception":"[object] (TypeError(code: 0): count(): Argument #1 ($value) must be of type Countable|array, null given at /opt/cyops-api/src/EventSubscriber/WorkflowEventSubscriber.php:297)"} [] can anyone please help me to understand and resolve this issue. 

Hi all, Please help me how to troubleshoot internet slowness issue on FortiGate 100F firewall. I have created SD-wan and not internet not working properly.

Hi, Does anybody know how to delete local certs using the FortiGate API? I found out how to upload them here:Upload certs using API  But I need to delete the old one first to upload the new one. Thanks

Hello, I have deployed FortiManager in Azure Infrastructure (Version is 7.4.1 with Trial License (which supports up to 3 devices)). Also I have 2 virtual FortiGate on-premise in Activa\Standby HA. I would like to add them to the FortiManager, all accesses are granted, FortiManager has network access to the FortiGates, but cant add it.  There is screenshot: 10.225.244.2 - IP address of loopback interface (I enabled on them FMG-access)   What is the issue?

Hey everybody, I hope you can help me. I've got the problem, that assigning a policy package is rarely possible on our FortiManager. I first thought that the login is the problem (the last times I was only able to assign policy packages to a firewall when I logged in as admin, assigning with my personal account (also superadmin) was not possible). I tried that again today but also with the admin account I am not able to assign a policy package to any firewall. Neither on the devices edit-page nor on the installation target site under Policy & Objects (edit and delete buttons are greyed out). A few hours ago it was possible to change the policy packages. I modified some rules in some policy packages to do some testing but after that it was not possible to assign the packages anymore. EDIT: My personal account has the profile "SuperUser", exactly as the user "admin". All ADOMs and PolicyPackages are allowed. EDIT2: Fortimanager Version is 7.2.3 GA build1405. Can t

Hi all.We have an issue after configuring SSL VPN through Azure SAML and we can no longer reach Fortigate GUI via HTTP/HTTPS. We get prompted to use authentication via Azure when surfing to the WAN IP. This may be by default but even when we authenticate we just get redirected to the SLL VPN web portal instead of the Fortigate GUI. I have compared every setting I can think of and can't seem to find any solultion to this. We can surf to FQDN but it's the same story. We get asked to authenticate and is then redirected to the SSL VPN web portal. Fortigate 60F with FortiOS 6.4.14Any help or suggestions is appreciated!Kind regards

Folks,For some reason am unable to run any commands on the CLI yet i am using the default admin user. All commands are failing with the "parsing" error. See attached screenshot.What would i be doing wrong?

Hello,   I'm trying to use the filters object by group name using request.get (Python) via the FCT EMS Cloud API (see FortiClient EMS - FortiAPI - FNDN (fortinet.net)). So far I can't get it to work properly: if I run the following code (below is just the relevant get request of the code), the request gets authenticated and runs through. But the returned result still contain the index of all endpoint entries. Means, the filter setting seems note to be recognised for whatever reason. Please not that I've tried both 'group' as well as 'group_name' as key. Makes no difference. Any example or idea from anybody? Thanks a lot!   ---- 8<-- code snipped----- import requests import json <...> filters = {'group':'VPN-Hub-HH-7-2-1'} r = requests.get("https://forticlient.forticloud.com/fct/api/public/v1/ems_api/api/v1/endpoints/index", params=filters, headers=headers) print (r.url) r_dict = r.json() print(json.dumps(r_dict, indent=4)) <...> ---- \-- code

Hello everyone. We have issue with webhook with parameter HTTP Body with %%log%% added to telegram parameter "text" field because it's showing incomplete raw log. I tried to compare email and webhook, email is fine but webhook is incomplete.For example:1. In webhook using telegram I receive like this "Administrator msinfokom logged in successfully from ssh(10.xxxxxxx) --- FGTxxxx xxxx Admin Success Login --- date=2022-05-04 time=09:42:28 logid=" after logid it's nothing more2. In email I receive "FGT[FG1xxxxxxxxxx] Automation Stitch:Admin Success Login Automation is triggered.date=2022-05-04 time=09:42:28 logid="0100032001" type="event" subtype="system" level="information" vd="VDOM_xxxx" eventtime=1651632148xxxxxxxx tz="+0700" logdesc="Admin login successful" sn="16516xxxxx" user="xxxxxx" ui="ssh(10.xx.xxxxxx)" method="ssh" srcip=10.xxxxxx dstip=10.xxxxx action="login" status="success" reason="none" profile="super_admin" msg="Administrator xxxxx logged in successfully from ssh(10.

Hello, everyone. Is there a way in FortiNAC to prevent a host with persistent agent to connect to, for example, a guest network SSID if they had previously signed in into a corporate network SSID?  Thank you all!

Hi,I have been working for several months on a PowerShell module that uses the FortiGate REST API. This module is available on psgallery(.com) : https://www.powershellgallery.com/packages/PowerFGTActually, we support to connect to HTTPS or HTTPand use the following feature :[ul]Address (Add/Get/Copy/Set/Remove object type ipmask/subnet)AddressGroup (Add/Get/Copy/Set/Remove and Add/Remove Member)DNS (Get)HA (Get)Interface (Get)IP Pool (Get)Local User (Get)Policy (Add/Get/Remove)RoutePolicy (Get)Service (Get)Service Group (Get)Static Route (Get)System Global (Get)VDOM (Get)Virtual IP (Get/Add/Remove object type static-nat)Virtual WAN Link/SD-WAN (Get)VPN IPsec Phase 1/Phase 2 Interface (Get)Zone (Get)[/ul] it is very easy to use (and install) Launch PowerShell command line and launch following command for installInstall-Module PowerFGT for load the moduleImport-Module PowerFGTConnect to your firewallConnect-FGT 192.0.2.1You get a prompt to ask credential for example

1) Configure primary FW and factory restart secondary firewall. Configure HA and let them sync. 2) Configure primary and secondary FW separately with same configure. Change the HA priority. Which method is better? 

Hello. I'm very new to FortiNet products so please forgive me in advance. Under Security Events, on the summary page it says "No events" on everything, including AntiVirus. I have tested that the AntiVirus is working and logging events by going to eicar.org and trying to download their test files. If I click to view the AntiVirus logs, it does show those attempts were blocked. Why would it still show as "No events" in the summary? I tried changing to monitor instead of block, it lets the malware through and logs it, but that still does not show as a security event either. The same thing goes for intrusion prevention. I see logs where connections were dropped to our webserver from the intrusion provention protocols, but they do not show as an event either in the summary. Any and all help would be greatly appreciated. Thank you.

I created my first VLAN Interface on the Fortigate, under the LAN port that goes to our core switch. The LAN port to the HP Switch is a Trunk port and the new VLAN is permitted on the trunk port.   For now all the other VLAN interfaces are on the Layer 3 Core Switch   I cant ping the new VLAN's interface from the Core switch directly or by one of the resources I have on the new VLAN connected to the Core switch

I have a FortiGate 40F and at 7.2.5 everything was working properly. After the upgrade to 7.2.6, the same problem exists on 7.4.1, the wan interface (PPPoE) is failing. After a few seconds it is getting the IP from the ISP but almost immediately it fails again and is getting the 0.0.0.0/0.0.0.0Are there any suggestions?FortiGate 

I am seeking clarity on this advisory. A use of GET request method with sensitive query strings vulnerability [CWE-598] in the FortiOS SSL VPN component may allow an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services (found in logs, referers, caches, etc...) We have several employees who SSLVPN using the FortiGate VPN client.  They then RDP to a Windows VM server.  In this instances how can an attacker view the plaintext passwords using the GET request?  As I understand a GET request is an http request and RDP uses protocol 3389.  Fortinet Support was not helpful in explaining the logic behind the advisory.  Can someone help me understand how an attacker can do this?

HiI have set up automatic backup to a sftp server (move it transfer), scheduled backup works well and the file is transferring to the server as well. But unfortunately the file's size is zero KB.Tried manual backup to sftp server by using execute backup command in the cli, but result is same.Firewall has multiple vdom.Attached the captured packet screenshot for the reference Thnaks inadvance  

Dear colleagues,   I don't get ZTNA running with Forticlient on Fedora Linux. I always get the massage   "ZTNA Access DeniedThe page you requested has been blocked by a ZTNA restriction. Details: Invalid ZTNA client certificate"   I tried Firefox, Chromium and Brave as Browsers but got the same result. I rejoined the client to EMS, I reinstalled Forticlient but no change. Is there someone with the same problem or anybody who could help?   Forticlient 7.2.2.0753 EMS Forticloud Fortigate 7.0.12     kind regards stephan