Solved

Hi, We had hired VAPT to test and below is the report from them.Fortigate 7.0.11 & Fortimanager 7.0.10 Does anyone know about this?How to find out the OpenSSH version (not referring to SSH protocol version 2) used in Fortigate?Or does fortigate uses any OpenSSH?As OpenSSH v7.9 is affected by the vulnerability, CVE-2019-6111.If it’s affected, what is the workaround to mitigate from attacks?Thank you Category: A06:2021-Vulnerable and Outdated ComponentsVul Findings:Vulnerable OpenSSH VersionThe installed version of OpenSSH is affected by multiple vulnerabilities- logic error- out-of-bouns read- double-free memory fault- fail open permission list- one-byte overflow- double free in error path- integer overflow- improper group inheritance- exploitation of low-privilege code- double-free memory corruption- CVE-2020-14871- integer overflow- memory side-channel attack- CVE-2019-6111- zero-length files creation

Hello Anoynone know how to show the DHCPv6 IAID and DHCPv6 Client DUID on a fortigate ?The device is configured to get IPV6 address via DHCP on WAN1 port from the ISP.I want to know what IAID and DUID the fortigate is presenting to the ISP's DHCP server via the WAN port.Sniffing is not an option. 

Since I have 2 WAN interfaces in a virtual-wan-link.For the traffic is it Active-active or active-passive?Is there any way to change the priority?

Hi Team, We have a scenario where we want to have two internet output connections to the same ISP, one connection over the WAN with public IP (which is already configured), and the second connection is to be on another LAN interface with private IP. Please check the details below: The connection is as follows:  Users-->proxy server-->Fortigate-->ISP router-->internet this connection is going through the WAN public IP. We want to enable another interface that will be connected to the ISP router with DHCP config to obtain IP/GW, and to influence the traffic to specific destinations to go through the new connection (private IP) using PBR. The issue we are facing is that once we enable the interface (for example int 5) with DHCP config the internet connection goes down even without using it in any sort of policies. Thanks.  

Hi can we do the SNMP configuration for PRTG network monitoringwhen fortigate firewall is working with multi vdom and dedicated management port ?Forti OS is 6.4.12 and there are four vdoms that management interface is working on isolated VDOM,  

Hello   We are using FortiClient EMS to manged + 7.000 FortiClient, only using the VPN function. The EMS server uses our Microsoft Active Directory to pull in devices and their location in the AD. Currently we are assigning policies to devices based on the device location in AD (OUs).   However I'de like to be able to assign policies to users / user-groups. I've greated a new AD security group, and added my user as member. I'm able to view the AD security group in FortiClient EMS, and I can assign my policy to it. However I can't view my user as member of the group in EMS, and also my FortiClient still has the old policy assigned from it's current location. I've made sure the policy has the highest priority under 'managed policies'.   Anyone been trying this out with success?

FortiGate 1100E with FortiOS v6.4.14 build2093 (GA) We have a SIEM to collect and correlate events from multiple sources. On Fortigate we have configured SIEM as an external syslog server and it work well BUT i've noticed that only failed ssl-vpn login were sent.  Any idea how to configure Fortigate to sent also successful ssl-vpn login to external syslog? Thanks

Hello,   I have several question regarding HA (Active-Standby) Fortigate virtual.  I had some issues when I was trying to configure HA in virtual environment. I used this article: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/900885/ha-active-passive-cluster-setup When I enabled HA my firewalls went down and after that I had no access to them via CLI, Web and so on. But If I then break HA (I have access via ESXi console) then access to the firewalls appeared. But I found workaround - I configured HA with "Unicast Heartbeat". HA works, but sometimes when I do some configuration changes I see "HA not synchronizing" alert. I would like to know is it normal behaviour on not?   Thanks in advice. 

We have been working with git for years, two months ago we noticed that were not been able to use the git commands anymore: git pull git@github.com: Permission denied (publickey). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists.  In the beginning we tought the problem were the credentials, after many tests we realized that it must be something in the firewall, because:Inside our LAN covered by the Fortinet Firewall, we get this errorInside out LAN covered by the firewall setting a rule ACCEPT ALL (all open), same errorUsing git inside the WSL installed on the same machines, worksUsing a WIFI not covered by the firewall, worksUsing the tethering of a random phone, worksUsing a LAN not covered by the firewall, worksWe tested different git versions: 2.41.0.windows.3, 2.32.0.windows.2, 2.33.0.windows.2 and we got the same results. We don't know what further tests can be done in order

 Per above picture - sometimes, about 50% of the time, all our policy blocks show 0/0, despite having multiple policies, when applied to policy packages. This is following an upgrade to 7.2.3 from 7.0.8.

friends, a question, in which layer of the OSI model does the FortiGate firewall work? I found this link which indicates that it works on all layers. That's true?https://www.linkedin.com/pulse/qu%C3%A9-es-un-firewall-perimetral-y-tipos-hay-luis-florez-estrada/?originalSubdomain=es

Just realized that the term Trunk is not the same in FSW as in Cisco. Thats why I am trying to clarify trunking between cisco and FWS.I have a:FWSwith just one VLAN (VLAN 10)on Port3 is a computer connected:native & allowed vlan 10Trunk:no Ling Aggression.just want to use the nr port 24 to forward traffic from vlan 10 to a cisco port which is in access mode vlan 10.cisco swichwith VLAN 9 & 11on port 15 is a laptop connected:mode access vlan 10Trunk on port 25mode trunknative vlan 9allowed vlan 1, 10 & 11So my question is:I know that, while trunking both switches's ports should have the same vlan as native vlan.Since my cisco switch has vlan 9 as native, i configured the FSW like this:edit port24set native-vlan 9set allowed-vlan 10set stp-state enabledI see that my traffic goes through and i can ping the laptop on my cisco switch. Am i doing it correctly ?  

Hello Evryone, We are facing a strange issue with our azure saml authetification for vpn users. The issue is on web mode as well as Forticlient. The issue is that users are not redirected to azure login page. ->vpn works with local users->single sign on button appears on web mode (Policy must be ok)->when we enable debug for samld there is only 1 output :__samld_sp_create_auth_req [447]: SAML SP algo: 0 -> lasso=1. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST->When we test on azure (Assertion consumer service URL) we get invalid http request->on web mode when we click on single sign on we are not redirected to azure and we get ERR_EMPTY_RESPONSEWe have checked multiple times if there was any syntax mismatch between idp and sp but there are none 3 fortinet support engineers also checked We are running out of ideas. Did anyone faced this issue ? Any suggestion is welcome ! Thanks in advanceFortiGate 

I've tried to create an application control security profile for the DNS requests of our DNS Server, so that only application data of the type DNS (and ICMP/Ping) is allowed. The app profile looks like this:  When I did that, I saw in the logs that Google Translate was getting blocked. Here the log of the blocked connection attempt:      date=2023-08-30 time=10:34:34 id=7273030939687518227 itime="2023-08-30 10:34:35" euid=3 epid=101 dsteuid=3 dstepid=101 logver=700120523 type="utm" subtype="app-ctrl" level="warning" action="block" sessionid=369741986 policyid=546 srcip=*.*.*.* dstip=*.*.*.* srcport=63371 dstport=53 proto=17 logid=1059028705 service="DNS" eventtime=1693384475533113261 incidentserialno=81095000 direction="outgoing" apprisk="elevated" appid=24473 srcintfrole="lan" dstintfrole="wan" applist="app-dns" appcat="General.Interest" app="Google.Translate" eventtype="signature" srcintf="****" dstintf="****" msg="General.Interest: Google.Tran

HelloI have 4 FGT 7.0.12 of the same model in FGSP configuration (no HA), handling asymmetric traffic.For non-UTM sessions, when testing failover (FGT reboot) all works fine, the sessions keep working when the node fails-over and fails-back.However for UTM sessions the fail-over doesn't work when we have 4 nodes.If the FGT handling the UTM session is rebooted, the session hangs until the node boots up, then it handles back its UTM session.When I remove 2 FGT from my network and redo the test with only 2 FGT the fail-over works just fine. In summary:Non-UTM session fails-over successfully when we have 4 nodesUTM session fails-over successfully when we have 2 nodes, but hangs with 4 nodesAny idea? 

Hi Support,I am New to Fortinet firewall. we are using FortiGate 100F firewall and the firmware version is v7.4. we have created multiple Vlans and two WAN links. now I configured static route for wan links. and Now all the vlans network traffics are going in only one wan link ie (primary Link). the secondary wan link is idle. so i need to segregate  the Vlan traffic with the two WAN link. i need to configure One Vlan to access only Primary wan link. and second Vlan to access  secondary wan link.  and i have not configure the wan link in SD wan ZONE can you Please help. 

Ver 7.2.3 see pic below

 Hi, we have many Lenovo Notebooks with Intel and AMD CPUs. Since last week Friday we get more and more "Virus found" messages from our Forticlient. Here are the details: Environment:We are using EMS 7.0.4We are using Forticlient 7.0.3 and 7.0.5 (identical results)All Clients Windows 10 22H2, Lenovo Vantage installedWhat happens:The Virus is found in the directory %PROGRAMDATA%\Lenovo\Vantage\...\On Intel, the malicious file found is named dp687checkversion_10.exe, on AMD it is dp687checkversion_amd.exe The file cannot be quarantined and is running as a subprocess to conhost.exe in Windows\System32Once Vantage is uninstalled, the virus is goneIt might not be a virus, just a false positive from Forticlient, buta) I cannot just ignore itb) End Users get a red window with this message on their desktopsc) It MIGHT BE a virus (maybe even spread by lenovo?)When you google the amd file, you will find the virus definition by Joe Sandbox (https://www.joesandbox.com

Hello, FortiGate with FortiOS 7.2.5.I try to create an automation stitch that sends me output ofdiagnose debug config-error-log readcommand upon FortiGate start. As described e.g. herehttps://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/639044I should create two actions, first for CLI command, second for sending mail with %%result%% in message body. I used this setting:config system automation-action edit "get_config_errors" set action-type cli-script set script "diagnose debug config-error-log read" next edit "send_mail_result" set action-type email set email-from "***" set email-to "***" set email-subject "command output" set message "%%result%%" nextend# LogID 32009 = FortiGate Startconfig system automation-trigger edit "Start" set event-type event-log set logid 32009 nextendconfig system automation-stitch edit "send_config_errors_upon_start" set trigger "Star

Hello most esteemed professionals, I'm new here and to the Fori world in general. Today I have a particular question for you all that has my mind in a loop and hopefully you can assist? We have a Fortigate 100E and a Unifi Pro 48 port POE switch. My objective is to link them at 10GE so I did the research and found the Multi mode modules for both: Forti: FN-TRAN-SFP+SRUnifi: OM-MM-10G-D I installed them and they work only issue is that they only connect at 1GE and not 10GE. what should I do to get them to run at the appropriate speeds for my goal and what pointers can you give me?Looking forward to your knowledge.

Hello Everyone, Wanna check if it is only a DB not up-to-date issue and is it a common known issue since the same issue found in all of my FortiGates upgrade scenario.  -Upgrade from v7.0.12 to v7.2.5-201F standalone-201F HA A-P cluster-101F HA A-P cluster-All of the forigates were using 1 month trial license and still vaild.-FortiAnalyzer was configured but not connected before and after upgrade.-Only mgmt port connected and have access to Internet behind simple source NAT from next hop gateway (a cisco router). After around 2 hours wait, all the "xx signature is missing" messages were gone. Messages of config-error-log found right after upgrade first boot# diagnose debug config-error-log readffdb_app_map_process-3326: wrong word 3798ffdb_app_map_process-3326: wrong word 196ffdb_app_map_process-3326: wrong word 208ffdb_app_map_process-3326: wrong word 190ffdb_app_map_process-3326: wrong word 46ffdb_app_map_process-3326: wrong word 132ffdb_app_map_process-3326:

Hello, thanks for your time in reading my message.Maybe I have not enough experience with Fortigate. I'm trying to create a Virtual IP where from one external IP to two differents mapped IP in my LAN.I don't know if this is possible as I receive an error when I define range. Please, see attached image for clarity and thanks again for helping  Regards  

Hi All, We've configured FortiAnalyzer HA in our environment and have configured Peer IP and Cluster Virtual IP.From FortiGate to send log to FortiAnalyzer , which interface IP of FAZ should be use ? Cluster Virtual IP or Peer IP ?Also what is the purpose of peer ip ? Please help guide on this.Thank you so much. 

Hi All After recently upgrading my Forti EMS to 7.2.1 build 0793. Get the following Error:ERROR log Internal Server Error: /api/v1/endpoint_policies/15/update This happens every time I try to update or create an Endpoint Policy. The policy retains the changes but says:Server encountered an error, please try again later. Any Ideas? RegardsShayne

I'm using a Fortigate 70F and experiencing lower bandwidth in download then upload for all speed tests done from a computer and internet mode. The CPU of the Fortigate doesn't going to 100% during the speed test. The version of FortiOS is 7.0.12. I'm connected to a WAN port of the firewall. No limit bandwidth policie are applied. My LAN connection is wired gigabyte. Thank you for commenting on the reason for this situation or provide a solution to get the full internet bandwidth or at least the same as upload speed.