Solved

 Hi, we have many Lenovo Notebooks with Intel and AMD CPUs. Since last week Friday we get more and more "Virus found" messages from our Forticlient. Here are the details: Environment:We are using EMS 7.0.4We are using Forticlient 7.0.3 and 7.0.5 (identical results)All Clients Windows 10 22H2, Lenovo Vantage installedWhat happens:The Virus is found in the directory %PROGRAMDATA%\Lenovo\Vantage\...\On Intel, the malicious file found is named dp687checkversion_10.exe, on AMD it is dp687checkversion_amd.exe The file cannot be quarantined and is running as a subprocess to conhost.exe in Windows\System32Once Vantage is uninstalled, the virus is goneIt might not be a virus, just a false positive from Forticlient, buta) I cannot just ignore itb) End Users get a red window with this message on their desktopsc) It MIGHT BE a virus (maybe even spread by lenovo?)When you google the amd file, you will find the virus definition by Joe Sandbox (https://www.joesandbox.com

Hello, FortiGate with FortiOS 7.2.5.I try to create an automation stitch that sends me output ofdiagnose debug config-error-log readcommand upon FortiGate start. As described e.g. herehttps://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/639044I should create two actions, first for CLI command, second for sending mail with %%result%% in message body. I used this setting:config system automation-action edit "get_config_errors" set action-type cli-script set script "diagnose debug config-error-log read" next edit "send_mail_result" set action-type email set email-from "***" set email-to "***" set email-subject "command output" set message "%%result%%" nextend# LogID 32009 = FortiGate Startconfig system automation-trigger edit "Start" set event-type event-log set logid 32009 nextendconfig system automation-stitch edit "send_config_errors_upon_start" set trigger "Star

Hello most esteemed professionals, I'm new here and to the Fori world in general. Today I have a particular question for you all that has my mind in a loop and hopefully you can assist? We have a Fortigate 100E and a Unifi Pro 48 port POE switch. My objective is to link them at 10GE so I did the research and found the Multi mode modules for both: Forti: FN-TRAN-SFP+SRUnifi: OM-MM-10G-D I installed them and they work only issue is that they only connect at 1GE and not 10GE. what should I do to get them to run at the appropriate speeds for my goal and what pointers can you give me?Looking forward to your knowledge.

Hello Everyone, Wanna check if it is only a DB not up-to-date issue and is it a common known issue since the same issue found in all of my FortiGates upgrade scenario.  -Upgrade from v7.0.12 to v7.2.5-201F standalone-201F HA A-P cluster-101F HA A-P cluster-All of the forigates were using 1 month trial license and still vaild.-FortiAnalyzer was configured but not connected before and after upgrade.-Only mgmt port connected and have access to Internet behind simple source NAT from next hop gateway (a cisco router). After around 2 hours wait, all the "xx signature is missing" messages were gone. Messages of config-error-log found right after upgrade first boot# diagnose debug config-error-log readffdb_app_map_process-3326: wrong word 3798ffdb_app_map_process-3326: wrong word 196ffdb_app_map_process-3326: wrong word 208ffdb_app_map_process-3326: wrong word 190ffdb_app_map_process-3326: wrong word 46ffdb_app_map_process-3326: wrong word 132ffdb_app_map_process-3326:

Hello, thanks for your time in reading my message.Maybe I have not enough experience with Fortigate. I'm trying to create a Virtual IP where from one external IP to two differents mapped IP in my LAN.I don't know if this is possible as I receive an error when I define range. Please, see attached image for clarity and thanks again for helping  Regards  

Hi All, We've configured FortiAnalyzer HA in our environment and have configured Peer IP and Cluster Virtual IP.From FortiGate to send log to FortiAnalyzer , which interface IP of FAZ should be use ? Cluster Virtual IP or Peer IP ?Also what is the purpose of peer ip ? Please help guide on this.Thank you so much. 

Hi All After recently upgrading my Forti EMS to 7.2.1 build 0793. Get the following Error:ERROR log Internal Server Error: /api/v1/endpoint_policies/15/update This happens every time I try to update or create an Endpoint Policy. The policy retains the changes but says:Server encountered an error, please try again later. Any Ideas? RegardsShayne

I'm using a Fortigate 70F and experiencing lower bandwidth in download then upload for all speed tests done from a computer and internet mode. The CPU of the Fortigate doesn't going to 100% during the speed test. The version of FortiOS is 7.0.12. I'm connected to a WAN port of the firewall. No limit bandwidth policie are applied. My LAN connection is wired gigabyte. Thank you for commenting on the reason for this situation or provide a solution to get the full internet bandwidth or at least the same as upload speed.

 I am using a Fortigate 40F with FortiOS 7.4.0 build 2360, and I'm looking to create a certificate for my webgui and another certificate for my web VPN via the Let's Encrypt service the firewall provides, and I'd like to configure ACME auto renewal. I purchased a domain through CloudFlare to use for the firewall, let's call it "mydomain.com". I created an A record in the CloudFlare that points mydomain.com to the public IP address of my network, which is my Fortigate unit, as it's the router. However, when I try to create a certificate for mydomain.com in the GUI, under System > Certificates > Create/Import > Certificate > Use Let's Encrypt, it errors out, stating "no valid A records found for mydomain.com; no valid AAAA records found for mydomain.com".Edit: I read the following posts prior to posting this:1.) https://community.fortinet.com/t5/Support-Forum/fcm-models-acme-acme-Acme-Error-A-C-M-E-Certificate-request-has/td-p/2644552.) https://docs.fortin

hI,I am running a FortiGate with Fortios 6.4 version. I have the firewall synced with my AD, this is working so I can see username and stats from my AD users in the Fortiview pages.I want to configure a policy (is for browsing navigation allowed) only for a group of my AD users, but when I try to configure 'Source' in the policy, and select the group in the list, I get this error.I ge this error: 'One address, address group, external resource or Internet service is required' As far as I understand, this means I can't create a policy that only is applied to a single group of users? There is no way to for example allow browsing to one group members and to forbide browsing to all other users?Thanks a lot.

Hi, I am using ForgiGate with Fortios 6.4 and I need to close all my Interenet outgoing connections but allow the ones that Anaconda (python development environement) uses. Anaconda connects via port 80 and 443 to internet, but the destination domains are not fixed, as the app asks for existant repositories and this destinations url are constantly changing and they count for dozens every connection. The question is, if there is some way to allow Anaconda traffic, as I don't see how can I parametrize it for to be identified and allowed by the FortiGate. I have checked in FortiGuard for in case this app is categorized, but the results are empty:https://www.fortiguard.com/search?q=Anaconda&engine=1Thanks a lot

Dear all,I can't log to fortianalyzer 200F after upgrading from v5.6.3 to v7.0.8 (authentication failed. Please try again...)Noted that the same issue appear using the console cable (or a directly connected network cable). Thank you in advance for your cooperation.

Hi Iam trying to use a Device Profillin Rules, to match our doamin computers to a group.We are using the base license.So I have installed  persistent agent on all clients. And the look at if there are in the correct domain name.But when doring a test on the host, connected with peristent agent i now get:No fingerprint data found for rule. Grace period has not expired. Putting back on queueWhat does this mean?If i remove the Windows Profile, it works, but then i do not match if it our domain name. :) 

Hello Team, I have a fortigate to which I want to connect a fortiswitch and to this fortiswitch another fortiswitch in cascade.My question is: in order to connect fortiswitch to fortiswitch, do I have to configure a particular port on the first fortiswitch and put it in fortilink or can I use the one I want? How should the port connecting the first fortiswitch to the second one in cascade be configured? thank you for your support

Dear friends, Regarding the KBs below:I understand that to use an IP address not other than the primary IP address configured on the exit interface of the tunnel, the IP address should be configured as a secondary IP address on that interface. Technical Tip: How to configure IPsec VPN settings... - Fortinet Communityhttps://docs.fortinet.com/document/fortigate/6.4.9/fortios-release-notes/230510/changes-in-default-behavior.https://community.fortinet.com/t5/FortiGate/Technical-Tip-Fix-issues-with-IPsec-tunnels-configured-with-an/ta-p/213133 Why the option "specify" is still existing as an option to configure the local gateway IP address of the IPSEC tunnel. I tested the "specify" option and the tunnel did not come up until I configured my IP as a secondary IP. So what cases I should use the specify option? shall it be an IP address that is configured on another interface? 

I want to completely turn off a port including power on a FortiSwitch port connect to FortiAP all managed by Fortigate. What is the correct way of doing this? I tried change the port Status to Disabled, PoE Disabled, Reset PoE. I can still see some FortiAP LED light up! The only way I can somehow make it work is to reboot the switch. I am trying to configure FortiAP with aggregate ports with LACP using two ports. If I don't do it in the right sequence, I lose access to the AP. The only way to get it back is to reboot the switch. Reset the ports doesn't seem to help.

Hi all. We have one very interesting case. We using Fortigate HA routers on HQ and Branch.Branch is connected to HQ via 2 providers over IPSEC-SD-WAN tunnels.But now we have often problems with these 2 providers availibility and decided to try Starlink.We have connected Starlink router to Fortigate, switched Starlink router to bypas mode. Now Branch's Fortigate behind Starlink's CGNAT with IP 100.122.N.N 255.192.0.0 and we can't connect classic peer-to-peer IPSEC as before with those 2 providers with public ip on both sides. So the question is how to make connection between HQ and branches?We tried configure IPSEC with dilaup user on HQ side as listener and remote side connect to HQ public ip.The tunnel become UP but there is no traffic between routers. I sugges that there is some configuration mistakes, but need more experience to debug it.

 Hi guys!  My 80F is getting loads of warning messages of temp is too high after upgrading to fortiOs 7.4, externally I can't fell it hotter than usual, the data center is climate controlled and the fw is not placed in encloused space. It is a probably bug?

I'm VERY new to Fortinet and am attempting to migrate from an ASA that's managed by a 3rd party to our own FG 201F.  I've got most of it configured, but struggling with how to setup my DMZ.  Current ASA has 3 DMZ's, each setup with their own public IP ranges on their own VLANs.  The DMZ's are then assigned to 1 physical port on the ASA. Now...I want to setup my DMZ and assign private IP's to the hosts and then map/NAT/virtual ip/whatever to the public IP's.  My question is...how do I setup the interfaces so I have multiple public IP's?  Do I create multiple DMZ interfaces?  Do I assign multiple IP's to the WAN interface? For example...current DMZA has public IP range of 10.10.0.0/29.  ASA has an interface in that range and it's assigned to a VLAN.  All hosts on that VLAN are also assigned public IPs in that range. DMZB has public IP range of 10.20.0.0/29.  ASA and hosts assigned to that range and VLAN.  

Hi, I have upgraded my FortiClient VPN from 7.0.6 to 7.0.8 and now the FortiClient VPN doesnt show the machine certificate. I had to give myself local admin privileges for the VPN client to display the machine certificate. Anyone else have the same issue ? Thanks Rakesh

Is the above scenario possible? Site A === site to site vpn === Site BSite B === site to site vpn === Site CSite C === site to site vpn === Site A It is like a network triangle but will it work?

to perform some tests safely on a FortiGate (FortiOS 6.4) doing BGP i was trying to setup a prefix-list that denies all prefixes and apply that the BGP neighbour section via set prefix-list-in / set prefix-list-out. as a prefix-list contains a implicit deny at the end i was expecting an "empty" one would be enough. config router prefix-list  edit "deny-all"    set comments "deny all prefixes"  nextend but this doesn't deny anything until i add a rule for dummy prefix with the deny action. then it behaves like i wanted to. anyone that knows / can confirm a rule for a dummy prefix with deny action is required here?

We have this odd issue where the memory is spiking to 85% on avg its 80% and causing internet down firmware : v6.2.0 build0866 (GA) Can anybody please tell how to fix this problem??  

I upgraded to test the beta version of Monterey. FortiClient6.0.9.162 The VPN connection terminates unexpectedly! (Error Code: -121)  20210721 10:59:08.513 [sslvpn:INFO] unknown:0 dns suffix: 20210721 10:59:08.513 [sslvpn:INFO] unknown:0 epctrl ping server: 20210721 10:59:08.514 [sslvpn:INFO] unknown:0 xml parsing split tunnel info 20210721 10:59:08.514 [sslvpn:INFO] unknown:0 xml parse split tunnel info success. Buffer length: 94 bytes 20210721 10:59:08.514 [sslvpn:INFO] unknown:0 blocked all ipv6 traffic 20210721 10:59:08.515 [sslvpn:INFO] unknown:0 begin io loop 20210721 10:59:08.515 [sslvpn:INFO] unknown:0 launch ssl read thread 20210721 10:59:08.515 [sslvpn:INFO] unknown:0 launch tty read thread 20210721 10:59:08.515 [sslvpn:INFO] unknown:0 ssl read thread started 20210721 10:59:08.516 [sslvpn:INFO] unknown:0 main thread waiting for threads termination 20210721 10:59:08.516 [sslvpn:INFO] unknown:0 tty read thread started 20210721 10:59:08.516 [sslvpn:INFO] unkn

Hi Community we currently use an LDAP server and import groups from there into fortigate user groups (create new user group -> add remote group from the LDAP server) that we use in SSL-VPN policies to grant access to the different ressources, that the users need to access. The users are also imported from the same LDAP Server in the same manner and we apply the 2FA settings afterwards.  As soon as we rename the object in AD, then things start breaking, which makes sense, as the import is set to the string that is used to the value of the LDAP group when it is imported.  I've seen that I can use the FSSO Collector Agent that allows me to directly use the LDAP Objects in my policies, without creating them localy. See this admin guide: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/795593 Now I wanted to know if this method would solve my problem with renaming groups. Would the firewall update the values of the used groups if