Solved

Hi,Resources > Rules > Windows: DPAPI Domain Master Key Backup AttemptAgain newbie here, would like to ask in the above rules description got a broken link."https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_dpapi_domain_masterkey_backup_attempt.yml" .. I would like to remove it .. but when i delete the link and click save, it save into a new copy .. Any way for me to remove that?Thanks..John- 

We are using the Fortigate product Fortigate 61F, which has a Windows RDP connection. When not specifying an IP, it can be accessed normally. However, when specifying an IP, the connection cannot be established to the server. We have checked that this issue does not occur on other brands of firewalls. We would like to inquire if Forti products have a different approach to this issue and how to configure the Fortigate firewall to enable RDP connection to Windows Server using a specified IP.

Hello, I want to make a policy with Geo Blocking in my wan port that's inside an SD-Wan interface, I tried to configure the policy with income interface SD-Wan but it doesn’t work, If I take out my wan from the SD-Wan and configure the policy with income interface wan it works correctly, how can I configure the policy using SD-Wan?I tried looking online for the answer but couldn’t find anything with SD-Wan, thank for the help!

May be someone can give some debug command?the only failure i can see is from this command:diagnose wireless-controller wlac -c wtplast failure : 12 -- AC daemon reset timer expired The topology is very simple FortiOS > FrotiSwitch>FortiAP,After update the fortigate to 6.2.1 it can authorize the fortiap but status stay disconnected. thanks in advance.

Hello CommunityI am troubleshooting a FortiWifi 80F with v7.2.4. There is Local wifi client connected to a network with -40dBM green signal strength. Next there is a SD-WAN Zone with that wifi as an interface which shows link is up.However the Download and Upload all have 0 bps. The Performance SLAs shows the wifi link is down. To troubleshoot I followed the link below but that did not fix the issue. https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SD-WAN-performance-SLA-down/ta-p/217089 Appreciate the help

Hello Guys, I recently got NSE7 and wanted to understand how the automatic renewal worked for NSE4 and 5.NSE4 expires on July 10, 2023NSE5 expires on August 20, 2024Having taken NSE7 on May 15, 2023, will the other certifications automatically renew on the same date until May 15, 2025 or one on July 10, 2025 and the other on August 20, 2025? thank you

How we can setup configure the FortiClient VPN if the application has existing configuration.

Hi all!Can anyone tell me who tried to connect 1Gb RJ-45 and 1 Gb SFP in one bond.FortiGate 501EFortiOS 6.0.6thank you in advance

We have a Chromecast connected at the wifi network, and We are trying to cast tabs/screens from our internal network. We follow the steps from the technical tip, but I can only stream audio as the tab screen remains static and don´t refresh. How could I troubleshoot this situation ? Let me know if anyone has seen the same problem. We are running FortiOS 7.2.3 and our box is FGT 60. Regards, Anderson

I have the Forticlient SSLVPN client running on a selection of iDevices. When I go to connect to a SSLVPN connection hosted on a 200F running 7.2.4, the VPN comes up, then the client errors out with Error: Internal Error, and the VPN is dropped. There are no interesting droppings in the logs coming from the Fortigate. The logs show the connection, the tunnel coming up, and then the tunnel being brought down. If I deliberately mess up the login password, I get a different error, so it isn't an auth issue. The same client can connect successfully to a similarly configured 300D running 6.4.11. Windows 10 clients can connect to this 200F properly. Does anyone know what the client is trying to tell me with "Internal error"?

Dear All, Yesterday  I was configuring Fortigate Firewall and I have created multiple Zones like - APP ZONE, server zone, Prod Zone, FTP server Zone. Having created above zone I was unable to add those zone incoming source address why ?. At the Sophos Firewall this option is available. Can anyone explain what should I do for it, OR I am doing something wrong. Your response would be highly aprriciated. Thank you.

Hi Fortinet Community I need some clarification on Forward Error Correction. Does FortiGate VMs support Forward Error Correction (FEC)? As per understanding NP, SOC3 or SOC4 one of the chips should be present in the FortiGate device to enable FEC and FEC can be enabled only on FortiGate physical devices as the mentioned chip will be present in physical devices. Thanks.

Hello Dears, I need to know if there is any solution for disconnect user or down VPN automatic when user is connected to VPN but don't make any activity it just connect to VPN.  

Hi everyone,My ISP just changed my connection configuration and I now must use a VLAN to connect my fiber to them. I've created the new VLAN interface off the WAN port interface and I can connect to my ISP now. The problem is I have quite a few VIP's setup which use the WAN interface and not the VLAN interface. When I try and create a new VIP using the DHCP assigned IP (from ISP) of the VLAN interface I get a "duplicate error" Is it possible to assign a VIP to a VLAN interface? Why is it detecting a duplicate? Does it not like that the VLAN interface has the ISP's dhcp ip now? Regards,

hi, I need to run a test with iperf3 on my backup link that is configured on interface 'A'. But when I run the iperf test the test ends up running on the wan interface (main link). What am I doing wrong? FRWF2A # diagnose traffictest showserver-intf: aclient-intf: aport: 5201proto: TCP diagnose traffictest run -R -c 189.7.204.140 -t 30 FRWF2A # diagnose sniffer packet any 'host 189.7.204.140' 4interfaces=[any]filters=[host 189.7.204.140]3.361560 wan out 10.22.22.10.17926 -> 189.7.204.140.5201: syn 42778168934.358916 wan out 10.22.22.10.17926 -> 189.7.204.140.5201: syn 42778168936.358929 wan out 10.22.22.10.17926 -> 189.7.204.140.5201: syn 427781689310.368913 wan out 10.22.22.10.17926 -> 189.7.204.140.5201: syn 4277816893 thanks

Hi all, Last week I created a first local in policy in our FortiManager. After I filled in the fields and clicked "OK", nothing appeared in the policy list.Nonetheless, after installing the policies it did show up in our Fortigate. Does anybody know how we could get this policy to show in the UI, so we can edit it later on? Or at least see that it's there? Fortimanager is running the latest 7.4.0 (had quite some issues with 7.2.2)Fortigates are on 7.2.4 Best regards,Imre

Hello all, I migrated FortiGate 300D to 201F. After migration, I cannot create Email based two-factor authentication for new user from GUI, but I can create from command line.  There is only 2 authentication type: Forti Token Cloud and Forti Token.Someone #FGT201F 

Or... it feels like they are always at 100% full blast and that makes noices ... At that price point, I am flabergasted that we can't control these... or I have missed an option somewhere? Firmware 7.2.3, but I remember it was at 100% also with the 6.x firmware. Ambient temperature is about 22 Celsius (71.6F).  execute sensor lis1 PSU [1] OK2 PSU [2] OK3 FAN 1 CPU FAN 9121 RPM4 FAN 2 SYS FAN 9574 RPM5 FAN 3 AUX2 FAN 9375 RPM6 VOL 1 VCORE 1.81 V7 VOL 2 P1V05_VCCSCUS 1.06 V8 VOL 3 P1V2_VDDQ 1.21 V9 VOL 4 P1V0_CORE_SW 0.99 V10 VOL 5 P1V0_SOC4 1.02 V11 VOL 6 P1V05 1.06 V12 VOL 7 P3V3_STBY_A 3.30 V13 VOL 8 P3V3_STBY 3.30 V14 VOL 9 P3V3_PCH 3.30 V15 VOL 10 VBAT 3.33 V16 TMP 1 CPUTIN 41.50 C17 TMP 2 PECI 60.00 C18 MV1680 1 48.00 C19 MV1680 2 36.00 C FortiGate #fortios#fanspeed#hardware 

I configured these 2 firewall rules: Rule 1From: wan1 , To: Any Interfacessrc: <malicious ip> , destination: allSchedule: always , Protocol: AllAction: deny Rule 2From: Any Interfaces, To: wan1 src: all, destination: <malicious ip> Schedule: always, Protocol: AllAction: deny Now I cannot ping or go to the wan interface from internet. Can anyone tell me what is wrong?I also enabled multiple interfaces under the advanced feature.    

hi,i'm trying to configure a VDOM link between 'root' and a separate VDOM 'internet' which provides public/internet access. i tried to configure first a plain VDOM link but when i try to edit, i can't add it to an 'npu_vlink' interface.but when i tried to create the reverse, i.e. i created npu0_vlink0 for 'root' with a /30 IP address, and npu0_vlunk1 for 'internet', i cant' add the inter VDOM link. see attached photos.my questions:1. can FG 40F support NPU enabled VDOM link?2. do i just create a "plain" VDOM link without NPU acceleration?3. what are the correct step/sequence to create VDOM link with NPU acceleration in a 40F? 

Hi  Actually, we are deploying FortiClient EMS 7.2 we are frequently facing "out of sync" issue between endpoints and EMS server, e.g. when restart ems server, also when editing profiles like webfilter and so on any idea what's the reason and how we can troubleshoot and track this issue? Thanks in advance

Hello,Hope you are doing well. I'm trying to change to vlan from authentication vlan which is the default with id 150 to Vlan 25 for the production access when the scan is successful without using dot1x on the switch port on Cisco switch.So far only for testing the Operating system windows 10 pass and the right network access policy is granted, but when it comes to cli change it keeps adding vlan 25 and undo it to 150 back and fourth.The port is a member of "Forced Registration" "Reset Forced Registration" and "Role Based Access"  My enforcement Access: Cli template :config tinterface %port%description Network Securityswitchport access vlan %vlan% do wrUndo :config tinterface %port%description Authenticationswitchport access vlan 105do wrFortiNAC version 9.2Cisco Switch 3750 IOS 12.2 Thank you!Best Regards!

Hi all,I configured out of the box a 148F layer 2 fortiswitch and connected it to a Cisco 2960X layer 2 switch. From the Fortiswitch I can ping anywhere in the LAN, but if connect my computer or IP phone to the switch - nothing. The computer and phone are on separate ports and in the correct vlan. The ports connecting the two switches are up and no errors. The switch has a L3 interface and it can ping its default gateway and as mention anywhere on the LAN. I just cant figure out why I'm not able to get anything on the computer and phone.I'm new to Fortinet and have experience only with Cisco switches.Thank you. 

Recently I upgraded a FortiGate 100E from FortiOS 6.4.X to 7.0.X. Since then, I am no longer able to backup the configuration automatically. Here is a basic topology of my network.    when running the "execute backup config" command from CLI I get the error "Send config file to ftp server via vdom root failed.Command fail. Return code 5"From CLI, when running "exec ping 192.168.2.10" I do not get a response. However, when I set the source of the ping to "192.168.1.2" I DO get a response. I assume I need to source the exec backup config command as well. How do I route this properly?

Hello, I used AD-VPN to Spoke to spoke communication (FortiOS 7.0.7), it works perfectly excepted when I used SD-WAN. I tried to reach 10.5.5.0/24 via ADVPN and here my bgp routing table, as you can see, I have 2 path to reach this subnet but onw with is "directly connected" -> This way tunnel is the best 10.5.5.0/24  [200/0] via 172.0.0.1 (recursive via ADVPN0 tunnel 1.2.3.4), 00:18:39                      [200/0] via 172.0.1.0 (recursive is directly connected, ADVPN1_0), 00:18:39 Now I added SD-WAN with sla with "lowest cost SLAN" and fib best match : config service   edit 1      set name "ADVPN"      [...]      set tie-break fib-best-match   nextend With a diagnose sys sdwan service I have this resultMembers(3):1: Seq_num(2 ADVPN0), alive, sla(0x1), gid(0), cfg_order(0), cost(0), selected2: Seq_num(3 ADVPN1_0), alive, sla(