Solved

Hi,I would like to know whether it is possible to create a custom plugin class for threat feed integration. According to the documentation, where we should put the custom class?3887997b48764aafa50beff503f168b9.pngI tried locating the default one and was unable to. Is it under "/opt/glassfish5/glassfish/domains/domain1/applications/phoenix/phoenix-domain-1.0_jar/com/ph/phoenix/service/integration/ioc/" ?------------------------------Cheers,Isuru------------------------------

hi,i just enabled Multi-VDOM in my FGT with HA.i plan to create an Internet access VDOM topology per link below and created a new "Internet" VDOM.https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/597696/vdom-overview#Topologies i just followed this link/blog, but i can't seem to move my physical/logical inside LAN and physical WAN to this new "Internet" VDOM.https://networkinterview.com/fortigate-vdom-configuration/ i just plan to leave MGMT(lan1) in root VDOM.please advise if there's any additional step or CLI command that i need to issue/enable?  

I all. I would like to obtain information about my network, mainly related to bandwitch usage. I go to install to obtain this information a netflow collector.I have read about some problems with some third party Netflow collectors and I would like to answer about your experience to install a good Collector to work with Fortigate Firewall.  Please, could you recommend me a netflow network analyzer, free if its possible and it works well with fortigate, to can monitorice the bandwitch of my network in a way that I can get more information  than the information that a widget or fortiview gives me?Thanks ¡¡¡

Hi people on the community. Can I exchange the license of FortiGate VM, PAYG to BYOL, after deploying as PAYG? Regards,FortiGate

Hi, guys, It has been frustrated about this configuration; the sslvpn idle-timer is still not working. I configured all related parameters/attributes as the following weblink:Technical Tip: SSL-VPN Idle-timeout not working  My network configuration as below:1.  Fortigate 100E with FortiOS v7.2.4.1.1. SSLVPN Client DNS same as Client1.2. SSLVPN idle-timeout 3002. FortiClient VPN v7.0.8.xxx3. Windows 10 home3.1. "SSDP Discovery" is disabled3.2  "LLMNR" is disabled  But the SSLPVN idle-timer is still working, any recommendation, many thanks ? With regardsBenson

Is there a way to increase the time between a pause during dialing and the phone automatically dialing the numbers already entered? For example, I want to dial a phone number, I start dialing XXX-XXX then pause to look at the last 4 digits, if I pause too long the phone attempts to dial the first 6 digits I entered instead of waiting just a few more seconds for me to enter the last 4 digits.

Good day everyone, was wondering - I am reading Fortinet documentation a lot (here in community "Tips", admin guides etc.) and sometimes stumble on incorrect/outdated or plain typo/incorrect info. Is there a way to alert someone on that?Thanks E.g. https://community.fortinet.com/t5/FortiGate/Technical-Tip-Usage-of-IP-Addresses-in-Technical-Documentation/ta-p/195597 "IPv6 addressesRFC 3849: IPv6 Address Prefix Reserved for Documentation(http://www.ietf.org/rfc/rfc3849.txt?number=3849) states that the IPv6 address prefix 2001:DB8::/323 is reserved for use in documentation." The correct prefix length is /32, of course. 

 Hello! I've been trying to disable an IP listed in Malicious-Malicious.Server, which is a list in the IP Reputation Database. I found information that said that it is not possible to disable an IP from this list via CLI commands. The problem is that the GUI can't display all the entries and I can't get to the desired entry to disable it.Please if anyone has any suggestions that would be great. Thanks! Attached is a printscreen. I'm using version 7.2.4 

Using a WiFi 60D with the standard 10 included FortiClient licenses. When I try to click to Register Endpoint from a computer with FortiClient installed I get an Error message that says "FortiGate maximum licenses exceeded.". When I go to System / Dashboard / Status / License Information, it says that 10 of the 10 FortiClient clients are registered. We are using less than 10 endpoints with FortiClient currently. FortiClient may have been installed on computers that have since been decommissioned. How can we release licenses that are no longer being used?

Hi I'm deploying Azure Fortigate HA Active-Passive as per this documentation:https://github.com/fortinet/azure-templates/tree/main/FortiGate/Active-Passive-ELB-ILBwith Active unit in Availabilty zone 1 and Passive unit in Availability zone 2.I'm having problems with the Passive Firewall.If I logon, it shows no arp entries 'get system arp':couks-FGT-B # get system arpAddress Age(min) Hardware Addr Interfacecouks-FGT-B #HA cluster is working because they both show in Sync. But on Passive, it doesn't respond to the ILB probes:couks-FGT-B # diag sniff packet port2 'host 168.63.129.16'Using Original Sniffing Modeinterfaces=[port2]filters=[host 168.63.129.16]1.459976 168.63.129.16.55536 -> 10.201.0.70.8008: syn 29682361253.468306 168.63.129.16.55536 -> 10.201.0.70.8008: syn 29682361256.455136 168.63.129.16.55613 -> 10.201.0.70.8008: syn 24901956527.469473 168.63.129.16.55613 -> 10.201.0.70.8008: syn 2490195652^C4 packets received by filter0 packets dropped by kernel and

Hello, For the first time, i have the following error message : (2023/05/22 07:43:34) Fortigate iot_detec signature missing. Do you have any informations about this error ? I don't found more details about this. Thank you in advance, Regards,Christopher

Hi Team,  I'm just asking if we can add multiple IP address on the LDAP Server?Our main goal: The user connects on the Fortinet VPN, we setup the LDAP server that contain 2 IP address, is this possible?the 2 IP address is our active directory, Main and Backup AD. I really appreciate to help me this :)

Hi, I'm new in fortiSIEM and recently I facing a problem that, an Alert email with incident ID $IncidentID. In the email it show the link with Host Name" URL: https://FortiSIEM.localdomain/phoenix/html/incidents/26278 "how can I change it to Host IP" URL: https://10.99.0.50/phoenix/html/incidents/26278 "Thank you.John

Hi all,We have some handheld android tablets on a "guest" network on our Fortigate 100F and they get an IP address of say 192.168.30.0 and we have a server on a DMZ on another interface on say 10.10.10.10 but all connected to the same physical 100F. The tablets connect to the server fine when they are off our network (i.e at 3rd party sites etc) but they cannot connect to the server when inside our network (on the Guest network). If i do a trace route then it picks up that it needs to go to 10.10.10.10 but hits the guest interface on the router (so 192.168.30.1) but then the next hop is our WAN IP address instead of the interface IP of our DMZ network? What do i need to do to get it to route "internally" ?Hope that makes sense.Thanks 

Hello To All,  Because of a memory leakage the http process needs to be restart from time so I figured using auto-script (there is not analyzer at the moment to use the fabric automation as mentioned in https://docs.fortinet.com/document/fortigate/6.2.14/cookbook/351998/creating-automation-stitches ) that can be scheduled or tiggered through the API but for example the command in "https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-restart-kill-all-the-processes-with/ta-p/194434 " that is fnsysctl killall httpsd is for backend-shell access and also diagnose test application <daemon_name> 99  that is suggested in the article belos does not seem to find the http processes https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restarting-internal-processess-daemons/ta-p/192124  I only need to find the correct command on 7.4 for Fortigate and then I can create the configuration script and then run the below commands:   &nbs

Hi  Actually, I want to create a Supervisor VM (all in one), and to allocate 2 TB of Data Disk (Local Virtual Disk), 2 TB is the max virtual disk size that VMware supports, I want to know, is there any issue from FortiSIEM side to accept this capacity ? Thanks in advance

Hi everyone, What is the best way migrate fortigate 501f to 601f? Thank you

Hey I want to create a rule to block teamviewer and ANYDESK so that users cannot access the inside network from outside.I want, the IT helpdesk be allowed to user these 2 APPs when is necessary to give support to end usersat local network. I was thinking to give them a profile access to the firewall just to disable and enable the rule whenever they need to acess the network with teamviwer or anydesk.....any ideas? Thanks

Hi Community,I'm trying to allow Vimeo video player on one of our webpage but it remains blocked.I'm using Fortigate 7.0.7Web link: https://fastrent.ch/fr/gamme-verte/broyeur-electriqueLink to allow: https://player.vimeo.com/video/460946876I want to unblock completely the player.I tried differents ways with no luck. I added player.vimeo.com to the web filter > URL Filter trying with simple, wildcard, allow, exempt etc.It never get unblocked. Have someone an idea how to resolve this?If you need additional informations let me know.Thanks for your help.Br,Cedric

Hi,I am hardy consider to know that how would be possible to block some IPs in a network? shall I block the IPs using firewall, if I'm right how should I use with API? I'm new with this topic, but I will appreciate your answer to inform me.Thanks

My KABDK won't register to the DHAUI in the JKA on FortiHKProtector.

All of the STAT_STDDEV functions end with a colon and some number.   I am assuming the number represents some sort of time frame, but I cannot find any documentation on this.   Can someone help explain the structure of this function? EXAMPLE:  STAT_STDDEV(SUM(Total Flows):125) FortiSIEM 

I currently have event triggers working on the FortiGate to ban IP's when the event handler on the FortiAnalyzer sees a matching event from the FortiGate. I also have an alert working within FortiAnalyzer for FortiMail when the event handler sees a matching event from the FortiMail. I recall reading somewhere, when the FortiGate Event Handler is triggered, it only notifies the device from where it originated, which explains why I cannot get it to trigger on the FortiGate since it originated from FortiMail. I'm trying to determine how I can ban an IP on the FortiGate from and event captured on the FortiMail using FortiAnalyzer. Is this possible? Has anyone done anything similar? NOTE: In the images below, I have email alert configured instead ban IP for testing purposes. Working Email Alert In FortiAnalyzerWorking Alert in FortiAnalyzer FortiAnalyzer Event Counts Not Working FortiGate Automation StitchNot Working FortiGate Automation Stitch FortiG

How would I create a fortilink connection when having two Fortiswitches in a HA setup? Below is a topology diagram of my setup, not sure If I can use the WAN ports for fortilink (obviously cannot add them to the aggregate now) but if I should have during the setup. My next thought is to setup a separate port on the FG for fortilink and then use another port on the fortiswitch, but my question is will the switch recognize this as a fortilink connection or will I need to setup a VLAN? Currently the switches are in layer 2 mode with no configs, just passing WAN traffic to both FG's.  

Currently running an ADVPN (BGP) with a couple dozen spokes. All the spokes are a single WAN connection. Now one of the sites wants to add a redundant WAN connection. There are two hubs at the 'hub' so if ISP 1 at the hub goes down, the spokes failover to Hub ISP 2. On the spokes, the backup hub monitors the first hub. How can I add a 3rd advpn connection from the spoke which would use spoke WAN2 if spoke WAN1 fails?    edit "ADVPN-PRIMARY" set interface "wan1" set peertype any set net-device enable set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set add-route disable set dpd on-idle set wizard-type spoke-fortigate-auto-discovery set auto-discovery-receiver enable set auto-discovery-shortcuts dependent set remote-gw <ISP1 at HUB> next edit "ADVPN-BACKUP" set interface "wan1" set peertype any set net-device enable set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set dpd on-i