Solved

Hello,I'm still new to FortiNAC,I did configure endpoint compliance schedule rescan each two 2 minutes(For testing), when i disable a specific service on the machine the rescan does not mark the host as At Risk and the verse versa with safe state even in the event it does trigger the scan, when i do a scan host manually it detect the service down or up. My Endpoint Compliance policies as bellow:ECP-AtRisk Host:Security Status:At-Risk And Type : Registered Host or DeviceECP-Rescan-Safe Host:Security Status:Safe And Type : Registered Host or Devicethe Scheduled rescan: Thank you!Regards!

Hi There, When I run the following command :#get log fortianalyzer setting It's return :Status:disable So how to turn it to enable ? On FortiOs v7.0.11 Thanks for the helpKader

how do i removed the resigned staff email from the fortinet renewal notification?

Hi!Cannot update application signatures (apdb) via ftp and tftpISDB and IPS signatures update successfully. FortiOS versions 6.0.6 and 6.0.12. Fortigate 501E(global) # execute restore other-objects ftp ffdb.pkgThis operation will overwrite the current other objects!Do you want to continue? (y/n)yPlease wait...Connect to ftp server ...Get other objects from ftp server OK.(global) # execute restore other-objects ftp apdb.pkgThis operation will overwrite the current other objects!Do you want to continue? (y/n)yPlease wait...Connect to ftp server ...Get other objects from ftp server OK.(global) # diagnose autoupdate versions | grep -A 7 InternetInternet-service Database Apps---------Version: 7.03208Contract Expiry Date: n/aLast Updated using manual update on Tue May 23 12:55:18 2023Last Update Attempt: Fri Mar 18 16:53:14 2022Result: UnauthorizedInternet-service Database Maps---------Version: 7.03208Contract Expiry Date: n/aLast Updated using manual update on Tue May 23 12:55:18 2023L

hii have a network with mikrotik. we are planning to replace mikrotik with fortigate 100F (v7.4.0)now i have:switchtag vlans: 32, 33 to mikrotiktag vlans: 32, 33 to fortigateuntag vlans: 32 to two hoststwo hosts: vlan 32, untag192.168.5.251/24 (gw: 192.168.5.1 - mikrotik) ,192.168.5.252/24 (gw 192.168.5.2 - fortigate) mikrotiktrunk vlans: 32 (192.168.5.1/24), 33 (192.168.20.1/24)fortigate:config system interfaceedit "vlan0032"set vdom "root"set ip 192.168.5.2 255.255.255.0set allowaccess ping https ssh snmp httpset device-identification enableset role lanset snmp-index 38set interface "x2"set vlanid 32next edit "vlan0033"set vdom "root"set ip 192.168.20.2 255.255.255.0set allowaccess ping https ssh snmp http fgfmset device-identification enableset role lanset snmp-index 35set interface "x2"set vlanid 33nextendconfig firewall policyedit 7set name "all"set srcintf "any"set dstintf "any"set action acceptset srcaddr "all"set dstaddr "all"set schedule "always"set service "ALL"set

Hi guys,can someone suggest me how to retrieve device inventory from Fortigate with API ? I am using :https://<IP:port>/api/v2/monitor/user/device/detected-device/?access_token=my token but i's giving me http_status:404 When i try https://<IP:port>/api/v2/monitor/user/?access_token=my token   is showing me the entire directory and it seems working.Fortios version is 7.2.3

In v7.0.7 FortiNet seems to have changed an option: config system antivirus quarantaine FMG now defaults the destination option to disk. Due to this policy package deployment will error out on every device that does support FortiGuard Antivirus but does not have a disk.Come on Fortinet. At least YOU should know that you sell FGT without disks that do not support that. Why then default that option to "disk"?Alas the other available options are "FortiAnalyzer" or "NULL".  In my case I could reset it to FortiAnalyzer since we have one running and all FGT are connected to it.Not sure if "NULL" woud be accepted by the FGT. I did not test it. Thus I had to change that on 20 FGT since its a cli only option in device manger... Just thought I let you know - just if anyone else runs into this issue...

Hi please i have a huge problem.I have an EC2 instance on AWS with IP address 172.31.X.X that I want to communicate with another remote instance of a customer always on AWS with IP address 172.33.X.X through a fortigate IPsec VPN tunnel on both sides else.For the fortigate 1 we have LAN: 172.31.X.Y, WAN: 172.31.Y.Z and the pubilc IPFor the fortigate 2 we have LAN: 172.33.X.Y, WAN: 172.33.Y.Z and the public IPthe vpn tunnel is UP but when I ping from the ec2 172.31.X.X to the remote ec2 172.33.X.X the ping does not go through and when I try to get out of the network I cannot. From the servers we can't ping the internet. Apparently it's a routing problem but I don't know which side.Here is the architecture EC2 ===> Fortigate 1 ===> tunnel ===> Fortigate 2 ===> EC2 But the traffic is blocked internally (between EC2 and Fortigate) and does not go out Please i want some help 

Hi,Resources > Rules > Windows: DPAPI Domain Master Key Backup AttemptAgain newbie here, would like to ask in the above rules description got a broken link."https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/win_dpapi_domain_masterkey_backup_attempt.yml" .. I would like to remove it .. but when i delete the link and click save, it save into a new copy .. Any way for me to remove that?Thanks..John- 

We are using the Fortigate product Fortigate 61F, which has a Windows RDP connection. When not specifying an IP, it can be accessed normally. However, when specifying an IP, the connection cannot be established to the server. We have checked that this issue does not occur on other brands of firewalls. We would like to inquire if Forti products have a different approach to this issue and how to configure the Fortigate firewall to enable RDP connection to Windows Server using a specified IP.

Hello, I want to make a policy with Geo Blocking in my wan port that's inside an SD-Wan interface, I tried to configure the policy with income interface SD-Wan but it doesn’t work, If I take out my wan from the SD-Wan and configure the policy with income interface wan it works correctly, how can I configure the policy using SD-Wan?I tried looking online for the answer but couldn’t find anything with SD-Wan, thank for the help!

May be someone can give some debug command?the only failure i can see is from this command:diagnose wireless-controller wlac -c wtplast failure : 12 -- AC daemon reset timer expired The topology is very simple FortiOS > FrotiSwitch>FortiAP,After update the fortigate to 6.2.1 it can authorize the fortiap but status stay disconnected. thanks in advance.

Hello CommunityI am troubleshooting a FortiWifi 80F with v7.2.4. There is Local wifi client connected to a network with -40dBM green signal strength. Next there is a SD-WAN Zone with that wifi as an interface which shows link is up.However the Download and Upload all have 0 bps. The Performance SLAs shows the wifi link is down. To troubleshoot I followed the link below but that did not fix the issue. https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-SD-WAN-performance-SLA-down/ta-p/217089 Appreciate the help

Hello Guys, I recently got NSE7 and wanted to understand how the automatic renewal worked for NSE4 and 5.NSE4 expires on July 10, 2023NSE5 expires on August 20, 2024Having taken NSE7 on May 15, 2023, will the other certifications automatically renew on the same date until May 15, 2025 or one on July 10, 2025 and the other on August 20, 2025? thank you

How we can setup configure the FortiClient VPN if the application has existing configuration.

Hi all!Can anyone tell me who tried to connect 1Gb RJ-45 and 1 Gb SFP in one bond.FortiGate 501EFortiOS 6.0.6thank you in advance

We have a Chromecast connected at the wifi network, and We are trying to cast tabs/screens from our internal network. We follow the steps from the technical tip, but I can only stream audio as the tab screen remains static and don´t refresh. How could I troubleshoot this situation ? Let me know if anyone has seen the same problem. We are running FortiOS 7.2.3 and our box is FGT 60. Regards, Anderson

I have the Forticlient SSLVPN client running on a selection of iDevices. When I go to connect to a SSLVPN connection hosted on a 200F running 7.2.4, the VPN comes up, then the client errors out with Error: Internal Error, and the VPN is dropped. There are no interesting droppings in the logs coming from the Fortigate. The logs show the connection, the tunnel coming up, and then the tunnel being brought down. If I deliberately mess up the login password, I get a different error, so it isn't an auth issue. The same client can connect successfully to a similarly configured 300D running 6.4.11. Windows 10 clients can connect to this 200F properly. Does anyone know what the client is trying to tell me with "Internal error"?

Dear All, Yesterday  I was configuring Fortigate Firewall and I have created multiple Zones like - APP ZONE, server zone, Prod Zone, FTP server Zone. Having created above zone I was unable to add those zone incoming source address why ?. At the Sophos Firewall this option is available. Can anyone explain what should I do for it, OR I am doing something wrong. Your response would be highly aprriciated. Thank you.

Hi Fortinet Community I need some clarification on Forward Error Correction. Does FortiGate VMs support Forward Error Correction (FEC)? As per understanding NP, SOC3 or SOC4 one of the chips should be present in the FortiGate device to enable FEC and FEC can be enabled only on FortiGate physical devices as the mentioned chip will be present in physical devices. Thanks.

Hello Dears, I need to know if there is any solution for disconnect user or down VPN automatic when user is connected to VPN but don't make any activity it just connect to VPN.  

Hi everyone,My ISP just changed my connection configuration and I now must use a VLAN to connect my fiber to them. I've created the new VLAN interface off the WAN port interface and I can connect to my ISP now. The problem is I have quite a few VIP's setup which use the WAN interface and not the VLAN interface. When I try and create a new VIP using the DHCP assigned IP (from ISP) of the VLAN interface I get a "duplicate error" Is it possible to assign a VIP to a VLAN interface? Why is it detecting a duplicate? Does it not like that the VLAN interface has the ISP's dhcp ip now? Regards,

hi, I need to run a test with iperf3 on my backup link that is configured on interface 'A'. But when I run the iperf test the test ends up running on the wan interface (main link). What am I doing wrong? FRWF2A # diagnose traffictest showserver-intf: aclient-intf: aport: 5201proto: TCP diagnose traffictest run -R -c 189.7.204.140 -t 30 FRWF2A # diagnose sniffer packet any 'host 189.7.204.140' 4interfaces=[any]filters=[host 189.7.204.140]3.361560 wan out 10.22.22.10.17926 -> 189.7.204.140.5201: syn 42778168934.358916 wan out 10.22.22.10.17926 -> 189.7.204.140.5201: syn 42778168936.358929 wan out 10.22.22.10.17926 -> 189.7.204.140.5201: syn 427781689310.368913 wan out 10.22.22.10.17926 -> 189.7.204.140.5201: syn 4277816893 thanks

Hi all, Last week I created a first local in policy in our FortiManager. After I filled in the fields and clicked "OK", nothing appeared in the policy list.Nonetheless, after installing the policies it did show up in our Fortigate. Does anybody know how we could get this policy to show in the UI, so we can edit it later on? Or at least see that it's there? Fortimanager is running the latest 7.4.0 (had quite some issues with 7.2.2)Fortigates are on 7.2.4 Best regards,Imre

Hello all, I migrated FortiGate 300D to 201F. After migration, I cannot create Email based two-factor authentication for new user from GUI, but I can create from command line.  There is only 2 authentication type: Forti Token Cloud and Forti Token.Someone #FGT201F