Solved

Our FTM is running 7.2.2 and our FTG's are running 7.2.4. These are relatively new installations, and we're trying to trim the amount of syslog traffic to our SIEM. On the FTM at Device Manager > [FortiGate] > Log & Report > Threat Weight, there are several security settings. I don't see where to apply these to the syslog settings, nor can I find any documentation to do so. The "Log Threat Weight" is enabled. We do not have FortiAnalyzer. Is there a way to configure syslog to send security-related info that can be ingested into our SIEM without having a bunch of extra fluff? Thanks

I have a FGT 90D and a 60D, both with FortiOS 5.0.12.The "set daily-restart enable" works just fine, but I think a weekly reboot would be more appropriate.Is there any way to achieve that in FortiOS? Thanks EDIT: Solution found on my last post... thanks!

FG 60Ev 7.2.4 I need help with the traffic shaping policy triggering and the traffic direction. When I created a VoIP traffic shaping policy based on the traffic direction from the source to the destination, which includes RTP and SIP services, I experienced some problems with the SIP DSCP marking. Applied EF but the output for the SIP packages was still CS0.The sessions output for the external inbound call for SIP session was:  session info: proto=17 proto_state=01 duration=540676 expire=179 timeout=0 flags=00000000 socktype=0 sockport=0 av_idx=0 use=3 origin-shaper= reply-shaper= per_ip_shaper= state=may_dirty npu statistic(bytes/packets/allow_err): org=62869363/107131/1 reply=56299023/112453/1 tuples=2 tx speed(Bps/kbps): 135/1 rx speed(Bps/kbps): 106/0 orgin->sink: org pre->post, reply pre->post dev=46->37/37->46 gwy=10.10.5.25/10.55.100.100 hook=pre dir=org act=noop 10.55.100.100:5060->10.10.5.25:5060(0.0.0.0:0) hook=post dir=reply act=noop 10

We currently run v6.4.10 for our FMG-VM and manage bigger customer's FortiGates(FGTs) totalling about 600 (soon to be 800+).And one of them needs one VIP group (two VIPs) at all 500+ locations. We use policy packages for this customer to standardize their policies, which is almost the same at all locations. But when I looked at the VIP object config under Policy&Objects->Object Configurations->Firewall Objects->Virtual IPs then hit "Create New->Virtual IP", I don't see a way to select a dynamic address object for the External IP and Mapped IP.This means we need to create 500+ x 2 VIPs manually putting each IP, then worse, we need to create 500+ different policies and use "Installation Target" to be for one specific FGT. Is there a better way to have just one policy for one VIP group for 500+ FGTs? Or, can I use meta fields+CLI template to define those on Device DB side and somehow let the policy to refer to the VIP group name?  There should be a

Hi,we set up two separate VLANS on our Fortigate, one for the clients and one for the servers.The Fortigate acts as a DHCP server for the clients. The domain controllers in the server network, where the DNS role is implemented, are defined as DNS servers for the clients.The AD DNS servers forward all requests for non-resolvable hosts / domains to the Fortigate.As soon as the users / clients log in, they get the network drives assigned to them.Unfortunately, users will not be able to access Internet pages with this configuration.A policy allowing Internet access for users has been set up.If I add another external DNS server to the clients when they log on, the users now get to the Internet, but the network drives from AD are not automatically assigned and are not accessible. What setting is still missing so that users can get their network drives as well as access the Internet?

Hi, we purchased a renewal license to be able to upgrade our firewall (FotiOS 6.0.2 build0163 (GA)).We're certainly going to follow the upgrade path to upgrade it to the latest version but what concerns me is how this upgrade will affect the connected FortiSwitch and FortiAPs:1AP FP221E-v6.0-build00442AP FP221E-v6.0-build00443AP FP221E-v6.0-build0044FORTISWITCH FS108D-v3.6.4-build0399 May I upgrade the firewall to the latest OS without issues or I have to upgrade also all APs and the switch at same time for every firmware update? Or there's an OS version until I can upgrade without problems? Thank you Kari

Hi Everyone, I am implementing Fortimanager to simplify configuration of our firewalls.  We have (6) 70F units running 7.0.9.  I have added them all to Fortimanager, and cloned one of the configs to a policy package I want to use for all of them.  The configs are almost identical on all of them.  There are two units that do not have all of the needs that the other 4 do.  I have figured out how to prevent certain firewall policies from getting pushed to these through installation targets on the policies.  When I try to push this policy pak to the two units, I am getting the following: Vdom copy failed:error 0 - invalid valueCopy objects for vdom root"firewall ssl-ssh-profile", "certificate-inspection", id=4360, SKIP - (null)"firewall ssl-ssh-profile", "deep-inspection", id=4369, SKIP - (null)"dynamic interface", "ATM VLAN", id=5216, INVALID MAPPING - (null)"firewall central-snat-map", "3", id=8426, INVALID MAPPING - invalid value These two fi

Hi,  We have a few FortiExtenders with multiple SIM's. Have so far not found any good way of controlling which SIM that should be used.  Is there no way we can simply disable slot 1 when we want to use the SIM in slot 2 - and vice versa? I know about the swap policy by data and signal, but sometimes we need to simply disable one of the SIM's, and it would be easier for us to do this remotely without physically disconnecting them. 

How to find which policy is used for a specific traffic( from a particular source to particular destination.) using cli

        I am in the process of configuring a new hub for our ADVPN-BGP environment. When I we were using FortiOS 7.0.8 it work worked with very few issues, but now in 7.0.10 I run into nothing but issues. When I run a ping from spoke to spoke, the first attempt will give me 2 successful pings and then die. If do an exec router clear bgp all and clear the table, will get successful pings for about 10 seconds and then it dies again.  So I run diagnose vpn ike log filter mdst-addr4 x.x.x.x y.y.y.y on each of the spokes and I when the pings are successful I see what I am supposed to see, but in the same ping the connection dies, I get: 2023-03-09 12:01:55 id=20085 trace_id=139 func=resolve_ip_tuple_fast line=5931 msg="Find an existing session, id-00001185, original direction"2023-03-09 12:01:55 id=20085 trace_id=139 func=ipsecdev_hard_start_xmit line=669 msg="enter IPSec interface EDW_ADVPN_0, tun_id=0.0.0.0"2023-03-09 12:01:55 id=20085 trace_id=139

I have a FortiWiFi 60F new out of the box. I upgraded it from 6.4.6 to 7.0.11 following the upgrade path. I have console window up and it constantly displays  unregister_vf: waiting for vsys_if#0 to become free. Usage count = 5.  I google and looked here in the forums and can find nothing about it. I see references to HA, but this gate's HA is in standalone, so HA is disabled. What is this?    

we have a user who is on a different domain and we are trying to give them access to a file server on our domain. I had tried ssl vpn through the web, but read somewhere that if we wanted to map drives would need to use forticlient.The user was able to connect to ssl vpn through the web. And they could ping IP of file server, but not dns name. If he tried to map drive, he would get an error saying "an error occurred while connecting Z: to "share path". The network path was not found. I installed forticlient ssl vpn, and configured is as well. But when users tried to login they get an error message: "failed to establish the VPN connection. This may be caused by a mismatch in the TLS versions. Please check the TLS version settings in the Advanced of the internet options. (-5029)"The fortigate is running version 7.2.x and has max tls set at tls1-3. And the users computer which is the one trying to connect to VPN is also running 1.3 and down to 1.2. Unable to test file mapping until t

Hello Everyone I recently created a ipv4 policy connecting to our partner. the policy created is inside to outside; the source ip is from our internal network but we have NAT the private ip to public via virtual address and enabled NAT. When we attempt to connect to our partner via icmp to see if they see our traffic logs, they note the public ip of the firewall but not the NAT ip associated with that public ip. I have placed the policy at the top but still they are unable to see our NAT public ip The traffic is leaving my network and hits together with active sessions are noted, but on the other end they view my firewall public ip instead of the NAT ip

Hi, trying to activate VM evaluation license (using Foricare account) but I get the error "Error downloading license: Invalid serial number". Other questions in the forum didn't help. Image downloaded: FGT_VM64-v7.2.4.F-build1396-FORTINET.out.ovfNo other evaluation license requested. The VM has ping to Internet:  FortiGate-VM64 # execute ping www.google.com PING www.google.com (172.217.20.164): 56 data bytes 64 bytes from 172.217.20.164: icmp_seq=0 ttl=115 time=26.9 ms 64 bytes from 172.217.20.164: icmp_seq=1 ttl=115 time=26.9 ms 64 bytes from 172.217.20.164: icmp_seq=2 ttl=115 time=25.7 ms  Other info: FortiGate-VM64 # get system stat Version: FortiGate-VM64 v7.2.4,build1396,230131 (GA.F) Virus-DB: 1.00000(2018-04-09 18:07) Extended DB: 1.00000(2018-04-09 18:07) Extreme DB: 1.00000(2018-04-09 18:07) AV AI/ML Model: 0.00000(2001-01-01 00:00) IPS-DB: 6.00741(2015-12-01 02:30) IPS-ETDB: 6.00741(2015-12-01 02:30) APP-DB: 6.00741(2015-12-01 02:30) IN

In a 81e fortigate firewall Nat is enabled between the policy created between port 1 and port 1 which are internal networks.Can anyone explain the working of NAT in that policy.

Hi all,   After upgrade to 5.2.4 my web admin session is disconnecting suddenly, while I'm working and before to idle timeout.  I already saw this in other versions of 5.2.X. Regards,Claudio Rezende

First timer here, so be kind :) We have two FortiSIEM environments - QA and Prod, to which we send logs from a number of sources, one being FortiMail. In our QA environment (minimal setup, hardly any resources like CPU/RAM) FortiSIEM manages fine and updates the default Fortinet Security dashboards as you'd expect. For some reason that doesn't happen in our Prod environment (BIG server, plenty of resources). Both environments are running the same versions, one collector fronting the sup, log sources as well as collectors are on the same subnets, log is coming into both QA and Prod, if I check in Analysis I see transactions in both - but the dashboard won't update in Prod. Any way we could re-initialize a dashboard? Any idea where we should look?

Hi all, I have an error while try to active FortiGate Cloud in FortiGate-VM 7.2.4. Error message as belowAnyone has been through this case? ThanksMore info: - I've been tried to active using Admin Guide, it's said I must enable Cloud-Logging in "Log & Report" first but in my version there's no Cloud-Logging option even in CLI configuration.- The account that use for Active FortiGate Cloud already active in Portal services of FortiGate Cloud.- My VM is activated with license VM02

Hi all, Need help on FG401E and Fortimanger on the address object limitation and address manage. Once the individual Fortigate firewall is integrated to FortiManager, how will the object being managed and will the limit depends on FortiManager or individual FortiGate firewall? For example, firewall A have 10k objects, firewall B have 10 k objects. Assuming that none of the objects in Firewall A and B is the same. Both firewalls are then onboarded to FortiManager. Will the object count be accumulated and now each firewall sees 20 k objects which is their limit? What is the limit of object the fortimanager can store?

Hi all, I am trying to get my FortiClient IPSec VPN working, but so far without success. I'm using FortiClient 7.0.3.0193 on Windows 10. I have configured the IPSec connection the way the firewall admin told me, but everytime I click on connect it just gets stuck forever at "Status: connecting" without establishing the connection. At the same time, the client kills almost all IPv4 and IPv6 connections from/to my laptop, so I lose all network connectivity until I click on disconnect. The only connection on my laptop that remains online and pingable during the connection phase is the link-local IPv6 address. All other outgoing and incoming pings from and to my machine fail, but as soon as I click disconnect all addresses are pingable and the system goes online again. At first I thought it was a problem with the credentials so I tested it with identical setting in a Windows 10 VM and there it works perfectly fine. VPN gets established and internet connection remains functional.&

Hello Team,I have upgraded the FortiManager to 6.4.11 and we have fortigate firewalls with version 6.2.12 and 6.4.8.After the upgrade when I go to create new rules Insert Above or Insert Below in fortigate firewall running 6.4.8 I get the below error message.firewall/policy/509: logtraffic cannot be set to utm when policy action is deny.Interestingly Policy 509 doesn't exist.But the firewall with version 6.2.12 doesn't have any issue.It seems to be a bug affecting fortios version 6.4.xAnyone can confirm if it's a bug or how do I resolve the issue. Thanks

Hi all, I wanted to know in my fortigate firewall with fortios 7.0.11, if I am using app control profile in policy then deep packet inspection is required compulsory? Issue : Actually I am having existing policy with app control with normal certificate inspection but I am getting intermittent issue in zoom meetings if I am using Dpi then too sometimes I am getting issue so if using Dpi then zoom need to be bypass from it?

Does these licenses come as default for 1 year?"forticare support""firmware & general updates"What happens if it is not renewed after a year?Is forticare support like TAC support? I realize that i cannot download firmware manually. Do i use forticloud to resolve this problem?

I use fortigate telnet server prompot: FortiGate-201F # execute telnet 192.168.20.15 5000Trying 192.168.20.15...Connected to 192.168.20.15.Connection closed by foreign host.ping is okFortiGate-201F # execute ping 192.168.20.15PING 192.168.20.15 (192.168.20.15): 56 data bytes64 bytes from 192.168.20.15: icmp_seq=0 ttl=64 time=0.2 ms64 bytes from 192.168.20.15: icmp_seq=1 ttl=64 time=0.1 msI use my pc telnet it is ok , the port of the server is open and there is no restriction

With Fortinet is it possible to see a network of an ipsec VPN configured on another fortinet??obviously between the two fortnets I have an ipsec VPN available.I would like from network x to see network y which is in VPN on the fortinet which is not my gateway but another fortinet.is it possible??