Solved

When you search for a certain ip block in the virustotal address, it produces a few results, but it says zero in the reputation section in soar. how can we solve this in soar?

Hello, I create a dataset in Report of FAZ with query as below:select $flex_timescale(timestamp) as hodex, sum(traffic_out) as traffic_out, sum(traffic_in) as traffic_in, sum(traffic_out)*8/60/60/1000 as traffic_out_kbps, sum(traffic_in)*8/60/60/1000 as traffic_in_kbps, 100000 as maxBWfrom ###(select timestamp, sum(bandwidth) as bandwidth, sum(traffic_out) as traffic_out, sum(traffic_in) as traffic_infrom ###base(select $flex_timestamp as timestamp, dvid, srcip, dstip, epid, euid, coalesce(nullifna(`user`), nullifna(`unauthuser`), ipstr(`srcip`)) as user_src, service, count(*) as sessions, sum(coalesce(sentbyte, 0)+coalesce(rcvdbyte, 0)) as bandwidth, sum(coalesce(sentbyte, 0)) as traffic_out, sum(coalesce(rcvdbyte, 0)) as traffic_infrom $log-trafficwhere $filter and (logflag&1>0) and (srcintf = 'ILL_Viettel' or dstintf = 'ILL_Viettel') and devname = 'Nuiphao-TN_FG201F'group by timestamp, dvid, srcip, dstip, epid, euid, user_src, service--order by timestamp desc/*SkipEND*/)

Hello, We have a fortigate FortiGate  v6.4.11 running in our dependencies, and we try to block any connection to botnet C&C We've got a policy with 2 Security Profiles:DNS Filter redirects botnet C&C requests to Block Portal and uses Fortiguard Based Filter, where Malicious Websites, Phishing sites, spam URLS and Newly X Domains are also redirected to Block Portal.Application Control allows DNS trafficWhen I use nslookup command to request an imaginary FQDN on a well-known malicious DNS server, Fortigate unexpectedly allows the request:Policy ID: the defined one :)Application: DNSApplication Action: detectedApplication Category: Network.serviceApplciation Risk: elevatedService: DNSOn the other hand, other fields make think the request should not reach the malicious servertdthreatname: Sinkholetdthreattype: Malwaretdtype: infected-iptdwfcate: Spyware and MalwareSo the thing is that ApplicationControl allows DNS network service, but DNS sho

Hello. I have 3 subnets /28 and 1 subnet /29 that are routed over PTP /30 link. And default route is added as static in routing table. Recently my organization acquired AS number and new /24 subnet. I made BGP with one provider that is also provider of old subnets mentioned above. They are sending me only default route. My problem is that default route learned from BGP is not injected into routing table because of static default route. So all outbound traffic with new subnet over BGP is done with policy routing and it is working but inbound traffic that comes on BGP peer interface is dropped because of RPF. It checks path and drops packet. I have to change all public addresses from old ranges to new range. It would be great if both ranges are available at the same time from outside so that I can gradually switch. My provider tried with full BGP table but behavior is the same. Is there a way to have both default routes in main table so that I don't have to

We are preparing a conversion from a Firepower to a FortiGate 2600. This will be the second attempt due to some routing issues. This is an HA pair, and we're using port15 as the management port. It's currently using the same VRF as the other ports, so we want to change this one to a different ID. I just want to make sure VRF will function as intended, that is, if we there are routes to the same network, say 10.0.0.0/8, for both the management port (VRF 1) and the inside interface (VRF 0), that packets coming into a data interface (say outside interface on VRF 0) destined to 10.1.1.1 will not go out the management interface on port15. What about if the management interface has a more specific route? I'd still expect it not to work but want to confirm. Thank you.

Looking for help in locating a power supply for the FortiSwitch 112D-POE that will allow us to plug this switch into a standard ac outlet. Anyone have links to a product online that would work? Thanks

I just saw an RSS feed announcing FAC 6.5.0 release. Since other products around FortiGate has version numbering scheme 6.4, 7.0, 7.2 so far, it's a little surprise for me to see 6.5.0 as the FAC's new version number. Then also realize the FAC generally doesn't have any direct functional connections with FortiGate features, so no reason to go to 7.0.x after 6.4.x.Is this the reason of 6.5.0 for new FAC version? And would it continue to 6.6->6.7->... consecutively without jumping these in the future? Toshi

Hi, i'm trying to create an ipsec tunnel everything it's fine.Tunnel is up correctly, both phase1 and 2 are correctly done.But from remote side, they ask me that they want that i've to translate my local IP before enter in the tunnel. So i've find that cookbook http://kb.fortinet.com/kb/viewContent.do?externalId=FD33638  So i've deleted old VPN (i've done it in interface mode) and create a new one with policy mode in order to follow that cookbook. But now with same settings (remote gw,local and remote address,ike version, encryption, auth etc etc) but in policy mode it doesn't work anymore. i've error in phase1, so there is a way to nat my local ip before entering tunnel in interface mode? Thanks 

Hi One of the feature of fortigate is it does not need controller. Without controller, how to manage a lot edge device? via fortimanager? thanks

I have set up a Fortigate VM and can access the web interface. When I execute the command "get sys int physical" in the CLI, only port 1 is displayed. In the Web GUI under Interfaces is also only port 1 to see. I would like to know how I can use all three ports in the test version.

I configured a ikev1 tunnel between Cisco IOS and Fortigate.The tunnel comes up but communication only works after a client of the remote site (cisco) initiated some traffic.As you can see in the Fortigate capture, the packet to 10.183.2.1 is sent into the tunnel IPsec tunnel-1.2.3.62 which is the correct tunnel.The capture on the cisco router shows nothing until I start a ping.The exact same configuration works with other remote router i tested like pfsense and a linux based system also using policy based vpn.----------------------------------------------------------------------Cisco configuration----------------------------------------------------------------------!crypto isakmp policy 9encryption aes 256authentication pre-sharegroup 14lifetime 28800crypto isakmp key ****** address 1.2.3.36 no-xauthcrypto isakmp keepalive 30 5crypto isakmp nat keepalive 15!crypto ipsec transform-set AES256-SHA1 esp-aes 256 esp-sha-hmacmode tunnel!crypto map IPSECMAP 9 ipsec-isakmpset peer 1.2.3.36set

Hello,I'm trying to change the logging options in my FortiClient-VPN (Version 7.0.7.0345), but I can only export the logs. Changing Log-Level and deleting Logs is greyed out: Funny thing is, yesterday I could change it on one client to "Fehlersuche". Now I can't change it on any client any more.For comparison, other client have information as standard logging-level:# The user has admin rights on his pc and is using Windows11.I already tried to start the client with administrator-privliges, which didn't help. Thanks in advance. Best regards

Hello!I'm new to FortiGate and experienced a roadblock during my setup.I was trying to reach the VM from the public IP(my PC), but there was no response from the VM. Attached are the diagram and packet capture results from FortiGate.Note:The default route is going to an ASR router, but I want all incoming and outgoing traffic to go via the same specific interface on the firewall. (highlighted orange)Static route cannot be used because the source IP can be anything.Tried the policy route, but it didn't work :( Kindly advise what could be the root cause.If you need additional information, feel free to let me know!Appreciate the comments!

I'm trying to follow the solution here: https://community.fortinet.com/t5/Support-Forum/Fortigate-Virtual-IP-One-public-IP-for-two-internal-web-servers/m-p/208937/thread-id/191897 When I change load balancing method to HTTP Host and hit OK, it just reverts back to static. No errors. It removes the http host field from all Real Servers as well.Fortigate 200D v6.05 

I have 2 Fortigate 601E. X1 has our private IP range and X2 has our public IP range.Each of these is connected to 2 separate ISPs. So I cannot run full HA. I run vrrp on X1 and X2 interfaces.I have put the vrrp of both X1 and X2 in the same group. This way if X1 fails over, X2 will fail over as well.I run full BGP with each ISP and announce my public IP.I prepend the inbound via Fortigate2 to make sure that all the internet traffic comes to fortigate1. Outbound traffic will take fortigate1 because of VRRP. Now the question, 1. When X1/X2 fails over, I want to failover the incoming traffic from the internet to ISP2 on Fortigate 2. Otherwise, the incoming traffic will hit Fortigate1 and get blackholed. Outbound traffic won't have an issue because of vrrp. 2. What is the best design to accommodate a situation where Fortigate1 reboots and comes back in 2-3 minutes? (Should I keep Fortigate2 as master even when Fortigate1 comes up? This again will cause an issue with BGP fail

Good afternoon everybody! I'm new to FortiAuthenticator and I'm having an issue related to custom fields in FortiAuthenticator. Within the company, there is an identification that is informed to the guests and they must fill in the custom field to complete the registration, however, the custom fields are not displayed in the user's registration. I renamed the fields, left them with the default name, downgraded the version but the problem persists. And this custom field is of paramount importance in the implementation, since it must be registered with a predetermined code given to the guest at the entrance of the company. If anyone has ever had a situation like this and can share how they did it so that the custom field could be shown, I would be very grateful.

Hey guyswe are looking for a VPN solution for our Azure AD joined Notebooks. We have configured Hello for Business and login with Face-ID or PIN. Is the FortiClient able to connect the VPN with SAML and without user interaction (Usertunnel)? We would have a Conditional Access Policy in AAD to make sure that only compliant devices and mfa are allowed to use SAML. Thanks for your help on this. Best regardsMarc

I have this error only for one user. VPN stops at 80% with the error. Tried another user and it works.  On the same computer tried on Windows10 and 11:  KOUser "A" : KOUser "B" : OK, works fine.User "A" password is not expired, account is working everywhere. Even tried to change password several times...Tried user "A" with both ForticlientEMS 7.0.7  and Free ForticlientVPN 7.0.7 : KOTried user "A" on another computer, still getting the same error. On the other hand user "B" can login everytime. Hostcheck is not enabled on the vpn portals.   Thank you for the help  

Hi all, I've been trying to delete an old user group in our Fortimanager install, but it won't work.When deleting through "User & Authentication" > "User Groups", the object is in use by itself. When going through CLI objects > User > Groups, I get the error:"Response with errors. (-9001) used - object is copied to VDOM GW01.root" During the last push, the group was correctly removed from the firewall. So it seems that is effectively not in use anymore. Does anyone know how this group could be deleted? Fortimanager 7.2.1 build1215Fortigate 200F - v7.2.3 Best regards,Imre

hi,i've been searching/googling for VDOM support for route-based VPN/VTI Tunnel but to no avail.is this route-based VPN/VTI tunnel interface supported in multiple VDOM? i.e. VDOM A is for our internal VPN/VTI to AWS, then VDOM B is for other customer/department.appreciate if someone can provide a fortinet link. thanks!

fortinac version:7.2.0.0035persisten agent verion: 9.4.0.93use L3 isolation model, power on a rogue pc (with PA), the fortinac put the pc into an isolation network and assign dns server ip (fortinac eth1 ip) to the rouge pc, in this senario the persisten agent on rouge pc trying to communication to nac controller, first step should send the dns request to dns server (fortinac eth1 ip) trying to get the ip of nac controller, however nac dns response it's eth1 ip to rouge pc not eth0 ip, is there any missconfiguation? 

Hi, as we know, cisco sdw viptela came into market prety early. and I just know forgate also sdw function. After I reviewed document on sdw-fortigate. I think sdw-fortigate is easy to handle and has some good features. Anyone can compare the two kinds of sdw from their features. so that we can easily know their difference. Thanks

Hi Please see the below diagram. Fortigate-port3, PC-eth0 and router-Gi0/0 (default gateway 192.168.1.1 for fortigate1 and PC to access internet) are in the same vlan. 8.8.8.8 is located at Cloud Net. Now both Fortigate1 and PC can ping gateway 192.168.1.1. but Fortigate1 cannot ping 8.8.8.8 while PC can ping 8.8.8.8. Fortigate config also is listed as below. Did I miss some step?  Thanks   FortiGate-VM64-KVM # show system interfaceedit "port3"set vdom "root"set ip 192.168.1.221 255.255.255.0set allowaccess ping https ssh httpset type physicalset snmp-index 3nextFortiGate-VM64-KVM # sh router policyconfig router policyedit 1set input-device "port1"set dst "0.0.0.0/0.0.0.0"set gateway 192.168.1.1set output-device "port3"nextend

Hi all! Can someone tell me why the ipsec tunnel itself falls everyday? maybe there is a time limit? i notice it in the morningTunnell between FortiGate 100F and Mikrotik

I am trying to determine what I am doing wrong. I' m working with a vendor who requires that they scan the external (WAN1) interface of the firewall for PCI compliance audit check process. To that effect they require a range of IP addresses to be " whitelisted" within IPS. I thought I had done that by doing the following: [ul] For the IPS profile that is assigned to the SSLVPN port, for each policy add the IP address/subnet mask to the IP exceptions list Reboot the firewall [/ul] The vendor performing the scan' s indicates that they are still being blocked. Have I " whitelisted" them wrong? Is there a better way of doing this? Thanks in advance! -Neil