Solved

Dears, Good day,  Actually, I am looking for a resource "How TO" integrate FortiSandBox and FortiClient EMS  can anyone help mention a resource talking about use cases of this type of integration Thanks in advanceFortiSandbox 

Hi all, I can find instructions to block certain IP's but is there a way to ONLY allow traffic in from any location in the UK, i.e so anything (and i mean anything) outside of the UK is blocked by default ?ThanksIan

 Hi All, FortiGate600E (HA) and FortiAnalyzer200F are connected.The FG has a 2 VDOM. (I don't use "root".)VDOM1 is the main network and is also used for management.VDOM2 has a separate network.Both are connected to the Internet by separate lines. FA is on the VDOM1 side and is logged by VDOM1.I want to get this with FA for VDOM2 logs as well.However, VDOM2 cannot access VDOM1's network. What solutions are possible?  - The way I come up with it.1. Set up connection to FA with Global, not VDOM1.2. Enable "set use-management-vdom" in "config log fortianalyzer override-setting" in VDOM2(This also sends the VDOM2 logs to the FA via the VDOM1 interface, am I correct?)3. Enable communication from VDOM2 to VDOM1 using VDOM link - Proposals claimed by others.4. Physically wire and connect from Switches connected to VDOM2 to FA(In this case, the second port of FA needs to be connected)Plan 3 has been confirmed to be doable.I think plan 2 is a reasonable one.How

Can we find who user which consume high bandwidth on fortinet?

Hello, I created customize report in FAZ (Firmware Version v7.2.1-build1215 220809 (GA))But if I change a little in query, example I change condition at WHERE statement where from_itime(timestamp) >= CURRENT_DATE - INTERVAL '14 days' and from_itime(timestamp) <= CURRENT_DATE - INTERVAL '8 days'-> where from_itime(timestamp) between CURRENT_DATE - INTERVAL '14 days' and CURRENT_DATE - INTERVAL '8 days'or reverse againTable data in report appear numberBut if I not change query, report automatic run at next week by schedule, table data in report disappear number (only 2nd and 3rd rows disappear number)Please refer query as below:select 'This week' as Types, round(avg(bandwidth)*8/60/60/1000/1000, 2) as bandwidth_Mbps, round(avg(traffic_out)*8/60/60/1000/1000,2) as traffic_out_Mbps, round(avg(traffic_in)*8/60/60/1000/1000, 2) as traffic_in_Mbps, case when round(avg(bandwidth)*8/60/60/1000/1000, 2) <= 100 then 'The bandwidth of Internet Leased Line is almost

Hi, FortiOS 7.0.x. We have defined a VIP translating address external X.X.X.X -> internal Y.Y.Y.Y, like this: config firewall vipedit "vip_server_vpn"set type static-natset extip X.X.X.Xset mappedip "Y.Y.Y.Y"set extintf "any"set portforward enableset extport 1-65535set mappedport 1-65535nextend We are using this VIP in multiple firewall policies with traffic coming in on different IPSEC tunnel interfaces. It works as expected. Now we want to initiate outgoing connections from the internal server Y.Y.Y.Y -> Internet (0.0.0.0/0), in the related firewall policy we have enabled "NAT / Use outgoing interface address". As we can see from traffic capture, the SNAT is performed using the external VIP address (X.X:X.X) and not the external interface IP. This behavior is unexpected. We would like to SNAT to the FGT external interface IP address. I had a look here in the knowledge base and in the article https://community.fortinet.com/t5/FortiGate/Technical-Tip

Hello Team, I need some guidance on FortiAuthenticator.Let's assume I want to implement FortiAuthenticator as a Radius (and Tacacs) Server only, for a small group of Network Engineers (30 Engineers) and about 3000 devices (switches and firewalls)Second assumption is to run FortiAuthenticator as a Virtual Appliance, what calculation needs to be done on the amount of users to match a certain type/size ? For example FAC-VM-BASE ( 100 users ) Thanks in advance !

Hi all! We have a Fortigate 40F that is placed on a temp location. We usually use another model for this but because of delivery issues we have to use this one. Is it possible to use a 4G USB modem in these models?  BrLars

Hi to Everyone, I am new to the Forti firewalls but I have firewall knowedge and I wanted to ask if the Fortigate Firewalls can share user information using FSSO with without Fortiauthenticator? I see that the FSSO is used to share user to ip maping , groups etc but from what I have seen from the documentation and youtube :) the Fabric Connectors can be the DC agent installed on a windows computer or the Fortiauthenticator but not another Fortigate firewall. Is that right? I want the users to authenticate to the VPN forti firewall and then the other forti firewalls after the VPN firewall to take the user info using FSSO, where the configured connector will be the VPN firewall but as I mentioned I do not know if this is possible. https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/450337/fsso https://help.fortinet.com/fmgr/50hlp/60/6-0-2/Content/FMG-FAZ/1200_Fabric_View/0600_Fabric%20Connectors/0800%20SSO-identity/0400_Create%20FSSO.htm 

Hey All,  I'm right in the middle of adding FortiSwitches to my current network. As of now, I have tp-link switches. I've already gone ahead and made a config converted over to fortilink and achieved basic connectivity, inter-vlan the whole nine yards. However, when I went to connect the fortiaps I can't seem to access them. I've gone ahead and made statics on each fortiap and still no luck. On the old switches, they worked perfectly and on the new ones I can't get them to connect at all. Any ideas would greatly help on what to check. When these fortiaps were connected to the fortiswitches, I couldn't get them to authorize in the fortigate nor could I access the HTTPs interface. When connected to old tp link switch no issues accessing the interface. The interface connected to these aps is configured as a trunk group with native-vlan being the same one configured on the tp-link. I don't have issues with any other device other than the fortiaps.  I'm using FortiSwitch

We recently performed a conversion from a Firepower to a FortiGate, and we had one tunnel that wouldn't come up. We found out during troubleshooting an authentication error that a special character in the PSK was not permitted, but we didn't have time to work with the vendor to remove them one at a time - we removed them all and just went with a long alphanumeric key, and it worked. Is there a list as to what isn't allowed? We have another conversion coming up in a few weeks that has between 30 and 40 IPsec tunnels, and we can't have surprises with this conversion. Thank you. 

Hello, I've got question about Denial policy in Fortigate. I put set up for DoS on my Wan IP with test thresholds like some examples below;   config anomaly edit "icmp_flood" set status enable set log enable set action block set quarantine attacker set quarantine-expiry 15m set quarantine-log enable set threshold 100 Now when I put some nmap scan from outside network to my WAN IP I get banned my IP address is putted on quaranteen list but even tough I can still ping WAN IP and I don't know why ? 

Hello, Recently got an 81f installed and I generated a Certificate and applied it to the Fortigate Administrative, users, and VPN settings, but when I connect to the Fortigate, I still get the Not Secure warning on any browser (Edge, Google, Firefox).  When I check the certificate on Chrome, it shows that it is not a valid certificate and that it was generated from Let's Encrypt and shows the generated date, and expiration date.  Any ideas on where to look for troubleshooting this issue? I am running on Firmware 7.0.9 if that matters.  Thanks!

Hi there, I'm new on Fortinet products. We just installed a FortiEDR solution and we have FortiClient EMS solution, so my question is : Do I have to enable the protection solution (Malware protection, Antivirus, Anti-Ransomware, Anti-exploit, Cloud based malware solution) on FortiClient Endpoint Management Server or the FortiEDR solution is enough to protect my endpoint. Thanks for your advices

Hi all,How would I go about finding an application signature for a VPN-proxy.The name is VPN-Super Unlimited Proxy by Mobile Jump Pte Ltd.I would like to block it, but it is not listed in application controls as a quick "add app", so I thought I could add it, but was stopped at the signature question. 

Hi What is difference between  executing keywords "GET" and "SHOW" with combination other keywords at Fortigate firewall CLI ??

Hi there, I have a FG60F on which I've setup a custom IPsec VPN to our main office that has a SonicWall NSA2600.The VPN is working / up. I can ping the remote LAN gateway address, but nothing behind that. Both directions are affected.Here some details: FG60F (Remote site, behind NAT)Firmware: 6.4.11, updated from 6.4.10 (but didn't help)LAN1: 192.168.40.1/24PC1: 192.168.40.2/24 Static routeconfig router staticedit 2set dst 10.13.25.0 255.255.255.0set device "xxxx"nextend Firewall policiesedit 10set name "VPN > Local"set uuid d42029c4-9d8b-51ed-fd1d-a746d24d2fa5set srcintf "VPN interface"set dstintf "internal"set srcaddr "all"set dstaddr "all"set action acceptset schedule "always"set service "ALL"nextedit 11set name "Local > VPN"set uuid 0e55778e-9d8c-51ed-5a53-1db42ef0823cset srcintf "internal"set dstintf "VPN interface"set srcaddr "all"set dstaddr "all"set action acceptset schedule "always"set service "ALL"next SonicWall (Main office, behind NAT)LAN1: 10

Hello all, I come from a cisco background. Previously before picking up fortiswitches, we had to setup trunk ports to the fortiaps to pass the vlans for the SSIDs. On fortiswitches, do you setup the trunks within Fortigate as well for the fortiaps ? Also, between fortiswitches I noticed LACP auto trunking took place. Is that the proper way to do it is just let fortilink pick up the switches and handle trunking or should I configure trunking static/fortinet trunking between switches. Also, should a trunk be configured between the fortiswitches and fortilink port on the fortigate ? Thank you in advance

Dears, I have question about deep inspection feature in fortiweb, I'm not sure if it's the right term in fortiweb but I mean decrypt incoming secure traffic, inspect it and encrypt again to send it for mail server as our case. my question is:Is the deep inspection is the default behavior in Fortiweb when we are using HTTPS protocol? I mean just uploading the server certificate and applying it in server policy with using web protection profile is enough? or there is additional setup? -We need fortiweb to inspect scure OWA traffic before [HTTPS traffic].

Hello everybody, I have a fortimanager with several ADOMs, and inside each ADOM there are devices that have a device name, what I would like to do is export the names of all the ADOMs and all the devices inside the ADOMs but I haven't found anything about it .Do you happen to think of anything useful about it? BR. 

Hello everyoneIn my company, I have two 200F FG. One for branch office, one for HQ. HQ and Branch are so close so I want to maybe connect two sites physically in one server room. I would like to use 200F as HA Active Passive mode but I am not sure about the performance. Here is why:If I use one FortiGate as active, it will have the traffic from Core switch that connectes to two distribution switch + 8 access switches in total. For subnets, I have currently 10 subnets each on FG, 18 FW policies eachDo you think that I could achieve to use FG 200F for all this traffic? there is no server or internal routing. Just pure internet connection :) 

Being new to the FortiGates, I probably have a misunderstanding on the log settings within the firewall policy. In the FortiManager, we have certain lines set to "Log All Sessions" that we are particular interested in, with the majority set to either "Log Violation Traffic" (for blocks) or  "Log Security Events", and it's set this way with the intent of somewhat restricting logs that are being sent to our SIEM. We have to pay for extra log data, so we'd like to trim out what isn't needed. After troubleshooting today, I believe this affects what's presented in the Log & Report > Forward Traffic. There were no results for a lline configured with "Log Security Events", but there was after this was changed to "Log All Sessions." Is it typical practice to set every line in the Firewall Policy to "Log All Sessions." I understand there is a logging level configured in the syslog configuration, but does the logging level in the firewall policy affect what goes out via sys

We recently converted from a Firepower to a FortiGate, and we have a problematic tunnel we just can't figure out what to do. The debug shows authentication is failing, but we've both confirmed and re-entered the PSK. We're also seeing the remote peer using 172.24.x.x as it's peer ID just before the authentication failure. They are using a Cisco ASR router and refuse to change their peer ID, although they did admit they have problems with both FortiGate and Palo firewalls. I've searched through numerous Fortinet documents, and I've had a TAC case opened a week with no progress. Is there anyone that can tell me how to change the remote peer ID for a VPN tunnel? Thank you.

Hi, We are getting the following alert on out FG50E:  The following intrusion was observed: "HTTP.Server.Authorization.Buffer.Overflow". date=2023-03-21 time=08:30:46 devname=Fortigate_FG50E devid=FGT50E3U17032297 logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" eventtime=1679401846773064861 tz="-0400" severity="critical" srcip=10.1.1.216 srccountry="Reserved" dstip=20.62.128.25 srcintf="lan" srcintfrole="lan" dstintf="wan1" dstintfrole="wan" sessionid=121219710 action="dropped" proto=6 service="HTTP" policyid=3 attack="HTTP.Server.Authorization.Buffer.Overflow" srcport=57766 dstport=443 url="/artifactory/api/system/ping" direction="outgoing" attackid=12351 profile="default" ref="http://www.fortinet.com/ids/VID12351" incidentserialno=1166735929 msg="web_server: HTTP.Server.Authorization.Buffer.Overflow," crscore=50 craction=4096 crlevel="critical" The user in question is getting this using Microsoft's Power Apps.  It loo

So using fgm logs and faz they both show me the same results. for some tcp session we can see number of packets sent and received is 0, along with data transferred 0, this makes sense, tcp handshake probably doesn't complete (or does complete then reject) and no further transactions happens, therefore we have a session with zero bytes transferred. All good.  But for UDP, the packet is just transmitted, now regardless of whether it makes it to the receiver or not,  how can it possibly be 0 bytes sent and received and 0 packets sent and received? I see this on both fmg and faz for some traffic.