Solved

Hi, We are getting the following alert on out FG50E:  The following intrusion was observed: "HTTP.Server.Authorization.Buffer.Overflow". date=2023-03-21 time=08:30:46 devname=Fortigate_FG50E devid=FGT50E3U17032297 logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" eventtime=1679401846773064861 tz="-0400" severity="critical" srcip=10.1.1.216 srccountry="Reserved" dstip=20.62.128.25 srcintf="lan" srcintfrole="lan" dstintf="wan1" dstintfrole="wan" sessionid=121219710 action="dropped" proto=6 service="HTTP" policyid=3 attack="HTTP.Server.Authorization.Buffer.Overflow" srcport=57766 dstport=443 url="/artifactory/api/system/ping" direction="outgoing" attackid=12351 profile="default" ref="http://www.fortinet.com/ids/VID12351" incidentserialno=1166735929 msg="web_server: HTTP.Server.Authorization.Buffer.Overflow," crscore=50 craction=4096 crlevel="critical" The user in question is getting this using Microsoft's Power Apps.  It loo

So using fgm logs and faz they both show me the same results. for some tcp session we can see number of packets sent and received is 0, along with data transferred 0, this makes sense, tcp handshake probably doesn't complete (or does complete then reject) and no further transactions happens, therefore we have a session with zero bytes transferred. All good.  But for UDP, the packet is just transmitted, now regardless of whether it makes it to the receiver or not,  how can it possibly be 0 bytes sent and received and 0 packets sent and received? I see this on both fmg and faz for some traffic. 

Hi community, I have upgraded an active/standby cluster of two FortiGates, but the process is the opposite that what I thought. The cluster HA override setting is disabled, so the uptime takes precedence over the firewall priority. This is my initial setup: FG-SPB01 - Priority 128 -> PrimaryFG-SPB02 - Priority 129 -> Secondary When I upgraded, the secondary firewall upgraded first and rebooted, and I saw the following (FG-SPB02 doesn't appear because it was rebooting): So far it is OK. After that, when the primary firewall upgraded and rebooted, I saw the following (FG-SPB01 after rebooting and up): So here, we see FG-SPB01 has higher uptime but it has the secondary role, while FG-SPB02 has lower uptime and it has taken the primary role. Is it OK? Shouldn't be the opposite? What am I missing? Regards,Julián

Hi, i wanted to make an inquiry, we have a client and we want to replace all their Cisco equipment with Fortinet, it is currently a 9-story hotel.The equipaments areCisco 2900 RouterSwitch 2960 switch for each room floorSwitch 3750 Corewith Cisco AP Aironetthey don't have firewall they do not have a DHCP server, currently the DHCP server is Mikrotik equipmentOaky, my idea is to remove everything and place Fortinet, for my proposal it occurs to me:FortiGate-100F (firewall/routing/dhcpservr)FortiSwitch-248E-POE (Core for vlans)FortiSwitch-124E-FPOE (switch for each floor)FAP-U231F-N (access point for each floor, two per floor) My question is am I correct or am I missing something? In addition, I would like to offer a second offer where only the fortigate is firewall, routing, dhcp server, and server for the vlans, i was thinking of a Fortigate-200F to meet this requirement and eliminate the FortiSwitch-124E-FPOE and thus only leave the switch in the floors. Can someone hel

Hi,This is the scenarioA VDOM named Mycompany is the main traffic VDOMA VDOM named MGMTFGD is responsible for connecting to Fortiguard (It's marked as the management VDOM)A VDOM named OOB is going to be used for Admins interaction and also sending logs to FortianalyzerThe Global VDOM is also present I want all the VDOMs (specially the MGMTFGD and Mycompany) logs to be sent to Fortianalyzer which is reachable via OOB VDOM When configuring FAZ-Override settings in Mycompany VDOM, I just have two options:1- Sending logs through the VDOM itself2- Sending logs through the management VDOM which is MGMTFGD In the command line, I cannot find any command to dictate the firewall sending logs neither through itself or the Management vdom (Here MGMTFGD) but using a third VDOM which is OOBAnd for security reasons I'm not going to change (Switch management) the Fortiguard VDOM to OOB. Hope its all clear Regards, 

We have two FG200F in active-passive HA config. Recently we tiggered upgrade from 7.2.2 to 7.2.4 using the GUI "wizard" as we have done multiple times before.When triggering the upgrade our two devices were"A" Active"B" Passive The upgrade started on B and after a short while the role of active was handed over tothe newly upgraded B.After that nothing seemd to happen on A. Now after waiting more then a day the HA status says that A is Not synchronized. "get system status" on A says version is still 7.2.2 The components not in sync seems to be: firewall.internet-service-nameendpoint-control.fctemssystem.federated-upgrade When looking at federated-upgrade on A i find:config system federated-upgrade   set status confirmed   set upgrade-id 2   config node-list      edit "FG200FTxxxxxxxxx"         set timing immediate         set setup-time 06:00 2023/03/19 UTC  &nbsp

Hi All, I have a central 100F and a small number of 60E's in regional offices. 60E's connect back to the 100F via IPSEC tunnels. I'm trying to monitor the 60E's via SNMP. Key points:IPSEC setup using default static FG-FG tunnel template.VDOM is not being used at either end.Specific rules have been setup for testing allowing essentially ANY/ANY for SNMP and ICMP to and from both ends.SNMP is enabled on the interface at the remote site.Tunnels have performed well for 2+ years and I can fire anything I need across it. (ie, DNS and Routing seem fine).Community has been set, along with ACL (which has also been removed and tested).I have extensive SNMP checks all over my networks which are working fine (ie, this isn't my first rodeo). Result:I can ping the remote interface gateway.SNMPGET and WALK returns "no response" (commands tested locally work fine). I can SNMPGET a bunch of other devices on that remote subnet and it works. When directing SNMP to the remote gateway,

Hi, I am following this kb article to reference default routes learned from bgp peers in the sdwan rules. So I created the route map and applied it to the bgp neighbors, however when referencing the tag from the sdwan rule I couldn't find the dst-tag item as mentioned in this part : config system sdwan config service edit 1 set mode priority set dst-tag 11 set health-check "datacenter1" set priority-members 1 2 next end end Seems like the dst-tag is not available, or do I need to enable something else? I tried both in a FG 600D 6.4.12 and a FortiVM (demo) with no luck: FortiGate-VM (1) # set dst-tag 11command parse error before 'dst-tag'Command fail. Return code -61   

Hi,I just purchased a FAZ and received the license file. Uploading the license file is successful and after login to FAZ 7.2 it goes to register with Forticare and says : Failed to connect to FortiCare servers. The appliance is in a secure zone and it can be only connected to Internet via a proxy server. I mean every connection such as DNS, HTTPS, ICMP, etc to Internet is only possible through a proxy server.In this situation, how can I set the FAZ to use that prox for connecting to forticare and complete the process and let me login and set up my device.I used config system web-proxy and it didn't work. Instantly it says:Failed to connect to FortiCare servers. Is there anyway to solve this and send all the traffic to the proxy server?Or maybe there is another trick to this? BTW, possible to skip this for now? Regards, 

hi,i managed to built HA active-passive between two 40F.i lost HTTPS/ping access to secondary since it sync'd with primary IP in lan1.i already remove FW policy and static route for lan1 but i'm still unable to add lan1 in HA MGMT interface reservation both in GUI (only 'a' is available, used in HA link) and CLI (code -23).can anyone advise or point me to the right direction? FW01_PRI # config system haFW01_PRI (ha) # set ha-mgmt-status enableFW01_PRI (ha) # config ha-mgmt-interfacesFW01_PRI (ha-mgmt-interfaces) # edit 1new entry '1' addedPRI (1) # set interface lan1node_check_object fail! for interface lan1value parse error before 'lan1'Command fail. Return code -23 

Hi gentles, Actually, I read an article that says there're use cases to run FortiClient in conjunction with Windows Defender. https://www.fortinet.com/content/dam/fortinet/assets/solution-guides/sb-leveraging-forticlient-w-microsoft-defender-6-use-cases.pdf If that possible technically, please share the material "How To" that describe the process, if any. Thanks in advance 

Can someone explain why this mac address appears every 5 seconds. It is source ip always different. It stopped appearing after I disabled “Device Detection” on LAN interface.

I am having issue getting the free trial tokens. Serial Number: FAC-VM0000000000 I just deployed FortiAuthenticator on AWS using the marketplace image version 6.2.1. After everything setup. I thought my company firewall may have blocked some urls. After checking in another post, I have requested all those urls to be opened. I am still having issues, this seems to be a old issue that has been resolved on another thread. But it is now happening again. On the status page, I see this issue: FortiToken Cloud - Status - Service unreachable  When I go to the token page (Authentication->User Management->FortiTokens->Create new FortiToken->FortiTokenMobile), I see this issue: FortiToken Mobile activation is disabled because this VM is unlicensed or license is disabled. When I try the "Get FortiTokenMobile free trial tokens", I get this issue: Error : FortiAuthenticator VM license not found This is really frustrating and making m

I'm attempting to try out FortiAuthenticator + FortiToken Mobile at the same time.  I have a trial VM of FA running, but when I attempt to execute the "Get FortiToken Mobile free trial tokens", i get an error message: "FortiAuthenticator VM license not found"... Has anyone else had any luck? I don't want to have to buy FA in order to test our an end-to-end solution... Thanks!!! **UPDATE**: If you come across this, for FAZ 6.x, you'll need to have an evaluation license of FAZ installed on the device in order for the trial tokens to be generated/available.

Hi, I am testing out fortiauthenticator and realized that it requires accessing external addresses. The licensing status indicated server unreacheable. I need to know the url as my company implement strict whitelisting.Also, does anyone know what other urls the product needs to work? Thanks.

Longer story short. Looking to setup additional group access in these for read access etc etc.(Using existing RADIUS setup that gates and other network devices are using)Group claims are not being seen on the FAC by these two platforms. On gates you can assign a user group and then add the group attribute on the gate. On the manager etc there are no groups set themselves... Rather setting up of remote users. When adding multiple RADIUS policies to the FAC for these devices it basically errors out and doesn't select any group, rather the first group within the FAC. Thanks

Hi,Is any way from Fortigate to check at what ethernet interface speed is connected FortiAP?

hello guys I need to know the matching Product Model of Sophos XGS 2100 with FortiGate

Hello All, I have a serious security issue and need your help to solve it.I have a Fortigate 60E securing Internet access, I'm using Security profile to block unwanted websites and applications and it's working fine except for Chrome extensions. I found that some users are using Hoxx and Windscribe extensions for chrome.They are able to bypass our security rules and connect to some sites that are blocked by Company's policy.Could you please help me finding a solution for that. Thanks and kind regards,Gr1n3

HiIn many tutorials when configuring ipsec vpn via sd wan that the tunnel interface must have an IP address, so my question is what is the purpose of this IP address and if the sd wan can work without ?  THANKS

I have a WWAN  backup link that is not ipv6 capable. Clients get GUAs from the primary link. In case this link goes down and SD-WAN switches to the backup link the outbound IPv6 traffic needs NAT64.edit: realized that NAT64 is not the right solution for this scenario. See below.So I need NAT64 for all the IPv6 traffic that leaves through the backup link interface of my FortiGate.NAT64 is configured on a policy level, but I can't do policies on member interfaces once they joined an SD-WAN zone.How can I achieve this? Or did I oversee something? I could add another router that does the NAT64 for this link.  But I'd prefer a solution without an additional device. Slightly offtopic: if I had a IPv6 capable backup link, is there  really no NPTv6 on FortiGates?TIA,Oliver

Hi All, I'm using Fortigate80E v6.0.9 build0335. We have two different internet connection. One is radiolink and second one is VDSL. I've already setup VDSL modem as bridge and on fortigate i choose pppoe and wrote down username and password. when i enable VDSL in interfaces; my connection is lost. i want to use both wan connection and i'll set policy like clients would use wan1 (radiolink) and servers use wan2(vdsl). I searched forum and couldn't find the answer. Can you help me? Thanks

I am trying to get a template created in FortiManager to integrate my FortiAnalyzer and when I try to select my FAZ, it does not show up in the list. How do I go about adding it? I do have my FAZ listed in Device Manager, so I am not sure what I am missing. I pretty much followed this KB:https://docs.fortinet.com/document/fortimanager/7.2.0/examples/480770/centrally-configuring-fortigate-to-send-logs-to-managed-fortianalyzerBut stuck on step 2e.v7.2.2-build1334 230201 (GA) When trying to select something I just see a crossed out red circle. Also, does anyone recall on how to add a button shortcut on FortiManager home page for FortiAnalyzer? 

Hi All, Yes I know, 'use the Manager'.. but some things are just not possible from Manager, so we need to login to the FortiGates & Switches directly.Why does the FG prompt the user loggin in, to do a FW upgrade, when the FG is Managed, and we even have Firmware Templates defined, that clearly state, it should NOT be upgraded! It would be great, if this prompt could be hidden... 

I've installed forticlient VPN client and opened the app and got white blank screenmac mini 2012macos 10.14.6