Solved

Hello team. Could you please help me to clarify the FAC licensing of TACACS service? The documentation for VM says that Radius/Tacacs clients are licensed as user licenses/3. I would like to define a single Tacacs client as a subnet /14. Will be consumed just a single license for all network devices which act as Tacacs clients in the /14 subnet (I am fine with just FAC BASE SKU) or do we need a single license for each network device (500 network devices so 1500 users licenses)? Thank you very much.

Hi,We're running a forticlientems (7.01) and have a number of versions of forticlient installed at our company. When we upgrade forticlient to 6.4.6 and 7.01 we get real time protection warnings like these, Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFound exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFound exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFound exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFound exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe as well as for chrome. This is on managed windows 10 computers and we can't find anything on them that we think shoul

Hello everyone, Fortigate 200EFortiOS: 7.0.9I have two FGCP clusters and FGSP beetwen it. I have some questions:1) Is it possible to use loopback interface and address on it as a peer ip on FGSP? When I use address on loopback interface as a peer ip session syncronization doesn't work, but when I change peer ip and use address on some connected interface  session syncronization begin to work. For loopback I have created firewall policy, but it doesn't help. 2) Are there ways to speed up session sync process? I have 9k session and it's can take for 3-5 minutes.

I've created a stich and an action to send a POST which Google states it supports Google Support Doc https://username:password@domains.google.com/nic/update?hostname=my.domain.com Here is it is from the Config:   config system automation-action edit "my.domain.com" set action-type webhook set minimum-interval 600 set protocol https set uri "username:password@domains.google.com/nic/update?hostname=my.domain.com" set port 443 config http-headers edit 1 set key "User Agent" set value "Chrome/41.0 email@domain.com" next edit 2 set key "Authorization" set value "Basic base64-encoded-auth-string" next edit 3 set key "Host" set value "domains.google.com" next end set verify-host-cert disable next end   Watching Debug

Hi,I wanted to know more about the "User Log" feature in FortiSIEM Agents. I presume this feature is for collecting custom logs from the endpoints. If so, how do we go about configuring this?The only explanation provided through documentation is as follows,2acb451cae0a41178bed24d4e936e454.pngI wanted to know whether the below configuration is correct or not, also,if we are to troubleshoot issues related to that which event type to look in the phoenix.log file?c47d7909bb4e416ab2ea0109ed877e55.pngSample Custom log5d7d4367e2b74f03aa033856fd2d8dd0.pngIf the custom log has a dynamic value at the beginning of the log event (ex: timestamp) how to correctly configure the prefix? Does it support regex?------------------------------Cheers,Isuru------------------------------

Hi,We are trying to integrate MSSQL via JDBC. However, we are facing an issue in the discovery process. It prompts an error for authentication (please refer to the attachments). Is there a possibility to bypass the SNMP configuration since SNMP is not required for JDBC configuration?------------------------------Cheers,Isuru------------------------------

I want to assign a FortiGate 60F's interfaces to eight different VDOMs, as followsdmz port: VDOM-Ainternal1: VDOM-Ginternal2: VDOM-Binternal3: VDOM-Cinternal4: VDOM-Dinternal5: VDOM-Ewan1: root VDOMwan2: VDOM-F(Then I want to create 802.1q VLAN subinterfaces for customers under each non-root VDOM interface.) But I cannot move internal1 out of the root VDOM. So I tried leaving internal1 in the root VDOM and put wan1 in VDOM-G, but it won't let me do that either. Is there something I have to tweak, to be able to extract one of those interfaces out of the root VDOM, and finally be able to use that eighth VDOM?

When configuring FortiAnalyzer idle timeouts, there is an option for both "Idle Timeout" and "Idle Timeout (GUI)". Anyone know the difference between these settings?I'm thinking that "Idle Timeout" might be for SSH sessions. Pete

I'm hoping someone maybe able to helps. We've been using Forticlient for many years starting with Windows 7, now we are on Windows 11 and FortiClient has worked well up until the recent upgrade from MS, 22H2 where the Forticlient Service Scheduler is stuck on Starting never started. We've been using V 6.2.6 and also v 7.0.5. V7 is just VPN only but both having the same problem. Any help would be grateful.

Hello Anyone with experience out there that has updated their FGs with such a big jump? I have to go from 6.2.5 in steps up to 6.2.11 - then it has me going directly to 6.4.11 per the download tool on Fortinet firmware page. I will perform the upgrade, but just wanted to see if anyone has run into any gotcha's. Thank you... 

I understand that the default action is deny unless explicitly declared in the fortigate firewall policy.Does this apply to 'local-in-policy' as well? Example) config firewall local-in-policyedit 1set uuid 0000000set int "port1"set srcaddr "Block Address group"set dstaddr "all"set service "TCP_22"set schedule "always"nextend

Product: Fortimanager-VM64Version: v7.0.4 build0306So, this is just super fun.  Upgrading a Fortigate from 6.4.x to 7.x requires using a 7.x ADOM, but once you do that if you have any VIP range definitions, they break and you can no longer push policy to the devices.  Like, at all.Even (and especially if) you're only using IPv4, within the 7.x ADOM in the Fortimanager, when attempting a per-device mapping for a VIP, below "External IP Address/Range" and "Mapped IPv4 Address/Range" appears "Mapped IPv6 Address/Range" which pre-fills with "::" and "::3fe" which despite many attempts to remove these values, isn't apparently going away.The end result is that when you try to push policy to the device, it uploads but won't apply because it attempts to set inappropriate IPv6 parameters on the thing, and there's no way to remove them.Does anyone happen to know if there's a sane workaround for this stupid bug?

I would like to use an Ansible playbook to import an SSL certificate into my Fortigate appliance and set that newly-imported certificate as the Server Certificate. Does anyone have any code examples on how to do that?

Hello Community,Dears, I have an issue in setup FortiGate MikroTik IPSec tunnelfrom MikroTik side -> failed to pre-process ph2 packetfrom FortiGate side -> NO-PROPOSAL-CHOSEN/no matchingAny help?FortiGate@IPSec  

Hi All,Load Balancing is defined for external network, but would like define for LAN.I set :Policy Route:Incoming interface: internalSource: IP TESTDestination: IIS SERVER IPOutgoing interface: internalGateway: IP FortiGateFirewall Policy:Incoming interface: LANOutcoming interface: LANSource: IP TESTDestination: Load BalWhy I have to set instead of  Use Outgoing Interface AddressThanks

I accidently disassociated a wifi client from one of my U431F ap's.  How do I reassociate it back? 

I have an IPSec tunnel between my FortiGate (7.0.8 0418) and a SonicWall firewall (version: old). After much hammering I have it working, but only for clients in part of my network.  I'm running using 192.168.8.0/21 as my network and netmask.  In my IPSec settings I have this entire range listed as an address group and in my Local Address list. For some reason 192.168.12.1 through 192.168.13.254 can all communicate with the target addresses.  192.168.10.1 through 192.168.10.254 cannot.  They are all using the same gateway. I can get the .10.0 network to communicate if I toggle the "Local Gateway" in the IPSec Tunnel to "ON" and enter my public IP address.  This kills the .12.0 and .13.0 tunnel connection.  These are both from the same tunnel, running a single Address Group. The firewall policy is set up so that internal interfaces with the associated internal source can go to the Outgoing interface (tunnel interface) with the destination IP

Is it possible to clone a custom dashboard between administrative users on a FortiGate and between HA FortiGate units?

Hello, I have a Fortigate unit where I have multiple VLANs (infrastructure, staff, guest, voice, servers...) and policies set up between them. All user devices (either wired or wireless) go to the Staff VLAN, and they get a DHCP assigned address. What I want to do is to give them an IP and a limited subnet address so that they won't see other devices on the same VLAN/DHCP pool. I've seen this in public WiFis (such as hotels). I tried looking in forums and Google, but I don't even know how this is called. Does anyone here know how to do this?Thanks and happy holidays!Luis

how do i setup forticlient ems ssl vpn to be always up for all users. FortiClient #vpn

Dears ,  are there any concerns to upgrade fortios from 6.4.8 to 6.4.11 so we can use ssl vpn again   ? Regards  

 Hi I have a pair of FortiGate-200E Firewalls in HA modev6.2.9,build1234,210601 (GA) The  advisory FG-IR-22-398 recommends checking for the existence of certain files in the filesystem./data/lib/libips.bak/data/lib/libgif.so/data/lib/libiptcp.so/data/lib/libipudp.so/data/lib/libjepg.so/var/.sslvpnconfigbk/data/etc/wxd.conf/flash The fnsysctl command doesn't appear to be available.$ fnsysctl lsUnknown action 0 How do I list files in the filesystem in v6.2.9? Do I need to enter a privileged mode to use fnsysctl or should I be using another command? I am new to Fortigates and this has just been dropped in my lap. Thanks for any assistance.

Hello,Please I need someone to help.I'm trying to activate trial licence in VM Fortimanager 2.7.1, installed in VMworkstation, but I can't do it.I wanted to configure the static route, after rule to access Internet, and after try to launch the licence activation from fortimanager.But I don't see how I can configure static route and rule to access internet in fortimanager with cli.So I would like to know if you can show me the method to help to activate a trial licence. Thank you

Hello everyone, I have just configured FGSP beetween pairs of FGCP clusters. I have tested some work scenarios: NAT sync, assymetric sync, failover session, DNAT sync etc. All works fine, except one problem. I have some assymetric traffic and I reboot FGSP peer. After peer rebooted session not sync back to this peer therefore I have traffic loss.I have found in documentation "down-intfs-before-sess-sync" option, but it doesn't help.Should back sync session work at all? Or where I misconfigured?Session sync works over L3 link, ForiOs 7.0.3. Configuration: Peer1:config system ha  set group-id 10  set group-name "Cluster"  set mode a-p  set hbdev "port8" 0  set session-pickup enable  set session-pickup-connectionless enable  set session-pickup-expectation enable  set override disable  set priority 200endconfig system cluster-sync  edit 1     set peerip 192.168.50.200     set syncv

I want to upgrade Fortigate firmware from 6.2.5 to 6.2.6 (Same Vdom)Also, I have fortimanager in my environment... So can I upgrade Fortigate firmware directly through Fortigate firewall settings or should I upgrade firmware from Fortimanager and push it in firewall Please suggest what is the best practice for upgrade of Fortigate firmware Image1) Uploading firmware image through Fortigate!!2) Uploading fortigate firmware image through Fortimanager and push it on Fortigate!!