Solved

Hello,I would like to process a report of IPS attacks sorted by geolocation (country) for the customer. I'm not familiar with sql - can I request a sample dataset or chart?FAZ 7.2Thank you. Jirka

Hello,I need your help to understand some logs for a rule : For example my rule contain : Src : IP_A, IP_B ...; Dst : IP_O, IP_Z, Service ; ftp(21),telnet(23)and tcp 6058 in my logs on the forianalyzer I can some others dst port value. It's possible? There are some explinations for that? Thank you 

Hello Fortinet CummunityI wonder how we can bypass access enforcement for the isolation logical networks.I can find it on the admin guide (check Access Enforcement section):https://docs.fortinet.com/document/fortinac/9.1.0/administration-guide/151724/model-configuration However actually on my GUI (FNAC 9.2.2) the only available options are "Enforce" and "Deny". I need this option in order to assign different Authentication networks for hosts depending on some of their attributes. Any idea on how we can do that? Cheers!AEK 

I have an FG-80C setup with LDAP authentication for SSLVPN. It' s been working great and we recently introduced FortiTokens for two factor authentication. The way I' ve set it up is by creating local accounts on the Fortigate unit and assigning the password field to LDAP lookups, along with the token s/n and adding them to an SSLVPN group. The issue we' re running into is case sensitivity on the usernames. I' ve got them all entered on the Fortigate in lower case and when a user logs in they are prompted for a token PIN code. Works great. However, if a user happens to put their username with an uppercase letter in the username, the Fortigate does not require a token PIN code and allows VPN access with just the AD password. I' ve got a ticket open with Fortinet support, but I' ve managed to stump the first engineer, so thought I would post here. They suggested removing the local accounts, but I/they were unsure how to bind the tokens to each user.

I purchased a fortigate 60D from eBay, it appeared to be unused.  When I booted it up and tried to connect with the iPad app I get a message “Unsupported version. This firmware version of FortiOS is not supported by FortiExplorer. You will need to use the Web GUI or SSH to configure this device.” I want to update the firmware and learned that you have to have an active support license to do so. But I can’t figure out how to get a support license or find out how much they cost. How have others out with this ?

Hi,a few days before, we made the Update 6.4.8 to 6.4.9. After this, the FG can't resolve any Hostnames.Ping with FQDN on FG CLI says "unable to resolve hostname". All rules that use FQDN doesn't work anymore. If I ping the IP-Address the FG is working fine. He also can ping the DNS. We didn't change any other configuration on the FG.Only thing I did after Update was this, cause I couldn't reach the GUI: "set admin-server-cert Fortinet_Factory"FG has configured the same DNS like every client in the network and all clients working fine!It is a FG100F. There is nothing special configured: In DNS-Settings there is only our DNS-Server / DC set with it's IP. I don't know what to do anymore. I tried to contact the support but for every answer they take about 2 days. I hope the FG community can help a little faster.

Dear Team,Is it supported FSSO to poll user-id mapping to FortiGate Firewall from Horizon RDSH servers?  Multiple users will have the same IP address while using RDSH.     

Hi all, I have implement Forticlient VPN with Azure SSO, and all seems to be working well. However I cant resolve hostnames, unless I specify the full suffix i.e. http://webserver.mycompany.lan, whereas on laptops / desktops I can reach it with http://webserver.  Is there something different with how mobile devices do DNS? I found the following tech doc, which outlines updating "set dns-suffix" https://docs.fortinet.com/document/forticlient/7.0.0/ios-administration-guide/597536/features I just dont want to impact anything thats currently working. We have a lot of VPN clients. Thanks.

Hi, I am trying to enable a newly created read only IPS profile on all FW policies. Is there a simple way to do this on the GUI, or would I have to script it into the policy config file? I can also see there is a CLI command "config ips global". Would this be an option for my requirements? Are there any potential drawbacks here?  Thanks.

Hi, I’ve been trying to configure a policy in Fortimail cloud that deliver mails from specific sender’s domain or specific mail sender to a specific internal mail account but I can’t figure how :(I want, for example, that all mails from example@gmail.com be delivered to example@internal.comThanks in advance

hello, how to run a single line command?example: config sys interface | edit port1 | full show

Hello everyone, I would like to performe an authentication in wifi WPA2 Enterprise environment, not with a Radius server but directly to LDAP server ( a OPEN LDAP ). I create a local group with LDAP server but not working . In an article in the 2011 told that was impossible cause the WPA2 Enterprise protocol with Windows AD LDAP but was right for OPEN LDAP ( https://community.fortinet.com/t5/FortiAP/Technical-Tip-FortiOS-LDAP-and-WiFi-WPA-WPA2-enterprise-security/ta-p/192530?cmd=displayKC&dialogID=41242937&docType=kc&docTypeID=DT_KCARTICLE_1_1&externalId=FD33251&sliceId=1&stateId=0%200%2041244958 ) I have another SSID that works with WINDOWS AD LDAP but in a Radius Server install in a Network Policy Server on a Windows Server.I have also a FortiAuthenticator and I use it to performe an authentication trought Radius Server ( FAC ) and the LDAP but also not working.Someone have any idea? Thank you guys Fabio 

I'm testing the FortiClient VPN app V6.4.3.0462 on Android. When I login to the VPN, I get a pop-up warning that the site's certificate is untrusted. According to the FortiClient Android Administration Guide (https://docs.fortinet.com...onnecting-to-the-vpn), it should give the option to Proceed, Cancel or Import Certificate. On my Android, I only see Cancel and Proceed.  (See screenshot attached.) If I proceed, disconnect and reconnect, I get the same message. So, is there another way to import the certificate? Kind regards, Herta

Dear community, I've used FortiGate for a long time now. The newer versions don't seem to store my Firewall policy columns on the table the way I need.  I always add the ID column to the table and drag it to the first column. But every time I log out and come back in the table resets. I need to fix the columns and the positions of the Policy GUI page permanently. What are the solutions? Thanks in advance,Manul De Silva

I try to configure SNMP traps for FortiADC. I don't find "Alert" under "System" in GUI. I used "config system alert-snmp-trap" but no traps are received on FortiSIEM. Is there an extra configuration required?SNMP Community is configured and worked in the discovery of FortiSIEM. Also SNMP filter is configured.

Hello allI hope you are fine and safe . I have two different public IPs from ISP I want to setup SSL vpn on both IPs on the device the default route is now going to ISP one take in mind there is policy route for network towards ISP two for some of users so how could make the device response from ISP Two interface and ISP one interface for SSL VPN Bests

I am trying to place two FortiGate 40F (OS 6.4.8) devices in HA, but I cannot achieve synchronization between the devices, despite the fact that the modifications that I am making in one of the FGs are replicated in the other.Regarding physical connectivity, they only have the WAN connection to a switch that is connected to a router. Heartbeat port is LAN 3.Regarding the front LED witnesses, it strikes me that in one of the two devices (the secondary) the Speed LED of the Heartbeat interface does not light upWhen I configure both FGs, if I keep the Heartbeat cable connected, I am only allowed to access the configuration of the primary from its management interface, being impossible to access the configuration of the secondary from its respective management interface.In the HA menu, keep the secondary as out of sync.The configuration of the interfaces on HA FG 1 (the primary) is:And the HA configuration on the primary FG is as follows:Regarding the second, the configuration (which I can

Helo everyone,Since yesterday, I cant see any log on the Fortigate (On friday, 3-4 days ago, it was working). I tryed through CLI and GUI. When I tryed in the web interface, the firewall starts searching for logs but it shows:  The severity of the logs is set as Information: config log memory filterset severity informationset forward-traffic enableset local-traffic enableset multicast-traffic enableset sniffer-traffic enableset anomaly enableset voip enableset filter ''set filter-type includeend I read that maybe reformatting the flash disk it get solved, but I would like to confirm it and know if someone suffered this problem before. The firewall is an Fortigate 601E with v6.4.8 firmware version. I hope someone could give some advice.Thank you in advance!

Hi,  In my scenario, I have one branch and one hub. My proxy server is on the Hub side. End client in branch uses proxy server for internet access. At branch, I want to do internet application steering between two links. Since I am using proxy server for internet access, whether application sensor can detect the application and do traffic steering or this traffic cant be detected with actual application (Example - Gmail) instead it detects this as proxy.http application.  Any one has come across this situation and what is the solution to do application based steering in the proxy server scenario. (This is SDWAN Hub and spoke solution)RegardsRaja

Dear All, I would like to know if during the hello-holddown's 'hello state' there is forwarding traffic, or it only happens after this timer reaches the working state. (the name 'working' suggests there is no forwarding (only ha) before it and it measured in seconds with the lowest value of 5).So the failover switching time from the perception to the public traffic again will be something like this (in worst case the failure happens just right after a heartbeat packet):hb-interval(def 200ms) * hb-lost-threshold (def. 6) + hello-holddown( def. 20sec) = 21,2 sec And in case of a fortigate 600E changing the values to the lowest possible one, it can be decreased to 100ms*1+5 = 5,1sec ?Could you please tell me if I am right? Thank you 

I have configured in my firewall different tunnel GRE all managed by PIM dense mode. I would like to enable PIM only for some specific tunnel GRE and let the other use the normal delivery of multicast without PIM (forward enable).  I tried to do that but when enable PIM multicast also the other tunnel GRE without multicast PIM do not deliver the multicast packet.How can I create a mixed environment tunnell GRE with PIM and GRE without PIM to deliver multicast packet? Do you believe that using different VDOM this is possible? At the moment it seems that if I enable PIM multicast routing all the firewall has to be manage  with PIM, I cant use different interface for this. I have a firewall Fortigate 600e with 6.4.7 build 1911 firmware.

Hi Everyone,  We have an issue with our Forticlient SSL-VPN on LINUX (multiple flavours, redhat, centOS and Oracle) when connected to any standard WIFI, the VPN connection stops receiving packets for some time generally around 40secs to 2mins, then packets start to come through again. After about 2 or 3 time after dropping or delaying the receive packets it just disconnects from the VPN, I am saying delayed as I have a ping setup to a workstation which doesn't drop pings, the time just spans out to 10000ms for about 10-20pings then returns to normal after the packets start coming through again.So same machines connected to a mobile hotspot using the same WIFI adapter, connected to the same VPN with the same config and they connect perfectly, no drop-outs/dropped packets or delays in receiving packets. Works as it shouldLINUX Version 8Forticlient VPN - 7.0.0.0018SSL-VPN with no client certSplit tunnel ConnectionAnyone else having a similar issue, there aren't too many settings

Hi all,  i am having 2 Fortigates, FW1 and FW2 connected via IPSec VPN and on both sides i have a client network, in this client network the management web interface is activated, now i want to access from the client network on FW1 the webinterface of the FW2  on the client interface, is this possible?(The Client Networks are on both sides in the trusted hosts) best regardsfohe

Hello, I would like to have a command that can retrieve the following information: password policy, http, https, telnet, ssh, snmp v3, default account, updated, OS version, ntp, anti spoofing, syslog, statefull 

Hello!I want to implement Decrypted Traffic Mirror feature but I haven't seen a Fortinet document that would explain the Destination MAC meaning. What is it?1a. The MAC for the webserver whose decrypted traffic will be mirrored?1b. The MAC for the capturing server which captures the decrypted SSL traffic? It is more likely this case because the same GUI window also needs a port to send the decrypted traffic to.2. If the given example with ff:ff:ff:ff:ff:ff works for all cases then what is the meaning of those f's? Is it a filter or exact-match value? What changes when I replace that part with ff:ff:ff:ff:ff:f0 or any other real value? I guess that depends on the answer from the first question. Why isn't there an IP-address instead, whichever case it is (1a or 1b)? Is there anything to do with mirroring the traffic to multiple servers and all f's send this traffic to all servers behind the physical/virtual port?