Solved

Hello @All,I looking for a solution to redirect a URL like this one:User input: https://www.site.net:8080to; https://www.site.net:8080/info/faq.html I have look to this example:In my case, regular Expression is https://www.site.net:8080 and the replacement is https://www.site.net:8080/info/faq.html.If I try https://www.site.net:8080 I only get 404 not foundOn Policy / Web protection Profile, I have added the URL Rewriting. If I type that URL https://www.site.net:8080/info/faq.html everything is working. What I'm doing wrong?Many thanks for helping!TBC

Hello all,how can i access from outside over fortiweb to an internal web server without input of Login Details? We have an internal ADFS Server for Changing Passwords for the User.The User needs access to this internal Server from outside without any Logins. Is that possible? Many thanksTBC

Recently the FortiGate received attack from 114.34.160.41 and IPS successfully blocked the attack, but then caused a false alarm on SIEM. As the FortiGate sent a “Allowed – session reset” log message to SIEM, the SIEM triggered a high-alert message, which the keyword “allowed” made a confuse of the Firewall bypassed the attack. Any suggestion to prevent that? Thanks.  

Hi,it is possible on Fortigate 100F to have one vlan configured on multiple ports?Let's say I have vlan5 192.168.5.0, it is possible to attach it on port1 and port2 so then I will have on these ports the same shared vlan5 subnet ? thanks

I'm reading the FortiOS Handbook on page 1120 it says To import a separate server certificate and privat key files - GUI ......Go To System > Certificates and select ImportBut, there is no "Certificates" under System?????? 

Hi ¡¡¡ I have 2 doubts:  1) I have published WEB servers, which are in my DMZ. I have adjusted thresholds and protected them against TCP attacks since they only allow HTTPS traffic. I suppose there is no point in protecting them from other types of attacks DoS (UDP, ICMP etc). On the other hand, my firewall connects to an ISP and receives the public IP on one of its interfaces directly (witouth NAT). Is not the public IP (VIP) to connect to the web servers but is the same internet connection. This interface doesn't have any administrative acces enable (ICMP, HTTP etc are disable). I was wondering if I should protect the interface itself from DoS attacks, but I understand that it is not necessary since I do not have any services enabled. If there is no service enabled, they cannot do a DoS. However, I have monitored the IP of the interface with very low thresholds and if found anomaly alerts come out and I don't understand why it detects them when ports or services that a

Hello,  I have a 100D and I would like to clean installI boot it and got in the configuration menu so now I cannot upload through TFTP Is there a solution? Regards, Konstantinos

Hello,newbie using Fortigate.I created an automation sticth to upload a config backup to an SFTP server. I used the following CLI command execute backup config sftp /path/firewall_backup.cfg SFTP_IP SFTP_user SFTP-password If i run the above "CLI" command manually, file is created using the name I specify (in the example, firewall_backup.cfg) if I run the same command via an automation stitch, filename is prefixed with the fortigate serial number (i.e. it becomes FG123456789_firewall_backup.cfg) Of course such prefix doesn't disturb me, but I would like to understand WHY this prefix... Checked on documentation but since I'm a newbie on fortigate was unable to find the right point.Can someone help me understanding this  behaviour?Thanks in advance

Hi,Trying to evaluate Fortianalyzer, I created a Forticloud account, logged in and downloaded the VM image but as my lab is not able to access Internet, I cannot connect the VM in lab to get the free trial license directly from forticloud. Is there anyway I can download a free trial license file using my account and upload it to my lab VM?Regards, 

FortiNAC is not providing DHCP service for Isolated network via eth1 service interface. How can i resolve this issue?   

i Noticed that the logs on my Fortigate is stuck at 22-April.eg. web filter and email filter logs when viewed from Fortigate Logs and Report and from my FortiAnalyzer latest logs is until 22-April. I cannot see any logs from 23-April to today.How do i check whether my logs is working properly 

Hi, Long story short:I have created CSR on Fortiweb, CSR was signed and cerficate was imported on FortiWeb My question is:Is it possible to export private key and import it to the backend server?  The probilem I see here is:Private key is password encrypted (duh?), but there is no option to specify password during CSR creation, so I guess the password is automatically generated during CSR creation. I tried changing the password in CLI:conf sys cert localedit "cert1"unset passwdset passwd somepasswordendbut I get an error:Command fail. The configuration of a certificate can not be changed from CLI except the comments. Am I missing something here? Or this is just not possible? 

EnvironmentFortiGate 100FV6.2.9 Build 1234 Cloud EMSV6.4.4.1658 Has anyone upgraded from 6.x to 7.x for Cloud EMS? According to support, it just a case of converting the EMS licence.My concerns are as follows:Will this still be compatible with FortiGate (according to the compatibility chart I should be OK)?How will be affect my existing EMS 6.x VPN clients?Should I schedule the convert out of hours (even though this is a licence change)?I presume the EMS console will expose the option to create 7.x FortiClient installers alongside the existing 6.x created installers?Any advice would be welcome. 

Hi. I have fortigate 600E with 6.2.10 firmware. I have 3 DR (3 ISP internet connections) which the traffic from my servers goes to the internet. To determine which of the 3 lines the source from my server traffic leaves, I use policy routes. Now I would like to configure a SDWAN with 2 different internet lines, for other pourpuses, in addition to the 3 that I already have. When trying to create the new default route I read this message "You cannot have duplicated routes on SD-WAN and non SD-WAN interfaces." I have read about it and it seemed to me that what is usually done is to put all the lines in the SDWAN (the new and the 3 that it had) creating the default route to the SDWAN. Finally, create a DR that goes to the SDWAN (eliminating the current 3) and with SDWAN rules control what goes out through each line. I would like to know if it is correct. On the other hand, I would like to know if this would generate any problem in the servers that go out through the 3 DR that I have, for e

Hello @All, for internal testing, I have set up our fortiweb with an internal and external virtual IP.If I'm using the internal virtual IP for my profile under Policy / Server policy, I get my replacement message screen and everything is fine for internal communication.If I change the same Profile to my external virtual IP I only get a Login Prompt.After input my date the communication works fine but no replacement message at start. Has anyone an Idea what could be the Problem?Fortiweb OS: 7.0.0 Many thanksTBS

My organization is currently reviewing IOC and I been reading about it. However, I can't find answer to one thing, what if its a false positive and we know it and we want host to access the internet and remove it from 'compromised host' tag?

I see the FortiOS and Fortigate Image on Fortinet Support.I'd like to know how are there different?Note:1. Port1 is a management port (cannot use in firewall policy) I tried to change port name but it's not work.2. port 2 is a port1

Hello all,  i have here an Fortigate 60E with enterprise bundle. It is possible to combine it with an Layer3 FortiSwitch 448E without subscription? Is the Switch restricted without subscription? This time i have an HP29xx series as Layer3. However, this does not work optimally with the Fortigate. I thought a Fortiswitch would be a better choice. Especially in device detection and IOT.  Very ThanksBest regards IPranger

Hello @All, I'm looking for a configuration example how to configure a Fortigate to communicate to a Fortiweb like on this example:If a Client on the internet communicate over a public IP of Fortiweb Virtual Server, how to configure the Fortigate to send the traffic to Fortiweb.Is that just a NAT Rule? Fortigate and Fortiweb are on latest Firmware. Many thanks for helpinggreetings TBC    

Hi Guys, i need to delete an expired local certificate and upload a new one but the delete botton is grayed out and i've no access to CLI (i access directly to the public ip address), how can i replace it?if i try to import the new one i'm promped this: "Certificate file is duplicated for CA/LOCAL/REMOTE/CRL cert."hardware is FortiWiFi 60F Region-E thanksregards  

Dear Fortinet Community!FWF30E-3G4G (6.2.10)  is using onboard LTE modem with SDWAN. It works only with direct routes, and doesn't work  with static route sdwan--> 0.0.0.0. LTE gets dhcp address with /32 mask - so there is no any gateway... If I downgrade it to 6.2.9 - everything is fine, LTE gets /30 address with normal gateway. Asking here to see if anybody recently had this issue. Thanks!

Hello @All I have configured sslvpn on Fortigate OS 7.2.0.On Win10 Client Login Works, Ping IP and FQDN to system are working too.If I'm using nslookup I get DNS request Timeout.If i using ping -a I can Ping but no name resolution. My configuration:Under Network DNS Server I have configured LAN and SSL-VPN tunnel interface.DNS Database are configured our domain with both internal MS-AD-DNS Server.Under VPN sslvpn setting there are also both MS-AD-DNS Server configured. Is there anything wrong in my configuration?Also, i have no nslookup on Fortigate CLI Many thank's for helpingTBC 

Hi,I need to set a rule to deny any one RDP to a server, not just TCP 3389 but on any port.I know this can be done using IPS security profiles but there is a problem: When I set the rule to deny, no IPS profile may be selected and in the rule I can only choose RDP service which is TCP 3389. IPS profiles and exceptions within can only be selected when the rule is an Allow type. So? In short, I need a rule to deny RDP protocol with any port (default or non-default) to be blocked toward a specific destination. Regards, 

Has anyone gone thorugh the exercise of bundling the free Forticlient (6.0.x) MSI into a package for mass distribution throughout their enterprise via SCCM?  Any pointers, suggestions, gotchas that you ran into that you're willing to share? We're also trying to figure out how to bundle/pre-package our default Forticlient settings (Connection name, Remote Gateway URL, etc.) into the package - any recommendations on the good way to insert this into the package would be appreciated. Thanks, T. 

How do i enable email filter logs in Log and Report ?my FortiOS is 6.4.8. i can see web filter, Antivirus, web application firewall, but email filter is missing