Solved

We have standardized on using Power BI for reporting metrics on our different systems.  Has anyone created FortiSOAR reports using an external report system like Power BI?  If so, how did you accomplish this?

Hello everyone,I’m planning to replace my current Vigor 3220 router with a FortiGate 100F as the main firewall and router for my network. Current Network TopologyCore Switches: 2 × Dell S4112F (OS10), N160-N161 configured as a VLT pair.Access: Dell N1148T Switches N162-N165 connected via trunk ports to Core Switch.Old Router: Vigor 3220 (172.16.16.221) Connected via 1Gbit Link to Dell N1148T -N162 Switch port52. SVLANs: 1 (Mgmt), 110 (Servers), 120 (Users), 140 (WiFi), 510 (Staging Server), 520 (Staging Users).FortiGate 100F (test LAN 172.16.16.222 :( connected to Dell N1148T-N162 on port 51 (trunk)Currently, all inter-VLAN communication happens at the Core Switch level (the Dell S4112F pair). Each VLAN has its own SVI and VRRP configuration on the cores.  Fortigate Test Network At the moment, I created two testing VLANs (510, 520) and added static routes on the core switches so that those VLANs go through the FortiGate: ip route 0.0.0.0/0 172.16.16.221ip route 10.5

Hi, we need to config remote-access ipsec vpn on fortigate. can configure using a floating public IP address?the routing for this floating IP is configured properly, should be routed to the firewall via internet and local internet router. Can someone please advise? thanks in advance! 

We currently have two sites, Site A and Site B, with identical destinations defined over separate VPN tunnels. Each site has a separate SNAT range using different IP addresses, so they know which location/route to send traffic back to. Both of our firewalls are setup as Central SNAT, and they are running 7.4.6. We're about to implement a new solution that requires us to change the destination IP range at Site B, so that the new system can check each path for dropped packets, latency, etc., and then it will send the traffic over the best path. For example, our internal host 192.168.1.1 currently sends to VendorA host 192.168.2.55. Traffic to VendorA is advertised exactly the same to both of our sites, but SiteA is the preferred site. SiteB will only be used if SiteA goes down. This won't work with the new system. What we need to do is to keep the destination for VendorA going out SiteA as 192.168.2.55, but we need to change the VendorA subnet going out SiteB as 192.168.3.55. I

I'm on the verge of buying the FortiToken 410, but it comes in a 5-pack and I'm running a one-man show network. Can I use the FortiToken for authentication on other platforms—like my email account, web hosting provider, or password manager? Your answer is very much appreciated :) Thanks in advance <3

  I am currently working on integrating FortiGate with FortiSOAR and facing an issue while installing the FortiGate connector.FortiSOAR Version: [7.6.2]FortiGate Version: [7.0.0]Environment: VM (CentOS/RHEL baseWhen I try to install the FortiGate connector using the following command: sudo yum install cyops-connector-Fortinet-FortiGate  I get the following error:Errors during downloading metadata for repository 'fsr-app':- Curl error (28): Timeout was reached for https://repo.fortisoar.fortinet.com/7.6.2/fortisoar/x86_64/repodata/repomd.xml [Connection timed out after 30000 milliseconds]Error: Failed to download metadata for repo 'fsr-app': Cannot download repomd.xml I have already tried the following:Verified network connectivity (ping to 8.8.8.8 and 1.1.1.1 works).Edited /opt/cyops-integrations/.env/pip.conf to point index-url to https://repo.fortisoar.fortinet.com/connectors/deps/simple/.Increased timeout and retries in pip.conf.Still facing the same is

We have just upgraded our 100F from 7.0.17 to 7.4.9 with 7.0 going end of support.It upgraded to 7.2 and then to 7.4 Everything seems to work fine with the exception of FortiAnalyzer Cloud. It's refusing to connect and send logs. We did upgrade the FAZ from 7.4 to 7.6.4 however it hasn't seemed to make any difference and both versions seem to support our Fortigate version. I have also removed the device and re-added it to FA Cloud still with no luck.  There's no access issues that I know of # exec ping fortianalyzer.forticloud.comPING fortianalyzer.forticloud.com.geo.fortinet.net (154.52.2.161): 56 data bytes64 bytes from 154.52.2.161: icmp_seq=0 ttl=52 time=20.6 ms64 bytes from 154.52.2.161: icmp_seq=1 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=2 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=3 ttl=52 time=20.5 ms64 bytes from 154.52.2.161: icmp_seq=4 ttl=52 time=20.5 ms--- fortianalyzer.forticloud.com.geo.fortinet.net ping statistics ---5 pac

Hi, I have been trying to access the training portal for some hours. I tried login with master account, did not work, sub-user, did not work. I even created different account. I am using my own FortiCloud account. By the way this worked yesterday. Anyone else experiencing this issue?Thanks in advance 

Title - self explanatory.  

I am wanting to change the hostname of our fortigates so they are more self explanitory. However we have a NPS server running and the NAS identifier is set to the present hostname of the fortigate.Is it possible to change the fortigate hostname and then also the NAS identifier on the NPS server? Will this impact anything else? Such as certs of other EAP settings? We are using EAP TLS with cert. for authentication.Also how would you do this for two fortigates with two different hostnames? Can you add a second NAS identifier in NPS under EAP TLS properties and Connection request policies?Thank you 

Greetings Hi guys, can I get some help with this issue please, these services are DOWN, running FortiSIEM 7.2 on Rocky Linux 8.8 (Green Obsidian) after fresh install it went down. (see the image) Thank you!

For some reason, my Fortigate 40F (v7.0.13 build0566) is losing the date and time settings when it loses power (maybe the battery is dead) and when the power comes back on, the Fortigate displays the message "Fortigate time is out of sync". I have already set the Fortigate to use the NTP server 200.160.0.8 but it does not work. When running the command "diagnose sniffer packet any 'host 200.160.0.8' 4" I can see the UDP requests being generated from my public IP, but no response is received.  In "Fortiview sessions" no sessions are displayed.If I define this NTP server on a LAN host it works perfectly.It seems that the problem only occurs when the traffic is generated by the Fortigate itself towards the IP 200.160.0.8. Could this be a bug in this firmware version?

In my test environment, I migrated from FortiEMS client 7.2.2 to 7.4.4.We deployed EMS on a Hyper-V VM.After a few manual tests, we'll migrate the remaining endpoints to the Linux EMS server by changing the EMS DNS record.How can I generate an overview of the EMS servers with endpoint connections/registrations?

when connect to FortiClient by laptop we lost the internet connection during VPN connecting (IPsec VPN), but when we use a mobile we don't lose the internet. How can we keep the internet connected using the laptop?note that the default route exist, the ping to 8.8.8.8 stopped even the default route exist

 Hi all! I am working with a FortiGate firewall that has an internet connection with a static IP.Our goal is to route the default gateway through an IPsec tunnel that breaks out via the headquarters. When configuring SD-WAN, a default route (0.0.0.0/0.0.0.0) is created toward the SD-WAN zone.Inside this SD-WAN setup, the IPsec tunnel is included with a performance SLA, so that the route is automatically disabled if the tunnel becomes unavailable. In this case, traffic should then fail over to the physical WAN interface.However, for the IPsec VPN, an inbound and outbound policy is required without NAT.These policies are placed at the top of the policy list: from IPsec to SD-WAN, and from SD-WAN to IPsec.The complication arises when the physical WAN interface is also placed inside the SD-WAN zone.In that scenario, NAT is required; otherwise, internet traffic via the local ISP will not work. One possible solution is to configure the physical WAN interface outside

I have an upcoming job where I’ll be installing and configuring a FortiGate to serve as the edge router at a facility currently running an all-Cisco internal network (from a previous contractor). The long-term plan is to replace all Cisco devices with Fortinet gear, but to avoid downtime, the Cisco network will continue operating through the FortiGate for now.Currently, a Meraki MX400 is acting as the edge router. Since we’re unsure of its configuration and I haven’t worked with one before, we don’t want to remove it yet. Instead, the MX400 will connect to the FortiGate, which will then connect to the ISP. We’ll begin building the new network off the FortiGate while keeping the existing Cisco network running through the MX400.The MX400 already performs NAT, so I want to avoid double NAT on the FortiGate. Would the correct approach be to create a firewall policy on the FortiGate for the interface handling Cisco traffic and simply disable NAT? 

Hi! Recently the new FortiOS 7.6 was released, so being an enthousiast I upgraded a new F40 straight out of the box.After the update the devices booted but I could not reach it by it's default IP.Booting the device via console, I got error messages about interfaces en the configuration. A few of these messages are:Initialize config error 44010The config file may contain errors.Please see details by the command 'diagnose debug config-error-log read'. The initial boot gives strange characters until it shows "system is starting" and after that everything is perfectly readable.After the device booted I am unable to type anything in de commandline.So, after this line it is stuck: Please see details by the command 'diagnose debug config-error-log read'. I also tried different serial configuration (baud rate etc.). But that doesn't do the trick.During boot I'm able to press a key but all the characters are gibberish, so a flash format is a challenge.  I

Anyone know are we able to query the SDWAN SLA performance to geeting information about jitter, packet loss and latency using CLI, SNMP or any other way?I have requirement to insert the SLA performance to the SQL database so I can make custom report for specific SLA performance.If we see in the SDWAN performance SLAs there are graph but is limited only to 10 minutes time window and i need more longer.

I recently purchased a Fortigate 50G, and the firmware on the device is v7.0.17 build7598 (Mature). I see possibility of upgrading beyond 7.0.17 but it doesn't see to be possible through the GUI. Also when I check the Firmware images available in Support section of Forticloud I don't find any firmware for 50G, I find them only for 50G-5G.Any info how I can upgrade?   

Hello,one of our customers will like to know if is possible to setup FortiMail FortiSandbox configuration so, that it will not prepend "[Scan Notification] Attachments are held for scanning" text to body and subject, when the message will be processed in the fortimail sandbox for a long time? ThanksMarko

I have this case with FortiMail 7.4.5 VM FortiMail has the following configuration for sending quarantine report config antispam quarantine-reportset schedule-hours 7 8 9 10 11 12 13 16set schedule-days monday tuesday wednesday thursday friday saturdayset web-release-hostname aaaa.bbbb.comset web-release-unauth-expiry 72end However, it only sends all reports at 09:00, despite new spam emails arriving at different times.For example: a user received spam yesterday at 18:40. That email should have been included in today’s 07:00 report, but the report was never sent. Another user received a spam email today at 09:15. It should have been included in the 10:00 report, but no new reports were sent after today at 09:00. I tried running "execute reload cronserviced", but there was no change.  

Hi everyone,Is it possible to tell FortiPAM that users can only connect to WebRDP if they have the extension installed? Because now they can't even connect clientless.Thanks

One of our remote offices has been having intermittent internet issues (thanks Comcast). From what I have been able to find, by default FortiGates don't do much health monitoring on WAN connections, and that if I want WAN health monitoring I need to configure SD-WAN. I have never configured SD-WAN before and wanted to avoid any gotchas. Some of the questions I have about SD-WANHow does configuring SD-WAN affect any WAN firewall policies? Do these need to be updated to point to the SD-WAN instead of WAN?We have a static IP, any concerns with SD-WAN and Static IPs?Will configuring SD-WAN mess with any IPSEC or SSL VPNs?We don't pay for FortiAnalyzer, without that will it make any Health Monitoring useless? 

I wasn't able to connect to an IPsec VPN through FortiClient VPN (7.0.2.0090 free) when updated to Windows 11 (build 22000), SSL VPNs were working fine. When I downgraded to Windows 10 (21h2 build 19044.1415) the IPsec VPN started working again. This is the error that I got on FortiClient  And this is the log that I exported   12/28/2021 4:02:55 PM info sslvpn date=2021-12-28 time=16:02:54 logver=1 id=96602 type=securityevent subtype=sslvpn eventtype=status level=info uid=19AEBE88942A48F59578C42AA765D590 devid=FCT8003159070034 hostname=DESKTOP-5BJFTJ3 pcdomain=N/A deviceip=192.168.224.1 devicemac=<redacted> site=N/A fctver=7.0.2.0090 fgtserial=FCT8003159070034 emsserial=N/A os="Microsoft Windows 11 , 64-bit (build 22000)" user=bueno msg="SSLVPN service started successfully" vpnstate= 12/28/2021 4:03:04 PM info system date=2021-12-28 time=16:03:03 logver=1 id=96823 type=systemevent subtype=system eventtype=status level=info uid=19AEBE88942A48F59578C42AA76

I'm currently working with FortiAuthenticator and I would like to know if it's possible to customize the login page, specifically to:Add our company logoPossibly change or style some elements of the page for branding purposes If this kind of customization is supported, could someone please guide me on how to achieve it or point me to the relevant documentation?Thank you in advance for your support!Best regards,