Solved

Hello Everyone, I am wondering about Fortigate with NAC license vs FortiNAC for OT device discovery and if there is any comparison ?  I know that Fortinet OT Security Service for Fortigate is for OT attacks and that for OT device discovery FortiNAC that is connected on layer 2 with the OT environment is needed as to be able to see arp, dhcp, dns, etc. and other OT related information but what about Fortigate with NAC license connected with fortilink to Fortiswitches?  From what I have found as info FortiNAC has better Advanced with profiling, behavior analysis for OT devices compared to FortGate with NAC license. But Maybe I am wrong ? I also think you can't stream logs to FortiNAC from Fortigate as so the FortiNAC to not be layer 2 connected to the OT environment which is a limitation if the Fortigate is already layer 2 connected and thus the FortiNAC also needs layer 2 connection even if Fortigate is already layer 2 connected but I could b

While we've been running FortiManager for years, we finally took the time to setup it up to fully provision a firewall using Provisioning CLI Templates. We built around 17 individual CLI Templates that configure various sections of the config, and once we could fully provision a firewall running them one at a time, we grouped them up into a CLI Template Group and were so disappointed when it immediately failed.  It appears that regardless of how you arrange the individual scripts in the Group, when you execute the script, it doesn't execute them sequentially, it consolidates all of the configuration and pushes in whatever order it feels like. In our case, the very first config it tries to push has a dependency on an interface that hasn't been created yet. I opened a support ticket reporting the Provisioning CLI Templates are running out of order and asked how to fix it. The answer I got was to run some of the CLI Templates independent of the Template Group, to ensure the

Hi. About Fortinet FortiGate or any other products,1. After inputting License key (Activation), is there any way to remove that license?2. Is deregistration and deactivation of License the same thing?3. What are the steps to follow if I want to deregister or deactivate a license in FortiGate? After deregistration or deactivation, will the configuration of the FortiGate erase?

When I tried to install FortiSIEM on a vm by using version FSM_Full_All_ESX_7.4.0_build0435, all looks good but when I try to access my vm by https://<my vm ip> it shows service unavailable error like following.      But if I use ssh to access it then it is good.  @Anthony_E  @Secusaurus could you please help here

We are running Windows Server 2012 R2. We have installed the most recent FortiNet client (vpn only), version 5.2.0.0591. We have configured an SSL-VPN connection. When we click on the " connect" button, the status progresses all the way to 98% and then hangs. We have disabled the windows firewall, do not have any anti virus software installed, no group policies are being applied, and no other applications are running when we attempt to make the VPN connection. Thanks for helping!

Hi Is it possible to replace the fortinet login page by our logo and color to fortigate?  Thank you

Hi Team,I was trying to edit an existing BGP route-map via FortiManager but cannot save the configuration. I am getting this notification while doing so.Error: rule/1/set-priority : out of range - prop[set-priority]: value 0 out of range (1,65535).But I don't see any attribute or priority to set in the route-map configuration dialogue box. Please do let me know what am i missing here.Warm RegardsFortiManager FortiGate 

Hi EveryoneWe have a Fortigate 80F currently configured with WAN1 only.There are many MIPs configured with this current Class C under Policy Objects -> IPv4 PolicyWe are migrating to a new ISP provider and have a new Class C.I am hoping to be able to configure this new ISP on WAN2 and create new MIPs  using the new Class C.Is this possible without bringing down the current WAN1?This is a production FW so causing a routing issue will be a disaster.The current WAN1 will be disconnected once the new WAN2 is tested successfully.Any help or direction is GREATLY appreciated!

Recently I have recieved this email from forticloud:-------------Start-----------------Dear Customer,We are reaching out to inform you about an important update regarding FortiGates provisioned to FortiGate Cloud without active subscriptions.To ensure robust security posture of your devices, starting Feb 28, 2025 FortiGate devices without an active FortiGate Cloud subscription will be required to upgrade to the latest firmware patch within 7 days of patch GA release.This change ensures enhanced security, reliability, and compliance with the latest features and updates provided by FortiGate Cloud. FortiGate Cloud will provide notification and prompts for upgrade when new patches are available on the web portal and the option to configure the upgrade time/day window of choice within 7-day schedule for convenience. Please note that cloud access and log upload to FortiGate Cloud can be restricted if not upgraded for devices without subscription.What does this mean for you:1. To maintain un

Hello Everyone, Does FortiWeb ML Based Bot Protection need a javascript to be injected ? I am asking if it can be used for API traffic as well  Does FortiWeb ML Based Bot Protection need a javascript to be injected as from what I have read from FortiWeb Bot Protection: Machine Learning based Protection  it seems that the Biometric Based and Deception based Bot features would need this but I see no reason for ML/AI to need it. Outside of that I wonder if during DOS attacks normal urls start returning 5xx (Nginx returns 503 during DOS) or does not respond will this cause false positives as FortiWeb needs to be aware which urls were returing normal 2xx or 3xx responses and not to block the user with Bot protection?    

Hello team! I have a new question about FortiClient EMS.I need to authenticate FortiClient users with an active directory domain and with 2FASo far, I could add the active directory domain in my FortiCllient EMS, and I can use the domain users when I connect a FortiClient (Without 2FA)When I started to search into this, the first option I found, needed to have FortiAuthenticator, but we dont have FortiAuthenticator.The second option that I found, is using Fortigate with the security fabric option, but my fortigate is not in a security fabric, because we havent any FortiManager or FortiAnalyzerI did not found any other method.Is there a way to add 2FA to AD domain users just using FortiClient EMS and Fortigate? Thanks in advance.Regards,Damián 

It appears I am missing some features like log view and in the adom I also dont see options for where to save logs, on which disk. Is it because I am using payg?  

I'm configuring internet inbound rules for Azure vWAN SLB using FortiManager 7.4.6 and FortiGate NVA 7.4.7.I am having the error on this step: https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-vwan-sd-wan-ngfw-deployment-guide/182878/configuring-internet-inbound-dnat-policies-using-fortimanagerTried IP, full resource ID, and exact name. Any help is appreciated!Error log: Starting log (Run on device)  Start installingforti-ngfw-fyalsqc3w~000  config azure vwan-slbforti-ngfw-fyalsqc3w~000 (vwan-slb)  config permanent-security-rulesforti-ngfw-fyalsqc3w~000 (permanent-securi~les)  set status enableforti-ngfw-fyalsqc3w~000 (permanent-securi~les)  config rulesforti-ngfw-fyalsqc3w~000 (rules)  edit "test"forti-ngfw-fyalsqc3w~000 (test)  set source-address-prefix "*"forti-ngfw-fyalsqc3w~000 (test)  set destination-port-ranges "443"forti-ngfw-fyalsqc3w~000 (test)  set applies-on "forti-slb-pip"invalid ingress public

HelloIs there a FortiGuard IP address threat feed? Like C&C, Spam sources, etc, ...I know we can block bad IP addresses directly from IPS, DNS filter & Antispam profile, but is it available from Fortinet as URI to use as external source in IP address threat feed?

I am using windows server 219 and installed FortiClient 7.4.3. But I cannot see the row about “Security Posture Tags: ” Could you help to check the reason ?

Hello, dears,I hope this message find you well. I am trying to rename a FortiAP Profile, which is not the default one. However, there is no button or option.I also checked the CLI from the profile, but there was no option, at least I could not find one, for renaming the profile. I would appreciate any help. Sagvan Saleem#fortiap #fortiapprofile

hello, here is my problem. i have a vm that can switch off servers when there is a power outage, managing a ups. that vm can send ssh commands. it's easier to send exec shutdown instead scripting. if the firewall is master, no need to worry, failover will do its job. if the firewall is slave, no failover. so in order to easily switch off a firewall from a specif location, i need to need to connect to by its own IP address and not from the HA mgmt IP address. if i configure in band management ip address, the vm needs to be in the same vlan, and that is not possible. i can't add another network card. is there a solution for the vm to get a ssh connection to a specific firewall, i guess the solution can route the network flow. maybe out band management? i don't know. thank you  

I have configured a File Filter on a FortiGate 40F running FortiOS 7.6.3. The filter is applied to the LAN -> WAN policy and set to Both (two-way). However, the problem is that it only blocks files being uploaded from LAN to WAN, while downloads are not blocked.Additionally, the antivirus on the same policy correctly blocks infected downloaded files, so the issue doesn’t seem to be with the policy or antivirus itself. I don’t want to create a WAN -> LAN policy because I don’t want external users to have access to the LAN network.Also, I can’t find the PROXY feature in the configuration — it seems like it might have been removed or is unavailable in this version.Does anyone know if this is expected behavior for the file filter in FortiOS 7.6.3? Am I missing some configuration to actually make it work two-way? Any advice would be much appreciated.

I can use nested query to search the devices not sending logs, but when I save this query as report results are coming wrong. How everyone else here gets devices not sending logs in last 24 hours?

Hello, i need to delete a test ipsec dialup vpn, this vpn has no reference but i'm unable to delete neither in cli nor in gui.It was firstly created via the vpn wizard and then changed to custom vpn.I also create a loopback and associated it instead of the wan1 interface but nothing changed.How can i fix it? Following the configuration: FW-VPN-A (ipsec_dialup_vpn) # showconfig vpn ipsec phase1-interfaceedit "ipsec_dialup_vpn"set type dynamicset interface "wan1"set mode aggressiveset peertype anyset net-device disableset proposal aes256-sha1set add-route disableset dpd disableset nattraversal disableset psksecret ENC jd2XioYxP9J8q0kk2kkqW11BE3YteLWRNpehZ1k6B0Ccmn1lmMjY3dkVAnextendFW-VPN-A # config vpn ipsec phase1-interfaceFW-VPN-A (phase1-interface) # delete ipsec_dialup_vpn This phase1-interface is currently usedcommand_cli_delete:6989 delete table entry ipsec_dialup_vpn unset oper error ret=-23Command fail. Return code -23Thank youRegards

 Hi Fortinet Community, I'm currently using FortiClient EMS 7.4 and FortiGate running FortiOS 7.4. When I try to access a server located in the DMZ using ZTNA access policies with ZTNA tags, I receive the following error:  Despite this, everything seems fine on the FortiGate side:The ZTNA tags are successfully synced from EMS.The relevant endpoint appears under the correct tag in the FortiGate.Running diagnostics shows that the endpoint is recognized and tagged appropriately."diagnose endpoint ec-shm list" command correctly shows the endpoint info.I can't identify where the issue is happening—whether it's on the client, EMS, or FortiGate. Has anyone encountered this issue or have suggestions on what else I should check? Appreciate any help or guidance from the community! Thanks.

We have experienced an issue with specific in-house built applications that worked when not behind our Fortigate 7.x firewall but started to fail when we placed behind it. Turns out the application does not send keep-alive or heartbeats and so the session-ttl kicks on the FortiGate and kills the application. We worked around it by creating a specific rule on the Fortigate to increase the TTL for that application but we are wondering if it is possible to log these events and send to the FortiAnalyzer so we have visibility of this condition going forward as we move more applications behind our firewall? 

Hi,  We have configured password policy for both admin and ipsec preshared key as below conf system password-policyset apply-to admin-password ipsec-preshared-keyset expire-day 90set expire-status enable Now the strange behaviour is, after 90 days we really didnt get any notification about ipsec preshared key expired neither IPSEC tunnel went down. We tried shutting down the ipsec tunnel and still the old key was working. There is no clear documentation about this in fortinet public document..This is working fine for admin-password where after 90 days, its prompting to change the password. With this scenario, can we assume that this password expiration is applicable only for admin password and not for ipsec preshared key??.. Please clarify it.. RegardsRaja 

Hi,I manage several firewalls using FortiManager, and I’d like to automate the regular backup of each firewall’s configuration. So, how can I set up this automation within FortiManager to export all managed firewall configurations to SFTP?  FortiGate FortiManager 

Hello and sorry for my english, In fortiauthenticator i created captive portal. All works very well ! But now i want to change logo on portal but when i go to 'administration' -> 'images' the button 'create new' is gray out. So i can't do nothing ! I can edit or delete images but not create. I am connect with admin account, i tried with other administratror account : same problem.thanks for help