Solved

I'm configuring internet inbound rules for Azure vWAN SLB using FortiManager 7.4.6 and FortiGate NVA 7.4.7.I am having the error on this step: https://docs.fortinet.com/document/fortigate-public-cloud/7.4.0/azure-vwan-sd-wan-ngfw-deployment-guide/182878/configuring-internet-inbound-dnat-policies-using-fortimanagerTried IP, full resource ID, and exact name. Any help is appreciated!Error log: Starting log (Run on device)  Start installingforti-ngfw-fyalsqc3w~000  config azure vwan-slbforti-ngfw-fyalsqc3w~000 (vwan-slb)  config permanent-security-rulesforti-ngfw-fyalsqc3w~000 (permanent-securi~les)  set status enableforti-ngfw-fyalsqc3w~000 (permanent-securi~les)  config rulesforti-ngfw-fyalsqc3w~000 (rules)  edit "test"forti-ngfw-fyalsqc3w~000 (test)  set source-address-prefix "*"forti-ngfw-fyalsqc3w~000 (test)  set destination-port-ranges "443"forti-ngfw-fyalsqc3w~000 (test)  set applies-on "forti-slb-pip"invalid ingress public

HelloIs there a FortiGuard IP address threat feed? Like C&C, Spam sources, etc, ...I know we can block bad IP addresses directly from IPS, DNS filter & Antispam profile, but is it available from Fortinet as URI to use as external source in IP address threat feed?

I am using windows server 219 and installed FortiClient 7.4.3. But I cannot see the row about “Security Posture Tags: ” Could you help to check the reason ?

Hello, dears,I hope this message find you well. I am trying to rename a FortiAP Profile, which is not the default one. However, there is no button or option.I also checked the CLI from the profile, but there was no option, at least I could not find one, for renaming the profile. I would appreciate any help. Sagvan Saleem#fortiap #fortiapprofile

hello, here is my problem. i have a vm that can switch off servers when there is a power outage, managing a ups. that vm can send ssh commands. it's easier to send exec shutdown instead scripting. if the firewall is master, no need to worry, failover will do its job. if the firewall is slave, no failover. so in order to easily switch off a firewall from a specif location, i need to need to connect to by its own IP address and not from the HA mgmt IP address. if i configure in band management ip address, the vm needs to be in the same vlan, and that is not possible. i can't add another network card. is there a solution for the vm to get a ssh connection to a specific firewall, i guess the solution can route the network flow. maybe out band management? i don't know. thank you  

I have configured a File Filter on a FortiGate 40F running FortiOS 7.6.3. The filter is applied to the LAN -> WAN policy and set to Both (two-way). However, the problem is that it only blocks files being uploaded from LAN to WAN, while downloads are not blocked.Additionally, the antivirus on the same policy correctly blocks infected downloaded files, so the issue doesn’t seem to be with the policy or antivirus itself. I don’t want to create a WAN -> LAN policy because I don’t want external users to have access to the LAN network.Also, I can’t find the PROXY feature in the configuration — it seems like it might have been removed or is unavailable in this version.Does anyone know if this is expected behavior for the file filter in FortiOS 7.6.3? Am I missing some configuration to actually make it work two-way? Any advice would be much appreciated.

I can use nested query to search the devices not sending logs, but when I save this query as report results are coming wrong. How everyone else here gets devices not sending logs in last 24 hours?

Hello, i need to delete a test ipsec dialup vpn, this vpn has no reference but i'm unable to delete neither in cli nor in gui.It was firstly created via the vpn wizard and then changed to custom vpn.I also create a loopback and associated it instead of the wan1 interface but nothing changed.How can i fix it? Following the configuration: FW-VPN-A (ipsec_dialup_vpn) # showconfig vpn ipsec phase1-interfaceedit "ipsec_dialup_vpn"set type dynamicset interface "wan1"set mode aggressiveset peertype anyset net-device disableset proposal aes256-sha1set add-route disableset dpd disableset nattraversal disableset psksecret ENC jd2XioYxP9J8q0kk2kkqW11BE3YteLWRNpehZ1k6B0Ccmn1lmMjY3dkVAnextendFW-VPN-A # config vpn ipsec phase1-interfaceFW-VPN-A (phase1-interface) # delete ipsec_dialup_vpn This phase1-interface is currently usedcommand_cli_delete:6989 delete table entry ipsec_dialup_vpn unset oper error ret=-23Command fail. Return code -23Thank youRegards

 Hi Fortinet Community, I'm currently using FortiClient EMS 7.4 and FortiGate running FortiOS 7.4. When I try to access a server located in the DMZ using ZTNA access policies with ZTNA tags, I receive the following error:  Despite this, everything seems fine on the FortiGate side:The ZTNA tags are successfully synced from EMS.The relevant endpoint appears under the correct tag in the FortiGate.Running diagnostics shows that the endpoint is recognized and tagged appropriately."diagnose endpoint ec-shm list" command correctly shows the endpoint info.I can't identify where the issue is happening—whether it's on the client, EMS, or FortiGate. Has anyone encountered this issue or have suggestions on what else I should check? Appreciate any help or guidance from the community! Thanks.

We have experienced an issue with specific in-house built applications that worked when not behind our Fortigate 7.x firewall but started to fail when we placed behind it. Turns out the application does not send keep-alive or heartbeats and so the session-ttl kicks on the FortiGate and kills the application. We worked around it by creating a specific rule on the Fortigate to increase the TTL for that application but we are wondering if it is possible to log these events and send to the FortiAnalyzer so we have visibility of this condition going forward as we move more applications behind our firewall? 

Hi,  We have configured password policy for both admin and ipsec preshared key as below conf system password-policyset apply-to admin-password ipsec-preshared-keyset expire-day 90set expire-status enable Now the strange behaviour is, after 90 days we really didnt get any notification about ipsec preshared key expired neither IPSEC tunnel went down. We tried shutting down the ipsec tunnel and still the old key was working. There is no clear documentation about this in fortinet public document..This is working fine for admin-password where after 90 days, its prompting to change the password. With this scenario, can we assume that this password expiration is applicable only for admin password and not for ipsec preshared key??.. Please clarify it.. RegardsRaja 

Hi,I manage several firewalls using FortiManager, and I’d like to automate the regular backup of each firewall’s configuration. So, how can I set up this automation within FortiManager to export all managed firewall configurations to SFTP?  FortiGate FortiManager 

Hello and sorry for my english, In fortiauthenticator i created captive portal. All works very well ! But now i want to change logo on portal but when i go to 'administration' -> 'images' the button 'create new' is gray out. So i can't do nothing ! I can edit or delete images but not create. I am connect with admin account, i tried with other administratror account : same problem.thanks for help

 I have a virtual IP configured on Fortigate, and I can access the server via the virtual IP from any network, even from my cell phone.From the local network that goes through Fortigate, I also need to access the virtual IP via the browser, but nothing appears on the page.The interface IP address is in the same segment as the virtual IP, and all segments use the same link to navigate.I hope you can help me identify a possible problem.

Hello, Is there any way of determining whether there will be a FortiAP v 7.4.x release that fixes bug ID 1060165: The FAP-231G/233G/234G 2.4GHz radio would stop SSID beaconing? I know there is a 7.6.2 fix for this, however it requires FortiOS 7.6.3 to ensure compatibility and I'm not confortable to push that FortiOS release out yet to production FortiGates. Thanks,

Hello,My account manager has told me that since we have replaced our Fortigate via RMA, that we can't renew support for the replacement device when the contract expires. This doesn't seem right. It's a 101E and is still a supported device.  Any thoughts?

Hi,I have FortiSwitch 108 POE connected to 40F and being managed by the 40F.I didn't configure any password for the fortiswitch - and connected to the FortiLink.yet - I understand that it is needed for manual configuration.is there a way to configure it ? or do I need to reset it ?

 Hi,  I have Fortegate 100F with OS 7.4.x I configured SSO with EntraID successfully and login was working.  I have a questions.Q) Can I use more than one entra id group for separate vpn portal and policy. A user member of group A and assigned the portal A and apply policy A, and B user member of group B and assigned the portal B and apply policy B And I have in troubleT) User can login was successfully with Entra ID, and connected.But SSL VPN client didn't receive internal routing table, only DMZ routing table was received.It add routing table in manually 'route -Add xxx -mask...' then it can be communicated.Anyone have solution like issue, please help me. Thank You. 

I was wondering as for SQL or XSS attacks fortiweb has 3 options for detections what is the order of operations ? Is it first signatures then Syntax Detection and  then attack ML models that are build on the appliance itself after time from the passed traffic? Also what happens it an attack matches all 3 options? My final question is for SQL injection and XSS attacks shouldn't signatures be stopped and just Syntax Detection and attack ML models to be used as I have read that they have less false positives ?  

Hi, We have two Sites, Site A and Site B already connected by telephone line(old), so they share the subnet ip address, now we want to have a VPN tunnel as a Backup with two Fortigate on each side, we cannot change the subnet ip address,  Configuring Site-to-site IPSec VPN in Central SNAT mode with overlapping subnets doesn't work because this will change to new IPs, which is the best solution for this?

Hello team!! I read the first 8 chapters of the "FortiClient EMS 7.4 Administrator Study Guide".  After this I started to open the FortiClient Cloud, and created some different objects there.  But playing with my FortiClient Cloud, before set this in production, I get some questions.  Please, answer my questions or guide me to reach the answers.  Sorry if there are obvious questions.1) I configured an authentication server (Windows AD), and this is connected, but when I create a Group Assignment Rule, I cannot select a Domain Group, just workgroup group.  Why?  (All computers objects are in All Endpoint as "Not installed", and I am able to use Domain Groups in "Manage Deployment")2) If I want that a group has a ZTNA application (The app is hosted in a server which is in the same site that Fortigate), I need to create 2 applications?  (One for on-fabric endpoints and the another for off-fabric endpoints).  If not, where do I need to point thi

I'm currently setting up a FortiGate firewall and facing a strange issue. The FortiGate WAN interface is directly connected to my ISP router. From the FortiGate, I can ping the ISP gateway successfully.However, from the ISP router side (or any host behind it), I cannot ping the FortiGate IP.Here’s what I’ve checked so far:Ping is enabled on the WAN interface (set allowaccess ping is configured).The interface is up, IP is correctly assigned, and the cable is physically connected.No local-in policy is blocking ICMP.No trusted hosts are configured under the admin settings.Subnet and default routes appear correct.and when I connect that ips wire to my laptop it can get the internet access and able to ping my ip from outside network.

I have played with FortiWeb trial VM and the demo center (FortiWeb Demo) and after reading some docummentation and watching (9) FortiWeb API Protection: Overview - YouTube and (9) FortiWeb - Machine Learning Based API Protection - YouTube I see that FortiWeb has ML for API discovery but what about discoverying if API endpoints don't enforce authentication or authorization or using weak authentication? The traffic could be legitimate but the devs in some cases by mistake don't enforce API autentication/authorization on some API endpoints or a forgotten old version of an API URL endopoint (shadow API). Can FortiWeb see the requests and still after time with Anomaly detection make suggestions for API security improvement even if all the requests don't have authorization header (not a deviation but still a security issue) ?

Hello,  I played with fortiweb trial Evaluation limitations | FortiWeb Private Cloud | Fortinet Document Library and demo https://fortiweb.fortidemo.com/ and I also watched FortiWeb API Protection: Machine Learning based Protection but it is not clear if FortiWeb can  generate swagger or openapi file based on ML/AI learning of the API traffic? Maybe if not the on-prem appliance (vmware or in a cloud like AWS/Azure) if the FortiWeb cloud can ?

can we deploy the User Based policies in similar way we were able to do onsite Active Directory integration using SSO. We normally use FSSO agent for that on AD server, how can we do that on Azure. PS. I am not talking about forticlient or VPN usage here but actual firewall rulebase using the User Groups.