Solved

Dear all,Could you please let me know which category the following logs:- Anomaly - APP-CTRL- DLP- DNS- EmailFilter- FILE-FILTER- FORTI-SWITCH- GTP- ICAP- IPS- SSH- SSL- Virus- VoIP- WAF- Webfilter  in FortiGate belong to, based on the categories shown in the image from fortigate GUI? I found this categories in the table from "Log Reference" section in fortigate guide. I can't understand for example the "anomaly" logs which category do they belog according to the fortigate list in gui (shown in immage).Thank you in advance for your support.Best regards,

Hello everyone, Before implementing the following configuration in production I'm testing it out in GNS3 and I'm facing issues with Inter-VLAN routing. I have configured FortiGate to act as router-on-a-stick. I have created VLAN 100 and VLAN 200 on the switch and allowed it over the trunk interface that is connected to the FortiGate. Configured the ports connecting the end devices as access ports.Created same VLANs on the FortiGate and attached it to the interfaces that is connected to the switch.Created the required Firewall polices, VLAN 100 -> VLAN 200 and VLAN 200 -> VLAN 100.From device in VLAN 100, I'm able to ping the VLAN 100 SVI IP address and the SVI IP address on VLAN 200. But unable to reach the other device in VLAN 200 and vice-versa.Packet sniffer on FortiGate shows that It is receiving the packet on VLAN 100 interface but it is not sending it out of VLAN 200 interface. Please, find the attached images for the reference. I believe I'm not missing anyt

I have to block filesharing and storage. It works with dropbox.But wetransfer.com is still shown, even when lookup rating tells me it is "filesharing and storage".But sometimes it blocks the short-url we.tl. Any suggestions?Thanks.

Hello and sorry for my english, I want to configure SNMP on fortigate FG500E firmware v7.2.11 (no VDOM). I did on other fortigate it was easy to configure but for this model, nothing works. I create community and allow IP of my Zabbix server (i allow V2 snmp)After that i allow SNMP on interface fortigateI can ping fortigate on interface, but there is no response from fortigate. The interface is not Magement interface, it is that the problem ? not sure i don't find the solution

Hello Experts, We have aaa.bbb.209.136/28 global IP address range by provider. The connection is PPPoE.As wan1 IP address, aaa.bbb.209.142 is set at unnumbered IP. At DMZ, aaa.bbb.209.137/28 is set.Everything works at Fortigate 60E. Recently, we bought Fortigate 90G to replace it with.However, the same IP addresses cannot be configured at Fortigate 90G.When we try to set aaa.bbb.209.137/28 for DMZ, an error message such as"overlapped network with wan1" is shown. How can we solve this situation?For information, aaa.bbb.209.142 can be configured at 90G. Thanks in advance and best regards, 

We recently moved a FortiGate cluster (60F running on 7.4.4b2662) to a new location and are now unable to re-add it to FortiManager (VM running y7.4.3b2487) using the new WAN interface IP receiving the generic "Probe failed" error. Nothing was changed at the time in the configuration of the FortiGate cluster other than the WAN interface IP and the default static route. FGM-Access is enabled on the interface. We have an active IPsec VPN tunnel between the site containing the FortiManager installation and the new location of the FortiGate cluster. The cluster was previously connected to FortiManager with no trouble at all and we are able to connect them now using the LAN interface IP over the VPN tunnel but using the WAN interface as was previously the case is the preferred method. We have confirmed that the credentials being used are correct. Nothing in the firewall policy directly references the old WAN IP that I can find. As mentioned, we can add the cluster using the internal IP

I'd like to ask a question Estimated bandwidth , what's the difference between kbps Upstream and kbps Downstream ? Upstream would be input and Downstream would be output ? in it I put example 80.0Mbps Upstream and limit of my link send message ? would that be it ? 

I'm running 40F with the latest version, it has FortiSwitch connected to it and managed by the 40F running the latest firmware as well, and 831F access points connected to the FortiSwitch, using the latest firmware managed by the 40F.I understand that the recommended version is 7.2 and we're running 7.6looking at the downgrade guides it says that the configuration would be saved.is there a way to downgrade remotely without losing configuration ? or the only path is to downgrade and re-configure everything manually again ?  

 Hi all - I have been fighting with the FortiManager API for a while now.  With a Python script, I've been able to:Authenticate to FortimanagerQuery all Fortigates in FortiManageLoop through the devices to find a specific FortigateCollect details from any individual or all Fortigates includingInterface Status, IP address, subnet, vlan and descriptionGrab the Switch Hostname, Serial Number and number of portsI am struggling with figuring out how to pull the switch details for:Mgmt IP addressModel Number (It appears to part of the start of the serial number)I'm pretty sure I can get it pretty easy from the FortiOS directly, but I'm really hoping to pull the details from FortiManager with the same "connection".  I can see the details in FortiManager under FortiSwitches. Any ideas anyone? Thanks,-Todd 

We just received licensing for FortiClientEMS, and I'm not following the documentation for setting this up. 1. The request to build the FortiClientEMS server has been sent, but it will be a few days before it's ready. I don't have the ability to test anything on the server at the moment.2. We want to use Entra ID for the SAML SSO authentication. Do I need to configure SAML SSO on the FortiGate or the FortiClientEMS server? On the admin guide, this is stated: "Communication between EMS AD connector and AD servers: Enables synchronization of AD groups and users with EMS for endpoint management, policy enforcement, and SAML-based authentication." This occurs over TCP-8871, so I'm confused if the FortiGate or FortiClientEMS server authenticates the user. However, on all our FortiGates that are configured to use SAML SSO for administration, this is configured on the FortiGates.3. The FortiClientEMS documentation shows TCP-389/636 for LDAP to the AD servers. We do have on-prem AD server

Good morning!Can I make a usage report for my fortigate interfaces? To receive in my e-mail? If I can also configure something to receive an alert if my link exceeds the contracted limit.

Hello, Our Fortimail rejects emails which are too big Is it possible to get a daily report with the rejected mails (from, to, subject, date) ? Thanks for your help.

Hi everyone, bit of a niche problem, I have many students working from home with laptops provided by us, they are hard configured to browse by the proxy we have set and they're locked down to keep it that way,  they can browse some times but not all. So we have an implicit proxy exposed on the FG's wan interface.The proxy is configured to default deny.There are proxy policies in place permitting access to Azure for the auth process to succeed which it doesA default policy is inplace that has the SAML_Group object associated against it to permit the learners access to the web, src=all + SAML_Group, dst=all, security= student-web-filter, Full SSL inspection.Clients win11, have the CA cert installed from the gate to their trusted ca stores. A session token is provided to the user post auth with 5 minute timeout.The user on their laptop can browse the web to certain sites, but then it suddenly blocks them going from say google to whatsmyip.In the logs I can see the successfu

Hello Team,I am trying to rewrite  https://exapmle.in.com to https://exapmle2.out.net (URL are fake).I have tried HTTP header rewriting ( without success) and body rewriting 9 the URL was redirecting to the new URL, which is not our case).We need to keep the traffic to Fortiweb and not redirect the traffic to the end URL.Bello the config config waf url-rewrite url-rewrite-ruleedit "ASK-AI-REWRITING"set host-status enableset host exapmle.in.comconfig header-insertendconfig response-header-insertendconfig header-removalendconfig response-header-removalendset request-remove-duplicate-headers disableconfig match-conditionedit 1set reg-exp exapmle2.out.netset HTTP-protocol httpsnextendnextendconfig waf url-rewrite url-rewrite-ruleedit "ASK-AI-REWRITING-2"set action http-response-header-rewriteset location_replace $0exapmle.in.com$1set location-status enableconfig header-insertendconfig response-header-insertendconfig header-removalendconfig response-header-removalendset respo

What the heck am I doing wrong here? FortiWifi # config system netflowFortiWifi (netflow) # set collector-ip 192.168.3.197command parse error before 'collector-ip'Command fail. Return code -61FortiWifi (netflow) #

Hi,I have a remote site A (SonicWall NSA) connected to site B (FortiGate) with IPSec tunnel. Site A is sending load balancing probes (over the tunnel) to site B, but it's targeting the WAN interface IP of site A. Traffic arrives on my tunnel interface at site B. Note that site A's probes are implicit and cannot be edited to target one of my local IPs on the local site. On the receiving site the FortiGate drops the traffic due to strict RPF, message as in logs below contains "reverse path check fail, drop". I tried setting up a DNAT with Virtual IP and got pass the initial above error, but still could not get the firewall policy to trigger correctly. When I enable below CLI bash stops working for some reason, so I suspect something is not right. Any idea if this is the right approach and what I should look at? Thnks. Policies are:vipconfig firewall vipedit "vpn-ahg-hub-probe-vip"set uuid 3e958d92-4f6b-51f0-67e8-xxxset extip 217.91.x.xset mappedip "192.168.10.1"  --> local L

Hello All, Recently i faced an issue with policy package sync whenever I created a user or any device settings and installed it. after the installation, policy package shows out-of-sync and if I want to re-install it. it shows me to delete the device settings which I created recently.Appreciate your help for this.

hi everyonei want to acces a local web server which use virtual host for accessing. so it use a local fqdnI want to reach this internal web server with vip configuration . i will use a andress object mapping to the fqdn of my local web server. how to do that. ?

I have FortiClient 5.4.2.0860 on Windows 10 and it will not work when I try to use it through the Wifi at my local library (had this problem once before at a mall also).  When using the library's Wifi, Forticlient gets to 10 percent and then says "Unable to establish the vpn connection. The vpn server may be unreachable". I can establish a Forticlient connection through most other Wifi networks just fine (hotels, Starbucks, airports, etc).    My company's VPN server is set up to listen using port 10443.   I have tried disabling Windows 10 firewall and Windows Defender and it doesn't help. Could the library's network be blocking port 10443?   Thank you, Tom 

Hi @communiy, FortiSOAR Version: FortiSOARTM 7.6.2-5507Summary:When selecting a datetime picklist in the manual input step and submitting it, the execution output displays the submitted date as one day earlier than the selected value. Let me know how to resolve this issue. For more details check the attached screenshots.The same issue occurred in the previous version - FortiSOAR™ 7.6.1-5275. I had already reported this in a post related to that version, which you can find in the attached link.https://community.fortinet.com/t5/FortiSOAR-Discussions/Submitted-Date-Shows-One-Day-Earlier-in-Execution-OutputIf you have any solution or workaround to resolve this issue, please let us know.Thanks.

Hi all, I am attempting to build a Fortinet Lab. I have a FortiGate version 7.6.1 and FortiManager 7.6.2. Both devices are using trial licenses.  When attempting to add the FortiGate to the Manager, I am getting a "probe failed" error.  On the FortiGate I have FMG-Access selected, I configured the ENC-algorithm to default On the FortiManager I configured ENC-algorithm to low and fgfm-ssl-protocol sslv3 When attempting to add the FortiGate to the FortiManager from the FortiGate Security Fabric -> Fabric Connectors I get the below error Any assistance will be greatly appreciated  

Hello Everyone, I am wondering about Fortigate with NAC license vs FortiNAC for OT device discovery and if there is any comparison ?  I know that Fortinet OT Security Service for Fortigate is for OT attacks and that for OT device discovery FortiNAC that is connected on layer 2 with the OT environment is needed as to be able to see arp, dhcp, dns, etc. and other OT related information but what about Fortigate with NAC license connected with fortilink to Fortiswitches?  From what I have found as info FortiNAC has better Advanced with profiling, behavior analysis for OT devices compared to FortGate with NAC license. But Maybe I am wrong ? I also think you can't stream logs to FortiNAC from Fortigate as so the FortiNAC to not be layer 2 connected to the OT environment which is a limitation if the Fortigate is already layer 2 connected and thus the FortiNAC also needs layer 2 connection even if Fortigate is already layer 2 connected but I could b

While we've been running FortiManager for years, we finally took the time to setup it up to fully provision a firewall using Provisioning CLI Templates. We built around 17 individual CLI Templates that configure various sections of the config, and once we could fully provision a firewall running them one at a time, we grouped them up into a CLI Template Group and were so disappointed when it immediately failed.  It appears that regardless of how you arrange the individual scripts in the Group, when you execute the script, it doesn't execute them sequentially, it consolidates all of the configuration and pushes in whatever order it feels like. In our case, the very first config it tries to push has a dependency on an interface that hasn't been created yet. I opened a support ticket reporting the Provisioning CLI Templates are running out of order and asked how to fix it. The answer I got was to run some of the CLI Templates independent of the Template Group, to ensure the

Hi. About Fortinet FortiGate or any other products,1. After inputting License key (Activation), is there any way to remove that license?2. Is deregistration and deactivation of License the same thing?3. What are the steps to follow if I want to deregister or deactivate a license in FortiGate? After deregistration or deactivation, will the configuration of the FortiGate erase?

When I tried to install FortiSIEM on a vm by using version FSM_Full_All_ESX_7.4.0_build0435, all looks good but when I try to access my vm by https://<my vm ip> it shows service unavailable error like following.      But if I use ssh to access it then it is good.  @Anthony_E  @Secusaurus could you please help here