Solved

There have been internal discussions about blocking *all AI websites, so I was asked if that could be done on the FortiGate. I don't see a category for this, but I did find a webpage that had something under General Interest - Business | Aritificial Intelligence Technology. However, I don't see that category in our FortiGate, which is running 7.2.5. Does anyone have suggestions for this? Thanks

i setup this hub site with diaup ipsec option with igbp my issue spoke1 to spoke 2 not ping

Hi, I'm new hereI have the SIEM analyst role and I have read-only access to the fortianalyzer.I have to monitor all the events that it detects as incidents.This fortianalyzer manages more than 10 firewalls and I only want to get the events that are most relevant or what fortianalyzer considers as an incident or what most draws attention and contributes to security issues to avoid incidents.According to what I have investigated this is the configuration that I should request to the firewall administrator but I would appreciate if you could share with me your recommendations config system log-forward edit 1 set mode forwarding set fwd-max-delay realtime set server-name "SIEM_Server" set server-addr "192.169.1.1" set fwd-server-type cef set server-port 6515 set fwd-reliable enable set log-filter-status enable config log-filter edit 1 set field "event" set value "sec

Hello Team, I connected an already configured fortigate cluster to a Fortimanager. Now I wanted to try to create a policy from the Fortimanager and push it to the firewall. Can you point me to the correct procedure?To do this I saw that you have to create a policy package but I have the grey button and I can't click it.I am logging into the FortiManager as an admin user (so I am ruling out permissions problems).I point out that on the same adom (root) as Fortimanager there is already another pair of fortigates which already have a policy package assigned. Please feel free to ask for more details.I thank you in advance for the supportBR 

i need to know after ssl vpn not support in future so if we need vpn web mode how we configure this?

Hi everyone,I have a FortiNAC VPN management model with FortiGate (IPsec VPN).I referred to the documents below but still do not understand some things:https://docs.fortinet.com/document/fortinac-f/7.6.0/fortigate-vpn-integration/693309/what-it-doeshttps://docs.fortinet.com/document/fortinac-f/7.6.0/fortigate-vpn-integration/693309/configuring-fortigatePlease see the attached links for IP information, model, etc.My questions:Can FortiNAC's Isolation Interface (10.1.3.71/24) be used for both SSL VPN and IPsec VPN?Where does the Isolation IP range 10.5.254.11 - 10.5.254.99 come from? Where is the gateway of that range?When is the IP range 10.5.254.11 - 10.5.254.99 used?

HiI'm trying to setup IKEv2 tunnels for my remote access users. on IKEv1 i could assign tunnels to a user groups but when i change it to IKEv2, I can't find anywhere to assign the tunnel to a group. I'm using LDAP for user Authentication. how am i supposed to handle this?Regards

Hello Guys,I have two questions about the Ike V2 IPSEC DIalup Connection. I want to configure in my enviroment (two fortigate 100F HA) like 150 dialup external connection. I have setup an IPSEC Tunnel (IkeV2) and set policy correctly. I created the users locally (without any Proxy or RADIUS) and inserted in a group. The VPN works fine but i have two questions:- Is binding set in the IPSEC configuration the authusrgrp? because i haven't set and i won't set because if i set, every time thast the people connect appear when the people search a local ip for example, the Fortigate Auth page, and for us isn't necessary. So if i unset that is an error? -  Ikev2 works fine with the local user (i enabled the EAP)? because i haven't any other type of authentication Thank you so much

Hi,Is it possible to use both SamAccountName and DnsHostname authenticated against same LDAP server. I cannot get it worked. If I changed the username attribute to dnshostname as below it authenticates with dnshostname but not with samaccountname, how can I get both working so I can authenticate using both computer name and username ?  Thanks Thilina 

I upgraded from 7.0.15 to 7.4.7 due to a request from Fortinet support to fix an IPSec issue I had.After the upgrade, all was working fine. Then, a couple of days ago, the letsencrypt certificates I use with Virtual Servers were renewed. Successfully.However, since the renewal, the certificates are not applied anymore to the incoming connections. Instead the self-signed certs of the application are shown to the client. After some research, I believe that this is because proxy based fw rules are not supported anymore on a 40F with 2GB RAM. Question: Can I still use the letsencrypt certificates with VIP connections? If yes, what do I need to change on the settings for those connections (FW rule, VIP serttings, etc.)? ThanksDan

Hello, We have an LDAP connection to our DC setup on our Fortigate 60E (v6.2.2 build1010). We connect to the domain controller over a S2S VPN. Insecure connections on port 389 connect just fine. However, when I attempt to turn on LDAPS, and issue command: diagnose test authserver ldap SDC_LDAP <username> <password> I get authenticate '<username>' against 'SDC_LDAP' failed!I have imported a CA cert into the Fortigate that is in the trusted CA store of the DC (SDC_LDAP) as well. After a bit of troubleshooting, I believe I cannot connect via LDAPS because the Fortigate does not resolve the fqdn of the LDAP server IP, thus causing a cert validation failure. Entering in the fqdn of the DC into the server field does not work because the Fortigate does not resolve the name to an IP address (a DNS resolution failure).  Using the Ldp utility from my desktop I get a similar result, I can connect via LDAPS just fine if and only if I use the DC hostname/f

Hi, Someone with experience updating FortiMail devices, If the release notes of a version provide the following Upgrade Path:   Is it feasible to upgrade directly from version 7.2.5 to version 7.4.3, even if the specific step through version 7.2.5 is not mentioned in that Upgrade Path? I believe it is, because version 7.2.5 is higher than the 7.2.2 version specified there. Could you confirm this for me to be 100% sure, please? Thank you very much! Best regards.

Hello! I have a Windows server, as a Windows RRAS VPN server, connected to the fortigate's "internal" interface. No one on the same network is able to connect the VPN, which is to be expected. Everyone outside the office can connect to the VPN with no problems. The same firewall also has a guest VLAN, which has no access to the internal network, it only has one policy, to connect to the internet, and I'm trying to make the VPN work for computers on that VLAN. The computers are able to connect to the server, windows asks for credentials, and then drops. I've tried policies, Virtual IP's, port forward, but can't get it to work. Any help is much appreciated! Thank you!

Hi,  Recently we received multiple logs from a FortiGate appliance that are related to the "diag log test" command like the one below  date=2024-05-10 time=17:33:16 devname="firewall" devid="ID" eventtime= tz="" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="high" srcip=168.10.199.186 srccountry="United States" dstip=224.141.85.77 dstcountry="Reserved" srcintf="internal" srcintfrole="lan" dstintf="dmz" dstintfrole="undefined" sessionid=50000 action="detected" proto=6 service="HTTP" vrf=32 policyid=0 attack="test_attack" srcport=50000 dstport=80 hostname="host2" direction="N/A" attackid=32587 profile="sensor" ref="http://www.fortinet.com/ids/VID32587" user="user5" group="group1" incidentserialno=0 crscore=30 craction=8192 crlevel="high"  We checked the firewall and no admin account was logged in during the period of the events. Please note there are multiple events from Malware, Botenet, Filedownloads etc

I am a little bit lost here so any guidance is greatly appreciated. I am able to add the Fortigate-50G to our Fortimanager 7.6 but since the 50G only comes with version 7.0.17 firmware it gives errors when trying to push configs or policies.   I see the rejected commands in the log, and when I try them on the Fortigate CLI, it is clear they do not exist. I tried this under the default 7.6 ADOM, and also under a freshly created ADOM with the lowest possible value of 7.2.  I cannot create an ADOM with 7.0 so how is this supposed to work? Please advise.  Thanks. 

Hi,I have a problem with the RESTAPI to create a localuser on my Fortiauthenticator. When i use the expires_at field, i get automatically an error :Cannot add local user "toto" (Response: HTTP 400), Error: b'{"localusers": {"expires_at": ["Invalid time format. Time should be formatted using ISO-8601 (e.g. 2015-02-17T15:42:50.972335-08:00). If timezone is not given, time is assumed to be in UTC."]}}'I'd tried with many format (with and without timezone, miliseconds), i also tried with the example... Nothing at all.

Hi Team,Can anyone let me know how to check that when was taken last backup in Fortinet firewall. thanks 

Is there any way to assign static IPs for several users from SASE 

Hi guys, is it possible to enforce registration/isolation vlan  for the devices connected to the hub or unmanaged switch?All devices connected to the managed switches are working fine once i enforce to the isolation vlan and the captive portal is working fine but don't know about the hub. Thanks   

Hello FortiSIEM Community,I am planning to upgrade FortiSIEM to the 7.3.2 in an environment without internet access and considering the offline upgrade process. However, I noticed that one of the first steps requires downloading the FortiSIEM OS Repository and copying the script fsm-sync-os-repo.sh from a FortiSIEM 7.3.2 host.My concern is: Does this mean that an existing FortiSIEM 7.3.2 machine is mandatory to proceed with an offline upgrade? If we do not already have a 7.3.2 instance running, are there alternative ways to obtain the necessary files for an offline installation?If anyone has experience with this scenario or knows potential workarounds (such as setting up an offline repository server), I would appreciate any insights or guidance.Thanks in advance!Ref: Offline Installation and Upgrade | FortiSIEM 7.3.2 | Fortinet Document Library

Hello Team, i have two FGT-400F.when I configure HA in A-P mode I lose access to mgmt, or rather, I keep losing packets and sometimes I have response but then I lose them again.HA status seems ok from cli but secondary appears out-of-sync HA Health Status: OKModel: FortiGate-400FMode: HA A-PGroup: 0Debug: 0Cluster Uptime: 0 days 0:43:2Cluster state change time: 2025-05-05 15:12:06Primary selected using:<2025/05/05 15:12:06> FG4H0FTXXXXXXX is selected as the primary because it has the largest value of override priority.ses_pickup: enable, ses_pickup_delay=disableoverride: disableConfiguration Status:FG4H0FTXXXXXXX (updated 1 seconds ago): in-syncFG4H0FTYYYYYYY (updated 2 seconds ago): out-of-syncSystem Usage stats:FG4H0FTXXXXXXX (updated 1 seconds ago):sessions=11, average-cpu-user/nice/system/idle=0%/0%/1%/98%, memory=20%FG4H0FTYYYYYYY (updated 2 seconds ago):sessions=0, average-cpu-user/nice/system/idle=0%/0%/0%/99%, memory=19%HBDEV stats:FG4H0FTXXXXXXX (updated 1 seco

I have a Fortigate 40F. I have been trying for weeks to get DNS Filtering working. The basic setup is simple. When a user goes to a restricted site they do get redirected but the Block Page will not show up as there is a certificate error. (This is understandable since the Fortigate cert does not have the same name as the page the person is trying to go to). For Web Filtering the solution was to download, install and trust the default Fortigate cert. This works for Web Filtering but it does not work for DNS Filtering.I have Googled endlessly with no solution. I have a support case open with Fortinet. So far, they have not been able to provide a solution.If anyone can help with this, it would be much appreciated.

hi Let's say I have an SD-WAN rule based on the MANUAL strategy. This SD-WAN rule has two interfaces (WAN1 and WAN2), with WAN1 being the interface that was added first and therefore becomes the preferred interface for internet communication. If the WAN1 interface loses internet communication, will WAN2 be used? If so, how does Fortigate determine that WAN1 has lost internet communication and should use WAN2? Since with the Manual strategy it is not possible to select a Performance SLA.The final goal is to make all connections to a given destination IP on the Internet always go out through the WAN1 interface unless the WAN1 interface has lost communication with the Internet, in which case WAN2 can be used.

Hi every one.We use in my company the ForticlientVPN-only software. We use it to access the VPN of our customer. (link https://links.fortinet.com/forticlient/win/vpnagent)On 2 HP laptops, the installation of these software crashes, avec that sequence :- Installator downloads package -> OK- Installator extracts package -> OK- Then a window opens 0.5 sec and close immediately- Then nothing. The installation of the Forticlient licenced software works fine on theses two laptop. Do you have any clue ? Thank you in advance

I am trying to generate a CSR on the Fortigate and getting the message "etc/cert/local/root_"certname".key: Read-only file system".I have full super-admin permissions on the Fortigate. Has anyone seen this before?