Solved

The goal is split multiple JSON events sent in a batch into separate events. Going through the docs available to me, I've gotten to this - <patternDefinitions> <pattern name="patSplitEventsFromAkamai"><![CDATA[\{.*]]></pattern> </patternDefinitions> <eventFormatRecognizer><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,]]></eventFormatRecognizer> <parsingInstructions> <switch> <case> <!-- Individual event format, process like normal --> <collectFieldsByRegex src="$_rawmsg"> <regex><![CDATA[\[PH_DEV_MON_CUSTOM_JSON\]:\[reptVendor\]=Akamai,\[reptModel\]=Cloud%20Control,\[json\]=<_json:patSplitEventsFromAkamai>]]></regex> </collectFieldsByRegex> <when test="exist _json"> <collectAndSetAttrByJSON src="$json"> <attrKeyMap attr="format" key="format"/> <attrKeyMap attr="version" key="version"/> <attrKeyMap attr="eve

I have a FortiGate 70F running 7.4.7 and I'm trying to set up a DNS server on it to resolve some internal server host names.  The system DNS is pointing to the FortGuard DNS servers.  I am using FortiSwitches connected via FortiLink for clients on multiple VLANs.  I enabled DNS Servers in Feature Visibility to add that option and noticed that it already had an entry for the fortilink interface set to Forward to System DNS, and a DNS Database entry for fortiswitch set to Primary/Shadow that has 5 entries, one for each of my FortiSwitches.  I did not make any of these, so this is apparently done automatically when you install a FortiSwitch.  I am trying to get clients on the Lab VLAN to resolve host names for 3 servers in our environment.  I went through the steps to add a new DNS Database using Primary/Shadow and added 'A' and 'PTR' records and a domain name for the 3 servers on our internal network.  I saved this and then added a '

Hi, I'd like to share with all of you a python script to perform full FortiGate config backups. It started as a simple automation for my work two years ago and has become a hobby. Along with today's new release i decided to do this post and maybe help some of you who do this task often. As i no longer have access to an appliance, my tests are done with a FortigateVM. Feel free to try out this tool and share your thougs here. All suggestions, comments and feedbacks are welcome. It requires Python 3.8+ and support FortiOS 6.x and 7.x versions. https://github.com/mcarneir0/fortigate-backup-api 

I'm very new to networking, and I'm a bit over my head. The current situation is we have two firewalls (Firewall 1 and Firewall 2) and two different WANs (VDOM Prod = 1.2.3.4/32, VDOM Nonprod =5.6.7.8/32) on physical ports on Firewall 1. There are no WAN connections are Firewall 2, so when there's a failover, we lose connection to the outside.  My end goal is to have a physical port on each that can support both VDOM WANs without adding more physical WAN drops to the greater network. So, here is my concept:Firewall 1:Physical Port-1 1.2.3.4/32 (Prod VDOM)   VLAN 5.6.7.8/32 (NonProd VDOM)Firewall 2Physical Port 2 5.6.7.8/32 (NonProd VDOM)   VLAN 1.2.3.4/32 (Prod VDOM)Is this a feasible solution? Should I make the connection identical?  Thank you for your time. 

Hello,on Fortigate 100F how I can monitor the PSU state without execute a commenad in a shell? When a PSU is disconnected the system LED should be amber?I tried to disconnect one of the PSU and I not have any alarms from the hardware led and also in the GUI. Thank you.

Hello, So i have a problem and cant solve without some help. We have two Fortigates, Main office (Site A) and the new one (Site B). I connected them by IPsec tunnel, with ph2 address 0.0.0.0/0 to both sides. Tunnel is up and working fine, but now i want to route two local subnets  of SiteB to go to internet over SiteA. and other subnets go to internet from local WAN. Topology: 10.20.1.0/24 -> SiteB FTG ->IPsec Tunnel->SiteA FTG->Internet10.20.2.0/24 -> SiteB FTG ->IPsec Tunnel->SiteA FTG->Internet10.99.99.0/24 -> SiteB FTG ->Internet I am trying to use policy routes but its not working or i am doing something wrong. Any help would be nice. 

Hi all, I have setup a new Fortigate 1101E cluster with FortiOS 6.2.10. Now I'm trying to configure radius authentication for administrators but when I try to set as source-ip the IP of the MGMT interface I get this error: x.x.x.x is not valid source ip.node_check_object fail! for source-ip x.x.x.x value parse error before '10.119.254.120'Command fail. Return code -8 What am I doing wrong? Thanks,M. 

Dear All,We are having following issue ClickHouseServer service on the worker is currently down, and no incidents or events are being ingested.Could someone help me to solve this issue ?  What could be the possible reasons for it ?@Anthony_E @Secusaurus   please help  

Hi Everyone! Would like to ask if anyone had experience connecting a breakout cable LC to Fortigate 200FThe breakout Cable in question is the HPE/Aruba K2Q46A MPO to 4 LC.This will be connected on an Aruba Switch using JH233A MPO Qsfp+ so the LC side will be on the Fortinet using a fortinet 10GBase-SR  Sfp+ transciever FTLX8574D3BCLFTN.Would this work having the Aruba switch do the splitting to 4x 10G per breakout cable? Your thoughts on this is much appreciated. Thanks 

Need to shift traffic on MPLS when Packet loss & latency has been increased.Currently when both the link get down traffic is being shifted but we want to shift the traffic when packet loss & latency has been increased.

I have already enable radius on fortigate and fortinac and then the connection is successiful.But when guestusers authenticate from wireless NAC radius log  show like as below i have attached   

I create web filtering name Block_Social_Media and apply for all user in Vlan4, but I want to whitelist a few IP address of this Vlan4 to access Social Media. How to config that in FortiGate?

Hi all, Have a Fortigate 81F running 7.0.17. I note that some CVE's such as FG-IR-23-293 and FG-IR-24-250 are listed as being vulnerable on all 7.0 versions. Is it likely that the 7.0 firmware will never get these fixed and we should move to 7.2? thanksJC

Hi,I'm trying to use SSL VPN web mode on a FortiGate 60F running v7.4.8 build2795 (Mature). This has worked before and has stopped working without changing the config. Is anyone else experiencing simular issues?Thanks -- Screen when browsing to WebVPN --First screen after browsing to webvpn-- Screen after pressing OK --login screen after pressing 'ok' on first screen-- Browser network log --browser network logFortigate diagnose log:2025-06-02 11:56:23 [403:root:b]req: / 2025-06-02 11:56:23 [403:root:b]mza: 0x358f360 /rmt_index.html 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path failed /migadmin/rmt_index.html, /data/migadmin, /migadmin 2025-06-02 11:56:23 [403:root:b]sslvpn_zip_handler:136 sslvpn check path failed. 2025-06-02 11:56:23 [403:root:b]req: /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]mza: 0x358f3a8 /sslvpn/css/ssl_style.css 2025-06-02 11:56:23 [403:root:b]fsv_check_path_passed:997 No access: check path faile

Dear　Team I upgraded Fortigate v6.0.X to v7.0.11 according to the upgrade path.After update We cannot call park with sip server. We are using only FW policy for IP telphone . we do not use Voip profile . I think that fortigate was changed default value v6 to v7. but I cannot find the information.Could you have any infomation. 

Hello All, I'm configuring FortiSIEM 7.3.0, but some of the use cases aren't clear to me, and I kindly request some advice about whether the following use cases are possible to configure and display on the FortiSIEM dashboard. if so, please give advice, or does it need some other solution to be integrated as a source? Insider Threat & Lateral MovementEnable detection of unusual user activity (e.g., access to sensitive data). Correlate logins from multiple locations within a short time frame. Flag mass file downloads from internal systems. Vulnerability scan and\ assesment Identify the Vulnerability of the assets Regularly Test Security Systems & ProcessesDetect failed or overdue security scans. Alert on new vulnerabilities detected in PCI systems. Track & Monitor All Access to Network Resources & Cardholder DataEnable File Integrity Monitoring (FIM) for critical cardholder files. Configure correlation rules for unauthorized d

We need to migrate our internal network from the Fortigate ethernet port to one of the fiber ports in order to get the 5Gbps subscribed in FortiGate 600E model, what are the basic check we need to perform to check if it is supported and is there's any documentation I can follow for this configuration.

Hello,  our "Vulnerability Scanner" detected that libcurl.dll as vulnerable to CVE-2025-0167Vulnerable files are:C:\Program Files\Fortinet\FortiClient\libcurl.dllC:\Program Files\Fortinet\FortiClient\x86\libcurl.dllWe use free FortiClient VPN SSL, so we can't confirm if full paid version is vulnerable too.We've upgraded to FortiClient VPN SSL 7.4.3, but libcurl.dll version is still vulnerable 

Hello community, I tried many ways to configure IPsec vpn to access only a specific subnet, but all have failed.Can you guide to how to configure such connection. Thank you!

Hello Team,We have deployed the FortiGate Firewall-201G in HA (Active-Passive) mode. Due to port limitations, we have connected a FortiSwitch (model 148F) to each firewall. These switches are managed through the firewalls.Currently, we are facing an issue: only the FortiSwitch connected to the primary firewall is coming online. However, we want both switches (connected to the primary and secondary firewalls) to stay online.Additionally, while the firewalls are in HA mode and have failover configured, the switches do not have any failover setup. This means if one switch goes down, traffic cannot switch over to the secondary switch, which creates a single point of failure.We have tried using crossover connections and the FortiLink split interface feature, but were not successful. We also noticed that the MC-LAG option is not available on the FortiSwitch 148F.Could you please advise on the best way to configure failover for both FortiSwitches connected to the primary and secondary firewal

I had tried to setup VPN connection. Using the latest version client and firewall. In windows During the login time it shows"VPN Server may be unreachable (-14) " . Status shows 80% complete. BUT it works in ANDROID..!!! Anyone resolved this ?  

I have a, maybe silly question but maybe someone can answer me.. We have FAC setup with RADIUS clients in a 10.10.0.0/16 subnet, mainly used towards switches for MAB. The thing is we want to configure VPN for a firewall with an IP in the same subnet. Is it possible to configure this as a /32 without it being affected in the /16 subnet policy?

Hello, I am trying to setup a FortiAuthenticator policy for Wireless dot1x. The authentication works but RADIUS attributes (vlan and ACL) is not pushed to client.Here is what I have tested; Added the Remote LDAPCreated a User Group which retrieves user via LDAP Filter (not via imported users).Created a Realm for LDAP UsersCreated a Policy that:WLC as RADIUS ClientAuthentication Type Password/OTP (PEAP and EAP-MSCHAPv2)Identity Source - username@realm - Points to LDAP Realm, uses Windows AD Domain Auth and filters on the groupAuthentication Factors - Password Only and Windows AD computer authentication I have tested with User Group pointed to imported users and remote user sync rule but that does not work either.Does anyone have any idea? I checked the debug logs but cannot find anything interested. Also we havetested this with a local group (MAB) and it works fine.

If use lacp-mode static because the peer equipment does not support lacp, it seems similar to use h/w switch or s/w switch instead of LAG. What's the difference between Fortigate's lacp-mode static and h/w & s/w switch?

Hello to all,I’m trying to build a single spoke hub & spoke (Dual hub) topology using the overlay template provided by FMG 7.6.3.The architecture is formed by 2 VM fortigate hubs in 7.4.6 and an onprem A/S pair that acts as spoke in 7.4.6.Full internet topology, each hub has only one link while the spoke has 2.All the tunnels are UP, and HUB side I see the advertisement in BGP of the test subnet that I’m using onprem side (192.168.99.0/24). The BGP advertisement has something strange, I would have expected to see the VPNs as next-hop interfaces, instead it uses directly the port 1 (outside of the hub) used by the underlay.I noticed that the templates created by FMG do not assign an IP on the HUB interface tunnels, I don’t know if this is an error.From the hub loopback (172.16.5.252) I can successfully ping the spoke’s Lo (172.16.5.1).