Solved

All my user with the same installer profile have a status unreachable profil today.

fortigate in headquarter and switch and fortiap in the branch office connected in VPN is it possible to connect them to the fortigate? Are they managed by the fortigate? can I address them at the IP level? how do I do it? keep in mind that the VPN based (91fgt) while in the shops there are mikrotik all connected in IPSEC.I attached the PHOTO

HiI have a Fortigate 91G and created an IPSEC site to site tunnel to a firewall of an external partner with preshared key (I think Cisco Firewall but info is not disclosed). The tunnel drops from time to time - there is no pattern why. It reconnects immediately but the session for users is lost and they need to turn off and on their LAN / VPN connection to be able to reconnect to the partner's systems. I checked the configuration multiple time and it's exactly the same as the partner uses (IKEv2, preshared key, Phase1: SHA256, AES256, Diffie-Hellman 14, Key-Lifetime 43200, Phase2 Lifetime: 3600s).I tried turning on and off the Phase2 Auto-negotiate and Auto Key Keepalive options but the tunnel keeps going down. I can't really tell why it goes down because I don't see anything in the logs - maybe I am looking at the wrong place. I can tell that this is only happening during work time, the tunnel is stable outside of working hours.

Guys I'm trying to block access via FTP but I'm not succeeding I'm following this https://docs.fortinet.com/document/fortiweb/7.6.2/administration-guide/398215/creating-an-ftp-command-restriction-rule someone could give me a light

 Hello everyone, I have a problem now, my fortiSIEM system can't upload data at present, then I go to see the ERROR log through tail -f /opt/phoenix/log/phoenix.log, fm, and there is an error in the following figure, I want to ask anyone if anyone knows where the problem is? How can I troubleshoot or resolve errors?

Is FortiNAC able to change VLANs on a hypervisor's vswitches - WMWare, Proxmox, Citrix Xen, etc ?FortiNAC 

I have an unusual problem. When I went to add a rest api user I noticed that I am missing options for "REST API Admin" and "SSO Admin". I can only create create system administrators. I have a mix of hundreds of 7.2 and 7.4 systems in my network. This is the only device running 7.2.11 so I dont know if it is specifically for that version. And I cannot downgrade without getting an approved maintenance window.I tried using the CLI as well...I cannot type in config system api-user sso-admin... those are missing from the CLI.  

Hello,I deploy a Fortigate Next-Generation Firewall through the Azure Marketplace. After a short period of time, I noticed that the 30-day free evaluation wasn't being applied, but instead, I was charged directly according to the cost management. Can anyone tell me why? Did I do something wrong during the creation process?  The PAYG costs are displayed in cost management under Fortinet FortiGate-VM: ARM64 (PAYG) 2023. Thanks for your responses.

Is it possible to Buy a license for a used fortigate bought from Ebay? Thanks

Hello everyone,I'm currently working on my final year project, which involves Fortinet products, including FortiSIEM, as well as routers, switches, and endpoints.I would like to understand more about FortiSIEM's capabilities when it comes to responding to security incidents. I have seen that FortiSIEM has remediation features, but I was told it doesn't support fully automated actions in response to security events.Can FortiSIEM take automated actions similar to what an EDR or SOAR solution would do? For example, is it possible to:Quarantine an endpoint?Block a malicious IP address?Kill a malicious process?Isolate a machine from the network?Or is FortiSIEM primarily focused on collecting logs and generating alerts, without taking direct action on network devices and endpoints automatically?Any clarification or guidance on this would be greatly appreciated. Thank you!

I'm having some problems that are affecting the normal operation of the workers. Some evidence is below: The first of them is related to the Shared Store: "Readers phRuleWorker pos 99.9969% more than 15% behind of Writer" and Event Pipeline: "Worker Upload Queue greater than 75MB". The latter I believe is a consequence of the first.When analyzing the health of the Worker VM, the highlighted backend errors are in the image below, I highlight the large amount of counts for PH_PARSER_FILE_STAT_FAILURE and PH_EVT_HANDLER_ERR and PH_HTTP_CLIENT_CURL_ERROR, with the respective phParser, phEventHandler and phRuleWorker processes. Performing a check on the phoenix.log file for the three types of errors described above, we have:We currently use Clickhouse in our cluster, and we have 2 workers. Both Workers are having this issue in the Shared Store.

I need to generate a Web Filter report and also Application Control, I'm going through an audit he wants it on paper

Hi Team, I am currently facing an issue where I am unable to log in with any account created on FortiWeb. It consistently displays "Incorrect credentials." Since no "prof_admin" account is being accepted, I would like to recover the admin password without using a "prof_admin" account. I have already tried the "maintainer" method, but it was unsuccessful.Could you please assist me with this?  Thank you.

Hello All,I'm facing an issue with the IBM X-Force Connector. I receive the following error when using the IP reputation feature: HTTPSConnectionPool(host='api.xforce.ibmcloud.com', port=443): Max retries exceeded with URL: /ipr/history/185.213.164.197 (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f66510dd9a0>: Failed to establish a new connection: [Errno -2] Name or service not known'))

Dear Concern, I want to set a limit on a specific SSL-VPN user so that this user can establish multiple connections at the same time. For example, User A should be able to establish SSL-VPN connections from two different laptops at a time using FortiClient. If I configure it via GUI: VPN > SSL-VPN Portals, edit the SSL-VPN Portal, and enable "Limit Users to One SSL-VPN Connection at a Time", this restriction applies to all users, preventing multiple connections for everyone. However, I want to remove this restriction only for a specific user while keeping it enabled for others.How can I achieve this? Please share the configuration steps. Waiting for your valuable response.

In sdwan enviroment with one hub and multiple spokes, in which side the sdwan sla should be configure? In the hub or in every spoke?

Hi, Right now using on login for our standalone FortiSwitches and wanted to setup LDAP for authentication. FortiSwitch_148F-FPOE, V7.2.9. Can't see an article on this but saw on that say it is not supported, however, that was 2023.  Thanks 

Hi there, I am in charge of introducing FortiPAM in our Windows domain environment to manage log and secure the access to our servers.Testing things out I have created some users, groups, targets and secrets (mostly on the same target). Clearing out some of my tests I ran into a problem: Secret Z with ID=1 gave the answer "Failed to delete some of the secrets or folders" (I can click the delete button). I tried to delete everything that could be related to it. The situation now is following:  In my personal Folder and in the secrets folder I can see the entry for the secret Z. I have owner permissions on it. In Targets there is only the asociated Target also called Z. The delete button for this is grey and can not be clicked (obviousliy because there is an dependent objekt). I thought I could solve my problem with deleting the secret entry in the "secret database" via cli-command but the answer is this:"SRV-FPA # config secret databaseSRV-FPA (database) # get==

New FortiGate admin here. I'm looking to enable web-admin on the WAN ports, but only allow access from specific IP addresses. I've created the address objects, but am not seeing how to configure a firewall policy. There would (obviously) be no outgoing interface.I can see a couple of suggestions coming, so to avoid those...I'd rather not have to use a VPN just for remote admin access.Also, configuring "trusted hosts" for specific users still exposes the admin ports to the entire internet, which is an all-around bad idea.So, a firewall policy should be the way to go...Any help would be appreciated!

Hey everyone Thanks in advance for any help you can provide. I recently upgraded my company's FortiAnalyzer (FAZ) to 7.6.2, and a custom VPN connection/disconnection report used by my manager has broken. While the report is custom, it was originally based on a Fortinet employee’s article. After logging a support case, I was informed that because this is a custom report, I need to resolve the issue myself. What I’ve Found So FarI found a Reddit post where another user experienced similar issues after the FAZ backend switched from PostgreSQL to ClickHouse.I followed the Fortinet ClickHouse migration documentation and updated my SQL query accordingly.The data appears correctly when previewing the dataset, and it also shows up in chart previews.However, when I generate the report, it comes out blank with the message::police_car_light:"No matching log data for this report"My Current SQL Query SELECT`user` AS "User",(CASEWHEN `action` = 'tunnel-up' THEN 'Co

I have a computer that was sent an invite from the EMS system that was able to go through the set-up process and appears in my system. Today, when the user tried to connect to a VPN they see "Unlicensed VPN access is available until *insert a date here*" (they can still connect to whatever VPN they were attempting). When I access EMS, the device is showing Not Managed by EMS and Not Registered. Please advise on how to handle this. Extra Info:- I have several open spots in my licensing.- According to the Log Viewer, the device was unregistered this morning. 

 Greetings everyone, I am opening this case because I have set up a virtual lab with a FortiManager that manages three FortiGates, ALL with TRIAL licenses. The entire lab is virtual, using the following versions:FMG_VM64_KVM-v7.6.1.M-build3344-FORTINET.out.kvmFGT_VM64_KVM-v7.6.2.F-build3462-FORTINET.out.kvmThe FortiGates are registered using the following command in FortiManager: config sys global     set fgfm-peercert-withoutsn enableend  The IssueAfter registering the devices, the problem arises when pushing configurations or policies to the FortiGate, as it always results in an error. As shown in the images below: Install OK / Verify FAILWhen expanding the error message from the FortiManager UI:  Checking the Install Log reveals that the issue occurs because FortiManager attempts to modify (delete) the WebFilter profile "monitor-all", as shown in the following image:  CLI Test on FortiGateThe issue is that FortiGa

Hello everyone! I'm having some problems to redistribute bgp routes learned from another part of the network. The routes learned Hub to hub works fine on the hubs, however in the spokes, the routes learned from the other part are pointing to WAN interfaces, not the overlays.  I've created the topology inside GNS3 to test pre-production:I'm using the same AS with iBGP and next-hop-self-rr on the hub to hub overlay neighbor configuration.   Hub routing table: Spoke routing table: Any ideas?

We've got some development that's going on in Azure which makes a call to our internal servers.  I've got the "source" inbound rule pointing to a VIP and restricted to traffic coming from *.azure-api.net*.microsoft.com*.slope.ioThe problem is with something like apimanagement-cors-proxy-prd.azure-api.net depending on what IP that resolves to, the firewall may or may not allow traffic coming from that URL.  As I understand it from FortiNet support, this is "expected" behavior.  IE if the firewall has resolved apimanagement-cors-proxy-prd.azure-api.net to be 13.91.254.72 and the traffic is coming from 13.91.254.72, then the traffic will be allowed in.  However if traffic coming from apimanagement-cors-proxy-prd.azure-api.net is coming from 20.121.82.216 and the firewall hasn't resolved 20.121.82.216 as a valid IP for apimanagement-cors-proxy-prd.azure-api.net then the traffic won't be allowed in.  The only other option would be to allow Azure

Hello,We are trying to adjust the threshold for the Fortigate DOS IPv4 L4 anomalies rule because it triggers too many incidents on our FortiSIEM.The issue is that it is hard to know how far the threshold (5000 pps in our case) is overtaken.The raw log, as sent by the FW to the FortiSIEM is the following: <185>logver=702101706 timestamp=1741353017 devname="*redacted*" devid="*redacted*" vd="root" date=2025-03-07 time=13:10:17 eventtime=1741371017400546868 tz="-0500" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" severity="critical" srcip=*redacted* srccountry="Reserved" dstip=*redacted* dstcountry="Reserved" srcintf="VLAN35" srcintfrole="lan" sessionid=0 action="detected" proto=17 service="udp-53" count=13 attack="udp_dst_session" srcport=57032 dstport=53 attackid=285212775 policyid=3 policytype="DoS-policy" ref="http://www.fortinet.com/ids/VID285212775" msg="anomaly: udp_dst_session, 5001 > threshold 5000, repeats 13 times" crscore=50 cr