Solved

Good day Team, Fortimail v7.4.1 I have a few entries (full email addresses) under IP Policy -> Inbound Session -> Lists -> Sender Blocklist checkingand indeed, it works, no more mails from those senders.  However, I am getting quite a few from same domain, how can someone in Fortimail block only the @domain.com portion of email addresses. Please show me the definite steps to complete this procedure. So far my Fortimail is working well, just a few domains I want to keep under control. Regards,

I am following this doc.https://docs.fortinet.com/document/fortinac-f/7.2.0/kvm-deployment-guide/31945 ./deploy_kvm <domain_name> 1- what is meant by "domain name" in this case?2 - Didn't know what that was so I just used "nac". After running the script, I got the following errors and cannot proceed../deploy_kvm: line 164: virsh: command not found./deploy_kvm: line 165: sudo: command not found Any ideas ?

HelloThe following doc shows that FortiLink is supported is this topology:FortiGate <---> FortiSwitch <---> 3rd party L2 switch <---> FortiSwitchhttps://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/801183 My question is more simple: is FortiLink supported in the following case?FortiGate <---> 3rd party L2 switch <---> FortiSwitch

I need to delete ima Interface, but I can't figure out how to do it? I want to remove it and put it in SEM_USO 

When I do the Fortigate ssl-vpn test, client failed to get gateway, but traffic flow is normalIs it okay if it's like this?IPv4 Add : 192.168.1.1Subnet : 255.255.255.255Default gateway : 

I have 2 Fortigate 201F set up with a tunnel and I'm seeing some strange traffic (mostly missing) from site A to site B.  Site A has 2 active WAN interfaces with the 2nd interface static DF route at a higher priority. My tunnel is assigned to the interface with the lower routing priority.  I'm not able to ping devices on Site B, yet I'm able to access the internal web interface of the Fortigate of Site B.Site B only has one WAN interface and I'm able to ping from devices within Site B to devices on Site A, but I'm not able to connect to NTP, DNS or LDAP from the Fortigate B to Site A.Both tunnels were created as custom pointing to the IP address of the outside interface of the opposite.  I have phase 2 selectors set for each of the VLANs from Site A and all show active.  Both sites are set with incoming/outgoing policies using the named tunnel and allowing ALL traffic and stated VLANs.Both sites have static routes set to use the tunnel interface for traffic.&nb

Hello team kindly helpi am configuring site-to-site IPSEC on fortimanager to push on fortigate but the i am confused where to confgure the IPsec?i have tried to my best on all platform1. on VPN Manager2. on IPsec Template3. on the device phase1 and phase 2 but after creating the vpn on all the 3 i can not see the VPN as the interface so that i can use on policy?PLASE HELP

Hello Community I am attempting to use the FortiOS API to apply a license. The device is a FortiWifi 80F with Firmware 7.2.6.I am attempting to apply the Advanced Malware Protection Free Trial, for testing purposes.From help with the Fortinet Developer Network I have seen this command:  curl -X 'POST' \ 'https://192.168.20.1/api/v2/monitor/registration/forticare/add-license?access_token=xp40rkkhqcbfyr8Nq96H9G7H43q0f4' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "registration_code": "STRING" }'  I am not sure what the registration_code value should be. I visited support.fortinet.com to gather the license key I wish to apply. It downloads as a .lic file. There is text in there but nothing matches the registration code. I have tried to insert the contract number as the string but this did not work.Where can I find the registration code?Am I using the wrong endpoint?Appreciate it

Hello FortiSIEM Community,I hope this message finds you well. I am planning to upgrade my FortiSIEMinstance from version 6.7.1 and would appreciate any guidance on the recommended upgrade path to the latest stable versionSpecifically, I am looking for:Recommended Upgrade Path: The sequence of versions to upgrade through from 6.7.1 to the latest recommended version.I have reviewed the available upgrade guides but could not find specific recommendations for upgrading from version 6.7.1. Any insights or experiences shared would be greatly appreciated. Thank you in advance for your assistance and support. Your expertise and experiences are invaluable to me.

Hello,I am starting to learn with FortiManager and when initially importing an existing FortiGate I get the following error: Retriving configuration file from FGT... Configuration file import succeeded. Reloading configuration file... Error: Configuration reload error. --------------------------------- Failure info: SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_group SELECT "##oid" FROM objcfg_fw_sched_group WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_onetime SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_group SELECT "##oid" FROM objcfg_fw_sched_group WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_onetime SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); >command(set firewall local-in-policy.1:intf SD-WAN-Inet) detail(datasr

Hi Fortinet Community, We're facing an issue where traffic shaping on our FortiGate device doesn't seem to be working as expected. Despite setting up the necessary configurations, no traffic appears to be shaped — the system always shows current-bandwidth=0(kbps) when monitoring shaping statistics. What We’ve Verified So Far:1. Class IDs are configured correctly.2. Traffic Shaping Profile is set up and active.3. Relevant Traffic Shaping Policy is in place.4. Interface outbound bandwidth is configured.5. Traffic Shaping Profile is applied to the correct interface.6. Ran "diagnose netlink interface list" command No matter what we try, shaping stats show zero usage:  Any help or insights would be greatly appreciated.Thanks in advance!

Hello. We are currently using FortiSwitches with FortiLink.In version 7.2.x, I understand that changing the FortiSwitch name does not affect active sessions. Recently, we upgraded all our devices (gate, switch, AP) to 7.4.x.We have about 20 switches in use.However, when we change a switch name from the gate, it appears that some other switches temporarily disconnect and reconnect. It also seems that active sessions are interrupted.Based on my research, it seems that when a managed switch is renamed, it is deauthorized and then rejoined, which causes all sessions to be dropped. As the switch reconnects, STP path recalculation occurs, so session drops or other switches disconnecting may be observed. Is this understanding correct?I referred to the following URI for this information:community.fortinet.com/t5/FortiGate/Technical-Tip-Unable-to-change-managed-FortiSwitch-name-after/ta-p/280009docs.fortinet.com/document/fortiswitch/7.4.0/fortilink-guide/59264/defining-names-for-managed-switche

Is it possible to configure a time-based administrator user access in FortiGate?For example: an administrative user must be able to login the firewall device from 9 am to 11 am. Beyond 11 am, the login access should be disabled 

Hello community, I am new to FortiSIEM, I want to build a rule to detect new devices in my network, I had the idea to create like a list containing MAC addresses and a rule to check each time if a mac is in that list if not it will trigger an incident and add the mac address to the list (if you are familiar with qradar it is like a reference set), the problem is I don't know if that is applicable also in FortiSIEM or there is another approach to solve the problem??? any idea is appreciated, thank you in advance.

Greetings community!We are now receiving events from the Kaspersky cloud in FortiSIEM, where the format is a "System Log", and it has the following structure, for example:<14>1 2025-04-15T12:50:06.047Z | - TEST_SIEM_CONNECTION [event@23668 et="TEST_SIEM_CONNECTION" etdn="Test Siem Connection"]<14>1 2025-04-15T01:34:49.000Z xxx_hostedinst_xxxxx.openstacklocal 1093|1.0.0.0 - KLAUD_EV_SERVERCONNECT [event@23668 p2="x.x.x.x" p3="2x\\xx" p5="x.x.x.x" p9="::1" et="KLAUD_EV_SERVERCONNECT" etdn="Audit (connection to the Administration Server)" hdn="<xxxx>" hip="x.x.x.x" gn="Managed devices" kscfqdn="xxx.openstacklocal"] User "2xxx" has connected to the Administration Server from "x.x.x.x".As a result, the events are arriving as "Unknow_events", precisely because there is no parser for this type of log. I created a new parser file at this first moment just to test the simplest events, for example: <14>1 2025-04-15T12:50:06.047Z | - TEST_SIEM_CONNECTION [event@23668 et="T

Dear Team,I have a question regarding the use of the Per-IP Shaper feature in traffic shaping on the FortiGate firewall.I configured a traffic shaper with a total shared bandwidth of 20 Mbps (Reverse enabled) for 10 users.Additionally, I applied a Per-IP shaper limit of 4 Mbps.My inquiry is:Does this configuration mean that all 10 users combined can consume up to 40 Mbps (i.e., 4 Mbps per user), or will the total bandwidth still be limited to 20 Mbps regardless of the Per-IP shaper setting?Looking forward to your clarification.

How can I set up an SSL VPN connection on an FGT60F v7.6.2.F? Unfortunately, I can't find this option in this FortiOS version.

Hi Everyone, We just bought a FortiSwitch 448E and when I tried to connect a LAN cable from my laptop to the FortiSwitch's MGNT port, it's giving my LAN port an IP of 169.254.200.221.  The label on the switch says the switch itself is supposed to be 192.168.1.99. I even tried to set my laptop's LAN port to a static IP of 192.168.1.10 and still can't access this switch's GUI. Any assistance is greatly appreciated. Thank you very much,Sonny

FortiClient EMS 7.4.1.1872FortiClient 7.2.9.1033 I have gone in to EMS -> Endpoint Profiles -> ZTNA Destinations.  Edited the ZTNA profile.  Disabled it.  Then re-enabled it and made sure the EYE was looking. This has been pushed out to my machine only.  However, in EMS when I find my endpoint I still see ZTNA enabled (hidden) under Features and my client is not showing the Destinations tab even after waiting minutes. What am I missing here????

Hi all,i have 3 branches with MPLS link to HQ and a DIA access.We have only one ISP that manages two different connections for every branch. The ISP give me the possibility to use the local internet connection as a DIA in every branch. The ISP manages the redundancy of MPLS and internet link between the two different connection they provide. I want to build an IPSEC tunnel over the MPLS for security reasons and use this also to route some particular internet traffic. In case this link goes down I need to route all the internet traffic through the DIA. I always need the possibility to use the DIA for other traffic. Branches does not need to talk each other. This is the network scheme. I only manage fortigates. Routers are managed by the ISP. I've coloured the path that i want to implement.  - Should I use SDWAN to manage that?- Do I need BGP?- How do i manage route changes and nat changes?  

Hello, My wireless clients do not receive an IP Address when connecting to a SSID.My Infrastructure is as follow;FortiGate 120G <fortilink> FortiSwitch FS-108F-FPOE <port1> FAP231 On the FortiSwitch port1 the native vlan is 5 and the allowed vlan are 30 and 40 On the FortiGate in the fortilink interface the vlan5 is configured with a subnet 192.168.5.32/27 and a DHCP server to provide management subnet for the FAP231 (this is working).On the fortilink I configured the vlan 30 without any IP or DHCP serverOn the fortilink I configured the vlan 40 with a subnet 192.168.40.0/24 with a DHCP server (192.168.40.10-192.168.40.250).In the SSID section I configured the SSID GUEST_30 in Tunnel mode, with a subnet 192.168.30.0/24 and a DHCP server (192.168.30.10-192.168.30.250) open authentication with a local captive portal, and the vlanid 30.In the SSID section I configured the SSID OFFICE_40 in Tunnel mode, without a subnet or DHCP server, WPA2 Personnal (will go to

Have few Fortigate devices (6.4.12) managed by Fortimanager (7.2.2) and have problem with packet capture in Fortimanager.Packet Capture is grayedAny suggestion why this option is not available in Fortimanager? Only solution is to make packet capture directly on device but then device will "out of sync".

I know Fortinet is doing away with SSL VPN.  I am close to moving off SSL VPN and going to Dialup IPSec VPN.  However, its taking a while due to issues I am working with support on.  At the same time I am trying to get my head around ZTNA and from what I have been reading ZTNA uses SSL VPN too but in a more secure way. Please tell me that ZTNA using SSL VPN is NOT going to be going away any time soon????  I am looking to use ZTNA so users can access internal websites on port 443, SSH to hosts, RDP to hosts.  I know there are different methods for each of these.  I just want to make I am not wasting my time by setting this up with ZTNA.

Hello Team, I'm facing a issue with update reord Step on playbook as mentioned on below log {"Error message": "\n Failed to create the record. The system administrator has defined a uniqueness constraint for the fields (typeofindicator, value) and a record already exists with the specified values for these fields! Note that the record might be in the recycle bin or not accessible to you. URL: https://localhost/api/3/indicators/5086526c-b0ee-44ad-810d-ab252ed73206 Call for URL: https://localhost/api/{"Error message": "\n Failed to create the record. The system administrator has defined a uniqueness constraint for the fields (typeofindicator, value) and a record already exists with the specified values for these fields! Note that the record might be in the recycle bin or not accessible to you. URL: https://localhost/api/3/indicators/5086526c-b0ee-44ad-810d-ab252ed73206 Call for URL: https://localhost/api/3/indicators/5086526c-b0ee-44ad-810d-ab252ed73206 failed with status code

Hello,I'm trying to create a new site to site vpn for a customer.Headquarter device is fortigate 80E, branch is fortigate 60F. There is already a site to site ipsec vpn between Head and Branch that is working internet provider's router at both site are not natted so fortigates route using public IP addresses.Now the customer has a new FWA faster connection at the branch and want to use this new for vpn to the HQ, but this connection has a router with firewall that we cannot disable and we cannot use a public IP address for WAN port of the branch fortigate.What are seeing connection from the HQ arriving at the branch on port 500, but when the branch sends out ike packet to HQ the branch fortigate shows error "network unreachble" Following an exaple of packet capture session 2025-04-11 16:40:01.021309 ike 0: comes 2.40.80.242:500->192.168.1.2:500,ifindex=6,vrf=0....2025-04-11 16:40:01.021384 ike 0: IKEv2 exchange=SA_INIT id=cdb44172569bf4cb/0000000000000000 len=5002025-04-11 16:4