Solved

Hi, We have two firewalls located in different locations: Firewall A and Firewall B. Both setups include an L3 device positioned between the LAN and the firewall. In Firewall A, the relevant subnet appears as directly connected, whereas in Firewall B, the subnet is marked as statically connected. This indicates that in the Firewall B setup, the switch acts as the gateway, causing the firewall to receive the MAC address of the L3 device instead of the end-user device. However, in the Firewall A network, even with the L3 setup, the firewall acts as the gateway for the subnet, enabling it to detect actual client MAC addresses and enforce MAC-based policies. Consequently, MAC-based policies do not function in the Firewall B setup because the L3 device serves as the gateway. In contrast, these policies work in the Firewall A setup, where the firewall directly receives the MAC addresses of the client devices.  FortiGate 

I generated a CSR on one of my Fortigate firewalls that contained over 10 SAN's entries, the certificate was signed by my internal company CA, I then imported the PEM into the Fortigate firewall successfully to use for HTTPS access, then by mistake I deleted the Certificate off the firewall instead of downloading the cert! My signed PEM file doesn't have a private key, I have a PCKS#7 cert, der and cer from my PKI team. But I do not have the private key anymore is my guess after deleting my imported signed Cert on the Fortigate. On another SAN Firewall where I need to install I import any of these signed cert formats, error is "duplicate mismatch" I gather because the signed cert doesn't have the private key and I should be downloading the imported cert from the Fortigate that imported the signed cert where the CSR was generated to the other Firewalls! Any there any way I can install these signed certs on my SANs Firewalls or do I need to generate another CSR again?&nbsp

I like to generate a weekly report that includes any active FortiGate-Policy filtered by some keywords in their name.I'm able to query them from $log-traffic, but obviously this gets only the policies with traffic.Is there a table that includes the configured policies regardless of them having traffic or not?

Hi , I'm Currently facing an issue with My Fortinac-VM i already Download the new version 9.4.7 but when i press install it's sending me to the page to start the download when i press it nothing happen any suggestion  

Hello,I have to go through the "Automatic Patch Upgrades" wizard each time I connect to my FortiGate. I am using version 7.4.6 of FortiOS.Does anyone know the solution to this problem?

Hello,I would like to inquire about the automatic update management for FortiManager that is integrated with FortiGate and the Security Fabric.Could you please provide information on how automatic updates are handled in this setup?As far as I know, when a FortiGate is connected to a FortiManager, the FortiGate shows that automatic updates are enabled, and because it is managed by the FortiManager, the option to disable automatic updates is not available on the FortiGate.So, does this mean that automatic updates are not actually performed on FortiGates that are managed by FortiManager?I would like to perform updates manually when I want, and I do not want automatic updates to be applied.Is there anything that needs to be configured separately on the FortiManager side? Thaks all.

Hello, I have been search the posts here and I am seeing a few different replies to this.Can some one please clarify the reason for this error? One suggests Adding the ip hostname of supervisor to  /etc/hosts. Is that all that has to be done?   I still get the error when I select to down load to the client, does some DNS cache need to be cleared or something?  Another suggests In some of these cases we will need to see the error from the Collectors side. There are 2 locations for collector upgrade logs to find out why the collector failed : /usr/local/upgrade/logs/ansible.log /opt/phoenix/log/collector-upgrade.log  we will need to see why Your have 3 options 1- Spin up a new collector in the customers environment with the build that we need This will bypass the upgrade all together and just spin up a new collector and provision it as the same hostname and IP as the old one 2- A

FortiClient 7.4.3.1736 has no reaction after set username, password and click on Connect. In forticlient-logs/confighandler.log are messages as:20250428 16:00:13.520 TZ=+0200 [confighandler:EROR] decorators:52 Failed to send message to fortitray: runtime directory not found20250428 16:00:13.644 TZ=+0200 [confighandler:EROR] decorators:52 Failed to send message to fortitray: runtime directory not found20250428 16:00:30.087 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:00:31.506 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:00:57.295 TZ=+0200 [confighandler:EROR] antivirus:49 Failed to get total quarantine entry count: i/o error: No such file or directory (os error 2)20250428 16:01:01.375 TZ=+0200 [confighandler:EROR] about:105 Failed to get icdb metadata: i/o error: No such file or directory (os error 2)20250428 16:01:29.

Hi, just wanted to point out an spelling Error in the second image of the guide from this link:https://docs.fortinet.com/document/fortiextender/7.6.0/admin-guide-fgt-managed/201700 The image shows a FortiGate with the description ForitGate. This has been the way since 7.0.0 till 7.6.0. Version 7.6.1 uses a new image without the spelling error.Old:New:   

I opened a ticket on this but maybe this will be faster...  I am running FortiClient 7.2.4.0850 on a MAC runing macOS 14.5.  But I also have a need to run CloudFlare WARP once a week.  But the logs for WARP show that the ztagent is running and that port 53 has been redirected to the Fnet app. I do not currently have ZTNA setup at all in FortiClient.  But regardless, there must be a way to shut down the client fully for a short time so I can run WARP for a few hours a week.  When I do try to shutdown the forticlient processes they auto restart on my MAC. Does anyone know if there is a way to kill them off for a few hours then manually start them up?  And yes I am connected to an EMS. 

Try to config ZTNA Shortcuts on SASE end point already integrated with Entra ID. Need clarify  config user samledit "saml_ztna"set cert "Fortinet_CA_SSL"set entity-id "https://fgt9.myqalab.local:7831/samlap"set single-sign-on-url "https://fgt9.myqalab.local:7831/XX/YY/ZZ/saml/login/"set single-logout-url "https://fgt9.myqalab.local:7831/XX/YY/ZZ/saml/logout/"set idp-entity-id "http://MYQALAB.LOCAL/adfs/services/trust"set idp-single-sign-on-url "https://myqalab.local/adfs/ls"set idp-single-logout-url "https://myqalab.local/adfs/ls"set idp-cert "REMOTE_Cert_4"set digest-method sha256set adfs-claim enableset user-claim-type upnset group-claim-type group-sidnextend The entity-id single-sign-on and single-logout URLs from SASE and  idp URLs from SMAL authenticator ( In My case it's Entra ID )  i follow below guidelines https://docs.fortinet.com/document/fortisase/latest/spa-using-ztna-deployment-guide/976373/configuring-authen

Hi FortiSIEM Community,I have a question regarding the requirements for High Availability (HA) and Disaster Recovery (DR) setups in FortiSIEMMultiple Instances Requirement: Is it correct that both HA and DR require more than one FortiSIEM instance? Specifically, can HA or DR be configured with just a single FortiSIEM instance, or do they both necessitate multiple instances?Thank you for your assistance!

When I tested it through FortiVPN with a Windows 10 laptop, it worked fine, but when I tested it through FortiClient with a Windows 11 laptop, it didn't work.It is the same environment except that Windows 11 laptop has EMS interworking as FortiClient.What is the problem? 

I can't add any FGTs to my FMG within Eve-NG, debugs are showing it to be a SN issue, found several post to do below, but I don't seem to have that option on 7.4.6 The fix is to disable cert check:FMG-VM64-KVM # config system global(global)# set fgfm-peercert-withoutsn enable Any help would be greatly appreciated? Thanks

Hi everyone.I would like to display antivirus log in my Fortigate F60 (OS 7.2.11).In the forum I've noticied that I have to set the value "av-virus-log" to enable.In the CLI, I've edited the profile and I've entered the command "set av-virus-log enable".But there is no impact, when I want to show the different value of my profile, the value does'nt exist.Have you an idea ?Thank you in advance  

Hello everybody,regarding ZTNA, we found a bug after yesterday Forticlient EMS 7.2.5 upgrade.This is happening only on macOS devices.We have a ZTNA destination profile:On Windows device, rule are correctly retrivied. But, on macOS, I can see no destination (I have all the tags I need):Debbuging this problem, I was looking at the Forticlient ztna.logs, and I found (I removed some rules for simplification): 2024-10-11T16:24:28.238 TZ=+0200 info ztna mergeCfg:{"enabled":1,"rules":[{"name":"EMS","mode":"transparent","enabled":0,"destination":"10.1.0.217:3389","gateway":"ztna.ntditalia.com:13389","encryption":1,"local_port":"7788","type":"private"},{"name":"VMAgostini","mode":"transparent","enabled":0,"destination":"10.1.0.215:3389","gateway":"ztna.ntditalia.com:13389","encryption":1,"local_port":"7788","type":"private"}],"portals":null,"gateways":null,"notify_on_error":1,"portals_enabled":1,"gateways_enabled":1}2024-10-11T16:24:57.148 TZ=+0200 info ztna sync portal select portal err:e

Hi Team,Is there a way to enable Interface Pair View on a FortiGate 121G without removing the existing policies? From what I’ve found, it seems that enabling this option via CLI may result in the deletion of current policies.I’d appreciate any guidance that would allow this without impacting the existing configuration.

Hello FortiSIEM Community,I have a couple of questions regarding the upgrade process to FortiSIEM version 7.3.2 Where can we download the upgrade package "FSM_Upgrade_All_7.3.2_build0374.zip"?I understand this package is required for the upgrade, but I would appreciate guidance on the exact location or steps to download it.Upgrade Process Clarification:The Fortinet documentation mentions that the Supervisor and Worker nodes should use the same package for the upgrade. Does this mean that once we upgrade the Supervisor, Worker, the entire FortiSIEM system will automatically be upgraded to version 7.3.2?Ref: Upgrading to FortiSIEM 7.3.x | FortiSIEM 7.3.2 | Fortinet Document Library Thank you in advance for your assistance and insights!

Hello,I have a request regarding license renewal.I’ve received two new Contract Registration Codes for renewing licenses — one for a FortiGate and one for a FortiSwitch device.These devices were already licensed previously, and now I need to renew them.As I understand it, for FortiGate, the process is:System → FortiGuard → Enter Registration CodeIs that correct?As for the FortiSwitch, it is managed through the FortiGate.How should I apply the license in this case?Do I need to register it separately, or is it handled via the FortiGate interface?I would appreciate your guidance on the correct steps.Thank you in advance!

Hi everyone, I have a question regarding how FortiGate handles override of blocked categories in Web Filtering. Let me explain my setup:I have Web Filtering enabled with a custom profile where the "Streaming Media and Download" category is set to block. The goal is to allow certain users to override the block and access specific sites within that category after authentication.To do this, I enabled "Override blocked categories" and assigned the built-in monitor-all profile. Inside this monitor-all profile, I kept "Streaming Media and Download" set to block, but I also configured a URL Filter exception, where I added a wildcard like *youtube.com and set the action to "exempt".The expected behavior is:When a user tries to access YouTube, the override page should appear.The user logs in with credentials.Due to the URL Filter exemption, access to YouTube is allowed.All other sites under the "Streaming Media and Download" category remain blocked.However, this doesn’t seem to work as intended

 hello,i have problem with my vpn ipsec i tried to connect to vpn but i have error during phase 2   and on wireshark i'm stuck at here same on forticlient log,  i have no idea why config :same auth-encryption for vpn settings and client good selectors for phase 2 ( src and dest addresses  ) why quick mode failed ? i can share log from CLI thanks 

Hello, I have 2 FortiGate VMs that I want to configure HA in Active-passive mode. I immediately lost GUI access when I applied the HA configuration to the first VM. The same thing happened to the second FortiGate VM.For context, both VMs are deployed on vSphere and are connected to the same port group.Does anyone know why this happens and how I can resolve this problem?

Hello Fortinet Community,  We have configured an Incident Notification in FortiSIEM to send email alerts when incidents occur. • Test emails (via the “Send Test Email” option) work correctly and are being received. • However, when a real incident is triggered, no email is received. • Email server settings are valid, as test emails are successfully sent.  The issue appears to be specific to incident-triggered email alerts. We kindly request your assistance in identifying and resolving this issue.  Best Regards, İsmail Ürek FortiSIEM 

Hi,We have FortiMail and trying restrict outgoing email to a few addresses only in an external domain, let's say to user1@abc.com and user2@abc.com  and block off everything else to that domain. I have created 2 Recipient Policy with Recipient Pattern, first policy with all the email addresses, and then second policy with wildcard *@abc.com, then enabled Content profile and set max size to 10 and also 102400, Action to Reject.I can see the second policy is able to catch non whitelisted address as expected, but still accept and send those emails and not reject them. Any idea why or better method to implement this?   

Hi, Syslog functionality was operating correctly when a single VDOM was in use. However, after enabling multi-VDOM, the syslog configuration now appears exclusively in the Global VDOM mode, making it applicable only to the Global VDOM. In the root VDOM, where all policies, VPN tunnels, and other configurations are present, it is not possible to configure syslog. Attempts to use the "config log syslogd settings" command in the root VDOM were unsuccessful, as the term "syslogd" is not recognized. We are currently running version 7.4.7v. To forward logs, each VDOM needs to have its own separate syslog configuration.