Solved

Hi everyone, Does anyone know why there isn’t a Cybereason Antivirus product available for validation in the FortiNAC endpoint compliance scan? I managed to create a custom scan, which is working well, but now I need to validate either SentinelOne or Cybereason, and with Antivirus plus Custom scan I did not found a way to do this, because there is no OR between them, only AND. FortiNAC 7.2 

Hello everyone, I am currently a beginner on FortiSOAR and I have a ‘problem’, using an API to retrieve a lot of information, I have a little trouble processing on FortiSOAR unlike using a standard programming language. I'd like to process data like this:items : [0] : id : xx indicators : [0] : type : xxx [1] : type : xxx [1] : id : xx indicators : [0] : type : xxx [1] : type : xxx I can't figure out how to process each item as a unit firstthen process the indicators as a unit and then carry out other actions.Maybe the answer has already been given, but I couldn't find it. if anyone can help me that would be great news Best regards,

hi,just would like to confirm if my conversion below is correct?it's for NAT between two internal networks in our environment to reach the MGMT subnet 172.29.0.0/16.do i also use the "nat-source-vip enable" so the "mapped-ip" will be be used for SNAT in the reverse direction? interface Port-channel101.61 nameif outside security-level 0 ip address 172.20.248.78 255.255.255.248 interface Port-channel101.60 nameif inside security-level 100 ip address 172.20.248.70 255.255.255.248 object network obj-172.16.7.70 host 172.16.7.70 nat (outside,inside) static 172.20.32.1route outside 172.16.7.0 255.255.255.0 172.20.248.77 1route inside 172.20.0.0 255.255.0.0 172.20.248.69 1-----config firewall vipedit "vip-172.20.32.1"set extip 172.20.32.1set mappedip 172.16.7.70set extintf "po1.60"set nat-source-vip enableend config firewall security-policyedit "DNAT for 172.20.32.1"set srcintf "po1.60" set dstintf "po1.61"set srcaddr "any"set dstadd

Hi Guys, I just enrolled in to the course recently and i was given a task at work to try and connect to my firewall remotely and some of my clients are not connecting to the network due to insufficient IP's. Any suggestion? Rgards

Hi all,I'm hoping someone here has successfully been able to set this up and can give me some pointers.I'm running 6.0.4 on a 200E and need to allow Symantec LiveUpdate to run through the F/W.The updates work when I allow all traffic from DMZ -> WAN, so I know the Symantec software is installed fine. However, when I block internet traffic, allow DNS lookup to pass through as LiveUpdate uses FQDNs and follow the Symantec tech article to allow it through the firewall, it fails every time. The tech article in question can be found here: https://support.symantec.com/en_US/article.TECH102059.html I've done some packet tracing when all traffic is allowed and it looks like LiveUpdate has multiple CNAMEs returned from the DNS. Should these CNAMEs be added to the policy as allowed or should the firewall be able to deal with them? It's getting to the point where I'm considering setting up LiveUpdate to run once a day and to allow all traffic out to the internet for a 10 mi

I am looking for a bit of guidance on how to get captive portal access to resources working based on firewall policies on a Fortigate (currently running 7.2.x).  More specifically, I want to restrict management access to devices to authenticated users while allowing full access to the services running on those devices. For example, if I have users on Vlan 10 and Vlan 20 with Windows servers on Vlan 30 and Linux servers on Vlan 40, I would like to restrict RDP from Vlans 10 and 20 to Vlan 30 to only authenticated users while allow SMB through for everyone.  At the same time I would like to restrict RDP from Vlans 10 and 20 to Vlan 40 to only authenticated users while allowing HTTP and HTTPS through. Can anyone point me at a complete, end-to-end How-To on how I achieve this, including where the (FQDN) captive portal could/should sit, please?

Hello, I would like to setup configuration using one virtual IP to connect multiple internal IP/host. How can I do the setup? Model: FortiWeb 1000e with firmware 6.3.1-build1056  Thank You

I have 40 windows servers that perform unique functions and want ZTNA access to all of them. I guess there are a couple of different ways:1) Unique public IPs for ZTNA TCP Forwarding Server with the same external port being 3389, and internally mapped to the single server on 3389.. Easy, but takes up a lot of addresses.2) Same public IP for ZTNA TCP Forwarding Server, with unique external ports,  and internally mapped to the single server on 3389. Seems like a hassle for the end user to append a new port to and RDP session. Unless done using a SRV record in DNS with the unique port….. Does this sound correct ?Tom

Hi all,. I am having no luck finding these  link again I need FortiSIEM Linux and Windows Agents downloads the actual files not the guides or pdfs.   Thanks in advance. . 

Hi, I have question related to filters and policies, I know that I can deny or allow emails with encrypted PDFs, but I need to do this:Allow X account to always send encrypted PDFs to everyone, but if someone who received the PDF replies with the PDF attached then allow it too, but if someone sends in normal circumstances a encrypted PDF to X account then block it.Is it possible to create a rule or something like this?: If X account sends something to Z account, then X account now knows Z account, and then if Z accounts sends/replies with a encrypted PDF to X account then allow the message, but if X account does not know Z account and Z account sends encrypted PDF to X account then block it.Is it possible to do what I want to do?Thank you and I hope I'm not bothering you.

Hi all,  I have a FortiGate 100F series, and some devices are having internet, some are not, but all the configurations seem to be okay. Any suggestions?

I noticed a strange behavior to say the least, everything was working normally until about 4 days ago the incidents that were seen regarding events in MEA collectors stopped without explanation, that is, the initial screen that counts the incidents was reset from 4 days ago. I didn't notice anything out of the ordinary, the health of the cluster is ok, the events that the collector forwards to the supervisor continue to arrive, but for some reason the incidents don't appear, this is what is most confusing. I have already tried stopping and starting the collector, but the problem remains, and I believe that perhaps the problem is not with the collector, considering that events arrive, but the rules no longer transform them into incidents. Could anyone help me troubleshoot? I remain at your disposal to provide any additional information. Thanks

Hi Team, I need to know if it is possible to change the MTU on the ports of a Fortiswitch, I have been reviewing the config, and the only thing it allows me to change, is the MTU in: HOSTNAME # conf system interfaceHOSTNAME (interface) # edit internalHOSTNAME (internal) # set mtu-override enableHOSTNAME (internal) # set mtu 1600 HOSTNAME # config switch globalHOSTNAME (global) # set max-frame-size<integer> frame size between 68 and 10000 If I try it on the interfaces, I don't have the option to modify the MTU. HOSTNAME # config switch interfaceHOSTNAME (interface) # edit port1HOSTNAME (port1) # getname : port1description : (null)type : physicalnative-vlan : 1allowed-vlans :untagged-vlans :discard-mode : nonedhcp-snooping : untrusteddhcp-snoop-learning-limit-check: disabledhcp-snoop-option82-trust: disablearp-inspection-trust: untrusteddhcp-snoop-option82-override:stp-state : enabledstp-loop-protection : disabledstp-root-guard : disabledstp-bpdu-guard : di

Hello,     We are a mid-sized school in Pennsylvania, 4 buildings + admin, 3000 students etc. We are looking to replace a couple of 7+ year old SonicWall nsa 6600 devices with compairable Fortinet or PaloAlto devices, and I'm heavily leaning towards Fortinet because of a bad PaloAlto experence a number of years back at a different job. What is the suggested Fortinet hardware that would be compairable to the SonicWall 6600s that we have now? Currently we have dual fiber lines coming in from our primary ISP and a second fiber line coming into from a fall over ISP, All connections are currently registering as 1Gbps connections, although I'm checking with our Primary ISP if that is the true speed or just what our SonicWall is tapped out at. thanks in advance. 

I have FG 100 E, and I have it setupDHCP ServerAddress range 192.168.2.2-192.168.2.254Netmask 255.255.255.0is there something missing so that some devices sometimes can't get the IP address                                     Thanks.

Hello admins, Are there openings to become moderators in Fortinet forum?if so, would you please share details.Thank you

I am new to FortiClient EMS, I am installing and configuring at the moment. I can see that the FortiClient download URL is https://servername:1443/installers/ I am planning to configure IIS to run another website on port 1443.  Is there a way to change the FortiClient download URL to a different port? I am not sure if I can have 2 websites running on the same server with the same port.Please advice 

Hello all - new to Fortigate Central Nat and just wanted to run something by the community here.Looking to exempt NAT for a specific source and destination - while maintaining NAT\PAT to internet bound destinations for the same source. My questions are, can a "No NAT" rule be created\utilized in Central NAT, and how are the rules parsed\ matched ? Assume top-down correct? Here's an example of what I'm after - 3 interfaces on the firewall. I just want to NOT nat the Forti voice ip when the destination is the CCUM server ip. Can I create a rule with those sources and destinations and just turn NAT off -then create a rule below for everything else internet bound?  Thanks in advance all inside – outside – any – any – NAT\PAT  - to internet hosted –outside – Fortivoice IP – CCUM IPs– no NAT hosted – outside – any – any – NAT\PAT - to internet 

Good morning everyone.I need to configure an SMTP external to my administration on my FortiAuthenticator (v.6.6.2) to forward FortiTokens.I would like to use the Fortinet service "notification.fortinet.com" as SMTP, but I can't configure it to work.Can someone help me?Thanks.

Hi, I want to block custom files (bin, ova, ovf) on FortiProxy. I couldn't find these files in the file filter field. How can I block them? Has anyone done this? I would appreciate your support. Best Regards,İsmail Ürek

Dear Experts, When IPsec VPN at IPsec aggregation with SD-WAN is down, Trap fgTrapVpnTunDown(1.3.6.1.4.1.12356.101.2.0.302) is not sent,although "VPN tunnel down" is enabled at SNMP events.For information linkDown(2) of MIB 1.3.6.1.6.3.1.1.5 is sent. Can someone tell me how & what I should change so that fgTrapVpnTunDown is sent? Thanks in advance. 

Is it possible to make the Fortigate route traffic in this way:External dns pointing to fortigate public ip > fortigate external interface > route the traffic based on dns to a internal IP ONLY if it matches the requested dns?example using other dns names:google.com > 8.8.8.8 (fortigate external ip) > 192.168.1.200 (internal system) Essentially asking if the fortigate can serve the same purpose as a reverse proxy which checks source packets trying to match dns and redirect to a local server. I hope i explained in a understandable way and thanks in advance.

Hi, I have a problem with forticlient 7.2.2.0776 on Mac OS Sonoma 14.1.2.When I'm connected to forticlient for a specific customer, I can't access Internet at all (email, Teams, web browser...). However, when I log on to the same customer via forticlient on a Windows computer I don't have the problem. So it seems like an issue related to my Mac. But what is strange is that I have another customer who uses forticlient and when I log on to that customer on the same Mac, I have access to internet, so it doesn't seems related to my Mac after all. I'm very confused and don't know where the restriction is- Is it something that I should do on my Mac (but if yes why it's working for another customer on the same mac?)- Is it something that the admins of my customer should do on their side (if yes, do you know what they should do?) RegardsYoan.

Hello everyone,I’m planning a new installation for FortiNAC and I’m trying to decide between FortiNAC 9.4 or FortiNAC-F 7.6. I’m not entirely sure about the key differences between the two versions and which one would be the best fit for my needs.Could someone please explain the differences between FortiNAC 9.4 and FortiNAC-F 7.6? Specifically:What are the feature differences?Are there any performance or scalability considerations?Which one is more suitable for a medium to large enterprise environment?Additionally, if anyone has experience with configuring either of these solutions, I would greatly appreciate any tips, best practices, or even a step-by-step guide to help me get started.NB: my licence is : FortiNAC Control and Application Extended VM Certificate (FNC-CAX-VM for 2 VMs)(LIC-FNAC-PRO-100)Thank you for your help!Best regards,

Hi, We are planning on rolling out a handful of Fortigates 90G - currently we have 3 setup in a non-production environment. We are receiving a TLS link between some sites and other sites will use ADVPN Hub\Spoke with SD-WAN and dual ISP. The VPN part is working fine and so I've removed those links for the time being.  For the TLS we have 2VLANs on our hub FortiGate (200,300) setup under port3.  Our PC connected to the main Fortigate can each all other Fortigates. The other PCs connected to the other Fortigate can reach the hub but cannot each the Fortigate at the other end. The reason looks like BGP is not interesting the route into the routing table. As it is the only path to the destination, I am not sure why and am clearly missing something.  Willing to post any config that will help. Here are screen captures of what I'm referring to. The first one is the main Fortigate where the trunks for the TLS from our ISP will come in and the second one is th