Solved

Hello everyone,I'm currently working on my final year project, which involves Fortinet products, including FortiSIEM, as well as routers, switches, and endpoints.I would like to understand more about FortiSIEM's capabilities when it comes to responding to security incidents. I have seen that FortiSIEM has remediation features, but I was told it doesn't support fully automated actions in response to security events.Can FortiSIEM take automated actions similar to what an EDR or SOAR solution would do? For example, is it possible to:Quarantine an endpoint?Block a malicious IP address?Kill a malicious process?Isolate a machine from the network?Or is FortiSIEM primarily focused on collecting logs and generating alerts, without taking direct action on network devices and endpoints automatically?Any clarification or guidance on this would be greatly appreciated. Thank you!

I'm having some problems that are affecting the normal operation of the workers. Some evidence is below: The first of them is related to the Shared Store: "Readers phRuleWorker pos 99.9969% more than 15% behind of Writer" and Event Pipeline: "Worker Upload Queue greater than 75MB". The latter I believe is a consequence of the first.When analyzing the health of the Worker VM, the highlighted backend errors are in the image below, I highlight the large amount of counts for PH_PARSER_FILE_STAT_FAILURE and PH_EVT_HANDLER_ERR and PH_HTTP_CLIENT_CURL_ERROR, with the respective phParser, phEventHandler and phRuleWorker processes. Performing a check on the phoenix.log file for the three types of errors described above, we have:We currently use Clickhouse in our cluster, and we have 2 workers. Both Workers are having this issue in the Shared Store.

I need to generate a Web Filter report and also Application Control, I'm going through an audit he wants it on paper

Hi Team, I am currently facing an issue where I am unable to log in with any account created on FortiWeb. It consistently displays "Incorrect credentials." Since no "prof_admin" account is being accepted, I would like to recover the admin password without using a "prof_admin" account. I have already tried the "maintainer" method, but it was unsuccessful.Could you please assist me with this?  Thank you.

Hello All,I'm facing an issue with the IBM X-Force Connector. I receive the following error when using the IP reputation feature: HTTPSConnectionPool(host='api.xforce.ibmcloud.com', port=443): Max retries exceeded with URL: /ipr/history/185.213.164.197 (Caused by NewConnectionError('<urllib3.connection.HTTPSConnection object at 0x7f66510dd9a0>: Failed to establish a new connection: [Errno -2] Name or service not known'))

Dear Concern, I want to set a limit on a specific SSL-VPN user so that this user can establish multiple connections at the same time. For example, User A should be able to establish SSL-VPN connections from two different laptops at a time using FortiClient. If I configure it via GUI: VPN > SSL-VPN Portals, edit the SSL-VPN Portal, and enable "Limit Users to One SSL-VPN Connection at a Time", this restriction applies to all users, preventing multiple connections for everyone. However, I want to remove this restriction only for a specific user while keeping it enabled for others.How can I achieve this? Please share the configuration steps. Waiting for your valuable response.

In sdwan enviroment with one hub and multiple spokes, in which side the sdwan sla should be configure? In the hub or in every spoke?

Hi, Right now using on login for our standalone FortiSwitches and wanted to setup LDAP for authentication. FortiSwitch_148F-FPOE, V7.2.9. Can't see an article on this but saw on that say it is not supported, however, that was 2023.  Thanks 

Hi there, I am in charge of introducing FortiPAM in our Windows domain environment to manage log and secure the access to our servers.Testing things out I have created some users, groups, targets and secrets (mostly on the same target). Clearing out some of my tests I ran into a problem: Secret Z with ID=1 gave the answer "Failed to delete some of the secrets or folders" (I can click the delete button). I tried to delete everything that could be related to it. The situation now is following:  In my personal Folder and in the secrets folder I can see the entry for the secret Z. I have owner permissions on it. In Targets there is only the asociated Target also called Z. The delete button for this is grey and can not be clicked (obviousliy because there is an dependent objekt). I thought I could solve my problem with deleting the secret entry in the "secret database" via cli-command but the answer is this:"SRV-FPA # config secret databaseSRV-FPA (database) # get==

New FortiGate admin here. I'm looking to enable web-admin on the WAN ports, but only allow access from specific IP addresses. I've created the address objects, but am not seeing how to configure a firewall policy. There would (obviously) be no outgoing interface.I can see a couple of suggestions coming, so to avoid those...I'd rather not have to use a VPN just for remote admin access.Also, configuring "trusted hosts" for specific users still exposes the admin ports to the entire internet, which is an all-around bad idea.So, a firewall policy should be the way to go...Any help would be appreciated!

Hey everyone Thanks in advance for any help you can provide. I recently upgraded my company's FortiAnalyzer (FAZ) to 7.6.2, and a custom VPN connection/disconnection report used by my manager has broken. While the report is custom, it was originally based on a Fortinet employee’s article. After logging a support case, I was informed that because this is a custom report, I need to resolve the issue myself. What I’ve Found So FarI found a Reddit post where another user experienced similar issues after the FAZ backend switched from PostgreSQL to ClickHouse.I followed the Fortinet ClickHouse migration documentation and updated my SQL query accordingly.The data appears correctly when previewing the dataset, and it also shows up in chart previews.However, when I generate the report, it comes out blank with the message::police_car_light:"No matching log data for this report"My Current SQL Query SELECT`user` AS "User",(CASEWHEN `action` = 'tunnel-up' THEN 'Co

I have a computer that was sent an invite from the EMS system that was able to go through the set-up process and appears in my system. Today, when the user tried to connect to a VPN they see "Unlicensed VPN access is available until *insert a date here*" (they can still connect to whatever VPN they were attempting). When I access EMS, the device is showing Not Managed by EMS and Not Registered. Please advise on how to handle this. Extra Info:- I have several open spots in my licensing.- According to the Log Viewer, the device was unregistered this morning. 

 Greetings everyone, I am opening this case because I have set up a virtual lab with a FortiManager that manages three FortiGates, ALL with TRIAL licenses. The entire lab is virtual, using the following versions:FMG_VM64_KVM-v7.6.1.M-build3344-FORTINET.out.kvmFGT_VM64_KVM-v7.6.2.F-build3462-FORTINET.out.kvmThe FortiGates are registered using the following command in FortiManager: config sys global     set fgfm-peercert-withoutsn enableend  The IssueAfter registering the devices, the problem arises when pushing configurations or policies to the FortiGate, as it always results in an error. As shown in the images below: Install OK / Verify FAILWhen expanding the error message from the FortiManager UI:  Checking the Install Log reveals that the issue occurs because FortiManager attempts to modify (delete) the WebFilter profile "monitor-all", as shown in the following image:  CLI Test on FortiGateThe issue is that FortiGa

Hello everyone! I'm having some problems to redistribute bgp routes learned from another part of the network. The routes learned Hub to hub works fine on the hubs, however in the spokes, the routes learned from the other part are pointing to WAN interfaces, not the overlays.  I've created the topology inside GNS3 to test pre-production:I'm using the same AS with iBGP and next-hop-self-rr on the hub to hub overlay neighbor configuration.   Hub routing table: Spoke routing table: Any ideas?

We've got some development that's going on in Azure which makes a call to our internal servers.  I've got the "source" inbound rule pointing to a VIP and restricted to traffic coming from *.azure-api.net*.microsoft.com*.slope.ioThe problem is with something like apimanagement-cors-proxy-prd.azure-api.net depending on what IP that resolves to, the firewall may or may not allow traffic coming from that URL.  As I understand it from FortiNet support, this is "expected" behavior.  IE if the firewall has resolved apimanagement-cors-proxy-prd.azure-api.net to be 13.91.254.72 and the traffic is coming from 13.91.254.72, then the traffic will be allowed in.  However if traffic coming from apimanagement-cors-proxy-prd.azure-api.net is coming from 20.121.82.216 and the firewall hasn't resolved 20.121.82.216 as a valid IP for apimanagement-cors-proxy-prd.azure-api.net then the traffic won't be allowed in.  The only other option would be to allow Azure

Hello,We are trying to adjust the threshold for the Fortigate DOS IPv4 L4 anomalies rule because it triggers too many incidents on our FortiSIEM.The issue is that it is hard to know how far the threshold (5000 pps in our case) is overtaken.The raw log, as sent by the FW to the FortiSIEM is the following: <185>logver=702101706 timestamp=1741353017 devname="*redacted*" devid="*redacted*" vd="root" date=2025-03-07 time=13:10:17 eventtime=1741371017400546868 tz="-0500" logid="0720018432" type="utm" subtype="anomaly" eventtype="anomaly" level="alert" severity="critical" srcip=*redacted* srccountry="Reserved" dstip=*redacted* dstcountry="Reserved" srcintf="VLAN35" srcintfrole="lan" sessionid=0 action="detected" proto=17 service="udp-53" count=13 attack="udp_dst_session" srcport=57032 dstport=53 attackid=285212775 policyid=3 policytype="DoS-policy" ref="http://www.fortinet.com/ids/VID285212775" msg="anomaly: udp_dst_session, 5001 > threshold 5000, repeats 13 times" crscore=50 cr

I did a simple exercise where I connected the two PCs to the physical FortiGate (to port1 and port2). Then I created a rule where I set the incoming traffic to port1 and outgoing traffic to port2 (with all other parameters set to 'all'). I also created another rule to permit the reverse traffic. However, all traffic is being denied due to the implicit deny rule. Does anyone have a suggestion regarding this configuration? I can ping the FortiGate from the PCs. The FortiGate is not registered yet (I did the same configuration in VMware Workstation with the FortiGate running on a VM, and it worked).

Hello, FortiGate-100E # diag sys ntp statussynchronized: no, ntpsync: enabled, server-mode: enabledipv4 server(192.168.0.61) 192.168.0.61 -- unreachable(0x0) S:7 T:684no data I have the following issue: I have activated NTP on a FortiGate 100E. Unfortunately, I do not have a WAN interface configured on the interfaces, and I cannot assign an external IP address directly to the device. I want to extend the NTP address to the firewall through a tunnel, so the access is open. The access is open, and I can ping it from different interfaces that I have configured under "listen on interfaces."However, it still cannot synchronize and has a 2-minute delay. What could be the cause of this issue? What should I check first, and if possible, could you provide a solution? #FortiGate #NTP #System_Settings

Hello Team, now I have a cluster of FGT 500E with five vdom that manage via FortiManager. I need migrate all configurations of FGT 500E on a new cluster FGT 400F. Now on FGT 400F i have configured only the management interface. what is the best way to migrate configurations? Configure the new cluster locally and then hook it up to the fortimanager or the other way around? Thanks for the supportBR

Hello I have a question: when using SDWAN rules with Maximize Bandwidth (SLA) or Best Quality strategies, what happens to sessions already started on an Internet link that no longer meets SLA requirements? Are these sessions terminated by Fortigate or do they remain on the low-performance link until they are formally terminated by the application?

I'm looking for configuration example on the FortiAP to solve this use case.  Client connects to an Open SSID, gets an IP from FortiNAC's registration interface. It is then directed to FortiNAC registration portal. Once the user is authenticated, NAC policy is applied and the Wifi vlan is changed to allow access. On the "Main" SSID interface, should there be any IP address ?Should Captive Portal be enabled with the external IP of NAC's registration interface ?Would you have two SSID "subinterfaces", one for each the registration vlan and guest access vlan ? Or just one for the guest access vlan. Any example configs or guide on the AP side would be much appreciated. I believe I have what I need on the NAC side.Don    

Greetings...  I have a FortiGate 60F in a building that is central to three legs of a campus, south, west and north. Mounted on south, west and north exterior/outdoor walls of the central building are three FortiAP 234F units providing WiFi to each leg as noted. Some recent renovations have left the signal poor at the end of each leg inside buildings, so we have purchased three more FortiAP 234Fs and plan to turn the existing WiFi network to a Mesh Wireless Network and are curious as to the best route we should go to configure this. Currently, all three APs are directly wired to the FortiGate and use the same SSID to make connecting and roaming the campus seamless. Each leg will have two FortiAP 234F units, a total of six on campus, one direct wired connection to FortiGate as noted and one mounted at end of each leg to provide stronger signal. Is it best to set up each leg as its own Mesh Wireless Network with its own SSID, or can all six units use one, si

Hi Team, I have several Fortiswitches managed via Fortilink, and I need to configure snmpv3 with one Read and one Read/Write user. This configuration must be done from Fortigate? Can you provide me the steps to follow to perform this configuration. Thanks and best regards,Juanmi

hi all,I have a SD-WAN performance SLA with two participant interface, I want to view the history curve in FortiAnalyzer but one of the participant interface is not there.however, another SLA with the same interface have the interface displayed in FortiAnalyzer.what could be the reason and how to fix it?1. SLA 2. SLA in fortianalyzer with all participants (OL_INET_SKO_112 and port17)3. SLA in fortianalyzer with only one participant (OL_INET_SKO_112)

We were working w/ Lumen on getting Fortinet SD Wan setup. We currently have Meraki and Firepower FIrewalls sitting behind a pass through port on versas, but when switching to the exact same setup on Fortinet, a lot of traffic was dropping. Mainly UDP because thats what meraki was complaining about. Is there something the Lumen tech was missing that would cause this to happen?