Solved

Hello,Is there a way to see in Fortigate how much bandwidth (Mbps)is consuming an internal user?I recall before in fortiview it showed this but now (FortiOS 7.4) I can not see it. Only shows traffic in Bytes (MB). thank you.Regards.

I have been struggling with forticlient on Opensuse Tumbleweed. It worked fine until last week but now, after a zypper dup, (I did others before and there were no issues) I can't establish the connection anymore. Even trying boot across previous system snapshot, it doesn't work. I use a SAML integrated VPN and it authenticates successfully just before the client dropping the connection. Can anyone help me to fix this?    20241203 16:50:09.950 TZ=-0300 [sslvpn:INFO] main:1817 Init 20241203 16:50:09.951 TZ=-0300 [sslvpn:INFO] main:622 Load profile: BLN 20241203 16:50:09.952 TZ=-0300 [sslvpn:DEBG] main:631 Inherit local DNS: No 20241203 16:50:09.952 TZ=-0300 [sslvpn:DEBG] main:644 DNS service resetting interval: 0 20241203 16:50:09.952 TZ=-0300 [sslvpn:INFO] main:329 Get DBUS session bus address 20241203 16:50:09.954 TZ=-0300 [sslvpn:DEBG] main:333 Failed to find DBUS session bus address in dbus-daemon, try to find in dbus-broker 20241203 16:50:09.955 TZ=-0300 [sslvpn:

My site https://zarashigal.eu.org/ Is static html, hosted on GitHub pages and has no Phishing. Would you please show me where the phishing risk is on my personal site? And if not, please delist it. - Many thanks and Respect,Zarashigal

I have VLAN with IP 192.168.100.0/24 and over IPSec network with IP 192.168.100.0./22.Local users on another VLAN 10.60.18.0/23 need to access the network over IPSec and do not need to access the local network. Current situation is that users are able to access the IPSec network except those IPs that are overlapping with local IP. In other words, users are able to access IP range from 192.168.101.x, 192.168.102.x etc, but are not able to access 192.168.100.x, which because I believe because of the presence of local VLAN, despite having proper firewall policy and static routing.Any idea how to resolve this?

What are the IPs and ports need to open from private network for access SASE from FortiClient which protected by Firewall.

We configure Microsoft Entra ID SSO with FortiSASE support of Configuring FortiSASE with Entra ID SSO in FortiClient agent-based mode document. But we have faced error as below. Searching for solution... 

Hi!I'm struggling with CLI template in FortiManager right now. I must delete all dhcp servers and I made script where I use purge command, but the problem  is, it gets stuck there. There is prompt where user must press y to confirm what you are doing, but I cant make it work in the script. When i copy that script manually to FortiGate then it works.I read from other posts that few people got it work when they used \ny after purge command or added y below the command or right before end command "yend". All these ways didn't work for me. I also tried both CLI and JINJA template

Haven't really looked at this for a solution, but I have a question, I want to create a Global Header Policy, and push to 10 FortiGates in an ADOM,  seems straight forward, apart from I want to create my own normalised interface in the Global ADOM , called "WAN-GLOBAL"  and select devices to map there repsective interfaces (some are wan,wan1, port1 etc)  but you cant do this.  You can only map interfaces from devices in the ADOM, thats pointless, as I cant then use a normalised interface in the Global Header, as it cant map to anything?  is it just a name in the GLOBAL HEADER? as long as its called the same there, and in the ADOM mapped interface?

My observation:Secure Boot is a general control intended for the configuration review of firewalls. We are using a customized image during firmware updates, which makes this option not mandatory. You can either provide this justification to close the finding or, if feasible, implement the control using the attached reference  https://docs.fortinet.com/document/fortigate/7.4.0/new-features/249947/enhance-bios-level-signature-and-file-integrity-checkingWhat is the relevance of changing the security level to 1 and how we can do this?

Hello  after active ZTNA in FORTIPAMi have a messge error from gui access ,help me pleaseAccess DeniedThe page you requested has been blocked by PAM policy restriction.Invalid ZTNA client certificate  

Hi all, I would like to know until which date it would be possible to take the FCSS SDWAN in version 7.2 ?Where can I get this information ?In the Fortinet Institute, the courses I took are now archived and I'm following the courses in version 7.4 but in  the Pearson Vue Portal, I don't find it in version 7.4, only 7.2 version is available for the SDWAN certification...Other question, I'm looking for any others sources that Fortinet Institute, for this certification, book, vidéo etc...Do you have a best seller to advice me ?Many thanksRegards

Hello everyone,I would like to know if you can tell me the EOL and EOSL dates for the FortiAP FP221E.I couldn’t find this information in the datasheet.Thank you.

Hi,We are migrating from AnyConnect to FortiClient and encountering many problems. Currently, a RADIUS server (NPS) is being used, which passes Cisco RADIUS attributes such as IP address, subnet mask, and a dynamic ACL (DAC) for each user.For each user created in Active Directory, a static IP is assigned, the RADIUS profile to use is specified, and the corresponding ACL policies are created on the ASA.On the Fortigate side, I have configured the RADIUS servers and set up the entire SSL portal. Since the IP is passed statically, I found a guide that suggested setting "set ip-mode user-group" under the portal.I also created the corresponding ACL that allows from SSL VPN to any, but as soon as the MFA notification arrives with Duo, I get permission denied (error -455) and the process stops at 43%.Does anyone have any suggestions?I've tried everything but can't solve it.Below is the configuration. config vpn ssl web portaledit "RADIUS1_PORTAL"   <---- my 1st portalset tun

Hi, FortiManager Version - v7.4.6 build9266 (Mature), ADOM - 7.4FortiGate-40F-3G4G - v7.4.7,build2731 (GA) (Mature)FortiSwitch-108E-POE - v7.4.5-build880,241127 (GA) Just trying to build a little lab setup using the kit above. When creating a VLAN (FortiSwitch Manager > FortSwitch VLANs), I am able to create the VLAN without issue and apply the VLAN to the switch using a template. The VLAN shows up on the FortiGate and all looks good.  The issue is when I enable DHCP on the VLAN. When attempting to save the config I get the error message: -  Copy device global objectsCopy objects for vdom root Commit failed:error -999 - TCL error(missing operand at _@_in expression "(24<<24)+(_@_<<16)+(<<8)+") namespace import global::cli_ip2valset startip_str [cli_get_value $CLI_CUR_NODE "" "" "start-ip"]set endip_str [cli_get_value $CLI_CUR_NODE "" "" "end-ip"]set id [cli_get_value $CLI_CUR_NODE "" "" "id"]set startip [cli_ip

All my user with the same installer profile have a status unreachable profil today.

fortigate in headquarter and switch and fortiap in the branch office connected in VPN is it possible to connect them to the fortigate? Are they managed by the fortigate? can I address them at the IP level? how do I do it? keep in mind that the VPN based (91fgt) while in the shops there are mikrotik all connected in IPSEC.I attached the PHOTO

HiI have a Fortigate 91G and created an IPSEC site to site tunnel to a firewall of an external partner with preshared key (I think Cisco Firewall but info is not disclosed). The tunnel drops from time to time - there is no pattern why. It reconnects immediately but the session for users is lost and they need to turn off and on their LAN / VPN connection to be able to reconnect to the partner's systems. I checked the configuration multiple time and it's exactly the same as the partner uses (IKEv2, preshared key, Phase1: SHA256, AES256, Diffie-Hellman 14, Key-Lifetime 43200, Phase2 Lifetime: 3600s).I tried turning on and off the Phase2 Auto-negotiate and Auto Key Keepalive options but the tunnel keeps going down. I can't really tell why it goes down because I don't see anything in the logs - maybe I am looking at the wrong place. I can tell that this is only happening during work time, the tunnel is stable outside of working hours.

Guys I'm trying to block access via FTP but I'm not succeeding I'm following this https://docs.fortinet.com/document/fortiweb/7.6.2/administration-guide/398215/creating-an-ftp-command-restriction-rule someone could give me a light

 Hello everyone, I have a problem now, my fortiSIEM system can't upload data at present, then I go to see the ERROR log through tail -f /opt/phoenix/log/phoenix.log, fm, and there is an error in the following figure, I want to ask anyone if anyone knows where the problem is? How can I troubleshoot or resolve errors?

Is FortiNAC able to change VLANs on a hypervisor's vswitches - WMWare, Proxmox, Citrix Xen, etc ?FortiNAC 

I have an unusual problem. When I went to add a rest api user I noticed that I am missing options for "REST API Admin" and "SSO Admin". I can only create create system administrators. I have a mix of hundreds of 7.2 and 7.4 systems in my network. This is the only device running 7.2.11 so I dont know if it is specifically for that version. And I cannot downgrade without getting an approved maintenance window.I tried using the CLI as well...I cannot type in config system api-user sso-admin... those are missing from the CLI.  

Hello,I deploy a Fortigate Next-Generation Firewall through the Azure Marketplace. After a short period of time, I noticed that the 30-day free evaluation wasn't being applied, but instead, I was charged directly according to the cost management. Can anyone tell me why? Did I do something wrong during the creation process?  The PAYG costs are displayed in cost management under Fortinet FortiGate-VM: ARM64 (PAYG) 2023. Thanks for your responses.

Is it possible to Buy a license for a used fortigate bought from Ebay? Thanks

Hello everyone,I'm currently working on my final year project, which involves Fortinet products, including FortiSIEM, as well as routers, switches, and endpoints.I would like to understand more about FortiSIEM's capabilities when it comes to responding to security incidents. I have seen that FortiSIEM has remediation features, but I was told it doesn't support fully automated actions in response to security events.Can FortiSIEM take automated actions similar to what an EDR or SOAR solution would do? For example, is it possible to:Quarantine an endpoint?Block a malicious IP address?Kill a malicious process?Isolate a machine from the network?Or is FortiSIEM primarily focused on collecting logs and generating alerts, without taking direct action on network devices and endpoints automatically?Any clarification or guidance on this would be greatly appreciated. Thank you!

I'm having some problems that are affecting the normal operation of the workers. Some evidence is below: The first of them is related to the Shared Store: "Readers phRuleWorker pos 99.9969% more than 15% behind of Writer" and Event Pipeline: "Worker Upload Queue greater than 75MB". The latter I believe is a consequence of the first.When analyzing the health of the Worker VM, the highlighted backend errors are in the image below, I highlight the large amount of counts for PH_PARSER_FILE_STAT_FAILURE and PH_EVT_HANDLER_ERR and PH_HTTP_CLIENT_CURL_ERROR, with the respective phParser, phEventHandler and phRuleWorker processes. Performing a check on the phoenix.log file for the three types of errors described above, we have:We currently use Clickhouse in our cluster, and we have 2 workers. Both Workers are having this issue in the Shared Store.