Solved

hi,i'm trying to build a new FW policy and wondered if i just build a single custom service object with all the required ports added, i.e. TCP 80, TCP 443, TCP 8080 or create a service group and add the individual service objects.1. would there be a difference if i used a single service object vs a service group in the FW policy?2. what's the recommended or considered "best practice" in FGT FW policy?3. what are the pros and cons between the two approach? 

I've followed some of the most posted protocols for preventing brute force on my vpn interface, biggest was to only allow US based traffic to the interface, but what I've found in the last coupld of years, is that all the open VPN environments in the US are used by threat actors constantly.  I'm up to about 3000 failed login attempts in 6 hours time.  This is just US based IP's and when I look them up, the bulk of them are associated to open VPN providers IN the US. I was doing some searching to see if there are geo lists of these open vpn providers that I could import.  I've been manually digging up the blocks and doing ASN/Whois lookups to piece it together.  I get it down to about 200 / 6 hours, but then in a couple of weeks, shoots back up to the 1K's of hits.  Anyone have suggestions?  Again, this is US only attacks at this point.

Hello, we are currently running our Fortigates on FortiOS 7.0.13 and want to upgrade them as the version is coming out of support in next few months. we first considered 7.2.10 (7.2.11 now) but Fortinet recently changed their recommanded version to 7.4.7 for our models. Reviewing the release notes, I noticed this known issue :  1069208If the DHCP offer contains padding when DHCP relay is used, the DHCP relay deletes the padding before relaying the packet. From what I understand on various internet sources, removing padding from DHCP packets could be an issue for certain devices that could no more get an IP. I found nothing specific for Fortigate setup however. This is a major issue for us as our main Fortigate is used as a DHCP relay, and it is the only one so we cannot test it before. I was curious if someone encountered DHCP issues on 7.4.7 ?

Hello Gentlemen, I want to redirect thehttps://exmple.com/entohttps://example.com/en/product-category/audio-visualhow can I do that with fortiWeb using URL writing in simple way? I need the correct steps Thank you 

Greetings all I have an interesting issue on a FortiGate 40F, with OS 7.0.18 (soon to be upgraded to 7.2, then 7.4.7, to see if that solves the issue). I have done BGP routing before without issues, but over MPLS lines between FortiSwitch ports. In this case we have dual, redundant, IPsec VPN connections over a single WAN interface The IPsec's run fine, and both Pri and Sec are up. Then there are the BGP links, which I created via a BGP loopback interface, with primary IP 172.26.200.21 (just did the secondary link first) and secondary IP 172.26.200.1. The BGP links are also running fine, with packets processing, and both advertised and received routes visible on both sides of the VPN.BGP Pri: 172.26.200.1 (Mine) <> 172.26.200.2 (ISP)BGP Sec: 172.26.200.21 (Mine) <> 172.26.200.22 (ISP) However, the received routes are not being inserted into the main routing table, and thus any packet I receive over the IPsec to my VIP fails the return path check and is d

Hi everyone, Does anyone know why there isn’t a Cybereason Antivirus product available for validation in the FortiNAC endpoint compliance scan? I managed to create a custom scan, which is working well, but now I need to validate either SentinelOne or Cybereason, and with Antivirus plus Custom scan I did not found a way to do this, because there is no OR between them, only AND. FortiNAC 7.2 

Hello everyone, I am currently a beginner on FortiSOAR and I have a ‘problem’, using an API to retrieve a lot of information, I have a little trouble processing on FortiSOAR unlike using a standard programming language. I'd like to process data like this:items : [0] : id : xx indicators : [0] : type : xxx [1] : type : xxx [1] : id : xx indicators : [0] : type : xxx [1] : type : xxx I can't figure out how to process each item as a unit firstthen process the indicators as a unit and then carry out other actions.Maybe the answer has already been given, but I couldn't find it. if anyone can help me that would be great news Best regards,

hi,just would like to confirm if my conversion below is correct?it's for NAT between two internal networks in our environment to reach the MGMT subnet 172.29.0.0/16.do i also use the "nat-source-vip enable" so the "mapped-ip" will be be used for SNAT in the reverse direction? interface Port-channel101.61 nameif outside security-level 0 ip address 172.20.248.78 255.255.255.248 interface Port-channel101.60 nameif inside security-level 100 ip address 172.20.248.70 255.255.255.248 object network obj-172.16.7.70 host 172.16.7.70 nat (outside,inside) static 172.20.32.1route outside 172.16.7.0 255.255.255.0 172.20.248.77 1route inside 172.20.0.0 255.255.0.0 172.20.248.69 1-----config firewall vipedit "vip-172.20.32.1"set extip 172.20.32.1set mappedip 172.16.7.70set extintf "po1.60"set nat-source-vip enableend config firewall security-policyedit "DNAT for 172.20.32.1"set srcintf "po1.60" set dstintf "po1.61"set srcaddr "any"set dstadd

Hi Guys, I just enrolled in to the course recently and i was given a task at work to try and connect to my firewall remotely and some of my clients are not connecting to the network due to insufficient IP's. Any suggestion? Rgards

Hi all,I'm hoping someone here has successfully been able to set this up and can give me some pointers.I'm running 6.0.4 on a 200E and need to allow Symantec LiveUpdate to run through the F/W.The updates work when I allow all traffic from DMZ -> WAN, so I know the Symantec software is installed fine. However, when I block internet traffic, allow DNS lookup to pass through as LiveUpdate uses FQDNs and follow the Symantec tech article to allow it through the firewall, it fails every time. The tech article in question can be found here: https://support.symantec.com/en_US/article.TECH102059.html I've done some packet tracing when all traffic is allowed and it looks like LiveUpdate has multiple CNAMEs returned from the DNS. Should these CNAMEs be added to the policy as allowed or should the firewall be able to deal with them? It's getting to the point where I'm considering setting up LiveUpdate to run once a day and to allow all traffic out to the internet for a 10 mi

I am looking for a bit of guidance on how to get captive portal access to resources working based on firewall policies on a Fortigate (currently running 7.2.x).  More specifically, I want to restrict management access to devices to authenticated users while allowing full access to the services running on those devices. For example, if I have users on Vlan 10 and Vlan 20 with Windows servers on Vlan 30 and Linux servers on Vlan 40, I would like to restrict RDP from Vlans 10 and 20 to Vlan 30 to only authenticated users while allow SMB through for everyone.  At the same time I would like to restrict RDP from Vlans 10 and 20 to Vlan 40 to only authenticated users while allowing HTTP and HTTPS through. Can anyone point me at a complete, end-to-end How-To on how I achieve this, including where the (FQDN) captive portal could/should sit, please?

Hello, I would like to setup configuration using one virtual IP to connect multiple internal IP/host. How can I do the setup? Model: FortiWeb 1000e with firmware 6.3.1-build1056  Thank You

I have 40 windows servers that perform unique functions and want ZTNA access to all of them. I guess there are a couple of different ways:1) Unique public IPs for ZTNA TCP Forwarding Server with the same external port being 3389, and internally mapped to the single server on 3389.. Easy, but takes up a lot of addresses.2) Same public IP for ZTNA TCP Forwarding Server, with unique external ports,  and internally mapped to the single server on 3389. Seems like a hassle for the end user to append a new port to and RDP session. Unless done using a SRV record in DNS with the unique port….. Does this sound correct ?Tom

Hi all,. I am having no luck finding these  link again I need FortiSIEM Linux and Windows Agents downloads the actual files not the guides or pdfs.   Thanks in advance. . 

Hi, I have question related to filters and policies, I know that I can deny or allow emails with encrypted PDFs, but I need to do this:Allow X account to always send encrypted PDFs to everyone, but if someone who received the PDF replies with the PDF attached then allow it too, but if someone sends in normal circumstances a encrypted PDF to X account then block it.Is it possible to create a rule or something like this?: If X account sends something to Z account, then X account now knows Z account, and then if Z accounts sends/replies with a encrypted PDF to X account then allow the message, but if X account does not know Z account and Z account sends encrypted PDF to X account then block it.Is it possible to do what I want to do?Thank you and I hope I'm not bothering you.

Hi all,  I have a FortiGate 100F series, and some devices are having internet, some are not, but all the configurations seem to be okay. Any suggestions?

I noticed a strange behavior to say the least, everything was working normally until about 4 days ago the incidents that were seen regarding events in MEA collectors stopped without explanation, that is, the initial screen that counts the incidents was reset from 4 days ago. I didn't notice anything out of the ordinary, the health of the cluster is ok, the events that the collector forwards to the supervisor continue to arrive, but for some reason the incidents don't appear, this is what is most confusing. I have already tried stopping and starting the collector, but the problem remains, and I believe that perhaps the problem is not with the collector, considering that events arrive, but the rules no longer transform them into incidents. Could anyone help me troubleshoot? I remain at your disposal to provide any additional information. Thanks

Hi Team, I need to know if it is possible to change the MTU on the ports of a Fortiswitch, I have been reviewing the config, and the only thing it allows me to change, is the MTU in: HOSTNAME # conf system interfaceHOSTNAME (interface) # edit internalHOSTNAME (internal) # set mtu-override enableHOSTNAME (internal) # set mtu 1600 HOSTNAME # config switch globalHOSTNAME (global) # set max-frame-size<integer> frame size between 68 and 10000 If I try it on the interfaces, I don't have the option to modify the MTU. HOSTNAME # config switch interfaceHOSTNAME (interface) # edit port1HOSTNAME (port1) # getname : port1description : (null)type : physicalnative-vlan : 1allowed-vlans :untagged-vlans :discard-mode : nonedhcp-snooping : untrusteddhcp-snoop-learning-limit-check: disabledhcp-snoop-option82-trust: disablearp-inspection-trust: untrusteddhcp-snoop-option82-override:stp-state : enabledstp-loop-protection : disabledstp-root-guard : disabledstp-bpdu-guard : di

Hello,     We are a mid-sized school in Pennsylvania, 4 buildings + admin, 3000 students etc. We are looking to replace a couple of 7+ year old SonicWall nsa 6600 devices with compairable Fortinet or PaloAlto devices, and I'm heavily leaning towards Fortinet because of a bad PaloAlto experence a number of years back at a different job. What is the suggested Fortinet hardware that would be compairable to the SonicWall 6600s that we have now? Currently we have dual fiber lines coming in from our primary ISP and a second fiber line coming into from a fall over ISP, All connections are currently registering as 1Gbps connections, although I'm checking with our Primary ISP if that is the true speed or just what our SonicWall is tapped out at. thanks in advance. 

I have FG 100 E, and I have it setupDHCP ServerAddress range 192.168.2.2-192.168.2.254Netmask 255.255.255.0is there something missing so that some devices sometimes can't get the IP address                                     Thanks.

Hello admins, Are there openings to become moderators in Fortinet forum?if so, would you please share details.Thank you

I am new to FortiClient EMS, I am installing and configuring at the moment. I can see that the FortiClient download URL is https://servername:1443/installers/ I am planning to configure IIS to run another website on port 1443.  Is there a way to change the FortiClient download URL to a different port? I am not sure if I can have 2 websites running on the same server with the same port.Please advice 

Hello all - new to Fortigate Central Nat and just wanted to run something by the community here.Looking to exempt NAT for a specific source and destination - while maintaining NAT\PAT to internet bound destinations for the same source. My questions are, can a "No NAT" rule be created\utilized in Central NAT, and how are the rules parsed\ matched ? Assume top-down correct? Here's an example of what I'm after - 3 interfaces on the firewall. I just want to NOT nat the Forti voice ip when the destination is the CCUM server ip. Can I create a rule with those sources and destinations and just turn NAT off -then create a rule below for everything else internet bound?  Thanks in advance all inside – outside – any – any – NAT\PAT  - to internet hosted –outside – Fortivoice IP – CCUM IPs– no NAT hosted – outside – any – any – NAT\PAT - to internet 

Good morning everyone.I need to configure an SMTP external to my administration on my FortiAuthenticator (v.6.6.2) to forward FortiTokens.I would like to use the Fortinet service "notification.fortinet.com" as SMTP, but I can't configure it to work.Can someone help me?Thanks.

Hi, I want to block custom files (bin, ova, ovf) on FortiProxy. I couldn't find these files in the file filter field. How can I block them? Has anyone done this? I would appreciate your support. Best Regards,İsmail Ürek