Solved

Buen díaEstoy teniendo problemas al sacar un reporte en FortiAnalyzerTengo agregado un equipo FortiAuthenticator, revisando en los logs de event, veo los registros correctamente.En log type selecciono Event (es la única opción que tengo)El problemas esta que cuando ejecuto el query en datasets SELECT * FROM $event. Valido el query y no me manda error pero al ejecutarlo para ver los registros no me manda ninguno a pesar de que tengo registros en Log View -> Event.Hago el mismo proceso en otra ADOM con un Fortigate y aquí si me trae registros. Tendrás alguna solución o  recomendación respecto a esto.  

Cannot seem to find the downloads site for Windows agents for the SIEM. I found the pdf it would be nice to add the link to the actual instal file in the doc. Thanks

Hi everyone, after upgrading my FortiGate 91G from FortiOS 7.0.16 to 7.2.10, the SSL VPN interface (ssl.root) disappeared from Network > Interfaces in the GUI. However:•The SSL VPN works normally and users are able to connect.•From CLI, the ssl.root interface is visible and the status is su:get system interface | grep ssl Output:name: ssl.root ip: 0.0.0.0 0.0.0.0 status: up type: tunnel The SSL VPN configuration seems active and correct. But if I go online the SSL VPN INTERFACE is not visible. You give me feeds

Hello everybody: I want to enable two-factor authentication but only for local users who use the forticlient to connect VPN (fortigate 60F).I want to use email, I already have the email-server configured.The option does not appear, so I have to configure the email-server.This is my configuration:show system email-serverconfig system email-serverset server "mail.emailexample.com.ar"set port 26set security smtpsendAccording to the documentation:https://community.fortinet.com/t5/FortiGate/Technical-Tip-Email-Two-Factor-Authentication-on-FortiGate/ta-p/194890There are two steps to complete this configuration:Configure the SMTP server.config system email-serverset reply-to {Sender_email_address}set server {SMTP_server_FQDN/IP}set port {SMTP_server_port_number}set authenticate {enable | disable}set username {username}set password {password_string}set security {none | starttls | smtps}end Create a user(s) with email two-factor enabled.config user localedit {username}set type passwordset

Hello, I want to ask you for advice. I am currently managing a FortiGate device where I am running a VPN setup. Within this VPN, I have a requirement to authenticate users against two separate Azure tenants. Both tenants are configured with FortiGate SSL VPN applications. I have tested the connection, and I observed that when users are in different tenants, the authentication always attempts to validate against a single SAML provider (Users can be authenticated through one tenant, but users from the second tenant are experiencing issues. The system attempts to authenticate them through the first tenant, where they do not have access). I am looking for a solution that allows the system to attempt authentication in the second tenant if the initial SAML authentication fails. I would appreciate any advice.Jan 

Hello Team, I was gaining knowledge about incidents and I came to know that we can setup an external lookup tool like Virustotal from which we can repudiate the IOCs. I am curious to know that how we can build a custom external lookup tool which can be used just like Virustotal for enrichment. I want answers particular to development so answer keeping in mind development. Questions are as below:  Can that only be created by FortiSIEM platform team or I as developer can develop this and than submit to FortiSIEM by developing on my own?If I can develop, what is the procedure or coding best practice must be followed ?Which languages are used in development ?This looks more kind of manual enrichment of each IOC which I select, Can this be automated for every incident ?Feel free to reach out in any kind of clarity over this questions. If anyone has sales team or technical team contact details than please send it over here who can answer these questions. TIA.

Hello Everyone.  Home user here, been thinking about replacing my old linksys router with a fortigate firewall.  Nothing crazy, probably just the 40F.  Was looking at the support options, can anyone tell me if you're able to download firmware updates for your firewall with out having to pay for a yearly support contract?Thanks!

Hi all, I encounter an issue when trying to register to EMS from my local FortiClient. The version I have now is 7.0.2 for FortiOS. I am trying to troubleshoot this however am clueless where to start for the debugging.... 

Hi All,  I've built a lab with SD-WAN ADVPN set up over an MPLS network, with an Internet VRF and a Private VRF, all looks to be working fine, except for BGP multipath routing.  I have a Server IP, learning the IP through BGP over both Hubs not a problem, with the preferred path entering the routing table, however, I thought with multipath routing it would install both routes in the routing table?As a result, my SLA to the server in SD-WAN is showing as down over 1 of the Hubs, so it can't flip over if packet lass or high latency occurs etc Any ideas please? Thanks in eager anticipation  (topology, routing table and SLA attached if it helps)

Hello, we are changing in small offices from FG30E to FG40F and some 30G which we would like to try.  First, I cant download newer FortiOS versions from the support portal, it seems that the 30G only has the 7.2.X version, cant be true, no? Also in the Web Gui I cant activate a AV profile. I can add a new one but than I cant choose it in the policy. Any experience and feebdack from this modell? Thanks!

Hello Expert, I have fortigate 80F running version 6.4.I create a firewall policy and would like to to Clone Reverse the Policy.When I right click on the policy I not see the option to clone reverse. Is there some feature that has to be turn on before the option becomes visible.I humbly request some guidance   . Thank youRegard Jomo

hi,i'm trying to configure a new FW policy and just wanted to know the difference between ICMP and Ping service.1.which is best practice to use/choose?2.if i need to clone/edit a custom ping or icmp service, i.e. echo reply, which service do i use/edit (icmp vs ping)?3.what is also the difference between the "traceroute" service vs the custom ping "time exceeded" (type:11,code:0).

hi,i'd like rename an existing VDOM but can't seem to do this either on the local FGT device or FMG.can this be done via CLI? if there is, what is the command?is there a feature visibility that i should enable for me to edit the VDOM name?

 Hello. I would like to configure wan1 as the SD-WAN members on the case of new device.But, it is not appeared wan1 on interface for creating new SD-WAN member.It is appeared wan2 and dmz interfaces.How can I create SD-WAN members with wan1? Regards. 

Hey, Guys,I don’t know if you can help me with this problem, but I have tried many types of configurations network and of interfaces, therefore, the problem still happening.  On Windows I’m abel to Connect and use services of this VPN, but on Ubuntu, after some atualizations of system, when I try to connect the FortiClient shows the “VPN Connect” but the bytes received are iqual 0 and I can’t access the services and VMs. I already try restart network confugurations and reinstall FortiClient, but still not working. Thanks for your attention

Hello, I have strange situation related to my configuration of  SSL VPN and LDAP users on my FG100F unit.Currently all people in my agencies using their LDAP accounts to connect VPN and work remotely. Last week one person reported to me that it is possible to change expired password using Forticlient. It is normal because I have configuration which allows to users to change their Windows (LDAP) password. Unfortunately this user changed password for exactly the same as he had before. In my GPO I have password history for last 10 and compliance policy on high level (at least 10 characters etc.)But for now I see that it is possible to change it though Forticlient  Does anyone know how to force FortiGate to use AD policy during password change ?  BR Konrad

helloI have FortiGate40F and already I have DDNS from x.dyndns.orghow I can configure this DDNS from FortiGate (from GUI  only server from fortiddns.com )for example when I write x.dyndns.org with specific port from browser forwarding to server inside my Network Best Regards 

I have the below config, and seem to have an issue where the fortigate isn't sharing the direct connected routes, between BGP peers.FortigateInterfacesaggregateinterf: IP 172.19.0.6 255.255.255.248. No Vlan.MGMT: IP 192.168.183.58 255.255.255.192, VLAN 200, Parent: aggregateinterfCCTV: IP 192.168.183.190 255.255.255.192, VLAN 250, Parent: aggregateinterf.SwitchVRF WANVRF LANVRF MGMTVRF CCTVSVI: WAN, IP 172.19.0.2/29, VRF WAN, VLAN 101.SVI: CCTV, IP 192.168.183.130/26, VRF CCTV, VLAN 250SVI MGMT, IP 192.168.183.2/26, VRF MGMT, VLAN 200SVI: LAN1, IP 192.168.168.1/24, VRF LAN, VLAN 300SVI: LAN2, IP 192.168.169.1/24, VRF LAN, VLAN 301 On the switch, I leak the routes between LAN and WAN.I have BGP peering from the switch as below.VRF WAN to aggregateinterf, 172.19.0.6/29VRF MGMT to MGMT vlan, 192.168.183.58/26 Now BGP is established and I can see the fortigate as the default route.The issue I am having is, the fortigate is not advertising each interfaces connected route to the ot

I have a new implementation of FortiSASE and trying to integrate with EntraID for SSO. We have followed all the steps as documented here including API permissions : https://docs.fortinet.com/document/fortisase/latest/agent-based-vpn-autoconnect-using-entra-id-sso/547823/configuring-entra-id-options-for-agent-based-vpn-autoconnect SSO still doesn't work and every time, I lock the policy Source to EntraID group (My account is a member of this group), and i try to connect to agent based VPN, it gives me the following error. AADSTS50105: Your administrator has configured the application FortiSASE ('677888668-56ff-4675-7561-ddee90078') to block users unless they are specifically granted ('assigned') access to the application. The signed in user 'abcd@ybg.com' is blocked because they are not a direct member of a group with access, nor had access directly assigned by an administrator. Please contact your administrator to assign access to this application. Does anyone knows

So I have a few laptops in our organization that this has happened to now, I originally thought it was the most windows update that did it as both users advised that issue started occurring after a windows update.  But after experimenting with one of the laptops I have wiped it multiple times now (as issue kept reappearing) my tests I started installing things one by one and rebooting.  I started with our 7.2.5 installer and had no issue, but when I updated to 7.2.7 is when issue resurfaced. I then created a 7.2.7 installer wiped the laptop and first thing I did after joining our domain was install forticlient 7.2.7 and it issue immediately happened.  When the issue occurs the login screen flashes every few seconds and resets to the initial screen, it is painstaking to just reboot it into maintenance mode to use the recovery drive.  It has happened on 2 different model of laptops (Surface Laptop 6 and Asus Expert Book) I have a bunch of laptops that are just fi

Hi Am facing a strange issue where when I uploaded the backupconfig of the firewall we lost https or http access to the firewall I will explain everything below (I did a session with forti support but the result was you shouldn't take back up config from 7.6.0 version to 7.2.10 version tbh I wouldn't say this is true at some point but I will try my lost hope here) So we have a fortigate firewall that is on 7.6.0 we wanna role back because this version is seriously bad I toke the passive firewall factory reset it also rolled back to 7.2.10 then toke the back up config from 7.6.0 and uploaded it in the 7.2.10 suddenly no https \ http access I will write everything down that I tried : 1-interface up allow access ping https http ssh(i can ssh into the firewall)2-change the https port to default 3-no local in policy is configured4-trust host is configured I added the whole subnet of my vlan (me and the firewall are on the same vlan)5-diagnose sniffer to see what is being

Dears, TrendMicro Worry-Free Business Security Services (WFBS-SVC) provides different URLs used as reference for allowing listing from firewall or proxy server. We created a rule in FortiGate using FQDN trendmicro.com but it is not working and it is resolving in only 1 IP. TrendMicro has more than 1. How we can resolve this ? Thank You   

Hello, Securtiy Events Summary logs do not appear on FortiGate. FortiGate version 7.2.9. Does anyone have a solution for this?

I have just installed Windows 11 on my desktop PC and installed FortiClient v7.0.9. I have steup my FortiClient app the same way as it was on Windows 10 but it is not working. I just get a failed to connect check your internet and VPN pre-shared key message. It works fine on my Windows 11 Laptop though? Anyone else had this and can offer any advise?

Management access | FortiGate / FortiOS 7.0.0 | Fortinet Document Library"Management access to the FortiGate will be limited to a single physical interface."Foritgate 80E, has 2 WAN ports, but it is really not possible to access management GUI both public IP address on WAN1 and WAN2. So far, I can access management GUI on WAN1 public IP address only.