Solved

Dear TAC Team,I am experiencing difficulty locating the downloaded database from FortiClient EMS. While the GUI indicates that the database was downloaded and saved at a specific time, I am unable to determine the exact directory or repository where it is stored. Unlike FortiGate, the database does not appear in the browser's default download directory. Could you please provide guidance on the standard directory or repository where the database is saved by default? Additionally, any steps to locate or configure the backup path would be greatly appreciated.Thank you for your assistance.

Greetings all, I was looking at the options available for local-in policies and defined source interfaces and noticed that some interfaces are not listed.  These appear to be interfaces being used for WAN purposes, but even when switching their roles to 'undefined' they will not show up as available interfaces.  Anyone know what conditions may make an interface unavailable for use in local-in policies?

 Hello. I want to let "normal" users with the role "Standard User" to add secrets as their favorites. As you can see in the screenshot the option at a normal user is greyed out with that role. Admin users can add secrets to their favorites.  Can somebody help in which right is neccessary to add secrets as favorite? FortiPAM is running on version 1.5.0.  

Hi All, I need to know which Internet services/applications should be enabled/allowed through a Fortinet FW in order to allow Windows PCs to receive Windows/Office updates.

How can i get application signatures from api request? i want to save all app in varaible 

Hello I am having problems connecting to the FortiGuard servers on a FortiGate 40f firmware v7.0.13 build0566 (Mature) (HA Cluster). I am also receiving the message "FortiGate time is out of sync.", I use an NTP server 200.160.0.8. Images belowFrom FortiGate, I can ping the servers service.fortiguard.net, update.fortiguard.net, guard.fortinet.net. I get a response time of approximately 150ms. And I can also ping the IP 200.160.0.8 with approximately 18ms of response time. The output of the "diagnose debug rating" command is shown below: I also tried changing from https to udp with port 8888 with the commands below and I was also unsuccessful.config system fortiguard set fortiguard-anycast disable set protocol udp set port 8888 set sdns-server-ip 208.91.112.220 <-- IMPORTANT TO ADD THIS OR ANY OTHER FDN SERVER TO PREVENT DOWNTIME! endI have two internet links and I can ping the Fortiguard servers from both links. Both internet links are PPPOE. I tried to change th

Good day everyone, I've been trying to use the official Chrome Extension for searching from here https://chromewebstore.google.com/detail/fortinet-google-search/nhemkpkfgilmlepjncbgojlojaekhibm?pli=1 and no matter what I click it shows just 1 page of the search results. So wanted to ask - is it something on my side or it is by design this way?Thank you

Does anyone have information on the End of Life (EoL) date for FortiWeb 1000E? Any official sources or insights would be greatly appreciated. Thanks!

Hello everyone,I am sending the logs from our EMS server directly to our FAZ as the syslog server option.I wanted to know if the logs sent from the EMS to a FortyAnalyzer are unencrypted or are they encrypted ?From the EMS server GUI the commands are limited, is there a command from the CLI to possibly enable encryption of the logs sent to the FAZ ?If so, is there anything else to configure on the FAZ side ? FortiAnalyzer #Forti EMS

Hello guys,I'm kind of at my wits ends here.I have two FortiAP 431Gs on 7.4.5 managed via FortiLAN cloud. Both are connected to their own Fortigate 40F running 7.2.10. (So two sites, 1 AP each)The clients randomly drop throughout the day. Sometimes they will go a day or so without drops, then the clients will start to drop at random intervals sometimes every 5 minutes, sometimes every few hours.    Looking at the logs, I do not see any error messages, just client wtp disconnect messages. CPU/Memory looks to be within acceptable bounds on both the AP and the Fortigate too.What is interesting is we have 27 other sites with the same settings and no reported issues - only difference is at these sites the AP is managed via the Fortigates...The only thing I can think of if it has something to do with FortiEdge Cloud. if it matters, the sites with the APs are in the southeastern united states but for some reason they were deployed to FortiLAN cloud in Canada.but I also hav

MacOs Sequoia has changed to location of some of the security permission sets and the system extensions security profiles have changed. After installing 7.4.0.1645, the prompts to allow permissions takes a user to the permissions area where the defined permission set is no longer available to allow. You cannot continue beyond the FortiClient app prompt to change the security settings and the permissions cannot be given since the extension is not available to give permission to.  Any word on a Sequoia compatible release?

Hi everyone,I'm facing an issue that I need help resolving. I'm trying to configure a FortiWiFi 40F to distribute the IPv6 ::/56 prefix provided by my Starlink High Performance connection. I believe you might know how to set this upI’ve checked some resources(https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/37673/ipv6-prefix-delegation), but they haven’t helped me successfully propagate IPv6 on the FortiWiFi 40F. I’ll attach the configuration script for your reference. I really appreciate any assistance you can provide. Best regards Octavio    FortiWiFi-40F-3G4G (interface) # edit wanFortiWiFi-40F-3G4G (wan) # config ipv6FortiWiFi-40F-3G4G (ipv6) # showconfig ipv6set ip6-mode dhcpset ip6-allowaccess pingset dhcp6-prefix-delegation enableconfig dhcp6-iapd-listedit 1set prefix-hint ::/56nextendendFortiWiFi-40F-3G4G (ipv6) # getip6-mode : dhcpnd-mode : basicip6-address : ::/0ip6-allowaccess : pingicmp6-send-redirect : enablera-send

Hello,Today I have a server that is not part of my domain, but is in my IP Range, I need it to resolve an address https://plm.group.com/Windchill for server 192.168.20.2 to work https how do I do it inside the DNS server / DNS Database?  

Hey everyone,I recently attempted to set up Dial-Up VPN authentication using TOTPRadius in combination with an LDAP server and TOTP (Time-Based One-Time Password). TOTPRadius acts as a Proxy-RADIUS server and integrates LDAP authentication with TOTP for two-factor authentication. The setup process was based on the information provided by Token2's guide, which primarily explains how to configure TOTPRadius for admin login but does not explicitly mention VPN authentication. The Test Authentication worked, but when in combination with VPN it doesn't. The Problem:When trying to authenticate a Dial-Up VPN client using FortiGate and TOTPRadius, the authentication fails with the following error message from the TOTPRadius Server shown in Wireshark: Initial login not allowed; Empty password provided for user <blank-user>; Terminating process with Reject message This suggests that the FortiGate did not transmit the user’s password when performing VPN RADIUS authenticat

Hello experts, Am trying to find a way to block download exe files over whatsapp using fortigate f70, i have applied the file policy along with ssl deep inspection, also applied application control polciy to block file upload and file downlod from whatsapp as per below document : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Block-WhatsApp-file-uploads-action-by-using/ta-p/219694 After that we have tested, all files have been blocked over whatsapp, however we only require to block exe files over whatsapp, how we can achive that? 

Hello everyone,I have issue to integrate Domain Controller (Windows Server 2019) with WMI "failed (Login to remote object error)" when I configure the credential and would test I receive this message "failed (Win32_OperatingSystem Result not found via OMI)"-IN Credentials > Access Method Definition I use OMI - All Steps are done correctely as External Systems Configuration Guidehttps://docs.fortinet.com/document/fortisiem/7.1.7/external-systems-configuration-guide/421011/microsoft-windows-server- I removed the Kaspersky from server too Please can anyone help  FortiSIEM 

Hi everyone,I'm relatively new to networking and eager to learn.I would appreciate your input regarding a technical solution. Specifically, in the following architecture, I aim to facilitate communication between zones using two firewalls configured in High Availability (HA) active-passive mode. The challenge lies in achieving complete redundancy without employing intermediate switches between servers and firewalls.   In the scenario where, for instance, FG1 is the active firewall and the connection between SRV1 and FG1 drops for a specific reason, I'm unsure how to achieve full redundancy without using intermediate switches. In such cases, the only solution seems to be manually forcing an HA failover.   I'm thinking about using HA active-active, but I haven't used FortiGate devices in this mode before, and I'm uncertain if it's the optimal solution. I understand that having a pair of switches between servers and firewalls is preferable, but due to space and cost constraints

I noticed that in Policy & Objects there is at CLI Configurations > Objects > router some router objects like prefix-list and route-map. This seems to achieve something when first wanting to use a prefix-list or route-map for example in the Device BGP configuration. But later changes in the Policy & Objects on that configuration don't seem to have an effect. Did anyone work with this successfully? How did you make this work?

Hi,I am using Fortigate 200D Firmware v5.4.1,build1064 (GA)Recently, there is the message when I log in "Conserve mode activated due to high memory usage" Memory Usage 85%Could you help me fix this issue?Thank you.

Good day! I hope you are all doing well, I just want to ask what are the possible solutions when we input 2 FQDN (one is malicious and 1 is legitimate) it resolved same IP addresses. the FQDN that tagged as malicious are blocked via deny policy. However the our client are having a problem accessing the legit FQDN because of the same IP. the legit website are from Cloudflare. does cloudflare assigned same ip address to FQDNs? Thank you! 

how can i filter the api request i want to filter the size of logs{base_url}/api/v2/log/disk/traffic/local?vdom={vdom}&filter=policyid=={policy_id} and _metadata.timestamp>={start_time_ms} and _metadata.timestamp<={end_time_ms}&start={start}&limit={limit}i want to take just the first 1000 logs but the request show all logs 

Good day good people, I hope you are all doing well, I just want to ask if anyone has an idea on how to backtrack the reason for high resource utilization. For example, high CPU and memory utilization were observed during the morning, and we just noticed it in the evening. Does anyone know how to backtrack the issue without TAC intervention? what are the commands needed on to solve this issue Fortigate 7.2.10

Hi all,I have create an IPSEC dial up tunnel with Ike v2 and NAT-T. I use Forticlient to connect to it and it works well.  I have observed that some traffic are denyed cause when I send traffic across the tunnel, the user with witch Im logged (using forticlient) is not associated with the incoming traffic. I can see the IP from the private tunnel network but not the username. That causes the incoming traffic matches a deny policy, cause I use an user group in the incoming rule that permits traffic from the IPSEC interface. For example, I can see traffic from 192.168.106.x but the incoming traffic has not an user associated.Why the username with witch Im connected to the tunnel are not matched in incoming traffic?I attach you the tunnel configuration: Thanks ¡¡¡ 

Good morning everyone,It has been a while indeed. This is a follow up to a resolved post below: Post: Forticlient EMS removable media accessDate:14/5/2024----------------------------------------------------------------------------------------------- Since I configured this feature in EMS, it has been working perfectly, blocking usb devices while only allowing certain devices, especially Keyboard and mouse. However, my manager attached a USB dongle/device to a computer apart of target group/profile, and it is blocked by the USB policy. He instructed to disable the "Removable Media Access" feature on LAN until this ethernet-usb can be allowed on computers. I really don't want to keep this off for too long. Don't know why that instruction, but hey, following orders, at least my name won't be called for any issues. Can you show me to allow this device in Endpoint Profiles -> Malware Protection -> "profilepcs" -> Removable Media Access? Kindly see image below/at

Hello,I would like to implement VDOM In azure infrastructure. As I discovered when you implementing VDOM you must to assign interfaces to the VDOMs, but in case of Azure you have just 2 interfaces and I don't know how I can assign 2 interfaces for example to 3 VDOMs?