Solved

Hi All,I'm looking for advise on configuring a backup internet connection using vDSL.I have a Draytek 167 which I plan to set to bridge mode and perform the PPPoE authentication on the FortiGate.I have a single /32 public ip address. Any thoughts on this?The ISP is Andrews and Arnold.

Currently I have a typical Active Directory on-prem setup. 1- Persistent Agent gleans the username from the PC. 2- NAC is linked to AD and pulls the group info for the user.3- NAC sends the group tags to the Fortigate for use in FW policy to limit access for certain groups If we move to EntraID (which does not have directory services), how can we keep this design ?Is there any kind of workaround ? Don   

I got FortiCare today so downloaded some firmware off the site following upgrade path then the UI offered to do upgrades in the console rather than manual. Now it is at v7.0.17 and the upgrade path tool goes up until only 7.0.16 so I don't know how to move up to 7.6. "Firmware Management  Current FortiGate versionv7.0.17 build0682 (Mature)Select FirmwareLatestAll UpgradesAll DowngradesFile UploadThe firmware is up to date." This is from console. Thank you.

Hi there, I'm surveying related FG-121G solutions. Since FortiOS 7.0 satisfies Common Criteria for Information Technology Security Evaluation, Version 3.1 Rev. 5, June 2024.However, I checked related information (https://www.fortinet.com/corporate/about-us/product-certifications/common-criteria) that did not include FG-121G.Could the FG-121G be certified and listed in Security Target this year?

Hello everybody, I'm using a macOS with 7.2.5 of Forticlient.I had a deployment error with my device. Looking at the logs, i found this error: Downloading data from xxx:10443/Installers/default/FortiClient for Invitation/FortiClient_7.2.8.dmgURL using bad/illegal format or missing URL Obviously the error was caused by the spaces between the words:  FortiClient for Invitation On the EMS, I updated the URL, removing the spaces. At this, point, I want that my client, for the next update, automatically downloads the file from the new url. How can i say to my client:retrieve the new url and download the installer from thereIs there some command to push this new url to my client?Thank you! 

Is there a way to automatically map AD Groups to Workgroups for use in Policies ?I saw this article that seems to support it in 6.2. Seems the functionality is missing in 7.4.1  https://docs.fortinet.com/document/forticlient/6.2.0/new-features/280319/automatic-group-assignment#:~:text=group%20assignment%20rule:-,You%20can%20use%20AD%20groups%20to%20categorize%20users%20into%20different,local%20domain.  

Hello, I'm blocking app control Proxy category but I need to whitelist access to proxy-safebrowsing.googleapis.com. It falls under Proxy.HTTP application and gets blocked. I would like to do it via custom signature. But I can't seem to match the traffic using my custom signature.  I've read the signature creating guide and followed it but no luck. It still recognized as Proxy.HTTP.   config application custom edit "Google.Safebrowsing.Proxy" set signature "F-SBID( --attack_id 9876; --name \"Google.Safebrowsing.Proxy\"; --service HTTP; --protocol tcp; --  app_cat 6; --pattern \"safebrowsing.googleapis.com\"; --weight 40;)" set category 6nextend config application list edit "AppControl" set extended-log enable set other-application-log enable set unknown-application-log enable set deep-app-inspection disable unset options config entries edit 4     set application 9876  &nbsp

On the fortigate 100D, I configured an IPsec Site to Client VPN. How do I make the remote device connected to the VPN continue to access the internet? In this scenario it is Windows 11.

FortiMail 3000FFirmware version: 7.4.2 Two problems occurred when registering approximately 5,000 new aliases via CLI to FortiMail, which already has 100 aliases registered.1. When mail is received by newly registered aliases and existing aliases, mail is not delivered to members (user unknown is displayed even though the user is already registered).2. Adding/deleting a member in the GUI is not reflected in the alias where the above problem occurs (the member is deleted in the GUI, but the member still receives mail via the alias).The first problem stopped after I forced failover from primary to secondary in HA configuration,However, problem 2 continues to occur.Are these known issues?Is there a limit to the number of aliases that can be registered or the maximum number of members that can be registered in one alias? Is there any way to recover problem 2 ?

Hello Fortinet Community,I activated device control in #EDR to control the use of mass storage devices. The last days I created several exceptions for usb sticks with in the gui. Now we plan a bigger roll out of usb sticks. I want to prepare the exception in advance before handing out the sticksI used the API several times to handle collectors and their groups. This was no problem. The description of the API has a function call "create-or-edit-exception". The Exception data is mentioned as JSON in the body. There is no example for it in the dosumentation. I retrieved an exeption with "list-exceptions". I passed this JSON output to the create-or-edit function an get an error.So I´ve got the following questions:Can I create an exception for an usb mass storage device which has never generated an event?When there first has to be an event, can I used the event to create or add the device to an exception?Is there an example existing?My goal is to generate a script on an Linux machine in ord

Hi, we recently changed from 300D cluster to 200F cluster. Now we see no logs, no information at all in FortiCloud. In the GUI Dashboard I see Status activated, connected to my account, storage used 0KB and no files uploaded.  In System Feature Visibility I dont see anything deactivated which could have impact, Fortigate Cloud Sandbox is activated. In Security Fabric > Fabric Connectors and Logging Settings I see Fortigate Cloud activated and connected to send logs every 5 minutes to Fortigate Cloud. In Log Settings > Local Logs memory is activated since we also want to have the information there. We dont really see something missing? Thanks!

This problem began after I upgraded Fortigate from 6.4.15 to 7.0.17 without any configuration changes. Before this, the issue was not observed. It's not a problem if it asks for a username and password; the issue is that it started asking for a token, which was initially required only for VPN users.FortiGate is requiring a token for internet access, even for users who should only need a token only for VPN. The firewall integrates with MS AD with LDAP and FSSO.VPN users authenticate with tokens via FortiAuthentication, also integrated with MS AD and LDAP. FortiGate requires a token for internet access only if users are in local, not when are in remote access.All firewall rules for Internet access are configured to validate FSSO users, with LDAP validation as a fallback in the same rules. See the attached screenshot. 

Hi Guys, We are unable to reset uptime by using dia sys ha reset-uptime. But didn't work

hello everybody am facing strange issue where I can't ping from our new site lets name it HQ-2 I have configured firewall policy and everything we have an ipsec tunnel between main site HQ and new site HQ-2 I have vlan for MGMNT other device in same vlan they can reach the AD via the ip sec tunnel such as switches but still my firewall can't ping when I run the command Diagnose sniffer packet to see whats going on it seems the firewall is trying to ping the AD via the dmz interface which has the ip 10.10.10.1 nothing is connected to this interface I have tried to use policy route but still the same issue any advice what could be the issue here ? thanks in advance

Hello!I need to set up FortiEDR notifications for when a collector/device gets put in isolation automatically via the playbook. All of the system/security event notifications are setup and work properly, but how do I get the isolation notifications sent to the distribution lists?  Thank you!S0ck-Pupp3t

Hello,I'm currently configuring a second client IPSec VPN. The new uses IKEv2, on the same WAN interface/IPaddress. I saw help pages about the PeerID and LocalID, but my tries aren't okay. I have an phase1 error. I put a PeerID on the Authentication frame, and I reported it on the LocalID in the Forticlient configuration as I understand. Is it okay ? What about the LocalID on the Fortigate ?  The existing Client VPN has this configuration :Is this configuration a problem ? 

Good day Fortipeeps! I just wanted to ask if anyone has any idea how to calculate the total average or maximum CPU utilization. For example, the total average over 24 hours. I’m a bit confused about per-core CPU utilization. it is considered alarming if one of the core have high utilization?I would appreciate your insights Thank you! 

Hello everyone,  I've configured the antispam profile action on FortiMail to use personal quarantine. However, the end user receives a notification about a quarantined email several hours later—sometimes even a full day later. I've checked the NTP synchronization, which appears to be fine, and the latency between the mail server and FortiMail is normal. My current FortiMail version is 7.4.2, and I plan to update to 7.6.0 to see if it resolves the issue. Does anyone have a better suggestion or know if there's a way to adjust this delay on FortiMail? Best regards,

I am setting a new Firewall Cluster, when I import the firewall policy (show firewall policy/show) from the previous Firewall into the new Firewall (excluding UUID details) I can see the new  policy on the new Firewall "show firewall policy" but I cannot see the policy in the GUI...! If I create a policy rule in the GUI I see the policy in "show firewall security-policy" but not in the "show firewall policy"  ouput I am really struggling to see why? There are no advanced features in the policy just source/dest/port/accept.Is there something I need to turn off? This should be just a simple import, there are too many existing rules to import manually.

Hi FGT adminsCan FortiOS be compromised? I mean like any other OS by an attacker or a malware.Have there been any known cases?Is there any method to check if my FortiOS is compromised?Does FortiOS checks itself for possible compromise?Note: here I'm talking about FortiOS itself, not about FortiGate configuration.

We can install any version of FortiClient VPN on brand new Macbook (15.3 Sequoia).Problem lies in the new MAC security layer in the OS.  Creating a connection then clicking on Connect produces an error: "To connect to the VPN with FortiClient, open Security & Privacy Settings and allow the system software from FortiTray".Problem is that option is NO longer available is the new Mac OS versions.Called Apple to confirm this is a  issue, and they report the section of the security applet has been removed and will not come back. See screenshot. Will there be a newer build to accommodate for this new Security Change is MAC OS?The version shown here is the latest 7.4.2.1717Thanks!Brett FlaggIntegraONE

Hello,I would like to know if it is possible to change the AND in the fields to OR because I would like my action to be triggered only if one of the parameters I define is triggered.Thank you in advance. 

I have lant to migrate all of virtual machine to new server in different location, and we need to keep same ip address.The vlan handled by core switch and the core switch connected to the fortinet, in new location i also have same devices and both location have internet connection.Since the migration will done partially, this need both location should have same ip address, same vlan and can communicate each other.So can we use VPN in fortinet to transfer Vlan ? In my mind if we can transfer vlan over VPN then the new location will have same vlan and each host on new location can communicate with devices in of location.IF migration is done for all virtual machine then i can shutdown vlan interface on old location and make new interface vlan on core switch in new location.

Hello everyone, I am exploring better options for configuring FortiMail HA across two different sites—one FortiMail device in Site A and another in Site B. My initial idea is to connect the two devices via an MPLS VPN. However, this approach can be costly for geographically distant sites and requires extremely low latency to function effectively. As an alternative, I am considering using DNS failover... Does anyone have a better suggestion ? Best regards,

Hi, We run 3 firewalls for VPN connections.I created a CR on the first one and we generated a multi SAN certificate which was uploaded and works fine.I tried the same cert on the other two and i get an error saying there is no CR for this certificate.Error message: Uploaded certificate has no matching certificate signing request (CSR)Does each FW require a seperate CR to generate a different multi san cert? TIA :)