Solved

How can i get application signatures from api request? i want to save all app in varaible 

Hello I am having problems connecting to the FortiGuard servers on a FortiGate 40f firmware v7.0.13 build0566 (Mature) (HA Cluster). I am also receiving the message "FortiGate time is out of sync.", I use an NTP server 200.160.0.8. Images belowFrom FortiGate, I can ping the servers service.fortiguard.net, update.fortiguard.net, guard.fortinet.net. I get a response time of approximately 150ms. And I can also ping the IP 200.160.0.8 with approximately 18ms of response time. The output of the "diagnose debug rating" command is shown below: I also tried changing from https to udp with port 8888 with the commands below and I was also unsuccessful.config system fortiguard set fortiguard-anycast disable set protocol udp set port 8888 set sdns-server-ip 208.91.112.220 <-- IMPORTANT TO ADD THIS OR ANY OTHER FDN SERVER TO PREVENT DOWNTIME! endI have two internet links and I can ping the Fortiguard servers from both links. Both internet links are PPPOE. I tried to change th

Good day everyone, I've been trying to use the official Chrome Extension for searching from here https://chromewebstore.google.com/detail/fortinet-google-search/nhemkpkfgilmlepjncbgojlojaekhibm?pli=1 and no matter what I click it shows just 1 page of the search results. So wanted to ask - is it something on my side or it is by design this way?Thank you

Does anyone have information on the End of Life (EoL) date for FortiWeb 1000E? Any official sources or insights would be greatly appreciated. Thanks!

Hello everyone,I am sending the logs from our EMS server directly to our FAZ as the syslog server option.I wanted to know if the logs sent from the EMS to a FortyAnalyzer are unencrypted or are they encrypted ?From the EMS server GUI the commands are limited, is there a command from the CLI to possibly enable encryption of the logs sent to the FAZ ?If so, is there anything else to configure on the FAZ side ? FortiAnalyzer #Forti EMS

Hello guys,I'm kind of at my wits ends here.I have two FortiAP 431Gs on 7.4.5 managed via FortiLAN cloud. Both are connected to their own Fortigate 40F running 7.2.10. (So two sites, 1 AP each)The clients randomly drop throughout the day. Sometimes they will go a day or so without drops, then the clients will start to drop at random intervals sometimes every 5 minutes, sometimes every few hours.    Looking at the logs, I do not see any error messages, just client wtp disconnect messages. CPU/Memory looks to be within acceptable bounds on both the AP and the Fortigate too.What is interesting is we have 27 other sites with the same settings and no reported issues - only difference is at these sites the AP is managed via the Fortigates...The only thing I can think of if it has something to do with FortiEdge Cloud. if it matters, the sites with the APs are in the southeastern united states but for some reason they were deployed to FortiLAN cloud in Canada.but I also hav

MacOs Sequoia has changed to location of some of the security permission sets and the system extensions security profiles have changed. After installing 7.4.0.1645, the prompts to allow permissions takes a user to the permissions area where the defined permission set is no longer available to allow. You cannot continue beyond the FortiClient app prompt to change the security settings and the permissions cannot be given since the extension is not available to give permission to.  Any word on a Sequoia compatible release?

Hi everyone,I'm facing an issue that I need help resolving. I'm trying to configure a FortiWiFi 40F to distribute the IPv6 ::/56 prefix provided by my Starlink High Performance connection. I believe you might know how to set this upI’ve checked some resources(https://docs.fortinet.com/document/fortigate/7.6.2/administration-guide/37673/ipv6-prefix-delegation), but they haven’t helped me successfully propagate IPv6 on the FortiWiFi 40F. I’ll attach the configuration script for your reference. I really appreciate any assistance you can provide. Best regards Octavio    FortiWiFi-40F-3G4G (interface) # edit wanFortiWiFi-40F-3G4G (wan) # config ipv6FortiWiFi-40F-3G4G (ipv6) # showconfig ipv6set ip6-mode dhcpset ip6-allowaccess pingset dhcp6-prefix-delegation enableconfig dhcp6-iapd-listedit 1set prefix-hint ::/56nextendendFortiWiFi-40F-3G4G (ipv6) # getip6-mode : dhcpnd-mode : basicip6-address : ::/0ip6-allowaccess : pingicmp6-send-redirect : enablera-send

Hello,Today I have a server that is not part of my domain, but is in my IP Range, I need it to resolve an address https://plm.group.com/Windchill for server 192.168.20.2 to work https how do I do it inside the DNS server / DNS Database?  

Hey everyone,I recently attempted to set up Dial-Up VPN authentication using TOTPRadius in combination with an LDAP server and TOTP (Time-Based One-Time Password). TOTPRadius acts as a Proxy-RADIUS server and integrates LDAP authentication with TOTP for two-factor authentication. The setup process was based on the information provided by Token2's guide, which primarily explains how to configure TOTPRadius for admin login but does not explicitly mention VPN authentication. The Test Authentication worked, but when in combination with VPN it doesn't. The Problem:When trying to authenticate a Dial-Up VPN client using FortiGate and TOTPRadius, the authentication fails with the following error message from the TOTPRadius Server shown in Wireshark: Initial login not allowed; Empty password provided for user <blank-user>; Terminating process with Reject message This suggests that the FortiGate did not transmit the user’s password when performing VPN RADIUS authenticat

Hello experts, Am trying to find a way to block download exe files over whatsapp using fortigate f70, i have applied the file policy along with ssl deep inspection, also applied application control polciy to block file upload and file downlod from whatsapp as per below document : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Block-WhatsApp-file-uploads-action-by-using/ta-p/219694 After that we have tested, all files have been blocked over whatsapp, however we only require to block exe files over whatsapp, how we can achive that? 

Hello everyone,I have issue to integrate Domain Controller (Windows Server 2019) with WMI "failed (Login to remote object error)" when I configure the credential and would test I receive this message "failed (Win32_OperatingSystem Result not found via OMI)"-IN Credentials > Access Method Definition I use OMI - All Steps are done correctely as External Systems Configuration Guidehttps://docs.fortinet.com/document/fortisiem/7.1.7/external-systems-configuration-guide/421011/microsoft-windows-server- I removed the Kaspersky from server too Please can anyone help  FortiSIEM 

Hi everyone,I'm relatively new to networking and eager to learn.I would appreciate your input regarding a technical solution. Specifically, in the following architecture, I aim to facilitate communication between zones using two firewalls configured in High Availability (HA) active-passive mode. The challenge lies in achieving complete redundancy without employing intermediate switches between servers and firewalls.   In the scenario where, for instance, FG1 is the active firewall and the connection between SRV1 and FG1 drops for a specific reason, I'm unsure how to achieve full redundancy without using intermediate switches. In such cases, the only solution seems to be manually forcing an HA failover.   I'm thinking about using HA active-active, but I haven't used FortiGate devices in this mode before, and I'm uncertain if it's the optimal solution. I understand that having a pair of switches between servers and firewalls is preferable, but due to space and cost constraints

I noticed that in Policy & Objects there is at CLI Configurations > Objects > router some router objects like prefix-list and route-map. This seems to achieve something when first wanting to use a prefix-list or route-map for example in the Device BGP configuration. But later changes in the Policy & Objects on that configuration don't seem to have an effect. Did anyone work with this successfully? How did you make this work?

Hi,I am using Fortigate 200D Firmware v5.4.1,build1064 (GA)Recently, there is the message when I log in "Conserve mode activated due to high memory usage" Memory Usage 85%Could you help me fix this issue?Thank you.

Good day! I hope you are all doing well, I just want to ask what are the possible solutions when we input 2 FQDN (one is malicious and 1 is legitimate) it resolved same IP addresses. the FQDN that tagged as malicious are blocked via deny policy. However the our client are having a problem accessing the legit FQDN because of the same IP. the legit website are from Cloudflare. does cloudflare assigned same ip address to FQDNs? Thank you! 

how can i filter the api request i want to filter the size of logs{base_url}/api/v2/log/disk/traffic/local?vdom={vdom}&filter=policyid=={policy_id} and _metadata.timestamp>={start_time_ms} and _metadata.timestamp<={end_time_ms}&start={start}&limit={limit}i want to take just the first 1000 logs but the request show all logs 

Good day good people, I hope you are all doing well, I just want to ask if anyone has an idea on how to backtrack the reason for high resource utilization. For example, high CPU and memory utilization were observed during the morning, and we just noticed it in the evening. Does anyone know how to backtrack the issue without TAC intervention? what are the commands needed on to solve this issue Fortigate 7.2.10

Hi all,I have create an IPSEC dial up tunnel with Ike v2 and NAT-T. I use Forticlient to connect to it and it works well.  I have observed that some traffic are denyed cause when I send traffic across the tunnel, the user with witch Im logged (using forticlient) is not associated with the incoming traffic. I can see the IP from the private tunnel network but not the username. That causes the incoming traffic matches a deny policy, cause I use an user group in the incoming rule that permits traffic from the IPSEC interface. For example, I can see traffic from 192.168.106.x but the incoming traffic has not an user associated.Why the username with witch Im connected to the tunnel are not matched in incoming traffic?I attach you the tunnel configuration: Thanks ¡¡¡ 

Good morning everyone,It has been a while indeed. This is a follow up to a resolved post below: Post: Forticlient EMS removable media accessDate:14/5/2024----------------------------------------------------------------------------------------------- Since I configured this feature in EMS, it has been working perfectly, blocking usb devices while only allowing certain devices, especially Keyboard and mouse. However, my manager attached a USB dongle/device to a computer apart of target group/profile, and it is blocked by the USB policy. He instructed to disable the "Removable Media Access" feature on LAN until this ethernet-usb can be allowed on computers. I really don't want to keep this off for too long. Don't know why that instruction, but hey, following orders, at least my name won't be called for any issues. Can you show me to allow this device in Endpoint Profiles -> Malware Protection -> "profilepcs" -> Removable Media Access? Kindly see image below/at

Hello,I would like to implement VDOM In azure infrastructure. As I discovered when you implementing VDOM you must to assign interfaces to the VDOMs, but in case of Azure you have just 2 interfaces and I don't know how I can assign 2 interfaces for example to 3 VDOMs? 

Hi, today we tried to get information about our interface bandwith with iperf and Fortigates. We would like to get information about a FG location in South America. Our main office are in Europe and we use FG100Fs and 7.2.X. All our offices have at least 2 x 1000/1000mb access but in South America we can only do speedtest on browsers where we get like 800/800 at the most. Firts, we could not run iperf within the VPN from FG Europe <> FG South America. We set up a iperf server on windows on our side but doing diag traffictest run -c x.x.x.x we could not connect. We checked Windows FW, AV and policies and there was no way. As iperf-int we tried all interfaces (internal, WAN and the VPN interface). After that we tried with a linux in our network and we created a VIP with 5201 and trying from our FG with WAN as interfaces we got like maximum 12mb trying at least 10 times. Doing the same from our FG locationes in EU we got like 300-700 mbs.  We would like to k

Hello everyone, I am currently working on integrating FortiAI with FortiAnalyzer, and I would like to know from which version of FortiAnalyzer this integration is officially supported.- What is the minimum FortiAnalyzer version required to recognize and store logs from FortiAI ?- Are there any specific configuration steps or limitations I should be aware of ?- Where can I find the official documentation regarding this integration ?Any insights or shared experiences would be greatly appreciated. Thanks in advance for your help!

Hello there, can somone please explain to me what this FortiClient VPN icon display  means ? I could establish a succesfull connection and i pressed disconnect.  After 10 min when i tried to enter again i had this icon displaying and could not establish connection I have the Forticlient 7.2.8 version because it was the only version that i could establish a succesfull connection 

hello everybody, I defined a ZTNA Group that includes two ZTNA Tags:  I know that a firewall policy can work with ZTNA Tags. But is it the same for a local-in-policy?Looking at the documentation: config firewall {local-in-policy | local-in-policy6} edit <policy_number> set intf <interface> set srcaddr <source_address> [source_address] ... set dstaddr <destination_address> [destination_address] ... set action {accept | deny} set service <service_name> [service_name] ... set schedule <schedule_name> set comments <string> next end It generally talks about a destination address. But is the local-in-policy capable of understanding a ZTNA group?I didn't find anything indicative about this. I'm working on a Fortigate 60F v7.2.11.Thank you