Solved

Hello everyoneA few weeks ago I was looking for a solution with the following post.....https://community.fortinet.com/t5/Support-Forum/Fortigate-7-6-1-policy-with-timer-and-passwort-release/m-p/365986#M259639Unfortunately it's still not the solution I want.I'm still looking for a way to somehow create a "session timer" with my Fortigate.I'm looking for a way to limit my children's devices, which are all enabled with fixed IP addresses via policies, so that an IP session can only access the Internet for 1 hour per day.Again for information...I am NOT looking for a solution with the scheduler because the internet hour is NOT at the same time every day.I'm looking for a solution to run an IP session for 1 hour daily.The solution with the web filter is very laborious and cumbersome (post with URL above).Don't you have another idea how I could implement this?Thank youGreetingsSwiss daddy

hello team i have uploaded VM licence but the status is Serial-Number: FGVM00UNLICENSEDLicense Status: No LicenseLicense Expiration Date: 2024-03-04VM Resources: 1 CPU/0 allowed, 985 MB RAM/0 MB allowedLog hard disk: Not available --- PLEASE HELP---

Hi there! Is it possible to install the same single policy to say 5 FGT Clusters from Forti Mrg, but each of the 5 Clusters has different interface names? The same single policy will be pushed to each Cluster as a Global FW policy not a VDOM.............or is the only way via a VDOM with normalized interfaces from the FM? later mapping INTERNAL interface to Port1 on Cluster-1 and INTERNAL3 on Cluster-2 etc.........  

Hello i have a problem when i set ha-mgmt-status with port mgmt1 I set vdom root in fg vm v 7.0 in this port but i cant port with the ip i assigned to this pruporse. FortiGate-VM64-KVM # show system interface mgmt1config system interfaceedit "mgmt1"set ip 192.168.25.3 255.255.255.0set allowaccess ping ssh httpset type aggregateset lldp-transmission enableset snmp-index 25nextendFortiGate-VM64-KVM # FortiGate-VM64-KVM # execute ping 192.168.25.3PING 192.168.25.3 (192.168.25.3): 56 data bytes64 bytes from 192.168.25.3: icmp_seq=0 ttl=255 time=0.6 ms64 bytes from 192.168.25.3: icmp_seq=1 ttl=255 time=0.1 ms64 bytes from 192.168.25.3: icmp_seq=2 ttl=255 time=0.2 ms64 bytes from 192.168.25.3: icmp_seq=3 ttl=255 time=0.1 ms64 bytes from 192.168.25.3: icmp_seq=4 ttl=255 time=0.0 ms--- 192.168.25.3 ping statistics ---5 packets transmitted, 5 packets received, 0% packet lossround-trip min/avg/max = 0.0/0.2/0.6 ms  ortiGate-VM64-KVM # show system haconfig system haset gr

Hello team!!!Happy new year to everyone using gregorian calendar!! I have the following 3 questions about Fortigate:1) To block phishing I am using web filter, is there another Fortigate feature to add, to help blocking phishing attempts?2) Is there any place in the Fortigate where I can see security alerts for applications installed on computers?  I dont think so, but I'm asking just in case3) You know another feature to block suspicious network activities in addition to DOS rules and IPS profiles?This is for all the traffic comming through the Fortigate, not for traffic between 2 computers in the same LAN, of course. Thanks in advance.Regards,Damián 

您好，客户的 foritgate 60f 防火墙已购买 ATP 和工业安全服务的许可证，并将在生产环境中以透明模式部署。我想了解一下在这个环境下如何完成防火墙部署，这个部署有哪些注意事项，以及如何使用工业安全服务特性库

Any one knows how to change the loginscreen title or name -> FortiAnalyzer-VM64-KVM to a different name ? I have tried the following config system globalset platform-name <new-name>endIT DIDN'T WORKED

Fortinet changed the way local-in-policies are created when an interface is part of an SD-WAN zone. From 7.4.6 and 7.6.1, the local-in policy is assigned to the SD-WAN zone instead of the interface as explained in the article: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Local-in-Policy-is-Missing-after-upgrading-to-v7-4/ta-p/367001 This is great, however I'm dealing with issues now when I change these local-in-policies on the FortiManager. We run FortiManager 7.4.6. FortiManager 7.4.6 appears to not understand this new behaviour. I get a warning that I can't assign a local-in-policy to an SD-WAN zone when I create a local-in-policy in a policy package that's only assigned to firewalls that run FortiOS 7.4.6. That's quite annoying when you manage all your local-in-policies from the FortiManager. Is this intended behaviour in FortiOS 7.4.6 and if so, is there a fix on the way to bring this in line with FortiOS 7.4.6?

Hello,We are trying to switch our EMS authentication server from LDAP to LDAPS.  LDAP works fine.We have ports 389 and 636 open on our FortiGate firewall.  After inputting our local CA certificate and clicking Test we get a Network error message at the top.We are using the local CA certificate from our Windows server 2019 domain controller/Certificate authority by exporting it in DER format.  We have also tried that same domain controller server certificate, which is what EMS is syncing with today.Any thoughts about what could be doing wrong?  Could it be the certificate export process or maybe something else?Screenshot below.

Happy new year everyone.I want to authenticate a user through the Forti API, after the user finishes to authenticate against a 3rd party captive portal.I figured the API command would be: https://FORTI-IP/api/v2/monitor/user/firewall/auth?vdom=root{"users": [{"ip": "10.235.1.50","ip_version": "ipv4","method": "firewall","user_type": "firewall","username": "test4"}]}But I'm getting 424 Failed Dependency.Unfortunately I don't know what parameter is missing and I do not have access to the developer portal to read the documentation.FYIDeauthentication works fine like this:https://FORTI-IP/api/v2/monitor/user/firewall/deauth?vdom=root{"users": [{"id": 0,"ip": "10.235.1.50","ip_version": "ip4","method": "firewall","user_type": "firewall"}]} 

Hi Everyone, I'm having 10 years of experience with Palo Alto's. We make heavy use of their URL filtering and Application Detection.In our environment it's not possible to decrypt any traffic, yet the Palo could block all URL's (based on SNI, certificate names etc) but here with the Fortigate Eval License it even refuses to block any webpage using the URL filtering - I've tried "youtube.com", whatsapp.com, facebook.com and none of these work and I'm refusing to believe that this isn't possible with a Forti without decryption. What I've done:1. Security Profiles -> Web Filter -> Create New -> Checked URL Filter (Static URL Filter) and I've choosen Wildcard, Block, Enable for *facebook.com* / *whatsapp.com* and "*youtube.com*"2. I've made sure the Filter is set in "Flow Mode" and hit OK.3. Created a "Firewall Policy" under "Policy & Objects" that includes this Filter:Accept, All, All, All, Flow-Based, Web-Filter checked and choosen, SSL-Inspection left on "no-inspe

Please help me configure a policy for one connection. FG-60E (firmware v.7.2.10) works in transparent mode between optical modem (also in transparent mode) and main router for LAN. External IP address is on router, not on modem. When Inspection Mode works in Proxy-based (Firewall Policy), one of the devices in LAN cannot communicate with its server where it sends measurement data (blitzortung.org). Policy in Flow-base mode does not block the connection. It blocks only in Proxy-base. Is it possible to set Flow-based policy for selected remote server? Or add some exclusion in current policy? I know the addresses of servers to which data is sent.

Hello there,  I try to to slim down our Stack by getting those things mentioned in the Subject directly from FortiManager instead of all the Fortigates directly. Is that possible ? - Haven't found anything in the API Docs. API or Mail Event would be prefered.  Thanks!

Hi Forum,I have configured "host negated" and added a group of countries (block_country) on vpn-ssl settings to avoid ssl failed login attacks but a user need to connect permanently from a country who is on the group mentioned above. Is there a trick to bypass the current config and allow a remote ip from a country forbidden ?Thank you for your help.Regards

New setup with a 60F on 7.4.6.With 3 interface: WAN (6.6.6.6),Vl10_Users(10.0.10.1/24),Vl20_Servers(10.0.20.1/24)I did a rule that allow traffic between Vl10 and Vl20 with no ''inspection profile''.When NAT is disable on this rule trafic doesn't work between a host in Vl10 to another host in Vl20.Has soon I enable the rule with NAT, the host in Vl20 see traffic originating from the host on Vl10 with it's NATed IP.I don't want to enable NAT on this rule in order to see the originated source IP on the host in Vl20.Both hosts have they gateway pointing to the corresponding interface on the FW.I should not have to Nat traffic when routing should only be involved. I can do some show or debug if needed.Rule in question:set name "Allow_All_To_DNS"set uuid ...........set srcintf  "VL-10_OLD_LAN"...set dstintf "VL-20_SRV"set action acceptset srcaddr "all"set dstaddr "host_10.0.20.20_DNS-SRV"set schedule "always"set service "DNS" "ALL_ICMP"s

Hello Expert, I would like to setup client server vpn, but would prefer to use a customize setup as instead of ADVPN (I have move control of the setup)I notice the option to use dialup user for customize setup can I use this option Instead of the ADVPN?I humbly request some guidance   Thank youRegards 

Hi Fortinet Community, My address object is edit "Wifi-address"set type interface-subnetset subnet 192.168.0.0 255.255.255.0set interface "Wifi-interface"next how ever my interface status is unused/disable/down edit "Wifi-interface"set vdom "root"set ip 192.168.0.1 255.255.255.0set allowaccess ping fabricset status downset device-identification enableset role lanset snmp-index 8set interface "port4"set vlanid 888next ...  however, I am use the same Address Object to use in new Firewall Policy but using different interface in source/destination like source is port9 destination is wan1. the policy can created. i ask ChatGPT, is this possible? Behavior with Disabled Interface:When you disable an interface, FortiGate may interpret that the address object no longer has a valid binding, effectively treating it as "unbound." This could allow the address object to appear in policies for different source/destination interfaces.This behavior can be se

WebFilter is blocking a lot of traffic to the following URL.It looks like it's Microsoft traffic, but the category is (Uncategorized).Is this a feature that FortiGate is designed to block? http://48.210.69.87/filestreamingservice/files/xxxxxxxxxxxxxxxxxxx==&cacheHostOrigin=1D.tlu.dl.delivery.mp.microsoft.com ("xxxxxxxxxxxxxxxxxxx" is a random string) FortiOS 7.0.15

FSSO Collector Agent showing 'unprocessed logon event' in debug file (log level warning) Scenario: Fortigate FG600E cluster v.6.4.7. 3 Microsoft Windows Domain Controller servers (W2016), 2 Microsoft Windows Collector Agent servers (W2012): DC Agent and Collector Agent in Advanced Mode. From time to time, specially when DCs or CA servers goes down and up, 'unprocessed logon event' messages appear continuously in both Collector Agent servers. Some logon events are missing in Collector Agent, and therefore missing in Fortigate. Therefore, Internet access problem for several users arise. There isn't any specific procedure to recover to normal operation. Even restarting Collector Agents do not solve the problem. Sometimes, it seems to be recovered when modifying some part of the Collector Agents configuration, or when modifying some part of the DC FSSO configurtation and then restarting the Collector Agents... Any help is really appreciated.Many thanks in advanced.&nbsp

I succeeded to forward logs from the forcepoint NGFW to fortiSiem but all the event types received are unknown " unknown event type". FortiSIEM , #Forcepoint    

fnsysctl is frequently helpful in troubleshooting Fortigates, and while its options are mentioned in the Forums here and there, no single article lists them, and not all options are mentioned, so I wrote a post to summarize the info.Originally posted on https://yurisk.info/2024/10/23/fortigate-fnsysctl-command-options-with-examples/  Important facts about fnsysctl command:You have to log in with a user having super_admin profile.For VM Fortigate, it has to have a regular license - not free evaluation one. On free evaluation VM FGT you will get an error Unknown action 0.It is CLI-only command, with no GUI equivalent.The command runs locally on the Fortigate you are logged in, so to run the same command on a passive member of HA cluster, you will need to log in into the passive member first.The Tab completion does NOT work with this command (therefore this post).We CAN use these commands in automation stitches as set action-type cli-script.fns

Hello everyone, connected access points via a switch:configured DHCP on FORTIAccess points received IPE50 successfully pings access points and sees their MACSSID createdBut when creating an AP profile, I get the status "not available". Whoever encountered a similar problem could not find a solution to the problem ? The article on advanced search does not help.      

Access denied when trying to start cap. Any ideas? Tried this route as well - https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Disable-Hardware-Acceleration/ta-p/191256    

Hello all, I humbly request your assistant. I configure the ADVPN on the hub but I would like to configure AES and sha 256 but I am not allowed to configure same . The screen shot below is only options I am see, not even the option to convert to full configure is displayed. Thank you Regards 

We have a Forticlient EMS and are using IP-Sec VPN with entra SAML to login to the VPN.I need to have a simple time limit that would disconnect users after 12 hours of being connected (active or not)How can this be accomplished?Post Connection script? Automation on Fortigate? Tagging Action in EMS?