Solved

I succeeded to forward logs from the forcepoint NGFW to fortiSiem but all the event types received are unknown " unknown event type". FortiSIEM , #Forcepoint    

fnsysctl is frequently helpful in troubleshooting Fortigates, and while its options are mentioned in the Forums here and there, no single article lists them, and not all options are mentioned, so I wrote a post to summarize the info.Originally posted on https://yurisk.info/2024/10/23/fortigate-fnsysctl-command-options-with-examples/  Important facts about fnsysctl command:You have to log in with a user having super_admin profile.For VM Fortigate, it has to have a regular license - not free evaluation one. On free evaluation VM FGT you will get an error Unknown action 0.It is CLI-only command, with no GUI equivalent.The command runs locally on the Fortigate you are logged in, so to run the same command on a passive member of HA cluster, you will need to log in into the passive member first.The Tab completion does NOT work with this command (therefore this post).We CAN use these commands in automation stitches as set action-type cli-script.fns

Hello everyone, connected access points via a switch:configured DHCP on FORTIAccess points received IPE50 successfully pings access points and sees their MACSSID createdBut when creating an AP profile, I get the status "not available". Whoever encountered a similar problem could not find a solution to the problem ? The article on advanced search does not help.      

Access denied when trying to start cap. Any ideas? Tried this route as well - https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Disable-Hardware-Acceleration/ta-p/191256    

Hello all, I humbly request your assistant. I configure the ADVPN on the hub but I would like to configure AES and sha 256 but I am not allowed to configure same . The screen shot below is only options I am see, not even the option to convert to full configure is displayed. Thank you Regards 

We have a Forticlient EMS and are using IP-Sec VPN with entra SAML to login to the VPN.I need to have a simple time limit that would disconnect users after 12 hours of being connected (active or not)How can this be accomplished?Post Connection script? Automation on Fortigate? Tagging Action in EMS?

HiI'm trying to figure out why my transparent proxy policies are allowing traffic when they shouldn't. I have a transparent proxy policy restricted to a single IP and FSSO group for testing, yet when I disable the policy, the test device/user still has internet access when no other transparent proxy policy should apply. Fortigate 200E running 7.4.5 I've disabled fast-matching, and enabled WAD debug: diag deb resetdiag wad debug enable category policydiag wad deb enable level verbosediag wad filter src <redacted>diag deb ena With the policy enabled, I see proxy policy 8 matching: wad_http_req_check_policy :12911 start match policy vd=0(ses_ctx:t|Phx|Me|Hh|C|A1|O) (<redacted>:57019@19-><redacted>:80@20) absUrl=0wad_fast_match_is_enable :3702 fast matching is disabledwad_http_policy_get_cate_info :212 get category right awaywad_http_policy_match_one :454 fw_pol_id=8(pol_ctx:th|Acd|7|=p) pflag:H|W|U|Ac asyn_info=1wad_vwl_has_intf :329 logic/phy

Hi,we have two /29 IP blocks from our ISP. IPs from the first block are used for SNAT and a few VIPs. There are two default routes, one for each gateway because both subnets have different gateways. We didn't want ECMP, so we increased the distance for the default route to the gateway of block 2.We also run VIPs on IPs of the second block. I was wondering why this is even working because the default route for block 2 is not installed in the routing table because of the higher distance. Therefore, return traffic for VIPs of block 2 must flow through the gateway of block 1. Asymmetric routing is disabled, I checked it.We are also using port forwarding on the VIPs, so it shouldn't automatically use the VIP's public IP for return traffic. Edit: I checked the session table and it looks like Fortigate SNATs the reply traffic. But I don't know why, the documentation says that it sould only be doing this when One-to-One NAT is applied without port-forwarding. Or does this rule only apply

Hi,I set a wifi guest with self-registration and otp sent via sms using Fortisms license using Fortiauthenticator.There is a method to send an alert when Fortisms license is about to end? For example send an email?.Thank you all in advance. Vincenzo 

Dear AllWe have deployed FortiNAC 7.6 latest version and using it for 802.1X authentication using Cisco switches and AD authentication through WinBind, authentication was working well for some customers but its not stable , now we are facing that cisco showing authentication successful but on FortiNAC its showing "unauthenticated" and remain in Isolation/authentication VLAN means VLAN change is not happening , this product is strange sometimes becomes very slow. We are using Peap MSCHAPv2 with user authenticationplease suggest

 Problem:I have a FortiGate 90G, and I have created a cluster. The management IP for this cluster is currently set to 192.168.1.1. However, I also want to assign a secondary management IP of 192.168.1.2 to the secondary unit in the cluster, specifically for monitoring purposes.Request:How can I configure this secondary management IP for monitoring? Are there any potential issues or problems that might arise from this setup?Please provide the correct steps and guidance, as I do not have enough information about this process. 

Hello everyone, I am looking to add a disclaimer on the fortimail only for outbound emails, that every mail the user sends is under his responsability, I want the disclaimer to be only visible for the end user and not the recepient. When I configured the disclaimer to only be for outgoing, the message was sent to the recipient . If anyone knows how to do it that would be appreciated Best regards,   

 Hi, I want to manage fortigate from multiple fortimanager. On the central management settings screen we can add second fortimanager ip address. But when I add a second fortimanager, do the fortigate config settings sync in both fortimanagers? Does the config change I make in one fortimanager also sync in the other fortimanager?If so, we want to manage from two fortimanagers and not lose config when one of them fails.Best Regards

Hi I have the below requirement just looking for thoughts on the best way to do it....I need to do outbound blocking only for now. The site has a /16 assigned to it, carved up into many small subnets.....Most of the subnets will have the same banned countries, however, there are 3 subnets (scattered all round the /16) that require no restrictions. What is the cleanest way to tackle this? Couple of options that came to mind are 1. Create an address group for the /16, and use address exclude for the 3 subnets. Then in the rule block access to the restricted countries. Never used this feature before but it seems appropriate here. 2. Do the internet rules for the 3 VLAN's first, then block the countries for the rest, then do the normal rules for the rest any other ideas? thanks  

Is it just ME... or is auto-update the most dangerous and asinine thing I have ever heard? Me (for one) working in ICS/OT security, shiver at the thought of anything auto-updating. My compliance officers would shoot me in the f4ce if I ever suggested it. With the bugs in new releases, there is no way on earth I would consider this. Is there anyone out there that would actually enable this (or not disable it)? I'm interested in hearing more opinions than what my own paranoid brain is willing to offer. #fortigate #fortimanager #fortinet 

Hi guys, I am not able to pull off a DNAT to access from external internet access to my web service hosted in the server in  private subnet managed by fortigate. I am new into this networking area, could you guys help me out ?This is what I have been trying. I am accessing with web browser like http://<FGT-Public-Ip>:3002 and also doing telnet <FGT-Public-Ip> 3002.... both time out. Traffic is reaching my fortigate, verified with diagnose sniffer packet port1 'tcp and port 3002' results below:-----------------------------------------------------------------------------------------------XXXXXXXX # diagnose sniffer packet port1 'tcp and port 3002'Using Original Sniffing Modeinterfaces=[port1]filters=[tcp and port 3002]3.351276 XXX.XXX.9.57.59128 -> 10.0.0.10.3002: syn 34725990313.351345 XXX.XXX.9.57.59128 -> 10.0.0.10.3002: syn 89282952 Redirects to interface port1 private ip address port 3002--------------------------------------

 Hello over in Admin -Setup- Organizationthe Error appeared when I tried to delete an organization, one of our clients who has terminated service.  Any ideas on what this is due to? or how I can fix? is this the Database being confused somehow?   Thanks in advance.   

Hello, I firmware upgraded my Fortinet 60F firewall from v. 7.4.2 to 7.4.4 today and since then the firewall has restarted endlessly. I've tried resetting the firewall with a pin on the back, but it doesn't help at all. What do I do to get my firewall going again?

Hello, A company has registered their FortiGate device under their own FortiGate Cloud account. If I change it to my own FortiCloud account, will I lose my Forti license? Best regards.  

Hello,I have a problem with the Radius connection my Fortigate and my fortiauthenticator.Last night the security team updated Fortigate to version 7.4.5 since users can no longer connect via VPN.When I go to configuration I get this message  I checked the secret carefully and they are identical so I don't understand. The fortigate and the fortiauthenticator communicate well with each other however.Do you have any ideas?Thanks 

Hi all,I'm trying to uninstall FortiClient on macbook with M1/M2 processor using a script from this article: https://community.fortinet.com/t5/FortiClient/Technical-Tip-Uninstall-FortiClient-using-a-script-on-macOS/ta-p/277070I only added two lines to change flags. Here is my script: #!/bin/sh # Uninstall FortiClient.sh pkill FortiClient launchctl unload /Library/LaunchDaemons/com.fortinet* chflags -hv noschg /Applications/FortiClient.app chflags -hv noschg /Applications/FortiClientUninstaller.app rm -Rfv /Applications/FortiClient.app rm -Rfv /Applications/FortiClientUninstaller.app rm -Rfv /Library/Application\ Support/Fortinet rm -Rfv /Library/Internet\ Plug-Ins FortiClient_SSLVPN_Plugin.bundle rm -Rfv '/Library/LaunchDaemons/com.fortinet.forticlient.vpn.plist' rm -Rfv '/Library/LaunchDaemons/com.fortinet.forticlient.wf.plist' rm -Rfv '/Library/LaunchDaemons/com.fortinet.forticlient.fmon.plist' rm -Rfv '/Library/LaunchDaemons/com.fortinet.forticlient.epctrl.plist' rm -Rfv

Is there a way to use FortiManager to build Windows Client Native IPSec tunnels? I know I can do it directly on the device, but wasn't sure if there was a way to centralize it using FMG instead. FMG 7.2.8 (updating to 7.2.9 when the vm image is available)FGT 60F - 7.2.10 I know I can do it directly on the FGT, but was hoping there was a way to do it via VPN Manager in FMG to keep everything consistent.

I have 4 real DNS servers behind a common Virtual Server using UDP forwarding on port 53 on our FortiGate that has been working for several years. I now have the requirement for the client IP to be preserved for the DNS servers so they can apply their own policies to the client traffic based on source IP. It is currently being replaced by the FortiGate's IP. Any suggestions on how to achieve this? Cheers - Mike SOLVED: it was easier than NAT(which was not on) it was the flow/proxy setting - oops

Hi,we have a VLAN on a 40F that is being provided through some 3rd party access points. We enabled the disclaimer portal for that VLAN for guest access. We don't want them to type in an E-Mail or provide guest accounts.The disclaimer portal works well but we need to extend the (idle) timeout to more than 300 seconds.Where can I do that? None of the settings seem to alter that value. I tried:config user setting > set auth-timeout Xconfig wireless-controller timers > set client-idle-timeout Xconfig system settings > set auth-timeout X In this article using a mail collection portal, it is somehow set to 10 days (864000) by defaultRetail environment guest access | FortiGate / FortiOS 7.6.0 | Fortinet Document Library But mine always looks like this:192.168.3.17        src_mac: 98:69:8a:XX:XX:XX        type: disclaimer, id: 14, duration: 368, idled: 210        expire: 90, allow-idle: 300 

There is an analyzer with version 7.0.13. When you search fortigate log for the last 7 days on Analyzer, pages of logs come up. However, there is no total log count for the last 7 days anywhere on the page. How can I see the total number of traffic logs in any interval I enter.