Solved

Dear All, am facing the problem on viewing the traffic logs in Fortiweb which is deployed in Azure. Enabled the traffic logs in CLI but still it's not visible, any suggestion pls   

Hello , could someone give me a light I'm configuring F60 , when the WAN1 card is set to receive DHCP modem from the operator it navigates normally , when I put it in Manual it stops navigating , I already went to the modem of the operator I made a DMZ I put the same IP and nothing someone could help me with this

Hello team, This time, a basic question.https://docs.fortinet.com/document/fortigate/7.6.0/administration-guide/369092/enabling-automatic-firmware-upgradesThis article says "updates within the same major release", so I am wondering, what is this "major release".For example, if we want to schedulle an automatic update to afterhours, I will need to know to which version will be updated Thanks in advance.Regards,Damián

I need the installer for Forticlient VPN 7.0.8.0427 (ideally the MSI) for a large-scale uninstallation via Intune. Is there anywhere I can find it? I've seen some posts within this community that contained a link, but they were all expired. 

Hi Folks! Hope you are all doing well, I am new to the firewall role. I would like to ask why I cant see any denied logs related on our block list policy. we have this group for IP address and full qualified domain, we plae any malicious object from this group. but as I checked, It has block other IP address that are not included on the repository. and the IP address that are on the group are not is it because the user are not accessing this IP or I cant see it because of the 7 days log retention. I would appreciate your insights on this Also here is the policy (Version 7.2.8) NameFromToSourceDestinationScheduleServiceActionLogBlock Inbound TrafficanyanyGroup of Malicious IP and FQDN detected from QradarallalwaysALLDENYEnabledBlock Outbound TrafficanyanyallGroup of Malicious IP and FQDN detected from QradaralwaysALLDENYEnabled

Hello, One of my customers asked if FortiNAC-f would support their Dell Powerconnect N5548 switches.I assumed it would be possible with SNMP or just CLI. Back to the subject - is there a publicly available list of supported 3rd party switches or if not is the above model supported and in what capacity. Any answers to this or just pointers to the appropriate materials would be appreciated!

We are in POC state and what my expect framework is supervisor, collectors and agents all communicate via Internet, because the VMs and network devices we managed seperate in different physical location and they can only reach each other through the Internet, but it seems not working if I just NAT them to make sure they can ping and telnet :443 to each other. So I am wondering if there is any further configure requirement we have to do?

I recently added a cellular internet back up service to our Fotigate. For the last 2 or 3 weeks I have recieved over 1000 "Login Denied" email alerts. I would like to block all public ip addresses but I have not found a good step by step using the web interface (I don't use CLI). Can someone point me in the right direction?I have a Fortigate FG60F with version 7.0.16 build0667. I cuurently have the backup internet unplugged.

Our FMG and FGTs are all running 7.2.8, and several months ago we upgraded the security fabric across all our devices. Now, we have a problem to where our local-in-policy will deploy once from the FortiManager, and the next change we deploy deletes the configuration that as just installed. We're trying to enable BGP to a vendor for one of our new systems over one of the VPN tunnels, but BGP is being listened to on the outside interface. I blocked tcp/179 using the local-in-policy on the outside interface, but then had to make another change after that. It's now unblocked. We have 18 FortiGates, and all have various local-in-policy configurations, but we can't make any further changes. Can someone provide guidance on what we need to do? Thank you.

Hi people,I just updated a firewall from 7.0.15 to 16 and lost the standard SSL-VPN on forticlient. So we migrated the vpn remote access config on IPSEC restoring user groups, policies etc etc. The only issue I still have is to have the Forticlient (now connected by ipsec) use the dns suffix I'm passing to the clients. I did all the standard config steps I've seen on other posts:        set mode-cfg enable        set dns mode manual        set ipv4-dns-server        set unity-support enable         set domain <domain>   but the client is still ignoring it. On the ipconfig /all of the vpn client I can see it gets the parameters (internal dns, domain suffix, routes) but if I try to resolve a domain host without the suffix it simply fails. I can still ping it and resolve it with the full domain name. Rules have been checked and I can r

Anyone have this issue? I need follow the in progress case....

hi,the DNAT uses VIP for inbound traffic, i.e. internet to private LAN/host.is the outbound traffic stateful, meaning it uses the same VIP public IP for outbound?or do i still need to configure a separate outbound FW policy and use the same VIP?

Dear Team, I would like to any possible way or guide for configuring FortiSIEM to send notification via Telegram or Microsoft team. Appreciate for every answer. Thank You

What are settings ADOM-level database ?

Hello: I have a Fortinet 60F, I changed the wan1 connection to Starlink, addressing mode dhcp and static route with dhcp too. If I enable wan1, the PCs can have internet with Starlink and with the other connection but the VPN drops, I have to disable wan1 for the VPN to work. I don't know if I have something else to configure or if the VPN is configured incorrectly, I have virtual IPs that point to one connection or another, I don't know if it is that, I attached one with the Starlink connection.We use forticlient for vpn connection.I hope you can guide me to solve these problems.Greetings

 Hi everyone, I could use some help today. We're experiencing some unusual WAN latency issues. We have a setup using a pair of FortiGate-120G and FortiGate-100F devices with a WAN configured in LACP with 2x1Gb links. The network connection is structured as follows: WAN ISP (LACP 2x1Gb) <----> 120G (in Transparent mode on VDOM) <----> 100F <----> LANWhen our WAN traffic increases, we notice a rise in latency, particularly visible with ping probes. Could this be an issue with the ISP, a security profile, or something related to NPU offloading or ASIC processing? Thanks

Please can anyone provide a brief description of what STP MODE within the FortiAP configuration is supposed to do when it is enabled? If it is related to Spanning Tree, how does the mode operate when spanning tree is also configured on the switch port is connected to?

I have done nse 7 public cloud security and nse 7 firewall before as everything is restructured. I am planning to undertake nse 7 public cloud security soon and nse 7 enterprise firewall and SDwan later.  As certifications have been restructured, will nse 7 cloud keep all my other certifications alive? #nse

hi we are using 2 600E in ha cluster, and today lot of complaint were received from end users that services got stop working. when i login on firewall the error was displayed as per subject and memory graph was in between 82-85%. We never faced this issue before so after few googling we tried to disable IPS but this did not help out (may be take some time to get memory down), so finally firewall was rebooted and secondary firewall becomes primary, memory goes at 67%.and everything start working fine.  can somebody please suggest1) how can we prevent this in future as our env is a very critical and cant afford any downtime due to this issue2) how can we generate an email alert if conserve memory threshold value exceeds 75% or is there any way to prevent this error occurring again?2) can we add more memory to device?

Hi Community, In FortiSIEM 7, is there a possibility to delete a case and the references? On the FortiSIEM Dashboard under Cases, a case has a Ticket_ID and Incident_ID.In my example, I have a 1 Incident_ID 121212 which links to 3 Ticket_ID's 33086714, 33086715 and 33086716. So far, I had to delete the Ticket_ID from two tables: phoenixdb=# delete from ph_incident_ticket_trail where ticket_id = 33086716;DELETE 1phoenixdb=# delete from ph_incident_ticket where id = 33086716;DELETE 1However if I lookup the Incident_ID, it keeps pointing to 33086716: phoenixdb=# select ticket_id from ph_incident where incident_id = 121212;ticket_id-----------33086716(1 row)Is it safe to update the field here with the before last ticket_id 33086715?Also, if I check under Incidents, the Active History still shows all 3 cases - how can I delete the references?         

Hi All,     I've noticed a difference between FortiManager and FortiGate that I want to understand, and I'm hoping someone can help.We have a group of FortiGates (v7.4.5 build2702) that were recently added to a FortiManager (v7.4.5 build2553). If I log into one of the FortiGates, I can see that we have an SSL-VPN setup that limits access to specific hosts and then has two groups of hosts - but the negate switch is turned on, which means anyone can try to connect EXCEPT someone in one of those groups:  When I look at the same config in the FortiManager, there is no negate switch, meaning only those groups can try to connect - the opposite of what we want:  My concern is that if I push the config from the FortiManager, it will not push the negate switch, and I'll lose access to the firewall as I'm coming through the SSL-VPN.If you're building a VPN from scratch, how do you configure the negate switch in FortiManager? Thanks

Hi All,Been searching through docs but haven't found a clear answer...What TCP / UDP ports are required for FortiClient to comm with a cloud hosted EMS? Is it all just over TCP 443?And then - with all the individual services (exe's) installed with FortiClient, which specifically will comm with EMS?If there is a doc published somewhere please share;Thank you!FortiClient FortiCloud Products 

Hello Fortinet Community,I am currently working with a FortiGate firewall 61F v7.2.6 setup where I have a VLAN switch interface named bgroup0 with a physical connection to internal3. The IP address assigned to bgroup0 is 192.168.1.1/24, and it is connected to an Aruba switch.The goal is to have new devices that connect via LAN cable to the Aruba switch send DHCP requests to the bgroup0 interface. However, for security purposes, I would like these devices to receive IP addresses from a different subnet, such as 192.168.2.0/24. I initially tried using a secondary IP, but due to subnet conflicts, this did not work as intended.I am considering configuring DHCP Relay on the bgroup0 interface to forward these DHCP requests to another DHCP server(internal2 or internal5) that is configured to assign IP addresses in the 192.168.2.0/24 range. However, I am uncertain about the exact configuration steps required to achieve this.Could anyone provide guidance or confirm if this approach is feas

I need to use Azure Front Door as a WAF up front to on-premis Fortigateand with the FrontDoor_Header_Check - used to Application Control function block whole traffic except FrontDoor ID and i'm not sure how to create/which parameters to used to custom app signature for this traffici have only X-Azure-FDID number, i can't find anythink corrent in to Azure documentation https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-apply-and-validate-a-custom-applica... is not really legibledoes someone have any experience with this and can give me any direction?

Hello everybody, I have a Fortigate F60 device (v 7.2.10).this Fortigate is implementing a conditional DNS for the Wi-Fi interface.For some internal domain, I registered some DNS records:192.168.1.1 is the router address.Normally, everithing works, fine. If I try to ping one of the registered names (for example vpn.xxx.com):   10.1.0.1 replies to the echo request. 10.1.0.1 is the Fortigate address.These are my network settings:  So far, so good. Now I try to connect via Cisco Secure Client to a VPN.Regarding network settings, nothing has changed. My address is the same, Router address is the same, DNS address is the same. The interface is the same, so, if I ping the same address as before, I expect 10.1.0.1 to answer (as before), but now: 79.9.x.x is replying. Who is 79.9.x.x? Is the Fortigate WAN interface:And the domain vpn.xxxx.com, if I put it into the browser, is not reacheable anymore, because I think DNS is not functioning correctly. What am I missing?Thank you fo