Solved

For the FortiDeceptor is there an official document (matrix compatibility type) as is done for FMG and FAZ ?Also among the Fortinet Fabric I mentioned below, can you confirm that the ISOLATOR interacts only with these: Fortigate - YESFortiAnalyzer - YESFortiManager - NOFortiSandbox - YESFortiIsolator - NO Best regards

Hello,We have a hybrid configuration on our domain. When we receive mail from our M365 mailboxes to our on-prem exchange mailboxes, the mail is classified as fortiguard spam outbreak. We has opened a case. Tac engineer gave the following suggestion;1) Change the level from 'High' to 'Medium'.2) Place the domain or sender IP in the Safe list (it will bypass the entire AntiSpam profile).3) Create a specific Recipient policy with the AntiSpam profile where FortiGuard Spam outbreak protection is disabled.4) Set the spam outbreak protection time to minimum (6 minutes).I wonder if I change the outbreak protection level to low or medium, how will this affect us?

Model: Fortigate 60C (FGT60C) When connect to console it has the following error message. The firewall can boot up and functioning. Is there any way to replace this disk ?And what disk is this ?What is the function of fgtag.c ?  Thanks.   

We recently made some changes to our DNS server which now has a new IP addess.  When connecting via Forticlient, all network adapters are reverted back to the old IP address causing network drive mapping issues. Changing the settings on the adapter will work while connected through the VPN, but no matter what, the next time a user logs in, the old settings take precedent again. I have manually configured the adapters to the correct DNS address.I have done all the ipconfig / related commands I have tried other solutions from similar posts on this forum and others, but nothing prevents the VPN from changing the settings. Has anyone run into this before, or know of a solution?

Question regarding FortiManager.Is there any way to only show interfaces for the devices we have, as opposed to the entire product line? We typically use FGT 200F, 201F, 80F, and 60E/F devices. When I want to configure normalized interfaces, I have to wade through every model of device that Fortinet supports in that version of FMG. If I search just for the device type (e.g. 60F), find the port, then make a change, it goes back to the default view of everything and I have search again. When I'm working on building normalized interfaces for a bunch of devices, that can be difficult to deal with and I end up using port specific configurations instead of normalized ones. It would be great if I had the option to choose what devices I want to see in the normalized interface section of FMG and it was a setting that was saved.

When I used the FortiConverter to convert my ASA config into FortiGate, I really didn't care about the Phase2 VPN names. Now the migration to the FortiGate is done and I find that I would like to rename the Phase2 interfaces.  Is this possible after the fact?  I know it's not possible in the GUI, but thought it might be via CLI however I wasn't able to figure it out just poking at the CLI.

HelloI'm looking for to update/upgrade in our company the FortiClient VPN from 7.0.1 to 7.4.0. I've searched for the parameter but I could found it. Does anyone know if this is possible or not to update/upgrade the client instead of uninstall the old one and install the new client SW? #Produkt-Downloads | Fortinet-Produkt-Downloads | Support Thanks and regards,Daniel

Hi all, i have stubborn customer insisting on Rustdesk as a support tool for desktop support.Advising him of migration to Anydesk or something similar didnt helped.So, question:FG80f configured to allow necessary ports (21114-21119) are configured, nothing is blocked:  On link below is instruction about similar issue, configured for that particular policy without help:ArticleID 274423  All security profiles are disabled, pure NAT internet access without restrictions.So, i can confirm that Rustdesk is not blocked, on diagnose flow also didnt saw anything unusual, but tbh what should i diagnose.Did somebody else had similar issue with Rustdesk? ty,Drazen 

For FortiDeceptor is it possible to configure a different port than port 1 (used by mgmt network) with function for license validation, FDS services, Web filtering and other ?Speaking of the physical appliance can ports 2 through 8 be used only to deliver the decoy services ?Thank everyone in advance!

I've recently migrated our primary firewall from an ASA to a FortiGate 600.  Don't get me wrong, I love Cisco but the FortiGate firewall has been a HUGE improvement and I don't regret the change for a moment!  However, there was one thing about the ASA that I loved and has saved my butt more than once.  With every "commit" I made, I had the ASA spit out a CLI of what change I just made.  So like if I made some new service ports in the ASDM, when I hit "apply" I'd get an out put like so:object service TCP-7046service tcp destination eq 7046description Nav Client Servicesobject service TCP-7047service tcp destination eq 7047description Nav SOAP ServicesThen I would copy that info and place it into my own personal change log with a little note of what I was doing, so I've got my own personal change log of every change made.  An example entry:4/30/20241. Create the NAV ports on the ASAobject service TCP-7046service tcp destination eq 7046description Nav Client Serv

Hello, I have a FortiSIEM on VM, the license expires in 1 month and we will not be able to contract support again until the first days of next year.The question is what will happen when the license expires, what limitations does it have?Is FortiSIEM still functional?Thanks.

Hello Team! I am using a FortiGate 40F model FG-40F with a configuration which consist of a VDOM root (management, operation mode NAT) and a VDOM transparent (operation mode transparent).  The VDOM root is only use to give access to internet:  The VDOM transparent is only use to stablish a firewall between a network called LAN and a network called WAN:  My objective is to monitor the Fortinet sending get SNMP from a PC connected to the port 2 (Inside lan 2).I have configured the System > SNMP in this way:  My problem is that the Fortinet receives the SNMP get but not answer me:  I am sending the get SNMP with iReasoning Browser: I amnot using HA or trusted hosts (I have tested to add my pc to trusted hosts but the behaviour does not change), I have checked the threads: SNMP don't response traffic, SNMP response and SNMP no response: timed out but I can not solve the problem. I give you more information that could

Hello everyone,currently we are hanging in the SAML Entra SSO Setup. I checked the recommends Articles here in the Support Forum and watched serveral Videos.Firmware: v7.4.5 build2702Model: FortiGate 101F After the SAML login via the FortiClient and Enter the M365 Credentials, follwing Error Appear: Configuration on the Fortigate:User & Authentication > Single-Sign-onService Provider ConfigurationAddress: "forti-fqdn:6443" Entity ID: "http://forti-fqdn:6443/remote/saml/metadata/" Assertion consumer service URL: "https://forti-fqdn:6443/remote/saml/login" Single logout service URL: "https://forti-fqdn:6443/remote/saml/logout" Identity Provider ConfigurationEntity ID: "https://sts.windows.net/xxxx/" Assertion consumer service URL: "https://login.microsoftonline.com/xxxx/saml2" Single logout service URL: "https://login.microsoftonline.com/xxxx/saml2"  Certifcate Import from Entra  Additional SAML AttributesA

Hi,Is it possible to have the Fortigate perform a ICMP-ECHO to a IP Address before it sends a DHCP Offer to a client device. Have had an issue with duplicate IP Addresses on overlapping scopes / ranges that have static IP Addresses configured. This could be resolved with the DHCP server testing to see if the IP address is already in use in advance rather than relying on the client device to perform this function, I.E sending out an arp before accepting the DHCP Offer.  Any help would be much appreciated, thankyou. 

The customer has lost their collector LOGIN password we needed to login to clean the disk space from needless clickhouse service running now we have to re-install unless there is a safe procedure on the collector for Rocky Linux to reset the password. Has Anyone done this? The clients collector presently is  7.1.3.0165  was running on Azure Cloud VMOur super is 7.1.3If I cant reset the password then;We are new to the install procedures, ( i.e Ive never done an install before)  I'm seeking advice on the most stable version to install? do we use 7.1? or 7.2?Collector VM is on Azure (Cloud). Would the setup be the same  process as onPrem VM? Which All in One build do I download from here? https://support.fortinet.com/support/#/downloads/firmware Thank you , really need the help.

Hi I haven't used this feature before and need to set it up, have a question if someone can help? lets say you create a web filter that has some categories set to allow and others set to authenticate.....when the user browses from 1 site in the first authenticate category, then moves to a site in a different authenticate category, do they need to enter their details again or is it just the initial authentication?  thanks 

Hi folks this is my first post here and my first parser in FortiSIEM.  I have the raw logs. How do I develop the XML in the body, to grab the fields in the log?  Not sure of the approach here.Hmm Apparently I've managed to post incorrectly. I have poured over the docs and I am not getting it.I have my regexe here:Account Id":"\[\\"([0-9a-fA-F\-]+)\\Attack Module":"\[\\"(.*?)\\"Attack Time":"\[\\"(.*?)\\Code Processed":"\[\\"(.*?)\\Command Line":"\[\\"(.*?)\\Computer Name":"\[\\"([0-9A-F\-]+)\\ OR THIS Computer Name":"\[\\"([^\"]+?)\\"\\]Logged In UserName":"\[\\"[A-Z]+\/([^\\]+)\\\"\]\" OR POSSIBLY THIS Logged In UserName":"\[\\"[A-Z]+\/(.*?)\\Message":"\[\\"(.*?)\\"Morphisec Version":"\[\\"(.*?)\\"Parent Process Command Line":"\[\\"(.*?)\\"Protector IP":"\[\\"(.*?)\\"Threat Description":"\[\\"(.*?)\\"Threat Module":"\[\\"(.*?)\\"Threat Name":"\[\\"(.*?)\\" I have this raw log:2024-09-26 15:55:15 Morphisec-EPTP INFO MORPHISEC_ATTACK {"Account Id":"[\"0cebd16e-e

I have a Fortigate with a LAN interface with a static IP address (no DHCP enabled) which provides internet services to my internal network. The LAN interface is set up as a "DNS Service on Interface"  which forwards any host DNS queries to the system DNS. Therefore my host has been configured with the LAN interface IP address as the preferred DNS server address. However, in the Fortigate DNS page I cannot specify that I want to use system DNS and I am given just two options: Use FortiGuard Servers or Specify (which requires me to write down static IP addresses). I am using Fortiguard servers (i.e. primary and secondary DNS servers) but my WAN interface (which has both DHCP and Override internal DNS enabled) uses my ISP DNS server (i.e. Acquired DNS). I want my LAN interface to use my ISP DNS server and acquire its address automatically as my WAN interface already does, but I am not sure what DNS server is being used to resolve my host DNS queries as the Fortigate ha

Hello Fortinet Community,I'm seeking advice on the best practice for setting up two FortiGate 121G units in an active-passive HA pair configuration, alongside two FortiSwitch models FS148F and FS124F (does not support MCLAG). I'm currently evaluating two potential topologies and would appreciate your insights on both, particularly around VLAN configurations and any relevant design considerations.Here are the two topology options I'm considering:Daisy-Chained Topology:In this scenario, the two FortiGate units in HA mode will be connected to a daisy chain of FortiSwitches (FS148F and FS124F). The switches would be stacked for redundancy.Mesh Topology:Each FortiGate in the HA pair would be connected directly to both FortiSwitches. This creates a more distributed setup with each switch directly connected to each firewall for greater redundancy.Questions:How would VLAN management differ between the daisy-chained and mesh topologies?What would be the most efficient way to handle VLANs with t

Hi Community, I’m currently trying to install the CylancePROTECT Connector. While the connector installed successfully, I’m encountering issues with the connector dependencies, which are not installing properly. I’ve attached an image of the error message for reference.  Could anyone provide guidance or solutions to resolve this issue? Any help would be greatly appreciated! Thank you! 

For the FortiIsolator is there an official document (matrix compatibility type) as is done for FMG and FAZ ?Also among the Fortinet Fabric I mentioned below, can you confirm that the ISOLATOR interacts only with these products:Fortigate - YESFortiAnalyzer - YESFortiManager - NOFortiSandbox - YESFortiDeceptor - NOBest Regards

Hello, the below parser xml is failing testing on 7.1, any help is much appreciated. <eventFormatRecognizer><![CDATA[.*Vendor _ATTACK\s+]]></eventFormatRecognizer><parsingInstructions><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[.*Vendor Name {<_body:gPatMesgBody>}]]></regex></collectFieldsByRegex><setEventAttribute attr="eventType">VendorAlert</setEventAttribute><collectAndSetAttrByJSON src="$_body"><attrKeyMap attr="accountid" key="Account Id"/><attrKeyMap attr="VendorAttackModule" key="Attack Module"/></collectAndSetAttrByJSON></parsingInstructions>

Hello all, We have a few customers who use a FortiGate and are experimenting with deploying ChromeOS. Through ChromeOS you're able to push the FortiClient VPN Android version to the device. We would like to offer the right configuration for our customers without offering a tutorial/guide on how to create the correct configuration themselves. We noticed the FortiClient VPN Android version supports JSON files which can be used to add the settings automaticaly. Unfortunately we're unable to find the correct JSON script to do so. Where can we find the JSON file or how can we generate one? I would guess there is a template available somewhere! Thank you in advance!

Hi, Currently using FortiGate VM in FortiOS version 7.0.15. Based on the details below, it looks to be not supported. Is there another firmware which we can upgrade to, to enable the long vdom name? Followed this link to enable long vdom name: Long VDOM names - Fortinet Community, but unable to find the said config parameter - 'set long-vdom-name' It was indicated as well in the CLI reference that the parameter set long-vdom-name may not exist in some models: https://docs.fortinet.com/document/fortigate/7.0.15/cli-reference/339914554/config-system-global Thank you!

Hello everyone! I would like to know if there is a way to exclude specific VLANs from passing inside a fortiswitch ISL trunk or to pass only management traffic between a specific ISL link. By default fortilink passes all VLANs between Fortiswitches connected to each other. Yet, I have a requirement to not allow specific VLANs to pass through a ISL formed between 2 FortiSwitches, therefore forcing data traffic to go through a 3rd party switch connected to both of these Fortiswitches. KB: https://community.fortinet.com/t5/FortiSwitch/Technical-Tip-Seperate-Inter-Switch-Link-ISL-between-Managed/ta-p/224568states about separating the traffic, but my requirement does not need the second link to pass data. Is there a simpler way to achieve this? Did not want to go into modifying MSTP instances and all of that. Thanks in advance for any suggestions and tips! Regards FortiSwitch