Solved

The customer has lost their collector LOGIN password we needed to login to clean the disk space from needless clickhouse service running now we have to re-install unless there is a safe procedure on the collector for Rocky Linux to reset the password. Has Anyone done this? The clients collector presently is  7.1.3.0165  was running on Azure Cloud VMOur super is 7.1.3If I cant reset the password then;We are new to the install procedures, ( i.e Ive never done an install before)  I'm seeking advice on the most stable version to install? do we use 7.1? or 7.2?Collector VM is on Azure (Cloud). Would the setup be the same  process as onPrem VM? Which All in One build do I download from here? https://support.fortinet.com/support/#/downloads/firmware Thank you , really need the help.

Hi I haven't used this feature before and need to set it up, have a question if someone can help? lets say you create a web filter that has some categories set to allow and others set to authenticate.....when the user browses from 1 site in the first authenticate category, then moves to a site in a different authenticate category, do they need to enter their details again or is it just the initial authentication?  thanks 

Hi folks this is my first post here and my first parser in FortiSIEM.  I have the raw logs. How do I develop the XML in the body, to grab the fields in the log?  Not sure of the approach here.Hmm Apparently I've managed to post incorrectly. I have poured over the docs and I am not getting it.I have my regexe here:Account Id":"\[\\"([0-9a-fA-F\-]+)\\Attack Module":"\[\\"(.*?)\\"Attack Time":"\[\\"(.*?)\\Code Processed":"\[\\"(.*?)\\Command Line":"\[\\"(.*?)\\Computer Name":"\[\\"([0-9A-F\-]+)\\ OR THIS Computer Name":"\[\\"([^\"]+?)\\"\\]Logged In UserName":"\[\\"[A-Z]+\/([^\\]+)\\\"\]\" OR POSSIBLY THIS Logged In UserName":"\[\\"[A-Z]+\/(.*?)\\Message":"\[\\"(.*?)\\"Morphisec Version":"\[\\"(.*?)\\"Parent Process Command Line":"\[\\"(.*?)\\"Protector IP":"\[\\"(.*?)\\"Threat Description":"\[\\"(.*?)\\"Threat Module":"\[\\"(.*?)\\"Threat Name":"\[\\"(.*?)\\" I have this raw log:2024-09-26 15:55:15 Morphisec-EPTP INFO MORPHISEC_ATTACK {"Account Id":"[\"0cebd16e-e

I have a Fortigate with a LAN interface with a static IP address (no DHCP enabled) which provides internet services to my internal network. The LAN interface is set up as a "DNS Service on Interface"  which forwards any host DNS queries to the system DNS. Therefore my host has been configured with the LAN interface IP address as the preferred DNS server address. However, in the Fortigate DNS page I cannot specify that I want to use system DNS and I am given just two options: Use FortiGuard Servers or Specify (which requires me to write down static IP addresses). I am using Fortiguard servers (i.e. primary and secondary DNS servers) but my WAN interface (which has both DHCP and Override internal DNS enabled) uses my ISP DNS server (i.e. Acquired DNS). I want my LAN interface to use my ISP DNS server and acquire its address automatically as my WAN interface already does, but I am not sure what DNS server is being used to resolve my host DNS queries as the Fortigate ha

Hello Fortinet Community,I'm seeking advice on the best practice for setting up two FortiGate 121G units in an active-passive HA pair configuration, alongside two FortiSwitch models FS148F and FS124F (does not support MCLAG). I'm currently evaluating two potential topologies and would appreciate your insights on both, particularly around VLAN configurations and any relevant design considerations.Here are the two topology options I'm considering:Daisy-Chained Topology:In this scenario, the two FortiGate units in HA mode will be connected to a daisy chain of FortiSwitches (FS148F and FS124F). The switches would be stacked for redundancy.Mesh Topology:Each FortiGate in the HA pair would be connected directly to both FortiSwitches. This creates a more distributed setup with each switch directly connected to each firewall for greater redundancy.Questions:How would VLAN management differ between the daisy-chained and mesh topologies?What would be the most efficient way to handle VLANs with t

Hi Community, I’m currently trying to install the CylancePROTECT Connector. While the connector installed successfully, I’m encountering issues with the connector dependencies, which are not installing properly. I’ve attached an image of the error message for reference.  Could anyone provide guidance or solutions to resolve this issue? Any help would be greatly appreciated! Thank you! 

For the FortiIsolator is there an official document (matrix compatibility type) as is done for FMG and FAZ ?Also among the Fortinet Fabric I mentioned below, can you confirm that the ISOLATOR interacts only with these products:Fortigate - YESFortiAnalyzer - YESFortiManager - NOFortiSandbox - YESFortiDeceptor - NOBest Regards

Hello, the below parser xml is failing testing on 7.1, any help is much appreciated. <eventFormatRecognizer><![CDATA[.*Vendor _ATTACK\s+]]></eventFormatRecognizer><parsingInstructions><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[.*Vendor Name {<_body:gPatMesgBody>}]]></regex></collectFieldsByRegex><setEventAttribute attr="eventType">VendorAlert</setEventAttribute><collectAndSetAttrByJSON src="$_body"><attrKeyMap attr="accountid" key="Account Id"/><attrKeyMap attr="VendorAttackModule" key="Attack Module"/></collectAndSetAttrByJSON></parsingInstructions>

Hello all, We have a few customers who use a FortiGate and are experimenting with deploying ChromeOS. Through ChromeOS you're able to push the FortiClient VPN Android version to the device. We would like to offer the right configuration for our customers without offering a tutorial/guide on how to create the correct configuration themselves. We noticed the FortiClient VPN Android version supports JSON files which can be used to add the settings automaticaly. Unfortunately we're unable to find the correct JSON script to do so. Where can we find the JSON file or how can we generate one? I would guess there is a template available somewhere! Thank you in advance!

Hi, Currently using FortiGate VM in FortiOS version 7.0.15. Based on the details below, it looks to be not supported. Is there another firmware which we can upgrade to, to enable the long vdom name? Followed this link to enable long vdom name: Long VDOM names - Fortinet Community, but unable to find the said config parameter - 'set long-vdom-name' It was indicated as well in the CLI reference that the parameter set long-vdom-name may not exist in some models: https://docs.fortinet.com/document/fortigate/7.0.15/cli-reference/339914554/config-system-global Thank you!

Hello everyone! I would like to know if there is a way to exclude specific VLANs from passing inside a fortiswitch ISL trunk or to pass only management traffic between a specific ISL link. By default fortilink passes all VLANs between Fortiswitches connected to each other. Yet, I have a requirement to not allow specific VLANs to pass through a ISL formed between 2 FortiSwitches, therefore forcing data traffic to go through a 3rd party switch connected to both of these Fortiswitches. KB: https://community.fortinet.com/t5/FortiSwitch/Technical-Tip-Seperate-Inter-Switch-Link-ISL-between-Managed/ta-p/224568states about separating the traffic, but my requirement does not need the second link to pass data. Is there a simpler way to achieve this? Did not want to go into modifying MSTP instances and all of that. Thanks in advance for any suggestions and tips! Regards FortiSwitch 

I have a campus network with 63 FortiSwitches managed by a stack of 1101E Gates in an HA.MSTP is running in it's default state other then I did lower the priority of the distribution switches I want to be the root bridge.My question is what is the best way to setup MSTP? Right now I'm using instance 0 but I did see a MSTP best practice paper that suggested not using instance 0.  I have a single region and 68 Vlans. I would like to keep using instance 0 just because it's simple. I would appreciate any recommendations. 

Following this link - https://docs.fortinet.com/document/fortiauthenticator/6.0.0/cookbook/812128/creating-a-local-ca-on-fortiauthenticator I am a little confused, the cookbook suggests you have to create a user certificate? i have over 500 LDAP users, that cant be right can it? it also suggests you create the local users on the FAC? thats a bit pointless, my FAC is connected to AD, so why would I need to create the users again,  Im looking for a solution where the users connected to the business WIFI, using their machine certs, not sure why we need user certs, is it another check or something? thanks 

Dear, please help me in this case: I have a Fortigate 100F which was return to the factory and configured as an edge in another datacenter.The internet provider gave us a private WAN IP x.x.x.x; but to go out to the internet, we must do it through a secundary WAN IP y.y.y.y.The Firewall was already registered in FortiCloud before the factory reset. Currently it appears registered in FortiCloud.The system information on the dashboard confirms the WAN IP y.y.y.y; but when trying to connected to FortiCloud it gives us "FortiGate Cloud Internal Error".When generating a PING using the CLI witch the source-ip y.y.y.y to the service.fortiguard.net URL, I do manage to reach it, but when I connected to the internet, it gives me the aforementioned error.When reviewing the traffic I see that in the rule Implicit Deny the origin y.y.y.y with destination to the Fortinet DNS, port TCP/853 es accepted. 

Hello,I have a requirement, only 5Ghz and 6Ghz  need to be available for an office.Actually, only 5Ghz is available for users and it works well.I checked this link https://docs.fortinet.com/document/fortigate/7.2.0/new-features/169732 but I need more explications.I created a 6Ghz SSID, select WPA3 SAE et activate H2E.Then for the Operation profile, I'm not sure according to my requirements. I understand, all the bands needs to be ON for the wifi6E, but I don't want 2.4Ghz, so I created a profile where Radio 1 is disabled, and link it to the new 6Ghz SSID. I can't made a real test until next month. Another question, if on the 6Ghz SSID, I keep active the 2.4Ghz, it's only for 6Ghz use or a user can connect to this frequence ?I want to know if the configuration is correct or if you have some tips. Thank you  

I have 400F device and on this device we have configured around 1000 site to site VPN tunnels in active passive mode. We need to configure 330 link monitoring entries. I am able to configure 256 entries after that getting an error reached maximum entries. How can we increase the limit of link monitoring entries.  

What are the ramifications of disabling the clickhouse-server.service,Or asked another way what criteria would I need in order to make an informed decision? Id like a little more knowledge about clickhouse and if its set up by default and how to know if it actually is being used.I I don't think the log rotation is set up on a lot of the clients collectors at any rate so periodic removal of logs has to take place until there is a final solution. Thank you in advance. 

Hello Everyone,   I have a production device that has already had our template that is for 1 MPLS -1 internet connection ran on it. I want to add another internet connection to that device. I already have a template for 1 MPLS- 2 internet connections which would be perfect. Would I be able to just add the variables for the 2nd internet connection and run the 1 MPLS-2 internet template even though it will have all the same variables from when I used the 1 MPLS- 1 internet except for the additional 2nd internet connection, or will it fail since there will essentially be duplicate variables? I thought I remember hearing or reading somewhere that it will just skip them, but maybe I made that up.  Thanks!

Running a Fortgate 60E running firmware 7.4.5 with a Fortilink connection to a Fortiswitch 124E PoE switch running firmware 7.6.0.  I have created an active trunk using two ports (15 and 17) on the switch controller and trying to change the vlan from the default to another VLAN I have created. When I do this in the GUI I get a red banner in the upper right that says "Failed to Save Changes". I get no other information that I can find in the logs or documentation on why this would happen or how to resolve it.

Hi Everyone, i have a problem when i try to connect the EMS 7.2.5 to my LDAP server the same parameters work well in version 6.4.9 and 7.0.13 but since the update to version 7.2.5 impossible to reconnect the LDAP server i have the error message: unable to read LDAP response packet: unexpected EOF does anyone have an idea about this error Thanks for your help 

Hello everybody, We are facing an issue where the Application control isn't showing in the security profile in our FortiGate firewall we are using 60f we noticed this problem since we updated the firewall to the latest version 7.6.0, also note that when I go to certain policy it doesn't show when I edit the policy ,but strangely when I point my mouse on the security profile part in the policy it shows the application control and i can edit it.can anybody tell if this is a bug or something else. Thanks in advance

I have installed Forticlient on Debian 12 But it shows the error. Then i installed it on ubuntu 22.04 but it also shows same error. On windows and android vpn client works fine but does working on linux any one knows the solutionFailed to connect to vpn tunnel please try againDetails Error Error invoking remote method keytar.deletePassword error unknown or unsupported transport for address disabled  FortiClient @support 

We have Active/Passive with Virtual Clusters setup. With default HA configuration, the "link-failed-signal" is disabled. From some doc, it says the option is to enable/disable signaling to internal hosts when failover happens for fast switchover. So it sounds good but why it is disabled by default? Should I manually enable it? Please advise. 

Hello, When I register smartphones via dot1x auto registration, devices appear in the host view as "registered hosts." This is OK; it gets the job done. However, I couldn't find a way to modify the device type other than manually editing the host and setting it manually.  When a user has multiple devices (phones, tablets, PC, etc..) This creates a bit of complexity in the host view.IT admins have to sort things out manually for multiple devices with the same registered user. I tried to find a way around by using device profiling rules for iPhones and Androids by vendor name and DHCP fingerprint and confirming the device rule on connect. But it didn't work. (I know this profiling is for rogue devices; an already registered device would not hit this rule, but I tried anyway.)  Here is the question,  Is there a way to change the device type automatically after dot1x registration?It would be great to have Androids and iPhones sorted out with their icons a

Hello, Im trying to add the user: "user" to the group: "group1" using the api v2 of a fortigate v6.4.15Below is my request with the return (200:OK) but no revision_change, so its doing nothingAlso below the GET requests on the user and group1 to show the configs What am I missing ? Thanks for reading !   curl -k -X PUT -H "Content-Type: application/json" -H "Authorization: Bearer abcdefg" -d '{"member": "test"}' https://FORTI-URL/api/v2/cmdb/user/group/group1{"http_method":"PUT","revision":"5d01f6d0438463b2da7bd48c54508be3","revision_changed":false,"mkey":"group1","status":"success","http_status":200,"vdom":"root","path":"user","name":"group","serial":"FGT6xx","version":"v6.4.15","build":2095}    curl -k -X GET -H "Content-Type: application/json" -H "Authorization: Bearer abcdefg" https://FORTI-URL/api/v2/cmdb/user/local/test{"http_method":"GET","revision":"5380e9e62a96d94149368f7c05789ab7","results":[{"name":"test","q_origin_key":