Solved

Hello, I am new to FortiSOAR and need some help understanding how to achieve one of my use cases.I am getting alerts from Microsoft Defender for Endpoint through Data Ingestion and all is well on that front. However, when an alert that indicates that a suspicious file has been observed I want to add the filename, filehash and so on to the alert with a playbook. This is where I struggle. I need some pointers to know HOW to get the information from the Sourcedata to populate the alert itself. I have tried by looping through the objects array but I can't get it working.I can provide screenshots and config if needed.Thanks in advanceAlexander

We had recently been informed that we need to update our VPN clients.  Our user goes to this link https://links.fortinet.com/forticlient/mac/vpnagent to get the latest update.  But when we tested it this week, both fresh install / update comes up with the same error "Failed to connect to the update server." We had tried on two devices.   We also went to the website itself - Product Downloads | Fortinet Product Downloads | Support.  And we see the same error.The link for the windows update/fresh install works fine. https://links.fortinet.com/forticlient/win/vpnagent Any suggestion?

Hello everybody, I have a firewall policy regarding an IPSEC tunnel. This policy is saying that all the addresses that belong to ipsec_range can reach the internal destinations.This policy, if I connect, is working fine:I can reach on of  my VMs: Everything is all right.What's the problem?The user that has connected to the tunnel, belongs to a group: Let's suppose I  want to say:I want to filter the source not only by ip address, but also by user group. the same user has an address in ipsec_range and also belongs to IPSEC_USER.Everything should be okay, right?No! I can't reach my VM anymore. What am I doing wrong?  

Hi,I have configured Fortigate to send traffic logs to a remote syslog server.The GUI displays the destination IP along with the corresponding domain correctly.But only the 'dstip' is sent to syslog server, while the 'domain' is not included.How can I send the 'domain' along with the 'dstip'?

Hi,I'm managing 30 branches, all connected via MPLS and running FGTs as firewalls.There's a main site with a DC (10.7.7.80).I wanted to authenticate fortigate administrators via LDAPS and use their AD accounts for login.However, it is working in some of the sites, and not working on the rest. If i check the logs on the main site, I can see the packet is acceptedbut I can also see this session timeout if I click on this line of log:Some of the FGTs are able to contact the DC, when I look on their logs, it looks the same just without this "session timeout". I tried to increase the ldap query timeout on appliances which have this problem: set remoteauthtimeout 15 set ldapconntimeout 8000 but still the same. Will appreciate any help and advices. Thanks!  

Hi, I am trying to set up FortiGate Web Authentication and SAML as idP but I am having issues, I am following this guide https://docs.fortinet.com/document/fortigate/7.4.4/administration-guide/33053 I have setup but the authentication portal is not kicking in, I have seen that on the Fortigate in the Interface, you can enable Security Mode "Capture Portal", does this need enabling as not mentioned in the guide? Overview of what I have done.1. Created Enterprise App in Entra ID.2. Created a group in Entra ID added users and assigned to App.3. Created a Single Sign-on on the FortiGate pointing to the Enterprise App.4. Create a group on the FortiGate and set the Remote Server to Fortigate the Single-Sign-on and the Enterprise App group ID.5. Created a Firewall rule to allow traffic out and added the Fortigate group created in step 4.6. Create a Firewall rule to allow traffic in. When I test from a client PC or the Enterprise App I get 2This site can

Hello, I am seeing constant alerts on my Fortigate under sslvpn events "sslvpn login failed" This is not coming from the authorized users. Is there anything that can be done on it.  Thanks

I have an IPSEC tunnel configuration that refuses to allow GUI re-configuration. Displayed error is -9999:-9999.Objective: I am migrating from one IP/ISP/fiber to another, at the remote location. Local (HQ) connection will remain the same.I wish to run both tunnels until configuration is up and running. Otherwise, termination of existing tunnel disconnects all communication with the remote fortigate 80e.I originally configured the HQ connection to point to the DynDNS address of the remote site, I am unable to reconfigure this connection to a fixed IP.This connection is up and running. Firmware v.7.2.3 on both fortigates. When I change the Remote Gateway from Dynamic to fixed, it accepts the change, it recognizes and validates the IP address (malformed addresses are rejected). and when the 'check mark' is clicked the changes get locked in.But, when I click the OK button to accept the configuration, I am greeted with a red 'tag' in the lower right that displays and unhelpful '-9999:

Dear Team, My firmware version is 7.4.4. We are routing our webservers behind through cloudflare proxy. Here what are we getting in logs are the cloudflare proxy Ip address ranges. Pls guide me how to configure the fortigate to get the Original ip of the source traffic or how to Include the original visitor IP in fortigate logs.  I have already done as per the process defined - https://docs.fortinet.com/document/fortiproxy/7.4.4/administration-guide/764110/logging-client-ip-for-forward-traffic-and-https-transaction FGT (global) # sh full-configuration config web-proxy global set ssl-cert "Fortinet_Factory" set ssl-ca-cert "Fortinet_CA_SSL" set fast-policy-match enable set ldap-user-cache disable set proxy-fqdn "default.fqdn" set max-request-length 8 set max-message-length 32 set strict-web-check disable set forward-proxy-auth disable set forward-server-affinity-timeout 30 set max-waf-body-cache-length 32 set webproxy-profile "default" set learn-client-ip enable set alway

I'm working on migrating my home OpenSUSE machine I'm using for freeradius server to authenticate admin and VPN users on my FG40F(7.2.8) from Leap 15.3 to 15.5(on a new machine). Obviously 15.5's repo has a newer version of freeradius-server image.Then when I simply copied "clients.conf" and "users" file to the new machine and pointed the RADIUS config at the 40F to the new machine, the RADIUS auth request was simply dropped without showing much reason in debug output other than "missing mandatory attribute".After some research and investigation, I figured out I had to set "require_message_authenticator = no" in the client config for the 40F at the server, which was not required with the older version of freeradius, in order to let the server accept those requests from the 40F.So I found a way around but now wondering why 40F wouldn't send the Message-Authenticator attribute with the request.Even with 7.4.4, the admin guide says it doesn't send the attribute.https://docs.fortinet.com/d

Hello I'm having problems with local traffic generated by Fortigate and SDWAN rules. When one of the links that make up our SDWAN goes offline, I receive the following error message: "unable to connect to fortisandbox. Either the appliance is not reachable or this fortigate is not authorized" Then users start receiving SSL certificate error messages when they try to access a web page, or a message like this: "Web Page BlockedAn error occurred while trying to rate the website using the webfiltering service. Web Filter Service Error no correct FortiGuard information" I tried the following commands (available at: link  ) but the problem persists: config log fortiguard setting set interface-select-method sdwan end config system fortiguard set interface-select-method sdwan end I have a 60F with version 7.0.13 build 0566 (Mature)

Hello Community, Is there any limitation on the mock output in the playbooks. I was using the results of couple of SIEM queries as a mock output but the playbook didn't work.Appreciate your assistance.Thank you.

Hi , trying to update fortiweb running in an esxi host when i go to the Fortinet support portal , i see so many different versions , which one i need to download ?mine is v7.4.3 build 638(GA)  thank  you

Hello All,I'm new to Fortigate, so be gentle :)I have a Fortigate 400F that's set up and working, connected to the internet through a cellular router (temporary for now) that gives the fw a dynamic IP on the WAN port.  I want to route https traffic from the WAN port to an internal IP address.  I've followed the admin guide (FortOS 7.2.10), followed multiple online articles and youtube tutorials, and although the setup seems very simple and easy to understand but I cannot seem to get it to work. My basic understanding of the process is:1) Create virtual IP with source address of 0.0.0.0 mapped to my internal ip 10.35.1.11 and select port forwarding of 443.2) Create firewall policy to accept traffice from WAN interface to Internal Interface, source = any, destination = internal IP, service = https. To rule out my ISP being the problem, I tried to just connect directly to the WAN port with my laptop, set the IP of the WAN interface to a static address, set my laptop to

Hello! Please, help me. We use FortiGate 200E in our company.I have difficulty using the VPN. The speed when connecting to VPN is only 1-2 mbps. How can I fix this? The channel at both ends of 50 mbps

Hi We have a few FortiGate appliances managed by 1 FortiManager. i need to create a large number of IP subnet objects, which will be shared by more than 1 of the FortiGate appliances. Is there a way to import objects? I know on a Fortigate itself, I could cut/paste the commands in the CLI. So, is there a way of doing this in the FortiManager cli?Many thanksRoy

Good morning , guys I have fortigate in my headquarters , and now I'm going to close a VPN between this headquarters and branch , the question and I believe not but it does not hurt to ask with this tunnel I can use Fortinet Singles Sing On agent configuration that is in my AD . Or will I have to create Webfilter and application Control separately for this firewall ?

Hi everyone,I'm setting up a FortiSIEM Supervisor All-in-one (AIO) with version 7.2.0, but I've encountered an issue with the Collector.When I go to Admin → Setup → Collector, there is no option to configure the Collector’s IP or designate the server as a Collector. It seems like the Collector role is not enabled by default in my AIO environment. I also checked using systemctl, and the phCollector service does not exist on the system.Steps I’ve already taken:I checked the /opt/phoenix/config/phoenix_config.txt file to verify if the Collector role is enabled, but it seems unrecognized.Tried to find and start the Collector service, but the system says it doesn't exist.Restarted the main FortiSIEM services (phoenix), but the issue persists.I need to monitor events from Windows servers, but I'm encountering issues with WMI/OMI. I'm receiving errors such as "WMI failed (Login to remote object error)" and "OMI failed (Win32_OperatingSystem Result not found via OMI)", even though everything i

Hi,Could you please provide advice on how to setup an email alert if a local client device on LAN goes offline using automation stitch or similar? Is this possible?Articles that Im looking into.https://community.fortinet.com/t5/FortiGate/Technical-Tip-Creating-automation-stitches/ta-p/190594https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/351998TIA :) 

I recently bought a Fortigate 60F, two FortiSwitches and a number of FortiAPs to upgrade a small Dell/Sophos network at a small campus. While setting up the devices in the lab, I found that I can't use both A and B ports (with the Foritlink symbol) on the Fortigate at the same time. Regardless of which port (A or B) and which switch you connect first, the second port will not light up. Therefore  Fortigate System - Fabric Management can only see one switch at a time.  I was using port 24 of the switch to connect to the firewall per instruction label on the switch. I also tried just connecting to any port on the Fortigate and changing the port mode. I don't have the firmware versions at hand but they should be fairly recent. What's going on? Can't image  something this simple to not work. Can someone help?

Hello Experts, This may be a basic item.Why is Loopback Address necessary at SD-WAN?Is it used for SLA? If SLA is not important, can we omit it? Thanks in advance, 

I have two fortigate , one of them is managed by a company and the other is now acquired by a company and we are installing it. I need to configure it like the other Security Fabric Settings , I'm looking at several links but I can't get it to work. would you have any videos I can watch to solve this ? Imprimir Firewall configurando the current firewall  

A collector with high cpu usage. It's reporting, procs are up.. the stop start  seems to be very short in duration what is it actually doing? Thanks

Hello, do you have a video I can follow to close a VPN between two fortigate? What would be the best practice?

 Hello everyone, I want to set up the "Push Notification" option for FortiToken mobile. I followed the technical tip here: https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiToken-mobile-push-notification/ta-p/195578It works very well, but I would like to know if I can configure it for my two WAN lines?FTMThank you,