Solved

How can I extract the existing logs from a fortianalyzer version 7.4.4 to CSV? They are asking me for the last 90 days for a particular analysis.Within the team there is an adom who receives the 4 fortigates and it is required to obtain this information from all of them.I tried to do it Through API but the documentation is limited,Has anyone achieved it?I don't know if the logs already existing on the computer could be converted to csv in any tool?

Dear Members,I work in a support team at our company, and we have been facing the following problem:Users must change their Active Directory passwords on a company computer when the password expires or if they forget it.After that, users work from home on their personal computers and must use the VPN with the FortiClient.In this situation, they cannot access the VPN because the Windows certificate has saved the old password.To resolve this, we need to update the certificate.Is there any way to minimize support efforts? For example, could FortiClient prompt the user for the new password, or could the certificate be deleted when this issue occurs?Thank you in advance.

We got a team who manage the content of our corporate website. And everytime the push or publish their design/changes via wordpress. The fortiweb detected it as XSS.Is there a way to exempt the user ip source for any XSS detection or any better approach to fix this.FortiWeb 

Hi, I have problem with reseting FGT 200F. FortiGate-200F login:username: maintainerpass: bcpbFG200FT*********not works, I receive message "Login incorrect" When I press button, it just goes reload.I don't have forticloud. How can I reset it?please help.

Hi, I'm using fortianlyzer and have a question during dataset creation for report output.I wrote the query below to create a forticlient uuid for the logged-in vpn user and it works fine.Below is an example of a table made of query statements and queries. - select user, fctuid from $log where $filter and ( ( ( lower(logid) = lower('0107045124')))) Here, the user name is different, and I want to put a condition so that only the same line with the fctuid value is output, but it doesn't work well  GROUP BY fctuidHAVING COUNT (DISTINCT user) > 1 I tried adding this section but it doesn't work well.

I recently required a factory reset on my cell phone. Soon after I realized I could no longer login to my Fortigate. The problem was both of my logins were protected by Fortitokens. I contacted support and they informed me all I could do was a factory reset of my Fortigate. I did not want to rebuild the Fortigate config from scratch. After some thought I started to look at my backup config files. I was fortunate to have a current backup of the config file of my active Fortigate, which I could just use, but I would be back in the same boat. Fortunately, I have a second Fortigate that is inactive. Using it and looking at an older backup that still had the default admin user info, I copied that information and pasted it into the current backup. This took a couple of attempts to restore the modified config file to the inactive Fortigate. Once I completed it successfully, I was then able to login using the old admin user. Once login I was able to remove both Fortitokens from the active user

I configured the SSL VPN and the clients can ping and access all the internal LAN but the internal LAN cannot ping, controls the VPN Clientsmy FortiGate is 100F with firmware version of FortiOS v6.4.15 build2095i do policy like the following screenshot: 

Hi there,I'm getting the errors "-5052" and after updating from 7.0.x to 7.2.x it's "-5053" when trying to connect using the FortiClient VPN on a Windows 11 machine. I verified login data, deactivated 2FA temporarily. Other machines / clients (even on Win11) do not have this problem.It is, however, possible to connect from the same client using the local admin account, so maybe something in the profile is broken. I tried as suggested in this thread:Steps to troubleshoot the FortiClient VPN connection issue:Verify network connectivity.Check VPN server settings in FortiClient.Disable firewall and antivirus temporarily.Update FortiClient to the latest version.Flush DNS cache using the command "ipconfig /flushdns".Remove any conflicting VPN or networking software.Contact Fortinet support for further assistance (couldn't provide a solution either).In addition I tried removing %localappdata%\Forticlient\ as suggested by a user, but this didn't affect anything. I did record logs, se

Hello, I'm facing a trouble with setting up the LDAP authentication: my LDAP server seems to be well configured, Connectivity and User Credentials works from the GUI.From console, I try: diagnose test authserver ldap "LDAP TEST" ldapreader password diagnose test authserver ldap "LDAP TEST" myaccount password ldapreader is the username setted for the connection to LDAP, myaccount is my username.Each time I get : authenticate 'account' against 'LDAP TEST' failed! (account is the account I test) I'd tried many settings for the User group, adding my user (from ldap) or adding a remote group in which I am, it doesn't work. Product: Fortigate v7.4.4   

I have abit of a dumb question doesn't forticlient update on its own?i had the latest version at the moment that was 7.4.0.1658 now there is 7.4.1 there is no button on forticlient to update directly the client 

Hello everyone,I have a FortiSandbox 2000E appliance with VM license, below is the SKU:(FSA-2000E-UPG-LIC-BYOL) can you confirm me that this license only handles the number of clones up to 20 ?On board the machine I have only Windows 7, 8 and 10 keys after the upgrade in 4.4.6 I can download a WIN 11 but if I wanted to buy the license which SKU should I refer to ? Unfortunately I can find information referenced only for the new Sandbox F and G series

I'm setting up my first webapp on a brand new FortiWeb Cloud.The webapp is going to use the automatic certificates from Let's Encrypt; I also need to setup a very strict Geo IP Block.Turns out that Let's Enrypt is not going to work with that setup, as HTTP requests from blocked countries will be dropped.However, on the Let's Encrypt community someone got a solution:https://community.letsencrypt.org/t/whitelist-letsencrypt-server-ips/215833  How can I implement a whitelist for incoming HTTP request to /.well-known/acme-challenge? Thanks!Marco

I have a forgate 100DI am trying to use the API to create firewall addresses and update a policyI am on firmware 6.2.16 the latest for the 100DI have triedhttp://<IP>/api/v2/cmdb/firewall/address?access_token=<KEY> I get a 200 result but it never adds the address to the firewall  body example{'name': "test_IP_JP",'subnet': "1.1.1.1/32"''associated-interface': "Untrust"} but I get back a GET listing all the addressesfrom the api debug It looks right any suggestions?      

Hello,FortiMail We're using FortiMail in Gateway mode.We want to limit number of emails an user can send.All of the email traffic which gets into FortiMail goes from mail servers.As far I've seen there are only Session limits which I m afraid might block the mail servers instead of users.Any ideas? Thanks in advance.   

Hey,HI if some can point where to configure scenerio where when someone will visit `somewebsite.com` then it will get an error page with information " soory this service isnt avaiable any more".Is it possible to achieve it on WAF without creating another web server where WAF will have to forward traffic?  

I managed to manually install on a PC to test the Persistent Agent. Now I can register the PC but I still have a problem: when I open the browser I get the message that I have to register. Before reaching the registration page I am informed that the connection is not secure. (NET::ERR_CERT_AUTHORITY_INVALID).Once I accept the risk I can register. For authentication I use the domain user.I also find log messages in the Persistent Agent logs:2024-10-28 09:59:17 UTC :: peer CommonName = bradfordnetworks.com2024-10-28 09:59:17 UTC :: Checking Peer name fortinac.mydomain.com against Common or Subject-alternative-name entry bradfordnetworks.com2024-10-28 09:59:17 UTC :: Peer name "fortinac.mydomain.com" doesn't match "bradfordnetworks.com"2024-10-28 09:59:17 UTC :: Refusing to connect to trust_DISTRUSTED fortinac.it-present.com|bradfordnetworks.com|09:6e:cf:15:bd:ea:b9:1e:26:21:75:d5:86:9a:8e:37:15:f5:d4:a92024-10-28 09:59:17 UTC :: Connection failed! 1I installed the certificates as trusted

Hi,A few months ago we acquired a new customer that we have to manageTheir current Forti EMS version is 6.4.7I have read the necessary articles regarding upgrading from version 6.4.7 to 7.4.0It is a challenge to upgrade de EMS server, and all clients(workstations and servers) to version 7.0.11, then 7.2.4 and then 7.4.0.Wouldn't it be more convenient in this case to install/configure a new EMS 7.4.0 server?Then uninstall the old client and install the new clients.I am not (yet) familiar with the EMS tooling, so I do not know what the (im)possibilities are.And what about the license for temporarily having 2 EMS servers?I look forward to receiving advice.RegardsSteve

I want to check the IP address of the sender so that it is not blocked by the policy of the security device up to the proxy server.The following settings are included in order to use a proxy server when updating signatures or renewing licenses.At this time, which source IP address should be used for packets originating from Fortigate?Is it the Mgmt port? Or is it an interface for data communication close to the proxy server?config system autoupdate tunnelingset status enableset address “10.**. **. **” ⇒ IP address of the proxy serverset port 8080 

Myntra , refund money you should immediately contact Myntra's customer support: O-972-573-0058 and (available 24/7) report …

To Refund money from Ph0nepe for a wrong transaction, you should (immediately) contact customer support:081- 278√O2 259 (&) (available 24x7)call me..

Issue Description- A single launcher in FortiPAM can utilize multiple ports simultaneously- This launcher does not accept any additional parameters during executionConfiguration QuestionWhen a single executable (e.g., A.exe) needs to use multiple TCP/IP ports simultaneously (such as ports 2002 and 2007), how should the launcher and template be properly configured in  Technical ContextThis scenario involves:One launcher executable file (A.exe)Multiple TCP/IP ports (2002, 2007)No parameter input functionalityNeed for proper FortiPAM configuration settingsPlease provide guidance on the correct configuration approach for this multi-port launcher scenario in FortiPAM.

Hello Expert,I  enabled two factor authentication  on my remote ssl vpn configuration  (firmwave 7.2.9 build 1688 (mature) When I  simulate test with a user  gmail account, i am not receiving and activation code . I humble request some help with this issue. Thank you Regards    Please attachment for user setup and errors message gather from FortiGate logs

Good night! Is there a way I can activate my physical interfaces without having to go to the site?  

Hello, I just want to ask if it is possible to override Fortimanager sdwan template. Network connection changed and I have to change healt-check IP for one device. In device group is multiple devices so I have to make change only for one device. If it is not possible what is the best way to deal with this situation ? Thank you RegardsPeter 

Hi all, I have a setup with Fortiauthenticator (v6.6.0) and Fortigate 401F (v7.2.9), where FAC is fed by an openLDAP, and I use remote user sync rules to add users to groups created of FAC. The thing is, I have several groups created on FAC, however the users can only connect to VPN if they are in a specific group (regardless of which group they belong on openLDAP). I don't have any filters on the FAC policy.This happens with, and without token.I know that the problem is not related with the password. Logs of the user connecting succefuly: ESEnfC-1 # [3592:root:1c23e]allocSSLConn:310 sconn 0x7f201b4e7000 (0:root) [3592:root:1c23e]SSL state:before SSL initialization (*.*.*.*) [3592:root:1c23e]SSL state:fatal decode error (*.*.*.*) [3592:root:1c23e]SSL state:error:(null)(*.*.*.*) [3592:root:1c23e]SSL_accept failed, 1:unexpected eof while reading [3592:root:1c23e]Destroy sconn 0x7f201b4e7000, connSize=1. (root) [3593:root:1c23e]allocSSLConn:310 sconn 0x7f201b4e780