Solved

Hello all, Since yesterday I got a flood of our IPS about the following: date=2024-10-10 time=09:55:22 devid="FG100XXXXXXXXXXXX" devname="100f_serverroom" eventtime=1728546922552439440 tz="+0200" logid="0419016384" type="utm" subtype="ips" eventtype="signature" level="alert" vd="root" severity="low" srcip=xxx.xx.xx.xx srccountry="Reserved" dstip=157.240.247.61 dstcountry="Netherlands" srcintf="VLAN72" srcintfrole="lan" dstintf="wan1" dstintfrole="wan" sessionid=1996577 action="dropped" proto=6 service="HTTP" policyid=6 poluuid="016585d8-cf8c-51ec-1bc2-98b96e341900" policytype="policy" attack="HTTP.Suspicious.Headers.With.Special.Characters" srcport=49694 dstport=5222 direction="outgoing" attackid=48934 profile="high_security" ref="http://www.fortinet.com/ids/VID48934" incidentserialno=168450119 msg="http_decoder: HTTP.Suspicious.Headers.With.Special.Characters" crscore=5 craction=32768 crlevel="low" The destination is a meta-whatsapp service. This seems to happen with ev

Hello, I have an issue where we ingest a JSON type log which has multivalue key pairs. <132>1 2024-10-08T23:36:16.523272Z a347p001con61.itp.extra pam.rgt.gouv.qc.ca NILVALUE NILVALUE - {"adf":true,"significant":0,"udf":false,"virtualservice":"virtualservice-09330216-623b-4665-aebf-f6d69b96020c","report_timestamp":"2024-10-08T23:36:16.523272Z","service_engine":"z9900001awaf401-se-jmonv","vcpu_id":0,"log_id":661818,"client_ip":"3.98.92.14","client_src_port":48994,"client_dest_port":443,"client_rtt":9,"ssl_version":"TLSv1.2","ssl_cipher":"ECDHE-RSA-AES256-GCM-SHA384","http_version":"1.1","method":"GET","uri_path":"/note.txt","uri_query":"F_notini=&T_note=&nomentreprise=blah&filenote=../../winnt/win.ini","rewritten_uri_query":"F_notini=&T_note=&nomentreprise=blah&filenote=../../winnt/win.ini","user_agent":"Mozilla/4.0 (compatible; MSIE 8.0; Windows NT 5.1; Trident/4.0)","persistence_used":true,"host":"142.80.132.13","persistent_session_id":3472328297

Hello! Could you please help me find out where I can check the end-of-life and end-of-support dates for FortiGate Firewall devices? If you could guide me on how to do this or provide assistance, I would really appreciate it. Thank you!I am interested about FortiGate 90G and FortiGate 80F

Greetings Forti Community, I use a web application that I reach on a IP address in my company network over IPsec VPN.It appears that the application sends a HTTP POST request to the server that can't get through the VPN tunnel, because the package is to big. After I change my client VPN network interface to MTU 1350, it can send the package and the access works. I change it with the following command:netsh interface ipv4 set subinterface "Ethernet 3" mtu=1350 store=persistent After that I've tried to set the MTU of the VPN IPsec Tunnel to 1350 and restart my client, I still couldn't access the web application. I've also tried different MTU values on the Firewall, but it didn't really change anything. Only if I do it on the client per command line.If I restart my client and start the FortiClient VPN, it seems that this resets my MTU on my client VPN network interface. So I'd have to execute the command to change my client MTU every time after I start the FortiClient.&nbsp

Hello,I hope everything everything good, im reaching out for help i've seen your solutions and that you have good knowledge in fortigate/forticlient we are having an isse with some forticlient on some windows laptops were we enter configs correct but its gets stuck on connecting or after i install the vs c++ redistributable it pops up but blank and after a while it shows to enter credentials for authentication and 2fa after that it disconnects on its own no error no nothing.do you have any idea on what can be the problem cause im starting to think its a windows problem maybe a network adpater problem or something else 

Hello Community, We are facing an issue in cortex XDR integration error. (Screenshot attached). API has admin rights assigned. Does anyone face same error.

I'm planning a deployment to migrate stateless router ACLs centrally managed by Ansible to FortiGates/FortiManager. I'm experienced with FortiOS but new to FortiManager and I'm trying to solve a policy management problem. We have multiple sites and we'll have one FortiGate at each site. Each FortiGate will have about 70 rules in common, but most of the sites additionally have between five and a dozen site-specific rules.To manage this, I'd hoped to be able to layer multiple policy packages accordingly on each FortiGate. For example:Rules 1-70 - Shared policy packageRules 71-85 - Site-specific policy packageImplicit denyThis is trivial with Juniper's Security Director, which allows you to apply as many "group policies" to a firewall as you want and commingle them with device-specific policies. I was expecting similar functionality from FortiManager, but, as I learn the platform, I find that it doesn't really work that way, and you're not supposed to apply multiple policy packages to a s

Dear Fortinet Community. First of all the infos:Firewall model: Fortigate 100Fversion: 7.4.5 We have a thing I cannot explain to myself. I think the behaviour to handle it like this is since we have updated from 7.4.4 to 7.4.5. But I am not sure. We see a WebFilter violation when opening a http (not https) website. This website is in the category Phishing. We encountered it when installing a program that wants to download a executable file from this http source. Category Phishing is set to block in the WebFilter. Just to let you know. I made a ssl expection exception for the website. This helps to open the webpage when using SSL (https) but not without SSL, so http. The installer wants to reach the website by http. Probably I am wrong now but in the past we have added websites to the static URL Filter in the webfilter settings in order to reach them and to override a category filter. I have understood the static web filter as something like an override for categorie

Where is the problem? tunnel up no ping

Hi everyone,Regarding the ph processes.  First phAgentManager is down disk capacity is below 85%. I just see the health is showing this one proc is down. and I cannot find one doc about this anywhere? Why am I missing this? I just tried to search the community for the name phAgentManager,  and the search tried to correct me and asked if I meant Fortiseim Manager?  Also I am looking for a set of diagnostic steps I can use to create a runbook for when one or some or all of the ph processes are found to be down and my fellow engineers come on board. I am about a month in on this gig so still learning. Not having any luck with the search.  Cheers, Karl

Good day, I am working on a project to move from Domain Joined Windows 11 computers to Microsoft Entra Only Joined computers, I have a FortiGate FGT200F with Firmware 7.X which currently authenticates users via FSSO in the local Windows Domain via LDAP to determine which Web Filter Policies to apply based on their Active Directory group membership. My test Entra Only joined Windows 11 computers are having issues getting the correct Web Filter Policies from the FortiGate and are ending up going to the Catch-All policies, does anyone have any experience with how to do authentication with Entra Only Joined computers on a FortiGate? I have Microsoft Entra Connect Sync Pass-through authentication setup and it is working to authenticate Entra Only computers to the local Active Directory so users can gain access to network resources. Would I need to create groups in Entra the same as the local Domain groups and authenticate to them? And if so, how is this done? Thanks

Hi, Is there a way of getting a free limited version FortiAuthenticator VM so I do a proof of concept before purchasing? ThanksJulian 

Hi i want to make configuration SDWAN in fortinet 1800F in configuration active passive but i dont know whats is the CLI commands in order to use

I have 10 different models of computers at the institution. none of them have problems with fortinac windows pop-ups opening. New HP Elite tower 800 G9 computers have been purchased. When I install the same operating system on these machines in the same way, fortinac windows agent pop-up does not open in any way. There is a connection to the server. access is open from all ports. same operating system. but no popup. what could be the reason? 

Hi experts,I just got a new MacBook and try to install FortiClient, but when I open FortiClient app, it continuing crash (with quick flash and close with unexpected close message).I already allow the network extension settings, add allow full disk access, but it didn't work.I also try to uninstall, reboot and reinstall but still not work. Anyone can help me solve this issue?Thanks!! (sorry for Chinese scree shot)Network extension:Full disk access: Error message:   

Hi there, I have around 100 Fortigate 60E units around the place (administered through Fortimanager) running FortiOS 7.0.11 and I am looking for a script that will go through and convert all policies and profiles to flow-based. I am aware that FortiOS 7.4.4 will do this automatically when upgrading, but I am tied to version 7.0.11 for now, so a script for this would be really handy. Cheers

    Does the VLAN switch work in software or hardware?I do not seem to have the hardware switch option when attempting to create interfaces.

Hello, we have a Fortigate v7.0.7 and we dial into the company via vpn from Windows, Mac, Android, iPad, iPhone.An internal dns server is specified in the ssl vpn settings. There are different zones/domains in our internal DNS.For example:myfirma.lo (that's the name from our internal AD)somethingother.detest.blubber...If we make an vpn-connection (with FortiClient) from Windows, Mac or Android, all these zones/domains can be resolved to ip addresses. I test that with ping or nslookup.For example:ping hosta.myfirma.loping hostb.somethingother.deping testhost.test.blubber...No matter what I take, I get an ip address back everywhere. From iPad and iPhone (also with FortiClient) just the zone myfirma.lo works. All other zones/domains cannot be resolved.If I ping, for exampleping testhost.test.blubber I get "Can't resolve host" So I think, that's a problem with IOS. What can I do? Thank youGreetingsAlbertMin

Hello,I bought the F60 firewall where can I create a registration to register this firewall to upload the license and everything , where can I also register to open a call at forigate ?

We have 2 fortiswitches for wireless AP's 1 switch is installedWhen i come to installing the second switch, I just want the same VLAN's available for the WIFI.Is this achievable?Do I just create the same VLANs? I have a feeling it will tell me they are already in use. I read about Subnet overlap....is this something I need to enable? Thanks

Hello, while testing in our system I noticed that PowerShell and Sysmon events are not arriving in the SIEM system. Other events such as Windows Event ID 4624 arrive without any problems. The template is defined for the PowerShell events Microsoft-Windows-PowerShell/Operational and Windows PowerShell. The local security guidelines are also set. I'm using Windows Agent 7.2.2. What am I doing wrong? Best Regards

Dear all.   After upgrading to version 7.4.4 we experience massive performance and handling issues. Can anyone of you confirm this?   What I can see among other things are the following facts:   When adding new entries to an already existing address group the entries in the group are sorted alphabetically the entries on the right which I want to choose are not. They are sorted by creation. So new entries are at the end. When adding new entries to a already existing address group the entries on the right I want to add are only loaded when I scoll down and this takes very long. It is like only 30 entries are loaded and the others are not. They will be loaded only when I scroll down to the end. We use hundreds and thousands of entries and the scrolling for new created entries takes minutes now and not only 1-2 seconds like in version 7.4.0. In 7.4.0 just all where loaded directly and I was able to scroll down to the end immediately. The country database in order to block I

Dear Fortinet Community. I would like to go on hardening our SSL VPN access by using Client Certificates and I have several questions for my understanding that I cannot explain myself as I have no test environment and so I thought... Why not ask the professionals here in the forum that helped me in the past perfectly. :) Our environment:Fortigate (newest update installed)SSL VPN in tunnel modeFortiClient VPN will be used for SSL VPN connectionsUsers will authenticate via Active Directory (LDAP Server) What do I want to do? I want to enable Client Certificates. See here in the picture from Fortigate Demo Access:So what are the prerequisites for such a Client Certificate? These are my questions for understanding. Is the client certificate only connected to the server certificate used for SSL VPN?Can the client certificate be a certificate from another/internal root CA that we use internally from a Windows environment? And if so, does the server certificate must be iss

Dear Fortinet Community. We have upgraded our Fortiagte 100F from version 7.4.0 to 7.4.4.After that when I open the configuration of a SSL VPN Portal the following error message appears on the top right corner: this.portal.$schema.children is undefined.It looks like this:Has anyone of you ever experienced such an error message or probably know a solution for it? it always comes again with every portal we have defined. it dissapears if I close the error message but comes back when I restart my browser (cookies deleted etc.). Any answer or hint is much appreciated. With kindest RegardsFortiLover :)

Dear Fortinet Community. I have a question regarding the creation of triggers when it comes to a violation against our Application Control. Means we have blocked a specific Category in the Application Control settings. And if a person wants to use this Application from the category it gets an answer (shown as webpage while surfing) from the fortigate that the use of this applicaion is against internet usage policy. It looks like this: Now I would like to create an e-mail notification via Security Fabric -> Automation. I cannot find a trigger for that event. Can anyone help me to setup such a Stitch or Trigger? Model: Fortigate 100FVersion: 7.4.4 With kindest regardsFortiLover