Solved

Hello Everyone,I have some questions about a playbook I developed, but I'm having trouble uploading the playbook JSON file to the FortiSOAR community post. If anyone knows how to upload a playbook JSON file on FortiSOAR, please let me know.Thank you!

Hello Community. I have been using FortiClient since MacOS Catalina, until then everything was perfect, then from BigSur, everything was wrong. It does not work or simply the solutions that exist in the forums do not work or are incomplete.. I am currently running MacOS Monterey 12.4 and FortiClient 7.0.5.0166. I have this error when establishing the remote connection via VPN "Login failed. Insufficient credential(s). Please check the password, client certificate, etc."  Searching in Internet and this forum itself there are "solutions" of this type: Manually add a number of services from the FortiClient package with full disk access. This is an official note from the provider's documentation. URL:https://docs.fortinet.com/document/forticlient/7.0.5/macos-release-notes/223986/special-noticesApply the accesses from the previous point, uninstall FortiClient and reinstall FortiClient.I have applied both and it doesn't work. The strangest thing about this behav

Hello.I have a question about Ha being out of sync.Added user objects and groups to the portgate.Immediately after that, it was not synchronized.I deleted the object I created after HA was out of sync and it was resynchronized normally.As before, when you create a user object on the master equipment and then use the Run ha Sync Start command to add/delete the user object, the synchronization was not broken.Does anyone know why HA doesn't sync when creating objects?If anyone knows about this issue, I would appreciate it if you could let me know the cause and how to respond.

Hi all, I'm fairly new to the Fortinet suit of security devices. I have set up a scheduled SFTP backup on the FortiAnalyzer and FortiManager which was very simply to do. Locally, the SFTP password is hashed in the config, lovely. However, Fortigate appears to be a different story. To achieve a “Fortinet native” solution of a scheduled/automated backup. I looked at automation stitches, unfortunately the "cli script” option requires the SFTP password to be stored in clear text.  Does anyone know of any other “Fortinet native” solution to schedule automated backups to SFTP servers on Fortigates without having to store the SFTP password in clear text? Just not acceptable to store passwords in clear text in my opinion and against policy in general. My next stop is to move the automated backup process out of the Fortigate environment and move it to a netmiko/paramiko python solution. I would prefer an “in product” solution. Currently using v7.0.7. Thanks,&n

hello guys i have this challenge on BGP neighbor for sdwan 

Are there any specific commands that I can run on a FortiGate to check the following parameters of the FortiAPs associated with the FG:Number of APs associatedNumber of SSIDsNumber of Users/devices connected per SSIDTotal Number of Clients

Hi community, I hope someone in the community might have a suggestion for the issue I'm facing - I have set up a WEF from two different windows machines into a Windows Server configured as the WEC. All event logs from the two WEF machines are received at the WEC and are fully visible in the EVENT Viewer under "Forwarded Events". I have installed a FortiSiem agent on the WEC and configured to pull ALL events. for some reason I still can't see any indications of logs from the two WEF machines and can see only logs from the WEC.  I have followed all installation and configuration i could find on the matter but still can't identify the required logs. are there any special configurations i should set in the FortiSiem or any other machine which will make the Forwarded events from the two WEF be digested into the fortisiem ? any help will be appreciated. 

Dear community, I am trying to set a picklist value based on condition. The playbook execution log showed that the condition was evaluated and resolved to the appropriate picklist. Still, the severity picklist wasn't updated in the Alert module pane, as seen in the image below. INPUT Argseverity: {%if vars.input.records[0].fileHash==\"839765b93416bb945be4f4ef2804158f\"%} {{(\"Severity\" | picklist(\"Critical\"))}} {% else %} {{(\"Severity\" | picklist(\"Medium\"))}} {% endif %}EVALUATED Argseverity: {'@id': '/api/3/picklists/7efa2220-39bb-44e4-961f-ac368776e3b0', '@type': 'Picklist', 'itemValue': 'Critical', 'orderIndex': 4, 'color': '#e31b1d', 'icon': None, 'listName': '/api/3/picklist_names/4e80cba3-032f-48b4-ac03-17e3ec247aac', 'uuid': '7efa2220-39bb-44e4-961f-ac368776e3b0', 'id': 372, 'importedBy': []} Can anyone advise on what could be the issue here?Thanks. 

I have a core switch that acts as gateway for all the users.  10.10.10.254 Gateway (coreswtich) 1. I am seeing traffic from User IP but with core switch MACaddress.2.I am seeing DNS queries from host with core switch MACaddress to DNS Address that is not configured on the host. 3.I am seeing wrong IP address associated with this MAC (screen shot)4.I cannot delete it in devices (delete option is dimmed)how can i resolve this issue? 

Hi all,I would like you appreciate if you can share URL where only update the google chrome nothing else. Thanks in advance.

Hello team, I successfully configured phase 1 and phase 2 ipsec vpn having private ip's as peers (WAN).On one side I have fortigate, on the other side Palo Alto.Both VPN phases go up but when I try to generate traffic I never get the return responses, either way.Fortegate side I see correctly routed traffic to the ipsec tunnel but I never see the replies. Palo Alto side is the same, I see traffic is routed correctly but I never see the replies.The strange thing is that seeing traffic routed correctly to the ipsec tunnel I would expect to see traffic on both sides. Following screenshot from either sides Any suggestions for troubleshooting?It occurred to me to try as a test to modify phase two by specifying 0.0.0.0/0/0 for both remote and local to see if maybe some NAT is present that I am not aware of. Thanks in advance for the supportBR 

Hi All, We are deploying a full-forti-site, with FortiAP's.We have a VirtualFG installed and configured, AP's signing in (Thanks DHCP Option config!) and are now starting to make WiFi Floor Maps.1: Maps from FortiGate does not sync to ManagerIf I create Floor Maps in FortiGate WLC, they do not sync back to FortiManager - why? 2: Maps created in Manager does not puch to FG.If I create WiFi Floor Maps in Manager, there does not seem to be any link to what FortiGate the maps are for, so they does not sync from FGM to FG.Even after putting AP's on the maps, there is no 'link' from that map to the FG that manage the AP's..  Can anyone tell me what the thoughs about this is?!?Do I really have to create maps on both platforms, that I need to manage two places?!? 3: AP Placement on FGM Google Maps?That is only the 'general location' from the FortiGate, not by AP.. it seems..?

I have 2 - FG 200F's. I have HA configured. I have 1 FG WAN connected to a modem going to fiber internet. My 2nd FG WAN is connected to a modem going to COAX internet. So, 2 different internet pipes. "FG1" is primary, "FG2" is secondary. While in this configuration, I can access and ping the internet from each firewall. When I force an HA failover, "FG2" becomes primary as expected, however, once it does, I lose internet access and can no longer ping anything on the internet (from "FG2" via CLI). I am not sure what I am missing. FW: v7.4.4 build2662 (Feature)Active-Passive

I only can edit a Windows App filter, but when trying to apply it to a secret, there is no option to enable it in Secrets settings

SHORT ANSWER AS PER SOLUTION - DONT USE CHROME OR EDGE WITH FORTIANALYZER :D Original post:I have a weird/odd problem around the FAZ web GUI where anything on the UI that has a drop down arrow option is non-responsive. The buttons have black boxes around them but when you click on them, nothing happens, no response, no additional options.All of the normal options and functionality works within the FAZ but it means I cant change date ranges when searching logs or even open the alert bell in the top right corner.I get the same behaviour in Edge and ChromeEdge - Version 114.0.1823.82 (Official build) (64-bit)Chrome - Version 115.0.5790.99 (Official Build) (64-bit) FAZ - v7.4.0-build2223 230514 (GA)Platform - FAZVM64-KVM I even went to the effort of installing the latest version of Java because you just never know... Example one: Example two: 

Good day,The logging disk on our Fortigate 101E has failed. We've received a replacement device via RMA. We do not have HA, so I chose to not transfer the license upon shipping of the replacement.  I've installed the FortiOS version we are currently running and restored the latest configuration. How quick is a license transfer when I'm ready to move to the replacement device? Is there any way to expedite the process? I've contacted Fortinet support and they haven't given me much information other than to say it could be up to 4 hours. Thanks for any advice/assistance. 

Hi, We need to update Fortimail which is in an Active-Passive HA architecture, but we don't know if we should upload the firmware image to the Primary Device and this Primary Device is automatically updated itself and the Secondary unit likewise similar to FortiGate with this architecture. Or on the contrary, we must update the Secondary Unit manually, set this unit as Primary and update the unit that was previously primary. Could you please resolve this doubt?  Thank you all.  Best regards.

Hi, i'm trying to use the cli in Forti Manager 7.0.12 to script a policy. config firewall policyedit 0set name "test-policy"set srcintf ZONE_LANset dstintf ZONE_LANset srcaddr test-1set dstaddr TESTGRPset service TCP_5000-6000set action acceptset profile-protocol-options PROXY_FILTERset ssl-ssh-profile SSL_FILTER_CERTset ips-sensor IPS_FILTERset application-list APP_FILTERset inspection-mode flowset internet-service disableset nat disableset logtraffic allset schedule alwaysnextend I can run this script successfully.  No errors.  However in the gui the policy does not contain the APP and IPS filters?Any hint? 

Hello FCT EMS adminsAnyone tried EMS 7.4.0 and its client FCT 7.4.0 in production environment?As this is a new release, any feedback on the stability would be appreciated. This will help us choose between 7.4.0 and 7.2.4.

Dear All, We have created an IPSec tunnel between our HO and local location. The LDAP servers are hosted on HO Location and are we login the firewall based on AD user ID. But as soon as the tunnel is up, we cannot access the firewall as well as FortiManager using that tunnel. We have to bring the tunnel down manually to access the firewalls through the LDAP user ID. We have checked the configuration and the routes and also we have tried adding the tunnel to our SDWAN rules as per the requirement but we are facing the same issue. Today, one of our ISP was down and the entire traffic was switched to the secondary tunnel and we could not access the firewall as well as FortiManager. Post the ISP was up, we had to bring the secondary tunnel down and then we were able to access both devices. Please align someone on this call as soon as possible.

Hello community,   we would like to configure our fortigate 100F SSLVPN Access with SAML and MS Entra. Unfortunately, we get the following prompt    We use the following MS Node: https://learn.microsoft.com/en-us/entra/identity/saas-apps/fortigate-ssl-vpn-tutorial Is it important, that we use a entra Plan or is the free Version okay? We use M365 business St. 

Hello Fortinet Community, I've been reading https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Configure-FortiNAC-Tags-with-FortiOS-7-2-4-GA/ta-p/255138 on configuring FSSO tags with FortiOS 7.2.4 and https://community.fortinet.com/t5/FortiNAC-F/Technical-Tip-Connector-based-FSSO-vs-Fabric-Based-with-FortiNAC/ta-p/31610on Connector-based FSSO vs Fabric-based SSO.Is it correct to understand that Connector-based FSSO will be deprecated soon, possibly even removed from CLI configurations? Should we be configuring Fabric-based SSO for new deployments instead? With FortiGate and FortiNAC using a persistent agent setup, how can we propagate AD User/Group information to FortiGate without Connector-based FSSO? Currently, with Fabric-based SSO I only receive Dynamic-FortiNAC Tag. Looking forward to your insights!Thank you! 

Hi i would like to know if fortiXDR can protect against apc or is some device in fortigate than can protect agains apc ? 

Hi Everyone,unfortunately I have some issues with FortiClient 7.4. It freezes during "connecting" and nothing more happens. For my colleague it works with the version 7.2.4. So could someone please provide me with this Installer?Thanks and kind regardsJan

Hello Community. I'm trying to run some newly created playbooks with Manual Trigger using csadmin user, then I want to run it on ingested alerts from SIEM or escalated alerts (incidents) using the Execute option at the bottom of each record, but I can't see the playbooks that I want to run. Why is this happening? Regards!