Solved

I've recently migrated our primary firewall from an ASA to a FortiGate 600.  Don't get me wrong, I love Cisco but the FortiGate firewall has been a HUGE improvement and I don't regret the change for a moment!  However, there was one thing about the ASA that I loved and has saved my butt more than once.  With every "commit" I made, I had the ASA spit out a CLI of what change I just made.  So like if I made some new service ports in the ASDM, when I hit "apply" I'd get an out put like so:object service TCP-7046service tcp destination eq 7046description Nav Client Servicesobject service TCP-7047service tcp destination eq 7047description Nav SOAP ServicesThen I would copy that info and place it into my own personal change log with a little note of what I was doing, so I've got my own personal change log of every change made.  An example entry:4/30/20241. Create the NAV ports on the ASAobject service TCP-7046service tcp destination eq 7046description Nav Client Serv

Hello, I have a FortiSIEM on VM, the license expires in 1 month and we will not be able to contract support again until the first days of next year.The question is what will happen when the license expires, what limitations does it have?Is FortiSIEM still functional?Thanks.

Hello Team! I am using a FortiGate 40F model FG-40F with a configuration which consist of a VDOM root (management, operation mode NAT) and a VDOM transparent (operation mode transparent).  The VDOM root is only use to give access to internet:  The VDOM transparent is only use to stablish a firewall between a network called LAN and a network called WAN:  My objective is to monitor the Fortinet sending get SNMP from a PC connected to the port 2 (Inside lan 2).I have configured the System > SNMP in this way:  My problem is that the Fortinet receives the SNMP get but not answer me:  I am sending the get SNMP with iReasoning Browser: I amnot using HA or trusted hosts (I have tested to add my pc to trusted hosts but the behaviour does not change), I have checked the threads: SNMP don't response traffic, SNMP response and SNMP no response: timed out but I can not solve the problem. I give you more information that could

Hello everyone,currently we are hanging in the SAML Entra SSO Setup. I checked the recommends Articles here in the Support Forum and watched serveral Videos.Firmware: v7.4.5 build2702Model: FortiGate 101F After the SAML login via the FortiClient and Enter the M365 Credentials, follwing Error Appear: Configuration on the Fortigate:User & Authentication > Single-Sign-onService Provider ConfigurationAddress: "forti-fqdn:6443" Entity ID: "http://forti-fqdn:6443/remote/saml/metadata/" Assertion consumer service URL: "https://forti-fqdn:6443/remote/saml/login" Single logout service URL: "https://forti-fqdn:6443/remote/saml/logout" Identity Provider ConfigurationEntity ID: "https://sts.windows.net/xxxx/" Assertion consumer service URL: "https://login.microsoftonline.com/xxxx/saml2" Single logout service URL: "https://login.microsoftonline.com/xxxx/saml2"  Certifcate Import from Entra  Additional SAML AttributesA

Hi,Is it possible to have the Fortigate perform a ICMP-ECHO to a IP Address before it sends a DHCP Offer to a client device. Have had an issue with duplicate IP Addresses on overlapping scopes / ranges that have static IP Addresses configured. This could be resolved with the DHCP server testing to see if the IP address is already in use in advance rather than relying on the client device to perform this function, I.E sending out an arp before accepting the DHCP Offer.  Any help would be much appreciated, thankyou. 

The customer has lost their collector LOGIN password we needed to login to clean the disk space from needless clickhouse service running now we have to re-install unless there is a safe procedure on the collector for Rocky Linux to reset the password. Has Anyone done this? The clients collector presently is  7.1.3.0165  was running on Azure Cloud VMOur super is 7.1.3If I cant reset the password then;We are new to the install procedures, ( i.e Ive never done an install before)  I'm seeking advice on the most stable version to install? do we use 7.1? or 7.2?Collector VM is on Azure (Cloud). Would the setup be the same  process as onPrem VM? Which All in One build do I download from here? https://support.fortinet.com/support/#/downloads/firmware Thank you , really need the help.

Hi I haven't used this feature before and need to set it up, have a question if someone can help? lets say you create a web filter that has some categories set to allow and others set to authenticate.....when the user browses from 1 site in the first authenticate category, then moves to a site in a different authenticate category, do they need to enter their details again or is it just the initial authentication?  thanks 

Hi folks this is my first post here and my first parser in FortiSIEM.  I have the raw logs. How do I develop the XML in the body, to grab the fields in the log?  Not sure of the approach here.Hmm Apparently I've managed to post incorrectly. I have poured over the docs and I am not getting it.I have my regexe here:Account Id":"\[\\"([0-9a-fA-F\-]+)\\Attack Module":"\[\\"(.*?)\\"Attack Time":"\[\\"(.*?)\\Code Processed":"\[\\"(.*?)\\Command Line":"\[\\"(.*?)\\Computer Name":"\[\\"([0-9A-F\-]+)\\ OR THIS Computer Name":"\[\\"([^\"]+?)\\"\\]Logged In UserName":"\[\\"[A-Z]+\/([^\\]+)\\\"\]\" OR POSSIBLY THIS Logged In UserName":"\[\\"[A-Z]+\/(.*?)\\Message":"\[\\"(.*?)\\"Morphisec Version":"\[\\"(.*?)\\"Parent Process Command Line":"\[\\"(.*?)\\"Protector IP":"\[\\"(.*?)\\"Threat Description":"\[\\"(.*?)\\"Threat Module":"\[\\"(.*?)\\"Threat Name":"\[\\"(.*?)\\" I have this raw log:2024-09-26 15:55:15 Morphisec-EPTP INFO MORPHISEC_ATTACK {"Account Id":"[\"0cebd16e-e

I have a Fortigate with a LAN interface with a static IP address (no DHCP enabled) which provides internet services to my internal network. The LAN interface is set up as a "DNS Service on Interface"  which forwards any host DNS queries to the system DNS. Therefore my host has been configured with the LAN interface IP address as the preferred DNS server address. However, in the Fortigate DNS page I cannot specify that I want to use system DNS and I am given just two options: Use FortiGuard Servers or Specify (which requires me to write down static IP addresses). I am using Fortiguard servers (i.e. primary and secondary DNS servers) but my WAN interface (which has both DHCP and Override internal DNS enabled) uses my ISP DNS server (i.e. Acquired DNS). I want my LAN interface to use my ISP DNS server and acquire its address automatically as my WAN interface already does, but I am not sure what DNS server is being used to resolve my host DNS queries as the Fortigate ha

Hello Fortinet Community,I'm seeking advice on the best practice for setting up two FortiGate 121G units in an active-passive HA pair configuration, alongside two FortiSwitch models FS148F and FS124F (does not support MCLAG). I'm currently evaluating two potential topologies and would appreciate your insights on both, particularly around VLAN configurations and any relevant design considerations.Here are the two topology options I'm considering:Daisy-Chained Topology:In this scenario, the two FortiGate units in HA mode will be connected to a daisy chain of FortiSwitches (FS148F and FS124F). The switches would be stacked for redundancy.Mesh Topology:Each FortiGate in the HA pair would be connected directly to both FortiSwitches. This creates a more distributed setup with each switch directly connected to each firewall for greater redundancy.Questions:How would VLAN management differ between the daisy-chained and mesh topologies?What would be the most efficient way to handle VLANs with t

Hi Community, I’m currently trying to install the CylancePROTECT Connector. While the connector installed successfully, I’m encountering issues with the connector dependencies, which are not installing properly. I’ve attached an image of the error message for reference.  Could anyone provide guidance or solutions to resolve this issue? Any help would be greatly appreciated! Thank you! 

For the FortiIsolator is there an official document (matrix compatibility type) as is done for FMG and FAZ ?Also among the Fortinet Fabric I mentioned below, can you confirm that the ISOLATOR interacts only with these products:Fortigate - YESFortiAnalyzer - YESFortiManager - NOFortiSandbox - YESFortiDeceptor - NOBest Regards

Hello, the below parser xml is failing testing on 7.1, any help is much appreciated. <eventFormatRecognizer><![CDATA[.*Vendor _ATTACK\s+]]></eventFormatRecognizer><parsingInstructions><collectFieldsByRegex src="$_rawmsg"><regex><![CDATA[.*Vendor Name {<_body:gPatMesgBody>}]]></regex></collectFieldsByRegex><setEventAttribute attr="eventType">VendorAlert</setEventAttribute><collectAndSetAttrByJSON src="$_body"><attrKeyMap attr="accountid" key="Account Id"/><attrKeyMap attr="VendorAttackModule" key="Attack Module"/></collectAndSetAttrByJSON></parsingInstructions>

Hello all, We have a few customers who use a FortiGate and are experimenting with deploying ChromeOS. Through ChromeOS you're able to push the FortiClient VPN Android version to the device. We would like to offer the right configuration for our customers without offering a tutorial/guide on how to create the correct configuration themselves. We noticed the FortiClient VPN Android version supports JSON files which can be used to add the settings automaticaly. Unfortunately we're unable to find the correct JSON script to do so. Where can we find the JSON file or how can we generate one? I would guess there is a template available somewhere! Thank you in advance!

Hi, Currently using FortiGate VM in FortiOS version 7.0.15. Based on the details below, it looks to be not supported. Is there another firmware which we can upgrade to, to enable the long vdom name? Followed this link to enable long vdom name: Long VDOM names - Fortinet Community, but unable to find the said config parameter - 'set long-vdom-name' It was indicated as well in the CLI reference that the parameter set long-vdom-name may not exist in some models: https://docs.fortinet.com/document/fortigate/7.0.15/cli-reference/339914554/config-system-global Thank you!

Hello everyone! I would like to know if there is a way to exclude specific VLANs from passing inside a fortiswitch ISL trunk or to pass only management traffic between a specific ISL link. By default fortilink passes all VLANs between Fortiswitches connected to each other. Yet, I have a requirement to not allow specific VLANs to pass through a ISL formed between 2 FortiSwitches, therefore forcing data traffic to go through a 3rd party switch connected to both of these Fortiswitches. KB: https://community.fortinet.com/t5/FortiSwitch/Technical-Tip-Seperate-Inter-Switch-Link-ISL-between-Managed/ta-p/224568states about separating the traffic, but my requirement does not need the second link to pass data. Is there a simpler way to achieve this? Did not want to go into modifying MSTP instances and all of that. Thanks in advance for any suggestions and tips! Regards FortiSwitch 

I have a campus network with 63 FortiSwitches managed by a stack of 1101E Gates in an HA.MSTP is running in it's default state other then I did lower the priority of the distribution switches I want to be the root bridge.My question is what is the best way to setup MSTP? Right now I'm using instance 0 but I did see a MSTP best practice paper that suggested not using instance 0.  I have a single region and 68 Vlans. I would like to keep using instance 0 just because it's simple. I would appreciate any recommendations. 

Following this link - https://docs.fortinet.com/document/fortiauthenticator/6.0.0/cookbook/812128/creating-a-local-ca-on-fortiauthenticator I am a little confused, the cookbook suggests you have to create a user certificate? i have over 500 LDAP users, that cant be right can it? it also suggests you create the local users on the FAC? thats a bit pointless, my FAC is connected to AD, so why would I need to create the users again,  Im looking for a solution where the users connected to the business WIFI, using their machine certs, not sure why we need user certs, is it another check or something? thanks 

Dear, please help me in this case: I have a Fortigate 100F which was return to the factory and configured as an edge in another datacenter.The internet provider gave us a private WAN IP x.x.x.x; but to go out to the internet, we must do it through a secundary WAN IP y.y.y.y.The Firewall was already registered in FortiCloud before the factory reset. Currently it appears registered in FortiCloud.The system information on the dashboard confirms the WAN IP y.y.y.y; but when trying to connected to FortiCloud it gives us "FortiGate Cloud Internal Error".When generating a PING using the CLI witch the source-ip y.y.y.y to the service.fortiguard.net URL, I do manage to reach it, but when I connected to the internet, it gives me the aforementioned error.When reviewing the traffic I see that in the rule Implicit Deny the origin y.y.y.y with destination to the Fortinet DNS, port TCP/853 es accepted. 

Hello,I have a requirement, only 5Ghz and 6Ghz  need to be available for an office.Actually, only 5Ghz is available for users and it works well.I checked this link https://docs.fortinet.com/document/fortigate/7.2.0/new-features/169732 but I need more explications.I created a 6Ghz SSID, select WPA3 SAE et activate H2E.Then for the Operation profile, I'm not sure according to my requirements. I understand, all the bands needs to be ON for the wifi6E, but I don't want 2.4Ghz, so I created a profile where Radio 1 is disabled, and link it to the new 6Ghz SSID. I can't made a real test until next month. Another question, if on the 6Ghz SSID, I keep active the 2.4Ghz, it's only for 6Ghz use or a user can connect to this frequence ?I want to know if the configuration is correct or if you have some tips. Thank you  

I have 400F device and on this device we have configured around 1000 site to site VPN tunnels in active passive mode. We need to configure 330 link monitoring entries. I am able to configure 256 entries after that getting an error reached maximum entries. How can we increase the limit of link monitoring entries.  

What are the ramifications of disabling the clickhouse-server.service,Or asked another way what criteria would I need in order to make an informed decision? Id like a little more knowledge about clickhouse and if its set up by default and how to know if it actually is being used.I I don't think the log rotation is set up on a lot of the clients collectors at any rate so periodic removal of logs has to take place until there is a final solution. Thank you in advance. 

Hello Everyone,   I have a production device that has already had our template that is for 1 MPLS -1 internet connection ran on it. I want to add another internet connection to that device. I already have a template for 1 MPLS- 2 internet connections which would be perfect. Would I be able to just add the variables for the 2nd internet connection and run the 1 MPLS-2 internet template even though it will have all the same variables from when I used the 1 MPLS- 1 internet except for the additional 2nd internet connection, or will it fail since there will essentially be duplicate variables? I thought I remember hearing or reading somewhere that it will just skip them, but maybe I made that up.  Thanks!

Running a Fortgate 60E running firmware 7.4.5 with a Fortilink connection to a Fortiswitch 124E PoE switch running firmware 7.6.0.  I have created an active trunk using two ports (15 and 17) on the switch controller and trying to change the vlan from the default to another VLAN I have created. When I do this in the GUI I get a red banner in the upper right that says "Failed to Save Changes". I get no other information that I can find in the logs or documentation on why this would happen or how to resolve it.

Hi Everyone, i have a problem when i try to connect the EMS 7.2.5 to my LDAP server the same parameters work well in version 6.4.9 and 7.0.13 but since the update to version 7.2.5 impossible to reconnect the LDAP server i have the error message: unable to read LDAP response packet: unexpected EOF does anyone have an idea about this error Thanks for your help