Solved

Hello, we are using Fortiweb VM version 7.0.8 and i'm not specialist in the system. Our Exchange server is behind the fortiweb. We have a lot of attempt to connect to the exchange using EWS.  I can see in the Traffic (Log & Report) for attempts and the return code is 401 (forbidden). My question : Is it possible to create a rule/policy to automatically block IP for all attempt getting the Return code 401? Thank you

Hello FortiSIEMer,Hope u have a great day! We notice that we didn't receive any logs on the supervisor from the endpoints, then we tail the phoenix logs : 2024-07-21T02:24:12.306312+03:00 collector phEventPackager[7946]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1721500592_13_73.dat,[errorNoInt]=401,[destName]=super.barq.local,[phLogDetail]=Failed to upload event file to worker2024-07-21T02:25:13.317998+03:00 collector phEventPackager[7946]: [PH_EVT_PACKAGER_FILE_UPLOAD_FAILURE]:[eventSeverity]=PHL_WARNING,[procName]=phEventPackager,[fileName]=phEventPKGProcess.cpp,[lineNumber]=1013,[filePath]=/opt/phoenix/cache/parser/events/evt_1721500586_32_72.dat,[errorNoInt]=401,[destName]=worker.barq.local,[phLogDetail]=Failed to upload event file to worker

Good day, I am getting a lot of Microsoft URLs being re-signed as untrusted see below, I have a FGT200F running firmware 7. I have noticed that the Destination is not the same as the hostname, any thoughts as to what is happing? Server certificate is re-signed as untrusted, certificate-status: untrusted.Destination                                                                                    hostnamev10.events.data.microsoft.com                                                      uk-v20.events.data.microsoft.comteams.events.data.microsoft.com                        &n

hey guys.I have passed in january fortigate administrator 7.2I want to complete now the fcp and I studied faz.which exam can I pass to complete the fcp.there is on pearson vue two exams :Fortinet Analyazer 7.4 or Fortinet Analyazer 7.2is that matter which one I will pass ? thanks for the help :) 

I seem to get an awful lot of port scans to port 500, many/most on the same IP block.I'm certain they're doing an overall scan of the network, but I've just implemented a notification alert on the following:[ul]SSL VPN login failureIPsec tunnel errors[/ul]via Log & Report > Email Alert Settings (300E model) so I can keep tabs if any of my users are having problems (or are the target of a brute force attack). ..so I'm most aware of the port 500 hits.  However, because these garbage notifications are bloating my inbox, I've overlooked legitimate login failures for my users, unintentionally. What's the best approach to either stopping these scans from triggering an alert, or blocking the probes?I'm fairly new to Fortinet products, so I'm not completely well-versed in the full capabilities of the firewall. Possible approaches:[ul]Block the CIDR of the most frequent offenders for UDP 500 (may/may not be problematic, as it's on the Hurricane Electric network.. most

After upgrading from FortiClient 7.0.10 to 7.2.3, I've noticed that the exclusion list in the Web Filter no longer works.  No changes were made to the web filter policies, web browser plug-in is enabled in the policy and installed on the client, what gives?  My clients are all configured to use the web fliter plugin only when the endpoints are off-fabric, sync mode ad check user initiated traffic only are both enabled in their profiles.  I've tried every combination of the three and get the same result. For example, If I try to block Facebook, Twitter, or TikTok using a deny entry for each in the Web Filter Exclusion list, the sites do not get blocked on the client.  I've tried all three exclusion types (Simple, Regular Expression, and Wildcard) and none of them block the sites any longer. I've tried in both Edge and Chrome with the same results. Downgrading back to 7.0.10 resolves the issue. Anyone else experiencing this?

How can I change the IPsec tunnel preshared key? It can't be done in the gui. When I edit my tunnel and select the option for preshared key, the field key entry field doesn't appear like it does when creating a new tunnel. Is there a way to do this in the cli? So far I haven't found it.

Hello, is it possible to get a mail notification from fortinet, whenever a new Firmware release of Fortigate is available? GreetingsAndreas

Hello everyone I am a network analyst and I have updated a forti 60f from version 7.0.2 to version 7.2.9 and now I can't manage it remotely, how do I reach the equipment without having to go physically ?

Hi everyone, I'd appreciate some help over this problem. We use 3 DNS servers : 1 FortiGate DNS Server, and 2 DCs DNS. We can only use 2 IPs on most of our equipment, and we want to have FortiGate IP + Virtual IP (Load balancing to both DCs). This means to stay on our LAN (X.X.0.0/16) only, and the VIP would be on the same network as the real servers.  Here is a scheme to get a better idea: So for now I followed more or less this technical tip I found : https://community.fortinet.com/t5/FortiGate/Technical-Tip-VIP-IP-virtual-server-type-on-the-same-internal/ta-p/221782 I do have a Virtual server, and a corresponding address. Here are my configurations :VIP:Address:Policies: The issue is, whether from vlan10 or vlan213, I can't access at all to my VIP. The thing is, I am getting timed out and I'm not receiving a destination unreachable error. Still, the Hit count of my vip or the traffic trough my policies stays at 0.  Any hints on

hi,i'll be doing an OS upgrade on a FG HA pair.if for some reason I need to "downgrade", do I just select the OLD firmware, reboot and then restore the config referenced to the OLD firmware?is the downgrade the same as upgrade process, i.e. i only upload the firmware in the primary/active FG, it will auto push firmware to secondary, auto reboot secondary, then auto reboot primary?

I have a LAN with 2 FGT's.  SSLVPN coming in to FGT1 can not reach FGT2 and server on FGT2.  Not sure where my issue might be.

I recently installed a forti image V7.0.11 on pnetLab. I set up my lab which contains the forti, the cloud and a computer. I configured everything and I was able to go out on the internet. After some time the ping to the internet no longer works from the pc but the forti pings the internet well. At first I said to myself I may have changed something without realizing it. So I set up another lab, it was the same thing. I set up a third lab and I set the timer to about 1 hour the ping to the internet stopped. Every 1 hour I have to set up a new lab. I need your help.

Hello,I have a problem with FortiClient (7.0.5.0238). I lost internet connection when connecting SSL VPN via FortiClient. I found this article: https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Lost-internet-connection-when-connecting-SSL/ta-p/286345 but this solution is not working because: "After connecting to the VPN, do another 'route print' command. Note that, in the results displayed, the 'gateway' IP for the '0.0.0.0' entry has changed." - NOT, the gateway is still the same for both adresses and deleting route 0.0.0.0 is useless. Do you have any other ideas how to solve this problem?

My user is unbale to access FTP server from ssl vpn which protocol need to add in firewall policy when I add all services to the firewall policy, the SSL VPN user able to access FTP server but when  i  add FTP services in firewall policies the user unable to access FTP Serveris there any other services need add in firewall policy to access FTP server 

Dear all, I just read this KB https://docs.fortinet.com/document/fortigate/7.6.0/new-features/634909/socks-proxy-supports-utm-scanning-authentication-and-forward-server , and it looks good to my operation.So I tried to set up one Evaluation Fortigate and see if Form-based Auth is also supported. But seems no luck here. The Form-based auth only appeared when I selected HTTP protocol. If I selected Socks. No luck then.  Is there any way to achieve Captive portal + Local User DB + Socks-based proxy Auth on Fortigate?  

Getting logs in system event in FortiGate about "Admin login failed" and showing ip of the (Server connected to the internal network) as the source ip what to do? Is disabling SSH will work for it. or SNMP will work. Please suggest what solution we can do?

I have successfully imported my certificate which is signed by my CA. The problem is I cannot choose it as HTTP server certificate. I see only two options, even though I have many more certificates in System -> Settings -> Certificates. I 've tried also via command line but again I only see these two options.Thanks in advance. Edit: I have also imported both Root CA and Sub CA certificates.

I understand Fortigate must do this by default but I have not found this stated in the documentation. In my case, the Fortigate-100F seems to have no TPM and even if it had the admin manual does not mention that login credentials are encrypted by the TPM. Therefore, is there any official source which confirms login credentials are encrypted in a Fortigate-100F?

Hello.We'd like to configure our FortiAuthenticator as SAML IdP. The first authentication factor is password from AD. We've tested several OTP options: fortitoken, sms, email, etc. and the work fine but we'd like to use another second factor: client certificate. We've used local CA or remote CA, and we've configure "certificate bindings" under user configuration, but when SAML web page is shown, it only asks for username and password, and it doesn't prompt to chose a certificate.Anyone knows if it's possible to configure 2FA with AD password and user certificate?.Thank you!.

hi, can anyone please advise whether fortigate accept gratuitous arp sent from other device (like router, load balancer...)? some network devices will send out gratuitous arp when failover occur. thanks in advance!

hi,i'll be getting a new FG 401 but don't know yet which FortiOS code.i usually get OS 6.4.6 with newer device.my question is, since this is a new/blank FG, can i jump directly to 7.2.9?or do i still follow the "lengthy" upgrade path? 6.4.6 > 6.4.8 > 6.4.10 M > 7.010 M > 7.2.5 F > 7.2.7 M > 7.2.9 Mto my knowledge you follow the upgrade path when the FG is configured/in production so that it will "update" CLI syntax/command with the newer OS. 

Hello, Can I please have my nickname changed to sifr? Thanks

We are using FortiEMS in our organization. And recently we have received a vulnerability related to Oracle JAVA on EMS server side. So, please suggest whether JAVA is required on EMS server side. Apache 2.4.x < 2.4.62 multiple vulnerabilities - HighOracle JAVA SE multiple vulnerabilities - High Please refer attached snap. Thanks.

Hello, from day to day I started having problems starting the FortiClient application. Before that it worked for me for about 2 weeks. After startup, FortiClient shuts down after about two seconds. Can't click on anything in the app. No error appears anywhere. They could not advise me even at the IT department in the company. I am said to be the first to come up with such a problem. Reinstalling didn't help.Version: 7.2.4 (other version is not available in our company)Thanks for any help