Solved

Hello All, We would like to receive audit log activities via email at specific intervals for specific users. When we tried using a notification rule, it only allowed us to select individual statuses. Has anyone tried this before? We are also open to hearing about any different notification rules you have used. Thanks in advance

Hello, I am trying to setup the LDAPS connection between the FortiMail and the AD for the admin accounts. I would like to use the LDAPS setup and the certificat is required.The only way to import the AD CS Root CA is in System -> Certificate -> Local Certificate but the password/key is mandatory. The AD Root CA has no private key exportable.Is there a different way to import the certificat in the FortiMail and setup the LDAPS profile ? Following this KB previously : https://community.fortinet.com/t5/FortiMail/Technical-Tip-How-to-create-LDAPS-with-exchange-server/ta-p/240992 Thanks

Hi. Is it possible to configure the system for FG-60E so that in transparent mode it can download signatures for security services. FG-60E would be between the optical modem (also in transparent mode) and another main firewall (NGFW). In this other NGFW there is the IP address of the WAN gateway to the Internet.

Na madrugada de sábado (24/01), foi executada a atualização do firmware do Firewall Fortigate 100F da versão 7.4.9 para a 7.4.10.Após a conclusão do processo, identificou-se a interrupção de tráfego entre as demais Unidades e o Administrativo. O problema impactou diretamente o acesso aos sistemas internos hospedados na sede.Observação: Não foram identificados logs de bloqueio ou alterações de configuração que justificassem a queda de conectividade na nova versão 7.4.10, seguindo recomendação técnica, foi realizado o rollback para a versão 7.4.9. Após o reboot do dispositivo, a conectividade foi restabelecida e todos os sistemas voltaram à operação normal.

Hello everyone. Our company wants to provide an IP list through an internal webserver which we should import in our FortiManager to be used in Firewall Rules. (like http://10.10.10.10/list1.txt, .csv etc.)The use case is they want to manage a list which we will block on our internet facing firewall.Is there a way to do this? We have the 7.4.6 firmware installed currently.

Hi,I am trying to register for the FCP_FGT_AD-7.6 (FortiGate Administrator) exam via Pearson VUE in Japan.The exam language is fixed to Japanese, and I do not see an option to select English, while some other Fortinet exams appear in English by default.Could someone please confirm whether this exam is Japanese-only in Japan, or if there is any supported way to take it in English ? Thank you.    

Hello, we currently run FortiMail VM01 on‑prem and have purchased 110 FortiMail Cloud licenses.What’s the recommended way to transition—can existing settings, policies, and configurations be migrated to the cloud?Or does everything need to be rebuilt manually from scratch in FortiMail Cloud?Looking for best practices, steps, or guidance from anyone who has done this migration.

Hello.Within our proxmox environment we have several vlans.  The proxmox has several bonds with some of the interfaces configured as active/failover - such as the mgmt, and a separate bond for the vlan traffic. As it happens one of the vlans within the proxmox environment has the same vlan number as the switch.  By this I mean, the interface on bond0 is configured as the same vlan # that the servers have.  Obsivesily, the servers are 'tagged' within the proxmox environment to 'tag' traffic to/from other devices on that network.Here's a breakdown -Proxmox environment - native vlan is 10.  with an address of 10.0.1.xOn the switch network, which I'd like to configure the 'trunk', the default vlan is 10.The proxmox manages traffic in/out off of the 2nd bond or interfaces, but as the servers are also 'set' to use vlan 10, how will this work? It's almost like a 'nested' configuration with both interfaces using the same network - but not so as the proxmox handles

I think I have the answer, and it's yes - but wanted to confirm with everyone. new system running 7.4.8M 6484logged in and got a msg about upgrading to 7.4.9. since auto upgrade was turned off i have the option to upgrade.  trying thru clicking to upgrade doesn't work so the process should be manual, i presume.banner message says there's a (nother) issue with this firmware and i need to upgrade to 7.9M.  reviewing the document - Fortinet Document Library | Upgrade Path Toolit seems like there are 2 upgrades to get to this firmware, 7.4.8M2795 then 7.4.9M2829. Does this mean that i have to do 2 download/upload/reboots to 'jump' to the recommended level.  Again, i think the answer is yes - but wanted to confirm. 2 questions:1 - If this is the path and procedure for upgrades from 1 version to another, higher version? ie no 'jumping' to the latest version? trying to click on upgrade from my console didn't work as the gui seemed to indicate.2. since 7

Hello everyone, This might be a basic question, but what is the purpose on integrating FortiNAC with an LDAP server BR,

Good day! For monitoring purposes, we set up a custom integration with the Fortigate Cloud API. A couple of months ago, our custom integrations stopped working. Authentication still succeeds so it's not a credential/auth issue. We noticed that the following endpoint does not return any data anymore: https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices  Instead we are hit with the following error:{"error":"invalid_client","error_description":"Authentication failed","error_code":-1} This error indicated invalid_client (we used fortigatecloud as per the docs). Even stranger is the fact that we can query the API enpoints for individual devices by specifying the gate's SN. https://euapi.fortigate.forticloud.com/forticloudapi/v1/devices/FGT40FXXXXXX This proves that my access_token is valid and can authenticate against the API endpoints (again: with client_id: fortigatecloud). The fact we get a valid response also confirms to me that it's not a n

I have prefix list to filter which prefix will be send to azure.Previously ID no 4 is not exist and i can see in the advertise route only showig 10.103.0.0/16 and 172.30.30.0/24 FW01 (Internet) # get router info bgp neighbors 10.201.0.4 advertised-routesVRF 0 BGP table version is 43362, local router ID is 10.103.103.103Status codes: s suppressed, d damped, h history, * valid, > best, i - internalOrigin codes: i - IGP, e - EGP, ? - incompleteNetwork Next Hop Metric LocPrf Weight RouteTag Path*> 10.103.0.0/16 10.210.0.103 100 32768 0 i <-/->*> 172.30.30.0/24 10.210.0.103 100 32768 0 i <-/->Total number of prefixes 2 But when i add ID number 4 above why the fgt still advertise 2 prefix and not advertise 10.105.0.0/16?

Trying to understand all of this so I have a few questions around the setup:I want to do TCP forwarding to support SSH but we use an internal bastion host.  So all users login to the host with their own login and from there can SSH to host in production.  From what I can tell I cannot do host key checking since that would me all users need to login to a single account.When setting up the ZTNA server one of the questions is the Default Cert.  What cert is that?  If my destination host is jump.example.com would that cert be for *.example.com???  And if so I also need to copy it to the EMS server and tell EMS to push it down to the client????Lastly,  I am trying to setup ZTNA to use SSO thats connected to our ADFS.  So if I SSH to jump.example.com should I get prompted for SSO login?  At least once in a while?

Hi everyone. I am trying to set up Forticlient VPN users to be able to authenticate and get VPN access using their Google accounts. We have a Fortigate FGT60E with FortiOS 7.4.9 running.Right now we have a SSL-VPN set up and working fine but with separate account credentials + FortiTokens. I had tried following different guides I found online + trying to use the logic of my own but I am stuck, based on logs fortigate does not really understand how to map a user to a group.  I had created a custom SAML app with : ACS : https://MyFQDN:10443/remote/saml/login/ Entity ID: http://MyFQDN:10443/remote/saml/metadata/Start URL: https://MyFQDN:10443/remote/loginSigned response checkedCertificate valid until 2031.Basic information > Primary email Attribute mapping : Primary email -> usernameOn Fortigate side, under User & Authentication SSO I created Google_SAML, with this config :Entity ID : http://MyFQDN:10443/remote/saml/metadata/Assertion consumer service URL: ht

Hi,We have a Fortigate 60F and go through a reseller who look after it for us. We had a Forticare licence renewal reminder 3 months ago but didn't act on it at the time (because it was 3 months away and we weren't sure if we would lose time by renewing early). No reminder was set internally (my fault) and no further reminders were received from the reseller. It expired last week and we have had to scramble to renew. The reseller put the renewal in last Thursday and it still hasn't renewed on the device, so we continue to have issues.Is this normal 5 days later, and is there anything we (or they) can do to speed it up?I have access to the dashboard and the CLI.Thanks

Actually in the VPN why function of Local Gateway? What pro and cons if we enable/disable this?

I have a Fortinet FortiGate 100E (V7.2.10) running in a production environment.Currently, multi-VDOM mode is NOT enabled.I want to create a new VDOM.Can someone confirm whether enabling multi-VDOM mode and creating a new VDOM will impact the existing production traffic or policies?What precautions or best practices should I follow before enabling multi-VDOM on a live firewall?

Hello,I have to design a network based on sdwan, ibgp and advpn technology by the book, but using three hubs instead of the classical two.It is possible to implement advpn based on three hubs?Thank you all Vincenzo Stolfi 

Hi, I have set up virtual server with full ssl offloading. Everything is working fine but when I check our website by ssl checker for example https://www.digicert.com/help/ it says that the server is not sending the required intermediate certificate. Anybody know how to fix it? The problem is that Bluemedia cannot correct ask our webserver because it gets error "Unable to find valid cerification path to requested target".   I have already tried to upload .pfx with certificate, intermediate certificate, private key etc. and it still does not work.

Hi all, simple question...How do I unlock a user which is blocked due too many failed attempts?As of default the waiting time is 600sec. "diagnose firewall auth clear" seems a bit too much. Or is this the way to go? FortiOS 7.4.9 Thanks, regardsMarc

I have a fortinet v7.0.12 router and it's configured to nat and allow all traffic from the internal network to the internet. There's a firewall rule for internal -> wan with source/destination/Service set to 'all' and the security police is no-inspect. This seems to work for most things, internal users can access web site but some outgoing connections are blocked. Notably ports 8007 and 25 don't work. Where else would these connections be getting blocked if not the firewall?

Does anyone know how to do the equivalent of a " terminal length 0" on a Fortigate firewall? Our Fortigate has roughly 65k lines of config in the configuration file - hitting space bar all the way to the bottom is painful.

Hi everyone, I would like some clarification regarding FortiMail HA in active–passive mode, specifically around IP addressing and routing/firewall configuration. I already know how to configure HA itself, but my main question is about IP addresses:In an active–passive HA setup, do both FortiMail units use the same IP address, or does each unit keep a different IP address?I currently have a Virtual IP configured on my firewall (192.168.1.1) to forward SMTP traffic.At the moment, the primary FortiMail has IP 192.168.1.1(which is the VIP), and the secondary FortiMail has IP 192.168.1.2.SMTP traffic is currently being forwarded correctly to the primary unit.My concern is failover behavior:What should be configured so that when the primary FortiMail goes down, the secondary automatically takes over?Once HA is configured and synchronized, does the secondary automatically take over the primary’s IP address (192.168.1.1), or do I need to modify something on the firewall side (VI

Hi, I wanted to test 7.2.4 VM on ESXI.For my current and wanted setup, i wanted to add a NIC using PCIE passthrough of ESXI to the VM i downloaded, because i wanted to use a VLAN on my Nic so that i can get PPPOE. I Have my SFP in that NIC. I Got my PPPOE config to work using the CLI, so i currently can ping fortiguard servers or any other outside destinations using the execute ping command. When i go execute vm-licensesI get : 60 - Failed to request forticare license. Failed to download VM license.But when i am using Diagnose hardware sysinfo vm fulli getValid : 0Code : 202,Status : 3If i do it from the GUI i get a message bottom right which says : "Licence invalid product model"My guess is because i kind of tempered with the VM adding a passed through nic but i hoped i was wrong, confirmed, or that it would be made possible.My current number of physical interfaces is 2, i do respect the CPU and ram limitation (even tried lowering the ram to 1536 in case pcie did something).

Every time one of our users attempts to login, they are prompted to provide all their credentials. We're using Forticlient VPN (free). The connection is established and works, but on the next login it prompts for the Microsoft login again. This began happening in Forticlient 7.2 and has continued in Forticlient 7.4. This does NOT happen in Forticlient 7.0, so we're still using Forticlient 7.0 in production. The Fortigate itself has been on various flavors of FortiOS 7.0, 7.2, and 7.4, and the results have been the same for Forticlient. Our Azure accounts are setup with MFA, and we're using SSL-VPN in tunnel-only mode. Forticlient 7.0 - connecting with Azure SSO works fine without reprompting for credentials and without needing to change any of the default Forticlient settings Forticlient 7.2 - connecting with Azure SSO works, but prompts for credentials every login regardless of whether you tell it to remember credentials and MFA authorization or not.  For