Solved

Hi together, I have the following issue concerning the described network structure:Two main sites which are connected to our MPLS-Network. Other sites are also connected via MPLS. Each MPLS site has a MPLS-Router exchanging BGP-Routes with the Site-Firewall and redistributing it within the MPLS network. We want to throw out MPLS and replace it with IPSec tunnels. The goal is one connection from each remote site to each main site, routes also being exchanged via BGP and the two main sites also connected via IPSec to each other. From routing perspective this should not be a problem but if we now let the firewall things join we may break connections due to asynchronous routing when MPLS is still running:For example: packets entering via IPSec to main site 1 into MPLS to another location. Due to the BGP things within MPLS which we can't affect the answer packet maybe will be routed back through main site 2 as this is a "cheaper" way. Firewall on main site 2, of course, doesn't know ab

A basic question: Would Websocket app (TCP 443) traffic be filtered by a policy with a Web Filter profile? Or do we need to match it with Application Control in a separate policy before or after the web filter policy?Thanks, Toshi

Hey,I'm looking for a filter/policy to block instagram pages that contain specific hashtags. Is this possible and how to configure it ?Thx for your feedback.

Hello everyone! I am looking to leverage the Dot1x auto registration option on FortiNAC to register devices that log in to my network using WiFi. Yet, I need some way to identify that these guys became registered using this method, so I can apply scans, Net Access Policies and so on. The issue is they get assigned the NAC-Default role and I don't see any option to apply a role as we do on the portal for example, where I can give a BYOD or Guest role for example. Does anyone have any suggestions on how can I apply roles or can think of other ways to leverage this option but still have control of the way the device connected and became registered to the network? Appreciate the help! FortiNAC 

Hello,I've been asked to enumerate all devices on our office LANs and the Device Inventory Monitor seems to have all the information we're looking for such as MAC, IP, Hostname, OS, etc.  But I can't figure out a way to export this information from the web interface.  I'm surprised there isn't some kind of CSV download option or anything like that.Has anyone figured out a way to do this?

Hello, I have the following request. Which Fortinet products can perform the following tasks that I will outline? Here's what the product should do: SIEM: A local SIEM solution. Ability to separately analyze raw logs when needed, with the ability to export them in .json, .cef, and .csv formats. If the SIEM does not have this capability, the applicant must propose an alternative solution that allows retaining all security and application logs for 90 days. The solution should have User Behavior Analytics (UBA) functionality. Endpoint Security EDR/XDR: A local solution for endpoint detection and response (EDR) or extended detection and response (XDR). Privileged Access Management (PAM) Software: A local PAM solution for managing and controlling privileged access. Seven licenses required. Network Traffic Flow Recording Solution: A solution that can integrate with SIEM and firewall and/or network devices (switches, routers) to record traffic flow at the full TCP/IP packet level (in .

Dear All , hope you are doing great, i have FortiGate 60D, just unplugged it from the server room to hardware reset everything, put on my desk, plugged the power and all i got the power button is contiguously flashing green,it was working fine. tried to putty it with no access. your support much appreciated if anyone faced this before. RegardsGhadamsi

i recently upgraded my macbook and now need to install forticlient vpn on it.which version should i download?those that i tired download from fortinet support all comes with EMS with one month validityi just need the forticlient ssl vpn client

Hi everyone, How can I find the memory size of my Fortigate-100F? I have not found it listed in the Data Sheet nor have I been able to find the total amout or the free amount using the "free" command which is not recognised by the Fortigate.

Hello Guys, I had an issue when using the Default web filter profile with a blocked static URL for Youtube and other sites. I used the certificate inspection not the Deep inspection option, and when the any website should be blocked like Youtube, I got the certificate warning and only solved if I install the certificate on my machine, the goal is that how can I solve this issue to get the replacement message for FortiGuard web filter or the known error "This site can’t be reached". I have another firewalls and with the same configuration but without the certificate error. I opened a case with Fortinet TAC and they told me that you have to install the certificate on the machines! below is their message: " As per my findings, for https websites we need to install the CA certificate (in our case the FortiGate CA certificate) to the browser trusted store in order to get the replacement message. Without the certificate we received the same error as the error that you received. PFA the scree

Hello everybody,I've FortiClient EMS in my network. The filtering is working correctly, but I can't understand how to view generated logs. Is it mandatory to send logs to FortiAnalyzer or to an external server?Where can I view generated logs on FortiClient EMS?Thank you 

We would like to know more information about the Crowdstrike issue. Just wanted a confirmation that this issue could happens to Fortinet Products too such as Forticlient or any?  Does CrowdStrike has any impact on Fortinet products?  TIA :) 

Hello everybody,on my PC I've FortiClient, and in my network I have a Fortigate. Essentialy, regarding web filtering, FortiClient and Fortigate have the same settings and the same exceptions.When I visit a "tobacco" site, this site is correctly blocked. Reading the logs, how can I understand if the site was blocked by FortiGate or by FortiClient? date=2024-07-23 time=14:26:54 id=7394806744431460361 itime="2024-07-23 14:26:54" euid=1026 epid=1030 dsteuid=3 dstepid=101 logflag=3 logver=702081639 type="traffic" subtype="forward" level="notice" action="close" utmaction="block" policyid=6 sessionid=6330623 srcip=10.1.10.31 dstip=104.26.14.200 transip=192.168.1.4 srcport=55936 dstport=443 transport=55936 trandisp="snat" duration=140 proto=6 sentbyte=220 rcvdbyte=4659 sentdelta=104 rcvddelta=260 sentpkt=4 rcvdpkt=13 logid=0000000013 unauthuser="xyz" srcname="MacBook_Pro" service="HTTPS" app="SSL" appcat="Network.Service" fctuid="92CB99E956C6570AB48FD3B7E84960C7" srcintfrole="lan" dstintf

I'm having issues with FortiClient (7.0.3.0193) on Windows 10 Enterprise (19044.1645) inside a virtual machine (VM-ware)Installation of the Forticlient worked without issues.Configuration of VPN is OK (identical config works on host).Connection gets established according to Forticlient.Once connected, every communication through the VPN (ping,...) crashes Windows with a blue screen.Stop code: KMODE EXCEPTION NOT HANDLEDWhat failed: ndis.sysOn the host computer everything works without blue screen... Any idea how to solve this?

Hello everyone,We have recently started using a FortiManager VM (v7.4.3-build2487 240514 (GA)). We use it to manage a Fortigate 400F and of course also create our policies with it. Now to my problem: I have not been able to change the view mode for a few days and am now stuck in ‘By Sequence’ mode, the button for this has disappeared. According to a Fortinet article, the reason for this is that there are two interfaces in From or To - but I have checked each of the rules and there is only 1 interface in From and To in each rule. Do you have any idea how I could correct this? Kind regards Marc

I have two machines that when the firewall is enabled with Domain it disconnects Fortinet Single Sing On Agent Configuration, if I disable the Domain Network firewall it works perfectly. This machine has the same rules as all the other machines. Has anyone experienced this? 

greetings,Previously we used ping to a single www server from public Internet as the SLA detect method, and some day ISP stops the ICMP to that www server, so SD-WAN rule brought down the member interface.Now we'd like to use DNS as the active probe method since there are robust public DNS service provider for public Internet.So, my question is, what is the SLA Target if using DNS? from the screenshot below, it looks the same as measurement to Ping. Isn't it supposed to measure the response time for a DNS query? Should SLA Target be enabled?Thanks for your any advice！

Hi, I'm running FortiClient EMS v7.2.4 and I've deployed FortiClient v7.2.4 to a device, let's call it DeviceA. In EMS I have our Microsoft Entra ID added under Endpoints -> Manage Domains. Within this configuration I am sync'ing in selective groups, for ease, let's call them Device Group and User Group. DeviceA is a member of Device Group and UserA is a member of User Group. I then have various policies (VPN, FW etc) assigned to User Group, with no policies assign to Device Group. This is working nicely in that UserA is getting the correct policies when logging into DeviceA. Also, in EMS under Endpoints I can see DeviceA in Domains -> Entra ID -> Device Group, which again is to be expected. Now to my issue... I have created an installer (for v7.0.13 as a test) and a deployment within Deployment & Installers -> Manage Deployment and assigned this to my Device Group. The assignment appears as domain.onmicrosoft.com/Device Group, so it a

Hello all,I'm having problem with AnyDesk and activated SSL Deep inspection.As soon as this is activated, the AnyDesk client can no longer connect to the AnyDesk server.I've already tried to exclude *.anydesk.com but no luck.I have already created a outgoing policy specialy for service "AnyDesk-AnyDesk" and set it to the top. But even this does not work.

Hello team what is the course for the BGP not form neighbor between HQ and branch

I have two FortiGate 200D in HA mode currently and need to transfer one of them to the DR location. DR Site IP range and HO IP ranges are the same. Core Switch with different VLAN is having a gateway set to firewall LAN IP. Is it Possible to have an HA configured using Datalink connectivity between 2 different geographic locations?Do any other Changes are required on the Core switch?

Hi Team, I have a question about using DNAT and SNAT simultaneously. For example, my global IP is 100.100.100.100/32. I want to enable RDP (port 3389) access to a local host with the IP address 192.168.10.10/32 from the Internet.When a user connects to 100.100.100.100:42424, it should be forwarded to 192.168.10.10:3389 and also be SNATed to 192.168.20.10/32. Is the configuration below workable?------------------config firewall vip edit "vip_192.168.10.10_Office-RDP"  set service "TCP_42424"  set extip 100.100.100.100  set mappedip "192.168.10.10"  set extintf "WAN_v2000"  set portforward enable  set mappedport 3389 nextend config firewall ippool edit "192.168.20.10/32_LAN-Office"  set startip 192.168.20.10  set endip 192.168.20.10 nextend config firewall policy edit 10  set name "Internet->Office-RDP_allow"  set srcintf "WAN_v2000"  set dstintf "LAN_v2002"  set action accept

hi I need to implement HIGH Qos for Microsoft services. I understand I need to use shaper.i need help how to configure it.1.should i give maximum band for shard or per ip?2.the Microsoft services need to be as source or destination?3.do i need reverse shaper? thank you for  helping

Good morning experts. Maybe you want to help me with a problem that is killing me..?I’m trying to configure a solution for a remote office using CISCO switches and a Fortigate 60E. Difficult to explain but that is almost fixed, no problem with that.The problem is a behavior about how Fortigate manage VLANs in its Internal ports hard-switch:When all infrastructure is connected, the testing host is able to ping all VLANs. But when a physical trunk link is down between two of the Cisco Switches, the testing host loses connection to its default gateway (which is the Fortigate...!) I mean that the testing host can ping 5/6 time more from the moment the link goes down and after that it loses connection and pings are not more answered until the link is reestablished. I drew my infrastructure so that it is understood, I hope you can help me. Technical data:* Interfaces used: ports 1 to 5 of the Internal hardware-switch* Five VLANs configured on it: IDs 15, 30, 35, 50, and 101.* VLAN

Hi everyone, I want to allocate X, Y, etc. amounts of memory to storing certain log categories. Is it possible to do this in a Fortigate 100F?