Solved

Hey all - running into an issue deleting an address object that was used in an IPSEC configuration. I was able to delete the tunnel completely successfully, but as last part of clean up was to remove the address object I created to reference in the tunnel configuration. When I go to delete the address object, I get an error stating "Failed to delete object due to the following reason: used - object is copied to VDOM xxxxxx-efw.root." Any idea how and where to remove the reference from the root VDOM? I do not have any per device mappings for this object so not sure where the reference is coming from. Any help is appreciated.

The client has a Sophos Red Router which will be sitting behind my firewal and will just be using out our WAN for internet connection so there is no need to setup from my end regarding their VPN tunnel. There is no tunnel to be created from my side. What we need to make sure is that all traffic from this device, and all other devices behind it, passes through my fortigate firewall without any issues. FOS 7.2.14FG200F Does my current Any Any rule allow all their traffic in and out? Any suggestions or comments is highly appreciated. TIA :)  

Hello, I have a Fortigate with several VDOMs (root, VDOM1, VDOM2), all managed with Fortimanager. For debugging purposes, I need to give the administrator of VDOM2 access to the CLI of VDOM2. How can I do this? From Fortimanager? From Fortigate? Thank you for your assistance.

Hi, I would want to ask a question on the issue that was raised earlier.I have two wan lines, I have set up both tunnels on WAN1 I'm not sure if his setup is accurate. Should one tunnel be installed in Wan 1 and the other tunnel in Wan 2? Still, I have one of them tunnelled in shut down. The problem is that the client from the SAP server does not reach an AWS server, but the person from the AWS server reaches the SAP server for my client. Any thoughts?show system interface "TO AWS 2"config system interfaceedit "TO AWS 2"set vdom "root"set ip 169.254.85.6 255.255.255.255set allowaccess pingset type tunnelset tcp-mss 1379set remote-ip 169.254.85.5 255.255.255.252set snmp-index 69set interface "wan1"set mtu-override enableset mtu 1427diagnose debug enableFortiGate1 # diagnose debug flow filter daddr 169.254.85.5FortiGate1 # diagnose debug flow trace start 1FortiGate1 # id=65308 trace_id=1 func=print_pkt_detail line=5795 msg="vd-root:0 received a packet(proto=1, 169.254.85.6:83->16

Hi Team, I am currently working on this KB:FSSO breaks after installing Microsoft KB... - Fortinet Community Do I need to reboot the server or will the permanent solution work without a reboot? I just need to double check on this one. Permanent Solution:Create a new 'string value' registry entry under the following path. HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Kerberos\Entry name: Auth4Entry type: REG_SZEntry value: dcagent This key must be added to the target server under Show Monitored DCs -> Select DC to monitor -> Select Domain Controllers for Monitoring User Logon Event -> DC Agent or Pooling mode.  Thank you!

After firmware update 221E bricked. Trying to connect thru console pin (j44) inside AP. Maybe some information how to repair this ap.   from console i can see only:▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒▒▒▒f▒▒f▒`~`▒▒▒▒▒▒f▒▒▒▒▒▒▒

I'm trying to add Fortigate to FMG have tried version 7.0.15, 7.2.0, 6.4.10 and always get probe failed, even after emabling low encryption: config system globalset adom-status enableset enc-algorithm lowset fgfm-ssl-protocol tlsv1.0set usg enableend Anyone have any idea if any other config needs chaing? I also tried FMG 7.0.12 and got probe failure as well.port1 on the foritgate VM is enabled for FMG-Access I installed FMG on eve-ng and ESXi, every time I get probe failed. This is the debug from the fortigate, it shows connectivity is fine? FGVMEVWXJNWHYO97 # diagnose debug enableFGVMEVWXJNWHYO97 #FGVMEVWXJNWHYO97 # diagnose debug application fgfmd -1Debug messages will be on for 30 minutes.FGVMEVWXJNWHYO97 # FGFMs: Create session 0xfb19c50.FGFMs: setting session 0xfb19c50 exclusive=0FGFMs: Connect to 172.16.10.100:541, local 172.16.10.110:4840.FGFMs: set_fgfm_sni SNI<support.fortinet-ca2.fortinet.com>FGFMs: Load Cipher [ALL:!RC4:!EXPORT:@STRENGTH]FGFMs:

Having a buggy client install that wont connect to EMS and wont disconnect from EMS either with the proper password.  Cant shut it down so we can't uninstall it. All documentation points to FCRemove thats supposed to be included in the FortiClientTools download for each version but can't seem to find it in the downloads for Mac Forticlient v6.4.9, v6.4.8, and still searching...

Hello,I think my problem is relatively simple. I have an attribute "behaviorID"An example of how I would find it in the raw logs:"behavior_id":["ad23g22d-ge7h-po87-2345-nn367s296186!7504645180225346638"] the way its currently being parsed is simple using collectAndSetAttrByJSON:<attrKeyMap attr="behaviorID" key="behavior_id"/>What I need to happen is to remove the [" at the start and "] at the end so it only remains:ad23g22d-ge7h-po87-2345-nn367s296186!7504645180225346638How do I do that?I can tell you what I have tried, but perhaps I am overthinking.1. I changed the parsing instruction to use a variable: <attrKeyMap attr="_bid" key="behavior_id"/>  2. I am using the collectFieldsByRegex function to assign the string leaving the rest out, but it keeps giving me an error.  <patternDefinitions> <pattern name="patBID"><![CDATA[\w+-\w+-\w+-\w+-\w+!\w+]]></pattern> </patternDefinitions> ..... <collectFieldsByRegex s

HiI have started with a new company 6 months ago and inherited a strange issue. Occasionally, a user or 2 will get a "Fortiguard Intrusion Prevention - Access Blocked" message when trying to access any website. Other users are able to access the websites. What I see in FortiAnalyzer are logs with no username specified. We have FortiSSO, and it appears that it is not picking up the user logon event. Sometimes, getting the user to reboot will solve the issue but may take a few reboots. Another fix is to get the user to connect to another wifi network, then reconnect to the original network connection.  This issue has been happening intermittently for different users for well over a year now and the fixes mentioned above usually resolve this. However, I now have a user, who has been unable to access the Internet all day, so I'm looking for any possible help.  This does seem like an identity issue, where FortiSSO is not picking up the logon event but I do know

This may be a trivial question but I assumed incorrectly that the "Completed On" field in the tasks module would automatically populate once a Task was marked as completed but currently it doesn't. Do I need to create a separate playbook to update this or is there a simpler answer?Thanks, Nelson

Newbie looking for a link or general guide that will help me tweak some of these alerts.  One in particular: Rule Rule Name:  Ransomware detected on a hostRemediation:  Rule Description:  Identifies excessive non-executable file changes by the same process on a Windows host. Requires Windows Security logs or FortiSIEM Agent to be running on the host. Seems to occur anytime a user copies a folder.  Help!

hi I'm trying to ping 8.8.4.4 from my wan interfaces of my fortigate 40F (v7.0.13). Interface 'a' can ping correctly but interface 'wan' cannot reach the destination. Interface 'wan': #execute ping-options source 138.99.23.193 #execute ping 8.8.4.4 PING 8.8.4.4 (8.8.4.4): 56 data bytes --- 8.8.4.4 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss Debug:  # diagnose debug enable # diagnose debug flow filter addr 8.8.4.4 # diagnose debug flow filter proto 1 # diagnose debug flow show function-name enable show function name # diagnose debug flow trace start 100 # id=20085 trace_id=729 func=print_pkt_detail line=5864 msg="vd-root:0 received a packet(proto=1, 138.99.23.193:14760->8.8.4.4:2048) tun_id=0.0.0.0 from local. type=8, code=0, id=14760, seq=0." id=20085 trace_id=729 func=init_ip_session_common line=6043 msg="allocate a new session-0509fe9d, tun_id=0.0.0.0" id=20085 trace_id=730 func=print_pkt_detail line=5864 ms

Greetings -Sometime within the last couple of weeks, our users' Google Drive App stopped syncing with the Web App and vice versa.I set up a Google Drive account as a test and couldn't even sign in.We removed SSL inspection from our firewall policy for a minute and everything started working.Adding an an exemption in SSL inspection for *.google.com did not fix the issue.Note: We are a Mac environment. Any advice would be welcome.Thank you in advance!FortiGate 

Hello! I need help with setting up agentless polling configuration on FortiGate.I have a FortiGate device and an AD server where our company's users are located. I've been exploring the option of using agentless polling to implement and monitor these AD users in FortiGate. I'm having trouble adding FSSO-CA (FSSO Agent on Windows AD).I can see the server and can telnet using port 445, but the FSSO-CA status shows as disconnected. Could the issue be related to the user? What privileges and rights does this user need? How should I correctly configure this setup so that FSSO Agent on Windows AD can see FortiGate and function properly?Please assist me.#FortiGate FortiAuthenticator FortiAnalyzer 

Hello everyone, im testing a fsso solution where i have one machine that work as a collector agent, and another machine thath act as a DC, all the connection fortigate/fsso, fsso/dc and policy match work fine but i have a mismatch in the logon user list under the voice Type, which tell me is "DC-Agent" even if i have specified in the collector agent to work in pooling-mode. I have restarted more than one time both dc and collector just to see if something change but nothing. I dont know if this is just a bug or a real problem  BR, Giuseppe

Hi Team, I currently have an automated stitch to restart a process when the FortiGate reaches conserve mode - following this link: Restart WAD or IPS when conserve mode hit... - Fortinet Community Is it possible to have SNMP traps to be sent when the CLI script/automation is triggered in my FortiGate? Is there an OID intended for this? or others which must be configured? Currently using this CLI Script as Action: diagnose test application ipsmonitor 99 Thanks 

Hello, I am trying to block all traffic from Russia except Yandex mail. I have an address group for all Yandex IP addresses. Can someone explain why my Allow Yandex rule doesn't get priority and SMTP traffic still trying to go through Country Block rule and getting denied? I am attaching the screenshot.  Thank you very much!  

We are currently in the process of switching over to the FortiClient VPN (v7.0.0.0029) from the DrayTek Smart VPN Client and I notice that all of my traffic is now being piped through the VPN, instead of just the traffic that requires it. Our FortiClient is set up to use IPsec VPN. The DrayTek VPN has a setting named Use default gateway on remote network and I always have this switched off.  I'm trying to find a similar setting in the FortiClient VPN. Sorry.  I'm not overly familiar with all the network jargon, so please forgive me for that.  I see a bunch of settings under Advance Settings, but nothing that appears equivalent to the DrayTek setting. Thank you in advance for any assistance provided.

Hello,I would like to retrieve information about compromised hosts and threat types from FortiAnalyzer's FortiView using either the API or CLI, but I am unsure of how to proceed. If anyone has experience or knowledge about this, could you please provide some guidance?

My current setup is as follows: ISP using PPOE---- Cisco RV340----Four (4) NetGear lvl2 Switches.The Cisco RV3340 has the Firewall turned on and does VPN using Cisco AnyConnectI also have the following VLANS on the Cisco RV340: VLAN1 (Default) using private IP subnet 192.168.6.x/24VLAN 20 192.168.20.x/24 DHCP enabledVLAN 30 192.168.30.x/24 DHCP enabledVLAN 40 192.168.40.x/24 DHCP enabledVLAN 50 192.168.50.x/24 DHCP enabledVLAN 60 192.168.60.x/24 DHCP enabledVLAN Ports to Table have tagging enabled for Lan 1 to Lan 4 for VLANS 20 to 60 with VLAN1 untagged.NAT is enabled on the WAN 1 interfaceI want to setup a Fortinet F80 in front of the Cisco RV340. The reason for this is to setup a Site-to-Site VPN connection with another Fortinet F40 that will allow me to do DR for my backups from one (1) QNAP NAS to another QNAP NAS.My setup would be:Site 1. ISP using PPOE---- Fortinet F80----Cisco RV340----Four (4) NetGear lvl2 Switches----QNAP NAS.Site 2. ISP using PPOE----Fortinet F40----QNA

I have a Fortigate firewall with x2 VDOMs, root and user created called "management access". root and management access have an inter-vdom link between them to exchange traffic and because of the requirements root is the "management vdom" and used as management access for us to manage our customers firewall. The problem I am facing is that you cant configure SNMP in a non "management vdom", so I have configured SNMP on the inter vdom link in root as a workaround which the management access vdom is directly connected to. The problem is I cant seem to SSH onto the firewall using the intervdom link from our management jump box.Does anyone know if its possible to SSH to a Fortigate on an intervdom link from outside the Fortigate firewall? I have checked routing+firewall policies but it does not appear to work.

I have a couple of user that for some reason got assigned to the Default policy when they should have been assigned to our internal policy.  One of the users is our CTO.  So my question is there a way from FortiCloud EMS to move the user to the correct policy?  Or really anyway that does not involve interrupting the end user.

Does anyone have a recommendation on how to set up two IPsec tunnels? The client sites are using Fortigate-60e (Firmware 7.2), which will be using the home WAN internet with a one IPsec tunnel back to our HQ. But we are hoping to add another tunnel to the client fortigate to another backup HQ site in case the primary HQ goes down. Not sure if there is more than one way of doing this. 

Hi Fortinet Community, One of our clients wants to upgrade their FortiGate (physical appliance), deployed on-prem as an edge firewall. The current running version is v7.4.2, and the client wishes to upgrade to v7.4.3. Could you please confirm if v7.4.3 is a stable version and does not contain any significant bugs or issues? If it is not stable, could you suggest a stable version of FortiGate to upgrade to?