Solved

HiI have started with a new company 6 months ago and inherited a strange issue. Occasionally, a user or 2 will get a "Fortiguard Intrusion Prevention - Access Blocked" message when trying to access any website. Other users are able to access the websites. What I see in FortiAnalyzer are logs with no username specified. We have FortiSSO, and it appears that it is not picking up the user logon event. Sometimes, getting the user to reboot will solve the issue but may take a few reboots. Another fix is to get the user to connect to another wifi network, then reconnect to the original network connection.  This issue has been happening intermittently for different users for well over a year now and the fixes mentioned above usually resolve this. However, I now have a user, who has been unable to access the Internet all day, so I'm looking for any possible help.  This does seem like an identity issue, where FortiSSO is not picking up the logon event but I do know

This may be a trivial question but I assumed incorrectly that the "Completed On" field in the tasks module would automatically populate once a Task was marked as completed but currently it doesn't. Do I need to create a separate playbook to update this or is there a simpler answer?Thanks, Nelson

Newbie looking for a link or general guide that will help me tweak some of these alerts.  One in particular: Rule Rule Name:  Ransomware detected on a hostRemediation:  Rule Description:  Identifies excessive non-executable file changes by the same process on a Windows host. Requires Windows Security logs or FortiSIEM Agent to be running on the host. Seems to occur anytime a user copies a folder.  Help!

hi I'm trying to ping 8.8.4.4 from my wan interfaces of my fortigate 40F (v7.0.13). Interface 'a' can ping correctly but interface 'wan' cannot reach the destination. Interface 'wan': #execute ping-options source 138.99.23.193 #execute ping 8.8.4.4 PING 8.8.4.4 (8.8.4.4): 56 data bytes --- 8.8.4.4 ping statistics --- 5 packets transmitted, 0 packets received, 100% packet loss Debug:  # diagnose debug enable # diagnose debug flow filter addr 8.8.4.4 # diagnose debug flow filter proto 1 # diagnose debug flow show function-name enable show function name # diagnose debug flow trace start 100 # id=20085 trace_id=729 func=print_pkt_detail line=5864 msg="vd-root:0 received a packet(proto=1, 138.99.23.193:14760->8.8.4.4:2048) tun_id=0.0.0.0 from local. type=8, code=0, id=14760, seq=0." id=20085 trace_id=729 func=init_ip_session_common line=6043 msg="allocate a new session-0509fe9d, tun_id=0.0.0.0" id=20085 trace_id=730 func=print_pkt_detail line=5864 ms

Greetings -Sometime within the last couple of weeks, our users' Google Drive App stopped syncing with the Web App and vice versa.I set up a Google Drive account as a test and couldn't even sign in.We removed SSL inspection from our firewall policy for a minute and everything started working.Adding an an exemption in SSL inspection for *.google.com did not fix the issue.Note: We are a Mac environment. Any advice would be welcome.Thank you in advance!FortiGate 

Hello! I need help with setting up agentless polling configuration on FortiGate.I have a FortiGate device and an AD server where our company's users are located. I've been exploring the option of using agentless polling to implement and monitor these AD users in FortiGate. I'm having trouble adding FSSO-CA (FSSO Agent on Windows AD).I can see the server and can telnet using port 445, but the FSSO-CA status shows as disconnected. Could the issue be related to the user? What privileges and rights does this user need? How should I correctly configure this setup so that FSSO Agent on Windows AD can see FortiGate and function properly?Please assist me.#FortiGate FortiAuthenticator FortiAnalyzer 

Hello everyone, im testing a fsso solution where i have one machine that work as a collector agent, and another machine thath act as a DC, all the connection fortigate/fsso, fsso/dc and policy match work fine but i have a mismatch in the logon user list under the voice Type, which tell me is "DC-Agent" even if i have specified in the collector agent to work in pooling-mode. I have restarted more than one time both dc and collector just to see if something change but nothing. I dont know if this is just a bug or a real problem  BR, Giuseppe

Hi Team, I currently have an automated stitch to restart a process when the FortiGate reaches conserve mode - following this link: Restart WAD or IPS when conserve mode hit... - Fortinet Community Is it possible to have SNMP traps to be sent when the CLI script/automation is triggered in my FortiGate? Is there an OID intended for this? or others which must be configured? Currently using this CLI Script as Action: diagnose test application ipsmonitor 99 Thanks 

Hello, I am trying to block all traffic from Russia except Yandex mail. I have an address group for all Yandex IP addresses. Can someone explain why my Allow Yandex rule doesn't get priority and SMTP traffic still trying to go through Country Block rule and getting denied? I am attaching the screenshot.  Thank you very much!  

We are currently in the process of switching over to the FortiClient VPN (v7.0.0.0029) from the DrayTek Smart VPN Client and I notice that all of my traffic is now being piped through the VPN, instead of just the traffic that requires it. Our FortiClient is set up to use IPsec VPN. The DrayTek VPN has a setting named Use default gateway on remote network and I always have this switched off.  I'm trying to find a similar setting in the FortiClient VPN. Sorry.  I'm not overly familiar with all the network jargon, so please forgive me for that.  I see a bunch of settings under Advance Settings, but nothing that appears equivalent to the DrayTek setting. Thank you in advance for any assistance provided.

Hello,I would like to retrieve information about compromised hosts and threat types from FortiAnalyzer's FortiView using either the API or CLI, but I am unsure of how to proceed. If anyone has experience or knowledge about this, could you please provide some guidance?

My current setup is as follows: ISP using PPOE---- Cisco RV340----Four (4) NetGear lvl2 Switches.The Cisco RV3340 has the Firewall turned on and does VPN using Cisco AnyConnectI also have the following VLANS on the Cisco RV340: VLAN1 (Default) using private IP subnet 192.168.6.x/24VLAN 20 192.168.20.x/24 DHCP enabledVLAN 30 192.168.30.x/24 DHCP enabledVLAN 40 192.168.40.x/24 DHCP enabledVLAN 50 192.168.50.x/24 DHCP enabledVLAN 60 192.168.60.x/24 DHCP enabledVLAN Ports to Table have tagging enabled for Lan 1 to Lan 4 for VLANS 20 to 60 with VLAN1 untagged.NAT is enabled on the WAN 1 interfaceI want to setup a Fortinet F80 in front of the Cisco RV340. The reason for this is to setup a Site-to-Site VPN connection with another Fortinet F40 that will allow me to do DR for my backups from one (1) QNAP NAS to another QNAP NAS.My setup would be:Site 1. ISP using PPOE---- Fortinet F80----Cisco RV340----Four (4) NetGear lvl2 Switches----QNAP NAS.Site 2. ISP using PPOE----Fortinet F40----QNA

I have a Fortigate firewall with x2 VDOMs, root and user created called "management access". root and management access have an inter-vdom link between them to exchange traffic and because of the requirements root is the "management vdom" and used as management access for us to manage our customers firewall. The problem I am facing is that you cant configure SNMP in a non "management vdom", so I have configured SNMP on the inter vdom link in root as a workaround which the management access vdom is directly connected to. The problem is I cant seem to SSH onto the firewall using the intervdom link from our management jump box.Does anyone know if its possible to SSH to a Fortigate on an intervdom link from outside the Fortigate firewall? I have checked routing+firewall policies but it does not appear to work.

I have a couple of user that for some reason got assigned to the Default policy when they should have been assigned to our internal policy.  One of the users is our CTO.  So my question is there a way from FortiCloud EMS to move the user to the correct policy?  Or really anyway that does not involve interrupting the end user.

Does anyone have a recommendation on how to set up two IPsec tunnels? The client sites are using Fortigate-60e (Firmware 7.2), which will be using the home WAN internet with a one IPsec tunnel back to our HQ. But we are hoping to add another tunnel to the client fortigate to another backup HQ site in case the primary HQ goes down. Not sure if there is more than one way of doing this. 

Hi Fortinet Community, One of our clients wants to upgrade their FortiGate (physical appliance), deployed on-prem as an edge firewall. The current running version is v7.4.2, and the client wishes to upgrade to v7.4.3. Could you please confirm if v7.4.3 is a stable version and does not contain any significant bugs or issues? If it is not stable, could you suggest a stable version of FortiGate to upgrade to? 

I am using a VM image of Fortigate version 7.2.7 that I downloaded from the Fortinet website.I have the following problem: I configured VLANs on the firewall to control communication between VLANs. After one hour, the communication between two different devices via the firewall stops.To resolve this, I need to format the firewall and restore the backup, which makes it work for another hour.I am using EVE-NG version 6.2.0 and emulating Fortigate 7.2.7. I have tried other versions as well (EX: 7.0.0, 7.2.0), but the same error occurs.

Hello everybody,I'm struggling with deep packet inspection. My scope is not to use the FORTINET_CA_SSL certificate. But there is one thing I don't understand:only the certificates under the "Local CA Certificates"section can be used? Can't I use the certificates under the "Remote CA Certificates" section? If not, what kind of certificates can be added to the Local CA Certificates section?It's not deeply clear to me the difference between the two sections. Thank you for your help!  

Hello, I am a user of Fortigate 7.4.4. I have an architecture based on a root VDOM, where my WAN connections arrive, and then interconnection links with my child VDOMs (as shown in this diagram visible in the Fortigate documentation). My infrastructure is shared with a client. My client wants to set up an IPSEC VPN on their VDOM but is encountering problems and needs logs. The logs are not very verbose, and there are even no logs in the FortiGate GUI for their VDOM. I have to use the CLI (still within their VDOM) to provide them with traces. What can I do to give my client more visibility? Thank you for your help.

Hello everybody,I want to perform custom deep inspect, but I don't wanto to use the default FORTINET_CA_SLL certificate, so I decided to create a custom profile.(I'm working on FortiOS 7.2.8)I generated my certificates with Let's Encrypt, and I have 4 files:cert.pemchain.pemfullchain.pemprivkey.pemSome informations inside them are:1) cert.pem{ "name": "\/CN=xyz.com", "subject": { "CN": "xyz.com" }, "hash": "xyz", "issuer": { "C": "US", "O": "Let's Encrypt", "CN": "E5" }, "version": 2, "serialNumber": "xyz", "serialNumberHex": "xyz", "validFrom": "240628134133Z", "validTo": "240926134132Z", "validFrom_time_t": 1719582093, "validTo_time_t": 1727358092, "signatureTypeSN": "ecdsa-with-SHA384", "signatureTypeLN": "ecdsa-with-SHA384", "signatureTypeNID": 795, "purposes": { "1": [ true, false, "sslclient" ], "2": [ true,

Hi,i have problem with correct settings for VLAN mangment.I have two subnetsLAN (192.168.0.0/24) VLAN1 (connected to D-LINK Switch)MGM (10.10.5.1) VLAN5 (FortiSwitch) Two switches are connected to my Firewall SonicWall on separete port (PORT0 for D-LINK, PORT4 for FortiSwitch tagged 5) Fortiswitch is connect to my firewall on port 23 (native VLAN 1, Allowed VLAN 5) I Create VLAN interface on Firewall and set access rules for allow all traffic (temporary) between VLAN 1 and 5 On Fortiswitch i connect two devices on port 7,25 (Native VLAN5, Allowed VLAN 5)Communication work, i can access from LAN to MGM via ping and https and vice versa, devices inside VLAN5 also have communication beetwen each otcher. Problem is when i try connect from LAN to FortiSwitch to managment access. I can't any ping or HTTPS.In FortiSwitch i create VLAN5-MGM with ID 5 with ip 10.10.5.1/24 and access HTTPS,PING,SSH as physical interface select only one available internal (on System->

Hi all, so I've gotten a training kit from my new employer, which includes a FortiGate 60F, FortiSwitch 108FPOE and a FortiAP 231F. Setting up the basic stuff was more of less painless, but now i'm struggling with some VLAN configuration issues.  Let me start of by describing the topology. The FortiGate is connected on wan1 to the internet. Port A and B are connected to the FortiSwitch through FortiLink on ports 9 and 10 (SFP RJ45).  What i'd like to achieve is create two access ports for VLAN30 on port 2 of the FortiGate and port 8 of the FortiSwitch.  Tried a million different configurations but the one that makes sense is this one:- Get port 2 out of the internal VLAN Switch on the FortiGate.- Create a new VLAN Switch and assign it VLAN ID 30, and use port 2 as it's member. - Create address object matching subnet - enabled- DHCP server - enabled On WiFi & Switch Controller -> FortiSwitch VLANs- Create VLAN 30 - Set IP/Netmask

Hello everybody,I am facing an issue with my FortiGate firewall i have activated LDAP there is no problem the test of connectivity is successful, but whenever i tick the secure connection and activate the LDAPS the test of connectivity replies with can't contact LDAP server what is the problem ? (am not using any certificate as the option is untick)regards

Hi allHow can I create report with multiple data sources and conditions in one repportexemple: One repport with   Account Created/Deleted and Accounts Added to Windows Local Admin GroupBest regards

I am currenlty migrating from checkpoint 3200 ha with smart console to dual 200f fortigates, my questions, when applying the ip's to the interfaces on the forti, checkpoint gw 1mgmt: 192.168.x.253/24port 1: 10.76.x.148/24port 2: 4.36.x.70/29 (wan)port 3: 172.16.x.2/24port 4: 70.91.x.80/29 (secondary wan)port 5: 1.1.1.1/24 checkpoint gw 2mgmt: 192.168.x.254/24port 1: 10.76.x.149/24port 2: 4.36.x.71/29 (wan)port 3: 172.16.x.3/24port 4: 70.91.x.81/29 (secondary wan)port 5: 1.1.1.1/24 Very new to fortinet and trying to learn this instead of using forticonverter. I tried kind of setting this up on the forti but it didn't work properly, we currently have 5 static ip's on both of our isp providers, when I configure the ha on my fortigates, they both seem to be taking the same management ip and I have to manually go in and change it to gain access back to the gui. Just trying to see where I need to start, thanks in advace.