Solved

My goal is to skip emails only when either SPF or DKIM is correct (or both of whem). And the answer to this is DMARC. But what if some sender does not have it? For example: sender №1 with SPF, DKIM and DMARC, sender №2 with SPF, DKIM and without DMARC. Mail from sender №1:... (some antispam techniques) ...1) FortiMail checks DMARC for domain and find it.2) After this FortiMail look into SPF with DKIM and allow email only if either SPF or DKIM is correct (or both of whem).... (some antispam techniques) ... Mail from sender №2:... (some antispam techniques) ...1) FortiMail checks DMARC for domain and can't find anything because it's not published.2) FortiMail anyway checks SPF and DKIM, and allow email only if either SPF or DKIM is correct (or both of whem).... (some antispam techniques) ... How can I configure policies to achieve this result?

Hello Team,I am new to FortiSIEM and i could be making some obvious mistake but kindly help. We onboarded a custom application onto FSM and wanted to build custom parser so that we can get notified of failed logins. I tried building one and i Keep running into the same issue "Failed to execute node: collectFieldsByRegex. Please check the usage of API and attribute name." Not sure why.. My xml is as below:<eventFormatRecognizer><![CDATA[SOE: BAD\s+]]></eventFormatRecognizer> <parsingInstructions> <collectFieldsByRegex src="$_rawmsg"> <regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<reptDevName:gPatHostName>\s+SOE:\s+<_body:gPatMesgBody>]]></regex> </collectFieldsByRegex> <collectFieldsByRegex src="$_body"> <regex><![CDATA[?:SIGN-ON <srcIpAddr:gPatIpAddr>\s+\(<:gPatStr>\)\s+<:gPatStr>\s+-\s+d+\s+<:gPatStr>\.<:gPatStr>:

Hi FortiSwitch adminsI have a new FSW 124F with OS 7.2, standalone.When I go to menu Switch > Physical Ports, when I select one port and click edit I have this error.(URL https://1.2.3.4/switch/physical/edit?name=port1).Any of you has seen such error?500 Internal Server ErrorThe server has either erred or is incapable of performing the requested operation.

Hello Fortinet Community   So under the main network hood we have a FGT100F with a specific subnet policy towards the sd-wan interfaces with APP Control,WEB Filter and AV modules enabled.   More specifically on the APP Control module we have enabled between others HTTP/HTTPS.Browser as allowed SSL also allowed and Web Browsers category as allowed. Certificate Inspection Enabled   The problem now is that SPECIFICALY the Vivaldi browser wont reach any wabpage from ANY PC on the targeted subnet.Furthermore in inserted both in the PC and the certificate store of the browser the FGT SSL Cert. Disabled all of the track privacy settings of the Vivaldi browser,no webpage reached still. I also tried to disable all of the above mentioned modules in the policy,restarted the browser on a test PC with no avail.   Any ideas?     Thanks in advance!

Observed that using my domain address like xxx@xxx.com having the bad IP, multiple emails has been send to bulgaria, japan etc. How to resolve that issue. 

 Hi, I want to filter GTP traffic on the Fortigate 201F device used in the Telco system. When I examine the forward traffic logs, I only see GTP as the protocol. Ssh, ping, data, etc., are coming over GTP. However, I want to allow data access and block ping access. How can I do this? Thanks

Hello FortiCommunity, I am desperately searching for the currently recommended release for the FortiMail 200F.Is there a document or something where I could regularly look this up? Thank you very much for your help. FortiMail 

Hi, I need to understand the risks of enabling tcp-session-without-syn for asymmetric environment. Can someone help to explain to me all the risks if I enable this? Thank you 

Hi all,We have upgraded our windows server in 2022 version and since this update, no MacOs can't access to the file share.  No firewall activated on windows server.No specific Gpo are set on windows server.I tried to connect the share with the short name, fqdn name and IP address, no success. (smb://shortname...) No problem with windows computer. We have a file share on windows server 2012R2 (not upgraded) and MacOs can access to the file share. thank you for your help.  

Fortigate Version : 7.2.8 Strange thing we are seeing is that everytime there is a blocked connection to a destination - could be via any of the security profile, Fortigate initiates a local traffic to the same destination. The traffic does get denied eventually but what could be the reason for this behaviour. I have put a screenshot of the example. Line 2 and 3 are the user initiated forward traffic and Line 1 and 4 are local traffic initiated from the fortigate itself. Its a vdom based setup - that is the reason for multiple line of logs.   

Hi Team,I blocked many IPs on FGT daily is it applicable to send daily report of the blocked IPs in that Day with the Reputation associated with each IP Thanks in advance,FortiSOAR#Schedule

NGFW performance is measured with Firewall, IPS and Application Control enabled.Threat Protection performance is measured with Firewall, IPS, Application Control and Malware Protection enabled.

Hi!Unlike Fortigate VM, neither FortiManager nor FortiAnalyzer VM respond to KVM "qm shutdown" command that "send an ACPI event for the guest OS". Is this by design - if so, why?This is required when the Host is required to perform emergency shutdown of all Guests.FerenX 

Hi i've a Forti 60F,i've to create manage 2 WAN for the customer.The first WAN have an internal LAN where NAT is enable, and I have no problems with this network.The second WAN have an unique cable but Is a trunk of 2 LAN, with 2 different gateway. In the lan side of the 60F i've to configure both lan and direct, with 2 different gateways, always to the same outgoing wan port 2. How is it resolved? By making internal VLANs?   Thanks

There is a  CLI command to force the FSW NTP SYNC again to my FGT NTPI have my Fswitch managed Through my FGT. FortiSwitch 

Hello,I need to configure my FW to not use this protocol and I can`t find how to do it.

Hi, Because of "Troubleshooting Tip: Web pages not loading or taking too long to load when a web filter is applied"I changed my HTTP, AND HTTPS Policy's to proxy mode. The websites load fine, but if I turned on the Antivirus scannig, it takes an extremly extremly long time to download files (I really didn't have time to wait for the end). I would like to download a 50 MB ZIP file. I can download it without antivirus scanning in about 1 minute (or in flow mode), but if I turn on the antivirus scanning (in proxy mode) I can't download it in an hour. What could be the problem?  (Fortigate 201F; ver.7.4.3) 

On CLI, when a user tries to assigne the option ‘peer id from dialup group’ in the dial-up IPsec tunnel: # config vpn ipsec phase1-interface(phase1-interface) # edit <phase1 name>(phase1 name) # set peertype dialup(phase1 name) #set usrgrp <usergroup name>Error: auth_user not a local usernode_check_object fail! for usrgrp <usergroup name> value parse error before 'test'Command fail. Return code -1 On GUI, an error '-1: Invalid length of value’ will be visible when a user tries to assign a user group to the option ‘'peer id from dialup group’'. Solution: A user group can only be assigned/used in option ‘peer id from dialup group’ if every user in that group is locally created or the user group will have a Group type of ‘Firewall’. My Problem is that the user group RADIUS I use is from the group type Firewall, and it doesn't work. The user group RADIUS has a remote group being a RADIUS-Server. Is there no way to authenticate with the F

helloI have FortiGate 100F before 8 months when I buy this device I get contract registration code from supplier now I need this number can I find this Number from FortiGate GUI or CLI Thanks

Hi, I am trying to create policies based on AD-Users. So  I connected our FGT to our DC and was able to retrieve the users I would like to use in our policies. If I create a policy (LAN->WAN) -> Source: Username of the AD User ->> Destination WAN (all Services) the connection is not working. So I assume there is some component missing. As far as I understood, we will have to install the FSSO Agent on Windows AD and create a connection on our FGT to this SSO Agent, to authenticate our logged in PC-Users to the FGT  (=the FGT can check if the user is logged in correctly to AD). Is this correct, or should the above mentioned, also work without any Clientsoftware in AD-Environment? Thanks a lot!

Hello everyone. In our infrastructure, we have a Fortigate 100f. Situation: we are replacing our main switches. I have attached an image for you to see the changes. Basically, we want to remove core-1 and core-2 switches and will keep core-3 and core-4. Currently, everything has been migrated except for VLAN 1, where the firewall and the network communications of the switches are located. The only change I really see here is in MAC addresses since we are configuring the VRRP group in the new cores. That said, when we move VLAN 1 to cores 3 and 4 to finally shut down cores 1 and 2, everything works perfectly except for the services we have in the DMZ of our Fortigate. The question I have is, what could be changing if currently everything is working including the DMZ, and when we make the switch, everything works except the Fortigate's DMZ. Basically, the behavior of the Fortigate is that it sends the traffic, which it is currently correctly sending to the LAN, to another interface or to

Hello!I've only slightly modified Replacement Message "post_admin-disclaimer-text" but kept out-of-box system variables. However, as per screenshot, variable values aren't being substituted (or are empty valued)... Is this a fault, or am I'm doing it wrong?  FG200F-1 (global) # show system global | grep post-login-banner set post-login-banner enable FG200F-1 (global) # show system replacemsg admin post_admin-disclaimer-text config system replacemsg admin "post_admin-disclaimer-text" set buffer "Unauthorised Access Prohibited. %%LAST_SUCCESSFUL_LOGIN%%; %%LAST_FAILED_LOGIN%%" end     c:\Temp} ssh -l username FG200F-1 username@FG200F-1's password: Unauthorised Access Prohibited. ; (Press 'a' to accept): FG200F-1 # exit Connection to FG200F-1 closed.Also.. How to include line breaks?

Hi, I am currently looking for Security Pop IP address of Toronto - Canada. I cannot find the IP address, here is in the link.https://portal.prod.fortisase.com/api/v1/public/egress/ips I hope someone can help me to provide the IP address of the said Security Pop, thank you in advance.

current F 90D version is 6.0.9 build0335, this FW works as UTM, wan primary ip is private and secondary ip is the public routed throughout the private ip to reach internet, all filters to current public ip (set as secondary) are enabled to allow only from our network and if no allow rule is enabled by default all sessions to Fortigate Iitself should be dropped ( but some how icmp is still available from everywhere) . Following is debug output:2024-05-10 15:19:10 id=20085 trace_id=58 func=print_pkt_detail line=5455 msg="vd-root received a packet(proto=1, xxxPublicIcmpSourceIp:6164->xxxPublicWanIpxxx:2048) from wanvlanxxx. type=8, code=0, id=6164, seq=1."2024-05-10 15:19:10 id=20085 trace_id=58 func=init_ip_session_common line=5619 msg="allocate a new session-00767dad"2024-05-10 15:19:10 id=20085 trace_id=58 func=iprope_dnat_check line=4921 msg="in-[wanvlanxxx], out-[]"2024-05-10 15:19:10 id=20085 trace_id=58 func=iprope_dnat_tree_check line=812 msg="len=0"2024-05-10 15:19:10 id=

we are currently on FortiOS 7.2.7.is there any benefit to upgrading to 7.4.xx ?is there any vulnerability that is patched in 7.4.xx that is now in 7.2.7 ?