Solved

Hi there,I am accessing my FortiGate web GUI using a public IP address.My question is, whenever I access the web GUI using the domain name, it does not show any error regarding an unsecured connection. However, whenever I try to access it using the IP address, it shows an unsecured connection error.I want the FortiGate to only be accessible via the domain name with a secured, encrypted connection, and not via the IP address

Hi All, I have taken then backup FG configuration by using the scp client command which i used to take the backup as below. Sftp server -- > scp admin@<FortiGate_IP>:sys_config <location> Question 1 : sys_config  ( is it full configuration file as like what we are taking the normal backup config from GUI -- > admin --> configuration -- > backup -- > downloaded with xxxxxx.conf Question 2 : Can we use the "sys_config"  scp client backup file to restore the firewall configuration in the Manual GUI method  admin --- > configuration -- > restore -- > upload -- > "sys_config" Does it work or any problem with this restore proceedure ?

Greetings  Hello guys, please give me some tip to solve this. We deployed FortiSIEM supervisor and a collector for Windows Agents that are remotely on branch sites, they reach collector and supervisor with FQDN using public ip (port 443) no IPSec can be established. Internally the Supervisor and Collector communicate each other with private IP, we noted that Windows Agents can register normally, but when template is applied, they (agents) try to reach the collector through private IP, not the fqdn or public IP, for us this is reasonable because collector health on supervisor shows the private IP for collector. On windows Agent we run Wireshark, and effectively note that SYN packets are constantly sent to collector private IP. How this can be solved? there are a way to say that Windows Agents must send data to collector public IP instead of private?, we try to re-register the agent using collector as a proxy but once the template is applied, they start to s

I have a site to site VPN, i want to apply a traffic shapping to specific traffic (sourc IP), but in the shaping policy it is not matching the traffic through the IPSEC tunnel. There are some configuration that works different for interface like wan and not for IPSEC tunnel ? FortiGate 

Unable to load SD-WAN rules with firmware 7.4.3. This error is already in the list of errors in firmware 7.4.3 but there is no update to fix it

hi everybody i want to limit bandwith of sentinel one packet antivirus in my lan.i don't see the signature of this application on my fortigate 100 D THANKS FOR HELP 

Buenas,Cambie mi Forti AP de oficina,por ende, cambio su IP. Ya tengo acceso al Forti AP sin embargo, mi Fortigate no lo detecta y aparece como Offline. Recalco que los segmentos entre el Forti AP y el Fortigate si tienen comunicación, sin embargo, mi FTG sigue sin tomar nuevamente el Forti AP. Ya lo reinstalé de fábrica y sigue el mismo problema

why the formula that allows to get column's names from log: select * from $log .... doesn't work   

I would like to know if there is a site on which I could have the possibility of paying for labs with the possibility of repeating them several times. The courses concerned are the following: FortiGate Security 7.2 and FortiGate Infrastructure 7.2. I don't want the Fortinet Institute labs because you can't start again once you start.

Hello everyone :) As the name suggests, I'm trying to recover the ip addresses of my fortigate's interfaces.I found this command but it only returns the interface name: /api/v2/cmdb/system/interface/Overlay-A/ "results": [{"name": "Overlay-A","q_origin_key": "Overlay-A","q_limited_permission": true}],I've seen in the GUI via the API Preview button that there are formats with ip, remote-ip, etc. fields, but the following command doesn't return anything satisfactory: /api/v2/cmdb/system/interface/Overlay-A?format=ip"results":[{"q_limited_permission":true}], Can you please help me with this? Hyjaal

Has anyone been able to move FortiSwitch interfaces to a different VDOM than where FSW is?  I added FortiSwitch to root VDOM and moved some interfaces to another VDOM following this guide: https://docs.fortinet.com/document/fortiswitch/7.4.2/fortilink-guide/801172/multitenancy-and-vdoms I created a VLAN on the new VDOM and assigned to the switch ports. However, when connecting a device to one of these ports, I'm unable to get the device to have an IP assigned from the VLAN.  When checking "FortiSwitch Clients" list, I find the connected device under "root" instead of the new VDOM, and It's assigned the default VLAN 1 from root, rather than the VDOM assigned to the port. I'm running FortiOS 7.4.3 on FGT and FortiSwitch 7.4.2.

after login and getting session id i will upload an 1,5 MB file with the following code: def sendSmallFile(file_content_as_base64, file_name): print("try to send small file to sandbox") print(f"start of base64 content: {file_content_as_base64[:100]}") print(f"got filename: {file_name}") submitURL = "https://fortisand-api.our-domain.de/jsonrpc/" submit_json_data = { "method": "set", "params": [ { "file": file_content_as_base64, "filename": file_name, "skip_steps": "2", "url": "/submit-file", "type": "file", "vrecord": "0", "enable_ai": "", "forcedvm": 1, "browser": 0 } ], "session": session_id, "id": 11, "ver": "4.4.0" } response = requests.post(submitURL, json=submit_json_data) sid = getValueFromResponse(response.json(), "sid") print(f"sid: {sid}") the b

Hi team, Is there a way to exempt traffic for certain apps like Teams from going via SASE? there are issues reported by end users that teams calls are getting disconnected and there is loss in audio sometimes.  

I am currently working on FortiGate Captive Portal with Guest Users, and wondering if I can edit the email received by the guests. This is my reference link - https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-Captive-Portal-with-Guest-Users/ta-p/278606On step # 2, a sample output is provided when the credentials are sent to the guest. I am looking at removing the sponsor and company field. Is that possible? Thank you!    

Reports started rolling in on Monday, 22 April 2024, at approximately 07:00 AWST (Sunday, 21 April 2024, 23:00 UTC) that people could not access HTTPS websites but could access HTTP websites.We found that the common denominator was that only customers with a PPPoE dialler for the WAN/Internet service were impacted.We've seen this in the past and resolved it by adding "set tcp-mss 1452" to the LAN/INSIDE interface/s configuration of our Fortigates.We provide Internet to many of the customers, but not all - it does not seem to be isolated to a specific network or ISP.I wasn't involved in the initial information gathering, so I'm unsure if it was limited to specific sites, but I was aware that sites such as office.com (all of Microsoft), www.bom.gov.au, and www.news.com.au were impacted.The question is, why is it only impacting Fortigates (we have customers with different firewall vendors who didn't have the same issue), & why were they working fine before when the repo

Hello everyone, I was trying to make a Windows Deployment Services server working in my infrastructure with my Fortigates.We have two different interfaces: One for the servers and another one for the Clients Computers.I did a lot of tests and it's working without any problem when the computer is into the server interface. On the Client interface, I tried commands "next-server" and "filename". the computer is seeing well the WDS and the image as attached, but stuck at downloading and fail...  I saw from internet that when it's 2 differents network the ip helper is helping, but in this case should I have to do that? I tried with dhcp relay etc but didn´t work, maybe I did it wrong... Many thanks

Hi everyone,I'm looking to enhance the security of my FortiGate device. I want to set up a rule or policy that automatically blocks the source IPs trying to log in as admin and failing multiple times. For instance, if someone tries to log in with the wrong password 3 times(or more), the source IP should be automatically banned for a certain period of time.Could someone guide me on how to configure this on my FortiGate? Is it possible to do this directly from the admin interface, or do I need to configure any additional security profiles? Detailed instructions or any advice would be greatly appreciated.Thanks in advance.

Hi wireless adminsAnyone knows what can be the following FAP log?Log Description: Wireless bridge intrusion detected Action: wids-detect-firstThreat Type: wl_bridge Manufacturer: LoopcommMessage: WIDS wl_bridge: data/DS chan 11  

My goal is to skip emails only when either SPF or DKIM is correct (or both of whem). And the answer to this is DMARC. But what if some sender does not have it? For example: sender №1 with SPF, DKIM and DMARC, sender №2 with SPF, DKIM and without DMARC. Mail from sender №1:... (some antispam techniques) ...1) FortiMail checks DMARC for domain and find it.2) After this FortiMail look into SPF with DKIM and allow email only if either SPF or DKIM is correct (or both of whem).... (some antispam techniques) ... Mail from sender №2:... (some antispam techniques) ...1) FortiMail checks DMARC for domain and can't find anything because it's not published.2) FortiMail anyway checks SPF and DKIM, and allow email only if either SPF or DKIM is correct (or both of whem).... (some antispam techniques) ... How can I configure policies to achieve this result?

Hello Team,I am new to FortiSIEM and i could be making some obvious mistake but kindly help. We onboarded a custom application onto FSM and wanted to build custom parser so that we can get notified of failed logins. I tried building one and i Keep running into the same issue "Failed to execute node: collectFieldsByRegex. Please check the usage of API and attribute name." Not sure why.. My xml is as below:<eventFormatRecognizer><![CDATA[SOE: BAD\s+]]></eventFormatRecognizer> <parsingInstructions> <collectFieldsByRegex src="$_rawmsg"> <regex><![CDATA[<:gPatSyslogPRI><_mon:gPatMon>\s+<_day:gPatDay>\s+<_time:gPatTime>\s+<reptDevName:gPatHostName>\s+SOE:\s+<_body:gPatMesgBody>]]></regex> </collectFieldsByRegex> <collectFieldsByRegex src="$_body"> <regex><![CDATA[?:SIGN-ON <srcIpAddr:gPatIpAddr>\s+\(<:gPatStr>\)\s+<:gPatStr>\s+-\s+d+\s+<:gPatStr>\.<:gPatStr>:

Hi FortiSwitch adminsI have a new FSW 124F with OS 7.2, standalone.When I go to menu Switch > Physical Ports, when I select one port and click edit I have this error.(URL https://1.2.3.4/switch/physical/edit?name=port1).Any of you has seen such error?500 Internal Server ErrorThe server has either erred or is incapable of performing the requested operation.

Hello Fortinet Community   So under the main network hood we have a FGT100F with a specific subnet policy towards the sd-wan interfaces with APP Control,WEB Filter and AV modules enabled.   More specifically on the APP Control module we have enabled between others HTTP/HTTPS.Browser as allowed SSL also allowed and Web Browsers category as allowed. Certificate Inspection Enabled   The problem now is that SPECIFICALY the Vivaldi browser wont reach any wabpage from ANY PC on the targeted subnet.Furthermore in inserted both in the PC and the certificate store of the browser the FGT SSL Cert. Disabled all of the track privacy settings of the Vivaldi browser,no webpage reached still. I also tried to disable all of the above mentioned modules in the policy,restarted the browser on a test PC with no avail.   Any ideas?     Thanks in advance!

Observed that using my domain address like xxx@xxx.com having the bad IP, multiple emails has been send to bulgaria, japan etc. How to resolve that issue. 

 Hi, I want to filter GTP traffic on the Fortigate 201F device used in the Telco system. When I examine the forward traffic logs, I only see GTP as the protocol. Ssh, ping, data, etc., are coming over GTP. However, I want to allow data access and block ping access. How can I do this? Thanks

Hello FortiCommunity, I am desperately searching for the currently recommended release for the FortiMail 200F.Is there a document or something where I could regularly look this up? Thank you very much for your help. FortiMail