Solved

Dear Community, I tried creating a new module and after creating and adding the module to the navigation pane in the application editor, I am not able to see the created module on the left-hand sidebar of the FortiSOAR windows to navigate across modules in the system.Please can anyone let me know if there is any additional step I am missing?Thanks

During a recent VAPT security scanning, TCP port 514 was flagged out to be have weak SSL cert.The recommendation was to get a propert SSL certificate for the appliance.Can we disable port 514 on the Analyzer ?my firmware version is 6.4.10. will upgrade to version 7.2 soon. Contact the Certificate Authority to have the certificate reissued.Purchase or generate a proper certificate for this service.

Hi Team, I currently have a FortiSIEM version 7.0.2, but I can’t find any official documentation stating that it supports log collection for TrendMicro VisionOne. However, I can see from the FortiSIEM External Systems Configuration Guide (7.1.1) that FortiSIEM does support TrendMicro VisionOne. In light of this, I would like to know whether it is necessary for me to upgrade my FortiSIEM from version 7.0.2 to 7.1.1 or a higher version in order to collect logs from TrendMicro Vision? Or, in fact, can version 7.0.2 support TrendMicro VisionOne as long as I obtain the normalization configuration file?"Regards,Bruce Liu#Fortisiem #VisionOne #TrendMicro

Following issue shows a wrong connection to Fortiguard-log server, password is correct and worked properly with another Fortigate device, diagnose log is activate but I can't connect to Forticloud:  FORTI-40F # execute fortiguard-log login xxxMAILxxx xxxPWDxxx2024-03-13 12:52:46 [643] fds_https_stop_server: 173.243.143.6:4432024-03-13 12:52:46 [205] __ssl_data_ctx_free: Done2024-03-13 12:52:46 [1047] ssl_free: Done2024-03-13 12:52:46 [197] __ssl_cert_ctx_free: Done2024-03-13 12:52:46 [1057] ssl_ctx_free: Done2024-03-13 12:52:46 [1038] ssl_disconnect: Shutdown2024-03-13 12:52:46 [554] fds_https_timeout: Connection timed out, svr=Forticlient-svr2024-03-13 12:52:46 [246] fds_svr_default_on_error: Forticlient-svr: ip=173.243.143.6:443, reason=42024-03-13 12:52:46 [263] fds_svr_default_on_error: Forticlient-svr: Conn failes 1/22024-03-13 12:52:46 [145] fds_svr_default_pickup_server: Forticlient-svr: [2620:101:9000:143:173:243:143:6]:443Failed: FGT internal error(-1)Command fail. R

Hello, we are trying to deploy fortiweb-image docker image according following instructions: https://docs.fortinet.com/document/fortiweb-private-cloud/6.4.0/fortiweb-vm-on-docker/794267/deploying-fortiweb-vm-on-docker and our container is running but with no web server/GUI accessible and getting following error on docker logs:System is started!!!Program (sysinit) exitCaused by receive signal(9) can you please advise how overcome this error and expose the fortiweb GUI?  adding some info:1. docker image built and run as follows: (per above documentation instructions)cd ~/fwb/image-docker-64docker build -t fortiweb-image .cd script/./docker-fwb.sh -i fortiweb-image -n fortiweb-docker -e ChangeMe123 -g 7180 -m 81. we selected 7180 port for our testing for http server 2. docker psCONTAINER ID IMAGE COMMAND CREATED STATUS PORTS NAMES4075ec69f969 fortiweb-image "/bin/docker_init" 3 minutes ago Up 3 minutes 0.0.0.0:80->80/tcp, 0.0.0.0:443->443/tcp,

Hi,I've deployed a Fortinet Nextgen Firewall in AWS. Initially, the WAN interface IP is set to a local IP within the public subnet. However, when I attempt to change it to the actual public IP, I lose connection to the firewall entirely. As a result, I can no longer access it via HTTPS or SSH. Can anyone assist me in resolving this issue? My objective is to utilize the static public IP assigned by AWS for the WAN interface.Thanks

Hello, I noticed that my 60F 's Status LED not being "On"  after upgrade FortiOS to 7.2.8M.It was on while the FW is on 7.0.14MWhile the LED is off, everything seems working as expected.I am not sure if it is because of the design/feature change, or if it is a BUG?Anyone else faced the same issue? Thanks 

I'm seeking guidance on consolidating multiple policies into a single policy on my FortiGate device. Specifically, I have a scenario where I have numerous VLAN interfaces (approximately 100) under a single physical interface. Instead of creating individual policies for each VLAN interface, I'm interested in exploring the possibility of configuring a single policy that covers all VLAN interfaces associated with the physical interface.

Right now we have the inbound to our on premises Exchange server (hybrid - no mailboxes) set to 'All'. I need to use the ISD(s) to restrict to only MS. I have a Fortigate 100F with version 7. Anyone know which ones to use? 

We have a number of FGT devices running on 7.0.14 and all part of FortiManager, with the basic configurations being pretty much the same. One of those configurations is to setup AD users as admins based on LDAP. This process works great for all but 1 of our devices that's out in the field. I tested my "useradmin" account via the LDAP configuration page and got a return of successful. I am in our fw_admins group, which is assigned in the Administrators list for the FGT. However, when I try to login via the GUI with that same username and password, it tells me that my user cannot be found. I can test it all day via the LDAP settings or via CLI, and it consistently tells me that it's successful in hitting the LDAP server and authenticating me. It's just trying to login as an admin where it fails. I can log into any of the other 90 devices we have with that same username/password to admin them with zero issues, it's just the one. We are connected to that site via MPLS and/or VPN

I have the Fortigate VM in AWS and I am trying to setup Single Sign On connected to ADFS for my VPN users.  I am very new to ADFS.  The setup requires you to put in the SP info and then the IdP info.  I am very new to the whole ADFS thing but still in other places on the fortigate I have only had to setup the IdP pointing at my ADFS server and things worked fine.  Why is it asking for the SP too and who is the SP in this case?

Hello,I am trying to implement unsuccessful login attempts policy for local users.So if the user puts 5 times wrong password then he will be locked for some time.There are two local admin accounts.I have setup this, but the problem is that it will lockout whole firewall for login and not only userconfig system global    set admin-lockout-duration 300    set admin-lockout-threshold 10endSo I have tried this setting, but it seems that it is not triggered. Is this setting even relevant for local administrators ?config user setting    set auth-lockout-threshold 5    set auth-lockout-duration 900endThank youBR.D

Hello, I have a question with setting up an IPSec tunnel using IKEv2. In the FortiGate only one PSK needs to be specified. But in the Cisco ASA wizard I need to specify two PSK's. One from the local Cisco ASA and from the remote (FortiGate). How do I need to configure this, do I need to only add one PSK to the Cisco ASA, or is there an other solution?kind regards, Geert

Hello there, I need to make new connection with 4 FortiSwitches 448E FPoE and FortiGate 100F in HA cluster.Because distance between FortiGates and FortiSwitches is over 400 meters (different buildings) and I got 8 optic fibers for this connection.My question is what is best recommendation for connecting FortiSwitches with FortiGate to make it redundant and maximize speed of given ports.In FortiGate I was thinking of use X1 and X2.Also want to use FortiLink for management.Nice if both links will be used.In attachment network connection plan I was thinking off.Any suggestion or good practice will be nice to read.

i am trying to enable snmp to management engine opmanager.but it does not seems to work.what are the proper steps to configure the fortigate

I want to manage multiple fortigate devices.So i try to enable "Show Add Multiple Button".But i can't see the "Add Multiple Devices" button on  Device & Groups.I watch the video on youtube, it could be like this My FortiManager version is 7.2.4Has anyone else had this problem? Thanks.  

Friends, a question, I have a fortianalyzer VM. I have several Fortigate devices synchronized with the FAZ for reporting purposes.Previously, Total records for analysis were displayed: 60 days. Little by little it has been reducing and now I see Total logs for analytics: 20 days.Could you help me by indicating what this is due to?"Daily Log Limit Exceeded" alerts are also displayed.Will this be related to the reduction of Total logs for analytics: 20 day?I have 9 fortigates teams synchronized with the FAZ. 

Hi!I am trying to upgrade FortiClient 7.2.2.0864 to FortiClient 7.2.3.0929. I have never encountered any problems upgrading FortiClient before, but in this case I am unable to do this on Windows Server 2019. It works fine on Windows Server 2022. I am able to upgrade if I run the installation as an admin, but not as system. And I must admit, I would prefer to not upgrade FortiClient manually on 50+ servers. The error I get is the msi 1723 error.Error 1723. There is a problem with this Windows Installer package. A DLL required for this install to complete could not be run. Contact your support personnel or package vendor. Action CA_InstallFCTServices, entry: MSI_InstallFCService, library: C:\Windows\Installer\MSIFAAA.tmp Do you guys have any idea? I am puzzled as to why this is only a problem when upgrading as system, and on a Windows Server 2019.

Community Following issue showed a wrong connection to Fortiguard-log server, password is correct and worked properly with another Fortigate device, diagnose log is activate:  FORTI-40F # execute fortiguard-log login xxxMAILxxx xxxPWDxxx2024-03-13 12:52:46 [643] fds_https_stop_server: 173.243.143.6:4432024-03-13 12:52:46 [205] __ssl_data_ctx_free: Done2024-03-13 12:52:46 [1047] ssl_free: Done2024-03-13 12:52:46 [197] __ssl_cert_ctx_free: Done2024-03-13 12:52:46 [1057] ssl_ctx_free: Done2024-03-13 12:52:46 [1038] ssl_disconnect: Shutdown2024-03-13 12:52:46 [554] fds_https_timeout: Connection timed out, svr=Forticlient-svr2024-03-13 12:52:46 [246] fds_svr_default_on_error: Forticlient-svr: ip=173.243.143.6:443, reason=42024-03-13 12:52:46 [263] fds_svr_default_on_error: Forticlient-svr: Conn failes 1/22024-03-13 12:52:46 [145] fds_svr_default_pickup_server: Forticlient-svr: [2620:101:9000:143:173:243:143:6]:443Failed: FGT internal error(-1)Command fail. Return code 5FORTI-

I have a fortigate vm in aws.  I have setup a ssl vpn to a host on the local subnet of the inside interface and that works.  Now I want to expand it to a host in a different VPC in AWS.  For this it will need to route over a transit gateway to the other VPC.  The transit gateway routing works and can be verified.  I can ping and even telnet to port 22 from the fortigate to the endpoint in the other VPC. I am using browser based ssl vpn for testing. I tried to setup the following policy based routing:Incoming interface = ssl.rootOutgoing interface = port2 (private lan)Source = ALL and SSLVPNDestination = 10.0.0.0/8   (this CIDR will be routed over the transit gateway because of the attached tgw route)Schedule = alwaysService = ALLAction = Accept However, when I test this policy has no hits.  What am I doing wrong???

Is if possible to Create Multiple SSL VPN Groups that have limited access to different Networks AdminVPN Users able to get to systems and managementStandardVPN Users able to get to what systems they need but limitedand so on Thanks

Hello, everyone!I hope everyone is doing great. Recently, we upgraded our 100F firewall from 6.4.6 all the way up to 7.4.3.Unfortunately, SD-WAN Rules page doesn't load anything at all.Is there a new version to be released soon? How can I access it through GUI using another approach if possible? Best,Sagvan Saleem

I have many corporate Fortinet firewalls in play, but finally just went and bought one for myself (a 60e, great for home internet and labs) so am posting with my personal acct - and am seeing the following weird issue.   I have created an address group blocking a number of countries (Russia and China primarily, seeing attempted connectoin attempts from various IP's). While I do 'allow' SSH on wan1, the administrator super_admin and my acct profile_admin are only allowed from certain IP ranges (my inside subnets and the VPN DHCP range I hand out when I connect to my own network from outside) so that's already fairly locked down.I am seeing logs denying 'admin' by blocked IP because it falls outside trustedhosts range, but if the bots try any other account (that does NOT exist on the Fortinet) it allows the connection to try passwords and then of course fails because there's no such account.  I have created a deny policy referencing the regions and put wan1/

After updating various Fortigate models from version 7.0.13 to 7.0.14 the Kiwi Cattools Backup (Device Backup TFTP) brakes. Errorlog: Connection failed (30011) Invalid data received from remote server. Protocol error.We are using the latest version of Kiwi Cattools (3.12.3.3257).Maybe someone has the same problem and already found out what the problem is and how to fix it.Thanks in advance for any help! 

I want to open a different fortinac portal in front of a user joining a guest wireless network and a user joining a guest wired network. How can I do this?