Solved

Hello, Two Fortigate are linked by an IPSec Tunnel. LAN traffic passes well through the tunnel, but the fortigate cannot communicate with a syslog server located on the other site. How to specify to sent this local traffic into the tunnel ?

Hello colleagues, maybe someone can help. I have configured an SDWAN, which consists of two WAN interfaces. Everything is working properly. I want to force a route to the specified IP addresses through one link and the rest through the other. I configured SD-WAN rules, a rule on the firewall internal-->sdwan with NAT and it works fine. Now on one of them I made an ipsec VPN. Also I added it to SDWAN and I am trying to force the same operation. The problem is that I need to add the same rule for ipsec VPN but without NAT, only on FG I see only one SDWAN interface. So if I don't set NAT then WAN2 works, and if I don't set NAT then IPSEC works. I watched a tutorial for SDWAN with two VPNs, but that is not applicable here. Fortigate 60f and  7.0.13 firmware on board.  

Fortigate 201F on 7.0.14 firmware.Website: www.reliafund.comWe use this site for ACH transactions on a daily basis, so it's pretty important. According to the Fortiguard webfilter, this site was updated to a malicious category on Feb 12, 2024. Prior to that we never had an issue. So, starting yesterday, this site is no longer accessible. I’ve submitted three requests for reliafund.com to be recategorized and all three are denied due to a supposed infection. I’ve escalated those requests only to be denied again. We see two different block pages, seen below. Not sure if that's relevant. Here's what I've tried...Multiple browsers have the same experience. Yes, I know it wouldn't matter, but I'm only stating what I've tried.Multiple PCs accessing the internet through different outgoing firewall policies WITH different security profiles are blocked.Forward traffic logs so success, although that IP is related to Fortiguard. Creating a URL filter bypass is not successful. 

I am attempting to deploy the free FortiClientVPN via Intune without EMS.   I have deployed the individual registry keys via powershell using the new-item cmdlet with the DATA1 and DATA3 keys empty   Any deployed client will not connect to the VPN server. If i delete the profile within FortiClient and recreate it the client connects and I am prompted for EntraID credentials, the only difference I can see if that DATA1 key gets populated. I have tried deploying the registry settings without the DATA1 and DATA3 keys without success. I have tried deploying the keys then the client software but it still will not connect.   I am assuming this DATA1 value is supposed to be unique to each machine so what's the work around or can I deploy the same value to all machines?   Edit: Found a solution. Install the ForticlientVPN on a machine and create a VPN profile. Open regedit on this machine and find the VPN config in the registry under the Software\fortinet tree. Clear t

Please let me make sure the order a FGT examine policies.If there is a specific policy from a specific interface like "lan" to another specific interface like "wan1" with "any" source and "any" destination, it would be examined before another policy from "any" interface for a specific source IP set to "any" interface for "any" destination, even if the source IP matches one of those specified. Right?I just want to make sure my basic/fundamental understanding is correct.Toshi

I have a 101f with 7.2.6. User cannot be added to user groups. Under User and Authentication, User DefinitionI select a user that is an LDAP user,I select the User Group button and the list of available user groups pops up.  I select a group      from the list and when I save it I get an entry not found error. if I do the opposite from the groups:Under User and Authentication, User GroupsI select the same user group I was selecting above and edit.  there is no option to add users.  If I jump out to the CLI and manually try to add the user I get: entry not found in datasourcevalue parse error before 'xxxxxx'Command fail. Return code -3 The listed LDAP servers are connected successfully and can authenticate users through the FG interface under Under User and Authentication, LDAP Servers. what did I miss?

Hello, Is it possible if i want to create separate interface for management in Fortimail?Example: i want to use ETH1 only as Management interface and ETH2 for traffic. Thanks,Bram

I have a Fortigate being managed by a Fortiportal.The WiFi clients show in the Fortigate and the Fortiswitch monitoring in the Fortiportal but donot show up in the WiFi monitoring section of the Fortiportal.Is there a service that I need start or enable for this to work.

Hello,does anyone have done the integration between ServiceNow and FortiSOAR using oauth? The ServiceNow administrator created ClientID and Secret but the connector configuration also requires Username and password.

When we logon to the unit we receive an error that the Firmware was not signed by Fortinet. This was after an upgrade to FortiOS 7.2.7. The previous FortiOS version is 7.0.12 the resolution for this is to update on 7.0.13 and the error message still appears and now we upgrade it to FortiOS 7.2.7 still having the error message. The unit is part of a HA cluster. The second unit of the cluster does not have the error. Any workaround or recommendation would highly appreciated.    

I have a central site (A) with a static IP and many other sites (B, C and D) that create dialup IPsec tunnels back to site (A)   Subnets at site (A) can reach subnets at sites (B, C and D) and sites (B, C and D) can reach subnets at site (A)   But I have not seen a config or a topic which would allow sites (B, C and D) to learn they can reach each other via site (A)   Static routes and policies would be a good start. Does anyone have a recipe to allow traffic to to route from Site (B) to Site (C) via Site (A)?   In an ideal world it would be great to have a vpn direct  between site (B) and Site (C) but as both are on dynamic addresses this would introduce the use of a dynamic DNS service which I would like to avoid   It would be a great feature if site (A) would be able to act as a dynamic DNS

After upgrading our Fortigate 600E (two firewalls in HA) first to FortiOS 7.0.4 then later 7.0.5 we are experiencing what I suspect is memory leak issues. Over time the memory usage goes up gradually to the point where the firewall goes into "conserve mode" and traffic forwarding stops. After reboot (HA failover) the memory usage is back down and then after about three weeks it goes into conserve mode again. Anyone else experiencing the same problems?Do you think I should just roll back to 6.4.x or wait for the next patch?    

how do i edit the message header from the email alerts sent from the fortigate?the subject header is Message meets Alert conditionmy ForitOS version is 7.2.5 Message meets Alert conditiondate=2024-02-14 time=01:57:14 devname=100F devid=FG1000337 eventtime=17077209 tz="+0800" logid="0100032003" type="event" subtype="system" level="information" vd="root" logdesc="Admin logout successful" sn="17219" user="admin" ui="http(127.0.0.1)" method="http" srcip=127.0.0.1 dstip=127.0.0.1 action="logout" status="success" duration=1815 reason="timeout" msg="Administrator admin timed out on http(127.0.0.1)" 

Hi All,I'm relatively new to FortiNet and have a question about enabling the "Quarantine Host" option on an SSID configured on a FortiGate Firewall. I noticed when I enabled the "Quarantine Host" option, a wqt.root interface was created with an IP address of 10.253.255.254/20 and a connected route was added to the routing table. I don't recall configuring the wqt.root interface or assigning an IP address in the 10.253.240.0/20 subnet (this overlaps with other subnets in our network). I'd like to know if the interface and IP address are configured automatically by the FortiGate when "Quarantine Host" is enabled on an SSID. Any information about this is much appreciated.   

Hi All,   We are deploying FortiAP's, so I would like to monitor the WLC side of the FortiGates. I have SNMP(v3) running just fine, but some of the WLC MIB variables puzzles me a bit.   fgWcInfoWtpSessions "Represents the number of WTPs that are connecting to the AC." This seems to be the AP's acually Online & Aurhorized, as listed in the GUI. This is consistent and as expected.   fgWcInfoStationCount "Represents the number of stations that are accessing the wireless service provided by the AC." This seems to be All Known AP's, Online/Offline&Authorized and UnAuthorized&Online..   fgWcInfoWtpManaged "Represents the number of WTPs being managed on the AC." This number does not make sense - it fluctuates up and down, not following what is on/offline.. Anyone care to explain what it actually tells me?   It seems there is no (direct) MIB entry for Offline+Authorized AP's, and since there is no entry for Authorized APs, it's a bit hard to calcu

Today we updated all our FortiGate devices to 7.0.14 due to the security concerns with the ongoing attacks worldwide. Unfortunately after the upgrade we are facing a lot of blocked connection to applications which were working without problems before.What I have noticed is the type of block -> local-in-policy. Is there some new feature that I am missing or is there a way to enable such traffic.One of the blocked connection is video surveillance system, running on HTTPS:  ActionAction Policy violationFirewall ActiondenyPolicy ID0Threat262144 ApplicationApplication HTTPSApplication Category unscannedProtocol 6Service HTTPS DataDuration 0 secondsReceivedReceived Packets0SentSent Packets0.....FortiClient UUIDPolicy Type local-in-policy  

FG 100D fw:6.2.15MS AD domain usersThere are two domain controllers and FG agent is installed on them. Ver: 5.0.0312The user gets Internet access via AD groupProblem:From time to time, the user loses access to the Internet and is blocked by the default rule.The logs show that the user field is not filled in.The user accesses any domain resource and Internet access appears.There are no new records about the user's logons on the domain controllers.How can I fix the problem of periodic Internet loss?

Hello,   We have a Fortigate (100F) and multiple FortiAP (231F) access points. We recently ran into a problem. Almost all of our access points are working normally, but there is one that had slow Wi-Fi speeds. We tested the cable and the switch port, but it seemed they were not a problem. We tested another brand AP, and it had high speeds. With a reset, the FortiAP felt a bit different, but still has unstable speeds.   We wanted to upgrade the firmware of that particular FortiAP, but it seems it's hard to get the file. Can someone guide me for how to get the actual file as many tutorials just show me where I can upload the file on Fortigate without telling me where to get it.   Note: Its current version is 7.0Thank you!#FortiAP #Fortigate #Firmware-Upgrade

Hi, is there a way or command I can check who make the changes under Schedule Updates?My FW perform auto updates and I need to find out who have amended the schedule updates to auto, Thanks 

Hello,When external users have to logon, I give them https://firewall.mydomain.com:1003 (I've load a 3rd party certificate).but they are redirect to https://IP-ADRESS:1003 with a certificate error Is there a way to fix the name used by FG to match my FQDN ? Thanks !

I understand that (almost?) everything should be configured and deployed via FortiManager for any devices that are managed. Are there any configuration elements that cannot be done through FortiManager and must be done independently at the device level? Specifically ... I have a device that cannot connect to FortiAuthenticator, so I have to log in using local credentials.  I'm pretty sure the problem is that I need to set a source-ip for the RADIUS connection via CLI: config user radiusedit "<authentication string>"set source-ip 192.168.100.1 Of course when I log into the remote device locally and open the CLI, I get the message that "changes will cause this device to be out of sync with FortiManager." I guess I have four questions:1. Can this setting for an individual device (that is part of an ADOM with other devices) be set via FortiManager?2. If so, how?3. If it cannot be set via FortiManager and I set it on the device itself, will it cause any "

Hi all,We were forced to re-import the configuration of a firewall into the manager. As a result, many address objects have now received a per-device mapping. Is there a way to remove these per-device mappings in the address objects, e.g. using a script?

Hello guys, I have a multitenant structure and I have defined a JDBC with MSSQL in my organisation. I got success in Credential, Discovery. When I test it in the monitoring I have created, it gives successful results, but I cannot see it in pull events and events do not come. What do you think I should do?

After SSL-VPN Webmode authentication, https bookmark login fails.After a failure, the login screen will be displayed again.I can log in correctly on the http bookmark login site.I will add debugging, so if you have knowledge please help. Equipment used: FG60EVersion: 7.0.10   FortiGate-60E #FortiGate-60E # diag debug enable FortiGate-60E # [210:root:d1]req: /remote/logincheck <----------------SSL-VPN Login[210:root:d1]rmt_web_auth_info_parser_common:492 no session id in auth info[210:root:d1]rmt_web_access_check:760 access failed, uri=[/remote/logincheck],ret=4103,[210:root:d1]User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36 Edg/92.0.902.67[210:root:d1]rmt_logincheck_cb_handler:1283 user 'user01' has a matched local entry.[210:root:d1]sslvpn_auth_check_usrgroup:2967 forming user/group list from policy.[210:root:d1]sslvpn_auth_check_usrgroup:3013 got user (0) group (1:0).[210:root:d1]sslvpn_validate_u

Hi Community,   I would like to setup two different Phase1 IPSEC Interfaces which divides the peers via identifiers based on certificate matching. Suppose we have two companies and the structure of the CN is basically a String formatted like a FQDN of the Computer. Is there a chance to divide peers from company A and company B based on two peer-groups with a CN-Match Substring?   The CN has the classic form of computername.companyA.com or computername.companyB.com. In my test it was perfectly fine to use the full CN but a match based on substring matching does not do the job. Off Course the config vpn certificate setting Entry cn-match and subject-match is set to substring.   So what syntax, wildcard-Characters or even maybe regex can be used for the CN-Matching? Is there a way to go on the substring  "companyA.com" or can the cn Value in config user peer only be a whole string separated by whitespaces? Is there a knowledgebase Article or a more descriptive Article