Solved

Is it possible to add wildcards when creating a web rating override? Im trying to make new categories for easier administration of some requirements but I cant add a wildcard when setting a domain for a rating override, for example if I were to try to block amazon.com without a wildcard other sites like amazon.co.uk or amazon.co.jp will still load. Is it only possible to add wildcards on the url filter section? If its only possible here then can I make categories on the url filter so I can groups different filters like you can do on the web rating override? Thanks

Hello, I havent seen such weird behavior on FGT before. I have S2S VPN with another location where there is some Local network - all is working good with s2s, but the problem is with local asset. After sometime one of IP is unreachable.Debug commands says:.."id=20085 trace_id=161 func=init_ip_session_common line=6043 msg="allocate a new session-00bf3a66, tun_id=0.0.0.0"id=20085 trace_id=161 func=vf_ip_route_input_common line=2611 msg="find a route: flag=80000000 gw-10.0.201.2 via root".."id=20085 trace_id=161 func=fw_local_in_handler line=500 msg="iprope_in_check() check failed on policy 0, drop" I do have enabled "snat-route-change enable" - for SDWanI dont know why there is some problem with routing, where all is done as I used to do it regarding IPsec. Ive notice it after upgrade to 7.0.13(Mature)Ive got a temporary workaround, I must flush iprobe routing with "diagnose firewall iprope flush".Can someone point out what the hack? :)

I am curious about the status value of "diagnose sys ha dump-by group". "diagnose sys ha dump-by group"state/o/chg_time=3(waiting)/2(working)/1706239048I understand status and chg_time.What does "/o/" mean?FortiGate 

Hello team,   I configured snmp. I enabled snmp in the management interface, after which I went under "System > SNMP" and configured as follows:   When test with snmpwalk command via cli from my monitoring system, Fortigate side capture this traffic:     it is as if the fortigate is not responding to snmp traffic. Maybe some policy is missing? Thanks for the support   BR

Currently, it looks like the unit (3001F on 7.2.6) will use a different seed or other value when outputting configuration in a 'show' or 'show full-configuration'. This makes it different to watch for changes/etc. if tracking the configuration in an external system. Is there any way to get a consistent seed/encryption so that they aren't different values on every invocation? I'm open to retrieving the configuration using some other mechanism/api endpoint/etc. if needed.

When I enter the auxiliary-session command on the fortigate 50e device, it does not work. I would like to know if the auxiliary-session command is not set on the fortigate 50e device or if it is a version issue.

Hi all, I'min the process of replacing hardware for a customer. Right now their netwerk is based on Aruba CX switches (see diagram below), the have 2 core switches opering VSX with MCLAG to the access switch layer. The access switches are Aruba CX6200 stacks with lik 3/4/5 switches network closet.The Aruba switches are stacked and have an LACP trunk o the MCLAG on the core switches. The customer  recently switched their firewall to a Fortigate cluster and they are considering replacing their swithing network to Fortinet as well. So far I have found a decent replacement for the core switch but for access layer switches I can't quit grasp the concepts that fortnet is using. From what I understood so far is that I should use MCLAG on the access switches as well. If there are more than 2 switches in a network closet, how would include these in this network?Should I just create a ring network and have Spanning-tree take care of the loop?Are there other alternatives to co

Hi Experts, In FrotiSOAR (FSR version 7.2.2) GUI, in System Health Dashboard, under the "Playbook Execution Monitoring", I see Queued Workflows and Active Workflows. The Active Workflows count remains quite high above 200K and Queued Workflows count ascends up when I perform any bulk operation. It goes up to 400 to 450 and comes back to 0 when Bulk operation is finished.  I just want to know what are the typical values for these parameters in a mid sized enterprise environment, and can we see these workflows running, through CLI (if possible)?  BR,MBF #FortiSOAR

Hi All,Our conference sites are starting to look into upgrading older equipment and move towards new, modern, protocols for audio and video. We actually just got 4x 1024E & 2x 1048E with 100G backbone to replace the core switches in one location.In this location, they have Meyer Sound equipoment that use AVNU's Milan/AVB protocols, and they say the switched need special - certified - support for this.I can't seem to find details for this for FortiSwitches, can anyone help with information about this?IEEE 802.1BA-2011 – Audio Video BridgingIEEE 802.1Q-2014 – Bridge and Bridged NetworksIEEE 802.1AS-2011 – Timing and Synchronization for Time Sensitive ApplicationsIEEE 1722-2016 – Transport Protocol for Time-Sensitive Applications in Bridged Local Area NetworksIEEE 1722.1-2021 – Device Discovery, Connection Management, and Control Protocol for IEEE 1722(TM) Based DevicesHope we don't need to buy Netgear.. ;) 

Hi there,I have updated the Fortigate 101F to version 7.4.X. Since then there have been problems with the homeoffice access points FAP-C24JE.Whenever the routers get a new WAN IP, all devices on the LAN ports of the APs are offline or cannot connect to the Internet or the Fortigate.The AP is displayed as online in the FGT and the WLAN clients can also connect and are online.It seems as if the AP has forgotten the configuration for the LAN ports.After restarting the AP, everything works again.

Hi All, We are setting up a new Virtual FortiGate for use as WLC, and I have enabled Advanced Wireless Features. 1: The GUI in FG 7.0.n - 7.4.2 has a time-display bug:When running on 24-h system, editing a schedule still show time as 12-h am/pm input in the schedule editor.Time shown in Schedule List: Time shown in Editor: Time shown in CLI, when editing Schedules there, is in 24h format..  2: Time Schedules does not seem to manage the FortiAP LED's?First off: The schedule seems to control when the LED's are ON - right?Second: When I enable LED Enable and set a schedule, it seems that the LED's does not turn on/off within the minute of the time set. If I set a schedule, that turn off the LED's, they turn off instantly, same if I remove the schedule so the LED's turn on.When the schedule then hit the target time to tunr on/off the LED's, it's not happening.. at least not within the same minute..So, to understand this:Is this schedule pushed to the AP's

Hi!   I have got a fairly simple question, the situation is as following.   We have two core server/network-rooms inside the same building. Each room has a FortiGate Firewall and a MikroTik or HPE core-switch. Between these two switches we ran a 10Gbit fiber.   Can I setup HA (Active/Passive) on a Fortigate 70F or 80F over a VLAN between these two sever/network-rooms over the core-switches instead of directly interconnecting the heartbeat interfaces?   The last thing we want is issues like a split brain. How stable is a solution like this?   Best regards, Tim   

Hey All Has anyone come across the issues with pushing templates to the latest firmware. Looks like there are settings required in the new up date (7.4.2) but are not set on the Forti manager   Copy device global objects Post vdom failed: error dot quic- inspect:-999 - invalid value - prop[quic]: binary option(inspect) Copy objects for vdom root This make sense that it is to do with the ssl profile but cannot find what setting it is pointing too

Hi,     I am new to the fortigae 100F. I am trying to setup my laptop to access the internet. My issue is that from my laptop, i can ping 8.8.8.8 but i cannot surf any of the webpage.    Does anyone have any idea what could be the most possible issue?     Secondly, i discovered this firewall rule that cannot be deleted. Will this rule does anything?    Really hope someone can enlighten me, Thanks 

Hi Guys I've a problems with vDOM on FortiGate 60E 1. I did not see Virtual Domain option in System Operation Settings" section but I can enable vDOM on CLI.    I tried to enable on CLI with the command below, it's not working. config system global set edit-vdom-prompt enable end 2. I did not see vDOM type option (Admin and traffic), how can I enable it?3. I got a message when I try to enable it. FortiWiFi (settings) # set vdom-type adminadmin type cannot be set on the FortiWiFi.node_check_object fail! for vdom-type admin value parse error before 'admin'Command fail. Return code -651

I have configured destination IP detection using IP Reputation on FortiGate. I detected IPFS.Gateway at Reputation Level 2. I assume that IPFS.Gateway is classified at Reputation Level 2 because it involves peer-to-peer (P2P) communication. Could someone confirm if my assumption about the expected content is accurate?

Hello,I'm trying to grab IP address from the log after ssl-login-fail and create new Firewall->address and append it to existing group using CLI script:Log event looks like this:date=2024-01-17 time=11:11:19 id=7325007792115286044 itime="2024-01-17 11:11:19" euid=1049 epid=3 dsteuid=3 dstepid=3 logver=700130566 logid=0101039426 type="event" subtype="vpn" level="alert" action="ssl-login-fail" msg="SSL user failed to logged in" logdesc="SSL VPN login fail" user="admin" remip=5.153.183.36 group="N/A" tunnelid=0 tunneltype="ssl-web" dst_host="N/A" reason="sslvpn_login_permission_denied" eventtime=1705486279485398543 tz="+0100" devid="FG100E4Q17012295" vd="root" csf="TCCM_SF" dtime="2024-01-17 11:11:19" itime_t=1705486279 devname="EDGECLUSTER_FG100E" I see that IP address in question is named remip My script follows:config firewall address edit %%remip%%_SSL_VPN set subnet %%remip%% 255.255.255.255 next end config firewall addrgrp edit Banned_SSLVPN append member %%remip%% nex

I am currently trying to configure FortiNAC to authenticate 802.11 for devices using Wifi. The topology is as follows: Client -> Cambium AP -> Forti NAC (Radius) -> Active Directory (User Database). FortiNAC has been configured to join AD and LDAP authentication has also been integrated with AD. When the client sends an authentication request, the log on FortiNAC may show some errors such as:ERROR: No NT-Domain was found in the User-Name rest_reject: EXPAND Registration - Access Deny (Post-Auth) rest_reject: --> Registration - Access Deny (Post-Auth) rest_reject: Module-Failure-Message := “Registration - Access Deny (Post-Auth)”I’m not sure where I have misconfigured this. Please help me resolve this issue. I also attach detail log for deeper analysis in the follow linkhttps://drive.google.com/file/d/1EdOrojp-KYVcHPYxujuEdkmjEBjYpiKD/view?usp=drive_link

Hi all ¡¡ I'm trying to configure an email alert when WAN2 interface from my fortigate with 7.0.11 goes dow, but its not working. Probably I'm forgetting some steps or doing something wrong. This is the article: Technical Tip: E-mail alert when WAN interface wen... - Fortinet Community I attach you my trigger, action and stich. I have tried it using the LOG ID 22922 as in the example. Cause it doesn't  work I've noticed that the event ID changes in my FW (I attach you an image). I've changed it. Finally I attach you my mail server configuration (default configuration).  What am I doing wrong? The mail doesn't arrive (I've checked the spam folder).Thanks ¡¡      

Hi Community Member,   Hope all are doing well. I am currently facing an issue with FortiSIEM office365 integration I have followed each steps in the below provided documentation but still unable to fetch events. Appreciate if someone has come over resolution. followed docuement: http://docs.fortinet.com/document/fortisiem/7.1.1/external-systems-configuration-guide/514932/microsoft-office365-audit   Issue screenshot is attached <forum admin removed screenshot as may contain sensitive information>

We're building a new network and need to support directed broadcast messages. Essentially, some broadcast traffic shall need to be forwarded between different network segments. From my research, I believe our FortiGate firewalls will support the forwarding of this broadcast traffic through the configuration of a multicast policy. However, we will also be using FortiSwitch network switches. My question is, will the FortiSwitches support the forwarding of this broadcast traffic when managed through FortiOS via Fortilink? I have provided an example diagram below to illustrate, broadcast traffic from Host A must be able to reach Host B. Thanks :)

Hello team, I have an argument to share and would also like your opinion.If I create a wildcard FQDN object *.pluto.com qwhen the client does dns traffic I also get sub domains resolved for example foo.pluto.com duck.pluto.com etc.Now if by chance a subdomain is malevo this is resolved anyway and the fqdn wildcard object is updated with the malevoo ip. What advice can you give me to fix this problem? Or maybe it is not necessary if you configure other security profiles ad hoc? ThanksBR

Hello team!!! I hope you are fine!I have the following question, if I configure an sd-wan rule with the "maximize bandwidth" strategy, configuring in the cli, the "set hash-mode inbandwidth", how fortigate determines the interface with most available bandwidth if I have no licence for "SD-WAN Network Monitor" ?Is it possible? Thanks in advance.Regards!Damián

Hi Folks! Need to know the CLI command to check the FSR current version. Regards,MBF FortiSOAR 

Hi all,   Is there a way to restrict SSL-VPN access solely to the FQDN, disallowing users from accessing the web portal via the IP address? We prefer users to only use the FQDN for access. OR Can we use multiple server certificates that cover both IP and FQDN, eliminating certificate warnings?   Any lead?