Solved

Hello Community, Ive attempted to POST a new policy to a FortiWiFi 80F appliance. I am getting a 400 response due to bad syntax. I can do a GET to this same URL and it works without issue. What could be my issue? POSThttps://{{IP}}/api/v2/cmdb/firewall/policy/?access_token=7dpdqjH3bHjqfghw0Gkx9Ngxht8b8p BODY{ "name": "TEST5", "srcintf": [ { "name": "lan" } ], "dstintf": [ { "name": "lan" } ], "action": "accept", "srcaddr": [ { "name": "all" } ], "dstaddr": [ { "name": "all" } ], "schedule": { "q_origin_key": "always" }, "service": [ { "name": "FTP" } ], "nat": "enable" } }

I'd like to set up an executed playbook within an unhandled (not mitigated by FGT) incident.It's job is to send back the malicious event to fortigate (FGT) and have it mitigated automatically.Which playbook's template does fit this need ? and which associated "Action" ? It's about a malware hasn't been blocked by FGT and it shows "passthrough" in FAZ.  

Dear All,           May i ask if i can switch from  Security Fabric role standalone to Security Fabric root directly ? any different between these 2 role ? if i directly change from standalone to Security Fabric root , any impact ? thanks   piaakit    

Hi All, I configured FortiAuthenticator with integration to Azure, created the Enterprise Application and App Registration on Azure. I require to import / sync only specific group members into FortiAuthenticator as remote users and add them to identified remote SAML Group for specific authentication and autheorization managed by FAC. Unfortunately I do not get a list of groups from Azure and sync imports all users from Azure. We have approximately 9000 groups and around 11000 users in Azure and I do not require all in the FAC group.Currently open TAC with Microsoft and Fortinet. MS propose SCIM to manage provisioning of users and group but FAC do not have SCIM.Anyone have a similar issue and how did you resolve?Kind RegardsAndre F

Dear All,            I have a question would like to ask, we have recently setup ssl vpn with LDAP, but after we input all the things and created firewall policy etc, and we found we wont be able to connect successfully and i did the use "test user credential" the result is failure, but the password is sure correct, any help would be appreicated, Thanks   Keith

Dears, I have fortigate ddns is working fine in my country, but I tried to open fortigate from another country using my ddns link (xxxx.fortiddns.com) and it doesn't want to open and give me the following message This page is not working right nowxxxx.fortiddns.com didn't send any dataERR_EMPTY_RESPONSE althoug I can ping on it without any problem. Do you have ideas?

Hi,   There is a mention in documentation since v. 6.4:"Two new tables are added to the FortiOS Enterprise MIB: FgSwDeviceEntry: Details about connected FortiSwitch devices.FgSwPortEntry: Switch port related information."   What MIB is in question and where to download it ? 

Hello Support Team..Any idea how to deploy Auto-Registration for IP Phones with Extensions range ? ..for example a phone ( which we don't know its type or MAC ) , and it is connected to the network , with proper DHCP / Option 66 or TFTP 150 ( cisco ) .. can this phone get a dummy extension 601 ? .. the next phone would get 602 .. etc   As i tested , Cisco Phones ( Enterprise Firmware ) would register , but without Extension .. Another inquiry .. how to show live Debug from the CLI ? .. i don't mean open trace and download .. i am asking about enabling debug on CLI and seeing the output on it ..  for example :  debugging TFTP events or packets .. or SIP messages .. etc 

Hello, which firmware version is the latest stable ?Running 7.0.13 Best regards

Hello,i have a Fortigate 81F, last week i have entered the banking website as usual (bank austria) and today it is partially not posible to logon to the website and navigate to the business area. From my phone (extern) it works and its not blocked. https://www.bankaustria.at/ (works)https://corporateportal.unicreditgroup.eu (works)https://online.bankaustria.at (works) https://banking.bankaustria.at (doesnt work)  I get a message where Cisco Umbrella opendns.com pops up at says it  is marked as a phishing website. (First time seeing cisco umbrella reddirection). We dont have any Cisco devices or software anywhere. We never used services from Cisco Umbrella Open Dns. I assume that this service is maybe inplemended in the Fortigate 81F. Other Banking website (cardcomplete/easybank/bawag,ect) works as usual but i dont know wheater its filtered just this subdomain or something else it bothering the FG.Does anybody expirience this aswell ? If the service is on the Fortiga

Hello. We have two FAP-432F's setup as a MESH at one of our construction sites. One of the AP's is connected to the FortiSwitch and configured as the ROOT, the other is configured as a LEAF.- Both APs have the same 3 SSIDs assigned; "Corp", "Guest", and the "MESH" SSIDs.- Both APs are configured to use the same channels in the 2.4 GHz (1,6,11) and 5 GHz bands (all).- Both APs show online under Managed FortiAPs. SOMETIMES I will see clients on the LEAF AP, while other times I will see an interference error. I'm assuming this because both APs may be using the same channel at the same time. I've tried to manually set the channels on each, but the configuration does not persist. I've learned the "same channel vs different channel" argument seems to vary by vendor and hardware. What is the best/correct configuration for Fortinet devices? I also have power set to 50% for the 2.4GHz channel, and 100% for the 5GHz channel (it's a big construction site). Should I set these both t

Hello team, I would like to know what is the difference in having the firewall use Fortinet DNS or local internal network DNS, for example Windows Server DNS.Thanks for the supportBR

Hi,I am doing a lab setup where I have hit a problem with ebgp routes disappearing from the routing-database when ibgp routes shows up. I have not done any route manipulation on my BGP session at the moment. I would have thought that even if the route is not active it would appear in the routing-database (get router info routing-table database). I can see the routes being advertised and also received (get router info routing-table bgp neigh received-routes). The BGP sessions are over the tunnel and I am assuming that there would not be any difference.Any help is appreciated.  San

In the Admin > Device > Parsers many (all) are enabled but many are for devices we do not have in our environment. Does having unused parsers enabled affect the SIEM performance? Would it make sense to disable them?

Hi All, I need the official ebook FCA

PROBLEM:  Customer reports FortiClient Console launches at random intervals throughout the day interrupting work flow. BACKGROUND:  I had a customer who complained that FortiClient continued to pop-up at random intervals and was disrupting conference calls, Zoom meetings, YouTube videos, web surfing, etc.  We could reproduce the issue but not trigger the behavior with any repeatability. SOLUTION:  Disable the option in the Endpoint Profiles => System Settings => User Identity Settings for "Notify Users to Submit User Identity"  

I'm referring two KBs below for this issue:https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiGate-alt-primary-alt-secondary-DNS-server/ta-p/275269https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configuration-per-VDOM-DNS/ta-p/190815But in reality with 7.0.13, the vdom-dns config accepts only alt-primary/alt-secondary unlike the 2nd KB describes.With this, how is the DNS decided at the vdom (test-vdom)? Always ask global primary/secondary first? Then only when they're unreachable vdom-dns is used? Or only vdom-dns is used? I prefer the latter behavior but not sure. Also, what protocol would be used if alt-primary/alt-secondary was chosen? Same as the primary/secondary?   fg40f-utm (global) # config sys dns   fg40f-utm (dns) # get primary  : 96.45.45.45 secondary  : 96.45.46.46 protocol  : dot ssl-certificate  : Fortinet_Factory server-hostname  : "globalsdns.fortinet.net" domain &nb

My current ssl portal I have set up for my users doesnt have host check or split tunneling enabled.I created an ssl portal with hostcheking and split tunneling enabled, and created corresponding policies for it.Then I added the same users to the new portal. When trying to hit the policy its going over the old policy and and ssl portal. is there a way to prioritize the new portal with hostcheck/split tunneling. Or is reusing the same exact users on both portals creating an issue? Thank you.

Hello,I'm using policy-based mode on FortiGate and I have a problem with URL filtering. I have set up the rules as described here https://docs.fortinet.com/document/fortigate/7.2.0/new-features/472314/allow-web-filter-category-groups-to-be-selected-in-ngfw-policies and I have the rule targeting a user group. In the log, I see a deny rule that says the page is Unrated, but on the https://www.fortiguard.com/webfilter site, I can see that the page has a category. I am sending log: date=2023-12-16 time=16:33:02 eventtime=1702740782183012282 tz="+0100" logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="root" policyid=74 poluuid="7b975724-9285-51ee-f073-60f6db8bd24e" policytype="security-policy" sessionid=180151 user="Domain_user" authserver="FSSO_server" srcip=10.1.1.1 srcport=50104 srccountry="Reserved" srcintf="VLAN" srcintfrole="lan" srcuuid="efa45e5a-56d5-51ee-ff05-d73441199146" dstip=85.207.58.49 dstport=443 dstcountry="Czech Republic"

Hi,I just set up SSL VPN on a 60F. I know the process and have done it before, nothing new, but not today. VPN client stops at 10% with the error visible. But I see traffic when sniffing (diagnose sniffer packet wan1 none 1 100)? (Connecting to a different site is working fine!)     This is my current config. There is only one local user in vpn_grp. HTTPS port (administration) is set to 8443.Its my personal box which I am using at home. There is no license, even no FortiCare.Laptop I am trying to connect with is online via 5G internet. Any hint is highly appreciated! Desperately trying since 2 hours now. Thanks!

I have a loopback 10.222.80.1 configured (1) I have advertised the same prefix in BGP. (2) The BGP neighbor 10.4.10.1 in question is healthy with 159 routes received (3) Why is this prefix not advertised via BGP? (4)     

Hello,I'm using policy-based mode on FortiGate and I have a problem with URL filtering. I have set up the rules as described here https://docs.fortinet.com/document/fortigate/7.2.0/new-features/472314/allow-web-filter-category-gro... and I have the rule targeting a user group. In the log, I see a deny rule that says the page is Unrated, but on the https://www.fortiguard.com/webfilter site, I can see that the page has a category.I am sending log:date=2023-12-16 time=16:33:02 eventtime=1702740782183012282 tz="+0100" logid="0316013056" type="utm" subtype="webfilter" eventtype="ftgd_blk" level="warning" vd="root" policyid=74 poluuid="7b975724-9285-51ee-f073-60f6db8bd24e" policytype="security-policy" sessionid=180151 user="Domain_user" authserver="FSSO_server" srcip=10.1.1.1 srcport=50104 srccountry="Reserved" srcintf="VLAN" srcintfrole="lan" srcuuid="efa45e5a-56d5-51ee-ff05-d73441199146" dstip=85.207.58.49 dstport=443 dstcountry="Czech Republic" dstintf="wan1"

Hi, We have a Fortigate cluster deployed in Azure. The design includes an internal and external Azure load balancer. We cannot connect from a server behind the cluster using the FileZilla client outbound to the Internet (client > internal load balancer > fortigate > ext lb > ftp server). The external FTP server is configured to use passive mode and the client is also configured to use passive. We have tried enabling all ports outbound to the target and have deleted the FTP session helper - it doesn't help. The FTP server is configured to request a conn on 5000-5100 FileZilla responds withStatus: Connection established, waiting for welcome message...Trace: CRealControlSocket::OnSocketError(106)Trace: CRealControlSocket::DoClose(66)Trace: CControlSocket::DoClose(66)Trace: CFtpControlSocket::ResetOperation(66)Trace: CControlSocket::ResetOperation(66)Trace: CFtpLogonOpData::Reset(66) in state 1Error: Could not connect to serverTrace: CFileZillaEnginePrivate:

Hi All,I've created a VLAN for 2 IoT devices.I have not received any network requirements for them.I want to create a policy which locks them down to only the essential required outbound ports and destinations.How can I achieve this? Is it using debug flow? I find it hard to get the information I need from it?Any help will be appreciated.Many thanks,

Dear All,              I have an ugent issue, after the 2 fortigate 201F configured in HA Active Active, the secondary devices stop to have network connectivity, not even the mgmt interface, i can not ping and access to the secondary devices, i have tried to factory reset the secondary device and form the HA again, and issue still exist, and i followed below video to do the HA, any help would be appreicated  https://www.youtube.com/watch?v=j25SwFGa76M piaakit