Solved

This is what I'm trying to set up on an Fortigate 60F with firmware version 7.41: Wan1 - multiple static IPssubnet 192.168.2.0/24 on vlan switch internal on internal 1 portAdministrative Distance: 10 via static routevarious inbound and outbound policies.this contains public facing servers, domain infrastructure and other servers with static ips mostly for inbound.various inbound and outbound policies.This part is working fine. What I've set up on wan 2Wan2 - DHCPSubnet 192.168.3.0/24 on vlan switch internal1 on internal2 portDistance 10 via wan2 interfaceinbound policy block all portsoutbound policy allow all ports (for now, will lock down once things are working)This would be PCs, phones and other devices for internet access, with addresses assigned by domain dhcp service. What's happening (while playing around with various settings) is that either wan2 isn't working for internet, or the internet on both interfaces is completely hosed. Also required, bidirecti

Hi people!We've recently set the anti-spam filter in FG 7.4.1 and it seems to be working well, at least the FortiGuard Spam Filtering procedures :)But we are unable to get the banned words working. It looks like to be completely ignored :(We have the bword table configured:config emailfilter bwordedit 1  set name "Our banned words"  config entries  edit 1    set pattern "Notification*budget*requested"    set where subject    set score 11  next   (some more entries here)end.....And we've also set the profile to consider the banned-word-table:config emailfilter profile  edit "SPAM filter"    set spam-filtering enable    set options bannedword spambal spamfsip spamfssubmit spamfschksum spamfsurl spamhelodns spamraddrdns spamfsphish    set spam-bword-table 1    set spam-bal-table 1  end..... We can see at the GUI that banned word are enabled and using "Our banned words" t

Hello, We have a FortiGate 200E as one of our devices.After a factory reset by using the hole pin method, we are unable to access the device anymore.The status flashed for a while, the ports flashed, then the port lights were stable, then status was normal again. Leading us to believe the factory reset was successful. The computer IP is set to 192.168.1.1, netmask 255.255.255.0, gateway 192.168.1.99Everything as instructed in the manual and online.Connected to the management port as the sticker on the device says (connect to MGMT port and access the web UI on 192.168.1.99) However, we are unable to access the device on the web and we cannot ping it.https://192.168.1.99/ We have experience with multiple other FortiGates and went through similar processes in the past year without issues. What should we try? Thank you. 

Hi people!We'd like to reject some kind of incoming emails, eg. *@*.ru We receive emails through port 25, and we've configured email filter to tag some of them as spam.But when using the "wildcard" option, it's not possible to choose "reject".We don't even want those emails to reach the user inbox.Is it possible?Thanks!

Hello, I have been tasked with getting specific users browsing sessions. I have created the following dataset, that does work.But now I am being asked to to also include browsing-time per session. and if possible to exclude all internal traffic. Is this possible? And help is greatly appreciated. FortiAnalyzer Version v7.2.3Dataset below.  Log Type: Web Filter SELECTfrom_itime(itime) AS itime,`user` AS USER,`catdesc` AS Category,`url` AS URLFROM$logWHERE$filterAND (((lower(`user`) = lower('First.Last'))))

We just purchased a Fortigate FG-40F. I have done the initial set up and only have a single test server with 3 HyperV instances and one workstation connected.  Everyhting is getting a DHCP address from the firewall and can communicate with the internet gateway. However, I can't get anything on the LAN to communicate with each other. None of the HyperV instances see each other or can ping each other, and I need all LAN workstations to be able to communicate. What setting do I need to change for this?Thank you. 

Hello, I am looking for clarification in whether I need to migrate to ZTNA for remote access to do a basic posture check? I am looking to see if we can block an incoming SSLVPN request from a user has their local antivirus not running or is not up-to-date? We are using Forticlient EMS. https://community.fortinet.com/t5/4D-Documents/SSL-VPN-to-ZTNA-Migration-Guide/ta-p/286534

Dear all,Let me ask some helps from you all, i'm facing some case that i'm trying to block vpn application at our fortigate firewall, cloudflare and psiphon vpn apps:. It does not work using p2p and proxy to deny these apps:. Cloudflare is ok to deny by blocking cloudflare used ip address and ports. But, psiphon is not ok to block by choosing psiphon at application.    Anyone have ever been? or could you pls anyone help that problem to solve?  Thanks much!

Hi I configured an Explicit Proxy on a Fortigate appliance. Fortigate use FSSO for remote users authentication and it has tree main interfaces: 1 LAN interface on which explicit proxy is configured and 2 WAN interface. My goal is that User A proxed traffic flow through WAN1 interface and User B proxed traffic flow through WAN2. I know that it's not possible use PBR and my customer doesn't want use an additional vdom to re-route traffic generated by Proxy. Is there another solution to achieve it?   

Hi, we use a FortiGate 7.4.1 with two independent ISP Connections.With hundreds of Students surfing, our bandwith runs very often into limitations. To priorize the various traffic i have tried SD-WAN Rules to one or another ISP Line.If i simply try to spread traffic between the two interfaces by "Best Quality" or "Lowest cost (SLA)" both ways work fine by directing new traffic to the interface with the best SLA. The problem is, Sessions are interrupted when a switch between the interfaces occours.I already tried the option "preserve-session-route enable" on our WAN Interfaces but this didn't change anything. Any help appreciated. 

Hello forum,I would like to know what is the best approach on restricting firewall policies as much as possible.How to plan everything, which services are needed where, how to be sure that I will not left any services, etc.Currently all services are allowed.I will do a network segmentation to create more smaller broadcast domains then to have nearly everything in one VLAN, and while I'm going to do that I want to implement most secured way for firewall policies also.Any advices are welcomed.

Hello, I would like to provide for my colleagues some restricted access on the fortigate for management. I know that I can provide read only access, but is it possible to somehow permit to just several rules in firewall policy(I mean for example add ports, sources and so on)? I mean is it possible to do flexible restriction? 

I upgraded Forticlient from 7.0 to 7.2.2 on our servers and found that only on windows 2012 servers, I can't start Forticlient console. It gives following error when try open. I wanted to try uninstall and reinstall but to uninstall Forticlient I have to disconnect telemetry from the console. Is there any solution to fix issue.  "the procedure entry point DiscardVirtualMemory could not be located in the dynamic link library in C:\Program Files\Fortinet\FortiClient".  Problem signature:Problem Event Name: APPCRASHApplication Name: FortiClient.exeApplication Version: 7.2.2.864Application Timestamp: 6452884fFault Module Name: net\FortiClient\FortiClient.exe!DiscardVirtualMemoryFault Module Version: 6.3.9600.21620Fault Module Timestamp: 65175333Exception Code: c0000139Exception Offset: 00000000000ed170OS Version: 6.3.9600.2.0.0.272.7Locale ID: 3081Additional Information 1: ac05Additional Information 2: ac0507478d1c5bd693cfc4fe3987e900Additional Information 3: ac05A

Hello to all Cybersecurity enthusiastic,I would like to get some best practices, advices for my next project.On one location we didn't do barely any segmentation since last IT Manager so it's time to make it more secure and better.Current Situation is like this:VLAN 1 "Clients"Here in our Clients VLAN we have regular clients (notebooks, workstations), printers, VoIP devices, meeting devices (cameras, microphones etc)VLAN 2 "Servers"Here in Servers VLAN we have domain controllers, file servers, backup servers, repositories etcWhat would be a general recommendation?I would like to segment it a bit more and create separate VLANs for Printers, VoIP, IoT, Backup Network etc.Our Infrastructure is as follows:2 x FortiGate 200F in an HA Cluster (Active/Passive)2 x Core FortiSwitches in an MC-LAG3 X Access FortiSwitches I'm new to this forum.I'm NSE4 certified. 

two fortigate 3240c，v5.4.10,build1220,180821 (GA)，created ha . All config is all right.   and i enable these set ha-mgmt-status enable set ha-direct enable   when i found both of them had  two conflict snmp-index. master:port27 and mgmt had the same snmp index salve:mgmt and vlan11(a logic port) had the same snmp index So i first do the config on the slave to make sure all snmp-index are independent. And machine did not reset ,but why the slave sync the master.Usually the slave does not sync the master. Why it happened.And change snmp-index will not cause the machine reset,right? master and salve have the same snmp-index with them mgmt,what will it effect? thank you for your answer

We have a pair of 1101E's in HA (A-P) currently in production.  They are connected to Meraki MS450's.We purchased some fortiswitches that we want to manage in the gate via fortilink, but we did not enable fortilink on our 40gbps LAG configuration before adding subinterfaces, policies, etc.  So we are now unable to configure fortilink on this interface.We talked to support and they recommended that we take a backup of the current config, add "set fortilink enable" to our LAG in the config file, and then restore the gates from the modified config file.Does anyone have experience doing anything like this?The fortiswitches will not be diretly connected to the gate, they will be downstream and connected to MS225's/MS425's.  Our gate is currently on 7.0.13.Thanks!

Hello,   We have fortigate In azure, we would like to Prevent Port Scanning. Is it possible and how I can do it?I tried create IPS policy and select Port.scanning, but it didn't work    Is it possible prevent port scanning with IPS Profile? 

Good day everyone, hope you all are doing well. I created a Github repo where will collect scripts, tools, anything that helps in daily work with Fortinet products.So far put a collection of Fortigate automation stitches (21) you may find helpful. Next is the collection of FAZ Incident Handlers.I hope this to become a community effort, so if you have found a tool or implemented some automation, please share with me via email and I will update the repo.The repo: https://github.com/yuriskinfo/Fortinet-tools So far automation stitches:  Send email on admin-level user being created/addedBack up configuration when changed to external server via SFTPBack up configuration daily to external server via SFTPLocal TLS Certificate is about to expire email alertSend alert on Fortigate configuration changed by administrator without detailsSend alert on Fortigate configuration changed by administrator with detailsemail alert on Fortigate entering conserve modeSend email alert on F

Will there be any impact if i change the HTTPS port to any other number. eg 6443 and change web service certificate to Fortinet Local cert ?    

Hello all...We are looking to organize our config repository and wanted to have our FortiGates backup their configs to their respective "device" folders...and not just land them all at the root of our FTP server.Our current script line looks like this: execute backup config sftp Fw1-confg.txt our.ftpserver.local backupuser passsword If I simply append a folder name to the server path...it failsexecute backup config sftp fw1-confg.txt our.ftpserver.local/FW1 backupuser passsword Am I missing something is this not possible to do in this way (??)Appreciate any insight you may have...!Thanks in advance and look forward to your response !   

In the UK the default MTU value from most ISP's is 1492 for FTTP & FTTC connections.Do I need to tweak the MTU value on the WAN interface when using PPPoE to 1492 or will the fortigate cope with the lower value as I can see the default MTU is 1500. Or will I experience issues such as packet loss if I do not lower the value.  TIA

Hi,   We are using FortiAnalyzer version 7.0.8, wherein logs are being forwarded to a syslog server for traffic learnt from Fortigate firewalls. Amount of logs being forwarded are quite huge per minute as seen from forward traffic logs learnt on Fortigate firewall (source FortiAnalyzer to destination Syslog server).   Log rate seen on the FortiAnalyzer is approximately 500.   Can we have only incremental logs being sent from FortiAnalyzer to the syslog server.   Thanks, Naved.

We recently upgraded our FortiManager-VM from 7.0.8 to 7.2.4 and have discovered the Meta Field we've been using to "plug" values per device into CLI templates are not supported any more and have to migrate all those per-device mappings from Device Manager to Policy & Objects, now called "Meta Variables".The upgrade process just copied used variable names to the Policy & Objects side but all those mappings were not copied at all (why not???). I know it's too late and useless(hopeless) to argue why they're not automatically migrated during the upgrade process. So now I just want to know what's the best way to copy those values for 500+ devices on the FMG. Ideally there is a tool existing to do it. But if so, it could have been run during the upgrade. Therefore I have to assume that doesn't exist. Then, is there any good CLI command to dump all Device Managers Meta Field values to the console/SSH session so that I can have a list to copy them from then create script to paste

Hi,I have a very strange problem with Forticlient when I use it from MacOS (Sonoma). It was ok earlier (with Ventura) but because I tried to debug some another strange IPSec VPN issue, I had to uninstall it (using the official method) and install an older version. Since then when I press connect button for my SSL VPN it seems Forticlient is freezes (stuck in connecting phase) and the disconnect button also not working, so I have to shutdown Forticlient.... Unfortunately due to Fortinet strange policy, support can't help (forticlient-vpn is not covered by support contract), so all my hope is in this community :) Have you ever seen something like this? Any suggestion to fix? ThanksL: 

I want to record all the searches that employees do in search engines like Google or Yahoo, etc. In web filter I have the proxy option and in search engines I have Log all search keywords enabled but it doesn't work, do I have to enable or disable something else somewhere else or should that work? What should I check? Thank you