Solved

Hi team,   I´ve installed FortiSOAR, configured some connectors (icluding VirusTotal and IPQuality), created soem playbooks and everyhting seemed working well. Then, I installed the Phsihing Solution Pack and run it. When I opened the indicator "http://demo.gumblar.cn/", I realized the system was to slow to enrich the indicator. So, I opened the Playbook execution viewer and realized the playbook "Enrich Indicators (Type All)" stopped on "Compute Reputation Data" with a Jinja error code (CD-WF-8) - attached.   After that, I went to the Indicators module and tried to create a manual indicator for IP. I´ve created the new indicator, but again realized the Enrichment has stopped int he same playbook step (and same playbook).    I talked to a colleague of mine who suggested me to change the Global Variable "Demo_mode" to false. However, I realized this variable was still as false.   Would like to ask your help for solving this issue. The interesting thing that

Hello Everyone,   Anyone can share with me the guidelines on how to configure SDWAN in VDOM?  and limitation feature when FortiGate firewalls enable vdom mode?   Best Regards Thanks

 Trying to install the FortiClient VPN from https://www.fortinet.com/support/product-downloads keeps showing this error. I'm on Windows 11 22H2

My website is WordPress, added the Wordfence WAF and it shows only my Firewall IP as the traffic hits. I am doing IP & port forwarding on the firewall 60F. The following is my firewall policy and VIP: FG-60F (IPS1-website) $ show config firewall vip edit "IPS1-website" set uuid 486s855e-c968-54gl-692f-36157e21b9c0 set extip XX.XXX.XXX.XX set mappedip "192.168.1.54" set extintf "any" set portforward enable set extport 80 set mappedport 84 next end FG-60F $ config firewall policy FG-60F (policy) $ edit 2 FG-60F (2) $ show config firewall policy edit 2 set name "WAN1-WP-web" set uuid 31b74efe-c96a-5wed-a157-fddc795fb4c0 set srcintf "SD-WAN" set dstintf "internal" set action accept set srcaddr "all" set dstaddr "IPS1-website" set schedule "always" set service "ALL" set utm-status enable set ssl-ssh-profile "certificate-insp

Dear community, Maybe anyone else already wrapped his/her around this on FortiSIEM:I am looking for an aggregation function in the analytics/report generation that behaves like the SQL "concat" command, meaning writing all the values of all rows into the single result row.My usecase, to make it a little bit clearer:From the FortiClient EMS, I receive all endpoint's vulnerabilities (search criteria is Event Type = FortiEMS-Vuln-Detected)As Group By/Display Fields, I selected:COUNT DISTINCT( Vulnerability Id )COUNT DISTINCT( Host Name )ProductThis generates a wonderful list of all the products which need to be patched on the endpoints and I can sort it by how many hosts are affected (COUNT DISTINCT( Host Name ) )What I cannot see here, is which hosts exactly I need to go to and patchIf I used "Host Name" as display field, this would obviously split up my list into dozens of single lines with the same product just on another deviceI'd prefer keeping the single line, but instead of&nb

we would have to make the website www.aurena.at accessible to our colleagues for a longer period of time.The website works normally except for the images.Example: https://aurena.s3.amazonaws.com/m73k/public/auction/9176/1ce4f53d-72a7-4867-962c-17af8d601414_a.JPGThe URL is blocked by Fortigate Application Control (S3 Amazon Cloudservices).I have therefore created an exception policy that looks like this and precedes the Application Control Block Policy: The user has also not had any old sessions open according to Fortigate.What can we do so that we don't have to unblock the whole Amazon S3 Cloud on Fortigate?  

Hi all Have a strange problem with SSL VPN not answering. Have set it up multiple times on other system but only with only one WAN IP. Problem here i think is that it listens on all WAN IP's (11 Wan IPs). Everything is standard otherwise than the port (444) but the service doesn't answer. It's a FG81 running 7.2.5 Best regards Henrik 

I am working on a 30E with the built in local WiFi radio and although bridging is an option for the SSID I cannot for the life of me get it to advertise even with broadcast enabled. Tunneled works but I'd prefer bridging using the internal software switch. Any ideas? 

I have a Fortgate connected with others using OSPF, this one have some static routes that need to be redistributed over OSPF, so I configured to redistribute all. But now I need to add some static routes that will not to be redistributed.   I found this Technical tip https://community.fortinet.com/t5/FortiGate/Technical-Tip-OSPF-static-routes-redistribution-example/ta-p/191525    Is not exacly what i need but i try to adjust like this....       config router access-list edit "NOT-Redistribute" config rule edit 1 set prefix 10.241.224.0/19 set exact-match enable set action deny next edit 2 set prefix 192.168.192.0/20 set exact-match enable set action deny next edit 3 set prefix 10.241.48.0/20 set exact-match enable set action deny next end end edit "Redistribute-ALL" c

I have a single IPsec tunnel with Phase 1 and Phase 2 up.It is not passing traffic so something is wrong.When I do a get vpn ipsec tunnel name XXXX command I am used to seeing one SA in the output.Now I have 4 see below.It might be on account of issuing diagnose vpn ike restart a couple of times.What are these extra associations?thanks..... 

Hi, I have some forticlient installed on pc's without internet connection so i need to know if i can use fortiems as a source to update forticlient av signatures or if internet connection is required. best regards,

Hi all, Lately some emails containing URLs seem to skip the URL filter and rewrite that is configured.Nothing concerning the URLs show up in the logs, so it seems that they just go undetected. Yet, they hit exactly the same policies as emails that are getting processed.I suspect it might have something to do with "Content-Transfer-Encoding: quoted-printable" that is used in at least two of the cases I've been able to track down. Has anybody seen this behaviour? Is this expected? We are running Fortimail v7.4.1 on a VM. Not sure if the behaviour was the same in older versions. Many thanks,Imre

I want to implement a simple FortiNAC deployment and place the ETH0 (FortiNAC Mgnt) and ETH1 (FortiNAC Service) interfaces in the same VLAN for a "L3 network type". It seems to me that there will be no problem but I want to know if anyone here has done something like this and if it is working. I plan to use this table of IP Address:MGMT10.47.0.60/24CAPTIVE REGISTRATION10.47.0.61/24CAPTIVE REMEDIATION10.47.0.62/24CAPTIVE DEAD END10.47.0.63/24Is there anyone here who can point to a document describing this? I will be very grateful if there are contributions. 

I am looking for an indicator of uptime for my IPSec tunnel.I find these 3 commands but I can see nothing that can act as such.Any ideas greatly appreciated 

Nice people what can go wrong. I configured on fortigate 100 VPN native windows according to this guide. https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-establish-VPN-connection-between-Windows-10/ta-p/200001And it connects nicely to windows. But I only have access to the router. I ping his address I can access his site. For that I no longer ping any host on the local network. What did I forget?

Dear FortiExpertsWhy when my new VPN spoke sends IKE initiation packets to my existing Hub, does my hub not reply?I have found this "IKEv2 exchange=SA_INIT id" of 4f0472f511bd4d4a in debugs on both spoke and hub.So I can related the debugs to each other.The spoke is repeatedly sending IKE packets as seen with this pattern: 2023-11-03 12:08:37.961125 ike 3:pri_bms: schedule auto-negotiate 2023-11-03 12:08:38.970872 ike 3:pri_bms: auto-negotiate connection 2023-11-03 12:08:38.970996 ike 3:pri_bms: created connection: 0x8806da0 5 192.168.1.23->203.57.169.172:500. 2023-11-03 12:08:38.971031 ike 3:pri_bms:pri_bms: chosen to populate IKE_SA traffic-selectors 2023-11-03 12:08:38.971095 ike 3:pri_bms: no suitable IKE_SA, queuing CHILD_SA request and initiating IKE_SA negotiation 2023-11-03 12:08:38.971166 ike 3:pri_bms:613: generate DH public value request queued 2023-11-03 12:08:38.971515 ike 3:pri_bms:613: out 4F0472F511BD4D4A00000.. <<<truncated>>> 00000804000005

hello guys .I have two internet links with which I bgp The first question is that it says igp is in the original part of the best route table!!!The second question is that, when entering our network, it comes from a different link. Is it possible to change the entry route?  

GreetingsWhen I enable the various debugs as shown and I run diagnose debug info command I am expecting to see all currently enabled debugs in the location shown but I do not. Is this how it should be?Where or how can I obtain feedback to confirm what debugs are turned on at any given point?Thanks  

Hello Team, i have configured threat feed with "update method" external feed.I need to enable a connection coming from an ip that is inside the dynamic list. Is it possible to exclude this ip from the threat feed list? Thanks for the supportBR

Hi everyone I am trying to use the REST API to add IP addresses on our Firewall.  I have this python code:  import os import requests import urllib3 import getpass urllib3.disable_warnings(urllib3.exceptions.InsecureRequestWarning) baseURL = "REDACTED URL" apiURL = "/api/v2/cmdb/firewall/address" token = "REDACTED TOKEN" headers = {'Authorization':'Bearer ' + token,} params = { "datasource":1, "vdom": "root" } def createNewIpAddressData(ipAddress): data = { "name":"ext-" + ipAddress, "subnet":ipAddress + "/32", "comment": "New IP", "color":"0" } return data def addNewIpAddress(postData): try: r = requests.post(baseURL + apiURL, headers=headers, params=params, verify=False, data=postData, timeout=5) except requests.exceptions.Timeout: print("Timeout!") return None if r.status_code != 200: print("Error code:{}".format(r.status_code)) print(r.content) return Non

Dear Community,Which browser Dark Mode theme for working with FortiGate's would you recommend?kind regardsliswar

Hi!   I am configured HA on my Fortigate 100E running 5.6.   The CLI command get system ha status shows that it looks ok .   HA Health Status: OK Serial number Device 1(updated 3 seconds ago): in-sync Serial number Device 2(updated 2 seconds ago): in-sync   Master: Primary , FG100E4Q170444845, cluster index = 0 Slave : Secondry , FG100E4Q17044540, cluster index = 1   But on GUI the status is showing as Not Synchronized.   One more thing is that I used device priority for my selection of primary. I know that up time comes before the priority but my thought was that once I set higher priority then it will take that as first option of choice or I am missing point here.   Thanks        

Dear Colleagues,In almost every guide I found about adding a ZTNA Destination Gateway, "SaaS Applications" there is a screenshot of a long prefilled List with well known services where you should select yours from. But for me the List is empty. What can I do to populate the List of SaaS Applications? I'm using FortiEMS Cloud version. beststephan

We have FortiGate-200F with Firmware 7.2.5 at HQ Our office have 4 site. Every site have 2 AD server. We install FSSO DC agent on every server.Main server at HQ can monitor on other server normally. But we have problem with 1 user that show correct user but wrong IP address in FSSO DC agent. It show user: Cxxxxxx , IP: 192.168.0.109but the correct was user: Cxxxxxx , IP: 192.168.0.127 We have try de-authentication from Fortigate and restart client laptop but FSSO DC agent still show wrong IP address Please advise how can we solve this issue.

hello there,we use FG-60F with firmware 7.2.4 I searched internet how to apply policy to block activity download/upload for certain file size.But I can't find menu/settings as told by them. anyone can help please?I've tried to check DLP setting, file filter, also can't be found. thank you