Solved

Dear community, We are using FortiAuthenticator as External Authentication source for our FortiSIEM-users, providing us MFA. At the moment, we followed the guide for External Authentication Settings and set up this integration via RADIUS.It works fine, but of course entering the 6 digits of FortiToken is not very appealing to users ;) So, we'd like to move to SAML. I am not deep into the information that needs to be exchanged between both tools. The FSM docs focus on Okta and Azure AD which work a little different to FAC. Has anyone here experience in connecting these two components and likes to share the general config steps? If not, we will figure out and I will share our experience in a few weeks... Best,Christian

 Hi Community, I'm running into a problem while testing a customer setup. Customer is using a 3rd party device between FG and FortiSwitches, so I'm testing that setup. FortiLink mode over a layer-3 network is working fine with 2 FS224D-FPOE, but the FS108F is making some trouble. Fortigate is running version 7.2.5, all FortiSwitches are running 7.2.3. As you can see in the screenshot, CAPWAP is coming up, but after some time there are some error messages and the CAPWAP is down again. Anyone an idear what's wrong here? When connecting the FS108F direct to another fortiswitch, it's working fine. Thanks RegardsNico

Good day!I have non-critical but pretty annoying issue which is connected with Fortimanager, which displays application IDs instead of application titles in Fortigate Security policies. So for example if I want to provide RDP access and create a policy using Application (not service), Fortimanager shows id 15511, not RDP (you can see it on the screenshot). This bug appeared after Fortimanager upgrade to version 7.2.3, but I can't find any information how to fix it.Maybe someone has already faced such problem and know how to solve it? Any help is appreciated.Thanks! 

I have a 60F-3G4G in production and a 40G on test.I want to do a diff on the show full-config output but I find the output so different that I do some digging.Why is there such a massive delta in the config system ? output ?Thanks

GreetingsI have a 60F-3G4G unit.I can see the following physical interfaces (green boxes) corresponding to ports on the Front Facia at the top of the image shown below.I can see a wwan physical interface which does not correspond to any physical interface in the Facia. (red box)What is this interface?Much appreciate any reply

I have a site to site VPN setup from Fortigate 200D too AWS VPC. The tunnels are up and active but I cannot seem to get the routing correct.We are wanting all non-local traffic to go through the VPN tunnel to AWS. No matter what change I make traffice goes out the wan!.  I stand corrected if I edit the static default route to use the VPN interface instead of the WAN ports the tunnels go down.     next    edit "AWS VPN"        set vdom "VDOM-A"        set ip 169.254.47.154 255.255.255.255        set allowaccess ping        set type tunnel        set remote-ip 169.254.47.153        set snmp-index 19        set interface "port1"    next &nb

HelloFortiNAC 9.2.8.Anyone has integrated Huawei S7000 WLC in FortiNAC?This device is a switch and a WLC at the same time.When we add it to FortiNAC (SNMP + SSH), all switch ports are seen but we don't find SSIDs anywhere.Also no way to link the managed APs to WLC on FortiNAC. It seems it is just recognized as a switch device.Already read all FortiNAC document about Huawei WLC integration but found nothing useful for my case. 

I am using Fortclient 7.0.8.427 using Azure SAML for sign-in.   All works except for some users, when authenicating, they get the option to click on thier email address from the In Browser window that appears.   For others, the have to always enter in their email address.   Has anyone seen this?   Checked Credential Manager and cleared out the cache in MS Egde the default browser but no success.   Has anyone seen this?  

Hi at all,I create a VPN IPSEC for FortiClient:And this is the client configuration:But the connection fail every time I have enabled the debug log:ike 0: comes ClientIP:1011->FortiGateIPWAN:500,ifindex=8,vrf=0....ike 0: IKEv1 exchange=Aggressive id=2b2bdae897a15850/0000000000000000 len=508 vrf=0ike 0: in 2B2BDAE897A1585000000000000000000110040000000000000001FC04000064000000010000000100000058010100020300002801010000800B0001000C00040001518080010007800E00808003000180020002800400050000002802010000800B0001000C00040001518080010007800E01008003000180020004800400050A0000C49C29F77BADE5D43553C169BA2D54B30BB02C97B23EFFD1A8E6B53C663533F691F737045EBEE9F10483E173BAFFBA1EBED566AA0A81BF0EADB45B86D183F5839598F7B2FD23CAB766B358B537275DEDDE52A0CF4CAC22E0A84039FD27F15ED1D45D97CC0F46296A4C0B3461D509C1E74FC92A427AC11A48DFFAA82F85F7D54B9C64B066B072DE2100BFF3045364E54C57D07F50E0009BF4342A6DFB6EFA3C1A339D201E1D4893C598DB9E6A37BB7BC3E080B2BF16B1A6E0CB7331CCD4E6C3751405000014857E578C3B498EF7A50D38306E30A

Its posible that a Fortimanager act as NTP Server, I didnt found litarature about that only for Fortigates.

Hello EvryOne We are using FortiGate201F v6.4.11We have an internal web based application and I want my users to be able to connect to that application from outside our network.So I wanted to NAT between our public IP and private IPSo am getting the below error: A duplicate entry already exists.The extip is overlapped with the gateway of static route. So I searched the firewall I found that the same Public IP is defined as Gateway Address . am not sure what that’s mean ?Would any one kindly help. Thanks.

Hi All,   Hope you can give some light on the following issue which I'm facing with some fortigates, we have some Fortigates 101F, 100F, 60F and 40F, where after update to OS 7.4.1 we are not able to select VoIP profile on firewall rules, before update it was working fine and VoIP service was ok. This is only happeing on 60F and 40F fortigates, on 100F and 101F we are capable to still using VoIP profile on firewall profiles (this is being used on the IPSEC rules created)   These are the settings we have on fortigates for VoIP: config system settingsset sip-expectation enableset sip-nat-trace disableset h323-direct-model enableset default-voip-alg-mode kernel-helper-basedset gui-implicit-policy disableset gui-voip-profile enableCurrently VoIP service is not operational between remote office due to this, traffic is passing on tunnels but SIP sessions looking not be linked as expected. Can someone can let kmoe if maybe there is a command to force/reload VoIP profile be visible o

I have a FortiGate, I have 2 interfaces that connect to 2 different ISP/modems. When the primary ISP is down, the other is automatically used.I have set up Email Alerts through Stitch using the trigger "Interface status changed"I am able to receive email alerts if the interface is down (example: powering off the modem). But if there is no internet connection (example: due to ISP maintenance) I don't get any alert, because the interface is still up. How do I receive alerts on lost connectivity for an interface?

Hi  I have a fortigate 40F that is having problems communicating with the fortianalyser. When I perform a connectivity test I receive the "Unauthorized" message. I have already added the device to Fortianalyser. The output of the "exec log fortianalyzer test-connectivity" command displays:    Failed to get FAZ's status. Authentication Failed. (-19)     The OFTPD debug in fortianalyser: diag debug app oftpd 8 x.x.x.xdiag debug timestamp enablediag debug enable     [OFTP_try_accept_SSL_connection:1831 x.x.x.x] SSL clienthello incoming on sockfd[56] [OFTP_SSL_CTX_dft:1240 x.x.x.x] dft-idx=0 inited=1. [__create_ssl_context:1666 x.x.x.x] SSL socket[56] pid[1846] ssl[0x15b7a60] SSL_new() success. [__SSL_info_callback:301] before SSL initialization [__SSL_info_callback:301] before SSL initialization [server_sni_cb:1255] server_sni_cb(): sni='0x1434250/fortinet-ca2.fortinet.com' [server_sni_cb:1269] --

Hello I configure HA design active-passive       There is no communication + port e0/3 in switch in suspended which connect to passive firewall, how solve this problem or there is another better design HA .

Hi all, I decided to run a factory reset to an azure fortigate, to avoid license problems deploying new one.But after the factory reset the default admin without password is not working, how can I login now to the fortigate.I triyed to reset the password from Azure without success. Thanks

Dear community, At the moment, we only have one public IPv4 address left to put the FortiSIEM cluster behind.This has some implications:- We cannot differentiate user traffic from collector traffic (which I would like to use to limit the source IPs or even allow users through VPN only)- As I cannot define different IPs for supervisor or worker cluster, load balancing the collector traffic seems to be impossible - so I will have issues scaling some time in near future (if I don't get more IP addresses) I do see that there is a property for the port on the collector setting (phoenix config), but I am not sure if this works correctly. My idea would be to hand over different IP-ports for user, collector to supervisor and collector to worker.Then, I could create VIPs on the firewall that match (and for the workers, load-balance) the ports to the internal IPs.Because, as far as I can see, the HTTP Host header is not present in the http-request itself, which would be the only method

This post is to seek help to generate some debug output.The context is an attempt to setup a new IPsec tunnel on a new site to connect into an existing SD-WAN hub.I believe that I have copied the config of any existing site to a new setup but upon adding the first tunnel it remains status = down.I am wanting to generate some debugs but not seeing any output.All I have done is the following command:diagnose debug enableDo I need to do anything else?I have left the IKE filter at default i.e. No filtering.I am not sure if there is somewhere I need to specifically turn on IKE debugging?Appreciate any help

Hello team,   i have a question abount policy match. I have sniffed packets from fortigate CLI and the result is:   6.891062 port3 in 195.xx.xxx.xx -> 172.xx.xx.xxx: icmp: echo request7.892226 port3 in 195.xx.xxx.xx -> 172.xx.xx.xxx: icmp: echo request8.892875 port3 in 195.xx.xxx.xx -> 172.xx.xx.xxx: icmp: echo request   So I created a firewall policy having as source port3 and source ip address 195.xx.xxx.xx and as destination 172.xx.xx.xxx with service ICMP_ALL. But the policy not match.   Any suggestion?   Thanks for the support    

Im trying to configure an IPS Profile to block a Signatunre on whicht we can see under Protocols just unencrypted Protocols such as ftp, http, stmp, etc. Since those arent encrypted im assuming that we do not need ssl inspection at all.Is this correct or did i miss something here?Thanks in advanced.   

Hello,My four Active Directory accounts were successfully joined to Fortisiem using LDAP and WMI credentials, but up until this point, I was unable to get the users and groups from the AD to Fortisiem; nothing was visible on the CMDB>Users page. FortiSIEM 

Hi Guy, I have an error about forticlient: Unable to logon to the server. Your user name or password may not be configured properly for this connection. (-12) I sure username and pass is right. My 100D ver: v5.4.3,build1111 (GA) Forticlient ver: 5.4.2.0860 Thanks for help. 

When looking at the results from "Show matching logs" from the firewall policy, the Result field doesn't say Accept or Deny - it's just blank. I tried to telnet from the firewall to the destination of the blank Result field rule, but it shows the console line is in use. FortiGate-80F # exec telnet 10.51.0.156 13155Trying 10.51.0.156...Failed to connect to specified unit.Console line is in use. Clear it before next try. I did a search on Google and got no hits. How do I clear the console line? Thanks

FortiManager  FortiGate Dear friend,Add FortiGate 7.2.6 to Fortimanger 7.4.1 under adom adom_1 instead of root; all FortiGate(s) and FortiManager are deployed on AWS. Confront bug all the way as following: Understand one can (1) FortiGate add FortiManager  by searching FortiManager's ip address -- this only adds to adom root? (2) FortiManager add FortiGate by searching FortiGate's ip address -- never works (even for adom root, confront the bug above) for AWS deployment, but used to work for VMware ESXi deployment for Adom root (no can have no access to ESXI deployment in short term).Neither can help so far.  

Hi guys, I'm trying to make a server accessible from WAN, I configured virtual ip and port for the server, and then  I created a local in policy to test : config firewall local-in-policyedit 1set intf "port1"set srcaddr "all"set dstaddr "all"set action acceptset service "ALL"set schedule "always"nextend but I cannot access the server and related traffic still matches policy 0 : id=20085 trace_id=114 func=print_pkt_detail line=5822 msg="vd-root:0 received a packet(proto=6, [my ip]:2084->[FW IP]:50022) from port1. flag [S], seq 2666835964, ack 0, win 64240"id=20085 trace_id=114 func=init_ip_session_common line=5993 msg="allocate a new session-01e45466"id=20085 trace_id=114 func=vf_ip_route_input_common line=2615 msg="find a route: flag=80000000 gw-[FW IP] via root"id=20085 trace_id=114 func=fw_local_in_handler line=447 msg="iprope_in_check() check failed on policy 0, drop"  Am I doing it wrong? Please help, thanks!