Solved

1) Configure primary FW and factory restart secondary firewall. Configure HA and let them sync. 2) Configure primary and secondary FW separately with same configure. Change the HA priority. Which method is better? 

Hello. I'm very new to FortiNet products so please forgive me in advance. Under Security Events, on the summary page it says "No events" on everything, including AntiVirus. I have tested that the AntiVirus is working and logging events by going to eicar.org and trying to download their test files. If I click to view the AntiVirus logs, it does show those attempts were blocked. Why would it still show as "No events" in the summary? I tried changing to monitor instead of block, it lets the malware through and logs it, but that still does not show as a security event either. The same thing goes for intrusion prevention. I see logs where connections were dropped to our webserver from the intrusion provention protocols, but they do not show as an event either in the summary. Any and all help would be greatly appreciated. Thank you.

I created my first VLAN Interface on the Fortigate, under the LAN port that goes to our core switch. The LAN port to the HP Switch is a Trunk port and the new VLAN is permitted on the trunk port.   For now all the other VLAN interfaces are on the Layer 3 Core Switch   I cant ping the new VLAN's interface from the Core switch directly or by one of the resources I have on the new VLAN connected to the Core switch

I have a FortiGate 40F and at 7.2.5 everything was working properly. After the upgrade to 7.2.6, the same problem exists on 7.4.1, the wan interface (PPPoE) is failing. After a few seconds it is getting the IP from the ISP but almost immediately it fails again and is getting the 0.0.0.0/0.0.0.0Are there any suggestions?FortiGate 

I am seeking clarity on this advisory. A use of GET request method with sensitive query strings vulnerability [CWE-598] in the FortiOS SSL VPN component may allow an attacker to view plaintext passwords of remote services such as RDP or VNC, if the attacker is able to read the GET requests to those services (found in logs, referers, caches, etc...) We have several employees who SSLVPN using the FortiGate VPN client.  They then RDP to a Windows VM server.  In this instances how can an attacker view the plaintext passwords using the GET request?  As I understand a GET request is an http request and RDP uses protocol 3389.  Fortinet Support was not helpful in explaining the logic behind the advisory.  Can someone help me understand how an attacker can do this?

HiI have set up automatic backup to a sftp server (move it transfer), scheduled backup works well and the file is transferring to the server as well. But unfortunately the file's size is zero KB.Tried manual backup to sftp server by using execute backup command in the cli, but result is same.Firewall has multiple vdom.Attached the captured packet screenshot for the reference Thnaks inadvance  

Dear colleagues,   I don't get ZTNA running with Forticlient on Fedora Linux. I always get the massage   "ZTNA Access DeniedThe page you requested has been blocked by a ZTNA restriction. Details: Invalid ZTNA client certificate"   I tried Firefox, Chromium and Brave as Browsers but got the same result. I rejoined the client to EMS, I reinstalled Forticlient but no change. Is there someone with the same problem or anybody who could help?   Forticlient 7.2.2.0753 EMS Forticloud Fortigate 7.0.12     kind regards stephan

We are trying to figure out how to backup several FortiGates over an IPsec S2S tunnel, but I can't figure out how to source the backup alerts from the inside interface. Can someone provide some pointers on how to accomplish this? Thanks

Hello,Is there way to upgrade or downgrade a firmware on 124E Model network switch without having the switch configured on the network/internet? Like via serial or usb cables, TeraTerm or PuTTY etc…? If yes, please share a procedure or steps ASAP? Any help is greatly appreciated.

Hello Community, i need help with double nat please. Fortigate 100F SSL VPN Our Costumer cannot access our network through his Forti VPN client. The connection stops at 10%. After investigations, the ISP informed us that they are using a double nat. My question, what do I need to set on the Forticlient or Fortigate so that the VPN connection works. I had never had such a case.Thank you for your help

Hello.Regarding:https://community.fortinet.com/t5/FortiWeb/Outbreak-Alert-HTTP-2-Rapid-Reset-Attack-and-Mitigation/ta-p/278958 Topic is about "HTTP/2", so question is, if some service isnt using HTTP/2 scheme, then is it vuln?Please see attached screenshot example? 

Hi Guys, I have a problem after update my FGT 200E to 7.4.1, my SAML auth was operating normally, now I can't loggin to administrate firewall, I already did a new configuration on FGT and Azure but I receive the same error. "AADSTS7500525: There was an XML error in the SAML message at line 1, position 503. Verify that the XML content of the SAML messages conforms to the SAML protocol specifications." Someone also had this error and know how to fix it ? Tks

Hello,I'm trying to collect (through the json-rpc api) the firewall service objects that match     ["tcp-portrange", "==", ["443", "80"]]     and     ["udp-portrange", "==",["53"]]    . How can I use the "&&" operator to combine those two filtering conditions. The doc isn't so clear to me. I tried many things including this   { "method": "get", "params": [ { "filter": [ ["tcp-portrange", "==",["443", "80"]], "&&", ["udp-portrange", "==",["53"]] ], "url": "/pm/config/adom/ADOM-DC-FR-1/obj/firewall/service/custom" } ], "session": "{{session}}", "id": "1" }​   still having code -11 @ohole

Hello, guys! Some few weeks after upgrading my 80F to fortiOS 7.4 the web gui page for firewall policy stopped loading. Any ideas?  Thanks!

New to Fortinet, so please bear with me. I have a new Forti network environment managed by a FortiGate (7.0.12) and have trouble setting up a standalone switch (7.4). I do not want this switch managed by the FG at all. When I initially set up this switch, I set it up as managed, but when I realized that configuration wouldn't work I set it up as a standalone. This switch does appear in in FG managed Fortiswitches. Each time I connect this switch to its uplink, that port goes from displaying my native vlan to displaying the name of the switch. (The native vlan is not set to data.fortilink.) When I hover over the name it shows "Dedicated to connect to peer FortiSwitch." I can't ping the switch once connected to the network. After disconnecting the uplink and waiting for a few minutes, the native vlan changes from switch name back to my original native vlan. I've tried resetting via the recessed button several times, all to no avail. When I configure as standalone, the swit

Is packet capture COMPLETELY unavailable on the fortigate unless you purchase the model that embeds an SSD? Such as the 60F vs 61F. This is a native feature available on practically all other firewalls and switches, whether or not they have dedicated storage. And when I refer to packet capture, it's where you choose the filter and logging parameters to log packets for troubleshooting etc. In my experience, it's usually a couple hundred rows that you really need, not GBs.   If not, can you add a USB stick to say the 60F and enable logging? This would be in reference to the later firmware v7.

I have a Fortigate for a customer where the appliance DNS is configured to external servers and a DNS Database pointing to the internal domain servers The problem I'm running into is I want to point the firewall LDAP to an internal server using its hostname (not IP), but the firewall's internal DNS resolution seems to bypass the DNS database, so it can't resolve the internal names correctly. (i.e. hostname.domain.internal fails to resolve) [not the real domain] Is there a way around this that doesn't involve pointing DNS directly to the internal servers?  I want to be able to keep using the firewall as a DNS Proxy to external server in case internal DNS is down THanks in advance for you replies 

Hi All,   I am suffering by the trunk port crash when two trunk ports plugged between Forigate and Fortiswitch   Environment: I am using 1x Fortigate 80F, 1x Fortiswitch 124F-POE and 6x FortiAP 431F.   The cable connections are below: a. 6x FortiAPs are connected with 124F (Port 1 - 6) with PoE enabled b. 80F is connecting with 124F as below:      i) Fortilink Ports: 80F dedicate Ports (a and b) connect to 124F (23 and 24 Ports)      ii) Trunk Ports: 80F (Port 5 and 6 ) connect to 124F (21 and 22 Ports)   The trunk port configured as:      i) MC-LAG: disabled      ii) Mode: Static      iii) Enabled Features: Edge Port and Spanning Tree Protocol   When I configured the trunk port and plug two cables to the port, all the port in the switch crashed, because I cannot ping the gateway in 80F as well as the FortiAP will lost the configuration and failed connect with wireless devices (no S

Hi, i'm using a 100E in my homeoffice and for the children i have created a few proxy policies with URL filter whitelists with different schedules. For example: 19:00 - 16:00 minimal internet access16:00 - 18:00 allowed web pages and youtube18:00 - 19:00 allowed internet access without youtube All had woked perfect with 7.2.3 and now it seems that the scheduling has stopped working. Now after updating to 7.2.4, it was 16:05 and youtube should work, but in the log i see that youtube was blocked because of a policy which had a schedule from 18:00 to 19:00. I disabled all other policies except the one for youtube access and then the policy was used. Has here something changed in the design or is this a bug?  

Adding a new 600F v7.2.5 to FortiManager v7.2.0 gets Probe Failed when using Add Device.Ran debug on both 600F and ForitManger.Only evidence of any error in either debug is the following on the 600F. FGFMs: SSLv3/TLS read server certificate requestFGFMs: SSLv3/TLS read server certificateFGFMs: Remote issuer is /C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com.FGFMs: issuer matching...try next if not match... localissuer(fortinet-subca2001), remoteissuer(support)FGFMs: need change local cert to ISSUER[support]FGFMs: reload cert at client sideISSUER [/C=US/ST=California/L=Sunnyvale/O=Fortinet/OU=Certificate Authority/CN=support/emailAddress=support@fortinet.com]FGFMs: TLSv1.3 read server certificate verifyFGFMs: SSLv3/TLS read finishedFGFMs: SSLv3/TLS write change cipher specFGFMs: SSLv3/TLS write client certificate The debug shows that the FortiManager attempts three times before giving up.

Currently our Fortigate is connected to an Access Port on our Core Switch tagged with VLAN 4000. The Core Switch has all our Virtual Interferfaces configured on it with no restrictions on what VLANs can see/access other VLANs. The core switch has a static route "ip route-static 0.0.0.0 0.0.0.0 10.255.254.254" where 10.255.254.254 is the IP Address of the Fortgate port (Port 4) connected to the Access Port on the Core Switch The ultimate goal is to move all Virtual Interfaces to the Fortigate se we can start doing segementation. For now I just want to add a new VLAN/VLAN Interface to the Fortigate so I can segment that.     - I created the new VLAN / VLAN Interface under Port 4 on the Fortigate (VLAN 210)      - I created a new trunk port on the Core Switch that looks like this          interface GigabitEthernet4/0/24            port link-mode bridge      &nb

Hello I want to connect to fortiguard using ha-mgmt-interface. Is it possible?? When I tested it, it went to the interface set to default routing rather than ha-mgmt-interface.(I also enabled ha-direct.) Please let me know if this is possible.And if possible, please tell me how. Thanks.

Hi,Any tips or documentation for fine tuning the fortiSIEM rules/incident alert?Trying to improve or add fine tuned rules / incident alerts we are getting from the fortiSIEM. Thank you.

Hello team, I have a problem with matching a policy.The policy in question is:the policy logs (one is an example of a correct match and the 'other of a wrong match)I can't figure out why they don't both match the same policy.Thanks for the support

On one laptop everything is working fine. But on a service laptop we have the following issue:Connection is working fine but the bytes send and received stay on 0.When I check the "Fortinet SSL VPN" adapter under IPv4 config the static IP address remains empty.On the working computer this gets filled in automatically. Only debug and info lines in the log, already removed and reinstalled the software couple of times.