Solved

Hello,I monitor my Windows active directory which is also my DNS server through the Fortisiem Windows agent, How can I detect the change made on the DNS side ( record deleting or changing)?What types of Windows events ID should I look for when searching for those kinds of modifications made on the DNS server side? FortiSIEM 

I have firewalls in HA and have recieved new contract registration codes, adding this to my primary is easy enough in the GUI, but the secondary I'm told to do it via CLI. What are the commands to do so?I know I could fail over to the secondary but that seems a bit overkill.Currently on v7.0.12 build0523 I can enter the secondary from the CLI with, but once inside? Can't find any documentation.# execute ha manage [ID] [username] 

Hello, i am trying to route some ssl vpn traffic to a specific server over our firewall. the server i am trying to reach is a hyperforce infrastructure with frequently changing ip addresses. so it is no option to add a route for an ipv4 address. instead the option would be to add a FQDN instead of an ipv4 address. but it is not available to add an FQDN to the split tunneling tunnel mode routing address override. Is there a option i can do this. (perhaps a cronscript witch performs a lookup an adds the ipv4 addresses to an address group?) thanks a lot

Hello, I successfully integrated the FMC from Cisco with the fortisiem platform, but all the logs I received are unkown.Any suggestion to resolve this issue?

I need to perform all configuration of a VPN Site-to-site "External Gateway" through Fortimanager.But, in the last step of the configuration I didn't find the option "Selectors of Phase 2". There is an option "Create Phase2 by Protected Subnet Pair" , but I didn't identify where I define the remote and local networks that browsed this VPN.When I add an object in "Protected Subnet" will it be enough or should I create them through the firewall policy?

Dear Fortinet Community. We start to upgrade our network infrastructure with FortiSwitches. Now we have ordered several devices (400 series) and the SFP & SFP+ Transceivers. We can see that the SFP+ Transceivers have a label stating that this Transceiver is a original Fortinet Transceiver. The other SFP Transceivers seem to be from Finisar. My question to you community. Is this normal or the standard, that Fortinet ships OEM compatible Transceivers from Finisar? I am wondering about the difference. For any answer from your experience would be very helpful :)Have a great day. FortiLover

Good morning, Has anyone every seen a Fortiswitch with dead ports?  I have a standalone 448E (7.2.3) that has 3 adjacent ethernet ports that are dead.  When you plug anything into them you get no link lights.  All the ports are administratively up so thats not it either. If anyone has an diagnostic or otherwise suggestions or comments, I'd really appreciate it.  This units support contract has expired so I can't contact Fortinet about it.

Hi I understood that in the Fortinet training video that the Antivirus check is done by ISP engine.   Now the the test practice exam the selection of Antivirus wasn't correct according to the result provided by Fortinet.  I'would like to know what I missed. Thank you ,      

Hi, We had hired VAPT to test and below is the report from them.Fortigate 7.0.11 & Fortimanager 7.0.10 Does anyone know about this?How to find out the OpenSSH version (not referring to SSH protocol version 2) used in Fortigate?Or does fortigate uses any OpenSSH?As OpenSSH v7.9 is affected by the vulnerability, CVE-2019-6111.If it’s affected, what is the workaround to mitigate from attacks?Thank you Category: A06:2021-Vulnerable and Outdated ComponentsVul Findings:Vulnerable OpenSSH VersionThe installed version of OpenSSH is affected by multiple vulnerabilities- logic error- out-of-bouns read- double-free memory fault- fail open permission list- one-byte overflow- double free in error path- integer overflow- improper group inheritance- exploitation of low-privilege code- double-free memory corruption- CVE-2020-14871- integer overflow- memory side-channel attack- CVE-2019-6111- zero-length files creation

Hello Anoynone know how to show the DHCPv6 IAID and DHCPv6 Client DUID on a fortigate ?The device is configured to get IPV6 address via DHCP on WAN1 port from the ISP.I want to know what IAID and DUID the fortigate is presenting to the ISP's DHCP server via the WAN port.Sniffing is not an option. 

Since I have 2 WAN interfaces in a virtual-wan-link.For the traffic is it Active-active or active-passive?Is there any way to change the priority?

Hi Team, We have a scenario where we want to have two internet output connections to the same ISP, one connection over the WAN with public IP (which is already configured), and the second connection is to be on another LAN interface with private IP. Please check the details below: The connection is as follows:  Users-->proxy server-->Fortigate-->ISP router-->internet this connection is going through the WAN public IP. We want to enable another interface that will be connected to the ISP router with DHCP config to obtain IP/GW, and to influence the traffic to specific destinations to go through the new connection (private IP) using PBR. The issue we are facing is that once we enable the interface (for example int 5) with DHCP config the internet connection goes down even without using it in any sort of policies. Thanks.  

Hi can we do the SNMP configuration for PRTG network monitoringwhen fortigate firewall is working with multi vdom and dedicated management port ?Forti OS is 6.4.12 and there are four vdoms that management interface is working on isolated VDOM,  

Hello   We are using FortiClient EMS to manged + 7.000 FortiClient, only using the VPN function. The EMS server uses our Microsoft Active Directory to pull in devices and their location in the AD. Currently we are assigning policies to devices based on the device location in AD (OUs).   However I'de like to be able to assign policies to users / user-groups. I've greated a new AD security group, and added my user as member. I'm able to view the AD security group in FortiClient EMS, and I can assign my policy to it. However I can't view my user as member of the group in EMS, and also my FortiClient still has the old policy assigned from it's current location. I've made sure the policy has the highest priority under 'managed policies'.   Anyone been trying this out with success?

FortiGate 1100E with FortiOS v6.4.14 build2093 (GA) We have a SIEM to collect and correlate events from multiple sources. On Fortigate we have configured SIEM as an external syslog server and it work well BUT i've noticed that only failed ssl-vpn login were sent.  Any idea how to configure Fortigate to sent also successful ssl-vpn login to external syslog? Thanks

Hello,   I have several question regarding HA (Active-Standby) Fortigate virtual.  I had some issues when I was trying to configure HA in virtual environment. I used this article: https://docs.fortinet.com/document/fortigate/7.4.0/administration-guide/900885/ha-active-passive-cluster-setup When I enabled HA my firewalls went down and after that I had no access to them via CLI, Web and so on. But If I then break HA (I have access via ESXi console) then access to the firewalls appeared. But I found workaround - I configured HA with "Unicast Heartbeat". HA works, but sometimes when I do some configuration changes I see "HA not synchronizing" alert. I would like to know is it normal behaviour on not?   Thanks in advice. 

We have been working with git for years, two months ago we noticed that were not been able to use the git commands anymore: git pull git@github.com: Permission denied (publickey). fatal: Could not read from remote repository. Please make sure you have the correct access rights and the repository exists.  In the beginning we tought the problem were the credentials, after many tests we realized that it must be something in the firewall, because:Inside our LAN covered by the Fortinet Firewall, we get this errorInside out LAN covered by the firewall setting a rule ACCEPT ALL (all open), same errorUsing git inside the WSL installed on the same machines, worksUsing a WIFI not covered by the firewall, worksUsing the tethering of a random phone, worksUsing a LAN not covered by the firewall, worksWe tested different git versions: 2.41.0.windows.3, 2.32.0.windows.2, 2.33.0.windows.2 and we got the same results. We don't know what further tests can be done in order

 Per above picture - sometimes, about 50% of the time, all our policy blocks show 0/0, despite having multiple policies, when applied to policy packages. This is following an upgrade to 7.2.3 from 7.0.8.

friends, a question, in which layer of the OSI model does the FortiGate firewall work? I found this link which indicates that it works on all layers. That's true?https://www.linkedin.com/pulse/qu%C3%A9-es-un-firewall-perimetral-y-tipos-hay-luis-florez-estrada/?originalSubdomain=es

Just realized that the term Trunk is not the same in FSW as in Cisco. Thats why I am trying to clarify trunking between cisco and FWS.I have a:FWSwith just one VLAN (VLAN 10)on Port3 is a computer connected:native & allowed vlan 10Trunk:no Ling Aggression.just want to use the nr port 24 to forward traffic from vlan 10 to a cisco port which is in access mode vlan 10.cisco swichwith VLAN 9 & 11on port 15 is a laptop connected:mode access vlan 10Trunk on port 25mode trunknative vlan 9allowed vlan 1, 10 & 11So my question is:I know that, while trunking both switches's ports should have the same vlan as native vlan.Since my cisco switch has vlan 9 as native, i configured the FSW like this:edit port24set native-vlan 9set allowed-vlan 10set stp-state enabledI see that my traffic goes through and i can ping the laptop on my cisco switch. Am i doing it correctly ?  

Hello Evryone, We are facing a strange issue with our azure saml authetification for vpn users. The issue is on web mode as well as Forticlient. The issue is that users are not redirected to azure login page. ->vpn works with local users->single sign on button appears on web mode (Policy must be ok)->when we enable debug for samld there is only 1 output :__samld_sp_create_auth_req [447]: SAML SP algo: 0 -> lasso=1. Binding Method: urn:oasis:names:tc:SAML:2.0:bindings:HTTP-POST->When we test on azure (Assertion consumer service URL) we get invalid http request->on web mode when we click on single sign on we are not redirected to azure and we get ERR_EMPTY_RESPONSEWe have checked multiple times if there was any syntax mismatch between idp and sp but there are none 3 fortinet support engineers also checked We are running out of ideas. Did anyone faced this issue ? Any suggestion is welcome ! Thanks in advanceFortiGate 

I've tried to create an application control security profile for the DNS requests of our DNS Server, so that only application data of the type DNS (and ICMP/Ping) is allowed. The app profile looks like this:  When I did that, I saw in the logs that Google Translate was getting blocked. Here the log of the blocked connection attempt:      date=2023-08-30 time=10:34:34 id=7273030939687518227 itime="2023-08-30 10:34:35" euid=3 epid=101 dsteuid=3 dstepid=101 logver=700120523 type="utm" subtype="app-ctrl" level="warning" action="block" sessionid=369741986 policyid=546 srcip=*.*.*.* dstip=*.*.*.* srcport=63371 dstport=53 proto=17 logid=1059028705 service="DNS" eventtime=1693384475533113261 incidentserialno=81095000 direction="outgoing" apprisk="elevated" appid=24473 srcintfrole="lan" dstintfrole="wan" applist="app-dns" appcat="General.Interest" app="Google.Translate" eventtype="signature" srcintf="****" dstintf="****" msg="General.Interest: Google.Tran

HelloI have 4 FGT 7.0.12 of the same model in FGSP configuration (no HA), handling asymmetric traffic.For non-UTM sessions, when testing failover (FGT reboot) all works fine, the sessions keep working when the node fails-over and fails-back.However for UTM sessions the fail-over doesn't work when we have 4 nodes.If the FGT handling the UTM session is rebooted, the session hangs until the node boots up, then it handles back its UTM session.When I remove 2 FGT from my network and redo the test with only 2 FGT the fail-over works just fine. In summary:Non-UTM session fails-over successfully when we have 4 nodesUTM session fails-over successfully when we have 2 nodes, but hangs with 4 nodesAny idea? 

Hi Support,I am New to Fortinet firewall. we are using FortiGate 100F firewall and the firmware version is v7.4. we have created multiple Vlans and two WAN links. now I configured static route for wan links. and Now all the vlans network traffics are going in only one wan link ie (primary Link). the secondary wan link is idle. so i need to segregate  the Vlan traffic with the two WAN link. i need to configure One Vlan to access only Primary wan link. and second Vlan to access  secondary wan link.  and i have not configure the wan link in SD wan ZONE can you Please help. 

Ver 7.2.3 see pic below