Solved

All of the STAT_STDDEV functions end with a colon and some number.   I am assuming the number represents some sort of time frame, but I cannot find any documentation on this.   Can someone help explain the structure of this function? EXAMPLE:  STAT_STDDEV(SUM(Total Flows):125) FortiSIEM 

I currently have event triggers working on the FortiGate to ban IP's when the event handler on the FortiAnalyzer sees a matching event from the FortiGate. I also have an alert working within FortiAnalyzer for FortiMail when the event handler sees a matching event from the FortiMail. I recall reading somewhere, when the FortiGate Event Handler is triggered, it only notifies the device from where it originated, which explains why I cannot get it to trigger on the FortiGate since it originated from FortiMail. I'm trying to determine how I can ban an IP on the FortiGate from and event captured on the FortiMail using FortiAnalyzer. Is this possible? Has anyone done anything similar? NOTE: In the images below, I have email alert configured instead ban IP for testing purposes. Working Email Alert In FortiAnalyzerWorking Alert in FortiAnalyzer FortiAnalyzer Event Counts Not Working FortiGate Automation StitchNot Working FortiGate Automation Stitch FortiG

How would I create a fortilink connection when having two Fortiswitches in a HA setup? Below is a topology diagram of my setup, not sure If I can use the WAN ports for fortilink (obviously cannot add them to the aggregate now) but if I should have during the setup. My next thought is to setup a separate port on the FG for fortilink and then use another port on the fortiswitch, but my question is will the switch recognize this as a fortilink connection or will I need to setup a VLAN? Currently the switches are in layer 2 mode with no configs, just passing WAN traffic to both FG's.  

Currently running an ADVPN (BGP) with a couple dozen spokes. All the spokes are a single WAN connection. Now one of the sites wants to add a redundant WAN connection. There are two hubs at the 'hub' so if ISP 1 at the hub goes down, the spokes failover to Hub ISP 2. On the spokes, the backup hub monitors the first hub. How can I add a 3rd advpn connection from the spoke which would use spoke WAN2 if spoke WAN1 fails?    edit "ADVPN-PRIMARY" set interface "wan1" set peertype any set net-device enable set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set add-route disable set dpd on-idle set wizard-type spoke-fortigate-auto-discovery set auto-discovery-receiver enable set auto-discovery-shortcuts dependent set remote-gw <ISP1 at HUB> next edit "ADVPN-BACKUP" set interface "wan1" set peertype any set net-device enable set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1 set dpd on-i

Hello,1x HQ and 15x branch.Each branch has 2x SD-WAN Zones (one for wan1 a wan2 and second for IPsec1 and IPsec2 to the HQ). All traffic is sent through HQ.AD server, DHCP and DNS is running at the HQ and a DHCP relay is set up at each branch. Unfortunately, I do not know how to achieve that the DHCP relay can use both IPsec tunnels (e.g. when the primary line/tunnel fails). I tried all the settings according to the KB: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Configure-DHCP-relay-traffic-to-use-SD-WAN-rules/ta-p/196131 but the only working solution was 100% work that I defined the interface manually (either primary or backup tunnel).If I use the set dhcp-relay-interface-select-method sdwan option, the requests are sent randomly to the SD-WAN interface where the WAN lines are.If I use the set dhcp-relay-interface-select-method auto option, requests are sent randomly to all SD-WAN interfaces, resulting in sometimes it works and sometimes it doesn't. 

i am trying to change the certificate for my admin gui page following all the KBs in fortigate ( example : https://community.fortinet.com/t5/FortiGate/Technical-Tip-GUI-Untrusted-HTTPS-server-certificate/ta-p/224780 ) but i do not have HTTPS Server Certificate in the settings pageam i missing something? logging with the local adminPlease advise 

Hi Everyone.  I'm trying to block all our users from being able to add a personal E-mail account(webmail, Gmail etc) on the outlook client but i'm not sure if i can block this from the firewall.       

SSL certs are used for SSLVPN connections, deep packet inspections, and user authentication. I'm researching the various cert vendors, such as Comodo, DigiCert, Sectigo, etc. Which type of cert is best for each use case, OV, DV, or EV? Are there better options out there? Thank you for your time.

 Good day ladies and gents, Got a bit of a weird one here, I’m helping a Networks buddy to resolve an issue on a FortiWifi 30E and was hoping the community can give me some help.About a month ago we started experiencing insanely slow internet speed, we did the normal troubleshooting and saw that when pinging the firewall on the internal IP we started getting random packet drops. We checked the Switch and LAN cable, no issue, all other local pings are just fine with 0 packet drops.We backed up the unit and reset it too factory setting, but still exactly the same thing, any ideas on what it can be ? 

HELP, I have a FORTNET FG-80F, I've heard that if I use the SFP ports I disable the RJ45 ports, is that true? Can someone help?

Hi all I can't figure how to change data source ID column in log view to display actual hostname of firewall rather than its serial number. any help would be appreciated

Hello Experts, I want to create a phishing mail playbook. is there any out-of-box playbook OR how can I proceed with that playbook?

Hello Dears I want to configure static route for the same network with two different interlaces (both of them are IPsec tunnel interface) as below :Tunnel-1 is the main (Admin dstainse =10 and priority 1)Tunnel-2 is the main (Admin dstainse =20 and priority 2) the network want to reach is 192.168.1.0/24 Bests

Some time ago I had fedora 37 installed on my computer, and I use to access some services of my work, the forticlient VPN application, I never had problems with the application, but when this latest version of fedora 38 was released, it never reconnected, the settings are well configured, but when pressing the "connect" button, It connects for a couple of seconds and disconnects. Could anyone help me?

I Need to create VPN tunnel with below mention parameters from (Site A to Site B) Site A is fully configured need to configured (Site B) on fortinet firewall.                                                   SITE A                      SITE BTermination Equipment (type, OS version, etc…)Cisco Ike VersionIke Version 2 Encryption AlgorithmAES-256 Integrity (hash) algorithmSHA-256 Peer Authentication Method IKE Key exchange parameters (Diffie-Hellman group identifier)DH-Group 14 IKE-established security association’s lifetime (Phase-1)1800 (Sec) IP address of IPSEC peer192.168.7.3192.168.247.122Local IP Addess(s) Source/Natted/Tunnel IP address will be  10.12.157.98 /32 (Route Base VPN)DPD (Dead Peer Detection)20s Phase II  Encryption Algorit

Dear Fortinet Community. I have a question regarding the "hardening" of SSL VPN connections. I would like to increase the security by increasing the minimum TLS protocol version. Last week I have tried this via CLI. Just to let you know. After the change I could not login to SSL VPN anymore. But I could switch back to the old configuration and then it worked again. What did I do? I have used this command on cli:config vpn ssl settingset ssl-min-proto-ver tls1-2end After the change via cli my config looked different. The line that shows the minimum protocol version just disapeard. When using the Fortinet VPN Client it stopped the connection at 40%. Did I do something wrong? Have I missed something? Probably some of you have done this in your environment and can explain me what to do in order to use a higher TLS version. FYI: we use tunnel-mode. Fortigate is on newest version 7.2.4. I can confirm that TLS 1.3 should be possible. These are our vpn ssl setting

Hi!Recently, we bought a FortiGate 40F after we had a 30E in use for some years. Since some time, it seems that the unit sends around 300GB of logs to the FortiGate Cloud, which seems way too much in my point of view: For reference, the Log Settings are: What makes me wonder is that for all the policies under "Policy & Objects - Firewall Policy", it is shown that "All" gets logged: However, I never configured it like this and when I open the details of a specific policy, I don't see that log "All" is configured. See as an example the details for policy "ENTRY-NET Outgoing Traffic": So I'm not logging "All" allowed traffic but only if it triggers security events. Furthermore, no matter what I set here, the "All" in the list of policies changes. So even if I DISABLE "Log Allowed Traffic" here, the list of policies still shows "all" in column "Log" for the policy "ENTRY-NET Outgoing Traffic". Remark: I have the feeling that this "All"-logging st

Hello everyone, We have started enrolling into PING ID authentication in my company and we are having trouble setting up the MFA wait time on the Fortigate VPN (The time it sits on 45%). Is there any way to set the time for third party authenticators on the fortigate CLI (or GUI but i was not able to find those settings anywhere on the GUI) or are those settings on the RADIUS side of the authentication. Currently i was able to somehow set the time from 5 to about 40 seconds even though every parameter i put into the CLI was 60+ seconds.Thanks in advance for any help.

Hi, I am trying to setup L2TP/IPsec with RADIUS authentication.I could connect to the server by using Windows native VPN client.However, "Framed-IP-Address" defined in RADIUS was not assigned to the client,the first usable IP address (10.10.10.2) between l2tp's "sip" and "eip" was assigned instead. It seems possible with SSL-VPN, but not possible in L2TP/IPsec (using Windows native VPN client)? Here is the relevant configuration.config vpn ipsec phase1-interface edit "L2tpoIPsec" set type dynamic set interface "wan" set peertype any set net-device disable set proposal aes256-sha1 aes256-sha256 set comments "VPN: L2tpoIPsec (Created by VPN wizard)" set dhgrp 2 14 set wizard-type dialup-windows set psksecret "...." next end config vpn ipsec phase2-interface edit "L2tpoIPsec" set phase1name "L2tpoIPsec" set proposal aes256-md5 3des-sha1 aes192-sha1 set pfs disable

Dear Fortinet Community. I have a question and cannot really find a solution for it. What a pitty I have only a Fortigate without a integrated harddrive. because of this, at the moment, I have no real logging... The logs just dissapear after some minutes... At the beginning of the week we have turned on AntiVirus Scanning (Flow Based) with SSL Deep Scanning. Works perfectly I need to say :) So now I wanted to create a Trigger and Stitch and so on in order to receive an email if a user is receiving the High Security Alert. I wanted to do that becaause we have no real logs like I said before. And yes I know I could use a syslog Server. But my real question is: Is it possible to create a trigger that informs me if someone wanted to download a virus? With kindest regardsFortiLover :) FortiGate

My fortigate 90D-POE enabled SD Wan setup from different ISP, the problem is Wan1 can map port 80 & 443 to backend server(A)(DMZ-interface),while Wan2 port 80 & 443 cannot be map to backend server(B)(LAN-interface),but if I use 8080 of Wan2, I can successfully map to backend server (B); Can someone help me, if fortigate only allow inbound traffic to Wan1 port 80/443; Wan2 inbound traffic to port 80/443 is not allowed?  I checked both ISP not blocked port 80 & 443 My SD Wan setup:wan1wan2 SD Wan Rules:DMZ(server A) -> Wan1 (server A outbound traffic through Wan1)LAN(server B) -> Wan2 (server B outbound traffic through Wan2) Static Routes:Dest. 0.0.0.0 Gateway 0.0.0.0 Interface SD Wan Firewall Policy allowedSD-WAN ->DMZDMZ -> SD-WANLAN -> SD-WANSD-WAN -> LAN (server B, port 80/443) 

Hi I have 2 remote site router connected using vxlan over ipsec. I can ping, telnet and ssh between the routers. I want to do an ospf adjacency between them but even though they ping, the neighborship won't come up. When I debug ospf I see that ospf is sending hello packets on both routers but they don't receive any. I'm allowing all between the vxlan and vlan in the firewall policy. It's as if multicast traffic is being block.  And I want to know if is possible to get an adjacency between the routers using vxlan over ospf.     

We've attempted to use FQDNs for traffic such as SIP, SFTP, etc., but the rules don't receive any hits. If we include the IPs within the same rules, the traffic starts to flow. Our previous firewall would resolve the FQDNs to IPs for non-web traffic, but the FortiGates don't seem to be behaving this way. I'd like to confirm that FQDNs only work with web traffic, and if it should work with other traffic, are there any tricks to the configuration? Thanks

Using ansible galaxy fortinet.fortios when creating a vip I am trying to set the ldb_method. The only option that ever gets set is static. type: server-load-balancerserver-type: ipldb_method: round-robinif I specify an option that is not available I get an appropriate error.

I have FortiGate firewall in HA mode. I need to enable private data encryption on both the firewalls and for that I will need to break the HA and proceed further.How can I take the GUI access of the firewall incase of unable to take the console access.1) If I want to access the secondary firewall, can I access it directly with the console cable or do I have to remove the HA cable first and then take the console access.2) Any other ways to take the console access of secondary firewall other than reserve management IP process?Also let me know when to remove the HA cable to take the secondary firewall access