Solved

To check policy compliance we need to check all users that has not been logon to fortigate VPN for a given period of time. If there are matching users, they should be disabled. However, I could not find and easy way to see this. The most related one is "diagnose user-device-store user disk query" but unfortunately I could not find related documentation to create the correct query on v6.4.8. The next best match is "diagnose user-device-store user disk list". This time logon time is given as a long number which I could not convert to date for comparison.  

Dear All, If the asymroute is enabled, is there any way to filter/list/check somehow the traffics those don't have any sessions (what is the target of the asymroute enable settings) ?I'm trying to find those and drive them in the right path. thank you

Hello,Please help,I can't ping from User A to user B in the same network/segment.The topology :User A -> Access P -> FTG - Access P -> User BUser A : 10.10.4.5User B : 10.10.4.40AP : 10.10.3.0/24I have enable PING in Interface menu.What might be cause the problem ? Please help Thanks  

For external security we have an edge fortigate firewall with sophisticated of policies in place, such as:AV, WAP, ATP, IPS, SpamFilter, Content Filtering, and much more.For internal security we have a lot of layers of defense in place, such as:FortiNAC, sophisticated Windows Domain policies, and L3 switch segmentation.What is the added value of adding an internal firewall into the LAN in my situation?Are there any other threats that cannot be addressed and mitigated by the mentioned solutions ? 

Is it possible to connect a FortiAP directly to a port of a Fortigate where it has several vlans tagged? I have a FortiAP that I have to connect directly to a 40F and I have several vlans for the different SSIDs. For this type of architecture do I have to use a hardware switch or a software switch?

Hi,This might be better in a Windows group but I'll try here anyway. We're currently piloting FortiClient (EMS managed) which for the most part is going well.Split tunnel with RFC1918 destinations down the tunnel (configured simply by firewall policy) and all else direct Internet.However, some users are noticing a route to a 10.x.x.x/24 subnet that comes and goes and messes up reachability to internal resources while that specific route is in the Windows routing table.I'm 99.9% sure that it nothing to do with the config on the FortiGate/FortiClient/EMS. I think it's some group policy or InTune config or local application that is installing the route but I don't know how to prove this.I guess I need a Windows log that records a route add event and hopefully tells you what application or process triggered it.Anyone know how I can do this?Many thank in advance!

Hello!I have a Fortigate 500e that was working well until last week with two FSSO Agents installed on Windows AD Server.They just stopped to work and I observed that the FSSO Agent Status is like "not connected" when I look this on Fortigate Single Sin-on configurations.I didn't changed any configurations in this equipments and I use the FSSO Agent in version 5.0.0250. Is there anyone here who faced similar issues?Does anyone have any troubleshotting tips about this to share?Thanks!

I can't easily find this part of FGT-Managed FSW operation in the guid books or somewhere else. So I decided to post this. I was trying to figure out how to duplicate Cisco CBS switch's default QoS behaviors with FSWs and looked like I messed up config probably because I was touching both FGT and FSW config via console. So I decided to start over from scratch. Then encountered some difficulty because a simple Factory reset of those managed switches via GUI doesn't erase whatever configured under "config switch-controller". Especially under "config switch-controller managed-switch". Even when I "Delete" each FSW at WiFi&Switch Controller->Managed FortiSwitches in GUI, the config under "config switch-controller managed-switch" stays there. And maybe because of that, I don't seem to be able to re-register/re-authorize the FSWs. In this situation, do I have to go in CLI and delete all of them one by one (or just "purge")?Or, is there a simple button to erase all FSW relate

Hello everyone In Local in policy in my FG, UDP ports 500 and 4500 are active by default. I do not use IPsec and would like to disable these ports. How can I do this in CLI?

Dear All,  I would like to make different ips security policies for different services (accepted by the appropriate firewall policies), however I have a confusion with signature categories. First I thought that for the https web services it is enough to make an ips sensor that includes the https from the protocol entries when editing the signatures filter, but I found something strange.Before when I used an ips policy including every signatures I found a line in my fortianalyzer, that shows "action:dropped, service:HTTPS, attack name: Bladabindi.Botnet". Then I checked this attack name in fortigate ips signatures and in the protocol section it only shows TCP, but not HTTPS. I think this means if I only add the HTTPS protocols to my custom ips filter, this attack is not checked.My question how should I make custom ips sensors for different protocols (an ips for http, an other to all email protocols) in order to not leave out any relevant signatures? thank youchr

I want to access our backup software on port https 8015. I created virtual ip with source ip/port and dest ip/port. Created services with custom port 8015. Created policy to allow traffic on port 8015. But so far I am not able to access interface over internet. I also checked the logs and don't see any request hitting firewall. I created RDP access rule which is working fine. 

HI, May i know does it support OSPF over SDWAN IPSEC - Spoke (with two tunnel IP) to Non SDWAN - Hub (with one single IP and aggregate-member enable) . I notice the once of the ospf interface is process stuck in INIT state. it's like no way for  Remote FGT (Non SDWAN) connect Local FGT (Spoke) tunnel 2 IP.Diagram like below Local FGT (Spoke)<------> Remote FGT (Non SDWAN)Tunnel1 -------Aggregate1 port1Tunnel2 -------Aggregate1 port2 Local FGT tunnel 1 and 2 using different IPAggregate1 port1 and port 2 share single same IP Due to SDWAN migration phase timing separately deploy for 2 site, so need  any workaround or idea can be solve scenario above Please help if there is good idea. Thanks 

Hello Community. I would like to ask for your help with a Fortigate 200F (HA- A/A), with FortiOS 7.0.9.I have an IPsec VPN with a customer, who has a Fortigate 400E on the same Firmware version. Through this IPsec VPN I am extending a vlan via VXLAN (10.100.0.0/23) (Vlan ID 1). The communication between the sites is correct for the computers that are not inside the Domain. This is evidenced, when entering the Domain (It is in Site B- Fortigate 400E), a computer that is in site A (Fortigate 200F). Windows authentication takes at least 30-45 minutes, they never update the GPOs and the client machine performance is super slow. When I remove the client machine from the domain, the machine starts to perform optimally. My suspicion is, that the fortigate has problems handling traffic from Kerberos, LDAP, NetBios, Etc. over VXLAN.These are my VPN over VXLAN configurations:config vpn ipsec phase1-interfaceedit "VPN_SiteB"set interface "port14"set peertype anyset net-device disableset prop

Hi all, we have Security fabric containing 1 root fortigate and 6 downstream Fortigates and i am trying to create an automation stitch on the root Fortigate for automatic ftp backups. The problem is that after i configure CLI script , i get backup only from the root Fortigate even though the action is synchronized with other FGTs.Furthermore i can see other Fortigates CPU is almost hiting the 100% and there are many traffic logs toward the FTP server ( so obviously they are sending or trying to send). The FTP server is reachable from every of them.And also is there a way to put some variable ( for example HOSTNAME%% ) to create unique file names for every Fortigate. The syntax i am using is: execute backup full-config ftp FTP-Folder/ <my FTP IP address>:21 <my username> <my password>

Hello,  I got interested by Forti Fabric but I see that there is not a lot of data for the communication that Forti fabric uses. I know that the device discovery is based on LLDP (https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/224074/leveraging-lldp-to-simplify-security-fabric-negotiation ) but after that there is not a lot of info if the communication is encrypted by SSL/TLS or like SSH. I found the below article but it is only that the log transmission to fortianalyzer can be encrypted but I know fortianalyzer is a crucial part for Security Fabric.  https://help.fortinet.com/fortiproxy/11/Content/Admin%20Guides/FPX-AdminGuide/300_System/306_Security-Fabric-settings.htm  Also it is interesting when doing an automation on the fabric is the REST API used or the forti fabric protocol as for example I see that automation Stitches are only configured under the security fabric and from what I read an automation Stitch can invo

Hello, I'm looking for a FortiSwitch image to run in a lab environment as to prepare for the NSE8 Lab exam especially that the exam is using vSwitch. However, I'm not able to locate any image for the switch that can work in VMWare Workstation or EVE-NG.If anyone has been in similar situation, it would be great to hear how it was resolved.

So I am seeing lots of scanning and trials to connect from different countries across the globe. All has been denied by the explicit deny policy "0" on the Fortigate. however, after few searches I was recommended to create External IP threat feed and add it a deny rule to ban these IPs.  So, I am seeing the same behavior but instead of being blocked by Policy"0" it is being blocked by the new deny policy. so I don't understand what the point is of doing that instead of letting the explicit deny policy "0" handle it. Your feedback is appreciated. 

Hi all, I logged onto our Fortianalyzer a couple of days ago as i wanted to see how much data was uploaded to a certain IP and then certain country at a specific time which i managed to find but i cannot now find that same option ? This is a screenshot of the "headings" that were on this report option Anyone recognise this and where i can find it ? I've been through every option and menu so i've obviously missed it somewhere :)

Hi all  I have a hub location that got about 9 BGP peers and also I had a route map on each peer to control certain routes, but I got this new problem and still thinking of a workaround on how to do it. I am trying to advertise some specific static routes to a specific BGP neighbor let's say BGP neighbor 3 I was thinking if I am going to use the network command then I need to modify the rest of 8 route maps to deny these routes, if I am going to redistribute static route I will do the same. So is there any way to advertise specific routes to a specific BGP peer without modifying the whole other BGP peers route maps? Thanks 

Hi all, i want to setup my fg100f as fiwerall for 2 vlans.This 2 vlans are conencted via one LACP port. Vlan 7 and Vlan 8. Each are the same networks, but we want to have vlan 7 as untrusted and vlan 8 as trusted vlan.Something like 2L switch between Vlan 7 and 8 icluding firewall rules.We dont want to use L3 routing becouse there are several other subnets int his vlan. Private and public too. Is there any way to do it?Tnak youBRDave

Trying to find the correct firmware for the FortiGate 30E 3G4G GBL device and have exhausted efforts in looking through the firmware repositories. Anyone out there have any information?

Dears, Good day,  Actually, I am looking for a resource "How TO" integrate FortiSandBox and FortiClient EMS  can anyone help mention a resource talking about use cases of this type of integration Thanks in advanceFortiSandbox 

Hi all, I can find instructions to block certain IP's but is there a way to ONLY allow traffic in from any location in the UK, i.e so anything (and i mean anything) outside of the UK is blocked by default ?ThanksIan

 Hi All, FortiGate600E (HA) and FortiAnalyzer200F are connected.The FG has a 2 VDOM. (I don't use "root".)VDOM1 is the main network and is also used for management.VDOM2 has a separate network.Both are connected to the Internet by separate lines. FA is on the VDOM1 side and is logged by VDOM1.I want to get this with FA for VDOM2 logs as well.However, VDOM2 cannot access VDOM1's network. What solutions are possible?  - The way I come up with it.1. Set up connection to FA with Global, not VDOM1.2. Enable "set use-management-vdom" in "config log fortianalyzer override-setting" in VDOM2(This also sends the VDOM2 logs to the FA via the VDOM1 interface, am I correct?)3. Enable communication from VDOM2 to VDOM1 using VDOM link - Proposals claimed by others.4. Physically wire and connect from Switches connected to VDOM2 to FA(In this case, the second port of FA needs to be connected)Plan 3 has been confirmed to be doable.I think plan 2 is a reasonable one.How

Can we find who user which consume high bandwidth on fortinet?