Solved

I am having a hard time figuring out how exactly a decision is taken when multiple UTM profiles and multiple rules are in play. But let's have a simple example: I have a HTTP request that goes into category "Information Technology".However it is being allowed by the rule with the following security profile: Webfilter* "Content Servers" -> Allow* All the others (including "Information Technology") -> Monitor 1) What is the actual meaning of "Monitor" anyway? 2) If a rule contains multiple security profiles, where do I see exactly which one was matched, if the rule matched? Is there some detailed documentation on this? ThanksMarki

Hi, I keep receiving emails with this warning (about 300 a day).I checked but there is nothing out of the ordinary.Do you have experience on how to fix?The message satisfies the warning conditionVirus/worm detected: ; Protocol: IMAPS; E-mail address from: ************** ; E-mail address to: ************** t ; VIRUS REFERRAL URL:date=28-12-2022 time=09:55:53 devname=FG ************** devid=FGT *************** eventtime = 1672217753527378557 tz="+0100" logid="0203008200" type="utm" subtype="virus" eventtype="filetype-executable" level="warning" vd="root" policyid=17 poluuid="b6a200f8-826b- 51eb -3027-b96cfdbc33ef" policytype="policy" msg="The file is an executable." action="blocked" service="IMAPS" sessionsid=7101423 srcip=192.168.0.107 dstip=62.149.152.153 srcport=54463 dstport=993 srccountry="Reserved" dstcountry="Italy" srcintf="internal" srcintfrole="lan" dstintf ="wan1" dstintfrole="wan" srcuuid="dd5ff6ee-7d26-51ec-caf0-bb8630bb31c9"************* " a=" *********** ** @ *************

I have 2 internet connections configured in my Fortigate. One is WAN and the other is LAN via a 4G router. I have configured them as port 10 and port 9, and they both function fine. Now, I would like traffic to a specific website to use the 4G router (port 9) instead of the primary port 10. I've read that in order to do this, I need to have 2 static routes and then create a policy route. I've done that, but traffic is still going through port 10. I think it has something to do with my static route for port 9. I can't figure out the gateway address. It doesn't show in the 4G router either. For port 10, I selected "Automatic gateway retrieval" and because it is a PPPoE, the Gateway can be automatically found. But for port 9 since it's a 4G router and connected via a LAN cable, the gateway is still 0.0.0.0. I think that this is the cause. Any idea how else I can get the traffic to use port 9? I'm not looking for load balancing or failover. Just want a specific website to use the

Hi everyone,I would like to know what is the best way to limit a user access within wifi network.I want to create a user that can only reach Internet and some PCs. This user will be used for screen casting. I already have a public network but the PC used for screen casting are not reachable from this network.  Thanks for your help.

I would like to monitor the available DHCP addresses on each of the VLAN's my fortigate 60F is used as a DHCP server. We are using paessler PRTG, so monitoring by SNMP would be fine.  For a microsoft DHCP server, I could use Monitoring Windows DHCP With PRTG (paessler.com)I'm not sure if the OID's used are standard (as with system uptime), and I'm no SNMP super expert (I can use it), but it would me a great new feature te be able to monitor the available adresses, and offload al history, monitoring, alerting to (in my case) PRTG. At the moment (7.0.9) I can't monitor DHCP-available adresses from my fortinet (I can monitor uptime, SNMP is working), while I can monitor available DHCP adresses from my microsoft DHCP.  I expect this OID is just not implemented in FortiOS.  Am I right? Would this be a great feature? Could it be done in another way?

HelloI'm trying to install a previous version on my Mac, from what I've read I need FortClient version 6.2.1, but I can't find the installer anywhere. I have read something about EMS but I can't find that. Please help, I need it for work.

Hi, the feature 'config user device' is removes in the last version 7.. Have you an solution to filter sourceIP and MACDevice in one rules ? I have try SourceIP and DeviceMAC object, but this one allow all source network... Best regards 

Hello  I have do many test for deploy my FortiClient with SCCM, and now I can't upgrade my FortiClient for an old or new version, I obtain the error message in the picture ! And it's impossible to see this one to the control panel ... Have you any solution for fix the problem ? or maybe a cleaner tool ? Many thanks for your help.

Dear Team, I am facing a strange issue with my IPSec tunnel interface.When i am trying to add that tunnel in bandwidth monitor it shows that maximum interface bandwidth reached.But when i see the widget it shows that the bandwidth monitor for this interface is disabled.I have tried enabling bandwidth monitor for that VPN interface, when i do so it shows maximum interface bandwidth reached. Please assist me in this.Thanks Shailesh 

So far I am able to retrieve a new API token via the GUI and by using the CLI methods. Would like however to retrieve a new API token via the POST method. Read the documentation from the link below and followed by using a POST /api/v2/monitor/system/api-user/generate-key?vdom=root and a body with{'api-user':"api-admin"} https://fndn.fortinet.net/index.php?/fortiapi/1-fortios/100/  This for only returns a 401 unauthorized. How then can proper authorization be included? Appreciate it 

Hello everyone, I am currently trying to change a webfilter profile on a FortiGate via the FortiManager so it allows access to alcohol and tobacco websites.Adjusting the settings works without any problems. Once I install the device settings / policy package on the FortiGate, using the install wizard, however, it just resets the webfilter profile and sets the categories alcohol and tobacco to "block" instead of "monitor" again. What can be the cause of this? Is there any other way to do this? FortiManager v7.0.5 GA build0365FortiGate 7.0.7 GA build0367 Thanks!

Hi, I have a two-tier MCLAG-topology with 2x1048E switches in tier 1 and several MCLAG Peer Groups in tier 2. The switches are managed by Fortigates in HA-setup. Now I want to connect multi-homed servers to the tier1-switches and I have created trunk interfaces with MCLAG and active-active LACP via the switch-controller on the Fortigate.  The member ports are defined with 1 port from each switch in the MCLAG. What is the recommended way to assign VLANs to the trunk-interface? Should I assign the VLANs via the Trunk-tab or directly to the member-ports in the Interface-tab? With both methods work?

HiI have a cisco switch with trunk port connected to a fortswitch in stand alone mode, i am not able to pass the traffic between them, i have this config EXAMPLE:CISCOinter gi0/1/1switchport mode trunkswitchport trunk allowed vlan 50,10,100 #fortiswitch in standaloneconfig switch interfaceedit port4set allowed-vlan 50, 10, 100nextedit port5 set native vlan 50  (acces port)nextend i connected a PC to port 5 and i am not able to do ping to gateway.  Some have configured something like that ?? can you share a KBFortiSwitch 

I have a fortimail cloud integrated with o365 through a API, so i have realtime policy applied, but in the log tab i just see log for email traffic IN; I would like to know how can i enable the log to see traffic OUT.  Is it possible ???  FortiMail#FORTIMAILCLOUD 

I try to reset my lost admin password login with maintain user. but I can't reset it. it getting some errors. Plz kindly help me to resolve this problem. you can be seen below my error  Running Commnds>>>>>config system admin                                               edit admin                                               'maintainer' account can only edit existing admins.node_check_object fail! for name admin value parse error before 'admin' Command fail. Return code -37

Hello everyone, I have two fortigate units in standalone mode and both have asymmetric routing enabled. I would like to re-design my network in order to not enable asymmetric routing since enabling it is a (very) bad security practice.  So, here is the diagram of the network. The fortigates are not in cluster.  What happens is that L3 switches load balance the traffic that originates behind them in a round-robin fashion using wan link 1 and wan link 2. Traffic may go using wan link 1 and come back using the other wan link. In order to overcome this, we enabled asymmetric routing (long back ago) and its working since then, no issues. Today we want to re-design the network to avoid the use of asymmetric routing since its a bad security practice. I came with several designs, but in every  one of them i have my doubts: 1st design: Active-Pasive cluster, both wan links enter the same fortigate unit so no asym routing enabled. The problem with this is that

Hello, We have a Fortigate 100D in our office and created an IPSEC VPN to our PfSense firewall in the datacenter. The IPSEC is online and the configured local/remote networks can both access each other. The remote network is 172.16.0.0/24 (PfSense) and the local networks are 192.168.10.0/24 and 192.168.100.0/24 (both on Fortigate). When the Fortigate, which has an interface in both local networks (192.168.10.1 and 192.168.100.1), tries to access the remote network 172.16.0.0/24 it fails. The Fortigate uses its disabled DMZ interface (10.10.1.2) to access the network. Is there a way I can force the Fortigate to use the 192.168.10.1 or 192.168.100.1 interface to access the 172.16.0.0/24 network? I have a static route configured, as it won't route otherwise. We are running firmware 6.0.11. Kind regards,Tom

Hi AllWe have our FGT-600Es.  I have a question which I cant find the answer to.  Currently we are using another device for web filtering which is offering us free cloud based web filtering too (at the flick of a switch).  I want to explore ditching that service and using the built in Fortigate Web Filtering.  Setup for local users is fine, however we have several users who will be offsite with company owned devices.  Some of these users will not be using VPN to connect in so; 1 - I want to check if FGT offer a cloud based web filtering setup without the need to connect back to the main unit for rule checks etc, so that users can use their own internet connection to browse to the website (if the site is not blocked) and not use the office bandwidth. Is there anyway to do this?  2 - If this is not an option, is there a an agent/client that can be installed to force them to check the FGT Web filtering and again if allowed, use their own i

I have two installations of Fortigate 60F units for remote access.  One is running 6.4.8 and one on 7.0.5I have IPSEC remote access configurations setup on both and the configs are nearly identical (except for the addressing...same subnetting. Nothing of consequence)On the 6.4.8 unit I can have multiple dial-in instances each getting an address from the assigned pool.On the 7.0.5 unit I can only establish a single connection.  I get an address out of the pool but cannot establish additional sessions.  Both dialer instances are coming from the same office so have the same remote WAN IP.  But that is the same for the working instance.Phase 1 and phase 2 both come up but phase 2 eventually drops.  I do believe this is related to not obtaining a second IP from the pool but cannot figure out why.

I have a "Remote Facility" that has equipment that is to be monitored by two separate operations centers.The remote facility has two distinct private subnets that are not interconnected and need to remain so.I have successfully configured two site-to-site IPSEC VPNs (Fortigate to Fortigate) from one Operations Center and can access hosts on those LANs.I cannot establish a second site to site connection from Operations Center 2.  I can build the dialer from the NATed side and the connector on the Remote Facility side but when selecting the Tunnel status, the second tunnel doesn't even show up so that I can select "bring up".  Attached is a diagram.  I'm sure there are smart people out there who will tell me how I "should" be doing this. Any help appreciated. 

Hi,I have an automation script for FortiProxy v7.07, which backups to FTP and then sends an email.The configuration of the email isBody:  %%log%% - %%results% What i get as an email is only the log and after the actuall word %%results%%I tried to put it %%results%%: as i see on the example but it is not working, only the %% log%% working and i get this:  On Fortinet, the same exact body variables work as normal  Does anyone have any hint on how to get the actual result ? Many thanks-Vassilis

HelloI've got 8 HA firewall pairs that I need to make sure the new IP scheme from Mimecast is updated in the ISDB. Can this be done via the FMG or do I need to go to each FortiGate HA pair? Or does the FMG only point to the FortiGuard servers? Thank you

Hello team. Could you please help me to clarify the FAC licensing of TACACS service? The documentation for VM says that Radius/Tacacs clients are licensed as user licenses/3. I would like to define a single Tacacs client as a subnet /14. Will be consumed just a single license for all network devices which act as Tacacs clients in the /14 subnet (I am fine with just FAC BASE SKU) or do we need a single license for each network device (500 network devices so 1500 users licenses)? Thank you very much.

Hi,We're running a forticlientems (7.01) and have a number of versions of forticlient installed at our company. When we upgrade forticlient to 6.4.6 and 7.01 we get real time protection warnings like these, Found exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFound exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFound exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFound exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFound exploit process C:\Windows\System32\cmd.exe target process 11328 C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe as well as for chrome. This is on managed windows 10 computers and we can't find anything on them that we think shoul

Hello everyone, Fortigate 200EFortiOS: 7.0.9I have two FGCP clusters and FGSP beetwen it. I have some questions:1) Is it possible to use loopback interface and address on it as a peer ip on FGSP? When I use address on loopback interface as a peer ip session syncronization doesn't work, but when I change peer ip and use address on some connected interface  session syncronization begin to work. For loopback I have created firewall policy, but it doesn't help. 2) Are there ways to speed up session sync process? I have 9k session and it's can take for 3-5 minutes.