Solved

Hi all I am trying to use the API to create users and assign them to a specific usergroup.   I can use the POST to /api/v1/localusers/ to create a user with a relevant JSON as body. This seems to work just fine. I am a bit annoyed that I can't just add the user_groups to that request, but so be it.   Then I can find all usergroups usign this GET: /api/v1/usergroups/ - This will return all the usergroups along with their "resource_uri". This works fine.   Now, how do I add a user to the group? I don't want to use the PATCH to the /api/v1/usergroups because that would require me to include ALL the users in the PATCH-call. I just need to add a user. So I thought the best way was to use the POST to the /api/v1/localgroup-memberships/ - but it fails for me. If I provide this JSON: {"group": "/api/v1/usergroups/2/","user": "/api/v1/localusers/25/"} I get an error back: "Cannot add facgroup-user relationship "FacGroup_users object (None)" (Response: HTTP 400), Er

Hello I am trying to determine if a customer of mine has been infected by the latest vulnerability. How do you access the Linux file system to check if the files are present? Thank you

Hello everyone,  I have two different FortiGates I recently installed on my work network. Fortigate 200E Fortigate 81EThey are both on FortiOS 6.4.8 I am having an issue with one of them (the 81E) not fully populating the users/group. Are there limitations on the selected groups the Fortigate 81E can choose simultaneously? And if there is, what is the best way to specify a group. See the screenshots attached.  They are both connected to the same FSSO agent on a windows device.  Thanks in advance for your help.   

Hello, I am just creating a security fabric out of our three firewall systems - FG501E HA-Cluster (site1, fabric root, 7.0.9)- FG60E (site2, fabric member, 7.0.9)- FG61F (site3, fabric member, 7.2.3) Both the 60E and 61F are connected via site-to-site VPN created by the integrated wizard.I configured the tunnel interfaces, gave them IP addresses and created the required static routes.The 60E is joining the fabric without any issues, the 61F does not. All the traffic to the root fabric is blocked: Maybe you do have any idea or hint what I may be missing out here. I already chatted with the Forti Support to verify that the newer firmware is no problem joining the cluster as it is supported. Thank you in advance and kind regards Marius

Hi, i am using a Fortinet 60F for managing IPsec-Connections between machines outsiede the company and the central.If the tunnel is established, all traffic goes through the tunnel. The drawback is, that SSH and ping to the components goes through this tunnel, too. Components without an IPsec tunnel (e.g. a central machine) cannot access these components via ping ans SSH. How can I configure the 60F, so that alle the traffic goes through the VPN tunnel, except SSH und ICMP packets?

Hi I have a problem with dedicated management port setup with my Fortinet 201E running version 7.2.2Please can someone take a look at my problem when I am trying to setup a dedicated management port. I have an Active/ Passive setup and I would like to configure a different IP Address on each box. I would like to see on the Monitoring tool that both devices are up and not just the cluster, and also to be able to login to both Active/ Passive device.I was configuring the dedicated management port and I keep getting the error in the screen shots that I have provided.https://community.fortinet.com/t5/FortiGate/Technical-Note-How-to-dedicate-an-interface-to-management/ta-p/189625The setup is as follows;Root - is not the management VDOM, the was changed to have FIREWALL-1 context as the management VDOM.Everything is working well with the setup, except I have a reference attached to the management port, a “Sniffer” object type, I have provided screen shots,When I follow the link that I just p

Hi CommunityI'm in need for some design guides and ideas.I have a few Fortigates in different Offices. All of them have an internet connection and sometimes a backup line.All locations have a vpn tunnel to the HQ and a static 10.0.0.0/16 route which points to the vpn-interface.The HQ is doing the routing and spreads the /24 or /23 toward the branch offices vpn tunnel interface(s). So far everything is working but it's not looking niceMy Idea is to use OSPF or BGP between those locations, but i'm unsure how to set it upGeneraly I would put all those FGT into area 0. If we have a "sub-network" attached in a branch, that would get an other area.But since we don't have all those FTG in the same subnet and don't have a full-mesh...The current plan is to use HQ as area 0 and put each branch into a different area.The ipsec tunnel interfaces between HQ and branches get their own /30 subnet.HQ will announce the /16 network towards a branch and the branch announces the local /24 or /23 towa

Hi Firewall Gurus,               I'm looking for best practice for the phase 2 selector subnets in a general case. I understand in some case it requires to use 0.0.0.0/0. I'm talking about in decent network segmentation internal network that connects to outside. Is it better to have broader range of subnet or as specific as possible. For example, if I have a /16 subnets, but I only need to allow one or two /32 IP addresses from the other side of VPN tunnel. Do I create two /32 selectors or one /16? Thank you.  

Hello, i have 3 sites with fortigates (+APs, + SWs), all are connected directly to the internet. is it possible to put the im one security fabric and does it make sense to do that? In the documentation and cookbooks i can only find examples with fortigates which are on the same site. thank you in advanceFeho 

Hi, I have an active/active cluster of 2 x 3200D's. There are 2 ports dedicated to HA communication, port47 and port48. In order to see these HA port's physical and virtual MAC addresses, I do this: FGT-3200D (root) # diagnose sys ha mac[... other interfaces which have VLAN(s) attached for user data ...]prio=0, phy_index=46, itf_name=port47, mac=e8.1c.ba.x.x.x, vmac=00.09.0f.09.00.2e, linkfail=0prio=0, phy_index=47, itf_name=port48, mac=e8.1c.ba.x.x.x, vmac=00.09.0f.09.00.2f, linkfail=0[... other interfaces which have VLAN(s) attached for user data ...]Unlike the interfaces for user data, where I can see the HA VMAC on the L2 infrastructure of the network, I cannot see the HA specific VMACs (00.09.0f.09.00.2e and 00.09.0f.09.00.2f above) on the L2 infrastructure. The cables from ports47 and 48 do go into switches and are not directly connected. And I do see the physical HA MAC addresses on the switches!Can someone explain why I cannot see the VMACs of the HA interfa

Hi Guys Starting two weeks ego my FGT200E web UI stopped responding, giving ERR_CONNECTION_REFUSED nosing and  diagnosing, it appears that the HTTPS  daemon is not running did some top commands and #dia sys process pidof httpsdgives no answer, nor the top shows any httpsd daemon runs on the system I also restarted the box two days  ego, and still no HTTPS access  i run the FortiGate-200E v6.4.10,build2000,220824 (GA.M)   What would be the next step Appriciate   

Hi all A new behavior came up during a penetration testing that all published application (publishing is on a Cisco ASA) replies on the tcp ports 2000 and 5060. During the investigation we figured out that not the ASA replies on them, that this is the Fortigate firewall which is sitting in front of the ASA to route the traffic between two connected Internet providers. As we don't need these ports and we don't need SIP inspection and proxy function (in our case this vDOM on our Fortigate is "only" a router and has no policies in place), our approach is to disable this behavior. All filtering/inspection should apply on the ASA firewall which is on the LAN side of the Fortigate. Based on the article https://kb.fortinet.com/kb/documentLink.do?externalID=FD36152 we found that this behavior is a normal function of the Fortigate. The only option here would be to move the ports away from the standard ports to a higher port, but not to disable this function. Means the publis

I have noticed when calling into certain automated phone systems, the FortiFone/FortiVoice is either not sending the complete tone or the other end is not receiving it or interpreting it as some of the phone systems are not responding to the button presses. I dialed my cell phone from my FF and pressed each of the number keys and I hear a truncated tone through my cell phone, the packet capture shows the tone being sent through the FV. FortiFone 480 is using v3.0.16 build 265 connected to a FV-100E running 6.4.4 build 414. It does work with most systems, but I have encountered a couple where it consistently does not work, where my cell phone does work, and even some where my cell phone does not work and the FF does work. Does anyone have any thoughts on what could be causing these issues? Thank you.

Hello, I would like to restrict access to certain users which are assigned a custom profile, access to the configuration of all Traffic Shaper / Traffic Shaping Policy / Profile options/config and was wondering if it can be achieved somehow.The restrictions would need to be for both CLI / GUI and what I've tried is :- put System > Configuration to Read on the profile, but that would only disable Feature Visibility from the GUI for them, but they would still work from CLI- put Firewall > Others to Read, this would achieve want I want but would disable access to IP Pools / Protocol options.Any help would be appreciated. L.E. Running FortiOS 6.4.10

I know enough about FortiAuthenticator to be dangerous, so forgive me if I come across ignorant on the product. I currently have mine setup where I have a SAML connection to Azure where I can pull user and group information; however, the only login event I have been able to accomplish from my non-domain joined devices (which for me is about 90% of my devices as we are 1:1 Apple) is via Syslog from my 3rd party internal web filter appliance for Apple devices. I have a web filter agent providing login info to my filter where it matches it against AD users so that they can be put into the correct groups. Domain joined devices are handled via web filter agent on the AD server for those login events. So in a nutshell, I am able to filter all of that down to my FortiGates into FSSO groups for varied policies to match up against. So my first question is, why doesn't Fortinet have a simple multi-OS agent that would provide that info directly to the FortiAuthenticator? In my situation, I a

I'm having an issue with setting up OSPF over IPSEC tunnel.  1. IPSEC tunnel is up.2. Tunnel is up.  I can ping remote tunnel IP.3. OSPF interface doesn't show the tunnel interface when I ran "get router info ospf interface".  It's not on the list.   Any suggestions?

I've created a custom report to show user bandwidth by date but it always returns 'No matching log data for this report'I created the data set and when I run it I see the expected results.I then created the chart and if I test for real data I see the expected results. Finally I added my chart to a report and run it without any device filtering.  No data, I've tried:For past 1,2 7 and 30 days.Any help is appreciated:This is my query (based on Log Type - Event):selectmyUser,myDate--,min(s_time) as s_time--,max(e_time) as e_time,(case when min(s_time)=max(e_time) then max(max_traffic_in)+max(max_traffic_out)else max(max_traffic_in)-min(min_traffic_in)+max(max_traffic_out)-min(min_traffic_out) end) as bandwidth,(case when min(s_time)=max(e_time) then max(max_traffic_in)else max(max_traffic_in)-min(min_traffic_in) end) as traffic_in,(case when min(s_time)=max(e_time) then max(max_traffic_out)else max(max_traffic_out)-min(min_traffic_out) end) as traffic_outfrom ###(selectcoalesce(

2016-10-04T14:00:20.092804+02:00 date=2016-10-04 time=14: 00:13 devname=FG800C3913801910 devid=FG800C3913801910 logid=0100037903 type=event subtype=system level=information vd="root" msg="The sync status with the master" sync_type=configurations sync_status="in-sync" 2016-10-04T14:00:25.128612+02:00 date=2016-10-04 time=14: 00:19 devname=FG800C3913801910 devid=FG800C3913801910 logid=0100037903 type=event subtype=system level=information vd="root" msg="The sync status with the master" sync_type=configurations sync_status="out-of-sync" I have a lot of logs like the ones above. In fact it seems that master and slave are not in sync. The synchronization status of the two cluster units : FG800C3913801256 (global) # di sys ha cluster-csum ================== FG800C3913801256 ================== is_manage_master()=1, is_root_master()=1 debugzone global: 94 ff 8c be 11 c1 c0 57 4d d7 73 dd c0 f0 46 db vdc: 3e 57 22 61 f0 58 af 18 66 9c b1 c9 ae 30 ac 75 root: 74 1b f9 bd 5c 41 a4 64 4f d

Hello, What is the current status with regards the expiration of Lets Encrypt root certificate? Is there any permanent fix to this problem and where can I find updated documentation on this subject? What is the current recommendation about that issue? Thanks

Hi Guys, I upgrade FortiSOAR to new version 7.3.0 and then connectorFortinet FortiGuard Threat IntelligenceFortinet Web Filter Lookup can't connect to url "productapi.fortinet.com"  and "fortiguard.com" it show as disconnect and invalid url. How to solve it? Thanks 

Hi,I have an issue with fortigate authentication. I have configured successfully ssl vpn for users on my firewall. But today all users cannot use ssl vpn any more. When I login web vpn with my account the system show "Error: Permission denied". I tried to reset password but no luck. My fortigate firmware is 7.0.2. Could you please give me advices 

Hello I am working with Fortinet 201E v7.2 1157Please see diagram in reference to my issue below.So far, I have setup multiple vdoms. Traffic will go through hit the Root VDOM then it should go to VDOM 1.To browse to the Firewall I use VDOM 1 - Port 1 sub interface address.This works fine.At Global Level I have added SNMP settings and I can see traffic hitting the firewall through packet capture, but then I do not know where it is going.SNMP polling fails. My question is; how do I link ROOT VDOM to VDOM 1?I have tried a VDOM - LINK and I created a rule in the rule base of VDOM 1 to SNMP IP, but this failed, no traffic or logs. Do I need a static route on ROOT VDOM context to VDOM 1 context. The setup seems so simple but I am not sure why SNMP cannot talk to VDOM 1 but I can browse to it. Port 1 sub interface is management, I have a HA setup as well, Active-Passive.   I do not use the management port, this is for local access only. All help is apprecia

HiOne question why is the SNMP access on an Interface red/orange. Is thre a deper meaning? I haven't found something about this... Does anyone know this?Thank for.  Patric

Hi All I have the Persistent Agent installed on Windows and I noticed that logs are lost after a host reboot.Logs are saved at %ProgramData%\Bradford Networks\ folder:https://community.fortinet.com/t5/FortiNAC/Troubleshooting-Tip-Windows-Persistent-Agent-logs/ta-p/190324 Is there a configuration to set log retention on Windows? Thank you! FortiNAC 

Hi Why is the port forwarding not working? Any ideas?     Test Port from FortiGate (Port is open on the vm) From another Internet Access (no connection via port forwarding)  Thanks