Solved

I have 200E in my environment running on Forti OS version 7.0.2I also have Forti Analyzer running on 7.0.4.According to https://www.fortiguard.com/psirt/FG-IR-22-377 this KB. Forti OS 7.0.1 to 7.0.6 and 7.2.0-7.2.1 are affected versions.Does this vulnerability also affect Forti Analyzer? Please suggest

Hello,I am dealing with a issue when under "Forward logs" the user column shows out-of-date information about the current user. When looking at the forward log record there is a record showing "userA" but "userA" has not logged into the workstation. Also when looking at the security event then the user has not taken any action with the workstation. On the Fortigate unit there is configured an LDAP connection in order to get AD groups but no external connector for FSSO. Can someone please explain the behaviour behind this action and possible fixes to see up-to-date information about users, in the forward logs. Cheers!    

Fortigate 80F 6.4.10 single domain / 3 subnets / one DC per subnet.We have Security Fabric / External Connectors / AD Connector set up with 3 AD connectors, one for each DC.I see that there are Connector Objects for each AD Connector - we have made the all the same.  So, that's a lot of connector objects it might seem.  We want to have redundancy, thus 3 DCs.  So, it seems consistent for each AD connector to have all the Connector Objects.  Is that good practice?  Or should only one AD Connector be populated with Connector Objects? Also, we have added each and every AD User and we have added an AD Group with all the same users.  This seems appropriate.  Is it?In one AD Connector, we are unable to add those AD Groups - get an error that there are too many.....Thus this question.

I am a volunteer at a local tennis club that has a rather complicated rack system with a fortigate 60e. The system has several VLANS for the security cameras, guest wifi, etc. I have been tasked with switching everything from Verizon fiber to Spectrum fiber. The spectrum fiber has already been installed and I tested it with a laptop by manually entering the ip range, gateway etc and it works. Now I want to plug it into the fortigate 60e and unplug the Verizon.. To make things more complex, there is also a secondary backup ISP from Spectrum cable. That we also want to get rid of. I have experience with home routers but the fortigate 60e settings are rather complex. Is there a paid support we can buy that can walk me through everything I need to change? We tried contacting the original company who set it all up but they said they are too busy. Or should I just post screenshots of what I think I should do and go from there?

Hello Together, i would like to ask if the support for RPM packages has been suspended for the FortiVPN Client. I get an error if i try to download the RPM Client. Is this still possible to get it? Or are there any legacy clients for version 6.4.x ? I have attached the screenshots with the error. Thanks and best regards Egor  

Hi, I'm using DAC SFP+ 10G cables from fs.com, programmed as Fortinet.They are FINISAR modules, considered valid by the FortiGate 501E and FortiSwitch1048E.Both FGT and FSW are running 7.2.2 However, every 3 minutes, sharp, modules are reset 'to recover from error state'.Between reset, data flows correctly. Is there anything to be done to avoid these module reset ? Thanks,IG

I route all Internet traffic through an IPsec tunnel except the connection to the remote tunnel peer. I have been able to get SSL VPN connections, FTM acknowledgements, SNMP, etc. working in this way however since upgrading from 6.0.14 to 6.0.15 I have not been able to get FTM acknowledgements and SNMP working, although the SSL VPN connection itself does, and I cannot identify why. I do not see anything that has changed other than upgrading. I have validated the local traffic is hitting the implicit deny. fg90d $ di de flow filter addr 172.16.0.100 fg90d $ di de flow filter dport 161 fg90d $ di de flow trace start 1000 fg90d $ di de en fg90d $ id=20085 trace_id=103 func=print_pkt_detail line=5529 msg="vd-root received a packet(proto=17, 1.2.3.4:56936->172.16.0.100:161) from Reverse-Proxy. " id=20085 trace_id=103 func=init_ip_session_common line=5693 msg="allocate a new session-00000612" id=20085 trace_id=103 func=vf_ip4_route_input line=1604 msg="find a route

Good morning and thanks in advance.I have deployed a FM with v7.2.1 and two FG HA cluster with v7.0.2I added FG to FM with the Add Device wizard. All devices have been discovered and added, policies and objects sync'd ok with FM. When modifying rules on the FM the modifications are pushed OK to FGs.I also activated Fortianalyzer Features on FM and FG are sending logs OK to FM. Everything seems OK, BUT on both FG clusters, within Security Fabric > Fabric Connectors > FM Connection is shown in Red and "Not Managed" and the notification reads as: Unable to Connect to FM But when checking by CLI all the platforms, the FGFM tunnels are established and up:On FM:ES1FMG01BKT2 # diagnose fgfm session-listES1FW03BKT2_FG (260) sn(******************) ip(192.168.177.124)    <-- FG HA Cluster2state(tunnel) tunnel (169.254.0.2) uptime:Mon Oct 24 00:07:56 2022ES1FW03BKT1_FG (233) sn(******************) ip(192.168.177.140)    <-- FG HA Cluster1state(tunnel) tun

Hello Dears I am trying to block some users to access internet using FSSO policy but it seems not working could anyone advise about that ? Bests

We have problem connecting to FortiAuthenticator (EAP-PEAP) using Active Directory.All setting is done, status connection to AD is joined and we can Syncronization the user from AD.But, when we try to join using Access point using MSCHAP v2, the login success and the certificate can see but after login, the dialog is back to login again. If we tested to login using application 3rd party "ntradping" using the same user and the respons is success / accept Log information is  Remote LDAP user authentication(mschap) with no token failed: invalid password.In the debug the information is :facauth: Remote ldap user 'misniru': NULL password is not allowed When we try to login using user local from FortiAuthenticator is running well. the problem is using Remote user Active Directory. If anybody here have a experience with this issue please help me. For the information, we using Mikrotik and TP-LINK as a Access Point  

Hi @ all,I have an Fortigate 7.2.2 in AWS with two VDOM. On for Management (root) and one for Traffic.The Traffic VDOM has two Interfacesinternal (10.1.1.1)external (10.2.2.2) with an Elastic IP 1.2.3.4Actually I'm trying to reach an Internal Instance via SSH. For this I want to use Port Forwarding on Port 222 on the Elastic IP Interface 1.2.3.4. (VIP 1.2.3.4 -> 10.1.1.100 : TCP 222 -> 22)Else I created an approbiate Firewallrule (any / VIP / 222 / allow)If I try to ssh to 1.2.3.4 then I got the following error: id=65308 trace_id=159 func=print_pkt_detail line=5892 msg="vd-aws-fw:0 received a packet(proto=6, x.x.x.x:52547->10.1.1.100:222) tun_id=0.0.0.0 from port2. flag [S], seq 3936964361, ack 0, win 64240"id=65308 trace_id=159 func=init_ip_session_common line=6073 msg="allocate a new session-000035cb, tun_id=0.0.0.0"id=65308 trace_id=159 func=vf_ip_route_input_common line=2605 msg="find a route: flag=80000000 gw-10.2.2.2 via aws-fw"id=65308 trace_id=159 func=fw_loc

Hi,Switch details as follows:Model: FortiSwitch-108E-POEFirmware version: v7.0.3,build0058Stand alone mode. We have a situation where an admin changed the password and has since left and is not contactable.I have tried pressing <space> during boot (no login prompt came up for me to use the maintainer account as with the Fortigates) and get presented with this menu: [G]: Get firmware image from TFTP server.[F]: Format boot device.[I]: Configuration and Information.[U]: Upgrade BIOS image.[R]: Reboot FortiSwitch.[Q]: Quit menu and continue to boot.[H]: Display this list of options. If I press [I] I get this menu[S]: Set serial port baudrate.[C]: Set DHCP Enabled.[E]: Set restricted mode.[T]: Set menu timeout.[P]: Ping an IP address.[R]: Reset environment to default.[U]: Upgrade component firmware.[I]: Display hardware information.[B]: Display boot information.[Q]: Quit this menu.[H]: Display this list of options Is there a way to change the admin password? 

Hi all,I've installed the last version of Forticlient (7.0.0.0018) on my Ubuntu virtual machine (version 20.04.3) I've setup a SSL VPN, but it's not working, I've receive two errors:[ul][sslvpn:EROR] vpn_connection:706 IO read remote failed: timeout[sslvpn:EROR] vpn_connection:1379 Error: Disconnected because of error: Read packet from tunnel[/ul]With the same credetials and settings I'm able to connect on a Windows machine Anyone have encountered these errors? How can I fix the connection? Thanks in advance,Jack

The "bandwidth-unit" option described in the KB below (also in CLI references) doesn't seem to exist at least on FG60E/60E-POE with 6.4.x while I can see this option on 1000D/1500D we have. Is this limited to some certain models?https://community.fortinet.com/t5/FortiGate/Technical-Tip-Traffic-shaper-and-bandwidth-unit-display/ta-p/195197 6.4.9 on 60E-POE:FortiGate-60E-POE (guarantee-100kbps) # getname : guarantee-100kbpsguaranteed-bandwidth: 100maximum-bandwidth : 1048576priority : highper-policy : enablediffserv : disableoverhead : 0 6.4.9 on 1000D:FGT1KDxxxxxxfg1 (guarantee-100kbps) # getname : guarantee-100kbpsguaranteed-bandwidth: 100maximum-bandwidth : 1048576bandwidth-unit : kbpspriority : highper-policy : enablediffserv : disableoverhead : 0Thanks,  Toshi

Dear all,I've recently imported three FortiGate v7.2.1 on dedicated ADOM on FortiManager v7.2.1.I follow this KB:       Technical Tip: Adding FortiGates to shared Policy ... - Fortinet Community FortiGate 1 is the member I started from to make the policy package.And all works fine, but when I try to deploy new policy there is an error in FortiManager  on FortiGate 2 and 3: FortiGate 2Post vdom failed: error :131 - datasrc invalid. object: user saml.ssl-azure-saml:idp-cert. detail: REMOTE_Cert_3. solution: data not exist FortiGate 3Post vdom failed: error :131 - datasrc invalid. object: user saml.ssl-azure-saml:idp-cert. detail: Remote_Cert_4. solution: data not exist It seems not to exist the Remote Certificate associated on SAML user account, but I see this certificate in FortiGate and in device DB on FortiManager.Unfortunately I noticed that it is not possible to make a dynamic object for this Remote Certificate object. I also noticed

Hi all,My first post here!I am trying to deploy FGT (V7.0.8) on two sites, each FGT with its own dedicated mgmt interface, and have HTTPS access over an IPSEC tunnel, diagram below:From the local site, each admin pc can access the local FGT web interface, the issue starts when the admin at pc A tries to access the FGT-B web interface tunnel and when the admin at pc B tries to access the FGT-A web interface. mgmt interface configuration of each FGT below:FGT-A: config system interface edit "mgmt" set vdom "root" set ip 10.206.250.2 255.255.255.0 set allowaccess ping https ssh fgfm fabric set type physical set dedicated-to management set snmp-index 2 set trust-ip-1 10.21.31.0 255.255.255.0 set trust-ip-2 10.11.32.0 255.255.255.0 next FGT-B: config system interface edit "mgmt" set vdom "root" set ip 10.205.250.2 255.255.255.0 set allowaccess ping https ssh fgfm fabric set type physical set dedicated-to management set snmp-index 2 set trust-ip-1 10.21.31.0 255.255.255.0

We are using a Fortigate 100F with firmware 7.2.2.  Is there a way to reset the hit counts for specific SD-WAN rules?  After some searching in the guides and the forum I found info to reset the hit counts for the policy rules but uptil now no luck in resetting the hit counts for the SD-WAN rules. Can some of the guru's here help me or point me in the right direction?  Thanks in advance

We just started with Fortimail units running in Gateway mode, and we are now migrating all SMTP connections to it. However, I did run into an issue after moving the mail connectivity from Notes app to Fortimail. The application sends an HTML formatted email, but after the move, the content is seen as TXT instead of HTML. In the header of the email, I notice a change of the content type: After the move:Content-type:  text/plainContent-transfer-encoding: quoted-printable Before:Content-type:  multipart/alternativeContent-disposition: inline Is there any setting to resolve this problem?I have nothing special configured in my policies, as the servers are simple SMTP gateway servers for outbound email. I can't find any related settings to this. 

Thank you for your reply.

Hi,If I edit a EMS remote acces profile will clients using this profile recive the updated change? For example if I edit the VPN Tunnel 'On Connect' XML script to add a new drive mapping I would want clients using this profile to detect this. I want to avoid uninstalling the client and re-installing.

I am using Kubuntu 22.04 and it bothers me that fortitray (forticlient icon on system tray) is present event if I did not open forticlient. Is it possible to disable forticlient autostart?

We have setup our Fortigate 80F to connect to our AzureAD. All seems to work fine, but users immediately logout after the credentials are checked. So either if we connect through the webinterface or the FortiClient software, we fill in the credentials of the user.The login is validated and immediately we get 'Microsoft: You've signed out of your account.'Followed by a 'Session ended' screen from the Fortigate. I have followed all steps here: https://learn.microsoft.com/en-us/azure/active-directory/saas-apps/fortigate-ssl-vpn-tutorial#configure-azure-ad-sso But I seem to have missed something. Anyone any idea?

Hi Team, I would work with RestAPI Fortigate and access to documentation.I saw that it was necessary to be sponsored by 2 employees of Fortinet, can you tell me if partners are sufficient or not? what solution can i have? thx 

Good day, I have an IPSEC tunnel created between my head office running a FortiGate FW and my branch running a Sophos FW. The tunnel is connected and I am able to ping devices between the 2 offices over the tunnel. I am however having issues accessing anything over the tunnel, I can browse any device web interfaces over the tunnel as well as access any shares. Any suggestions as to where the issue could be?  Thanks in advance