Solved

Hello all!Hope you all doing great. I have a Fortigate/Fortimanager/Fortianalyzer combo in the organization I work. My FortiManager was alerting some C&C callbacks based on webfilter logs. I do not have the SOC license, but I do have an third party SIEM. I was trying to configure some rules on my SIEM to mimic the C&C callback alerts on my FortiManager. Inspecting my FortiManager default Event Handlers it says that the alerts are generated when the log field tdtype contains the string "infected". The problem is that I cant find the tdtype field anywhere in the logs. Already tried to look at raw logs.The documentation says near to nothing related to this log field: Fortinet Documentation on event handlers I also checked the very log entry that generater the alerts but couldnt find this field. Anyone could give me a hint on this one? Best Regards!

Dear, I would like to use Opendns as a DNS in Fortigate 60F firewall. I am using PPPoE and the dns obtained from the ISP.  I would like to edit and use Opendns. I checked DNS option under the network and it is not been used when I check Ipconfig/all in client system. Kindly help. Thank you

Hi,I have two routers serving a lot of EIGRP neighbors and are neighbors together. I have to use a Fortigate device between two routers and prefer to configure it in NAT mode. Putting the Fortigate in between, the EIGRP neighborship breaks and the dynamic routing protocol fails even if I set any any allow rule between two points. As a matter of fact, somehow it is not possible to use different IP sets at both sides and fire up the routing protocol. So, what are my choices? Do static routing?configure the firewall in transparent mode?do any special config to make the EIGRP protocol work in this way? Any help is appreciated  

Hi,can I use Forti Client 7.0.2 with EMS 7.0.2 when had disabled:"Use SSL certificate for Endpoint Control" because of older FC 6.4.6 still in use.It will no generate any issues?In EMS 7.0.2 Release Notes I see:"If Use SSL certificate for Endpoint Control is enabled on EMS, EMS supports thefollowing Forti Client (Windows) versions:l 7.0.2 If Use SSL certificate for Endpoint Control is disabled on EMS, EMS supports thefollowing Forti Client (Windows) versions:l 7.0.0 and later"so if "7.0.0 and later it means it will work with no problems when accept invalid cert?

 Hello,Fortimail in gateway mode(DMZ)I want to create Fortimail personal quarantine for all users in a domain.Do I need to connect Fortimail to AD LDAP and than configure personal quarantine?I have 1000 domain(exchange) users.Any advice how to do create personal quarantineThank you

I unboxed a new Fortigate 200F. I uplifted the firmware from 6.x to 7.2 b1157I configured a WAN-interface as a VLAN-switch, and made setup: route, rule+nat, DNS and IPs.Internet-access is fine.I have allowed admin-access via icmp and https (custom port), I have defined trusted hosts.I can access the admin-center from the trusted host ok, from an untrusted host its blocked.So far everything looks as usual.In doing some tests I realised that I can't ping the WAN-interface from the outside.Its not working neither from trusted nor untrusted hosts.To my mind it should be pingable for both hostgroups if its enabled on the interface-definition.I checked on a fortigate 100F, same firmware and pretty same config, there the WAN-interface is pingable.Just wondering: is there an obscure option I'm not aware of? The forti was preregistered by the vendor, maybe he introduced an oddity....Any recommendation how to debug this?    

HiI'm trying to get more info about Fortigate performance specification.I already know about concurrent session and threat protection definitions. Also I've found out security features involved in threat protection (IPS + App Control + Malware Protection), all require CPU process but a specific model's ability to handle more concurrent session requires more memory ( RAM ).Here is specification for 900D:Here is specification for 600E: 900D has lower threat protection capability that is predictable because 900D has weaker CPU than 600E.Buy in case of firewall throughput or concurrent session, 900D is better while has almost same amount of RAM. I wonder why there is this much difference in FW throughput and concurrent session values while 900D memory is only 733MB more than 600E. Or maybe I'm wrong and there is other hardware factors for firewall throughput. 

Dear All,  I have set firewall FortiGate 60F  V7.05 from Technical Tip: How to create a VLAN tagged interface (802.1q) on a FortiGate - tagged/untagged traffic in forum There is Lan 1 only...I want to separete differnet port 1 for vlan 1, port 2 for vlan2but it show lan for total... Please advise...ThxLan1want to seprate vlan 

Hi All Is is possible to add user laptop / PC Mac address to control them allow or not to access the LAN device when they are using SSLVPN client connection ? My fortigate ver = 7.0.6, Model = FWF60 

Hi,make sense include in the configuration file a statement like this one:config system global   set reboot-upon-config-restore (enable/disable)end I noted that for particular configuration file (multicast routing) the configuration updating and automatic boot is not enough to restore a good running, and I need to reboot from dashboard the firewall. If I introduce these statement do you believe this double boot (one auto and one manual) can be resolved? 

Hi, I have a FortiGate 80F with FortiAP P433API've already successfully set up a SSID local bridge for the colleagues in the office. Right now I'd like to create a guest SSID with captive portal authentication.I've created the SSID, type tunnel, on a network that's different from lan (192.168.2.0/24) but from now on I'm lost. I've some questions: 1) Where are the menu options to set captive portal pages?2) Assuming that my fortigate il 192.168.1.254, what is the URL to access captive portal?3) I'd like to have a captive portal where the secretary creates users upon request. How do I do that?4) Are there some docs showing me how to proceed? Thanks

Hi everyone, I want to configure my fortigate to send logs to a specific dest e.g /var/log/firewall/x.x.x.xbut i don't see where can i do this is there a way to do this ? thanks

Hi, Is there a possible replacement of the FortiClient VPN with a Fortinet Router? Now we are connecting to a VPN server and every computer in the office is connecting using FortiClient VPN with user and password every time. Is it possible to put a Fortinet Router FG-30 or 40, and this one connects to the server and we can stop using the software client? Thank you!

Hi, I have two switches, SW1 for internal LAN, SW2 for GuestI want to setup management ports for both switches on VLAN 99 (10.10.99.0/24)SW1 is directly connected to FG90E port that has the VLAN 99 configured on, I can reach the management IP of SW1 from the internal LAN (10.10.20.0/24) with no problems ( the needed polices are created to establish the connection)SW2 is directly connected to another separated port on the FG90E with a different subnet (192.168.0.0/24) no VLANs are configured on this switch all ports are in access mode.Now, I want to be able to access the management ip of SW2 which is on subnet (10.10.99.0/24) from the internal lan (10.10.20.0/24) how can I establish this connection? Thank you in advance  

Hi all, hopefully and easy question. When creating an address object on the Fortigate (Policy & Objects/Addresses), what is the purpose of the Interface selection? Does it restrict that address to only being accessible via that interface? thanks

Hi,it is a period that I have some problem with PIM of my  Firewall Fortigate 600D and wish to share this post if someone else has had the same experience.I have a network of seven firewall connected by LAN. All node are PIM dense mode enabled. When I change the configuration to one of these, at beginning, after booting,  some of multicast between the firewall updated and the other firewalls are missing. Everything is ok in term of client join , IGMP , policy etc. What I do to let it to run is simply disable /enable, in the dashboard, the multicast routing. After this all run perfectly. It seems  as the boot is not enough to restore a right situation or   disabling enabling multicast routing probably reset some ethernet ports. In the multicast forwarding mode instead I have never had this problem. Do you know some tricks that can add to the configuration to avoid this problem? Could it be a bag? thanks in advance for your support

I recently started to receive the following errors when I run "diagnose debug config-error-log read" on my FortiGate 60F running 7.2.0.  The only thing we did recently is add a REST API user.  However, even after a factory reset we get these.   ffdb_app_map_process-2000: wrong word 5530ffdb_app_map_process-2000: wrong word 43ffdb_app_map_process-2000: wrong word 4303ffdb_app_map_process-2000: wrong word 194ffdb_app_map_process-2000: wrong word 47ffdb_err_msg_print: ret=-10, Error: open map res file error I've been doing a lot of searching and can't seem to figure it out.  Any ideas what they are and how to resolve it? Thanks in advance!

Hello Fortinet Community, I have a Fortigate 200F with Firmware v7.0.2. How do I edit the email alert settings currently set up with my Fortigate?  I did some searching, but only able to find information on Setting up new email alerts. I also noticed this firmware version doesn't have the GUI for updating Email Alerts.  Was this deprecated on purpose? Any information or help would greatly be appreciated.

Hi everyone We're trying to connect 2 sites with an VPN IPSEC. with the tunnel up and working. we have the next issue: Scenario:Triying to connect 192.168.0.102 --> 10.58.152.10Having the following issue: Anyone can help please?

Hello there, We want to apply IPS signature MS.OWA.Brute.Force (ID 39292) on a Microsoft Outlook Web App 2019 server but according to the documentation it is not supported. Is it known when this signature will get support for Microsoft Outlook Web App 2019 server?

Hello guys! I already implemented a solution with FortiGate and LDAP (via LDAPS) in which it's possible for users to change the password with the SSL VPN Client if it is expired so I hope there is an FortiAuthenticator solution.config user ldap   edit <server_name>   set password-expiry-warning {disable | enable}   set password-renewal {disable | enable}   ...end I'm searching for a solution in which the same is possible but the FortiGate isn't connected to an LDAP server but instead to an FortiAuthenticator via RADIUS (dynamic FortiToken Mobile assigning) which gets the User Information from the LDAP server (via LDAPS). I only found the Self Service Portal which provides this feature but this doesn't meet the customer expectations. Do you have any experience with this? Thank you.

Hello Team, Is that possible to include a link aggregate interface as a member of hardware switch? I did this test with the Fortigate VM, but using the software switch instead, and I can insert the aggregate interface into it. My scenario is this: We'll need to implement two switches (from other vendor) doing an uplink with Fortigate. This two switches needs to connect to fortigate by PortChannel and we need to share the same vlans with all of it.So, by the test I have did, I know that by soft-switch it is possible, but my concern is about the CPU usage, so I need to know if is that possible using the hardware switch. Tks!

set up SSL deep inspection and now am able to find the viruses in https links too, but, while testing this with TekDefense.com (http://www.tekdefense.com/downloads/malware-samples/)some files are recognized nut some not. For instance: This one is recognized and blockedhttp://www.tekdefense.com/downloads/malware-samples/malz4.zip but these are downloaded and not blockedhttp://www.tekdefense.com/downloads/malware-samples/malz5.ziphttp://www.tekdefense.com/downloads/malware-samples/yitaly.exe.zip I'm using the firewall in proxy mode (provides Internet to users via web proxy) and the mail policy rule to provide internet is proxy based. Would you please give me hints what is the root cause? size of file? types of viruses? type of files or? Regards,Mohammad

We are using FAC for 2FA and we have configured our SMS gateway and also SMTP server to receive token codes on Email and SMS. Its working fine but the end user is receiving the token code along with username details. Our query is there any way to remove username details from token received on Email and SMS?We don't want username only token code is sufficient.We have checked admin guide of FAC but not found any such settings to remove username details. If anyone have any suggestions kindly assists!!! 

Hi all, We have a FortiGate 81f running FortiOS 7.0.5. We have Application Control running that blocks proxy and vpn, which we want. We do however have one internal device (static IP) that we need to connect via vpn to an external ip.  We also have another internal device that requires connection to an external proxy. What is the best way to allow an internal ip to use vpn or proxy to contact an external ip? Custom IPS signature? thanks jc