Solved

Hi,I try to configure an automation stitch with this event:However, I can't understand why the event never gets triggered. Even on the system event logs I never find anything related to IPS db updates .. does anyone know why?Maybe because I only have the IPS license and not antivirus?Thank you

Hi, I'm still learning, wanted to get one up and runing in Hyper-V together with a Fortigate or 2.(on a local Windows 10 machine)I followed https://fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/9c527bde-cce0-11e8-8784-00505692583a/FortiAnalyzer-HyperV-VM-Install-Guide.pdf Dowloaded vm from https://support.fortinet.com/Download/VMImages.aspx 7.03 Reinstalled 3 times, didnt find any guide for 7.0x. Video's just show to log into gui after adding HDD and booting up. Tried a execute sql-local rebuild-db, and afterAt shutdown and the dots counting up, it always ends with Failed! =/ I guess all my questions are wrong, butAs they have 7.03 for hyper-v i guess its supported? OR should I try another version? or vm platform?Tried google the errors. reset system all-settings. How do I mount /var?

Hi all, I'm seeing every few minutes the number of sessions moving through my FortiGate spike from a few thousand, to tens of thousands, and back.How would I best identify the source of these connections?

i have seen this a couple of times and just wondering if anyone else has come across this. and can add any logic, so i can add to my notes for resolution. when the logotype has been set to CEF, via the GUI.however the format it seem to come out in the local disk value not the expected CEF e.g  expected output  CEF:0|Fortinet|Fortigate|version|etcnot the ondisk formatdate=2022-03-20 time=14:55:20 logid="1203030258" type="utm" subtype="waf" eventtype="waf-http-constraint" level="warning" 

Hi. Is it possible to view traffic log from internal device to another internal device (for example RDP connection). Currently I am not able to view any traffic from lan to lan. Appreciate your knowledge and information. Thank you.

Hi, I trying to add IPv6 to existing interfaces on my Fortigate 60E running 7.0.2 The WAN part was no problem. When adding the configuration to the LAN (internal) interface, I got an error:object check operator error, 1, discard the settingCommand fail. Return code 1 Config WAN:FTG60E (wan1) # showconfig system interfaceedit "wan1"set vdom "root"set mode dhcpset allowaccess pingset type physicalset description "WAN Ziggo"set alias "Internet Ziggo"set lldp-reception enableset monitor-bandwidth enableset role wanset snmp-index 1config ipv6set ip6-mode dhcpset ip6-allowaccess pingset dhcp6-prefix-delegation enableconfig dhcp6-iapd-listedit 1set prefix-hint ::/56nextendend Confige I try to add to LAN:config system interface edit "internal"FTG60E-BMR-001 (internal) # config ipv6FTG60E (ipv6) # set ip6-mode delegatedFTG60E (ipv6) # set ip6-send-adv enableFTG60E (ipv6) # set ip6-other-flag enableFTG60E (ipv6) # set ip6-upstream-interface "wan1"FTG60E (ipv6) # set ip6-

Dear Poeple,Nice Sunday first:-)I put a picture to explain my behaviour better.I want connect with a forticlient to FG1 to reach their network and reach the Network from FG2 too.FG1 und FG2 have side to side VPN connections.I can ping only the FG1 networks and cannot reach the FG2 networks like in picture to the network 192.168.4.0/24.Does it possibele to reach other Networks with a Forticlient over VPN Connection or not? Phase 2 all FGs and FortiClient Network are 0.0.0.0/0.0.0.0 typedIn FortiClient VPN Connections are both Network (192.168.4.0 and 192.168.5.0) typed.In FG 1 is a policyincomming: FortiClientVPNoutgoing: internal, VPN Connection to FG2incomming Network: alloutgoing Network: 192.168.4.0 and 192.168.5.0Split Tunneling ist activatedThanx in advantage 

Hi everybody, In now, I need create Policy internet access with AD account. I already Ldap with AD Server but when create policy then can not access. After that, I read document and create windows polling group, add user group with FSSO and test but user can not access internet I think, must install FSSO Agent. But I have questions below:  FSSO Agent must install on AD Server or I can install at other server with collect/polling mode ? Thanks   

Hello, I have a question about the setting of Virtual Server(loadbalance). Please see the detail as below. -There are 2 Real Servers and I want Real Server1 is Active and Real Server 2 is Standby.-If a Real Server1 fails. Real Server2 to be active instead. When Real Server1 is back. Can FortiGate automatically set Real Server 1 as Standby? I want Real Server1 is standby after coming up. I tested many settings. but when Real Server1 is back. It will always be back to active. Does anyone have a solution for this situation? Thank you.

Can someone explain to me why the answer is "client did not authenticated"? i thought it was authenticated because on the smtp session "sender ok" and "recipient ok" and also the message is delivered

Im planning to upgrade our FSSO Agent to version to 5.0.0304.But on our Citrix servers we are currently running TS Agents with version 5.0.0294. Would this cause any issues? I cannot find any information about running diffrent versions. Thanks,

Hi. I have a question to the community. What is the difference in creating VIP (NATting) with port forwarding and without port forwarding? If i VIP all service without port forwarding does that mean all services are exposed to the internet? Hope someone can have a clear explanation on this as I am quite confused about this matter. Thank you in advance!

Hello everyone,When a guest user authenticates via the captive portal, a FortiGate page appears on the browser with the address ---> http://192.168.x.x:1000/fgtauthBy pressing the "Send anyway" button you can navigate correctly.How is it possible to remove this page?Browser: ChromeCaptive Portal: FortiAuthenticator v6.1.2, build0420 (GA)ThanksAndrea

Hello There, Is anyone having the same problem of disappearing the Device Information from devices connected to each Fortiswtich Ports, with Fortigate 301E using OS 7.0.5 version?    

I have a problem with the webfilter and app control of my Fortigate60E I am blocking EVERYTHING that is remote access and it is not working, which it is but if I go to Log&Report>FowardTraffic absolutely NOTHING is reflected in "Application Name", which makes me assume that my traffic passes without SSL inspection. I'm using a basic Monitoring setup profiel on App Control and Webfilter, and it doesn't work either, I don't really see anything. What's going on?

Our AD is hardened and our service accounts are limited in what they can do.  I have a service account that I am attempting to poll active directory groups for usernames.  Currently my service account can query ldap and view event logs.  What other permissions would I need the service account to have.  Currently I have a red arrow on my active domain controller. Our domain controllers are up to date and our Fortimanager is version 6.4.3 build 2201. The connector does get a green arrow if we use domain admin credentials. thank you

Hello team!! I have the following issue with a fortigate 60F (firmware 6.4.4)We have all the rules from LAN to WAN, with "Certificate-inspection", no one with "Full-inspection", and the "Certificate-inspection" profile is the default one.Sometimes, clients are having problems browsing in the internet, because Fortigate is giving to user its own certificate and it is not trusted in clientsI know a possible solution is to install the fortigate certificate in clients but I prefer to know why is happening thisDo you know why fortigate could give its own certificate to clients even using default "Certificate-inspection" profile? Thanks in advance.Regards,Damián

Hi,Does anyone know exactly what it means no_ofld_reason: redir-to-ips??? I have two fortigate 60F, (FGA and FGB) with FortiOS 7.0 but one (FG A)of them has problems inspecting the traffic, i mean that the traffic passes without inspecting the security policies. Example, if I want to block Torrent or Remote Desktop, the traffic goes through and is not blocked by Application control. This only happens with one of the two fortigates (FG A), in the other (FG B) i can block an application or URL without problems when I run the command "dig sys session list" the result say in FG A no_ofld_reason: redir-to-ips is constant and it always stays, but in FG B it varies does it have something to do with it? FG A says: no_ofld_reason: redir-to-ips (is constant)Fortigate A redir-to-ipsFG B says: no_ofld_reason:

Good morning,I would like to know what to include as dst_port and protocol to find the rulethat allows me to pass the ping in the command:diag firewall iprope lookup  src_ip  src_port  dst_ip  dst_port  protocol  Source interfaceI have tried with "any" and "all_icmp" and it does not give an error but it does not give me the correct policy:diag firewall iprope lookup 1.1.1.1 51778 2.2.2.2 any all_icmp port35Thank you very much.

Hello everyone,I'm trying to set up FSSO on AzureVDI. We have a FortiVM in Azure, a Win2019 DC, currently one VDI Server running Windows 10. I have installed the Collector and DC Agent on the DC and the TSAgent on the VDI Server. The connector on the FortiGate is working and I can select LDAP Users/Groups. My issue is that users connecting on the VDI server are not being pushed to the collector; instead, my logins on Azure seen by the DC Agent and because of that, if an admin logs onto the VDI Server, all other users then have internet access.  Sessions on the TSAgent are being logged and assigned port ranges but they simply don't appear to be visible under "Show Logon Users" on the collector. I've specified the VDI server in the "Citrix/Terminal Server" in the collector and on the TSagent, I don't see any connection failure to the collector. Any help would be greatly appreciated. Kind regards,Renato

Hello, we did setup a port forward from wan to a internal server. This works. Now we want to only allow access for iPad and iPhones over the external wan to the internal ip. Is ist possible to set this up? Regards Jens

Hello, for remote backup reasons I need to get a Seagte ReadyNAS 516 with Firmware 6.9.4 running. On the NAS I created users, shares and the needed applications (rsync, smb, http/webdav, ftp). On our FortiGate 100D (WAN DOWN 100MB/s UP 100MB/s) with Firmware 5.6.3 build 1547 I connected the NAS to a separate interface (role LAN) and set up a VIP with the required ports.   MTU is set to 1500 on both sides. File copy from my laptop over LAN works with 95MB/s (1GB/s connection). Copy files from remote locations via smb or ftp does not go higher than 512/600k (10MB/s or 5MB/s upload connection possible). Any idea what configuration mistake I made on the FG100D? Kind regardsJay

Hi all, when an ssl client is connected it can ping a host on the lan, but not vice versa. The same problem is between two connected SSL clients. The strange thing is that, on the contrary, the VNC (like access to remote desktop) works correctly. I made all the correct policies. You can help me? Firmware 6.4.8 and SD-WAN configured.I have some doubts about the Portal, you know that activating the spli-tunnel even if you do not declare the lan to reach, you can do it in the policy, and so I did. Thank you

Hello bro,I have hundreds of Fortigates to version 6.4.8, in recent weeks I have always waited to bring them to 7.x (in particular to the latest 7.0.5). What do you advise me not having, at the moment, particular problems?I only brought the Fortianalyzer to 7.x and I must say that it works very well and has solved some "reports" problems that were sometimes completely empty, without any data. Thank you all.

Hi, We have a FortiAnalyzer VM deployed on ESXi last year at our customer's place. Everything was working fine but since a week we were not able to see any logs on "Log View". When we checked the dashboard, we can see that the FortiAnalyzer is receiving logs from the FortiGate but it is not Inserting them into the database. The logs are still present in Log Browse (Compressed). FortiAnalyzer is in Analyzer mode and not Collector mode. How do we fix this ?   Thank you. FortiAnalyzer FortiGate