Solved

Hi team,Does anyone know how to get the license expiration date by using an API call, either to FG directly or to FMG (with ADOM)?API with the format /api/v2/monitor/license/status/ is not showing the expiration date 

Hi all,I'm trying to move our VPN's away from SSL to IPSEC which I've managed to do for our Windows machines (which are the majority) but I've been struggling to get iPads to work so I've managed to get them working on IKEv2 with a pre shared key as long as i don't enable 2FA (just to confirm the VPN works) but I've found an updated post on Fortinet that due to a limitation on IOS that you can't use 2FA on IPSEC with a pre-shared key and the only option is to use SAML certificates however there seems to be a lot of confusing information on going about this and what exactly is needed.....so....am i correct in understanding that to get iPads to connect using IKEv2 and 2FA that i only need our FortiGate 100F and an identity provider such as Azure ? I don't NEED EMS or anything else to get this to work do i ? Also can the 100F do the IdP part as well instead of Azure etc just so it's all contained on the one box ?I'm just trying to clarify what different devices/platforms i need to ge

Dear Team,   I created a simple custom parser for ZTE device , it passed all test with multiple ZTE raw logs but the device is not accepting the parser i.e the ZTE device logs are still shown "Unknown_EventType" in FortiSIEM can some one help in identifying issue or any suggestions ? I tried linking the parser manually in CMDB->device-edit device->parsers   Below is the log and parsers ----------------------------------------------------------------------------------------- <!--<190>2025 May 15 14:23:31 172.21.107.110 alarm-log:mac 407c.7d5d.a1d0 vlan 4000 move from gei_1/3/3 to gei_1/4/3<134>2025 May 15 13:43:41 172.21.107.110 command-log: telnet0 mikul 27.116.54.53 /*** telnet user log in ***/--><eventFormatRecognizer><![CDATA[alarm-log|command-log]]></eventFormatRecognizer><patternDefinitions><pattern name="patLevel"><![CDATA[\w+-\w+]]></pattern><pattern name="patos"><![CDATA[TMNX]]></pat

When the application (google drive)upload or sync file, the traffic will trigger the DOS UPD flood as below. itime=1436345294 dstname=tl-in-f116.1e100.net device_id=FG600B3909601201 log_id=18432 subtype=anomaly type=ips pri=alert policyid=0 serial=0 attack_id=285212772 severity=critical sensor=block_flood src=*.*.*.* dst=64.233.189.116 src_port=56355 dst_port=443 src_int=port4 dst_int=N/A status=clear_session proto=17 service=https user=N/A group=N/A ref=http://www.fortinet.com/ids/VID285212772 count=507 incident_serialno=0 msg="anomaly: udp_flood, 2074 > threshold 2000, repeats 507 times" vd=root identidx=0 attack_name=udp_flood intf_policyid=0 date=2015-07-08 time=16:48:14itime=1436345279 dstname=tl-in-f116.1e100.net device_id=FG600B3909601201 log_id=18432 subtype=anomaly type=ips pri=alert policyid=0 serial=0 attack_id=285212772 severity=critical sensor=block_flood src=….dst=64.233.189.116 src_port=56355 dst_port=443 src_int=port4 dst_int=N/A status=clear_session proto=17 se

Hello!I'm facing a strange issue with my FMG on 7.6.3, basically i'm trying to create an overlay template but i cannot select any of my firewalls, is that a bug from 7.6.3?I tried also to reboot the FMG, but nothing changed.

Hello Dears we need to setup QOS service for MS-team meetings , any suggestion for implement that on fortigate 201F firewall ? Bests

Hello EMS adminsFortiClient EMS 7.4.0 with FCT Agent 7.4.0 on Windows 10 client.Enabled the "FortiClient telemetry connection key" option in EMS settings.When registering a client with invitation it doesn't prompt for telemetry connection key.Did I miss something or is this a normal behavior?

Hello, Kindly, Is there any document (Guide) to develop parser for unsupported data source?

hi all, I have a fortigate 1100E and need to set up two WANsI need WAN1 to handle internet for users and WAN2 to handle the traffic for  applications that are accessible from the internet.the problem is that the users and applications are all in the same LAN and the default route in the fortigate goes to the WAN1.how can I force the reply of  traffic that came from WAN2 to LAN(application data) to not use the default route that goes to the WAN1 and use the WAN2 Path?

Maybe someone with a deeper understanding can shed some light on this.I've set up an IPsec VPN using certificate-based authentication and tested it with a small user group — it works great.I then handed it over to software delivery. They did what they usually do with the SSL-VPN profile: extracted the config from the registry and bundled it with FortiClientVPNSetup_7.2.8.1140_x64.exe.Now the issue after deployment:The IPsec profile appears in FortiClient. The user selects it and clicks Connect → Status shows Connected.However:Bytes received: 0 (remains at 0)Bytes sent: $somenumberOnly working fix so far:Uninstall FortiClient and remove all registry traces. & install FortiClient and manually add the IPsec profile.What doesn't work:Uninstalling and reinstalling FortiClient, then manually adding the IPsec profile — still connects, but no incoming data.Adding the IPsec profile under a different name. So it seems there is something in the registry that messes with IPSec exclusively

Hello team, I have configured VPN IPSec from PA to FGT but the pahse1 still down.I have enabled the debug from fortigate's CLI and following the results: debug commands:diag debug resetdiag debug console timestamp enablediag debug application ike -1diag debug enable debug output:ignoring IKEv2 request, no policy configured The peer from FGT is a public ip configured on WAN interface directly. Do you have any suggestions? Thanks for the supportBR 

Hi everyone,I have a FortiGate 120G with deep inspection profile applied.Since the update to v7.2.10 I have random issues and I think it does belong to quic. This morning several clients called me to tell that www.google.at does not work any more in edge browser:ERR_SSL_PROTOCOL_ERROR First I did try to block quic via application control, that didn't help so I did create a policy blocking udp 443. Didn't help either. So if blocking does not work I tried to allow it - as this telling me blocking is not neccesarry:https://docs.fortinet.com/document/fortigate/7.2.10/administration-guide/984075/blocking-quic-manually But this does not help either. What is really strange: the error messages does not appear to be consistent at all. Websites do work on some clients and on others they do not (using same firewall policy and same inspection profile). The next hour these websites do work on clients that were affected before but then it does not work on other clients.  As a wor

Hello.I was wondering if any alternatives to FortiAnalyzer that still allow the Security Fabric feature on FortiGate. If there are any, I would like to know the tradeoffs each alternative offers.If you are asking for a context, there isn't any. I am just curious to know what my options are.

Hello everybody, I'm working on a Fortigate 70G v7.2.11I defined an interface:   and a policy to allow the traffic:  With this policy, I want to say: wherever I call you, you have to allow the traffic.If I connect to any 70G interface (wifi, wired lan etc.), it works. I can ping 10.0.0.2.There is only one interface for which this policy does not work: It's the admin_tunnel (or the ipsec interface), an ipsec interface. I've already tested this ipsec tunnel for other scopes and it works fine. In fact, I already defined one policy:  The problem is that if I'm connected to this tunnel I can't ping 10.0.0.2 anymore.Why is that? shouldn't the traffic I send out the tunnel just fall under any -> 70Gto60F (port5) the policy?   

Hi everyone, I'm currently trying to set up a new FG-120G, and I'm currently stuck with enabling the proxy mode inspection. I tried following these two instructions for activating proxy mode inspection:- https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-the-visibility-of-Proxy-Mode-in/ta-p/270448 - https://community.fortinet.com/t5/FortiGate/Technical-Tip-Inspection-mode-option-is-not-visible-under-Policy/ta-p/250797  I activated "Policy Advanced Options" under Feature visibility. Then I tried the commands in the CLI, but there is no "gui-proxy-inspection" under "config system settings". Even under "config system global" there is no "proxy-and-explicit-proxy".I also tried restarting the FortiGate after activating the Feature "Policy Advanced Options", but the commands still don't work. (since the command "fnsysctl killall httpsd" did nothing) Are there any requirements or settings that I'm missing to activate proxy mode?View of creating a

There have been internal discussions about blocking *all AI websites, so I was asked if that could be done on the FortiGate. I don't see a category for this, but I did find a webpage that had something under General Interest - Business | Aritificial Intelligence Technology. However, I don't see that category in our FortiGate, which is running 7.2.5. Does anyone have suggestions for this? Thanks

i setup this hub site with diaup ipsec option with igbp my issue spoke1 to spoke 2 not ping

Hi, I'm new hereI have the SIEM analyst role and I have read-only access to the fortianalyzer.I have to monitor all the events that it detects as incidents.This fortianalyzer manages more than 10 firewalls and I only want to get the events that are most relevant or what fortianalyzer considers as an incident or what most draws attention and contributes to security issues to avoid incidents.According to what I have investigated this is the configuration that I should request to the firewall administrator but I would appreciate if you could share with me your recommendations config system log-forward edit 1 set mode forwarding set fwd-max-delay realtime set server-name "SIEM_Server" set server-addr "192.169.1.1" set fwd-server-type cef set server-port 6515 set fwd-reliable enable set log-filter-status enable config log-filter edit 1 set field "event" set value "sec

Hello Team, I connected an already configured fortigate cluster to a Fortimanager. Now I wanted to try to create a policy from the Fortimanager and push it to the firewall. Can you point me to the correct procedure?To do this I saw that you have to create a policy package but I have the grey button and I can't click it.I am logging into the FortiManager as an admin user (so I am ruling out permissions problems).I point out that on the same adom (root) as Fortimanager there is already another pair of fortigates which already have a policy package assigned. Please feel free to ask for more details.I thank you in advance for the supportBR 

i need to know after ssl vpn not support in future so if we need vpn web mode how we configure this?

Hi everyone,I have a FortiNAC VPN management model with FortiGate (IPsec VPN).I referred to the documents below but still do not understand some things:https://docs.fortinet.com/document/fortinac-f/7.6.0/fortigate-vpn-integration/693309/what-it-doeshttps://docs.fortinet.com/document/fortinac-f/7.6.0/fortigate-vpn-integration/693309/configuring-fortigatePlease see the attached links for IP information, model, etc.My questions:Can FortiNAC's Isolation Interface (10.1.3.71/24) be used for both SSL VPN and IPsec VPN?Where does the Isolation IP range 10.5.254.11 - 10.5.254.99 come from? Where is the gateway of that range?When is the IP range 10.5.254.11 - 10.5.254.99 used?

HiI'm trying to setup IKEv2 tunnels for my remote access users. on IKEv1 i could assign tunnels to a user groups but when i change it to IKEv2, I can't find anywhere to assign the tunnel to a group. I'm using LDAP for user Authentication. how am i supposed to handle this?Regards

Hello Guys,I have two questions about the Ike V2 IPSEC DIalup Connection. I want to configure in my enviroment (two fortigate 100F HA) like 150 dialup external connection. I have setup an IPSEC Tunnel (IkeV2) and set policy correctly. I created the users locally (without any Proxy or RADIUS) and inserted in a group. The VPN works fine but i have two questions:- Is binding set in the IPSEC configuration the authusrgrp? because i haven't set and i won't set because if i set, every time thast the people connect appear when the people search a local ip for example, the Fortigate Auth page, and for us isn't necessary. So if i unset that is an error? -  Ikev2 works fine with the local user (i enabled the EAP)? because i haven't any other type of authentication Thank you so much

Hi,Is it possible to use both SamAccountName and DnsHostname authenticated against same LDAP server. I cannot get it worked. If I changed the username attribute to dnshostname as below it authenticates with dnshostname but not with samaccountname, how can I get both working so I can authenticate using both computer name and username ?  Thanks Thilina 

I upgraded from 7.0.15 to 7.4.7 due to a request from Fortinet support to fix an IPSec issue I had.After the upgrade, all was working fine. Then, a couple of days ago, the letsencrypt certificates I use with Virtual Servers were renewed. Successfully.However, since the renewal, the certificates are not applied anymore to the incoming connections. Instead the self-signed certs of the application are shown to the client. After some research, I believe that this is because proxy based fw rules are not supported anymore on a 40F with 2GB RAM. Question: Can I still use the letsencrypt certificates with VIP connections? If yes, what do I need to change on the settings for those connections (FW rule, VIP serttings, etc.)? ThanksDan