Solved

Hello FortiSIEM Community,I have a couple of questions regarding the upgrade process to FortiSIEM version 7.3.2 Where can we download the upgrade package "FSM_Upgrade_All_7.3.2_build0374.zip"?I understand this package is required for the upgrade, but I would appreciate guidance on the exact location or steps to download it.Upgrade Process Clarification:The Fortinet documentation mentions that the Supervisor and Worker nodes should use the same package for the upgrade. Does this mean that once we upgrade the Supervisor, Worker, the entire FortiSIEM system will automatically be upgraded to version 7.3.2?Ref: Upgrading to FortiSIEM 7.3.x | FortiSIEM 7.3.2 | Fortinet Document Library Thank you in advance for your assistance and insights!

Hello,I have a request regarding license renewal.I’ve received two new Contract Registration Codes for renewing licenses — one for a FortiGate and one for a FortiSwitch device.These devices were already licensed previously, and now I need to renew them.As I understand it, for FortiGate, the process is:System → FortiGuard → Enter Registration CodeIs that correct?As for the FortiSwitch, it is managed through the FortiGate.How should I apply the license in this case?Do I need to register it separately, or is it handled via the FortiGate interface?I would appreciate your guidance on the correct steps.Thank you in advance!

Hi everyone, I have a question regarding how FortiGate handles override of blocked categories in Web Filtering. Let me explain my setup:I have Web Filtering enabled with a custom profile where the "Streaming Media and Download" category is set to block. The goal is to allow certain users to override the block and access specific sites within that category after authentication.To do this, I enabled "Override blocked categories" and assigned the built-in monitor-all profile. Inside this monitor-all profile, I kept "Streaming Media and Download" set to block, but I also configured a URL Filter exception, where I added a wildcard like *youtube.com and set the action to "exempt".The expected behavior is:When a user tries to access YouTube, the override page should appear.The user logs in with credentials.Due to the URL Filter exemption, access to YouTube is allowed.All other sites under the "Streaming Media and Download" category remain blocked.However, this doesn’t seem to work as intended

 hello,i have problem with my vpn ipsec i tried to connect to vpn but i have error during phase 2   and on wireshark i'm stuck at here same on forticlient log,  i have no idea why config :same auth-encryption for vpn settings and client good selectors for phase 2 ( src and dest addresses  ) why quick mode failed ? i can share log from CLI thanks 

Hello, I have 2 FortiGate VMs that I want to configure HA in Active-passive mode. I immediately lost GUI access when I applied the HA configuration to the first VM. The same thing happened to the second FortiGate VM.For context, both VMs are deployed on vSphere and are connected to the same port group.Does anyone know why this happens and how I can resolve this problem?

Hello Fortinet Community,  We have configured an Incident Notification in FortiSIEM to send email alerts when incidents occur. • Test emails (via the “Send Test Email” option) work correctly and are being received. • However, when a real incident is triggered, no email is received. • Email server settings are valid, as test emails are successfully sent.  The issue appears to be specific to incident-triggered email alerts. We kindly request your assistance in identifying and resolving this issue.  Best Regards, İsmail Ürek FortiSIEM 

Hi,We have FortiMail and trying restrict outgoing email to a few addresses only in an external domain, let's say to user1@abc.com and user2@abc.com  and block off everything else to that domain. I have created 2 Recipient Policy with Recipient Pattern, first policy with all the email addresses, and then second policy with wildcard *@abc.com, then enabled Content profile and set max size to 10 and also 102400, Action to Reject.I can see the second policy is able to catch non whitelisted address as expected, but still accept and send those emails and not reject them. Any idea why or better method to implement this?   

Hi, Syslog functionality was operating correctly when a single VDOM was in use. However, after enabling multi-VDOM, the syslog configuration now appears exclusively in the Global VDOM mode, making it applicable only to the Global VDOM. In the root VDOM, where all policies, VPN tunnels, and other configurations are present, it is not possible to configure syslog. Attempts to use the "config log syslogd settings" command in the root VDOM were unsuccessful, as the term "syslogd" is not recognized. We are currently running version 7.4.7v. To forward logs, each VDOM needs to have its own separate syslog configuration.

How can I use [FortiClient VPN-Only] in an offline environment? I would like to perform IPsec remote access testing in a closed testing environment, but FortiClient VPN-Only is not functioning correctly offline. When I click "Connect," nothing happens, and it returns to the screen before entering the password.No packets are reaching the FortiGate side, and when I perform a packet capture on the client, no packets are being generated.In the testing environment, I am using an L3 switch as a pseudo-internet environment, and there is a Ping response between the client and the FortiGate. The client’s default gateway is the IP address of the FortiGate’s listening port. Even when I connect the client directly to the FortiGate’s listening port without using the pseudo-internet environment, the issue persists. Is it not possible to use FortiClient VPN-Only in a completely offline environment? Environment in use:FortiGate 60F Version 7.4.5 build 2702Windows 11 FortiClient VPN-Only

Hello, Email-based two-factor authentication has been successfully enabled for users, including SSL VPN users, who are now receiving OTPs via email without any issues. The OTP emails are currently being sent from the email address "DoNotReply@fortinet-notifications.com." Is it possible to modify the sender's email address to align with our domain (e.g., example@test.com)?

Good day Team, Fortimail v7.4.1 I have a few entries (full email addresses) under IP Policy -> Inbound Session -> Lists -> Sender Blocklist checkingand indeed, it works, no more mails from those senders.  However, I am getting quite a few from same domain, how can someone in Fortimail block only the @domain.com portion of email addresses. Please show me the definite steps to complete this procedure. So far my Fortimail is working well, just a few domains I want to keep under control. Regards,

I am following this doc.https://docs.fortinet.com/document/fortinac-f/7.2.0/kvm-deployment-guide/31945 ./deploy_kvm <domain_name> 1- what is meant by "domain name" in this case?2 - Didn't know what that was so I just used "nac". After running the script, I got the following errors and cannot proceed../deploy_kvm: line 164: virsh: command not found./deploy_kvm: line 165: sudo: command not found Any ideas ?

HelloThe following doc shows that FortiLink is supported is this topology:FortiGate <---> FortiSwitch <---> 3rd party L2 switch <---> FortiSwitchhttps://docs.fortinet.com/document/fortiswitch/7.0.8/devices-managed-by-fortios/801183 My question is more simple: is FortiLink supported in the following case?FortiGate <---> 3rd party L2 switch <---> FortiSwitch

I need to delete ima Interface, but I can't figure out how to do it? I want to remove it and put it in SEM_USO 

When I do the Fortigate ssl-vpn test, client failed to get gateway, but traffic flow is normalIs it okay if it's like this?IPv4 Add : 192.168.1.1Subnet : 255.255.255.255Default gateway : 

I have 2 Fortigate 201F set up with a tunnel and I'm seeing some strange traffic (mostly missing) from site A to site B.  Site A has 2 active WAN interfaces with the 2nd interface static DF route at a higher priority. My tunnel is assigned to the interface with the lower routing priority.  I'm not able to ping devices on Site B, yet I'm able to access the internal web interface of the Fortigate of Site B.Site B only has one WAN interface and I'm able to ping from devices within Site B to devices on Site A, but I'm not able to connect to NTP, DNS or LDAP from the Fortigate B to Site A.Both tunnels were created as custom pointing to the IP address of the outside interface of the opposite.  I have phase 2 selectors set for each of the VLANs from Site A and all show active.  Both sites are set with incoming/outgoing policies using the named tunnel and allowing ALL traffic and stated VLANs.Both sites have static routes set to use the tunnel interface for traffic.&nb

Hello team kindly helpi am configuring site-to-site IPSEC on fortimanager to push on fortigate but the i am confused where to confgure the IPsec?i have tried to my best on all platform1. on VPN Manager2. on IPsec Template3. on the device phase1 and phase 2 but after creating the vpn on all the 3 i can not see the VPN as the interface so that i can use on policy?PLASE HELP

Hello Community I am attempting to use the FortiOS API to apply a license. The device is a FortiWifi 80F with Firmware 7.2.6.I am attempting to apply the Advanced Malware Protection Free Trial, for testing purposes.From help with the Fortinet Developer Network I have seen this command:  curl -X 'POST' \ 'https://192.168.20.1/api/v2/monitor/registration/forticare/add-license?access_token=xp40rkkhqcbfyr8Nq96H9G7H43q0f4' \ -H 'accept: application/json' \ -H 'Content-Type: application/json' \ -d '{ "registration_code": "STRING" }'  I am not sure what the registration_code value should be. I visited support.fortinet.com to gather the license key I wish to apply. It downloads as a .lic file. There is text in there but nothing matches the registration code. I have tried to insert the contract number as the string but this did not work.Where can I find the registration code?Am I using the wrong endpoint?Appreciate it

Hello FortiSIEM Community,I hope this message finds you well. I am planning to upgrade my FortiSIEMinstance from version 6.7.1 and would appreciate any guidance on the recommended upgrade path to the latest stable versionSpecifically, I am looking for:Recommended Upgrade Path: The sequence of versions to upgrade through from 6.7.1 to the latest recommended version.I have reviewed the available upgrade guides but could not find specific recommendations for upgrading from version 6.7.1. Any insights or experiences shared would be greatly appreciated. Thank you in advance for your assistance and support. Your expertise and experiences are invaluable to me.

Hello,I am starting to learn with FortiManager and when initially importing an existing FortiGate I get the following error: Retriving configuration file from FGT... Configuration file import succeeded. Reloading configuration file... Error: Configuration reload error. --------------------------------- Failure info: SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_group SELECT "##oid" FROM objcfg_fw_sched_group WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_onetime SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_group SELECT "##oid" FROM objcfg_fw_sched_group WHERE "##parent"=3 AND ("name"=? OR "name"=?); no such table: objcfg_fw_sched_onetime SELECT "##oid" FROM objcfg_fw_sched_onetime WHERE "##parent"=3 AND ("name"=? OR "name"=?); >command(set firewall local-in-policy.1:intf SD-WAN-Inet) detail(datasr

Hi Fortinet Community, We're facing an issue where traffic shaping on our FortiGate device doesn't seem to be working as expected. Despite setting up the necessary configurations, no traffic appears to be shaped — the system always shows current-bandwidth=0(kbps) when monitoring shaping statistics. What We’ve Verified So Far:1. Class IDs are configured correctly.2. Traffic Shaping Profile is set up and active.3. Relevant Traffic Shaping Policy is in place.4. Interface outbound bandwidth is configured.5. Traffic Shaping Profile is applied to the correct interface.6. Ran "diagnose netlink interface list" command No matter what we try, shaping stats show zero usage:  Any help or insights would be greatly appreciated.Thanks in advance!

Hello. We are currently using FortiSwitches with FortiLink.In version 7.2.x, I understand that changing the FortiSwitch name does not affect active sessions. Recently, we upgraded all our devices (gate, switch, AP) to 7.4.x.We have about 20 switches in use.However, when we change a switch name from the gate, it appears that some other switches temporarily disconnect and reconnect. It also seems that active sessions are interrupted.Based on my research, it seems that when a managed switch is renamed, it is deauthorized and then rejoined, which causes all sessions to be dropped. As the switch reconnects, STP path recalculation occurs, so session drops or other switches disconnecting may be observed. Is this understanding correct?I referred to the following URI for this information:community.fortinet.com/t5/FortiGate/Technical-Tip-Unable-to-change-managed-FortiSwitch-name-after/ta-p/280009docs.fortinet.com/document/fortiswitch/7.4.0/fortilink-guide/59264/defining-names-for-managed-switche

Is it possible to configure a time-based administrator user access in FortiGate?For example: an administrative user must be able to login the firewall device from 9 am to 11 am. Beyond 11 am, the login access should be disabled 

Hello community, I am new to FortiSIEM, I want to build a rule to detect new devices in my network, I had the idea to create like a list containing MAC addresses and a rule to check each time if a mac is in that list if not it will trigger an incident and add the mac address to the list (if you are familiar with qradar it is like a reference set), the problem is I don't know if that is applicable also in FortiSIEM or there is another approach to solve the problem??? any idea is appreciated, thank you in advance.

Greetings community!We are now receiving events from the Kaspersky cloud in FortiSIEM, where the format is a "System Log", and it has the following structure, for example:<14>1 2025-04-15T12:50:06.047Z | - TEST_SIEM_CONNECTION [event@23668 et="TEST_SIEM_CONNECTION" etdn="Test Siem Connection"]<14>1 2025-04-15T01:34:49.000Z xxx_hostedinst_xxxxx.openstacklocal 1093|1.0.0.0 - KLAUD_EV_SERVERCONNECT [event@23668 p2="x.x.x.x" p3="2x\\xx" p5="x.x.x.x" p9="::1" et="KLAUD_EV_SERVERCONNECT" etdn="Audit (connection to the Administration Server)" hdn="<xxxx>" hip="x.x.x.x" gn="Managed devices" kscfqdn="xxx.openstacklocal"] User "2xxx" has connected to the Administration Server from "x.x.x.x".As a result, the events are arriving as "Unknow_events", precisely because there is no parser for this type of log. I created a new parser file at this first moment just to test the simplest events, for example: <14>1 2025-04-15T12:50:06.047Z | - TEST_SIEM_CONNECTION [event@23668 et="T