Solved

Hi,I am using Fortigate 200D Firmware v5.4.1,build1064 (GA)Recently, there is the message when I log in "Conserve mode activated due to high memory usage" Memory Usage 85%Could you help me fix this issue?Thank you.

Good day! I hope you are all doing well, I just want to ask what are the possible solutions when we input 2 FQDN (one is malicious and 1 is legitimate) it resolved same IP addresses. the FQDN that tagged as malicious are blocked via deny policy. However the our client are having a problem accessing the legit FQDN because of the same IP. the legit website are from Cloudflare. does cloudflare assigned same ip address to FQDNs? Thank you! 

how can i filter the api request i want to filter the size of logs{base_url}/api/v2/log/disk/traffic/local?vdom={vdom}&filter=policyid=={policy_id} and _metadata.timestamp>={start_time_ms} and _metadata.timestamp<={end_time_ms}&start={start}&limit={limit}i want to take just the first 1000 logs but the request show all logs 

Good day good people, I hope you are all doing well, I just want to ask if anyone has an idea on how to backtrack the reason for high resource utilization. For example, high CPU and memory utilization were observed during the morning, and we just noticed it in the evening. Does anyone know how to backtrack the issue without TAC intervention? what are the commands needed on to solve this issue Fortigate 7.2.10

Hi all,I have create an IPSEC dial up tunnel with Ike v2 and NAT-T. I use Forticlient to connect to it and it works well.  I have observed that some traffic are denyed cause when I send traffic across the tunnel, the user with witch Im logged (using forticlient) is not associated with the incoming traffic. I can see the IP from the private tunnel network but not the username. That causes the incoming traffic matches a deny policy, cause I use an user group in the incoming rule that permits traffic from the IPSEC interface. For example, I can see traffic from 192.168.106.x but the incoming traffic has not an user associated.Why the username with witch Im connected to the tunnel are not matched in incoming traffic?I attach you the tunnel configuration: Thanks ¡¡¡ 

Good morning everyone,It has been a while indeed. This is a follow up to a resolved post below: Post: Forticlient EMS removable media accessDate:14/5/2024----------------------------------------------------------------------------------------------- Since I configured this feature in EMS, it has been working perfectly, blocking usb devices while only allowing certain devices, especially Keyboard and mouse. However, my manager attached a USB dongle/device to a computer apart of target group/profile, and it is blocked by the USB policy. He instructed to disable the "Removable Media Access" feature on LAN until this ethernet-usb can be allowed on computers. I really don't want to keep this off for too long. Don't know why that instruction, but hey, following orders, at least my name won't be called for any issues. Can you show me to allow this device in Endpoint Profiles -> Malware Protection -> "profilepcs" -> Removable Media Access? Kindly see image below/at

Hello,I would like to implement VDOM In azure infrastructure. As I discovered when you implementing VDOM you must to assign interfaces to the VDOMs, but in case of Azure you have just 2 interfaces and I don't know how I can assign 2 interfaces for example to 3 VDOMs? 

Hi, today we tried to get information about our interface bandwith with iperf and Fortigates. We would like to get information about a FG location in South America. Our main office are in Europe and we use FG100Fs and 7.2.X. All our offices have at least 2 x 1000/1000mb access but in South America we can only do speedtest on browsers where we get like 800/800 at the most. Firts, we could not run iperf within the VPN from FG Europe <> FG South America. We set up a iperf server on windows on our side but doing diag traffictest run -c x.x.x.x we could not connect. We checked Windows FW, AV and policies and there was no way. As iperf-int we tried all interfaces (internal, WAN and the VPN interface). After that we tried with a linux in our network and we created a VIP with 5201 and trying from our FG with WAN as interfaces we got like maximum 12mb trying at least 10 times. Doing the same from our FG locationes in EU we got like 300-700 mbs.  We would like to k

Hello everyone, I am currently working on integrating FortiAI with FortiAnalyzer, and I would like to know from which version of FortiAnalyzer this integration is officially supported.- What is the minimum FortiAnalyzer version required to recognize and store logs from FortiAI ?- Are there any specific configuration steps or limitations I should be aware of ?- Where can I find the official documentation regarding this integration ?Any insights or shared experiences would be greatly appreciated. Thanks in advance for your help!

Hello there, can somone please explain to me what this FortiClient VPN icon display  means ? I could establish a succesfull connection and i pressed disconnect.  After 10 min when i tried to enter again i had this icon displaying and could not establish connection I have the Forticlient 7.2.8 version because it was the only version that i could establish a succesfull connection 

hello everybody, I defined a ZTNA Group that includes two ZTNA Tags:  I know that a firewall policy can work with ZTNA Tags. But is it the same for a local-in-policy?Looking at the documentation: config firewall {local-in-policy | local-in-policy6} edit <policy_number> set intf <interface> set srcaddr <source_address> [source_address] ... set dstaddr <destination_address> [destination_address] ... set action {accept | deny} set service <service_name> [service_name] ... set schedule <schedule_name> set comments <string> next end It generally talks about a destination address. But is the local-in-policy capable of understanding a ZTNA group?I didn't find anything indicative about this. I'm working on a Fortigate 60F v7.2.11.Thank you

Hi. I have a Cisco switch configured with gateway IP at 10.24.111.65. The switch is connected to the fortigate through a trunk with VLAN 101 tagged. Im trying to do vlan-routing from my VLAN1 which is configured with gateway in the fortigate to VLAN101 with the Cisco Switch as gateway. I have created VLAN101 in the fortigate without address.Firewall policies from-to VLAN1-VLAN101.Static route Destination 10.24.111.64/255.255.255.192, Gateway 10.24.111.65 and Interface VLAN101 I cannot ping the gateway or any devices on vlan 101 from vlan 1. (Reply from 192.168.80.254: Destination host unreachable.) The devices on VLAN101 are showing up in the fortigate users & devices under VLAN101. What am I doing wrong?The cisco and all devices connected to that is supplied by a third-party supplier and I cannot do any configuration on that network.

Today we received a security audit assessment from a 3rd party security company. They indicated they can login successfully to our border FortiGate firewall using jsconsole from a trusted management interface. The trusted management interface is connected to the Out-of-band (OOB) Management network and is restricted to specific internal users including the 3rd party security company performing the audit. Can anyone speak to this access, good, bad, indifferent?Can jsconsole be used to make changes to the firewall?Is there a way to block jsconsole access?Thank you 

Ran into this issue today and figured I would post the solution, since I couldn't find it. Situation is a VPN hub/concentrator running 5.2.8 with multiple IPSec VPN peers configured as dynamic/dialup peers. When testing the new firewalls one at a time before shipping out, each one worked fine. But after users received them at their site, none worked. They all kept bouncing up and down. Tunnels would establish, and then with 2-3 seconds go back down again, over and over. The solution was to disable add-route under the Phase 1 settings for each VPN peer: config vpn ipsec phase1-interface     edit "DVPN-PEER-1"         set add-route disable     next end I didn't capture the log message, but what was seen was a message indicating that route 0.0.0.0/0 was being passed from one VPN to the other. Since Phase 2 selectors are set to all zeroes, and add-route is enabled by default for a dynamic pe

I'm testing Fortigate-VM-Evaluation adn EMS Client Trial(Server),Fortigate-VM can't accept certificate of EMS Client.Fortgate-VM:OS Firm 7.2.10EMS:7.0.7build0398Is there any possible mistake to setup for EMS and Fortigate、or perhaps, Evaluation cannot be used.By the way,when I tried phisical-Fortigate-100F with EMS、it worked.Physical-Fortigate-100F could accept certification of EMS.Please help!!

I want to WAN2-port to Dedicated as Ethernet Trunk.Is this possible?Even WAN2-port role is changed to LAN-role,there is no "Dedicated as Ethernet Trunk".I have to choose port1～port6 using by "Dedicated as Ethernet Trunk" ? 

Hello,I'm trying to connect with iPhone on a tunnel SSLVPN (with MS SSO configured) and the FortiClient VPN app on device says:"The network connection was lost."The same SSLVPN tunnel works fine from an Android device.How can I resolve ?Regards,Leandro

Am I right in thinking that setting set username-sensitivity enable for a local LDAP user just removes the set username-sensitivity disable line from the user's config? set username-sensitivity enable doesn't persist in the config when I enter it, and I want to be sure I have this right. I assume entering set username-sensitivity enable is the same as entering unset username-sensitivity ?

Hello, I have made a deny policy on the Fortigate 7.4.7 and assigned some FQDNs as source on LAN to WAN communication. However, I realized it doesn't work. When I tried the policy with the IP addresses, it worked as it should. Then, I executed below command where "ABC.Domain.com" is our internal network host's FQDN.   exe ping ABC.Domain.com   Result:   Unable to resolve hostname.   We are using the Fortigate DNS servers as below:   #show system dns config system dns set primary 96.45.45.45 set secondary 96.45.46.46 set protocol dot set server-hostname "globalsdns.fortinet.net" set dns-cache-limit 300 end    Also:   # show system dns-server config system dns-server edit "lan" set mode forward-only set dnsfilter-profile "default" next end    FYI, I'm able to ping the hostnames in my endpoints but not in comman

In the GCP environment I set up the VM where I installed the ova file downloaded directly from the Support Fortinet site (see below for example)        After installation I tried logging in with the default credentials both in SSH and from the GUI but I get this error when logging in            Thank everyone in advance!#FortiPortal #GCP

hi Community, We have a website that goes through our fortiweb with HTTP authentication with AD enable. Is there a possibilities to exclude this authentication rule based on IP Address? thanks

Hello,  We have a fortigate 80F. There is a Firewall Policy, which has WebFilter enabled for traffic from LAN to Internet. The problem is that we are trying to access a sftp with IP. I see in the logs that the IP is categorized as Unrated. I created a new Web Rating override and in the URL I've added the IP we are trying to access (The override is to use a different category to allow the access). Obviously the URL field is for URLs, so the IP is still been treated as unrated. To overcome this issue I have created a new Policy rule so the traffic for this specific IP is not using the WebFilter UTM.Is there any way (except making the Unrated category allowed) to overcome this issue?

I want to build a HA with FortiClient and my current EMS has 150 client licenses but do i need to buy another 150 for the implementation of a HA or will the client use the same license when switching to the second EMS?

Hello Community, Why I don't have ddns settings in fortigate interface, although I can configure ddns via CLI. Is it because of a license issue? 

We are having a bizarre problem since updating to 6.2.1 (we updated due to a memory leak issue in 6.2.0). Certain sites are giving us a ERR_SSL_PROTOCOL_ERROR only in Google Chrome. I have tried all the usual troubleshooting for this error, but the only thing that fixes it is restarting the fortigate. Two sites (facebook.com and login.renweb.com) both use TLS 1.3, but we can get to facebook without a problem and we cannot get to the other site. After rebooting the device, it works for several days and then starts behaving poorly again. Other browsers work fine, including Internet Explorer, Edge (not Chromium based) and Firefox. I have attempted to disable SSL certificate inspection, but that does not seem to affect the problem one way or another. I also tried putting the fortigate back on its factory certificate. My next step will be to revert to 6.0 branch, where I did not experience this issue, but I figured I would post first to see if anyone had similar exp