Solved

Hello All, The Microsoft Defender Endpoint vulnerability scanner is detecting the following vulnerable files created as part of the Forticlient 7.4 VPN Installer, all with the version number 3.1.5.0:c:\program files\fortinet\forticlient\libcrypto-3-x64.dllc:\program files\fortinet\forticlient\libssl-3-x64.dllc:\program files\fortinet\forticlient\x86\libcrypto-3.dllc:\program files\fortinet\forticlient\x86\libssl-3.dllThe listed CVE's against these files from MDE Show as:CVE-2024-2511CVE-2024-4603CVE-2024-4741CVE-2024-5535CVE-2024-6119Is the Forticlient 7.4 VPN software vulnerable to these CVE's because of the libcrypto/libssl dlls present in it's install directorys?

Hello everybody, some days ago I received this error on my Fortigate F60 (v 7.2.10):msg="User shutdown the device from forticron. The reason is 'System file integrity check failed'"I searched for this error and I found the following guide: https://docs.fortinet.com/document/fortigate/7.2.5/administration-guide/249947From this guide, I didn't understand very well. I'll try to explain:what I understood is that this error appears beacause BIOS security level is 2 (I confirm) and, because the firmware (as well as the AV engine etc.) is signed by the Fortinet CA and a third-part CA, this integrity check fails.Now, I have two question:1) Who is this third-part CA?2) If there is an integrity check error, how is it possible that the solution can simply be setting the security level to 1? How can we simply ignore this error?I think I'm missing the point. Can someone explain to me this concept in a simple way?Thank you so much!

Hi, I was trying to create dedicated HA management port for the firewall cluster but "mgmt" wasn't listed as option under HA config. Could you please advice if i have missed any configuration here.# showconfig system interfaceedit "mgmt"set vdom "root"set ip x.x.x.x x.x.x.xset allowaccess ping https ssh snmp fgfmset type physicalset dedicated-to managementset role lanset snmp-index 2nextendFW01 (mgmt) # endFW01 (global) # config system haFW01 (ha) # set ha-mgmt-status enableFW01 (ha) # config ha-mgmt-interfacesFW01 (ha-mgmt-interfaces) # edit 1new entry '1' added# set interface<string> please input string valueha interfacenpu0_vlink0 interfacenpu0_vlink1 interfaceport1 interfaceport2 interfaceport3 interfaceport4 interfaceport5 interfaceport6 interfaceport7 interfaceport8 interfaceport9 interfaceport10 interfaceport11 interfaceport12 interfacex1 interfacex2 interface# set interface mgmtnode_check_object fail! for interface mgmtAppreciate your response. TIA :) 

hi,i plan to configure SNAT in a FG with multiple VDOMs.i currently have the "internet VDOM" topology wherein "internet" VDOM act as our internet edge device and all downstream VDOMs will connect/flow through it to go to the public internet.my question, if i create a FW policy WITH SNAT in "VDOM-1", do i also create FW policy WITHOUT NAT in "internet VDOM" for traffic flow continuity?   

I have two phones that are not registering with Fortivoice that are behind a site-to-site IPSEC VPN. The reason in Wireshark is. I can ping both sides with no problem and the DHCP option 66 is configured.  There not much information about this in Google or any other documentation available. I hope anyone can help Spoiler (Highlight to read)NOTIFY sip:MACd476a0f758ce@xx.xx.xx.xx(Phone IP) SIP/2.0Via: SIP/2.0/UDP xx.xx.xx.xx:5656(FortiVoice IP);branch=z9hG4bKbK4f1731334589;rportRoute: <sip:MACd476a0f758ce@10.100.101.201>Max-Forwards: 20Contact: <sip:xx.xx.xx.xx;transport=UDP;handler=dum>To: <sip:MACd476a0f758ce@xx.xx.xx.xx>;tag=e9b466de-2d30-48e6-80c1-d33fc386c2adFrom: sip:MACd476a0f758ce@224.0.1.75:5060;tag=888888286Call-ID: 9c0ee096-b8a6-472a-ade1-66fa8cfb4affCSeq: 286 NOTIFYContent-Type: application/urlSubscription-State: terminated;reason=timeoutUser-Agent: FortiVoiceEvent: ua-profileContent-Length: 37NOTIFY sip:MACd476a0f758ce@xx.xx.xx.xx(Phone IP) S

Hello, good evening from here. Please, for days now, I've been struggling to setup the FortiEMS license, and honestly I'm feeling like giving up. I don't know if anyone will be kind enough to assist me through, and I'll greatly appreciate it. Thanks 

Hi All,i need to connect two building with FortiAP outdoor (Distance = 100M).Which FortiAP model should I choose? Thanks

Hello a far more general question As I hone my expertise in this tool,  what is the  threshold for how long it has been since a file is received? Do I wait a certain time?  what are others doing to handle general critical states that can show up in the health column as it goes red? I often times see these red alerts then go greenafter a time, but what is a safe time to wait, once they hit these threshold? Thanks in advance,Karl.

I am trying to create software switch and bind the SSID to tunnel wireless traffic. As I read, it is required to have software switch to perform internally pass traffic between VLANs. However; I have uplink ports added to 803.ad as aggregate links to the switches where access points are plugged in.  When I create an interface as software switch, I cannot add the ports that was already added to Fortlink as management therefore I cannot add the ports which already added to Fortilink to the software switch as member interfaces also to pass traffic to the SSID, do you know it is possible in any way to accomplish this add ports already in 803.ad aggregated link? 

Hi All, I have dual wan setup on my fortigate. Is there a way to set the "WAN IP" in the system information that always uses wan1 or wan2 ip? Thanks regardsJimmy

How can I extract the existing logs from a fortianalyzer version 7.4.4 to CSV? They are asking me for the last 90 days for a particular analysis.Within the team there is an adom who receives the 4 fortigates and it is required to obtain this information from all of them.I tried to do it Through API but the documentation is limited,Has anyone achieved it?I don't know if the logs already existing on the computer could be converted to csv in any tool?

Dear Members,I work in a support team at our company, and we have been facing the following problem:Users must change their Active Directory passwords on a company computer when the password expires or if they forget it.After that, users work from home on their personal computers and must use the VPN with the FortiClient.In this situation, they cannot access the VPN because the Windows certificate has saved the old password.To resolve this, we need to update the certificate.Is there any way to minimize support efforts? For example, could FortiClient prompt the user for the new password, or could the certificate be deleted when this issue occurs?Thank you in advance.

We got a team who manage the content of our corporate website. And everytime the push or publish their design/changes via wordpress. The fortiweb detected it as XSS.Is there a way to exempt the user ip source for any XSS detection or any better approach to fix this.FortiWeb 

Hi, I have problem with reseting FGT 200F. FortiGate-200F login:username: maintainerpass: bcpbFG200FT*********not works, I receive message "Login incorrect" When I press button, it just goes reload.I don't have forticloud. How can I reset it?please help.

Hi, I'm using fortianlyzer and have a question during dataset creation for report output.I wrote the query below to create a forticlient uuid for the logged-in vpn user and it works fine.Below is an example of a table made of query statements and queries. - select user, fctuid from $log where $filter and ( ( ( lower(logid) = lower('0107045124')))) Here, the user name is different, and I want to put a condition so that only the same line with the fctuid value is output, but it doesn't work well  GROUP BY fctuidHAVING COUNT (DISTINCT user) > 1 I tried adding this section but it doesn't work well.

I recently required a factory reset on my cell phone. Soon after I realized I could no longer login to my Fortigate. The problem was both of my logins were protected by Fortitokens. I contacted support and they informed me all I could do was a factory reset of my Fortigate. I did not want to rebuild the Fortigate config from scratch. After some thought I started to look at my backup config files. I was fortunate to have a current backup of the config file of my active Fortigate, which I could just use, but I would be back in the same boat. Fortunately, I have a second Fortigate that is inactive. Using it and looking at an older backup that still had the default admin user info, I copied that information and pasted it into the current backup. This took a couple of attempts to restore the modified config file to the inactive Fortigate. Once I completed it successfully, I was then able to login using the old admin user. Once login I was able to remove both Fortitokens from the active user

I configured the SSL VPN and the clients can ping and access all the internal LAN but the internal LAN cannot ping, controls the VPN Clientsmy FortiGate is 100F with firmware version of FortiOS v6.4.15 build2095i do policy like the following screenshot: 

Hi there,I'm getting the errors "-5052" and after updating from 7.0.x to 7.2.x it's "-5053" when trying to connect using the FortiClient VPN on a Windows 11 machine. I verified login data, deactivated 2FA temporarily. Other machines / clients (even on Win11) do not have this problem.It is, however, possible to connect from the same client using the local admin account, so maybe something in the profile is broken. I tried as suggested in this thread:Steps to troubleshoot the FortiClient VPN connection issue:Verify network connectivity.Check VPN server settings in FortiClient.Disable firewall and antivirus temporarily.Update FortiClient to the latest version.Flush DNS cache using the command "ipconfig /flushdns".Remove any conflicting VPN or networking software.Contact Fortinet support for further assistance (couldn't provide a solution either).In addition I tried removing %localappdata%\Forticlient\ as suggested by a user, but this didn't affect anything. I did record logs, se

Hello, I'm facing a trouble with setting up the LDAP authentication: my LDAP server seems to be well configured, Connectivity and User Credentials works from the GUI.From console, I try: diagnose test authserver ldap "LDAP TEST" ldapreader password diagnose test authserver ldap "LDAP TEST" myaccount password ldapreader is the username setted for the connection to LDAP, myaccount is my username.Each time I get : authenticate 'account' against 'LDAP TEST' failed! (account is the account I test) I'd tried many settings for the User group, adding my user (from ldap) or adding a remote group in which I am, it doesn't work. Product: Fortigate v7.4.4   

I have abit of a dumb question doesn't forticlient update on its own?i had the latest version at the moment that was 7.4.0.1658 now there is 7.4.1 there is no button on forticlient to update directly the client 

Hello everyone,I have a FortiSandbox 2000E appliance with VM license, below is the SKU:(FSA-2000E-UPG-LIC-BYOL) can you confirm me that this license only handles the number of clones up to 20 ?On board the machine I have only Windows 7, 8 and 10 keys after the upgrade in 4.4.6 I can download a WIN 11 but if I wanted to buy the license which SKU should I refer to ? Unfortunately I can find information referenced only for the new Sandbox F and G series

I'm setting up my first webapp on a brand new FortiWeb Cloud.The webapp is going to use the automatic certificates from Let's Encrypt; I also need to setup a very strict Geo IP Block.Turns out that Let's Enrypt is not going to work with that setup, as HTTP requests from blocked countries will be dropped.However, on the Let's Encrypt community someone got a solution:https://community.letsencrypt.org/t/whitelist-letsencrypt-server-ips/215833  How can I implement a whitelist for incoming HTTP request to /.well-known/acme-challenge? Thanks!Marco

I have a forgate 100DI am trying to use the API to create firewall addresses and update a policyI am on firmware 6.2.16 the latest for the 100DI have triedhttp://<IP>/api/v2/cmdb/firewall/address?access_token=<KEY> I get a 200 result but it never adds the address to the firewall  body example{'name': "test_IP_JP",'subnet': "1.1.1.1/32"''associated-interface': "Untrust"} but I get back a GET listing all the addressesfrom the api debug It looks right any suggestions?      

Hello,FortiMail We're using FortiMail in Gateway mode.We want to limit number of emails an user can send.All of the email traffic which gets into FortiMail goes from mail servers.As far I've seen there are only Session limits which I m afraid might block the mail servers instead of users.Any ideas? Thanks in advance.   

Hey,HI if some can point where to configure scenerio where when someone will visit `somewebsite.com` then it will get an error page with information " soory this service isnt avaiable any more".Is it possible to achieve it on WAF without creating another web server where WAF will have to forward traffic?