Solved

I managed to manually install on a PC to test the Persistent Agent. Now I can register the PC but I still have a problem: when I open the browser I get the message that I have to register. Before reaching the registration page I am informed that the connection is not secure. (NET::ERR_CERT_AUTHORITY_INVALID).Once I accept the risk I can register. For authentication I use the domain user.I also find log messages in the Persistent Agent logs:2024-10-28 09:59:17 UTC :: peer CommonName = bradfordnetworks.com2024-10-28 09:59:17 UTC :: Checking Peer name fortinac.mydomain.com against Common or Subject-alternative-name entry bradfordnetworks.com2024-10-28 09:59:17 UTC :: Peer name "fortinac.mydomain.com" doesn't match "bradfordnetworks.com"2024-10-28 09:59:17 UTC :: Refusing to connect to trust_DISTRUSTED fortinac.it-present.com|bradfordnetworks.com|09:6e:cf:15:bd:ea:b9:1e:26:21:75:d5:86:9a:8e:37:15:f5:d4:a92024-10-28 09:59:17 UTC :: Connection failed! 1I installed the certificates as trusted

Hi,A few months ago we acquired a new customer that we have to manageTheir current Forti EMS version is 6.4.7I have read the necessary articles regarding upgrading from version 6.4.7 to 7.4.0It is a challenge to upgrade de EMS server, and all clients(workstations and servers) to version 7.0.11, then 7.2.4 and then 7.4.0.Wouldn't it be more convenient in this case to install/configure a new EMS 7.4.0 server?Then uninstall the old client and install the new clients.I am not (yet) familiar with the EMS tooling, so I do not know what the (im)possibilities are.And what about the license for temporarily having 2 EMS servers?I look forward to receiving advice.RegardsSteve

I want to check the IP address of the sender so that it is not blocked by the policy of the security device up to the proxy server.The following settings are included in order to use a proxy server when updating signatures or renewing licenses.At this time, which source IP address should be used for packets originating from Fortigate?Is it the Mgmt port? Or is it an interface for data communication close to the proxy server?config system autoupdate tunnelingset status enableset address “10.**. **. **” ⇒ IP address of the proxy serverset port 8080 

Myntra , refund money you should immediately contact Myntra's customer support: O-972-573-0058 and (available 24/7) report …

To Refund money from Ph0nepe for a wrong transaction, you should (immediately) contact customer support:081- 278√O2 259 (&) (available 24x7)call me..

Issue Description- A single launcher in FortiPAM can utilize multiple ports simultaneously- This launcher does not accept any additional parameters during executionConfiguration QuestionWhen a single executable (e.g., A.exe) needs to use multiple TCP/IP ports simultaneously (such as ports 2002 and 2007), how should the launcher and template be properly configured in  Technical ContextThis scenario involves:One launcher executable file (A.exe)Multiple TCP/IP ports (2002, 2007)No parameter input functionalityNeed for proper FortiPAM configuration settingsPlease provide guidance on the correct configuration approach for this multi-port launcher scenario in FortiPAM.

Hello Expert,I  enabled two factor authentication  on my remote ssl vpn configuration  (firmwave 7.2.9 build 1688 (mature) When I  simulate test with a user  gmail account, i am not receiving and activation code . I humble request some help with this issue. Thank you Regards    Please attachment for user setup and errors message gather from FortiGate logs

Good night! Is there a way I can activate my physical interfaces without having to go to the site?  

Hello, I just want to ask if it is possible to override Fortimanager sdwan template. Network connection changed and I have to change healt-check IP for one device. In device group is multiple devices so I have to make change only for one device. If it is not possible what is the best way to deal with this situation ? Thank you RegardsPeter 

Hi all, I have a setup with Fortiauthenticator (v6.6.0) and Fortigate 401F (v7.2.9), where FAC is fed by an openLDAP, and I use remote user sync rules to add users to groups created of FAC. The thing is, I have several groups created on FAC, however the users can only connect to VPN if they are in a specific group (regardless of which group they belong on openLDAP). I don't have any filters on the FAC policy.This happens with, and without token.I know that the problem is not related with the password. Logs of the user connecting succefuly: ESEnfC-1 # [3592:root:1c23e]allocSSLConn:310 sconn 0x7f201b4e7000 (0:root) [3592:root:1c23e]SSL state:before SSL initialization (*.*.*.*) [3592:root:1c23e]SSL state:fatal decode error (*.*.*.*) [3592:root:1c23e]SSL state:error:(null)(*.*.*.*) [3592:root:1c23e]SSL_accept failed, 1:unexpected eof while reading [3592:root:1c23e]Destroy sconn 0x7f201b4e7000, connSize=1. (root) [3593:root:1c23e]allocSSLConn:310 sconn 0x7f201b4e780

I purchased a 100F firewall and three 248E-FPOE switches.How can I connect the devices together giving 2Gbits of bandwidth to each switch.I can aggregate the ports but how can I separate three FortiLink interfaces for the three switches. ??I'm missing this step. Why does it seem to me that the FortiLink interface is always and only one?? Or am I misunderstanding something??

My setup is that of your traditional legacy WAN hub (data center) and spoke (branch sites). Currently, my only Internet access is at my data center. Even though they are on private WAN connections, the branch locations' connection to the WAN is via FortiGate (for traffic inspection purposes away from the data center). I am in the process of adding Internet connectivity to each of these branch sites (will also add secondary Internet connectivity at the data center as well in the near future). I have a fair grasp of what needs to be done and following the hub/spoke guidelines in the SD-WAN Branch Deployment Guide documentation; however, what I am missing is process/procedures or caveats in migrating an existing used interface over to a new zone. So what I mean is, if I have my existing interface in a WAN zone and policies are applied to that zone, will I be able to easily move that interface to the new SD-WAN zone? I know I cannot do anything with the interface while it references s

Hi, I want to connect to my Fortigate using its hostname via SSH with PuTTY. However, the documentation only mentions establishing a session via IP address and whenever I try to connect by writing the hostname in the Hostname (or IP address) field, it gives me the error host does not exist. Session is established successfully without any errors if I use the the MGMT port's IP address instead.

Hi,I've set the Data Policy for my root ADOM to 120 days for Analytic logs. All my Fortigates are in that ADOM. However, when I view the logs, there are only logs available for the last 61 days. It never exceeds 61 days plus a few hours, even though the ADOM root has 40 % of unused storage. The analytic / archive ratio is set to 75 / 25. Do you know what I'm doing wrong? I'd expect it to fill the storage until it's full or the data policy is met but it doesn't do any of that.I also tried rebuilding the SQL DB. It seemed to be working at first, since logs for analytics reached 61 and 20 hours but after 00:00, it reset itself to 61 days and 0 hours. After the rebuild it freed up some space and ADOM root now even has 55 % of unused storage but is stil not logging according to the policy. Thanks in advance

Hello, I am currently attempting a deployment for new Windows 11 PCs; these machines are equipped with Sierra Wireless EM7511 WWAN cards / modems using AT&T physical SIMs. Our deployment requires a split tunnel, using both Netmotion NetMobility Client and Forticlient VPN simultaneously. Over the past weeks we have had nothing but issues, both Windows 11 and Windows 10 based machines (same physical hardware) BSOD / BugCheck a short time after connecting via FortiClient. Initially we were concerned that this could be a Sierra Wireless issue, so as a temporary solution we tested USB modems. These modems perform well until the machines are connected to Forticlient; Once connected within 30s - 5 minutes the USB modem will restart / disconnect albeit no BSOD. This behavior is repeatable and occurs only when Forticlient is connected regardless if NetMobility is connected or disabled. It appears that for some reason when Forticlient is active it causes modems, whether USB or inte

Hi,When SSL-decrypted HTTPS traffic is sent to a mirror port and analyzed using Wireshark on a server connectedto that port, unusual packet patterns are observed.     wan port IP : 1.235.10.153destination IP : 54.84.14.5source IP : 172.30.0.162 It seems like there is wrong with hand shake process, and when I monitor this traffic with Zeek, either the request body or the response body always shows 0. Is there something wrong with my FortiGate configurations, or is this expected situation for mirrored traffic?I need your assist. Thanks.

Im using Fortigate 50E with Firmware FortiOS 6.2.16.FortiOS 6.2 is EOS but Fortigate 50E still supported until 2027 march, what's the reccomendation, should i upgrade my hardware? or it's secure enough?

Dear all,I'm following the guide in order to setup for the first time the FortiClient EMS with my existing architecture ( FortiGate + FortiAuth).  In the docs (https://docs.fortinet.com/document/fortigate/7.2.5/ztna-deployment/374384/connect-the-fortigate-to-ems) is telling that: 1- I need to generate a cert. By i do have already EMS Server Certificates (FortiCare). Do i need to generate again using a third party such as godaddy since i do not have an CA ? Or this are the defaults one ? 2- How i can publish in the DMZ the FortiEMS ? Thank You in advance#FortiClientEMS 

HI, I am planning to move my FortiGate SSL VPN to an external DHCP Server and have the following plan using a loopback interface following the FortiGate document link below. I am unsure if my plan will work and if I have the correct Firewall Policies etc, does it look good? https://community.fortinet.com/t5/FortiGate/Technical-Tip-SSL-VPN-with-external-DHCP-Server/ta-p/215644 

Hello  I would like to know how does the FortiNDR VM  respond after it detects malware ? Can the FortiNDR clean the malware files on its own ? or it just detects the malware Thank You

Let me start by saying I'm not the network guy, I'm more of the endpoint guy. But I'm also kind of the security guy (IT department is, well... lean). With that being said, on more than one occasion now, I've noticed that we were exposing things we shouldn't via Shodan. We own a block of public IP's. One was the login page to a critical internal service. Another was a recursive DNS server and port 53. The former was an accidental misconfiguration that I brought up and was fixed (looking at the logs it was getting hammered with brute force attempts, as you would expect). The latter, the network guy just didn't know it wasn't a good idea. I don't pretend to know everything, so I'm just hoping for a reality check on what we still have exposed across multiple public IP's. We have a FortiGate. We have VPN setup. It requires MFA. I believe it's L2TP with IPsec. Ports 1701 UDP and 179 are exposed across multiple public IP's that we are using. On Shodan, for 1701, it says so

Ive been trying at this for awhile and cant wrap my head around the problem.  Im trying to go from ssl vpn to vlan100Fortigate sees vlan100 in the routing table. It has a firewall policy allowing it.  yet the policy match tool and debug shows it going to the implicit deny policy  What else am I missing?

Our firewall (FortiGate-500E v7.0.14, build0601) is currently experiencing issues with upgrading to newer firmware versions. There are two options available: versions 7.2.7 and 7.2.8. However, the release notes for version 7.2.7 indicate a bug affecting IPsec tunnels, while version 7.2.8 has a known issue with routing and SD-WAN How should I determine the most suitable version for the upgrade?known issues: 7.2.7 -->> https://docs.fortinet.com/document/fortigate/7.2.7/fortios-release-notes/236526/known-issues  known issues: 7.2.8 --> https://docs.fortinet.com/document/fortigate/7.2.8/fortios-release-notes/236526/known-issues    

To a Virtual Server is it possible in Load balancing method selecting "HTTP Host" and "Round Robin" at the same time?As it is now with "HTTP Host" it looks like it uses Static with the 2 Real Servers. 

Hello,I now have new parser. When I go to the Admin -> Device support -> ParsersI can see my parser I try to check the box in the Enable columnit then opens the parser window showing the code. Here you can see the Enable state is checkedIf I pick Validate it validates if I select Test it tests successfully. if I select Save it says parser not validated or test failed which makes no sense. If I select cancel it just take me back to the list view of parsers.it is stuck in some kind of loop, there is no way for me to enable the parser , I cannot get to the Apply option.also if I start in the list view and select Edit it takes me in the parser code where again I select validate and it validates and then I select test and it tests successfully, but Enable is greyed out via this menu path that I take.