Solved

    Does the VLAN switch work in software or hardware?I do not seem to have the hardware switch option when attempting to create interfaces.

Hello, we have a Fortigate v7.0.7 and we dial into the company via vpn from Windows, Mac, Android, iPad, iPhone.An internal dns server is specified in the ssl vpn settings. There are different zones/domains in our internal DNS.For example:myfirma.lo (that's the name from our internal AD)somethingother.detest.blubber...If we make an vpn-connection (with FortiClient) from Windows, Mac or Android, all these zones/domains can be resolved to ip addresses. I test that with ping or nslookup.For example:ping hosta.myfirma.loping hostb.somethingother.deping testhost.test.blubber...No matter what I take, I get an ip address back everywhere. From iPad and iPhone (also with FortiClient) just the zone myfirma.lo works. All other zones/domains cannot be resolved.If I ping, for exampleping testhost.test.blubber I get "Can't resolve host" So I think, that's a problem with IOS. What can I do? Thank youGreetingsAlbertMin

Hello,I bought the F60 firewall where can I create a registration to register this firewall to upload the license and everything , where can I also register to open a call at forigate ?

We have 2 fortiswitches for wireless AP's 1 switch is installedWhen i come to installing the second switch, I just want the same VLAN's available for the WIFI.Is this achievable?Do I just create the same VLANs? I have a feeling it will tell me they are already in use. I read about Subnet overlap....is this something I need to enable? Thanks

Hello, while testing in our system I noticed that PowerShell and Sysmon events are not arriving in the SIEM system. Other events such as Windows Event ID 4624 arrive without any problems. The template is defined for the PowerShell events Microsoft-Windows-PowerShell/Operational and Windows PowerShell. The local security guidelines are also set. I'm using Windows Agent 7.2.2. What am I doing wrong? Best Regards

Dear all.   After upgrading to version 7.4.4 we experience massive performance and handling issues. Can anyone of you confirm this?   What I can see among other things are the following facts:   When adding new entries to an already existing address group the entries in the group are sorted alphabetically the entries on the right which I want to choose are not. They are sorted by creation. So new entries are at the end. When adding new entries to a already existing address group the entries on the right I want to add are only loaded when I scoll down and this takes very long. It is like only 30 entries are loaded and the others are not. They will be loaded only when I scroll down to the end. We use hundreds and thousands of entries and the scrolling for new created entries takes minutes now and not only 1-2 seconds like in version 7.4.0. In 7.4.0 just all where loaded directly and I was able to scroll down to the end immediately. The country database in order to block I

Dear Fortinet Community. I would like to go on hardening our SSL VPN access by using Client Certificates and I have several questions for my understanding that I cannot explain myself as I have no test environment and so I thought... Why not ask the professionals here in the forum that helped me in the past perfectly. :) Our environment:Fortigate (newest update installed)SSL VPN in tunnel modeFortiClient VPN will be used for SSL VPN connectionsUsers will authenticate via Active Directory (LDAP Server) What do I want to do? I want to enable Client Certificates. See here in the picture from Fortigate Demo Access:So what are the prerequisites for such a Client Certificate? These are my questions for understanding. Is the client certificate only connected to the server certificate used for SSL VPN?Can the client certificate be a certificate from another/internal root CA that we use internally from a Windows environment? And if so, does the server certificate must be iss

Dear Fortinet Community. We have upgraded our Fortiagte 100F from version 7.4.0 to 7.4.4.After that when I open the configuration of a SSL VPN Portal the following error message appears on the top right corner: this.portal.$schema.children is undefined.It looks like this:Has anyone of you ever experienced such an error message or probably know a solution for it? it always comes again with every portal we have defined. it dissapears if I close the error message but comes back when I restart my browser (cookies deleted etc.). Any answer or hint is much appreciated. With kindest RegardsFortiLover :)

Dear Fortinet Community. I have a question regarding the creation of triggers when it comes to a violation against our Application Control. Means we have blocked a specific Category in the Application Control settings. And if a person wants to use this Application from the category it gets an answer (shown as webpage while surfing) from the fortigate that the use of this applicaion is against internet usage policy. It looks like this: Now I would like to create an e-mail notification via Security Fabric -> Automation. I cannot find a trigger for that event. Can anyone help me to setup such a Stitch or Trigger? Model: Fortigate 100FVersion: 7.4.4 With kindest regardsFortiLover

Dear FortiNet Community. We use AutoDesk AutoCAD Version 2020. When we start the program it cannot start and tells us that it needs an internet connection. I have found out that it works when I remove antivirus scanning from the firewall policy rule that refers to internet connections. Have you experienced a problem like this? FortiGate does not have so many settings within the AntiVirus profiles... I have tried alot now. But it is always the same. The software works without AntiVirus Security profiles but not with. Has anyone ever experienced something like this? With kindest regardsFortiLover

Dear Fortinet Community. We have upgraded our Fortiagte 100F from version 7.4.0 to 7.4.4. After that it seems so that users which we have defined to get mails for 2FA when connecting to SSL VPN will not receive emails with the 2FA code anymore. Other emails for triggers for instance still work. So it does not seem to be a mail account issue. But the emails with the 2FA code will not be sent anymore. I have created a testuser in order to check it. Mails will not received and they are not in SPAM or Quarantine or so. Does anyone of you have ever experieced this? Or probably know a solution for this circumstance? Any answer or hint is much appreciated. With kindest RegardsFortiLover :)

Hi FG-OT adminsIn OT security study guide, page 39, Asset Identity Center,When we organize the devices in their corresponding levels (Perdue Model), does it actually have any added value on how the traffic is filtered or how it is monitored or whatever?

Hello. We are planning to implement #FortiPAM through a Korean vendor and have a few questions regarding its compatibility with custom applications. Our network environment consists of separate IT and OT (Operational Technology) networks, controlled by firewall. While we understand that #FortiPAM can easily register and manage known applications and ports (such as MS SQL with port 1433), we're curious about its capability to handle custom-developed, private applications. Specifically:Is it possible to register and manage custom-developed applications in #FortiPAM, similar to how we would with well-known applications?We have a use case where a user in the IT network has developed an automation program to retrieve and analyze data from the OT network. Can we register this custom automation program in #FortiPAM?If custom application registration is possible, can we also specify and manage the specific ports used by these applications through #FortiPAM?Are there an

I have Fortigates in Azure deployed as per below scenario: Active-passive with external and internal Azure load balancer (LB) Can session synchronization happen between Fortigates? If YES how? If NO Why? 

Hello all,The past night Forticlient 7.0.1 update was pushed via EMS and now inside of Defender we are seeing multiple endpoints reporting that: Defender detected and terminated active 'Trojan:Win32/SuspServiceBin.A!cl' in process 'FortiClientSetup_7.0.1_x64.exe' It is also saying that:FortiClientSetup_7.0.1_x64.exe - 'SuspServiceBin' malware was detected and was active I know I can whitelist what I need to in defender, but I want to know if anyone else has come across this/seen this to get a better understanding as to why this would be. 

Good morning all,I am running into an issue where our Fortigate's firewall policy is blocking employees from logging into ticketmaster.com When they try to login they are met with a screen that says: Your Browsing Activity Has Been Paused We've detected unusual behavior on either your network or your browser.To resolve this:Sign in to your Ticketmaster account if you haven't alreadyChange your Wi-Fi or cellular networkSwitch devices or move to a different location if possible I have attemtped to add a policy rule that will stop all traffic from our lan to the wan with a destination of ticketmaster.com from being scanned by the various services, but it does not seem to fix the issue. Has anyone else ran into this? Or do you have another idea I can try?Thanks so much

Greetings, community. I hope you are doing well. I am trying to reach a Fortigate 80F through the LINKDDNS, but I am unable to access the device. However, when I ping the public IP and the LINKDDNS of the device, I do not experience any packet loss.

Our recent vulnerability scan has pointed out we need to set timeout outs for:- console sessionsSSH HTTPSadmin services Looks like this has to be done through the CLIHave viewed some documents but is there a way to set them all to the same time? Thanks 

Hi, I'm configuring my first FortiNAC.I manually installed the Persistent agent on a test PC (OS Windows 11), according to the instructions found in https://community.fortinet.com/t5/FortiNAC/Technical-Tip-Manually-install-and-configure-Persistent-Agent-on/ta-p/191164It seems that the agent does not communicate with the Fortinac.From the PC, telnet to eth1 fortinac on port 4568 is ok.In the %ProgramData%\Bradford Networks folder I do not find any log files. As suggested I reinstalled the client but without success. Icon of Persistent agent say: Network access normal. PC is viewed as rogue. Could you help me? Thanks in advance.

Hello ,  I have DC agent installed on the Domain Controller, and FAC debug indicate that it's getting the user and workstation details, but that it cannot resolve the DNS name for the workstation domain error below from FAC FSSO debug ( FAC is acting as collector agent ) any ideas or tips on where to look?the workstation domain name is like mydomain.subdomain.local, so I have added subsomain.local to the DNS suffix in the DC agent config page, but still with no luck. appreciate anyone's help. Thanks01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded workstation: WKS0101/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded domain: MYDOMAIN01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: decoded user: userx01/21/2022 15:32:04 [F4555555] DC/TS Agent [DEBUG]: has 0 ipv6 address01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: cannot get DNS name of domain MYDOMAIN from Domain Manager01/21/2022 15:32:04 [F4555555] DC/TS Agent [WARN]: Failed to decode DCTS

Hi All,My case is that our branch company will be closed. Valuable assets may be transported to ourheadquarter in another country. Is there any limitation if we move our  firewall to another country? If we are going to buy new license, who should we buy from? The original seller or the seller in another country? Looking forward to your answer. Thanks.

Hello community,I need yours help, when i make FortiGate-VM64-AWS (interface) #edit port1  set mode dhcpthen i getting this errorThis interface is being used by one or more dhcp servers.attribute set operator error, -236, discard the settingCommand fail. Return code 1

hi,i recently did a HA firmware upgrade following an upgrade path.the selection of HA primary kept changing due to high uptime.my question is, do i need to keep "forcing" back HA to original primary or just proceed to upload the firmware on the current primary (secondary unit).the serial with 795 is the original primary/active and 836 is the secondary/passive. # get system ha statusHA Health Status: OKModel: FortiGate-xxFMode: HA A-PGroup Name: xxFW01_CLUSTERGroup ID: 0Debug: 0Cluster Uptime: 264 days 9:33:6Cluster state change time: 2024-10-03 15:04:23Primary selected using:<2024/10/03 15:04:23> vcluster-1: FGxx836 is selected as the primary because its uptime is larger than peer member FGxx795.<2024/10/03 15:01:40> vcluster-1: FGxx836 is selected as the primary because it's the only member in the cluster.<2024/10/03 15:01:31> vcluster-1: FGxx836 is selected as the primary because UPGRADE_SECONDARY flag is set on peer member FGxx795.<2024/10/03 14:59:19> v

Hi, I have to import rules to a production SIEM.  Many of these rules contains a eventType IN (Group@PH_SYS_EVENT_Group). We have noticed those conditons are broken when imported in the new SIEM and we have to remap them manually to the event type group. My question:  Is there a quicker way to make those statements working? Thanks,

Hi everyone,I`m new to forum :)My question is:Is there a way to drop (not block) external traffic into my WAN without logging it?By country or by IP range or single IP?The goal is to block certain IPs so they can't even port scan my firewall.I can`t find too much apart from Deny ipv4 policy which still logs everything.I have Fortigate 60F.Thanks