Fortinet Community

Unable to access Fortiguard servers since a few days - FW40F - v7.2.10 build 1706

Hi everyone,Since a few days FW can’t access the servers and we’ve lost our access for a few users (with quota, app and YT supervision). Licenses are up to early 2027.I noted the firmware was coming to EOS on 10/01. I followed the troubleshooting tip

171

I

2 hours ago

MohammedBahjatExplorer

FortiEDR Communication Control causes Kubernetes cluster outage

Hi Everybody,We are running a Kubernetes cluster on Rocky Linux 10.2 VMs, with the FortiEDR Linux Collector installed on the host OS.When FortiEDR Communication Control was changed from Simulation to Prevention, the entire Kubernetes cluster became u

501

4 hours ago

jinhaNew Member

Advice migrating from 60E to 70G

HelloI've been tasked with migrating from a 60E to a 70G.7.4.12 to 7.4.12A backup and a read-only user in the 60E was given to me.I've participated in this procces before but now i'm alone.Any usefull advice?

70

7 hours ago

SubjectNameNew Member

FortiClient EMS auto-registration and multiple-user computers

I need to configure our environment for both single and multi-user, domain and workgroup (personal) computers.. Ideally we want absolutely no user interaction required for the shared domain pc's, at any point. These are EntraID or hybrid-joined, mana

60044

B

8 hours ago

PaolGrazStaff

FortiSwitch

Troubleshooting Tip: Cisco switch portchannel in the ERR-DISABLE state when connected to MCLAG peers

Description This article describes that by default, both MCLAG peers send BPDUs to the third-party switch connected via a LAG / portchannel.   The BPDUs frames are sent with different source MAC addresses (one for each MCLAG peer) and this i

58281

14 hours ago

FortiKoalaStaff

Technical Note: SNMP ifDescr missing in FortiOS 5.4

DescriptionWith FortiOS 5.2, and lower the "ifDescr" OID is systematically filled in with the interface name. This behavior was not compliant as per RFC 1213 that states: "ifDescr should be filled in with a textual string containing informatio

67051

19 hours ago

amatosStaff & Editor

FortiClient

Troubleshooting Tip: Error while installing FortiClient version 7.4.3 in Windows ARM

DescriptionThis article describes an issue while trying to install the FortiClient version 7.4.3 on a Windows ARM. If the user uses an .exe file, it may present a message similar to the following, stating that the Setup Wizard ended prematurely becau

43792

22 hours ago

shahzebStaff

Troubleshooting Tip: Network Access Policies not matching LDAP user while RADIUS logs display 'anonymous' for the username

DescriptionThis article describes how to resolve issues where network access policies fail to match LDAP groups and instead hit unauthenticated policies in FortiNAC.ScopeFortiNAC or FortiNAC-F.SolutionBehavior:Check the radius logs under Network -&gt

140

milenikStaff

Technical Tip: Comparison of ADVPN with BGP on loopback over BGP per overlay

DescriptionThis article describes the differing benefits of using BGP on loopback and using BGP per overlay.ScopeFortiGate 7.0 or higher.SolutionBGP over loopback – advantages:Decouples BGP from individual IPsec overlays: BGP peering is established b

240

shahzebStaff

Troubleshooting Tip: FortiNAC is sending incorrect VLAN to Extreme AP in RADIUS response

DescriptionThis article describes the integration issues with Aerohive/Extreme Wi-Fi integrations. Users experience issues with the FortiNAC sending an incorrect VLAN in response to the Extreme AP's RADIUS request.ScopeFortiNAC-F v7.6.7.SolutionForti

90

Sylvain92Explorer II

Unable to access Fortiguard servers since a few days - FW40F - v7.2.10 build 1706

Hi everyone,Since a few days FW can’t access the servers and we’ve lost our access for a few users (with quota, app and YT supervision). Licenses are up to early 2027.I noted the firmware was coming to EOS on 10/01. I followed the troubleshooting tip

171

I

2 hours ago

jinhaNew Member

Advice migrating from 60E to 70G

HelloI've been tasked with migrating from a 60E to a 70G.7.4.12 to 7.4.12A backup and a read-only user in the 60E was given to me.I've participated in this procces before but now i'm alone.Any usefull advice?

70

7 hours ago

SubjectNameNew Member

FortiClient EMS auto-registration and multiple-user computers

I need to configure our environment for both single and multi-user, domain and workgroup (personal) computers.. Ideally we want absolutely no user interaction required for the shared domain pc's, at any point. These are EntraID or hybrid-joined, mana

60044

B

8 hours ago

S

Stefan RaudonisNew Member

DLP Profile file pattern does not work as expected

Hi,a few days we updated from FortiOS 7.2.13 to 7.6.6.Now we can’t download “*.xlsx” files, because our DLP profile is blocking that.But we have only “*.xls” configured for blocking and not “*.xlsx”.When i remove the “*.xls” pattern, we are able to d

593

prestadclNew Member

IPv6 limitation in RADIUS NAS-IP field

Hello Fortinet community,We are trying to connect our Fortigate 100F (7.6.7) to our RADIUS server (Windows NPS) but the NAS-IP of the Fortigate is designed to only accept IPv4 addresses. In our case, the NAS-IP needs to be the gateway of one of the i

512

B

BhaskarDVisitor II

Ipsec Tunnel - Bgp establishment issue

FortiGate-A ↔ FortiGate-B IPsec Tunnel – BGP TCP/179 Return Traffic Not DecryptingHi Fortinet Community,I am troubleshooting a BGP connectivity issue over an IPsec tunnel.Environment:FortiGate-A: FortiGate 60F FortiOS: 7.4.11 GA FortiGate-B: Remote F

2007

Ercan UymaNew Member

Forticlient VPN Connection Time out

I haven’t been able to connect to my company network with Forticlient for the past two weeks. The latest versionof Forticlient vpn installed is 7.4.3 hotfix 1.8758. I keep getting a “connection timeout” error. I tried running it as an administrator,

1356

Dan_CVisitor III

Discovering Wired MAC Addresses From The Air

Hi Fortifiers,I just wanted to do a quick post for the community that I thought might be interesting to some. Many organisations share the same network segment between wired and wireless clients. While this can simplify network design and conserve ad

310

MandalorianExplorer III

How to automatically enable SMS token-based authentication for newly synced LDAP users on FortiAuthenticator

Hi everyone!On my FortiAuthenticator running version 6.6.10, I've connected a remote LDAP server and already imported the first batch of users. As a second step, I've set up a sync rule for it.I'd like to clear up a few doubts regarding the sync rule

442

BusinessUserExplorer

permission denied -455

Permission denied when using ssl user to log in fortigate firewall.What does -455 mean by the way?

38453

Troubleshooting Tip: Cisco switch portchannel in the ERR-DISABLE state when connected to MCLAG peers

PaolGrazStaff

FortiSwitch

Description This article describes that by default, both MCLAG peers send BPDUs to the third-party switch connected via a LAG / portchannel.   The BPDUs frames are sent with different source MAC addresses (one for each MCLAG peer) and this i

58281

14 hours ago

FortiKoalaStaff

Technical Note: SNMP ifDescr missing in FortiOS 5.4

DescriptionWith FortiOS 5.2, and lower the "ifDescr" OID is systematically filled in with the interface name. This behavior was not compliant as per RFC 1213 that states: "ifDescr should be filled in with a textual string containing informatio

67051

19 hours ago

amatosStaff & Editor

FortiClient

Troubleshooting Tip: Error while installing FortiClient version 7.4.3 in Windows ARM

DescriptionThis article describes an issue while trying to install the FortiClient version 7.4.3 on a Windows ARM. If the user uses an .exe file, it may present a message similar to the following, stating that the Setup Wizard ended prematurely becau

43792

22 hours ago

shahzebStaff

Troubleshooting Tip: Network Access Policies not matching LDAP user while RADIUS logs display 'anonymous' for the username

DescriptionThis article describes how to resolve issues where network access policies fail to match LDAP groups and instead hit unauthenticated policies in FortiNAC.ScopeFortiNAC or FortiNAC-F.SolutionBehavior:Check the radius logs under Network -&gt

140

milenikStaff

Technical Tip: Comparison of ADVPN with BGP on loopback over BGP per overlay

DescriptionThis article describes the differing benefits of using BGP on loopback and using BGP per overlay.ScopeFortiGate 7.0 or higher.SolutionBGP over loopback – advantages:Decouples BGP from individual IPsec overlays: BGP peering is established b

240

shahzebStaff

Troubleshooting Tip: FortiNAC is sending incorrect VLAN to Extreme AP in RADIUS response

DescriptionThis article describes the integration issues with Aerohive/Extreme Wi-Fi integrations. Users experience issues with the FortiNAC sending an incorrect VLAN in response to the Extreme AP's RADIUS request.ScopeFortiNAC-F v7.6.7.SolutionForti

90

Technical Tip: How to migrate all FortiSIEM data to another machine

mbenvenutiStaff

FortiSIEM

Description This article describes how to migrate all the data from a FortiSIEM to another machine. Scope FortiSIEM. Solution When there are issues with an initial FortiSIEM machine, the appliance has been replaced because of hardware issues

59171

A

avinash_vStaff

Troubleshooting Tip: FortiSwitch remains Authorized/Down after a simultaneous power-up in a FortiLink split-interface FortiGate HA topology

DescriptionThis article describes how to diagnose and recover a FortiSwitch that remains in the Authorized/Down state after a site-wide power cut in which the FortiGate HA pair and all FortiSwitches power on at the same time. The article focuses on t

760

sprashantStaff

Technical Tip: Unable to see Remote Group option for TACACS+ in a Multi-VDOM Scenario on FortiGate

Description This article describes the configuration of TACACS+ in a multi-VDOM scenario on FortiGate. The user is unable to see the Remote Group Option in the Global VDOM where Administrator options reside, despite enabling TACACS+ under the Root VD

170

J

Jaye17Staff

Troubleshooting Tip: MacOS IKEv2 Dial-up VPN fails with 'Peer Certificate is Invalid'

DescriptionThis article describes an issue with connecting to IPsec Dial-up VPN using a macOS FortiClient. ScopeFortiGate v7.4.FortiClient macOS. SolutionWhen using FortiClient macOS to connect to an IPsec Dial-up VPN using IKEv2 with certificate aut

9341

N