Recently active topics

We have policy to allow all servers access to microsoft then i have a firewall policy and set the destination to all microsoft internet service.However i found some microsoft url still blocked by implicit denied and this mean microsoft internet service not contains all microsoft url. Anyone know how to solve this?  

Hello everyone,Is it possible to configure webhooks in FortiSIEM using a different application type?I wanted to know if FortiSIEM can create or add a new application type outside of the normal selections since I want to use webhooks to integrate a custom application or device.If anyone has experience with this setup or knows the recommended approach, I’d appreciate your guidance.Thank you!Ghada

Hi,I am looking at using a small FortiGate setup on Azure for lab practice. I have found this to be relatively simple and looks like I can use the PAYG model to simply create a VM and use it.What I am struggling with is FortiManager, all the guides indicate a BYOL licence is needed, but during the setup it gives the option for FortiFlex which looks to be the right idea but I have no idea if I can buy a small number of points anywhere or do PAYG… Also this marketplace item exists and I am not sure if this is what I should be using as a way to pay all through Azure? Fortinet FortiFlex Usage-based Licensing - Microsoft AzureI can see this has a purchase option which then gives an option of 1,2,3 years but also it gives the create option which does create a VM?

HI All I need to get some guidance on how we can deploy below network Firewall HA ( 2 LAN port1 and port2 in same hardware switch), Port 1 on both FG connect to cisco switch 1 and cisco switch 2 respectively. Port 2 on both FG connect to cisco switch 1 and 2 respectively alsoCisco Switch 1 and 2 also interconnected(trunk port). Cisco runs RPVST+. Switch1 runs as STP root primary, Switch 2 runs as STP root secondaryAbove topology eventually create loop network. How should it be configured to avoid the loopFortigate hardware switch if disable STP, it eventaally create loop, and broadcast storm starts. Enable STP on FG hardware , eventually the  broadcast stops.  But i found some weird result. When i check Switch2 STP, it blocks the port connect to FG1, but port connect to FG2 becomes root, and forward state. Switch2 can still somehow reach FG IP, the mac-address also shows it learned from port to FG2. But FG2 runs as HA passive state. i try diagnose sniffer on FG2, nothing captured. How

I'm struggling a bit with my performance SLAs and SDWAN Rules. My typical branch office will have 2 internet connections, one is usually better than the other (i.e., Verizon FiOS plus Comcast or true DIA Fiber plus a business broadband).What's the best-practice strat for SDWAN rule? I've been mostly relying on Best Quality rule with a performance SLA that pings Google DNS (8.8.8.8), but I'm seeing more flapping than I would expect.I think my first question is: Do the Performance SLA settings under Link Status (Check Interval and Failure before inactive) affect the SLAs themselves? If I have my latency SLA set at 250ms, is the interface in violation of the SLA the first time if sees latency greater than 250ms or if my check interval is 1000ms and failure before inactive is 5, does it take 5 seconds of 250ms latency to violate the SLA?Any best-practice recommendations on these rules and Perf SLAs? I'm starting to think that Google DNS might not be the best candidate host for my probe. Do

Description   This article describes the steps to configure multiple DNS servers for IPsec dial-up VPN.   Scope   FortiGate.Solution   Note: Up to 3 IPv4 DNS servers and 3 IPv6 DNS servers for dial-up tunnel can be configured. Note: If already having VPN Dialup configured, skip to item 5. 'Configuration in CLI'.   Initial configuration (if having not yet configured VPN Dialup) First go to the menu on the left and start the configuration by selecting: VPN --> IPsec Wizard. In step 1 of the wizard, 'VPN Setup'. Specify the VPN Dialup name to identify the tunnel in the FortiGate. Select the type of template 'Remote Access'. Choose the device/connection type of the user's device to configure settings based on the most popular platforms Client-based: Connection application (FortiClient or Cisco Client).Native: Connection with the device natively (IOS, Android, Windows), without additional applications.   In step 2 of the wizard, 'Authentication'.

I setup a lab environment with a FortiGate evaluation. All good… I needed to blow it all away and start again… I can see the asset in my portal, and I can download the lic file, but on a new install it does not accept it and gives me: Am I missing something here?

Description This article describes an issue that prevents booting the firewall or loading a firmware image and offers a solution. Scope FortiGate v6.X and v7.X. Solution The error appears as one of the following:   Fatal error: Loading FOS fails!  Please power cycle. System halted.   Or:   Fatal error: AV engine file authentication failed!  Please power cycle. System halted.   To solve the issue, follow the steps below.   Note: The following procedure requires a console cable. These actions cannot be performed via SSH or GUI web console, as the connection will be lost during the reboot.   Step 1: Restart the Firewall using the CLI. While the device restarts, press any key to see boot options.   Initializing boot device... Initializing MAC... NP6XLITE#0 Please wait for OS to boot, or press any key to display the configuration menu. [C]: Configure TFTP parameters. [R]: Review TFTP parameters. [T]: Initiate TFTP firmware transfer. [F]:

Why oh why does Fortinet make all this so difficult, it seems like they actually don't want people to even use the trials… I finally have a FortiGate trial VM and a FortiManager trial VM, but can I get them talking? No! Lots of commands that are no longer valid etc... FortiManager reports a probe fail, from online searches, I have tried lowering the encryption settings and allowing VM registration on the FortiManager. I have tried registering from the FortiGate side also.Now it transpires that my FortiGate trial VM does not have the right factory cert because it is does not contain the serial of the virtual appliance, just a generic "Fortinet". I have tried regenerating the certs, tried re-execting the VM commands but it does not accept them either… To be honest it feels like a battle just to make the trials work, which is hardly a good starting point.

Fabric contains a FortiGate cluster and managed FortiSwitches for internal and external purpose. Is there any solution to shut down all the devices from the downstream connected device such as a desktop. As per my understanding, the challenge is the FortiGate is the brain here. so I am facing a chicken and egg problem. Please let us know if there is a good solution for this. Thank you

Description This article describes how to configure ZTNA agentless web portal access with SAML authentication (IdP is Entra ID), including bookmarks for RDP and WEB. Scope FortiGate v7.6.1+. Solution This article provides a step-by-step guide to configure a ZTNA agentless web portal using SAML authentication with Entra ID as the Identity Provider (IDP) . This enhanced ZTNA web portal allows access to protected resources using only a client browser.     The Entra ID enterprise application should be configured previously by including the FortiGate 'Service Provider' (SP) URLs ('http://ztna.fortilab.local:2587/xxxx'). The Entra ID SAML certificate should be downloaded and imported into the FortiGate Remote certificate store. The imported certificate can be renamed to maintain a clean and consistent configuration:   config vpn certificate remote     rename Remote_Cert_1 to saml-ztna-entra end   The SSL server certificate 'ztna.fortilab.local' was

I have guest ssid on the cisco wlc9800 and if there are user want connect to this ssid then the user will authenticate by captive portal with entra id.After the authentication successfull the client should be move from isolation network to guest network, in my case the client was moved to guest network if i see from fortinac policy but the client itself still connect to isolation network.Already ask to cisco support then they said the cisco not receive the coa to change the vlan. Anyone know here how to change thje vlan to teh cisco wlc9800?

Description This article describes the process of installing a FortiOS-VM in the Hyper-V platform for testing purposes with a permanent Trial License Scope FortiOS-VM. Solution To install a FortiOS-VM in a hypervisor platform a FortiCare account is required to download the FortiOS image and apply a license that will be attached to this account. From the support portal select Support -> VM Images, select Product FortiGate, select Platform Hyper-V and download the ZIP file:       Extract ZIP content to a directory where Virtual Machine will be stored and check to make sure it has 3 folders that are standard to Hyper-V implementation: Snapshots. Virtual Hard Disks. Virtual Machine. The snapshots folder does not have any content, while 2 other folders have Virtual Hard disks and XML configuration files.There are multiple ways to import VMs using xml files but in this document, another way is used.   Create a new VM on the Hyper-V management consol

I had automatic updates turned on on my fortigate 60F. After Installation of OS 7.4.12 none of my VPN-Clients were able to login anymore. No idea why. Reverting to 7.4.11 resolved the problem. Does anyone have an idea what exactly caused the problem? I am not an fortigate expert but that a minor update to the os breaks a basic functionality, at least on my device, doesnt make me happy. First thing i learned was turning off automatic updates. But thats not a longterm strategy.  

Hi,One of my clients have sip traffic passing through firewall. When we view forward logs firewall shows lots of logs with "0 Bytes sent/received". What does it mean?. 

Hi, i have a Fortigate 200D Firewall with FortiOS 6.0.16 and a Huawei 4G Webstick Modell 3372h. I can't bring the Connection to the LTE-Network up. I searched around and found this https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-use-Huawei-E3372-h-modem-stick/ta-p/193600 The Problem is, that i have the AT-Command Version of this Stick and this HowTo is for the Web-Interface Version. When i try to configure the Stick as lte-modemdiagnose sys lte-modem infosays, that the Modem is not connected.  So i tried to configure the Stick as "normal" Modem. The Modem itself seems to work properly: diagnose sys modem queryUSB status: Connectedmanufacturer: huaweimodel: E3372IMEI number: 868230032061123SIM state: Validservice status: Valid Servicesignal level: 3/4network name: E-Plusnetwork type: E-UTRANlocation area code:active profile(AT&V):COMMAND NOT SUPPORT^RSSI:18^HCSQ:"LTE",45,47,136,26 But in the Debug Messages a Timout occures (At

DescriptionThis article describes why FortiOS shows an error while trying to access the primary radius server and does not fail over to the secondary server.ScopeFortiOS 7.2.x, FortiOS 7.4.x, FortiOS 7.6.x.SolutionThis issue only occurs on FortiOS 7.2.x. While FortiOS has a radius profile with two servers (primary, secondary), it might not fail over to the secondary radius server, when primary is not reachable.For instance, assume that there are two RADIUS servers from two different destination subnets, which are routed accordingly from tunnel interfaces. There may be a ‘blackhole’ route for the subnet of the primary server. When all tunnels are down, there may be no route to the primary RADIUS server. This exact event does not trigger failover to the secondary RADIUS server.Either of the following error snippets may show in logs:2026-05-21 11:15:32 [1419] fnbamd_rad_dns_cb-10.10.20.76->10.10.20.76 2026-05-21 11:15:32 [1388] __fnbamd_rad_send-Error sending radius request: fd=10, Net

DescriptionThis article describes an issue where, with FIPS-CC mode enabled in FortiGate HA, the System -> HA page fails to load in the GUI on both primary and secondary devices.ScopeFortiGate 7.6.SolutionWith FIPS-CC mode enabled on FortiGate HA, the System -> HA page fails to load in the GUI on both primary and secondary devices.Spoke1-HA1 # get system ha status HA Health Status: OK Model: FortiGate-VM64-KVM Mode: HA A-P Group Name: fortinet Group ID: 10 Debug: 0 Cluster Uptime: 0 days 0h:47m:32s Cluster state change time: 2026-05-18 06:15:32 Primary selected using: <2026/05/18 06:15:32> vcluster-1: FGVMxxxxxxxxx049 is selected as the primary because its uptime is larger than peer member FGVMxxxxxxxxx556. <2026/05/18 05:30:30> vcluster-1: FGVMxxxxxxxxx049 is selected as the primary because it's the only member in the cluster. ses_pickup: disable override: disable Configuration Status: FGVMxxxxxxxxx049(updated 3 seconds ago): in-sync FGVMxxxxxxxxx0

DescriptionThis article describes the high CPU utilization observed when creating or editing a VLAN interface in the FortiGate GUI. The 'httpsd' process consumes high CPU, resulting in interface bandwidth drops and potential traffic impact.ScopeFortiGate-340xE, FortiGate-330xE, FortiGate-110xE, FortiGate-180xF.FortiOS v7.0.x, v7.2.x, v7.4.11, v7.6.6.SolutionReproduction scenario:Create or edit a VLAN interface via the web UI, selecting the parent interface before entering the IP address, with traffic running at approximately 4Gbps or higher. The issue is not observed when performing configuration changes using the CLI. When creating a new VLAN interface via the web UI, the high CPU issue is triggered by a specific operation sequence: click "Add VLAN Interface", first select the parent interface, then fill in the VLAN ID and VDOM, and finally enter the IP address and leave the input field (e.g., clicking other areas or pressing Enter). The issue occurs as long as the parent interface is

Hi all,I have struggled with the above but now have this working on a 61F.However there are a few bits I am still struggling with that I am trying to work out if they are a limitation of Windows or how I am configuring…I need an IPSEC VPN with split tunnelling without requiring:Free Fortinet VPN client due to lack of admin rights External RADIUS/AuthenticationI have got this working using Machine certs as I believe the Windows client requires the use of EAP-TLS for a user account based tunnel which the FortiGate cannot directly achieve by itself?Once I got this working, I then wanted to enable split tunnelling, Windows appears to need DHCP option 249 to send over these routes, but also needs mode-config to assign the IP.I have tried to create a DHCP server on the VPN interface, dummy DHCP servers on loopbacks etc, but cannot seem to get this part working… is it even possible? If I change the IP address mechanism by specifying DHCP the client connects but never gets an IP, unless I enab

DescriptionThis article describes step-by-step instructions to generate a client certificate on Ubuntu 22.04 LTS using OpenSSL, submit the Certificate Signing Request (CSR) to Active Directory Certificate Services (AD CS) on Windows Server 2022, and validate that the signed certificate is correctly registered in the AD CA database. The procedure is used in the context of StrongSwan IKEv2 VPN authentication with FortiGate.ScopeClient OS: Ubuntu 22.04 LTS - OpenSSL 1.1.1CA Server: Windows Server 2022 - AD CS (wellscompany-WELLS-ADSERVER-CA)CA Template: VPN-Client (custom - Subject supplied in request)VPN Context: StrongSwan 5.6.2 - IKEv2 - FortiGate mutual certificate authSolutionComplete Flow:Step 1 - Generate Private Key and CSR on Ubuntu.All certificate generation happens on Ubuntu. The private key never leaves the machine.Create working directory:mkdir -p ~/vpn-cert && cd ~/vpn-certGenerate 2048-bit RSA private key:openssl genrsa -out ubuntu-client.key 2048 ls -la ubuntu-clie

DescriptionThis article describes an issue with connecting to IPsec Dial-up VPN using a macOS FortiClient. ScopeFortiGate v7.4.FortiClient macOS. SolutionWhen using FortiClient macOS to connect to an IPsec Dial-up VPN using IKEv2 with certificate authentication, the error 'Peer Certificate is Invalid' is observed. The same configuration works with FortiClient Window OS, Android, iOS phone.The following article discusses the recommended configuration for certificate authentication for IPsec IKEv2: Technical Tip: Certificate authentication for FortiClient remote access dialup IPsec clients with SAML user authentication.The dial-up VPN configuration is as follows:config vpn ipsec phase1-interface edit "VPN" set type dynamic set interface "x1" set ike-version 2 set authmethod signature set peertype peergrp set net-device disable set mode-cfg enable set proposal aes256-sha256 set dpd on-idle set dhgrp 14

Description This article describes an issue with Authentication Rules and the URL-List no longer being available for selection as a Destination Address after upgrading to v7.4.11 or 7.6.6.ScopeFortiProxy, v7.4.11, v7.6.6SolutionThe following scenario is seen in this case:Under Web Filter URL list, there are entries with external resources created.Proxy addresses are configured with Type URL List, which will push the entries created on Web Filter URL List.These proxy addresses will be used as destination on the Authentication Rules created.However, the proxy addresses are not visible on GUI to be selected after an upgrade. When using the CLI, the addresses can be selected without issues.With other types of proxy addresses (like Regex or Pattern), the issue is not observed. This is only a GUI issue, as there is no impact on the traffic or on the Rules.In the CLI, the behavior is as follows:config webfilter url-list edit "TEST_Admin"     set uuid 42f335a2-38a3-51f1-cdb9-1ceb49026d

Hello all, If there a device sending syslog using specific IP and send SNMP traps with another IP, What should I do in FortiSIEM side to make them appear as one device in CMDB?