Recently active topics

Hi everyone, somebody can help me with this error, my SSD go to 100% of use, searching; windows write and read the file push.conf forever, i erase the file and reboot and works but, later the problem start again. thanks and sorry for my bad english.

I’m trying to setup a DNS service on the network interface.  I followed the instructions on this link.  However, it doesn’t resolve anything on the public domain.  It resolves interface domain name.  It looks like Fortigate doesn’t forward the query to system DNS servers.  Anything I need to check?  I used the following link to create DNS service.  Technical Note: DNS resolution not working when DNS Server configured to 'Same as Interface IP' | CommunityBasically, I want a user to use Fortigate interface as a DNS server IP and have Fortigate to resolve internal domain relying on the local dns database but forward to system dns servers to resolve anything outside domain names.

DescriptionThis article describes the supported methods for FortiPAM license validation in environments with and without direct Internet access.FortiPAM performs periodic license validation to ensure that the device remains properly registered and authorized. In environments such as Operational Technology networks, where direct Internet access is restricted or not available, an alternative validation method is required to maintain system operation.ScopeFortiPAM.FortiManager.SolutionFortiPAM supports two methods for license validation, depending on network design and connectivity availability.Direct Internet access (default method).FortiPAM connects directly to Fortinet services over the internet to perform license validation. This method is the standard deployment model and requires outbound connectivity to Fortinet services.FortiManager as intermediary (offline or restricted environments).In environments without direct Internet access, FortiManager can be used as an intermediary for l

DescriptionThis article describes a solution to resolve license issues on FortiGate devices, where the IPS, Antiviruses, and Web Filtering features are not licensed despite having valid licenses assigned in FortiCloud Asset Management.ScopeFortiGate.SolutionTo resolve the license issue on FortiGate, follow these steps:Verify License Validity in FortiCloud.Log in to FortiCloud Asset Management.Confirm:License start date.License expiration date.Correct device assignmentCheck Device Registration Status.Log in to the FortiGate GUI or CLI.Ensure:The device is registered with FortiCloud.The correct serial number is associated.Licenses are mapped to the device.If the issue persists, contact the Customer Service team to verify the license start date and expiration date. See Fortinet Contact Support Information.A FortiGate can be fully registered and have licenses assigned, but if the license start date is incorrect or set in the future, the device will still show services as unlicensed until t

Second-hand devices - Does it actually matter if the device you are running is not registered to your forticloud account?This is assuming fortigate cloud is disabled on the unit and there’s no EMS so it cannot be remotely managed.Or should I just create a support ticket, send pictures of the labels to support and wait two weeks and hope fortinet decides to add these to my account?My plan was to test active-active HA pair so automatic updates aren’t what I want to happen.

We have setup a point to point wireless bridge using 2 FAP234's as the parent and leaf AP's. The wireless bridge is intended as a backup route to a fibre connection should it go down. A diagram below shows the setup;Network DIagramWe are however having issues in that the wireless bridge does not pass traffic when the fibre link goes down, and although I do have a TAC case open, I'm hoping a member of the community could review the setup and point out anything that could be causing the problem.One thing to highlight is that spanning tree is enabled on the switches that the AP's are connected to. Should spanning tree also be enabled on the AP's themselves, or is that managed by the switches? Any help is welcome.

Fairly new to Forti and deployed a range of 50G models at branch sites 5-10 users and HA pair of 70Gs at HQ which has been fine however, have an on going VOIP issue and looking for some guidance.-Telephony platform is cloud hosted-Disabled SIP ALG-No VOIP profile applied to access rulesIssues raised:-Calls dropping-Audio being lost during calls-Poor call quality

Hi All,  We are experiencing an issue with the forticlient VPN client on MacOS 15.5 We are currently planning our roll out of remote access via IPsec and moving away from SSL VPNs, The issue we are having is that after a device cold start/reboot, the initial attempt to connect to the remote access VPN via IPsec always fails and gives an "Connection was terminated unexpectedly" error. Trying it immediately again afterwards, it still fails. The current workaround is to connect to the same remote VPN endpoint but via SSL VPN, and then trying the IPsec once more; however, this does not always seem to work.Another workaround seems to be waiting 5-10 minutes, and trying the IPsec connection seems to work.Once successfully connected via the IPsec VPN, it continues to work until the client device is rebooted/shut down. Looking through the Forticlient debug logs, we are getting an "IPsec error -104"; however, when running an authentication debug on the FortiGate, I can

I am facing an issue where some users in the FortiGate firewall appear with an “orange” status instead of the normal connected (blue) state.When this happens, the affected users experience restricted access, and some applications or websites are blocked.Our environment is integrated with Active Directory (AD) using authentication (SSO). The issue seems to occur especially when users switch between different network connections, such as Wi-Fi, wired (LAN), or VPN. In these cases, the user’s IP address changes, and the FortiGate appears unable to properly recognize or maintain the authentication session.We have already attempted the following troubleshooting steps:Removed the user from the domain and rejoined Reinstalled the FortiGate certificateHowever, the issue persists.Interestingly, when the user connects via a wired network, the status returns to normal (blue), and access is restored.It appears that during network transitions, the user session becomes inconsistent, causing the Fort

When i use IPSEC with IKEv2 and in the forticlient I use DNS on the remote gateway then the client can connect to the VPN but can’t reach to anywhere.If i switch using IP Address for Remote gateway then the client is able to connect to the LAN.Anyone facing same issue with me or this is know issue for IKEv2?

Hi All, Anyone have any idea for Grey-noise deployment in FortiGate?And hope it is third party, so can we trust them? 

Hi, I have installed Fortianalyzer-VM on my Server with 50 GB storage for trial. Then I extend my storage to 500 GB and purchased 500 GB storage license from fortinet. After the license applied my storage is not increased its showing me 50 GB only. I restarted my server several times but no result. Anyone guide me what I'm doing wrong. I attached snapshot of my storage as well as license for reference.

I have problems with a policy where I include an application control where I block access to facebook, youtube and others, one of the applications that I allow within the control is whatsapp but it has presented problems since yesterday, the attached files are not They send and the messages are sent several minutes later, the same as when receiving. I have been doing tests and by allowing the known applications the whatsapp starts working correctly, someone could help me know what the problem is if everything was working well until yesterday that I present this inconvenient.   My device is a Fortigate 90D The only categories that I have blocked in the control of applications are: Botnet, Game, P2P, Social.Media, Update, Video/Audio and Unknown applications (now in monitor mode for whatsapp work) The other categories are in monitor mode

Hello All,When I try to install the “Outbreak Response Framework” for the SIEM installation, I encounter an error. Error: PreInstall Script Installation. I haven’t encountered this error in another environment. Both of my environments are running version 7.6.5. Does anyone have experience with this? Thanks in advance

Dear All, I have question about FortiProxy Authentication Timeout. My customer need scenario like this :User group SERVER doesn’t have timeout. There is traffic or not, once authenticate the server can connect forever User group EMPLOYEE have timeout 12 hours. So, after 12 hours they must authenticate again using captive portalCould anyone suggest me what I need to configure? I don’t understand guidance from documentation clearlyThank you

DescriptionThis article describes the configuration steps required to send the Disconnect Message (DM) to the clients connected to the Juniper EX2300 Switch.ScopeFortiNAC-F v7.6.5.SolutionFortiNAC is unable to send a Disconnect Message to the Juniper EX2300 switch when RFC5176 mode is set to 'System Defined'. To solve this, RFC5176 Mode should be set to 'Custom' with the following configuration.Method:Navigate to the model configuration of the switch under Network -> Inventory.Set RFC5176 mode to 'Custom' and RFC5176 port to 3799.Select 'Disconnect Message' in the RFC5176 Message Type dropdown.Create a new attribute group and include the 'Calling-Station-Id' attribute with '%AUTH%' in the Response values.Save the configuration and verify if FortiNAC is sending the Disconnect Message using tcpdump.execute tcpdump -i port1 port 3799 and host <Switch IP>Example:  

Hello.We have an FG-401F firewall, divided into a few VDOMs, all in profile-based mode. Now we need to convert one of the VDOMs to policy-based mode, and as I know in this case all policies are removed. Is there any way to automatically migrate policies from profile-based mode to policy-based, so we don’t have to recreate all of them manually? Maybe some sort of tool or script?Thanks.

Hello everyone, my company is using a fully licensed FortiGate 100F firewall and I need to block Telegram. I've searched in FortiGuard and classified it as Collaboration. Now, to effectively block it and optimize my firewall's performance, should I block it via Application Control or Web Filtering? What Inspection Mode should I set? Flow or Proxy Based?Please give me your advice. Thank you!

DescriptionThis article describes how to import a remote certificate in FortiPAM without the infinity loop. Sometimes when importing the certificate, the system shows Certificate uploaded successfully, but the Remote Certificate list is not updated correctly.Most probably because the certificate name is too long.ScopeFortiPAM.SolutionShorten the name of the certificate below 18 characters.In this example, a certificate is imported with a name of 18 characters (without a suffix).The picture below shows the steps for importing the certificate:Navigate to: System -> Certificates -> +Create/Import -> Remote Certificate, Upload Remote Certificate window pops up.Certificate name: Fortinet_123456789.cerAfter selecting OK, the system shows that the certificate is uploaded, but the list is not updated:To fix this, shorten the name of the certificate, in this case: Fortinet_12345678.cer.After the same steps, the certificate is successfully imported, and the list is updated.

DescriptionThis article describes reasons for the error 'Unable to find authpolicy to process' when using overlapping ranges and subnets in a single RADIUS policy. ScopeFortiAuthenticator. SolutionThe article uses the following IPs to illustrate the issue:RADIUS client (FortiGate): 10.252.252.250.Subnet_Radius1: 10.252.252.0/22.Range_radius1: 10.252.252.240~10.252.252.249.The issue only occurs if the actual RADIUS client is slightly outside of the range, but within the subnet. Step 1 :Verify if the clients in the RADIUS policy consist of an overlapping range and subnet.In this example, there are two clients, one configured with the range 10.252.252.240-249, the other client with the subnet 10.252.252.0/22.Step 2 :The FortiAuthenticator allows this configuration, but authentication will fail with the error 'Unable to find authpolicy to process'. This error can be found under Error logs, which can be viewed under Logging -> Log Access -> Logs:The RADIUS debug log may show additiona

DescriptionThe article describes how to implement a profile override to ensure specific users receive different permissions (such as Read-Only vs. Super_User). ScopeFortiAnalyzer, FortiAuthenticator. SolutionTo configure remote RADIUS administrators using FortiAuthenticator as a RADIUS server, see this article: Technical Tip: Remote admin login with RADIUS selecting an admin access account profile.In this scenario, Read_Only access as a customized profile and Super_User as Super_admin privilege are given to a separate Remote user group in FortiAuthenticator as a RADIUS server. Step 1: Create a customized profile and an Administrator for the Wildcard administrator in FortiAnalyzer:Step 2: Configure a remote user or group on FortiAuthenticator and assign the Fortinet-Access-Profile attribute to the relevant user or group on FortiAuthenticator. The value of this attribute must exactly match the name of the desired  Admin Profile pre-configured on the FortiAnalyzer (e,g Read_Only).Administ

Description This article describes how to troubleshoot if the FortiMail connector shows as down under FortiAnalyzer v7.6, Incidents & Events -> Automation -> Active Connectors -> FortiMail Connector. Scope FortiAnalyzer and FortiMail.Solution Make sure the configuration is correctly configured as per below, where the credentials are the same as the user in FortiMail.In FortiAnalyzer v7.6: Incidents & Events -> Automation -> Active Connectors -> FortiMail Connector -> Edit.FortiMail: Domain & User -> User -> User Preference.Run sniffer to ensure the connectivity between FortiAnalyzer and FortiMail:diagnose sniffer packet any "host <FortiMail IP> and port 443" 4Perform a debug as per the below command:diagnose debug application fazsvcd 255 diagnose debug enableNote: To get the debug output, proceed to click the Active Connectors.Example output on the debug:INFO - finding fml connector parameters [2026-04-29 15:14:41,595] {health_check:68} INFO

DescriptionThis article describes the grace period policy for FortiWeb Cloud Prepay subscriptions in FortiAppSec Cloud after license expiration.ScopeFortiAppSec Cloud WAF.SolutionA grace period is a temporary extension period after a license or subscription expires, during which the service remains available to allow time for renewal without immediate interruption. When the portal enters the grace period, access to the portal is limited to read-only mode.Unlike FortiAppSec Cloud contracts, which provide a 21-day grace period, legacy FortiWeb Cloud Prepay contracts have a shorter 14-day grace period.Steps to verify contract type:Login into Fortinet Support portal.Navigate to Services -> Asset Management -> Products -> My Assets.Select FortiWeb Cloud serial number.Under Product Information, the product model is described.Related document:License&Contract

DescriptionThis article describes how to troubleshoot the PBA leak on NP7 platforms due to vlan-lookup-cache setting.ScopeFortiGate NP7 platform.SolutionUnder certain circumstances, FortiGate NP7 platforms may experience a PBA leak on NP7. This can be checked using the following commands:diagnose npu np7 pba all diagnose npu np7 pmon all diagnose npu np7 pdqFor example:FGT1800F # diagnose npu np7 pba all [NP7_0]      normal current Delta Empty pba 00003f7c 0000267e 6398 0 dba 00001ddf 00001494 2379 hba 00000ff5 00000ff5 0 !!!Leak!!! < ----FGT1800F # diagnose npu np7 pba all [NP7_0]      normal current Delta Empty pba 00003f7c 0000267e 6398 0 dba 00001ddf 00001494 2379 hba 00000ff5 00000ff5 0 !!!Leak!!! < ----NP7 may become stuck affecting the traffic through FortiGate interfaces. For example, the LACP interface may become down even when physical interfaces are UP.FGT1800F # diagnose npu np7 pmon all [NP7_0] EIF0_IGR EIF1_IGR EIF0_EGR EIF1_EGR HRX HTX DFR -------- -------- ----

DescriptionThis article describes the issue FortiView SD-WAN application performance shows 'No results' after adding the monitor.ScopeFortiGate.SolutionA new FortiView dashboard, 'FortiView SD-WAN application performance', is added in FortiOS v8.0, which leverages the passive WAN health capabilities of SD-WAN to log and monitor application performance metrics.FortiGate Cloud will be the default data source for FortiView, but FortiGate Cloud does not support the feature of SD-WAN application performance. To resolve the issue, select a different data source such as FortiGate, FortiAnalyzer, or FortiAnalyzer Cloud.Below is the sample after selecting FortiGate as the data source.