Recently active topics

Hi all,I am looking for FAZ resources which cover real world use cases or lab based scenario, I have checked on YouTube but not much available, checked their Fortinet Video Lib as well, I would appreciate you recommend some resources, thanksNote : I am focusing on FAZ, FSM

Hi everyone,We recently ended our support contract with our previous vendor and decided to renew with a different support provider.Unfortunately, the previous vendor has refused to provide the FortiGate administrator credentials and has also refused to share the latest configuration backup.we tried using the maintainer account with the password format bcpb+<Serial Number>, but I received the following error:login: maintainerPassword:Verifying password...Login incorrectDevice Model: FortiGate 200FIs there any supported method to reset or recover the administrator password without performing a factory reset, so that the existing configuration is preserved?Any guidance or recommendations would be greatly appreciated.Thank you.

I setup 1VM (FMG V8.0.0) and FW(V8.0.0) and trying to onboard fortigate firewall to manager but getting below error , is there any bug or do i need to make further changes in the configuration considering both VM Mgt subnet are in same subnet. Error “The FortiManager's access to the FortiGate will be authenticated by the FortiManager certificate. The serial number from the certificate must match the serial number observed on the FortiManager.Could not connect to the FortiManager to retrieve its serial number.” 

This article describes how to configure a Windows endpoint to generate and collect a memory dump file for troubleshooting Blue Screen of Death (BSOD) issues related to FortiClient (including version 7.4.7 and later versions).The generated dump file can be analyzed using WinDbg to identify the faulting module, driver, or call stack.

Hi, how do you set up a VXLAN when you have two locations? We're using FortiSwitches at both locations, and VLANs are also in use there.But we now have another location, and I'd like to know if it's possible to set up a VXLAN using the FortiLink VLAN as well?

Why link status for each port is different between the device and fortinac? On the device port g1/0/27 - 31 is up but in the NAC is different 

I try to send CoA to the endpoint but we can see from below picture the CoA is failed, and from tcpdump there is no traffic to port 1700. Also in the cisco switch i already enable CoA debug but not receive any message. This mean the fortinac not send the CoA message? 

Hi everyone,I have the topology below using Fortigate HA Active -Active Cluster  Everything works normally until SW1 (the current STP root) is rebooted or powered off.After SW1 comes back (or after the topology reconverges), the topology does not recover correctly. One or more FortiSwitches may randomly become Offline, even though the physical links are up.The only workaround is to disable and enable FortiLink Split Interface, after which all FortiSwitches immediately come back online and the topology is rebuilt correctly.FortiOS 7.6.7 / FortiSwitchOS 8.0.0

Hello everyone.I want to move old online data before I enabled Archiving to Archive storage. Since Clickhouse Archive only moves incoming logs as it comes, I swear I saw some commands to move old data to Archive but cannot find it now. Does any of you have experience with this?

Running FortiWeb KVM_PAYG on Proxmox (standalone, not a cloud marketplace deployment). Reproduced this identically on two separate fresh installs — 8.0.6 build0116 and 7.6.9 build1133. Running FortiWeb KVM_PAYG on Proxmox (standalone, not a cloud marketplace deployment). Reproduced this identically on two separate fresh installs — 8.0.6 build0116 and 7.6.9 build1133.Setup:Operation Mode: Reverse Proxy, standalone (no HA) port1 (external): static/DHCP IP, allowaccess includes http/https/ssh/ping port2 (internal): static IP, reaches backend fine Server Pool → backend IP:80, enabled Virtual Server → Use Interface IP enabled, bound to port1 Server Policy → links VS + Pool + HTTP Service (port 80) + a Web Protection Profile, status shows Running admin-port moved to 8080 beforehand, confirmed no port-in-use conflict when creating the policy License page: all green (VM License, Support Contract, etc.)Symptom:Client (Kali, same L2 segment) connects to the Virtual Server IP on port 80: curl -v

We have 2 internet connections terminated to our firewall with spare IPs, and SD-WAN is already configured outbound for load-balance/failover.We have a specific outbound service (SMTP) that we want to attach to a dedicated outbound IP address.Setting an outbound NAT policy with an IP Pool was easy enough, and that's working, but we only have it setup for one of the internet connections at the moment.How can we set this up with a dedicated outbound IP for each internet connection and have it failover if the main internet connection goes offline? (active/passive)

Hi everyone,I'm looking for the FortiAnalyzer 7.2.11 JSON-RPC API documentation. Does anyone have a copy or know where I can find the complete documentation?I'm currently integrating FortiAnalyzer with an external system and need information on the available JSON-RPC methods and objects.Any documentation, examples, or links would be greatly appreciated.Thanks in advance!

● Prerequisites・ FortiOS version: v7.6.7・ Inspection mode: Flow-based・ SSL inspection: certificate-inspection・ Browser: Google Chrome, (Firefox), (Microsoft Edge)・ Client certificate installed on the endpoint ● IssueWhen accessing a site categorized for "Block" or "Warning" actions, the FortiGate is expected to display replacement messages;however, a browser error (ERR_SSL_PROTOCOL_ERROR, or occasionally ERR_CONNECTION_RESET) appears instead of the replacement message.Switching the inspection mode to proxy-based resolves the issue, and replacement messages are displayed correctly.Note that this issue occurs on some endpoints but not others. ● Troubleshooting results・ Endpoints experiencing the issue produced the same results when inspected via a different FortiGate.・ Changing the FortiOS version (to 7.6.6 or 7.4.12) yielded the same results.・ Updating the browser to the latest version yielded the same results. ● QuestionBased on the troubleshooting results, I suspect the issue lies wit

DescriptionThis article describes an issue affecting FortiGate 200G and 201G devices, where intermittent internet connectivity outages may occur after upgrading from FortiOS v7.4.9 to v7.4.10, v7.6.5, or above. Symptoms are characterized by a total loss of both inbound and outbound traffic connectivity on the SFP interfaces, specifically, despite the physical link status remaining 'up'.Scope FortiGate 200G and 201G.SolutionThis issue was investigated as part of Bug #1264495, and it was found that the issue only impacts the SFP interfaces (specifically port17 through port20). This issue does not impact the SFP+ interfaces (such as x1 through x8), nor does it impact the RJ45 interfaces.The root cause was identified as an implementation issue with setting interface speeds. When the SFP interfaces are configured to auto-negotiate interface speed, an intermittent issue can randomly occur that results in traffic no longer flowing through these interfaces for long periods of time (at least se

Hello,We are testing a FortiGate-VM trial setup, but the GUI still logs out immediately after login.We have already verified the following: GUI certificate is set correctly. Admin idle timeout has been increased. https is enabled on the management interface. NTP time sync is correct. httpsd process is running normally. We also tested: different browser, incognito mode, cleared cache and cookies, login from the correct trusted host / source IP. Even after all of the above, the GUI still kicks us out after login, while SSH access remains stable.Has anyone seen this behavior on FortiGate-VM trial or evaluation mode? Is there any other VM-specific GUI setting or known issue we should check?Thank you.

DescriptionThis article describes the process of identifying and resolving suspicious file extensions in FortiAnalyzer. The user may encounter a suspicious file extension, such as .ctbl, which may be flagged as a potential security threat.ScopeFortiAnalyzer.SolutionTo identify and resolve suspicious file extensions in FortiAnalyzer, follow these steps:Check the file extension and its origin to determine if it is a legitimate file or a potential security threat.If the file extension is unknown or suspicious, contact the Fortinet Technical Support team for further assistance.Provide the Technical Support team with the necessary information, such as the file extension, its location, and any relevant logs or configuration files.The Technical Support team will investigate the issue and provide a resolution, which may include updating the FortiAnalyzer configuration or providing additional guidance on how to handle the suspicious file extension.In the case of the .ctbl file extension, it has

Hi everyone,I’d like to clarify something regarding the Intune deployment using the official bash script as it seems to be a bit problematic.I was following during configuration → Deploying FortiClient using a shell script | FortiClient 7.4.0 | Fortinet Document Library  We are updating from 7.4.2 to a higher version. Issue I encountered are the following:  *If the EMS is connected, the service does not run at all. No errors are show shown in the Intune portal. Which leaves me with the impression that the devices are not being reached. *Some newer OS versions -> macOS 26.5.2, assigned to the same group are not added to the list of “pending” (invisible, not in the list). And I don’t understand why. I am unsure if the script is even reaching them. The person in question had the older version, we removed it manually, and then we were waiting for the script to be executed. The person’s device was synced a few times (and restarted once) - no changes. *In some occasions, the script does n

Description This article describes an issue where an IPsec VPN user fails to connect when IKEv1 is configured in Aggressive Mode and multiple Diffie-Hellman (DH) groups are selected in the Phase 1 configuration. Scope FortiClient v7.2, v7.4 and v7.6. Solution The following error message may be observed in the exported FortiClient debug logs:   msg="No response from the peer, phase1 retransmit reaches maximum count"   The message below may also appear on FortiClient:     On the FortiGate, debug settings vary depending on the firmware version.   If the FortiGate is running on v7.2.x, below logs may be seen in the IKE debugs.   diagnose debug resetdiagnose debug app ike -1diagnose debug console timestamp enablediagnose debug enable2024-09-03 05:14:29.602513 ike 0:ae258a933eed2138/0000000000000000:65: SA proposal chosen, matched gateway FCT_Ipsec2024-09-03 05:14:29.602580 ike 0:FCT_Ipsec: created connection: 0x7ca2e20 7 192.168.1.75->192.

DescriptionThis article describes the issue of updating a certificate via the CLI on FortiOS v8.0 when trying to replace a certificate and the private key.ScopeFortiOS v8.0.SolutionWhen modifying an existing certificate via CLI to replace the certificate and private key, administrators may encounter the following error:Input is not a valid/matched certificate. node_check_object fail!Example:config vpn certificate local edit <Existing Certificate name> set private-key "-----BEGIN PRIVATE KEY----- … -----END PRIVATE KEY-----" set certificate “-----BEGIN CERTIFICATE----- … -----END CERTIFICATE-----" Input is not a valid/matched certificate. node_check_object fail!To resolve this issue, upgrade to FortiOS v8.0.1 or a later release, where the fix has been implemented.Workaround 1:Create a new certificate with a different name.config vpn certificate local edit <New certificate name> set private-key "-----BEGIN PRIVATE KEY----- … -----END PRIVATE KEY-----" set certificate “-----

DescriptionThis article describes a scenario where the SAML login page error shows the error 'Specified tenant identifier is neither a valid DNS name, nor a valid external domain'.ScopeFortiGate.SolutionWhile connecting to the VPN via SAML, an SSO error may appear with the message 'Specified tenant identifier is neither a valid DNS name, nor a valid external domain.'This happens due to mismatch in configuration on FortiGate or Azure. Usually, it is the single-sign-on-url that needs to be verified.The following is a screenshot of the error:The following is the configuration on FortiGate:config user saml edit "saml-entra-id" set cert "fortinet_saml" set entity-id "https://test.fortinet.com:10428/remote/saml/metadata/" set single-sign-on-url "https://test.fortinet.com:10428/remote/saml/login" set single-logout-url "https://test.fortinet.com:10428/remote/saml/logout" set idp-entity-id "https://sts.windows.net/ab2ced4d-cadf-4e71-80f2-df3da5023c07/

DescriptionThis article describes steps to resolve issues with downloading reports in FortiPortal. The user may also encounter errors when attempting to download reports in various formats, such as PDF, CSV, and XML.ScopeFortiPortal and FortiAnalyzer.SolutionTo resolve the report download issues in FortiPortal, follow these steps:Ensure that the report is assigned to the correct organization.Try a different browser or try clearing the browser cache.If the issue persists, run browser debugging to check the suspected issue:The browser debugging processes under Network -> Response may show an error like the following:{ "status": { "code": -1, "message": "Internal error: Access denied. user=api, userfrom=JSON(x.x.x.x)." } }Check the Administrators in FortiAnalyzer to make sure the user has Read-Write access for the JSON API.

DescriptionThis article describes the steps to troubleshoot Endpoint Compliance for IPsec dial-up VPN in FortiGate. The user is experiencing issues with the Endpoint Compliance policy not being matched for VPN hosts.ScopeFortiGate, FortiNAC.SolutionTo troubleshoot Endpoint Compliance for IPsec dial-up VPN in FortiGate, follow these steps:Verify that the syslog filter is configured to include log ID 0101037139.Verify that the syslog ID 0101037139 is being received by FortiNAC.Enable these debug processes in the CLI:execute enter-shell nacdebug -name SyslogServer true nacdebug -name FortinetVPN true nacdebug -name RemoteAccess true tail -f /bsc/logs/output.masterDisconnect FortiClient, wait 10-15 seconds, then reconnect the IPsec VPN.FortiNAC CLI:RemoteAccess -remoteIP X.X.X.X Replace X.X.X.X with the assigned Host IP.Disable debug processes and collect logs. Press Ctrl+C and then run the following: nacdebug -name SyslogServer false nacdebug -name FortinetVPN false nacdebug -name RemoteA

DescriptionThis article describes why the mclag-igmpsnooping-aware option may no longer be available in FortiSwitch.ScopeFortiSwitch v7.6.7.SolutionThis behavior is observed after upgrading FortiSwitch to v7.6.7 or later.After the upgrade, the following CLI option is no longer available under the global switch configuration:config switch global set mclag-igmpsnooping-aware enable endAttempting to configure the command results in a configuration error. The output of 'diagnose debug config-error-log read' may vary depending on the configuration history and provide following output indicating removal of this command:FortiSwitch # diagnose debug config-error-log read set mclag-igmpsnooping-aware enableResolution: Starting from FortiSwitch v7.6.7, the mclag-igmpsnooping-aware feature is enabled automatically whenever MCLAG is configured.Since the feature is now enabled internally by default, the CLI configuration option has been removed and no longer appears in the configuration.No manu

Description This article describes how to identify the web filter category of a website or domain. This step is crucial for effectively utilizing the web filter feature in FortiGate. Scope FortiOS, FortiGate, Web Filter, FortiGuard. Solution Users may be uncertain about the category of a specific website or domain while configuring the web filter in FortiGate.   To instantly query the category of a website or domain, use the FortiGuard web filter lookup tool.     Enter the website or domain and select the relevant FortiOS version.     Press Enter or select the 'Search' button to display the relevant category. It is highly recommended to verify this information when configuring Web filtering on FortiGate to avoid blocking websites the business needs access to:   It can also be viewed from the FortiGate GUI as well.   Make sure that the FortiGate can connect to the FortiGuard server for the Lookup Rating to be successful.Navigate to Securi

DescriptionThis article describes how to add SAML authentication to a dial-up IPsec IKEv2 remote-access VPN on a FortiGate that already runs SSL VPN with SAML, without modifying or interrupting the existing SSL VPN service.ScopeFortiOS v7.2, v7.4, v7.6.SolutionA frequent question during SSL VPN to IPsec migrations is whether the existing SAML configuration - both the FortiGate SAML object and the Identity Provider (IdP) application - can simply be reused for IPsec. The answer is that the IdP tenant, users, groups and claim design are reused, but the Service Provider (SP) endpoints are not: SSL VPN and IPsec are two distinct SPs on the same FortiGate, reachable on different TCP ports, and each requires its own SAML object and its own IdP application registration.This article covers the design considerations, port planning, FortiGate and IdP configuration, FortiClient deployment, a phased migration plan, verification commands and the failure points most often seen in support cases.Design