Recently active topics

I have already defined a URL exclusion rule for URLs containing wildcards and selected the “exempt from action” option. However, access permission for these URLs is still not working.  

Hello Team,Following a recent electric power outage, HA FortiGate 201G v7.4.11 build2878 (Mature) cluster displayed the attached alert:“File System Check Recommended"Both units in the HA cluster are synchronized and operating normally,What is the recommended best action to handle this alert in an HA environment?Appreciate your guidance to ensure system stability and prevent potential disk issues. Thank you,

DescriptionThis article describes the steps to block access to the ZTNA Clientless portal. This can be useful when administrators need to apply geo-restrictions or block malicious IP addresses from loading the Web portal.ScopeFortiOS v7.6+, v8.0+.SolutionThis article assumes that ZTNA clientless access is already configured as per the steps described in Technical Tip: How to configure Agentless ZTNA with FortiGate v7.6.The following VIP will be used as the example:config firewall vip edit "ZTNA_PROXY" set uuid d365ced4-7ba0-51f1-4f96-a2bfd22c8236 set type access-proxy set server-type https set extip 10.9.11.209 set extintf "any" set client-cert disable set extport 443 set ssl-certificate "Wilcard2026" next end Create an address group containing the IP addresses that need to be blocked. The group can contain geography objects, individual IPs or subnets. For this example, a geography objects will be used to block the

DescriptionThis article describes a solution to the authentication error encountered by child domain users when logging in to VPN via FortiAuthenticator. The user may experience an error message indicating that the machine is protected by an authentication firewall and the specified account is not allowed to authenticate to the machine.ScopeFortiAuthenticator.SolutionAfter upgrading FortiAuthenticator from version 6.5.6 to 6.6.9, authentication failures may occur for users from a child domain.The following error is seen in the RADIUS logs:mschap: ERROR: Program returned code (1) and output 'Logon Failure: The machine you are logging onto is protected by an authentication firewall. The specified account is not allowed to authenticate to the machine. (0xc0000413)' To resolve the authentication issue for child domain users:Navigate to Authentication -> Remote Auth. Servers -> LDAP.Edit the configured Active Directory LDAP server.Under Windows Active Directory Domain Authentication,

DescriptionThis article describes how to verify if old events in ClickHouse still exist after the event retention period is over.ScopeFortiSIEM.SolutionIt has been observed that some of the older events from previous months still exist while checking from Admin -> Settings -> Database -> Online data for Clickhouse deployment.This behavior is mainly observed when older events are not covered by the Retention policy.The commands below provide details about the number of retention days for the events.This information can be useful for comparing the number of retention days defined in the retention policy.Run both of the following commands on the ClickHouse Data node:clickhouse-client -q "from fsiem.events_replicated select distinct(toIntervalDay(retentionDays));" The command below provides details about the oldest and newest event dates covered by retentionDays:clickhouse-client -q "SELECT     retentionDays,     min(toDate(phRecvTime)) AS oldest_date,     max(toDate(phRecvTime))

DescriptionThis article describes a scenario in FortiNAC / FortiNAC-F where a FortiGate that manages a FortiSwitch over FortiLink has been added to FortiNAC and its credentials validate successfully, but FortiNAC takes no action - no host detection, no VLAN change, no enforcement - when an endpoint connects to the FortiLink-managed FortiSwitch, even though the network access rules and profiles appear to be configured correctly.Moreover, in the FortiNAC interface, the FortiGate is displayed with a blue status icon.It explains how to confirm whether FortiNAC has full visibility and control of the FortiGate and its managed FortiSwitch, which logs and CLI outputs to collect, and the configuration required for reliable host detection and VLAN enforcement.ScopeFortiNAC / FortiNAC-F v7.6.3 and later.A FortiGate managing a FortiSwitch through FortiLink, integrated with FortiNAC using the REST API model (the recommended method to learn hosts and apply visibility and control on a FortiLink-manag

Hi Everyone,We have a predefined list of company-owned MAC addresses. We want FortiNAC to classify devices whose MAC addresses are in this list as Company Devices, while devices whose MAC addresses are not in the list should be classified as Personal/BYOD Devices.After classifying the devices into these two groups, we would like to apply different compliance policies to each group based on their device ownership. What is the recommended way to implement this in FortiNAC 7.6.x?

DescriptionThis article describes an issue encountered when renewing certificates using Let’s Encrypt on FortiAuthenticator.ScopeFortiAuthenticator.SolutionWhen attempting to automatically renew a Let’s Encrypt certificate on FortiAuthenticator v8.0.3, the renewal fails with the following error:Failed to renew certificate (ACME_auth.mycues.org_1774543132) for service (eap) error: Unsupported EC curve: 2048 Failed to renew certificate (ACME_auth.mycues.org_1774543132) for service (radsec) error: Unsupported EC curve: 2048 Failed to renew certificate (ACME_auth.mycues.org_1774543132) for service (https) error: Unsupported EC curve: 2048This is a known issue tracked under engineering ticket 1307157 and is expected to be resolved in an upcoming FortiAuthenticator GA release.

DescriptionThis article describes the issue of a FortiAuthenticator High Availability (HA) secondary node failing to synchronize TACACS+ related tables. The user may experience issues with TACACS+ clients, policy mapping, and policy-realm-group mappings not being synchronized between the primary and secondary nodes.ScopeFortiAuthenticator.SolutionIn certain scenarios, the TACACS+ related database tables on the FortiAuthenticator HA secondary node fail to synchronize correctly with the primary node.To resolve the issue of a FortiAuthenticator HA secondary node failing to synchronize TACACS+ related tables, follow these steps:Navigate to System -> Dashboard -> HA Status on the load balancer node and select the Rebuild Tables button. This causes the load-balancing node to rebuild its database from information synced from the primary.If the tables appear to be in sync (same number of entries) but the status still shows out of sync, recalculate the cluster checksums by navigating to t

DescriptionThis article describes the expected result that a new FortiGate must register with FortiCare before it can be fully configured, as well as how to perform initial configuration to enable registration.ScopeFortiOS v7.2.11 or v7.4.8 and later, FortiGate G-series models.SolutionIn FortiGate G-series hardware platforms such as FortiGate-30G and FortiGate-201G, the FortiGate shows a prompt on initial login, saying: 'Register with FortiCare. This step is required to activate threat protection services and receive firmware & package updates.' Enforcement Introduction:In v7.4.8, only FortiGate-20XG and 90XG models had the prompt, and it was possible to configure the devices using CLI before registration.In v7.4.9 and later, most G series models have the FortiCare registration check, and some CLI configuration is restricted. The 'Register with FortiCare' prompt will be displayed when logging in to the device via the GUI. On earlier firmware versions, there is no option to skip it.

Hello Team Je veux savoir dans quelle condition une box forinet peut etre bloqué a cause des licences 

DescriptionThis article describes how to analyze Active Directory user synchronization in FortiClient EMS using ADConnector and ADDAEMON logs.ScopeFortiClient EMS.SolutionFortiClient EMS uses ADConnector during Active Directory synchronization to enumerate directory objects and identify changes to users, groups, and other synchronized objects.The Enumerated Users entries in the ADConnector log can be used to determine whether a user addition, update, deletion, or disable operation was detected during a synchronization cycle.ADDAEMON processes the synchronization changes generated by ADConnector and updates the corresponding EMS data.The updateDomainUsers entries in the ADDAEMON log can be used to determine whether the user changes generated by ADConnector were subsequently processed by EMS.Correlating the ADConnector and ADDAEMON logs helps identify the stage at which an Active Directory synchronization issue occurs.If the expected change is not generated by ADConnector, troubleshootin

Description This article describes a software issue that causes packet loss, authentication failures, and session drops when using interfaces of type 'redundant' on specific FortiGate models and FortiOS versions. Scope FortiGate-70/71G, 90/91G v7.4.7 and v7.4.8. Solution Symptom of the problem: Packet loss. Authentication failures. Session drops. Not able to connect to SSH.   The symptoms detailed above will occur only for traffic with a source or destination passing through any interface configured as 'redundant'. Reproduction scenarios. Scenario 1: After upgrading from v7.2.11 or v7.4.7 to v7.4.8, FortiGate-70/71G and 90/91G with interfaces of type 'redundant' may experience packet loss and disconnections (poor quality, failure to establish TCP connections such as SSH). Scenario 2: On v7.4.7 and v7.4.8, after an unexpected power loss and reboot, FortiGate-70/71G and 90/91G with interfaces of type 'redundant' may experience packet loss and disconnections until the d

DescriptionThis article clarifies a known issue in FortiAuthenticator where LDAP lookups and user retrieval fail when using the UPN format.The issue occurs when FortiAuthenticator has multiple LDAP entries configured with different search filter formats, such as userPrincipalName and dNSHostName. In this scenario, FortiAuthenticator may fail to correctly resolve or apply the UPN when processing FSSO events, resulting in the associated user information not being identified correctly.ScopeFortiAuthenticator, FSSO.SolutionFortiAuthenticator should search for the user using the sAMAccountName attribute, even when the LDAP configuration is set to search using the UPN format. FortiAuthenticator should then resolve the corresponding UPN and use it when displaying the FSSO logon event.This is necessary because Windows Domain Controllers report the user logon event using the sAMAccountName, even when the user authenticates or logs in using the UPN format. Therefore, FortiAuthenticator should us

DesrciptionThis article describes an issue in FortiOS v7.4.x and v7.6.x that causes the FortiGate device to enter Conserve mode due to high memory utilization from the NODE daemon.ScopeFortiOS v7.4.x and v7.6.x.SolutionConserve mode is triggered when memory usage exceeds the configured threshold (memory-use-threshold-red 88). Continuous memory monitoring helps identify potential memory leaks and prevent conserve mode activation.Run the command below to check the top processes utilizing the memory. Verify if the node daemon is unexpectedly consuming high memory.FW1# diagnose sys top-mem 5 node (10773): 603172kB ipsengine (7513): 105623kB wad (7495): 32305kB ipshelper (7506): 28100kB wad (7493): 17015kBRun the command below to monitor if the Active(anon) value will increase continuously:FW1# diagnose hardware sysinfo memory MemTotal: 3797144 kB MemFree: 267212 kB MemAvailable: 252572 kB Buffers: 536 kB Cached: 573492 kB SwapCached: 0 kB Active: 2761692 kB Inactive: 136452 kB Active(anon

Does anyone have the official MTBF figure for the FortiGate 200G?

I've been requested to stretch a few VLANs across our two networks. Both networks live on the same Fortigate as different VDOMs. Each network has their own storage cluster, which our sys admin has requested I stretch their VLANs across to each other over an L2 connection as it would be faster than L3.Anyway, I'm not sure exactly how to accomplish this. None of the VXLAN diagrams look exactly like my setup. I'm thinking a VWP on the FG between two ports assigned to each network, but not sure where to go from there.Any help would be much appreciated. Also if this is a dumb idea please let me know that too.

DescriptionThis article describes how to correlate files submitted from FortiWeb to FortiSandbox with the HTTP Host of the protected application.ScopeFortiWeb.SolutionFortiWeb can submit uploaded files to FortiSandbox for additional inspection when FortiSandbox scanning is enabled in the applicable file upload restriction policy.The FortiWeb traffic or attack log can identify the HTTP Host and uploaded filename. However, these logs alone do not confirm that the file was successfully submitted to FortiSandbox.To generate an Event log when a file is successfully sent to FortiSandbox, enable FortiSandbox event logging:config system fortisandbox set elog enable endAfter enabling event logging, a successful file submission generates an Event log with the sandbox-send-file action.For example:Action: sandbox-send-file Message: Suspicious file APP1-FSA-ELOG-20260917-003.zip (219 bytes) has been sent to FortiSandboxThis Event log confirms that the file was successfully sent from FortiWeb to

I have a FortiGate VM deployed on Microsoft Azure, and I’m trying to configure an IPsec Client-to-Site VPN.The current situation is:* FortiGate VM is running on Azure.* UDP 500 and UDP 4500 are allowed in the Azure Network Security Group (NSG) and Azure networking.* The IPsec VPN client is able to reach the FortiGate.* Phase 1 is established successfully.* However, Phase 2 does not come up, and the VPN client cannot establish the VPN connection successfully.I have already verified that UDP 500 and 4500 are allowed, but the issue still occurs.My questions:1. What are the most common reasons for IPsec Phase 2 failing on a FortiGate VM running on Azure when Phase 1 is already established?2. Are there any Azure-specific requirements or settings that I should check for IPsec VPN, such as NSG rules, Public IP, routing, NAT-T, or IP forwarding?3. What FortiGate debug commands would you recommend to identify why Phase 2 is failing?Any guidance or troubleshooting steps would be highly appreciat

DescriptionThis article describes the behavior that the captive portal triggered after authenticating and connecting to an IPsec dial-up VPN for remote access.ScopeFortiOS, FortiClient.SolutionWhen configuring a FortiGate IPsec dial-up VPN for remote users to access internal or internet resources, there is a chance that traffic from users connected to the IPsec dial-up VPN triggers the captive portal.In these scenarios, users will be asked for user credentials while connecting to the VPN and once connected and browsing any websites, one more captive portal authentication will be required, which is unnecessary in an ideal situation.In the example below, the user has connected to the VPN with the credentials and got connected:After this, the user is prompted for a second authentication (captive portal) if any website is accessed via a browser:In this case, the internet will be accessible only after completing the second authentication.This is happening because of the user group configura

Hi everyone, I'm Sarah, just joined this community. We've been running a site-to-site VPN on FortiGate and occasionally notice intermittent drops, especially during peak traffic hours. Has anyone tuned specific settings (dead peer detection, keepalive intervals) to make tunnels more stable? Would appreciate any troubleshooting tips before opening a support ticket.

DescriptionThis article describes the steps required to migrate Exchange Online configurations from the FortiSOAR Exchange Connector to the Microsoft Graph Mail Connector because Microsoft is retiring Exchange Web Services (EWS) in Exchange Online. For additional information about the EWS retirement, see the Troubleshooting Tip: Action required: FortiSOAR Exchange Connector, Microsoft EWS for Exchange Online End of Service article.ScopeFortiSOAR Exchange connector used with Exchange Online.SolutionThe Microsoft Graph Mail Connector has been enhanced to provide functionality equivalent to the Exchange Connector for Exchange Online configurations.Note: Migration is required only for Exchange Online configurations. Existing Exchange Connector configurations that use on-premises Microsoft Exchange are currently unaffected and require no action.Areas of Impact:Data Ingestion.Users who have configured data ingestion using the Exchange Connector with Exchange Online must reconfigure data inge

DescriptionThis article exists to help users determine the most appropriate software release for FortiOS. The recommendations stated below are the latest as of June 2026 and are reviewed and updated every quarter.The information in this document is not meant to be exhaustive and is intended to serve as general guidance to customers, especially in cases of mass deployments/upgrades. When working with Fortinet SEs, Professional Services, or TAC: it is important to refer to their specific guidance.An additional information section has been added to the bottom of this article for answers to common questions.Subscribe to the RSS feed by selecting the three-dotted menu button to keep up to date on the latest changes to this article (note that this feature is temporarily unavailable as of June 2026).ScopeThis document is a general recommendation of FortiOS software for general customer deployments for general stability and is updated quarterly.For customers who may be leveraging the latest fe

DescriptionThis article describes a possible fix for the YubiKey token synchronization issue: 'Unable to synchronize. Please supply 2 consecutive codes'.ScopeFortiAuthenticator.SolutionA sync error can appear when trying to synchronize a YubiKey token in FortiAuthenticator:The fix for this issue is to change the setting of OATH Token Identifier in the YubiKey Personalization Tool selection to OMP + TT Modhex, rest numeric, like below. HOTP Length can be either 6 or 8 digits:After the change, try the synchronization again and enter the full-length code.

DescriptionIn distributed multi-tenant environments integrated with FortiPortal, administrators using multiple standalone FortiAnalyzer units may experience 'flickering' or missing reports in the FortiPortal dashboard.This article explains the architectural cause of this behavior and provides a comprehensive step-by-step migration plan to transition standalone FortiAnalyzers to an HA cluster, ensuring consistent reporting and unified log indexing. Scope FortiAnalyzer: v7.2, v7.4FortiPortal: v7.0, v7.2SolutionSymptoms: When FortiPortal is connected to two independent standalone FortiAnalyzers:FortiPortal maintains separate connectors and polls both FortiAnalyzer IPsGenerated reports are stored locally on whichever FortiAnalyzer unit executes the report generation job.Because the standalone units do not synchronize their local report databases, FortiPortal alternates which FortiAnalyzer it queries, causing reports to appear and disappear depending on the polled connection.Solution: Activ