Recently active topics

DescriptionThis article describes how to optimize configuration of FortiGate Virtual Clusters.ScopeFortiGate.SolutionIn a FortiGate FGCP cluster with Virtual Domains (VDOMs) enabled, it is possible to leverage the Virtual Clustering feature as detailed here: HA virtual cluster setup.For initial troubleshooting procedures, refer to Technical Tip: Configure virtual cluster on FortiGate HA cluster.It is essential to distinguish between three core entities: a Virtual Domain (VDOM), a Virtual Cluster (vCluster), and a physical or virtual FortiGate cluster member node. Understanding the distinct roles and interactions among these three layers is a central theme of this article.This article highlights key considerations for optimizing and maintaining a vClusters environment.Design tips:How many vClusters: Within each Virtual Cluster group, traffic for all associated VDOMs is managed exclusively by a single unit. Consequently, the optimal number of vClusters and the distribution of VDOMs acros

Hi,I've already set up my FortiNAC scenario with FortiGate and FortiSwitch in the lab, where it worked. Now I'm doing the same in production, but it doesn't want to work no matter what I troubleshoot.I have access value VLAN 31 for my guest network, where I want all users that have MAB to fall into.I have correctly configured the RADIUS attributes, and the logical networks are mapped to VLAN IDs in FG Virtualized Devices > Model Configuration.   My host in Policy Details matches the MAB policy, and the logs show that it is matched to go under VLAN 31.My FortiSwitch port has Group Membership Role Based Access and Reset Forced Registration. I've also tried adding Forced Registration/Forced Authentication, and it doesn't work. In my RADIUS logs, I don't know if it's bugged, but FortiNAC RADIUS keeps sending VLAN 1 even though it should match VLAN 31. Why is that happening? REST-HTTP-Status-Code = 204, REST-HTTP-Status-Code = 204, REST-HTTP-Status-Code = 200, Tunnel-Type = VLAN, Tunnel-

Hi all... I was using FortiClient VPN on MacOS Sequoia and all was working fine, but after update for MacOS 26 Tahoe, I'm experiencing several issues on applications that not recognizes the VPN. For example, I have a Java development environment configured on my Mac, but after update, when I start a Spring Boot backend application, it does not can reach database on Azure. Same for older Java applications using Wildfly 17. Error massage points to my local IP, not for VPN IP. VPN is connected, routes appears as result for netstat command, but I can't connect do my databases because allways returns erros saying my local IP is not on firewall. Anyone has an idea to solve this? Regards,Bruno

DescriptionThis article describes the connectivity issues faced with certain FortiGate models when they are peered with BT Openreach ADVA routers.ScopeFortiGate.SolutionThere is a known issue with the connectivity between specific FortiGate models when they are connected with BT Openreach ADVA routers.The link comes up.ARP/ICMP does not work.MAC table does not populate the peer MAC.It was confirmed by Fortinet's developers that this is a compatibility issue between the physical chipset on the FortiGate devices and the ADVA devices.If such an issue is seen on any FortiGate devices, the suggestion is to upgrade to any of the following versions: v7.4.10, v7.6.7, v8.0.0.

Hello,We are experiencing an issue in our environment with FortiNAC and would like to understand the root cause.EnvironmentFortiNAC Aruba Access Switches 802.1X enabled on switch ports Printers and endpoints authenticated through FortiNAC Wired environmentIssue DescriptionWe have several devices, including network printers and some user laptops, that intermittently lose network access.Symptoms:Device works normally for a period of time. After some time (sometimes a couple of days), the device loses network connectivity. The switch port remains physically up. Reconnecting the cable does not resolve the issue. As soon as we manually perform "Register as Device" (or re-register the host/device) in FortiNAC, connectivity is immediately restored. No switch configuration changes are required for recovery.This behavior affects both:Printers Wired laptopsObservationsDuring troubleshooting, we noticed that some affected hosts show:Last Modified By: Systemshortly before or around the time the de

DescriptionThis article describes an issue where FortiClient may continue using the previous IPsec Remote Gateway after the gateway is changed in an existing VPN profile.The new IP address is correctly displayed in the FortiClient GUI, but RemoteGWSorted may retain the previous value.ScopeFortiClient, IPsec VPN.SolutionAfter changing the remote gateway and attempting to connect to the IPsec VPN, FortiClient may display a warning indicating that the old gateway is still being used after the connection times out. A packet capture may also show IKE traffic being sent to the previous gateway.In the following registry path:HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\IPSEC\Tunnels\<VPN_Name>\P1Compare:RemoteGW.RemoteGWSorted.An affected profile may show:RemoteGW = 200.200.200.201 (New remote gateway).RemoteGWSorted = 200.200.200.200 (Old remote gateway).Workaround:Delete the affected IPsec VPN profile and recreate it with the correct Remote Gateway.After recreating the profile, ve

DescriptionThis article describes a method that can be used to determine which FortiNAC firmware version was running when a database backup was created.FortiNAC supports database restores only when the backup file was created on the same firmware version as the system performing the restore. For example, if the database backup was created while FortiNAC was running version 7.6.5, the system must first be downgraded to version 7.6.5 before the database restore can be performed successfully.ScopeFortiNAC v7.6.SolutionThe details can be checked from the CLI by running the following commands:fnac76 # execute enter-shell fnac76:~$ cd /bsc/backups/database/ fnac76:/bsc/backups/database$ zcat FortiNAC_DataBase_BackUp_2026_08_24_00_01_29_fnac76.gz | grep sysUpdate.lastVersion (246230983792640,'sysUpdate.lastVersion','7.6.7.0','SYSTEM','2026-07-23 09:31:58',''), fnac76:/bsc/backups/database$ zcat FortiNAC_DataBase_BackUp_2026_07_23_11_27_07_fnac76.gz | grep sysUpdate.lastVersion (24623098379

Hello all. We are rolling out 7.4.2 to our Mac fleet. We are seeking a way to do this via automation to auto-enable the system extensions so that when our JAMF instance touches our devices, it will install automatically. We are seeking to do this via PKG or DMG. Is this possible?

DescriptionThis article explains how to troubleshoot common FortiClient Posture Tagging Rules including Antivirus, User in AD Group, Windows Security and others.It is recommended to use the following official document as a reference alongside this troubleshooting article: Security posture tagging rule types.In addition, having FortiClient EMS v7.4.5+ will highly simplify the troubleshooting experience due to its new 'Tag Evaluation' dashboard. This article will show screenshots from this console.ScopeFortiClient. FortiClient EMS. Posture Tags. ZTNA. Windows.SolutionBelow are a list of most common tagging rules and the way to validate and troubleshoot them.Note that this article will often reference various logs from both FortiClient and FortiClient EMS depending on where the tagging rule is evaluated. Below is a list of log files and where they can be found/retrieved:FortiClient endpoint control (EC) log: C:\Program Files\Fortinet\FortiClient\logs race\FortiESNAC.log.Tagging rule sets

Hi,Is there a way to get report through fortianalyzer about rules on the firewall, not the usage of those rules?We have shared firewall for some users, and customers would like to receive reports of rules associated with their networks.It seems I can only get them to the report if there is either all logging enabled on the rules, or MTU filters record the event. I would like to have just rows of the rules, but afaik it isn't possible what I have searched?All loggin is the only way?

I am trying to create a FortiAnalyzer report that displays Sent and received interface bandwidth utilization over time for the Fortigates.The existing reports available in FortiAnalyzer provide data utilization using 5-minute averages, but they do not clearly identify the utilization for each individual interface.Below are multiple topics in the community:https://community.fortinet.com/support-forum-92/need-bandwidth-utilization-report-between-two-fortigate-devices-specific-interface-time-range-224155https://community.fortinet.com/fortianalyzer-6/technical-tip-how-to-generate-throughput-utilization-billing-report-98335https://community.fortinet.com/support-forum-92/fortianalyzer-how-to-generate-a-report-for-real-time-bandwidth-out-to-in-33756https://community.fortinet.com/support-forum-92/generate-bandwidth-utlization-report-for-specify-interface-in-faz-197578?tid=197578&fid=92As a possible solution, I enabled performance statistics on the FortiGate. FortiAnalyzer is now receiving

Dear All, Anybody can explain in laymon term what is under lay and over lay in SDWAN concept and how does it work. Why under lay and over lay need.  Thank you in advanced for sharing the knowledge.  

DescriptionThis article describes how to investigate FortiWeb Credit Card Number signature detections when the HTTP response does not appear to contain actual credit card information.ScopeFortiWeb.SolutionFortiWeb can detect possible credit card information in the HTTP response body using the Personally Identifiable Information signature category.An attack log may show information similar to the following:Main Type: Signature Detection Sub Type: Personally Identifiable Information Signature Subclass Type: Credit Card Number Signature ID: 100010001 Matched Field: none Message: Invalid HTTP Body triggered signature ID 100010001Signature ID 100010001 is the Credit Card Number detection signature and inspects the HTTP response body.When reviewing this type of event, do not only look for fields explicitly containing names such as credit card, card number, or PAN.An application-generated value can contain a numeric sequence that resembles a valid credit card number even though the value has

DescriptionThis article describes how an underlay link failure affects an IPsec overlay and the BGP routes established across the overlay.ScopeFortiGate.SolutionIn an overlay design, the underlay network provides the connectivity required to establish the IPsec tunnels. BGP can then be established between IP addresses assigned to the IPsec tunnel interfaces to exchange routes across the overlays.The following example uses two independent underlay paths and two corresponding IPsec overlays:In this topology:port4 provides the 10.10.10.0/24 underlay used by Overlay_1.port2 provides the 10.10.11.0/24 underlay used by Overlay_2.BGP is established between 172.16.10.1 and 172.16.10.2 through Overlay_1.BGP is established between 172.16.20.1 and 172.16.20.2 through Overlay_2.The local network is 192.168.1.0/24 and the remote network is 192.168.2.0/24.With both overlays available, the Local FortiGate learns the remote network through both BGP neighbors:LocalFortiGate # get router info routing-ta

DescriptionThis article explains the process and eligibility criteria for transferring a FortiToken Mobile electronic license between FortiGate and FortiAuthenticator devices.Scope FortiGate, FortiAuthenticator, FortiCloud SSO.SolutionTransfer eligibility:Customer Service frequently receives requests to transfer FortiToken Mobile licenses (EFTM0XXXXXXXXXXX) between FortiGate and FortiAuthenticator devices. Note that FortiToken Mobile electronic licenses shipped on or after August 4, 2025, are not transferable between devices, except for eligible RMA transfers. This restriction is also mentioned in the Fortinet Pricelist and FortiToken Mobile Redemption Certificate.Pricelist view:Certificate view:If the transfer restriction is not explicitly mentioned on the certificate, check the Certificate Valid Until date. The certificate is generally valid for one year from the license creation/shipping date. For example, if the certificate is valid until December 4, 2026, the license was shipped o

DescriptionThis article describes how to resolve ClickHouse not starting when the host only has IPv4.ScopeFortiSIEM.SolutionWhen the host has only IPv4:ip a 2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc fq_codel state UP group default qlen 1000 inet 10.5.144.25/18 brd 10.5.191.255 scope global noprefixroute eth0The following error may be seen under the ClickHouse logs:tail /opt/clickhouse/log/clickhouse-server.err.log 2026.08.24 14:56:37.437156 [ 42498 ] {} <Error> Application: Code: 210. DB::Exception: Listen [::]:9009 failed: Poco::Exception. Code: 1000, e.code() = 0, DNS error: EAI: Address family for hostname not supported (version 25.3.8.23 (official build)). (NETWORK_ERROR), Stack trace (when copying this message, always include the lines below):To fix the issue, change :: to 0.0.0.0 in the following files.cat /etc/clickhouse-server/config.d/listen.xml <listen_host replace="replace">::</listen_host> cat

Hi everyone, The UniFi OS GUI currently has limitations regarding routing traffic coming from an inbound VPN tunnel into an outbound VPN tunnel (VPN-to-VPN routing). If you have a Route-Based IPsec (VTI) tunnel and want to route its traffic through an outbound WireGuard client connected to a VPS/VPN provider, the standard Traffic Routes won't catch it.  After some debugging via `iptables` and `tcpdump`, I've managed to build a reliable solution using Linux **Policy-Based Routing (PBR)** and `systemd` persistence that survives UDM Pro reboots and firmware updates. Here is a step-by-step guide on how to achieve this. --- ### Prerequisites Before starting, connect to your UDM Pro via SSH and find your exact interface names:1. **Inbound IPsec VTI Interface:** Run `iptables-save | grep vti` to find it (e.g., `vti64`).2. **Outbound WireGuard Interface:** Run `wg show` to find it (e.g., `wgclt1`).3. **Inbound Subnet:** The network behind your IPsec tunnel that needs internet access through Wi

Hello, I recently updated FortiClient on a laptop to version 7.4.3.1790. Since then, the VPN has been unable to connect, and the Fortinet virtual adapters show as "Unknown Device" in the Windows 11 Device Manager. Every time I reboot the laptop, a FortiClient popup appears and says that FortiClient drivers have been installed that require a restart to finish. Each restart adds two more Unknown Devices in Device Manager.  A reinstall or repair of FortiClient doesn't fix the issue. I've tried reinstalling Visual C++ 2015-2022, but no luck there either. The two virtual adapters are supposed to show as:- Fortinet SSL VPN Virtual Ethernet Adapter- Fortinet Virtual Ethernet Adapter (NDIS 6.30) How can I fix these two virtual adapters? Thanks,Simon

Environment: FortiGate-VM64-OPC on OCI, FortiOS 7.6.7, A-P unicast HA, ha-mgmt-status enabled on port1 (reserved management interface, config ha-mgmt-interfaces with its own gateway).Two related issues, same root cause suspected:1. FortiToken Cloud MFA fails when logging into a unit directly via its own management IP - works on one unit, fails on the other. Traced to: the unit whose management interface needs to reach FortiGuard/FortiToken Cloud for validation has no outbound path. Confirmed via execute ping-options source <port1 IP> + ping 8.8.8.8 -> 100% loss, on both HA members (tested independently, not just the HA secondary).2. Separately, our OCI SDN connector (used for HA VIP failover) never completes the "refreshing IP info of instance / checking secondary ip" step in its debug output - it finishes generic resource inventory and just loops, never attempting the actual private IP move. Wondering if this is related to the same interface/routing gap.What we've confirmed:-

DescriptionThis article describes a scenario where a wildcard FQDN address object configured on a FortiGate does not cache IP addresses, even though the destination domain is being accessed successfully through a FortiProxy operating in explicit proxy mode.ScopeFortiGate.FortiProxy.Wildcard FQDN address objects.Explicit proxy deployments.SolutionThis behavior can occur when DNS resolution is performed by the FortiProxy, and the DNS traffic does not traverse the FortiGate. Since wildcard FQDN address objects rely on FortiGate observing DNS responses in transit, the address cache remains empty when the DNS exchange is not visible to the FortiGate.In this topology above, web traffic is sent to the FortiProxy using explicit proxy mode. The FortiProxy performs DNS resolution on behalf of the client; however, the DNS queries and responses follow a path that does not traverse the FortiGate, but via MGMT. Since a wildcard FQDN object is populated by observing DNS responses traversing the Forti

DescriptionThis article describes the process of checking the SRA (Seamless Rate Adaptation) status on FortiGate DSL models.ScopeFortiGate DSL models.SolutionSeamless Rate Adaptation (SRA) is an ITU-T standardized feature defined in the VDSL2 specification (G.993.2) that allows modems to adjust their data transmission speeds in real-time to match changing copper line conditions without dropping the connection.FortiGate DSL models (such as 60E DSL or 50G DSL) support bidirectional SRA, and it is enabled by default.To verify the SRA status on FortiGate, first connect to the modem from FortiGate CLI:execute telnet 240.0.0.1Then use the commands below to check the SRA status:root@ltqcpe:~# dsl_cpe_pipe g997racg 1 0 #upstream nReturn=0 nDslMode=1 nDirection=0 RA_MODE=3 root@ltqcpe:~# dsl_cpe_pipe g997racg 1 1 #downstream nReturn=0 nDslMode=1 nDirection=1 RA_MODE=3 'RA_MODE=3' indicates the SRA is enabled.

Is there anyway for RSAT tools to work with ZTNA?  Users can get to domain controller via ZTNA but RSAT tools is not working.  

DescriptionThis article describes why CAPWAP encapsulated fragmented packets may be dropped and provides workarounds.ScopeFortiOS v7.4.12 and v7.6.5.SolutionIn FortiOS v7.4.12 and v7.6.5, CAPWAP encapsulated small fragments may be dropped by the NP chip.Running the following command multiple times shows that the counter udp_ulite_minlen is increasing. diagnose npu np7 dce-drop-all [NP7_0] Counter EIF_0 EIF_1 EIF_2 EIF_3 EIF_4 EIF_5 EIF_6 EIF_7 Total ------------------------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- ------------ [27]tcp_csum 229 220 212 209 176 208 207 185 1646 [29]tcp_synoptpar 243 236 252 252 186 224 226 205 1824 [31]udp_ulite_minlen 14564938 14559284 14560158 14564480 14215132 14216066 14209976 14211117 115101151 [32]udp_csum 81 76 66 73 42 67 52 50 507 [38]icmp_csum 529 530 545 543 440 438 504 467 3996 ------------------------- ---------- ---------- ---------- ---------- ---------- ---------- ---------- -------

DescriptionThis article describes how to handle an issue where the TLS 1.0 traffic is being dropped after upgrading the IPS engine to v7.01196 even though the FortiOS version is v7.6.6 or earlier.ScopeFortiGate.SolutionThe TLS 1.0 drop is caused by a recent upgrade of the IPS engine to v7.01196.IPS Attack Engine --------- Version: 7.01196 signed Contract Expiry Date: Fri Aug 20 2027 Last Updated using scheduled update on Wed Aug 5 03:11:10 2026 Last Update Attempt: Wed Aug 10 02:45:13 2026 Result: No UpdatesThe following output is observed inside of the SSL anomaly logs:date=2026-08-10 time=11:23:45 eventtime=1786612096501738945 tz="+0400" logid="1702062101" type="utm" subtype="ssl" eventtype="ssl-negotiation" level="warning" vd="root" action="blocked" policyid=522 poluuid="f6889e34-f2a0-51f0-a2e6-3ca392aab71b" policytype="policy" sessionid=3508356123 service="SSL" profile="certificate-inspection" srcip=10.1.1.1 srcport=55555 srccountry="Reserved" dstip=10.12.1.1 dstport=999 dstcountry

DescriptionThis article describes how to deal with error -6023-11010 reported by the application Parsec when traffic goes through the FortiGate.ScopeFortiGate v7.6.x.SolutionAdmin has created a policy allowing all traffic for all services to be allowed by the FortiGate.However, the Parsec Application still reporting error -6023-11010.Collecting a packet capture of the PC, it is possible to see traffic from the STUN protocol not being replied.If traffic arrives at FortiGate but is not passed through it, to fix the issue, it is necessary to allow the STUN protocol in the following way:config firewall policy edit <POLICY-ID> set permit-stun-host enable next end