Recently active topics

Hey everyone, i'm sure the answer always depends but wondering who uses DARRP vs manual channel configuration. I've been using DARRP for a few years now and it works 'fine', but I have noticed sometimes it will over saturate a channel instead of using different ones. We typically reboot the AP and it will pick a different channel and things are fine. I've considered moving to a manual config. The only reason I don't is the obvious, it's manual and would love for DARRP to just work. For a scope we a few campuses and about 250APs. 

https://fortiguard.fortinet.com/psirt/FG-IR-26-156FG-IR-26-156 (CVE-2026-70465) advisory states the fix is available in FortiClient Windows 7.4.4 / 7.2.12 and later. However, the free VPN-only agent has not received a new release since 7.4.3 (per the community note that v7.4.4–7.4.8 include no new free VPN-only build).Could you confirm: 1. Is FortiClient Free VPN-only 7.4.3 (build 4726) vulnerable to CVE-2026-70465? 2. If yes, will a patched free VPN-only build be released, or is upgrading to a licensed version the only path to remediation? Thanks in advance.

Hello,We are using the free FortiClient Windows VPN-only agent, version 7.4.3.Regarding Fortinet PSIRT advisory FG-IR-26-156 / CVE-2026-70465, the advisory lists FortiClient Windows 7.4.0 through 7.4.3 as affected and recommends upgrading to 7.4.4 or later. However, the FortiClient Windows release notes state that versions 7.4.4 through 7.4.7 do not include a new release of the free VPN-only agent, and that users can continue using the 7.4.3 free VPN-only agent. Could a Fortinet representative please clarify the following?Is the latest available free FortiClient Windows VPN-only 7.4.3 build affected by CVE-2026-70465? References:FG-IR-26-156: https://fortiguard.fortinet.com/psirt/FG-IR-26-156FortiClient 7.4.7 release notes: https://docs.fortinet.com/document/forticlient/7.4.7/windows-release-notes/683433/special-notices This is a request for clarification of the public PSIRT advisory’s impact and remediation path for the free VPN-only edition

I mean, they are easily powerful enough and fit out usecase. No technical problem at all but they were released in 2019 and go eol September 2031. It does not sound clever to me to lose more than half of its lifespan.

We are testing FortiClient WebFilters and we are trying to test incognito mode extensions. It works on Windows browsers, but not macOS. Windows users get a pop-up asking to approve the new extension. (see example).None of my browsers have any FC extensions. Does this work on macOS?Bonus question: Can this pop-up be suppressed? 

The FortiClient VPN-only version 7.4.3.4323 has been installed onto a MacBook running macOS 26. Full disk access has been given to fctservctl2 and the network extension FortiTray has been enabled although FortiClientProxy and FortiClientPacketFilter were not present to enable. The settings for this VPN use the public IP address of the FortiGate and various DH Group and encryption levels have been tried but all to no avail. The VPN connection is IPsec VPN and tries connecting for a while then comes back with a connection timeout error. The native IKEv2 client for macOS does not work either. I read somewhere that Fortinet added macOS Tahoe 26 support in FortiClient 7.4.5 but there is no VPN-only version later than 7.4.3. I have also read that SSL-VPN support is being stopped so surely there needs to a new VPN-only version where IPsec VPN can be used. Is there ever going to be a newer VPN-only version released? Or is the option available now FortiClient Standalone? This does not seem to b

We received a notification last Friday regarding the need to upgrade our FortiEMS system. As per the schedule, we initiated the upgrade on Saturday at 1:00 AM.However, since Monday, we have been unable to access FortiEMS. The system continuously displays an "upgrade in progress" status, and refreshing the browser every 10 minutes has not resolved the issue.

DescriptionThis article describes how to resolve the failure to establish an FGFM connection between a FortiGate device and a FortiManager when the FGFM debug log on FortiManager indicates 'unsuitable certificate purpose'.ScopeFortiGate, FortiManager.SolutionWhen an FGFM connection fails to establish and the FGFM debug log includes a message that contains the text 'unsuitable certificate purpose', then this mostly likely means that the certificate that is being presented by the FortiGate device to FortiManager during TLS negotiation of the FGFM connection does not have the correct Extended Key Usage (EKU) extension.In the context of the FGFM connection, the FortiGate device takes on the role of a 'client', whilst the FortiManager acts in the 'server' role.The FGFM connection employs mTLS as a means to authenticate the connecting FortiGate device.For mTLS, the certificate that is presented to the 'server' (FortiManager) by the 'client' (FortiGate) needs to contain information about the

Hello i want to know the correlation latency for fortiSIEM 2200G because i cant seem to find it anywhere mentioned in the documentatios

We are a 100% cloud-based org using M365. We are 85% Windows and 15% Mac. We use FortiClient EMS Cloud to manage/publish ZTNA and VPN connection profiles to users. We have the FortiClient EMS configured with Domain Authentication and connected to our Entra ID tenant. The appropriate groups are assigned, and registration is seamless and it works. I fully understand that Mac OS is very different and does not support  Entra ID authentication with EMS. The Fortinet EMS admin guide says, “FortiClient (macOS) does not support native Entra ID integration with EMS. For the integration to work, macOS endpoints must be managed by Intune or JAMF and enrolled to company portal using Entra ID.” Adding an Entra ID server | FortiClient 7.4.5 | Fortinet Document LibraryThat last sentence says it’s possible to use Entra ID integration for Macs. Our Mac machines are registered to Intune through JAMF PRO and enrolled to Company Portal. Domain Authentication will not work, and I know that. Which registrat

Hi everyone,We would like to ask for assistance regarding CVE-2024-21762 on a FortiGate FG-100F currently running FortiOS 7.2.8.Our customer is requesting us to remediate this security vulnerability.Could anyone please confirm whether FortiOS 7.2.8 has already addressed CVE-2024-21762?If not, what is the recommended action and remediation procedure to fix this vulnerability?This is an important security issue and needs to be addressed as soon as possible. Any official guidance or recommendations would be greatly appreciated.Thank you for your support.

Hi all,I've made a free firewall migration tool, now available on GitHub: https://github.com/gateshift/gateshiftIt's still in beta, and feedback from people who actually do this work would be welcome.If you run firewall migrations or optimizations, give it a try and let me know where it falls short. 

DescriptionThis article describes how to configure lesser number of log file rolled by FortiMail to be exported for backup purposes.ScopeFortiMail.SolutionIf exporting the log files from FortiMail is always required and downloading multiple log files directly from FortiMail is not supported (the download button will be greyed out), the following suggestion can be considered.Navigate to Log & Report -> Log Setting -> Local and configure as per the screenshot.It is also possible to configure using the CLI command below:config log setting local set rotation-size 500 (MB) set rotation-period 365 (Days) end

SymptomsWe were configuring FortiClient EMS invitations using Domain/LDAP authentication.The environment appeared to be correctly configured:The Active Directory domain was successfully imported into EMS. Users were visible in EMS and could be selected when creating an individual invitation. No errors were reported in the AD Connector logs. EMS synchronization with AD appeared healthy.However, when users attempted to authenticate through the Domain/LDAP invitation workflow, they entered their AD credentials and the authentication window would remain in a continuous loading state indefinitely, without returning any error message. TroubleshootingInitially, no obvious issues were visible in the EMS GUI or AD Connector logs.To investigate further, we enabled Debug Log Mode on EMS and reproduced the issue.The debug logs revealed the following message:Authentication error: User not found in DBThis was unexpected because:The user existed in Active Directory. The user had already been imported

DescriptionThis article describes how to configure FortiMail Data Loss Prevention (DLP) to detect Malaysian identity card numbers in email messages and attachments.ScopeFortiMail.SolutionFortiMail DLP can use user-defined sensitive data, including regular expressions, to identify specific information in email traffic.For example, a Malaysian identity card number can be detected using a pattern matching the commonly used format:YYMMDD-SS-####Note:The regular expression should be adjusted according to the organization's actual identity-card format and detection requirements.Create the Scan rule:Go to:Data Loss Prevention -> Rule & Profile -> Rule.Select the appropriate pattern type, such as Regular Expression.Enter the regular expression for the identity card number.For example: \b\d{6}-\d{2}-\d{4}\b.Save the configuration.FortiMail supports user-defined sensitive data, such as words, phrases, and regular expressions.Create a DLP Rule:Go to: Data Loss Prevention -> Rule &amp

DescriptionThis article describes how to use an external IP address database as an 'External Feeds' connector with an external application over an API.ScopeFortiGate.SolutionWhen there is a need to use an external IP database with a third party that will use an external API key with the use of an FQDN, follow the following:Go to Security Fabric -> External Connectors -> Create new. After selecting Create New, choose the category External Feeds (IP address). After selecting the IP Address category, it will be necessary to fill in the following: Status -> Enable.Name -> Customize as needed.Update method -> External feed.URL of external resource -> Here is the need for the FQDN + API key given by the third-party service. With this configuration, the external feed with the FQDN+API will start working.

DescriptionThis article describes how to solve the error 'This sts.windows.net page can't be found' after the 2FA page pops up when authenticating over SAML.ScopeFortiGate, IPsec, SSO.SolutionThere are scenarios when connecting to a VPN with SAML authentication where the 2FA screen pops up, but the next error is shown: 'This sts.windows.net page can't be found'.The error means the URL 'IdP single sign-on URL' used by the IdP is wrongly configured on the FortiGate. This can be verified using the next command: FGT_TEST # config user saml FGT_TEST (saml) # edit "XXXXXX" FGT_TEST (XXXXXX) # showInside the 'XXXXX', specify the name of the SAML user profile, which can also be identified by going to User and authentication -> Single Sign-On, and the name of the profile is shown there:Check the URL and see if it is wrong: Correct URL that needs to be verified on the IdP side and also an example on the FortiGate side:  After the URL is fine, the issue should be fixed and not persist.

Hello, While I'm trying to install policy package to device, the copy of the package is working fine and then when it enters the state of "Install package to device from commit" the management tunnel goes down for some reason and I'm receiving the following error message "fgfm install run script error(st=2,logsz=150,errno=0 No response from remote" Updating the device, it goes online again but with a Config Status "Conflict" Any advise please?

DescriptionThis article describes an option needed to enable 802.11ax on FortiAP managed by FortiEdge Cloud.ScopeFortiAP managed by FortiEdge Cloud.SolutionTo enable 802.11ax on FortiAPs managed by FortiEdge Cloud,Verify that the High Efficiency feature is enabled on the SSID configuration.Go to Wireless -> SSID -> Edit and check if High Efficiency is enabled.This option requires an Advanced FortiAP management license. If FortiAP does not have this license, High Efficiency will not be enabled on FortiAP even if the option is enabled on FortiEdge Cloud.

DescriptionThis article describes why using a 'hidden' SSID is not considered a good practice in enterprise wireless networks.ScopeFortiAP, FortiGate as a wireless controller, Fortinet LAN Edge.SolutionIt is not considered good practice to use a 'hidden' SSID because the beacon frame is sent with an empty SSID field by the FortiAP. With a sniffer, it is possible to capture the association request from devices that are going to connect, which must include this string. These frames, by their nature, are not encrypted and can be captured easily.Additionally, this behavior is expected. In the situation of using a 'hidden' SSID, the only way clients can discover the network is to use active scanning, where the data of the 'hidden' SSID is visible. See Technical Tip: Wireless Roaming for more information.For iOS, the use of hidden networks is completely discouraged. After some time, the device marks the network as inoperative and does not attempt to connect again. It will not detect the netw

DescriptionThis article describes how to extend the retention period for the FortiMail Personal Quarantine beyond the default 14 days by creating a resource profile with the desired retention period and applying it through a recipient policy.ScopeFortiMail.SolutionBy default, FortiMail retains messages in the Personal Quarantine for 14 days, after which the messages are automatically deleted and can no longer be released or reviewed.The retention period is not configured directly in the personal quarantine settings. Instead, it is controlled by the resource profile associated with the recipient through a recipient policy.To extend the retention period, create a resource profile with the desired value and associate it with a recipient policy that matches the users requiring the change:Go to Profile -> Resource and select Create New to create a resource profile, or select an existing profile to edit.Configure the wanted retention period, in days, for messages in the personal quarantin

Hello,I currently have SSL VPN active and I want to switch to IPsec VPN (IKEv2 Remote Access).Environment:FortiGate model: FG-101FFortiOS version: 7.4.11VPN type: IKEv2 IPsec Remote AccessAuthentication: FortiAuthenticator 6.5.6 build 1391 (GA) with OTPDirectory: LDAP users and groups from Active DirectoryClient: FortiClient 7.4.3 Hotfix 1 (7.4.3.8758)I am configuring an IKEv2 IPsec remote access VPN that authenticates users via FortiAuthenticator using LDAP credentials and OTP.The VPN connection is not successfully established from FortiClient.Phase 1 (SA_INIT) completes successfully, but the connection fails during user authentication (EAP phase).FortiClient shows the following error:Wrong EAP credentialsHas anyone encountered this issue when using IKEv2 with EAP authentication and FortiAuthenticator OTP?Any suggestions or troubleshooting steps would be appreciated.Thank you.

Description   This article describes an issue where the FortiGate admin pre-login page displays raw HTML code instead of rendering the 'Pre-login Disclaimer Message' as intended, despite the message format being set to HTML.   Scope   FortiGate v7.2.11, v7.4.8, v7.6.3.   Solution   When a basic HTML pre-login disclaimer is defined, the FortiGate GUI displays the raw HTML code on the login page instead of rendering the formatted message.   For example, defining the following basic HTML pre-login disclaimer causes the login page to display the raw HTML code instead of rendering it.   tau-kvm171 config system replacemsg admin pre_admin-disclaimer-text tau-kvm171 (pre_admin-discla~ext) showconfig system replacemsg admin "pre_admin-disclaimer-text"set buffer "<!DOCTYPE html><html lang=\\\"en\\\"><head>Test</head><body>Test</body></html>"set header httpset format HTML <----- Format changed to HTML using CLI.

DescriptionThis article describes the command to backup configuration files from the command line using a TFTP server.ScopeFortiGate.SolutionFor more information, refer to the FortiOS CLI reference guides available in the Technical Tip: Differences between FortiGate CLI commands 'execute backup config' and 'execute backup full-config'. execute backup config tftp <filename_str> <server_ipv4> [<backup_password_str>] execute backup full-config tftp <filename_str> <server_ipv4> [<backup_password_str>]Note:The [<backup_password_str>] parameter is optional and can be skipped by pressing Enter after specifying the server IP.When choosing a backup method, use 'full-config' to include all default values for advanced audits or system rebuilds.For example, to backup the FortiGate unit system configuration to a file named fgt.cfg on a TFTP server at IP address 192.168.1.23, use the following command:execute backup config tftp fgt.cfg 192.168.1.23 Note:Ther

Hello everyone,I’m looking for the best way to review configurations and rules on FortiGate Firewall and FortiWeb. Are there any tools available for this, or benchmarks to follow?Any suggestions would be greatly appreciated!Thank you!