Recently active topics

Previously i have 5 AP under my WLC9800, then i add some APs and some existing APs is renamed. How Fortinac can sync with the new name and add new APs to the inventory? 

Servus Community,I'm trying to add a FortiGate-VM HA cluster (A-P) running FortiOS 7.4.11 to a FortiManager VM running 7.4.11. Both FortiGate VMs and the FortiManager VM are running in evaluation/trial mode.The cluster itself is healthy and synchronized. Network connectivity is fine and TCP/541 is reachable. I have also enabled:config system global set fgfm-allow-vm enableendWhen I try to add the FortiGate to FortiManager, the device discovery fails with "Probe failed".After enabling FGFM debugging, I noticed that the TLS handshake actually completes successfully. The FortiGate then sends its authentication information including the serial number:serialno=FGVMEVO4T9J2-XXXAt that point FortiManager rejects the session and logs:serial number (FGVMEVO4T9J2-XXX) in 'get' message doesn't match the subject CN (FortiGate) in peer's certificate.I then checked the certificates on both HA members.Both nodes have the same Fortinet_Factory certificate:Subject:CN = FortiGateThe certificate fingerpr

Having an issue I’ve never seen before, I have a ticket open with TAC but figured I’d see if anyone has ever seen this before. As soon as I plug the modem into my Fortigate, the modem crashes constantly and will never get a lock on the ISP signal. As soon as I unplug it and connect a laptop directly to the modem, it is able to establish a lock and I get a public IP. This occurs both if I try to get a public IP using DHCP or if I try to set one of our static IPs. The ISP has tried two of their Router/Modem combo units, as well as we have tried two Arris Surfboards, one of which is known working on a different circuit. Thanks for any help!

Hi,For training purposes, I have installed FortiManager 8.0.0 on VMware and FortiGate 8.0.0, but I am encountering the following problem: I have already tried using the SSL certificate whose serial number is specified in the CN field, but the issue still persists. fgfm-allow-vm is enabled   

Hey everyone I have been trying to login to our FortiCloud account to register couple of new FortiGates and im unable to because they security codes aren't being sent to our email. Also I did an passwort reset already and then I received an email. But I still dont receive the security code email while trying to login. Any ideas? 

Using the discount code PWDC when signing up or placing an order at Panda Wagon can help you receive 10% off, which is what initially encouraged me to explore the platform more closely. While searching for unique gaming products, limited-edition electronics, collectibles, and collaboration merchandise, I discovered https://panda-wagon.com/?ref=PWDC and quickly realized that Panda Wagon offers a very different shopping experience compared to traditional electronics stores.How I First Came Across Panda WagonI originally found Panda Wagon while looking for special-edition gaming hardware that was difficult to locate through mainstream retailers. Many collectors know how challenging it can be to find officially licensed collaboration products, particularly limited runs that combine popular gaming brands, anime franchises, and consumer electronics.After browsing the website, I noticed that Panda Wagon focuses heavily on unique products that appeal to collectors and enthusiasts. Instead of s

Using the discount code YLMC when creating an account or placing an order at PROHEAR can help you receive 10% off, which was one of the main reasons I decided to explore the brand more closely. While researching hearing protection solutions for both work and recreational activities, I came across https://www.prohearsafety.com/?ref=YLMC and quickly realized that PROHEAR focuses on a very specific but important category: protecting hearing without sacrificing comfort or convenience.How I First Discovered PROHEARI spend a considerable amount of time around loud equipment, whether it's power tools, lawn maintenance equipment, or occasional visits to shooting ranges. Over time, I became more aware of how important proper hearing protection really is. Many traditional earmuffs offer protection, but they often feel bulky or uncomfortable during extended use.While comparing different brands online, I found PROHEAR and noticed that the company specializes in hearing protection products designed

Using the discount code GET12 when creating an account or placing an order at ICUANUTY can help you receive 10% off, which is exactly what encouraged me to explore the brand in greater detail. While searching for premium display solutions for collectible models and LEGO® sets, I discovered https://www.icuanuty.com/?ref=GET12 and quickly realized that the company focuses on helping collectors showcase, protect, and enhance their prized collections.How I First Discovered ICUANUTYI have always enjoyed building collectible models, especially larger LEGO® Technic vehicles and display-worthy sets. The challenge, however, comes after the build is complete. Finding a way to properly display these creations while protecting them from dust and accidental damage is often difficult.During my search for display solutions, ICUANUTY stood out because it specializes almost entirely in display systems designed specifically for collectors. Instead of offering generic storage products, the company focuse

Dears when the hosts in registration or quarantine vlan persistent agent can’t communicate to fortinac because can’t resolve srv record and retrieve info about fortinac ip address but it retrieves portal and i think it is default in fortinacand when i search in this file i can’t find resolution for srv record except the portal.cat /var/named/chroot/etc/domain.zone.reg cat /var/named/chroot/etc/domain.zone.remso how can resolve this problem as when i search i find that for isolation VLANs it should there is record hosted locally in the fortinac

FortiWeb exporting and import ML learnings through API. I need to check the  Fortinet Developer Network (FNDN)  as to have FortiWeb in a staging environment that has ML enabled and then to export the ML learnings through API and import them on the production FortiWeb again through API will be really powerful thing.The production FortiWeb in this case does not need ML learning enabled actually enabled as maybe limiting on production the learning to fake IP as it is not needed and on Staging to the Staging Jump host or staging subnet or not limiting at all if the network is safely designed.    

Hi All,I would like to ask your help about BGP with my scenario.I have FG1 connect with some FG Spoke via MPLS and VPN tunnel. I configured BGP peer for each link with the neighbor is the ip of each link.I want to prevent FG1 advertise route learned from MPLS back to FG2 via VPN tunnel and vice versa. I tried with route map out and comminity and it work for mpls because there are separate mpls for spoke but for vpn tunnel I cant because the VPN tunnel is peering with other Spoke.Could someone advise me the solution for the scenario? 

Dear Fortinet Community,I am currently experiencing an issue with a FortiOS upgrade. I have unboxed two newly acquired FortiGate devices (200G and 90G), both of which are not yet license-activated.I attempted to upgrade their firmware to version 7.4.12. The FortiGate 200G was initially running 7.2.11, and I was able to upgrade it to 7.4.11, but the upgrade to 7.4.12 did not succeed. The FortiGate 90G was running 7.4.8, and I was unable to upgrade it to any other version.I am aware that from the 7.4.x branch onward, upgrades are generally limited to patch-level changes. However, in my case, this behavior is not consistent as expected.Any assistance in resolving this issue would be greatly appreciated.Best regards.

I have successfull sync my entra id group to the fortinac, however if i add someone to the group then why the user is not synced in fortinac?Example i add user1 to group IT then if i go to System-Groups-Remote Groups then the member still empty.

DescriptionThis article describes an issue encountered when using Entra ID group membership to provide differentiated access to end users authenticating with domain credentials.The problem occurs when group memberships for certain users are not correctly recognized. Specifically, the Entra ID Service Connector truncates the group list if a user belongs to more than 100 groups. As a result, users who are members of over 100 groups may fail authentication, and their memberships are not fully reflected in the corresponding remote group.ScopeFortiNAC-F.SolutionThis limitation results in incomplete retrieval of group memberships for users with large group associations (typically exceeding 100 groups). Consequently, not all memberships are processed, and the user may not be reflected in all applicable remote groups.It is important to note that authentication itself is successful. However, the limitation affects group-based authorization, causing incomplete group visibility.In the logs, this

 Hi,I want to create a correlation rule in FORTISIEM that detects when a VPN tunnel goes down and is not followed by a corresponding tunnel-up event within a defined time window. I have a FortiGate acting as a dial-up IPsec VPN hub for remote devices with forticlient(with auto reconnect) to be always connected 24/7.some peers generate tunnel-up events that successfully reach FortiSIEM, while other peers generate tunnel-up events locally on the FortiGate but those events never appear in FortiSIEM even though the tunnel is successfully re-established.Tunnel-down events are received consistently.Logging level is configured to "All" and I can see tunnel-up/tunnel-down events locally on the FortiGate. Has anyone experienced forwarding of IPsec tunnel-up events or know of any FortiGate logging behavior that could explain this?Thanks.

This article describes how to use the Compatibility Tool to determine FortiProxy Compatibility with FortiManager and FortiAnalyzer  

After upgrading our FortiGate device from FortiOS version 7.6.6 to 7.6.7, users at the branch lost internet access when the BambiDeep SSL/SSH Inspection profile (Deep Inspection) was used in the firewall rule.Traffic is allowed by the firewall rule, and NAT is working properly. However, HTTPS connections fail when Deep Inspection is enabled.As a temporary solution, we changed the SSL/SSH Inspection profile from BambiDeep (Deep Inspection) to Certificate Inspection, and internet access was immediately restored.  The first rule includes certificate inspection, and internet access works fine, but the second rule is the old one and includes “BambiDeep” SSL inspection; after the firmware upgrade, internet access is not working. Also ı tested the problem on new rule by adding  BambiDeep SSL inspection ant internet acces is not working. Are they any known issue about 7.6.7 version for tihs topic ?

Please tell me.Until recently, the following KB article, which describes a workaround for automatic firmware upgrades after End of Streaming (EoES), was available.However, it now displays "Access Denied." Technical Tip: Disable auto-upgrade for unlicensed FortiGateshttps://community.fortinet.com/t5/FortiGate/Technical-Tip-Disable-auto-upgrade-for-unlicensed-FortiGates/ta-p/414696 Please tell me why it has been made private.

Hi Fortinet team,So, we are upgrading our VPN to the latest software version, and we are changing from SSL VPN to IPSEC VPN, and we are thinking to deploy it via Intune, but we have encountered failures when trying to install the package.We follow the next steps:Changed the encrypted Preshared Key inside the conf file for the actual Preshared key Create Installer.ps1 with the following command: Start-Process -FilePath "C:\Program Files\Fortinet\FortiClient\FCConfig.exe" -ArgumentList "-m vpn -f <"$ConfigFile"> -o import -i 1 -p <"ConfigPassword"> -Wait -NoNewWindow -PassThru!--scriptorendfragment-->!--scriptorstartfragment--> Inside Intune we set up detection rule for the reg key: “HKEY_LOCAL_MACHINE\SOFTWARE\Fortinet\FortiClient\IPSec\Tunnels\IPSEC VPN” The weird part is that if we try running the Installer.ps1 locally/manually it works perfectly fine and it imports the conf file without issue but if we runs it via Intune, it directly says Installation Failed  Can yo

How do you transfer a call to someone’s voicemail?  In this case, a secretary has her boss’ extension programmed as a soft key on her phone so she can answer it.  A call comes in on her boss’ like, she answers, and would like to transfer it to her boss’ voicemail.  Nothing I’ve found online seems to work (I’ve read dial *9 + extension, dial **9 + extension - neither work)….  Any suggestions?

Hi, i tried to deploy FortiManager following this doc: https://docs.fortinet.com/document/fortimanager-private-cloud/8.0.0/microsoft-hyper-v-administration-guide/449452/creating-the-virtual-machineAdded a second Hard Disk in “IDE 0” Show me this error, i tried to create Fixed and Dynamically (in differents clear installations) but same error appears even when i have enough space.After this error i cant type in terminal. Any suggestion? 

Hello everyone. We bought a Fortigate 71g (7.6.7). I have experience using OpenVPN on Mikrotik and Pfsense. It was very convenient for remote access and local DNS access. The point is, we need to provide remote access to people without providing a DNS domain and server; we bind users by IP addresses, and that was sufficient. The problem is that I can't get the IPSec Fortigate to work without providing clients with a DNS server. All requests start going through the VPN tunnel, and access to local domains and DNS is lost.Detecting the client's local DNS is not quite right. For example, OpenVPN has this block-outside-dns feature. Is there a solution?Tried:1) config vpn ipsec phase1-interface    edit "test1"        set dns-mode manual        set ipv4-dns-server1 0.0.0.0    nextend2) I tried unset ipv4-dns-server1,2,33) ipsec Mode config - manual4) in the client's config in XML:         <ipsecvpn>            <options>                <enabled>1</enabled>              

Description This article describes how to enable EAP-TTLS as an authentication method in VPN-only (unlicensed) FortiClients. Scope FortiClient, EAP-TTLS authentication for IPsec VPN. Solution EAP-TTLS Support in FortiClient. FortiClient added support for EAP-TTLS authentication for IPsec VPN starting with version 7.4.3. This authentication method must be used when users need to authenticate to a remote LDAP server while connecting to an IPsec IKEv2 tunnel.     FortiToken Compatibility. Support for FortiToken with EAP-TTLS was introduced in FortiClient version 7.4.4. If FortiToken authentication is enabled, the free FortiClient version 7.4.3 will be unable to connect, as this version does not support multi-factor authentication with EAP-TTLS. For more information, refer to: Technical Tip: Multi-Factor Authentication support for Windows FortiClient with LDAP (EAP-TTLS).   Enabling EAP-TTLS. EMS-managed FortiClients. FortiClient documentation ou

FG-80FでHA構成を構築したが、「config firewall ssh local-key」の状態がPrimaryとSecondaryで異なるのはなんで？？ #Primaryconfig firewall ssh local-key    edit "Fortinet_SSH_RSA2048"        set password ENC AAAAELE8NqYyMBgEhQ7grTfXnpgDb0j1zQrGm/aSSQ1sqReRT3VeDXYDl6GmJTfjifhoYZqMV94zwzYt3BI8Li3/XhV3YaPXywj7lf2VBcKfDSbZbTvJO/8fw2pN25HAxq6I4/cd3ZX90abcxiEdz3oQ1adKVpy/75tzDx95iKJ04o6uTMByeivFhMvKizbm2xAEE1lmMjY3dkVA        unset private-key        unset public-key        set source built-in    next #Secondaryconfig firewall ssh local-key    edit "Fortinet_SSH_RSA2048"        set password ENC AAAAELE8NqYyMBgEhQ7grTfXnpgDb0j1zQrGm/aSSQ1sqReRT3VeDXYDl6GmJTfjifhoYZqMV94zwzYt3BI8Li3/XhVKqNqqBKwoZqTJvhlyp3Zj30tjCJrI4bRFjiacIgfgGLajHp73E3BtG700kjxkxzUMlTFHFg7OPISbONaK1IoYVL17IOcl6QzL6wR9NJMnLVlmMjY3dkVA        set private-key "-----BEGIN OPENSSH PRIVATE KEY-----b3BlbnNzaC1rZXktdjEAAAAACmFlczI1Ni1jdHIAAAAGYmNyeXB0AAAAGAAAABCEPyKnpOC7AuAUn8wkg717AAAAEAAAAAEAAAEXAAAAB3NzaC1yc2EAAAADAQABAAABAQC37dLSRQBZoOb49bsDn/YVhLuGlHio5XLLl9Dzy

 DescriptionThis article describes how to configure and validate the FortiGate integration with AWS IAM Identity Center using SAML. ScopeFortiGate. SolutionIn this scenario, user access to the internet is allowed only after successful SAML authentication to AWS IAM Identity Center. FortiGate acts as a SAML Service Provider (SP), and the IAM identity center is the SAML Identity Provider (IDP) where the user database is located.Operation flow:The user attempts to access any web page from the browser.FortiGate redirects the browser to the local captive portal for a short instant and then redirects again to the SAML IDP access portal.The user authenticates to the IAM identity center portal by username/password, and if enabled, will also be prompted to enter an MFA 6-digit code.IAM identity center IDP sends SAML assertions containing user information to the user's browser.The browser relays this information to FortiGate, which allows or denies access based on configured Firewall policies.Co