Recently active topics

Hello everyone, I have a few questions about how synchronization works at the HA group level.Virtual IPs (VIPs): Are VIPs synchronized across all the clusters/units that belong to the HA group, or must they be configured separately on each cluster? DKIM keys: Are DKIM keys synchronized across all the units/clusters in the HA group? Or do we need to generate or import them manually on each one? “Action on failure” in the HA group: When this option is set to “Wait for recovery and switch to configured role”, what happens when Site A comes back after being down while Site B was acting in its place? Does Site A resynchronize and apply the configuration changes made on Site B during the outage before switching back to its configured role? Or does it come back with its old configuration, potentially overwriting or ignoring the changes made on Site B? Thanks in advance,BR,

How and more importantly when are we supposed to update the OS using emscli please?This is the EMS Ubuntu 22 appliance from Fortinet running EMS 7.4.8 not a DIY Ubuntu build with EMS installed on it.EMS is up to date but the documentation doesn't seem to cover the OS updates but you read things on here about not updating because it can break EMS and so on https://100001.onl/ .

DescriptionThis article describes an issue with the default IPSEngine 7.01200 that is being distributed with the installation of FortiOS 7.6.8. The IPSEngine will be installed for FortiOS through the upgrade process or a fresh installation. ScopeFortiOS 7.6.8.SolutionAfter upgrading or installing FortiOS 7.6.8, a FortiGate configured with an IPS profile may face an issue with conserve mode caused by IPSEngine:FGT # diagnose sys top-mem 20 ipsengine (32351): 4935072kB ipsengine (32350): 1898962kB ipsengine (32349): 1341961kB ipsengine (32352): 697470kB node (3604): 94104kB mvl.user (2258): 81701kBThe output for crashlog will show the following:FGT # diagnose debug crashlog read | grep "conserve mode" 2026-10-16 10:26:40 green="13075 MB" msg="Kernel enters memory conserve mode 2026-10-16 10:27:24 green="13075 MB" msg="Kernel exits memory conserve mode" 2026-10-16 12:33:56 green="13075 MB" msg="Kernel enters memory conserve mode 2026-10-16 12:39:56 green="13075 MB" msg="Kernel exits memor

 Product: FortiManager VM64-KVM, v7.4.12 build 2836 (GA.M), downloaded from the support portal (VM Images, KVM).Problem: On first login the GUI shows the license page. With “Free trial” selected and FortiCloud login (valid account, the credentials work on the FortiCloud portal), the activation fails.GUI message: “Unexpected error happened while processing your request, please refer to error section in response for more details.” HTTP: POST /gui/userauth returns 401. CLI debug (diagnose debug application gui 8 / curl 8): “Error when retrieving trial license from FortiCloud: Unexpected error happened while processing your req.”Environment: KVM/QEMU on Ubuntu (WSL2), user-mode NAT networking, outbound HTTPS works (forticloud.com reachable, DNS OK). Serial shown: FMG-VM0000000000, License Status: Valid in get system status but the GUI keeps forcing the license page. VM UUID is set and unique. System time is correct.Already tried: reboot, fresh disks, DNS fixed, different attempts; the same

Mostly AI Generated, but results of my own work. After considerable troubleshooting, I've successfully implemented Windows Native Always On VPN (AOVPN) Device Tunnel with FortiGate 7.4.13, using machine-certificate authentication, Microsoft Intune, and Active Directory authorization.First, credit where it's due: Richard Hicks (richardhicks.com) has published excellent documentation on Windows AOVPN that helped tremendously.Also, let's be clear: FortiClient already provides always-on, pre-logon VPN connectivity using machine certificates and, in my experience, does it better than Windows native AOVPN.However, if you're like me and have valid reasons not to use FortiClient VPN, this post is for you.Our EnvironmentWe're using: FortiGate running FortiOS 7.4.13 Windows native IKEv2 Device Tunnel Enterprise CA with machine certificates deployed through Intune SCEP Microsoft Entra hybrid-joined Windows computers Active Directory LDAP for computer authorization Intune-managed split-t

We have been using IPsec VPN with a peer group and peers.The peers have the CA cert of the EMS server and the subject as part of the peer identifier. This has always worked fine until the upgrade to 7.4.13 where we get an “invalid certificate” error and no connection. If the Peer Option is set to Any Peer ID then the VPN connection works. I’ve looked through the “known issues” of 7.4.13 but nothing applies.Any ideas?Thanks.

We have standardized on using Power BI for reporting metrics on our different systems.  Has anyone created FortiSOAR reports using an external report system like Power BI?  If so, how did you accomplish this?

After upgrading to 7.4.13, many APs are no longer connecting to the firewall. A small number are connected, but most are not.What can be done, or is this a known issue?

I’m using Fortianalyzer 1000F version 7.6.8. I have a myriad reports that run daily based on traffic logs. These reports get mailed to IT and Security staff. What I find though is that the reports get sent even if there are no results. Any other reporting tool I have seems to have an option to only send mail alerts/reports if there are results (Splunk etc.)Is this possible in Fortianalyzer? If not, are there alternatives ?

Hello everyone,I’m trying to run sudo commands using the csadmin user, but I’m getting the following error:Sorry, user csadmin is not allowed to execute '/bin/vi /etc/pki/tls/openssl.cnf' as rootI’m trying to follow this article about troubleshooting the Exchange/Microsoft WinRM connector error: Also I don’t have access to the root account, and I’m also unable to change the root password.Could anyone advise me on the correct way to:Edit /etc/pki/tls/openssl.cnf using the csadmin account? Obtain the required sudo/root privileges? Reset or change the root password if necessary?Thank you.

Hello everyone,I know that the collector should be in sync with the supervisor and worker cluster. But what if the collector is deployed in an environment with a different time zone?For example, if the cluster is configured to use UTC+2, but the collector is deployed in an environment using UTC+1, should I configure the collector to use UTC+1 in time zone? or UTC+2?Will the logs work normally, or will there be a time skew issue?Thank you!

Hi All,I have fortigate firewall (OS 7.6.7) with two WAN interfaces (WAN1: 10.10.10.1 & WAN2: 20.10.10.1)And configured IPsec tunnel on WAN1 10.10.10.1), generally we can add another public IP as secondary IP to IPsec tunnel.But now I want to add WAN2 IP (20.10.10.1) as secondary IP to my existing tunnel, which is configured on WAN1 interface. Will it possible?, or in traditional way have to configure two IPSec tunnels?

I am trying to configure my Fortigate 60E using the Ansible ForiOS Galaxy plugins. Currently I am working on the vip configuration. For most of the vips it is working fine but I can't get the ssl vip to work.I would like to set up a ssl vip of type server-load-balancer like this:- name: "Configure {{ vdom }} vdom virtual IP for IPv4" fortios_firewall_vip: vdom: "{{ vdom }}" state: "{{ state }}" access_token: "{{ token }}" firewall_vip: name: "vip_ssl_placeholder" extintf: "management" extip: "10.10.10.1" extport: "6363" type: "server-load-balance" server_type: "ssl" monitor: - name: "tcp-6363-link-monitor" ldb_method: "least-rtt" persistence: "ssl-session-id" realservers: - id: "1" ip: "10.16.10.1" port: "6363" - id: "2" ip: "10.16.10.2" port: "6363" ssl_mode: "full" ssl_certificate: "Fortinet_Factory"However, when applying the script I get an error -56 from the Fortigat

Hi Everyone,We have a fortigate firewall with HA and FortiOS is 7.4. also laid few client based FortiGate SSL-VPNs accounts.Now we have to upgrade either 7.6 or 8.0, where as not support the client based FortiGate SSL-VPNs accounts. So, what is the best practice for moving to 7.6 or 8.0 version?.Before upgradation can we use any migration tool only for SSL-VPN accounts to IPsec or any other?.MY SSL-VPN purpose is providing the RDP access & Web based internal urls.  Anyone guide me for best practice for without any production impact?.Thanks in advance.  

Running FortiClient 7.4.8.2066 on Windows 11 25H2.What’s happening, Users can connect, everything works.  Next time they open laptop, unable to connect VPN Software.The Fortinet SSL VPN Virtual Ethernet Adapter is disabled.  Simple restart of laptop re-enables card, works again.    100 Users, at any one moment in time, 30 NICs are disabled on average.My best guess, and it is a guess, relates to Power Management on WiFi card.  Windows is disabling WiFi when you put laptop to sleep.  This event disables FortiClient NIC.  Wake laptop up, WiFi enables itself, FortiClient doesn’t.Has anyone seen this before ThanksBryan

Since yesterday morning a lot of websites give a 400 Bad Request ( see screenshot) when DeepInspection is enabled.Disabling DeepInspection fixed the problem.I also saw other issues relating DeepInspection(https://community.fortinet.com/support-forum-92/some-website-not-loading-with-deep-inspection-230891) But this seems to be other. We already have policy in Proxy mode en disabling AV is also not working.We use firmware level 7.4.13. More people have issues with this? 

This article describes how to identify a Supervisor with DB node whose PostgreSQL replica stopped following the database Leader after a failover or switchover. It also describes how to rebuild the replica and how to detect the issue before it affects the cluster.

DescriptionTroubleshooting steps for installation failure in FortiManager version 7.6.8 due to the 'udp-not-quic' option under 'config firewall ssl-ssh-profile' when installing to FortiGate models with 2GB of memory.ScopeFortiManager.  SolutionIn version 7.6.8, FortiManager has added some lines to the configuration to push. For example:config firewall ssl-ssh-profile edit "custom-deep-inspection" config https set udp-not-quick allow end config dot set udp-not-quick allow end next endWhen installing on FortiGate models with 2GB of memory, this change causes the installation to fail.These models do not support this option in FortiOS version 7.6.This behavior is due to a known issue, with ID 1352524.Workaround: Set 'udp-not-quic' to 'block' in the affected SSL/SSH profiles.Set udp-not-quic to block in the https and dot sections of the affected SSL/SSH profiles.Go to Policy & Objects -> Advanced.Select the CLI Configura

Fortinet Video Library — October 2026 Roundup Hi everyone, here are 12 full-length videos published on Fortinet’s official Video Library YouTube channel during October, checked through October 30. I’ve grouped them by product and included YouTube and video.fortinet.com links. Shorts are excluded.FortiGate & FortiOSOct. 28 — FortiOS 8.0.1: Configuring Hashed External Feeds to Block WebsitesYouTube | Fortinet Video Library Oct. 27 — FortiOS 8.0: Steering SD-WAN Traffic Based on Underlay BandwidthYouTube | Fortinet Video Library Oct. 22 — FortiOS 7.6.8: Configuring Application Hold Timer to Hold Newly Created Application SignaturesYouTube | Fortinet Video Library Oct. 13 — FortiOS 8.0: Using IPAM for Dual-Stack IPsec VPN Remote Endpoints' IPv6 Address AssignmentYouTube | Fortinet Video Library Oct. 8 — FortiOS 7.6.7: Enabling NPU Offloading for IPsec VPN over VNE Interfaces to Improve PerformanceYouTube | Fortinet Video Library Oct. 6 — FortiOS 8.0.1: Configuring User-Defined Applicat

DescriptionAfter upgrade to FortiOS 7.6.8, administrator SSO authentication fails. FortiOS access requires a local administrator or a RADIUS/LDAP/TACACS+ administrator account.ScopeFortiOS 7.6.8.SolutionAfter upgrade, administrator SSO will fail with the error message "Single Sign-On Failed", without presenting any option to enter an SSO administrator credential.The following FortiOS login methods are confirmed affected by the issue:Administrator FortiCloud SSO.Administrator third-party SSO, for example see Technical Tip: Configuring SAML SSO login for FortiGate administrators with Entra ID acting as SAML IdP.Security Fabric SSO with root FortiGate as IdP, for example see Configuring single-sign-on in the Security Fabric.Confirmed not affected:VPN user SSO authentication.Other FortiOS versions including FortiOS 7.2.14, 7.4.13, 7.6.7 and 8.0.2.Local administrator authentication.Remote administrator authentication using RADIUS/LDAP/TACACS+.While access to the FortiGate from FortiManageme

DescriptionAfter upgrading to FortiOS 7.6.8, administrators may be unable to configure an IP address for new VPN tunnels via the GUIScopeFortiOS 7.6.8.SolutionIf you try to configure only the IP address, the following behavior is observed: The FortiGate will not display any error message, but the Tunnel interface will remain with the default IP address 0.0.0.0/0.0.0.0.If you try to configure the tunnel IP address and the Remote IP address at the same time, the IP field will revert back to 0.0.0.0 and the GUI will display an error message:Error message:IP must be set if remote IP is defined.Must set ip if remote-ip is defined.Object set operator error, -118 discard the setting.SolutionThe issue is under investigation, and a permanent fix is not available yet.WorkaroundConfigure the IP address and remote address via the CLI with the following commands:config system interface edit <tunnel-interface> set ip <ipaddress> 255.255.255.255 set remote-ip <remot

DescriptionAn explanation of the retirement of Legacy FortiDLP Tenant Domain.ScopeFortiDLP.OverviewOn November 30th, 2026, two years after Fortinet acquired Next DLP, access to the FortiDLP Console using the legacy reveal.nextdlp.com domain will no longer be supported. The FortiDLP Console will only be accessible via the FortiCloud Services menu or https://fortidlp.forticloud.com.From that date onward, to access the FortiDLP Console, the following is required:A FortiCloud account containing a valid FortiDLP license registration.All FortiDLP operators must be configured in the FortiCloud account as IAM users with access to FortiDLP.FortiCloud accounts can also be integrated with an external IdP for SAML SSO login. For assistance, contact your Fortinet Account Representative.For a smooth transition, complete the following steps before November 30, 2026:Verify that all operators can log in to the FortiDLP Console using their FortiCloud IAM User accounts.Update all references to the legacy

DescriptionCheck the installed license and administrator profile when saving a Security Action returns HTTP 403. The required entitlement depends on whether the action is used for Security Incidents or Endpoint Compliance.ScopeFortiNAC with a PLUS license.SolutionSymptomsWhen you add a Security Action, such as Set Host Role, clicking OK can display the following error even when the administrator profile has all available permissions selected:Add Event Action Error - HTTP Status 403 - Forbidden The requested URL was not found on this server.In the browser developer tools, the failed save request appears as:POST /actions/policy/event-action/ HTTP 403 ForbiddenAdmin permission request and attribute error:License and permission requirementsThe installed license controls the available feature set. The administrator profile controls which licensed operations you can perform. Selecting all available administrator permissions does not enable features outside the installed license. See the Fort

Product: FortiGate-80F-POE, S/N FG80FPTK24000713 Firmware: FortiOS v7.6.8 build3744 (GA.M); IPS Engine 7.01200; AV Engine 7.00062 Severity: 3 (business impact, workaround available)SummarySince Windows clients started sending hybrid post-quantum key shares (OpenSSL 3.5+, Chrome/Edge), TLS 1.3 handshakes from Windows hosts through our FortiGate time out. The ClientHello (~1.5–2 KB) is split into two TCP segments. For sessions without the TCP timestamp option (Windows default timestamps=allowed), the FortiGate ACKs the second segment to the client on behalf of the server. It then retransmits that segment on wan1 about 6 times, and the server never acknowledges it. The handshake hangs until the client times out (FIN from server after ~15 s, or RST after ~35 s).macOS clients (TCP timestamps on) are unaffected through the same policy, with the same NAT IP and destination, and even with a byte-identical ClientHello split at the same offsets.This looks related to KB “ERR_SSL_PROTOCOL_ERROR wh

Description   This article describes the basics of TACACS+ authentication, how this can be used for authorization, and general troubleshooting logs.  Scope   FortiAuthenticator.   Solution   Provides Authentication, Accounting, and Authorization for devices as routers, switches, firewalls, and servers. Uses TCP port 49, and the payload is encrypted, providing security.    Working: User attempts to log in.  Username is checked locally; if present, it is forwarded to the TACACS+ server.  Password is verified successfully, forwarded, and processed to verify the Trusted host list. The required profiles and resources are allowed for the user. Successful authentication returns the Vendor-specific attributes (VSA) as per the specified user group.   Successful snippets of logs for reference. TACACS+ Authentication logs:   2025-12-09T09:42:08.789839+00:00 FAC01 authen_tac_plus[2916]: 10.10.10.2 test1 ssh 10.10.10.1 pap login succeede