Recently active topics

DescriptionThis article describes SSL VPN disconnections affecting macOS clients approximately 4 to 5 minutes after a successful connection when Host Check is configured with the Both (av-fw) option. The antivirus validation required by this configuration is not supported for macOS clients, causing the Host Check process to remain pending until the SSL VPN login timeout expires.ScopeFortiGate, FortiClient.SolutionTo troubleshoot SSL VPN disconnections on macOS clients when Host Check is configured for antivirus validation, follow these steps:Validate the SSL VPN Host Check configuration.Navigate to: VPN -> SSL VPN Portals.Identify the SSL VPN portal assigned to the affected macOS clients and review the Host Check configuration.Verify whether Host Check is enabled with the following option: Both (av-fw)The Both (av-fw) option requires validation of both antivirus and firewall status before the SSL VPN connection can complete the required host validation process.Validate the SSL VPN c

DescriptionThis article describes how to address an issue when the FortiClient VPN 'before logon' option is not available on the Windows login screen when SAML VPN is used.ScopeFortiClient/EMS, IPsec, SAML.SolutionAfter the v7.4.4 release, FortiClient no longer supports IKEv1, which required migration to IKEv2; one of the many benefits is using SAML for VPN authentication.SAML authentication on FortiClient supports various user-agent frameworks, including external browsers like Chrome, Edge, and others (Technical Tip: FortiClient SAML Authentication Configuration Demystified).When using IKEv2 with SAML authentication and having no configured VPN before logon tunnels are available on the Windows login screen, validate whether an external browser is used as a user agent for SAML login.If it is, disable it as shown in the screenshot above, and validate whether the tunnel appears on the Windows login screen.Note: When using SAML with external browser authentication, VPN before logon is not

Hello, I would like to know if anyone in the community has any AutoCAD document with drawings of the devices, any of them really, but if I had to ask for just one, it would be the FGR-60F. If anyone has something like that, I would really appreciate it.

HI all, I’m deploying a couple of 701G fortient onver an inter DCI (one fortinet on each DC) using vxlan (on a nexus 9k) and I found that when HA is enabled the same MAC are generated and for this reason this MAC’s are getting dropped from vxlan table and HA is not forming. If HA is disabled and I leave them as stand alone and put IP’s on the interfaces they can ping each other (the same for mgmt) once HA is enabled and the virtual MAC’s come in the connectivity on HA is not working and both MGMT can’t ping each other anymore and I have a duplicated messaje on my nexus logs. Does anyone know what could be wrong? Working on a 7.4.11 Regards

Hi,I have a strange case with some fortiAPs right now. 1x FAP 231G and 1x431F both on 7.6.4. I want to set a VLAN ID to have the management tagged but the variable is missing when typing cfg -s. Then i connected to the HTTPS GUI and the field is also missing. I typed in the command cfg -a AP_MGMT_VLAN_ID=200 on the CLI and I got no error. cfg -c for commit to flash. Nothing happened. Reboot and still no change, the AP won't take the VLAN ID. I have 100 more 231G on this site and also 20x431F and they all have the variable and it works fine. How is this possible? Anyone else encountering this problem?

I am using FortiGate as aDHCP Server and Windows Serve as DNS (Active Directory). Clients are getting IP addresses correctly, but DNS records are not being created or updated automatically in WINDOWS DNS.So:DHCP works fineBut no A or PTR records are created in DNSIs this expected behavior with FortiGate DHCP, or is there a way to enable dynamic DNS updates?Any help would be appreciated.

Hey everybody I'm new . currently I'm working as a desktop engineer and I'm planning to start studying. In a fortigate firewall now can anyone tell me where to start this course any free resources youtube channel n all. 

how can implement 

We have 8 sites running fortigate with version 7.4 and 2 sites running fortigates with version 7.6. When creating ADOM, is it better to create 7.4 ADOM or 7.6 ADOM to import configurations from all sites? I assume configuration needs to be re-installed from FortiManager back to the Fortigate devices to validate configuration? 

Hello Fortinet Community,I would like to better understand the behavior of FSSO group membership updates and firewall policy matching.Our environment has an FSSO Collector Agent monitoring two Domain Controllers. FortiGate receives the user logons correctly and applies policies based on AD groups. We also configured Group Lookup every minute, and we can confirm that the updated group membership is correctly reflected in FSSO/FortiGate.However, the change is not immediately reflected in the actual traffic.For example, we have an AD group that allows AnyDesk through a specific firewall policy:When a user is added to the group, the membership is updated correctly, but the traffic policy may take some time to apply. When the user is removed from the group, FSSO shows the updated membership, but AnyDesk may continue working for some time. We completely close and reopen AnyDesk during testing to generate new connections, but the previous policy may still be matched.My questions are:Is this e

Hello, How to collect specific channel from Applications and Service Logs in Event viewer using windows agent?

Description This article describes what happens to TCP, UDP, and ICMP packets when they arrive as asymmetric flows on a FortiGate.It may be seen that hosts on some networks cannot reach certain other networks. This can occur when request and response packets follow different paths and do not cross the same firewall. This behavior is known as asymmetric routing. If a FortiGate receives the response packets, but not the requests, by default, it blocks the packets as invalid.If, for some specific reason, it is required that the FortiGate unit permit asymmetric routing, it can be configured by using the following CLI commands per VDOM:config vdom     edit <vdom_name>         config system settings             set asymroute enable         end end Scope FortiGate.Solution When asymmetric routing is enabled, the firewall will behave as follows.For TCP packets:If the packet is a SYN, the FortiGate creates the session, checks the firewall policies, and applies the configuration of the mat

DescriptionThis article describes how to deploy and verify a FortiGate VM running FortiOS v8.0 on VMware Workstation Pro. The procedure covers importing the FortiGate VM deployment package (.OVF), selecting a storage location, completing the VMware Workstation import process, verifying that the FortiGate VM has been successfully added to the VMware Workstation inventory, and reviewing the primary virtual hardware configuration before the initial startup.ScopeFortiGate VM, FortiOS v8.0.0, VMware Workstation Pro 17.SolutionPrerequisites:Before starting this guide, ensure that the following prerequisites have been completed.Register a new FortiGate VM license.Download the FortiGate VM deployment package (.OVF).Helpful References:Registering a FortiGate VM.Customer Service Tip: How to Register Fortinet Products in the Fortinet Support PortalReference: Asset Management → 2.04 Virtual Machine (VM) License Registration (PDF):Downloading the FortiGate VM deployment package (.OVF).Technical Tip

Hello,We are planning to upgrade our FortiWeb HA cluster from version 7.0.9 to a newer stable release.However, we noticed that several versions are available (7.2.x, 7.4.x, 7.6.x, 8.0.x), and it is not clear which versions are considered as mature or feature.I tried to check whether Fortinet provides a Recommended Release for FortiWeb, similar to what is available for FortiOS, but I couldn’t find any official guidance.Additionally, the upgrade path does not seem to be available on the Firmware Images console. Could you please advise:Which FortiWeb version is currently recommended for production?The correct upgrade path from 7.0.9?Any known limitations or considerations for HA environments?Anything more that i should take in considerations for the new version ?

I try to install the FortiNAC on Azure for my HA but i try search FortiNAC on the marketplace and i didn’t find fortinac as documented in thisarticle FortiNAC Azure Deployment GuideHere available images from Azure Marketplace. 

DescriptionThis article describes how to create an event handler to send an email to the administrator when log rate exceeds licensed log rate.Scope: FortiAnalyzerSolution:  Create a mail server from System Settings >> Advanced >> Mail server.   Create a notification profile from Incidents & Event >> Event Handlers >> Notification Profiles.  Got to Incident & Events >> Event Handlers and create new event handler.  Under new event handler Notifications settings select Notification Profile created in previous step. Under new event handler Rules configurations click Add New Rule to create a rule.  Under new rule settings select FortiAnalyzer as log device type and select Event Log as log type.  Under logs filters apply the filter for field gbdayusage as below. Licensed log rate can be checked from gui License Information widget or from cli using command: get system loglimitsIt will send an email notification when log exceed event is triggered.  Refere

I have been experiencing this error message when trying to install the FortiClient VPN, and I keep getting the error message "Unable to access image servers." I have read on some other forums that if I try installing the VPN while connected to a mobile hotspot, I should not get this error message. But the error still persists. Any assistance provided will be accepted.

An insightful community-member posed a challenge that made us go back to the lab and change our hypothesis: Why You Can't Add DDNS to an Existing IPsec Tunnel — and why there is no zero-downtime workaround**Environment:** FortiGate-60F (FortiOS 7.6.7) and FortiGate-30G (FortiOS 7.4.12), site-to-site IPsec, route-based.If you built a site-to-site IPsec tunnel with a literal peer IP address and later needed to switch it to a DDNS hostname, you have probably found that FortiOS accepts every command you type and then discards all of it at commit. This article covers why that happens, the field-naming distinction behind most of the confusion, and — importantly — why the workaround that seems obvious does not actually work.---## The scenarioTwo FortiGates, site to site. One side holds a static public IP. The other is a home or branch office on a DHCP-assigned public address from the ISP.The tunnel was built with the peer's current address entered literally:```config vpn ipsec phase1-interfac

DescriptionThis article explains the behavior faced in FortiNAC-F v7.6.7 where the 'Model Configuration' tab no longer appears.ScopeFortiNAC-F v7.6.7.SolutionAfter a new installation of FortiNAC-F v7.6.7 and after integrating network devices under the Inventory, the 'Model Configuration' tab no longer appears for modeled network devices:This is the normal behavior. A new selector-based architecture is introduced starting from FortiNAC-F v7.6.7, replacing the legacy 'Model Configuration' architecture.The RADIUS secret configuration was moved to the 'Credentials' tab:The Logical Network configuration was moved to Network -> Logical Networks -> Logical VLAN Mapping Configuration:The configuration details for the new selector-based architecture can be found under the following guide: Support for RADIUS-only Devices.Related documents:What's New in FortiNAC F v7.6.7.

Hello FortiSIEM Community,I’m currently working on creating a custom parser for  Aruba EdgeConnect logs in FortiSIEM, but I’m facing an issue during parser validation.Each time I create or modify the parser, the validation fails with the following error:Failed to execute node: when. Please check the usage of API and attribute name.I have double-checked the parser XML and verified that the attributes I’m using, such as hostName, procName, user, command, eventType, destName, destIpAddr, and srcIpAddr, are defined and supported in FortiSIEM.However, the error does not indicate which specific node, API, or attribute is causing the failure, which makes troubleshooting difficult.I have attached a screenshot of the parser validation error along with the current parser configuration.Would anyone with experience in FortiSIEM custom parser development be able to assist me in identifying the root cause and correcting the parser?Any guidance or example of the correct parser structure would be grea

DescriptionThis article exists to help users determine the most appropriate software release for FortiOS. The recommendations stated below are the latest as of June 2026 and are reviewed and updated every quarter.The information in this document is not meant to be exhaustive and is intended to serve as general guidance to customers, especially in cases of mass deployments/upgrades. When working with Fortinet SEs, Professional Services, or TAC: it is important to refer to their specific guidance.An additional information section has been added to the bottom of this article for answers to common questions.Subscribe to the RSS feed by selecting the three-dotted menu button to keep up to date on the latest changes to this article (note that this feature is temporarily unavailable as of June 2026).ScopeThis document is a general recommendation of FortiOS software for general customer deployments for general stability and is updated quarterly.For customers who may be leveraging the latest fe

DescriptionThis article describes an issue where the Firewall Policy page remains grey, becomes unresponsive, or does not fully display the configured policies after upgrading to FortiOS v7.6.7.ScopeFortiGate, FortiOS v7.6.7.SolutionThis behavior can be caused by a GUI policy page issue where a large number of statistics API requests prevent the policy page from loading correctly.The issue is resolved in FortiOS v8.0.1 build 0191 and is scheduled to be resolved in FortiOS v7.6.8.Workaround:Use the Firewall Policy search filter to reduce the number of policies displayed.Use a simpler policy view when possible to reduce the amount of policy and statistics information loaded by the GUI.(Optional) Disable the FortiOS GUI CDN:config system global set gui-cdn-usage disable endAfter applying the change, log out of the FortiGate GUI, close all existing FortiGate browser tabs, and log in again using an Incognito or InPrivate browser window.The browser Developer Tools Network tab can also be

I have some Reolink camera equipment on my network. Its all on the same VLAN (2 different switches), and it talks to each other, but the devices are showing the wrong IP. If I look in the Fortigate on the port the NVR is connected to for example, it says its IP is totally different than what shows on the NVR when I go into its settings. A different subnet even, as the FG says 10.x.x.x but on the device it says 192.x.x.x. Now I imagine this is just the device’s internal network it creates perhaps. But its the same thing for the cameras which are connected directly to a fortiswitch. And if I look at their mapping from the NVR, they all show the 192 addresses as well which is at odds with the VLAN they are on and what the FG tells me they should be.  It all wouldn’t matter except for one problem. I cant connect to the NVR or cameras externally. There is a firewall rule present that allows that VLAN to go out to the internet, so I’m not sure what the problem is. If I manually change the NV

DescriptionThis article describes how to address the following error which may occur when executing a custom SQL dataset on FortiAnalyzer v7.6.3:ERROR: relation "adom***_fgt_wlog" does not exist LINE 5: ...vname","csf","devgrps" ,ti6.epname AS epname FROM adom***_FG... ScopeFortiAnalyzer v7.6.3.SolutionThe issue occurs when the SQL query generated for the custom dataset references a log table that is not available in the database.For example, the following command is used to execute the custom SQL dataset:execute sql-query-dataset ADOM test1 FGVM8VTM20123456 faz "2026-07-01 00:00:00" "2026-07-01 23:59:59" The command fails with: ERROR: relation "adom***_fgt_wlog" does not exist Command fail. Return code 1To verify the SQL query generated by FortiAnalyzer, enable SQL query debugging:diagnose sql debug sqlqry dbgon diagnose sql debug sqlqry showThe generated SQL query contains a reference to the following table:FROM adom***_FGT_wlog ti1However, the database returns the following er

I have a problem with FortiClient VPN 7.0.8.0427 on a few Windows PCs. When trying to connect I get:‘VPN Connection Failure - VPN connection failed. Please check your configuration, network connection and pre-shared key then retry your connection. If the problem persists, contact your network administrator for help.’The VPN does not work with any user account on the affected PC. The same users, the same VPN profile and the same FortiClient version work correctly on other computers. The problem was already present on a fresh Windows installation, so it is not caused by software installed later. Reinstalling FortiClient also did not help.Basic network connectivity looks fine. Internet connection works, the FortiGate is reachable and the client can communicate with the VPN gateway. I tested both Ethernet and Wi-Fi with the same result. Packet capture confirms that UDP/500 traffic reaches the FortiGate and the FortiGate response comes back to the affected PC.I also tested several other lap