Recently active topics

DescriptionAn issue where FortiSandbox unexpectedly skips quarantining the file from network share after being rated.ScopeFortiSandbox.SolutionIn certain cases, FortiSandbox is capable of moving files from the network share to another location after rating them, such as Quarantine or sanitized locations. This can be configured once the rating of the file in the network share is complete. See Configure Network Share to keep, delete or transfer files and Quarantine for more information.In some situations, you may see that the FortiSandBox is not moving the file to the destination location as expected. The diagnose-debug netshare logs show the following:13:51:03 DEBUG [3328 ] DO_QUARANTINE_FAIL: 8432832489187295401 (original file not found.) 13:51:03 DEBUG [3328 ] DO_QUARANTINE->FAIL: 8432832489187295401 (skip quarantine for original file not found.)By default, if the option "Keep A Copy Of Original File On FortiSandbox" is not enabled, FortiSandBox might not be able to move a copy of

DescriptionA guide to the signature database version that can block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiADC.ScopeFortiADC.SolutionA remote attacker may be able to exploit this to cause an out-of-memory error and in the worst case execute arbitrary code within the context of the application.Signatures covering the PHP2Shell (CVE-2026-109618 / CVE-2026-109619) vulnerabilities are available under FortiADC WAF signature database version update 1.00074. FortiADC itself is not impacted by this CVE. For more information, please refer to the FortiGuard advisory PHP.Core.Remote.Code.Execution.Ensure that the FortiADC WAF Signature Database version is up-to-date.Log in to the FortiADC Web UI.Navigate to System -> FortiGuard -> FortiGuard Services and look for "WAF Signature".Click on "Update FortiGuard Service Definitions".Confirm the update completes and the WAF Signature database version displays 1.00074.Via CLI:You may verify the WAF Signature DB version by issuing the

DescriptionAn issue where the default admin account cannot be deleted from FortiManager after migration to a Nutanix AHV environment.ScopeThis issue has been reported in FortiManager 7.4.11, where the previous environment used was 7.4.8.SolutionThis is a known issue in FortiManager version 7.4.11 and 7.6.7. Fix it by upgrading to FortiManager 7.6.8 or 8.0.1.In this issue: after migrating FortiManager to AHV, the administrator is unable to delete the default admin account.When attempting to delete the account, the following error is displayed:user 'admin' cannot be deleted command_cli_delete:3305 delete table entry admin unset oper error ret=-29 Command fail. Return code -29

DescriptionInstructions to check the firmware upgrade profile database on FortiManager with the diagnose fwmanager profile commands. It also describes how to clear the stored profile entries.ScopeFortiManager 7.2.3, 7.4.0, 7.6.0, 8.0.0 and later.SolutionFortiManager stores the firmware upgrade profiles of each ADOM (the enforced firmware version and the upgrade schedule used for scheduled firmware upgrade tasks) in an internal profile database. Since FortiManager 7.2.3, 7.4.0, 7.6.0 and 8.0.0, the following CLI commands are available to list this database and to clear it.Check the firmware upgrade profile databaseTo list the firmware upgrade profiles of all ADOMs, run the following command in the FortiManager CLI:diagnose fwmanager profile listExample output:fwm profile files in adom root(3): adom3_aaa: { "adom_oid": 3, "data": { "checksum": "1790596055-0417879535", "description": null, "enforced version": null, "image-source": null, "schedule-day": null, "schedule-end-ti

DescriptionThis article describes a delay in transitioning a FortiSwitch port to the configured Guest VLAN after a RADIUS server rejects an authentication request. Changing the authentication priority in the 802.1X security policy can help reduce the delay.ScopeFortiGate, FortiSwitch.SolutionSymptomsWhen a device connects to a FortiSwitch port configured for 802.1X and MAC Authentication Bypass (MAB), the port may take approximately one minute to transition from the default VLAN to the configured Guest VLAN after the RADIUS server returns an Access-Reject response.In comparison, when the RADIUS server returns an Access-Accept response, authentication and network access are typically completed much faster.Root CauseThe delay may be related to the authentication priority configured in the 802.1X security policy. When the priority is set to "legacy", the switch may take longer to process the authentication sequence and transition to the Guest VLAN following an authentication failure.Resol

DescriptionUsers are redirected back to the initial login page instead of the protected resource after successfully entering their two-factor authentication token in a FortiWeb site publishing configuration.ScopeFortiWeb.SolutionSymptomsWhen using site publishing on FortiWeb with RADIUS authentication and FortiToken enabled, users enter their credentials and the subsequent token. After clicking "Continue", the browser redirects the user back to the initial login page rather than the destination site.Root causeThe issue is caused by a mismatch between the sso-domain configuration and the actual domain used to access the site. When sso-support is enabled, FortiWeb inserts a Cookiesession3 cookie. If the sso-domain value does not match the original domain, the browser does not send the cookie back in the subsequent token request. This causes FortiWeb to treat the request as unauthenticated and redirect the user back to the login page.ResolutionStep 1: Disable SSO supportDisable the sso-su

When we migrate from SSL VPN to IPsec VPN, we currently use different firewall policies based on user groups to separate access for each vendor. In that case, would the firewall policies be configured as follows?config firewall policy    edit 1        set name "vendor1"        set uuid xxx        set srcintf "ssl.Internet"        set dstintf "Internal"        set action accept        set srcaddr "SSLVPN_TUNNEL_ADDR1"        set dstaddr "SERVER1"        set schedule "always"        set service "RDP"        set utm-status enable        set logtraffic all        set groups "vendor1"    nextedit 2        set name "vendor2"        set uuid xxx        set srcintf "ssl.Internet"        set dstintf "Internal"        set action accept        set srcaddr "SSLVPN_TUNNEL_ADDR1"        set dstaddr "SERVER2"        set schedule "always"        set service "RDP"        set utm-status enable        set logtraffic all        set groups "vendor2"    nextend But if we use IPsec VPN, do we need to create

DescriptionBackend servers retransmit TCP FIN packets because FortiADC closes the session due to a timeout without notifying the endpoints, leading to perceived service slowness.ScopeFortiADC.SolutionSymptomsBackend servers initiate TCP session closures by sending FIN packets, but the client does not acknowledge these packets. The backend servers repeatedly retransmit the FIN packets. Users may experience intermittent service slowness or queuing errors during application use.Root causeIn a Layer 4 Virtual Server configuration, FortiADC forwards traffic between the client and the server. If no packets are received from either side within the configured TCP session timeout period (default is 100 seconds), FortiADC closes the session silently. Because the "Timeout Send RST" option is disabled by default, FortiADC does not send a TCP RST to the client or the server upon timeout. When a backend server later attempts to close the session with a FIN packet, the session no longer exists on the

DescriptionThis article describes the limitations of the 'diagnose traffictest' command and how to properly test hardware throughput trafficScopeAll FortiGate models.SolutionIPERF is a tool used for active measurements of the maximum achievable bandwidth on IP networks. FortiGate does have the command 'diagnose traffictest' which is a reduced implementation of IPERF on FortiOS as described in Technical Tip: Use cases for the diagnose traffictest command. The fact that IPERF implementation on FortiGate was reduced can affect the result of bandwidth and throughput tests when they were started from the FortiGate interface instead of having IPERF traffic crossing the FortiGate device.  Using a Virtual Machine with Win10 Pro and a NIC of 10Gbps behind the FortiGate 100F for example, that has 2x 10Gbps ports (x1 and x2), is possible to reach ~9Gbps of throughput.  Checking the widget of bandwidth on FortiGate for interfaces x1 and x2.  Checking IPERF results on VM.  Now using the FortiGate 1

DescriptionImporting users via a CSV file with the 'Keep existing user accounts' option enabled may clear RADIUS attributes of existing accounts and prevent user authentication.ScopeFortiAuthenticator.SolutionRADIUS attributes of users that are not in the CSV file are deleted after importing a new CSV file.When performing a bulk user import via CSV in FortiAuthenticator, selecting Advanced Options -> Keep existing user accounts clears the 'Certificate Binding' attribute for some existing user accounts. Affected users lose authentication access.Issue 1-a: Importing a local user CSV file wipes user-bound RADIUS attributes.Issue 1-b: Certificates of users that are not in the CSV file are deleted.Issue 2: CSV Export does not include certificates of type 'Trusted CA'.Issue 3: CSV Export confuses local and remote users with the same ID.These are known issues tracked under the engineering ticket ID 1208720.See: FortiAuthenticator 8.0.2 Release Notes.Reported firmware version: 6.6.6Resolut

Description:An explanation of how to set up only a single modem in FortiExtender. Setting up multiple FortiExtender modems on FortiGate requires that two Modem interfaces are configured. This article explains how to overcome the requirement to set up two modem interfaces when only one modem is in use on FortiExtender.Scope:FortiGate 7.2.x, 7.4.x, and 7.6.x.Solution:If you try to set up the FortiExtender model FX212 as a WAN extension on FortiGate, you will notice that FortiOS requires both modem interfaces to be configured.Not all sites require two modem interfaces. FortiOS does not allow you to add only one modem interface as a minimum requirement.To overcome this scenario, create a dummy interface to fulfil FortiOS requirements. The image below shows an example of a dummy interface called "DUMMY_FEX".Fortinet recommends disabling all "Administrative Access" options and also disabling the interface. The same interface in the CLI:The following are the same CLI commands that can be used

DescriptionThis article describes a known issue affecting FortiGate G-Series devices where downgrading or upgrading from v8.0.1 to v8.0.x via the GUI fails, displaying the error status 'Upgrade Failed'.ScopeFortiGate G-Series devices running FortiOS v8.0.1 build 0245.SolutionExample error: During the firmware upgrade attempt, the device status may display the following:Steps to replicate the issue: Log in to a FortiGate G-Series device running FortiOS v8.0.1 build 0245 (Feature).Attempt to upgrade the firmware to FortiOS v8.0.2 using the online upgrade method via FortiGate Cloud or the GUI.Observe that the firmware upgrade fails. The device status displays 'Online - Upgrade failed', and the Upgrade Status displays 'Upgrade failed'. In some instances, the device status may show 'Rebooting with new firmware', while the Upgrade Status displays 'Firmware info unavailable'.Check the console output and observe the following messages:Image verification OK! Failed to get the image encryption

DescriptionInstructions to enable Telnet access for a FortiPAM secret and initiate a session using the Web Telnet launcher.ScopeFortiPAM.SolutionPrerequisite: Create the target device secret by following Creating a secret. Ensure the target address and credentials are configured.Enable Telnet for the existing secret.Navigate to Secrets -> Secrets and edit the target device secret.Open Service Setting or Settings, depending on the FortiPAM version.Enable Telnet Service.Set the destination port.Enable Use Template Default Port if the template port matches the target device’s Telnet port.Otherwise, disable this option and enter the port used by the target device. The standard Telnet port is TCP/23.Select Submit to save the changes.Launch the session.Select the saved secret and select Launch Secret.Choose Web Telnet, then select Launch.Verify access.Confirm that the browser terminal opens and displays the target device’s login prompt or command-line interface.If the connection fails, ch

DescriptionThis article describes how to troubleshoot and fix an import error issue when it shows "Can not copy password attribute password from private key encrypted device".ScopeFortiManager, FortiGate.SolutionWhen FortiManager import policy package from FortiGate shows fails as following:The Download Import Report shows as following:"system external-resource",FAIL,"(name=TL-IP-BlockList1, oid=2634, reason=invalid value. object: sys_external_resource. detail: Can not copy password attribute password from private key encrypted device)" "system external-resource",FAIL,"(name=TL-BlockURL_IP_Group1, oid=2636, reason=invalid value. object: sys_external_resource. detail: Can not copy password attribute password from private key encrypted device)"What happened is FortiManager being unable to copy the password from system external-resource due to it being encrypted.To solve the issue, disable the "private-data-encrytion" in Device Manager -> Device & Groups -> select the FortiGate

DescriptionUpgrading a FortiGate 201G from FortiOS 8.0.1 to 8.0.2 via the GUI may cause the reboot process to stall and fail.ScopeFortiGate 201G, FortiOS version 8.0.1.SolutionWhen performing a firmware upgrade from FortiOS version 8.0.1 to version 8.0.2 on a FortiGate 201G using the GUI, the system initiates the reboot process but fails to complete it. The process is stuck at the 'Rebooting new firmware' stage and does not finish.Console prints the console prints 'Image verification OK!' followed by 'Failed to get the image encryption key!'. A crash occurs in the sfupgraded application when upgrading the FortiGate 201G via the GUI on FortiOS version 8.0.1.2947: 2026-10-23 23:15:32 <04672> firmware FortiGate-201G v8.0.1,build0245b0245,260909 (GA.F) (Release) 2948: 2026-10-23 23:15:32 <04672> application sfupgraded 2949: 2026-10-23 23:15:32 <04672> *** signal 11 (Segmentation fault) received *** 2950: 2026-10-23 23:15:32 <04672> Register dump: 2951: 2026-10-2

DescriptionThis article describes how to save and reuse API sessions in Postman without having to copy and paste them every time.ScopeFortiManager, FortiAnalyzer.SolutionWhen using Postman to send API requests to FortiManager, you may need to copy and paste the session ID to other requests. This process can be time-consuming, especially if there are many requests in Postman. To solve this, you can use scripts in Postman to save the session as a variable every time a login API request is sent to FortiManager. First, create an Environment in Postman to store the variable(s): Next, create the POST request for API login to FortiManager in Postman: In the same request page, click on the Scripts tab, then select Post-response:  It is possible to then enter the following JavaScript code:let session = pm.response.json().session; pm.environment.set("session", session); The first line of the code reads the “session” attribute from the API response.The second line of the code saves it as a variab

DescriptionAfter upgrading to version 7.6.8, when using the FortiGate as an Explicit Proxy with the default settings, chat messages for Copilot will be blocked.ScopeFortiOS version 7.6.8+.SolutionAfter upgrading to version 7.6.8, users who are trying to talk to Copilot may see the following message appear:This is similar behaviour to what would occur on versions 7.6.6 and 7.6.7 due to a known issue in those versions tracked under 1308272 and 1257499. If on these versions, refer to this article instead:Troubleshooting Tip: Resolving Microsoft Copilot access issues with FortiGate inspecting traffic with a policy in proxy-mode and Application Control/IPS.If being on version 7.6.8 and have this issue, check the Forward Traffic logs filtered to the user's source IP. The following log may be visible:The traffic is being allowed by UTM, but denied by the proxy due to 'traffic denied because uri too long'. The maximum length of a request for an Explicit Proxy is defined by 'max-request-length'

DescriptionThe following discusses Fortinet's recent frontier AI-assisted security hardening firmware release and how it relates to the FortiGate's FIPS-Certified/CVE-Patched firmware branch.ScopeFortiGate, FIPS.SolutionFor context, Fortinet released a series of firmware updates for the FortiGate and several other Fortinet products on October 22nd, 2026, that identified and closed a number of vulnerabilities detected with the help of frontier AI solutions. The following links go to Fortinet blog posts that discuss this recent activity:Fortinet Releases Security Hardening Release for Multiple ProductsUpdate on Fortinet Use of Frontier AI Updates were initially published to the Fortinet Support Site for the General Availability (GA) branch of firmware. However, firmware for the FIPS-Certified branch of FortiGate firmware has now been released and is available for download. Clients utilizing FIPS-enabled FortiGates are highly recommended to upgrade to one of the following releases as soon

Product: FortiClient 7.4.3.1790Operating system: Windows 11Description:Hi,I'm trying to completely uninstall FortiClient 7.4.3.1790 from my personal Windows 11 laptop.I initially tried uninstalling it through Windows Settings > Installed apps, but the uninstall failed with an error.Fortinet Support provided FCRemove.exe and advised me to seek assistance through this community.I have since run FCRemove in Windows Safe Mode and restarted the laptop. However, FortiClient still appears in the Installed apps list.The FCRemove log contains the following errors: __uninstall_drivers(), retval=1603 MSI_UninstallDrivers(), retval=1603 HrUninstallNetComponent failed (err = 1) The log also indicates that a reboot was requested and performed.Could a Fortinet engineer please review this issue and advise on the recommended procedure to complete the removal safely? I would prefer to avoid manually deleting drivers, services or registry entries without guidance.I can provide the full FCRemove lo

DescriptionSteps to resolve an issue when users fail to authenticate via LDAPS because the member-attr is incorrectly set to tokenGroups, preventing the FortiGate from matching users to their assigned groups.ScopeFortiGate.SolutionUsers cannot authenticate via LDAPS even though the LDAP server returns a success response. The authentication fails during the group matching phase.The FortiGate is configured to use the tokenGroups attribute to retrieve group memberships. If the Active Directory environment does not populate this attribute or if it is not the correct attribute for the environment, the FortiGate finds zero values and skips group matching, resulting in an authentication failure for the user.Verify the issue via debug:Run the following commands to analyze the authentication process:diagnose debug console timestamp enable diagnose debug application fnbamd -1 diagnose debug enableIn the output, the following 2 lines show the attribute that FortiGate read and how many values it f

Description This article describes how to use a custom event handler in FortiAnalyzer to raise alerts for incident response related to attacks that attempt to leverage the PHP2Shell Remote Code Execution Vulnerabilities (CVE-2026-109618 and CVE-2026-109619). A report is also provided to gain historical visibility into the logs. Note that this article provides alpha files, which are automatically generated. The article will be continually updated as more information becomes available. Scope This article contains the files necessary to load an event handler and report into the FortiAnalyzer for either a Fabric ADOM or a FortiGate ADOM. The Fabric report and event handler leverage logs from other Fortinet products that can be used to detect the attack in addition to FortiGate logs. For more information about this attack, see the following FortiGuard Outbreak Alert: PHP2Shell Remote Code Execution Vulnerabilities Solution What is included

DescriptionThis article describes how to list, create, update, and delete FortiManager Device Blueprints using the JSON API, and how to use blueprints to add model devices and model HA clusters.ScopeFortiManager.SolutionDevice Blueprints define settings used when adding model devices, including the platform, firmware, device groups, policy package, and provisioning templates. Refer to Using device blueprints for model devices.Authentication uses the Creating administrators for the FortiManager API (Bearer token) against the /jsonrpc endpoint. List existing Device Blueprints:{ "id": 1, "method": "get", "verbose": 1, "params": [ { "url": "/pm/config/adom/{{ADOM}}/obj/fmg/device/blueprint" } ] }To retrieve a specific blueprint, append its name to the URL:/pm/config/adom/{{ADOM}}/obj/fmg/device/blueprint/<Blueprint_Name>Create a Device Blueprint:Use the add method. The following example creates a blueprint named TEST_01 for the FortiGat

Hi,i had an working PPPoE IPv6 internet connection but now i noticed that this isn’t working. I don’t getting an IP address.I can’t say sice when and after what change this happen, perhaps it can also be an probem on the providers side.This is the WAN Interface config:config system interface edit "FTTH" set vdom "root" set mode pppoe set allowaccess ping set type redundant set member "port15" set lldp-reception disable set estimated-upstream-bandwidth 1000000 set estimated-downstream-bandwidth 1000000 set monitor-bandwidth enable set role wan set snmp-index 22 config ipv6 set ip6-mode pppoe set ip6-allowaccess ping set dhcp6-prefix-delegation enable set autoconf enable config dhcp6-iapd-list edit 53 set prefix-hint xxxx:xxxx:0:200::/56 next end end set username user

DescriptionThis article discusses the v7.0 specialty builds for FIPS-CC certification and the technical support period offered by Fortinet.ScopeFortiGate, FIPS-CC.Solutionv7.0 has passed its End of Engineering Support date (EoES) of 2024-03-30 and will soon be approaching End of Support (EoS) as of 2025-09-30. At the same time, Fortinet only has FIPS-CC Certified/CVE-Patched firmware available for v7.0, as work is still ongoing to have builds for v7.2 and v7.4 certified for FIPS-CC and FIPS 140-3 (see also: NIST Cryptographic Module Validation Program - Modules In Process list). Important Updates:2025-10-10: Fortinet has released a candidate build for FortiOS v7.2 FIPS-CC and has made it available for download on the Fortinet Support site. The firmware may be found under the following firmware download section: /FortiGate/v7.00/7.2/FIPS-CC-Certification-Pending/7.2.8-FIPS-CC/FIPS-Candidate.2026-01-19: FortiOS v7.2 FIPS-CC has been certified and has been made available for download on t

Hello everyone,I’m glad to be part of the Fortinet Community. As a new member, I look forward to learning from experienced professionals, exchanging ideas, and participating in discussions about cybersecurity, network security, and IT infrastructure.I’m interested in learning more about Fortinet solutions, exploring security best practices, and understanding how other professionals approach network protection and troubleshoot security-related challenges. I believe that sharing knowledge and practical experiences can help everyone strengthen their skills and improve their understanding of cybersecurity.I’ll do my best to follow the community guidelines, respect other members’ perspectives, and contribute helpful and relevant information to discussions.Thank you, and I look forward to connecting with everyone and learning from this community!