Recently active topics

DescriptionThis article describes how to create a CLI script on FortiManager and configure it to run automatically on the FortiGate after every device install (policy package or device settings installation).ScopeFortiManager 7.x and 8.x.SolutionSome settings are changed or reverted by an install from FortiManager, or cannot be managed from the policy package or device database. A CLI script that runs directly on the FortiGate after each install can restore the required configuration without a manual step.For this, create a script with the target "Remote FortiGate Directly (via CLI)", then enable "Automatic execute after each device install" in the script schedule.Step 1: Create the scriptGo to "Device Manager" -> Script.Select "Create New".Enter a name for the script (for example, "post-install-script").Set "Type" to "CLI Script".Set "Run script on" to "Remote FortiGate Directly (via CLI)".In "Script Detail", enter the CLI commands to run on the FortiGate. For example, for a FortiG

i access FortiAP 231F through https with its ip managment but i can’t find options to configure ssids and make it in bridge mode but i can’t configure it ?how is it possible to do this? 

DescriptionFortiWeb and FortiAppSec vulnerability status and available attack signatures to protect applications against CVE-2026-109618 and CVE-2026-109619.ScopeFortiWeb, FortiAppSec.SolutionSymptomsDetermine whether FortiWeb and FortiAppSec are vulnerable to CVE-2026-109618 and CVE-2026-109619, and identify the specific attack signatures needed to protect backend applications.Root CauseCVE-2026-109618 and CVE-2026-109619 are vulnerabilities related to PHP Core Use After Free Remote Code Execution.ResolutionVulnerability StatusFortiAppSec is not vulnerable.FortiWeb itself is not vulnerable.Protection for Backend ApplicationsTo protect applications behind the Web Application Firewall, use the following attack signatures available for both FortiWeb and FortiAppSec:090502651 - PHP.Core.Use.After.Free.Remote.Code.Execution090502654 - PHP.Core.Use.After.Free.Remote.Code.Execution090502648 - PHP.Core.Use.After.Free.Remote.Code.ExecutionSignature ConfigurationIdentify the required signatures

Just wanted to see with anyone running FMG 7.6.8 if their monitor screens (SD-wan, vpn monitor or asset identity center) are taking longer than usual to refresh/populate. It seems that mine takes ~1min for the asset identity center page to load.Just checking before I open a support case.

DescriptionAn explanation of a situation where, after upgrading the FortiGate from version 7.2.11 to 7.4.12, the explicit proxy stopped working because of the VIPs.ScopeFortiOS version 7.4.SolutionThe explicit proxy policy will fail to visit the website if there is a VIP set to the same IP as the server IP.config firewall vip edit "myservicegov.dnat.orbit" set extip 202.27.76.219 set mappedip "172.24.157.168" set extintf "any" nextThe WAD log below:2026-10-01 16:43:27.087775 wad_dump_http_request :2911 hreq=0x7f5084217288 Received request from client: 172.24.157.203:61058 CONNECT myservicegov.datacom.co.nz:443 HTTP/1.1 Host: myservicegov.datacom.co.nz:443 Proxy-Connection: keep-alive User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/154.0.0.0 Safari/537.36 Edg/154.0.0.0 [I]2026-10-01 16:43:27.087779 wad_http_str_canonicalize :2196 enc=0 path=/ len=1 changes=0 [I]2026-10-01 16:43:27.087781 wad_http_req_de

DescriptionThis article describes why, in some scenarios, certificate-based dialup IPsec authentication may fail after upgrading to FortiOS versions 7.6.7 or 7.4.12 when the PKI peer is configured with cn-type FQDN.ScopeFortiGate, certificate-based dialup IPsec VPN.SolutionCertificate-based IPsec VPN utilizes mutual certificate-based authentication to validate the certificate chain presented during the IKE authentication. The accepted CA certificate and Common Name information of client certificate should be configured under the 'config user peer' to be referenced by the IPsec configuration.When a PKI peer uses cn-type FQDN on the Diapup IPsec VPN hub FortiGate, it not only checks the certificate name but also compares the hostname’s mapped IP address with the connecting client’s IP address.For example:config user peer edit "BRANCH-PEER" set ca "VPN-CA" set subject "CN=branch01.example.com" set cn "branch01.example.com" set cn-type FQDN next endF

Description When LTE-capable FortiGate devices such as the FortiGate 40F-3G4G are in an HA cluster, and each WWAN interface receives a different IPv6 address from the upstream provider, the HA cluster may show as out of sync. This occurs because LTE IPv6 addresses are specific to each member. Scope FortiGate and FortiWiFi models with built-in 3G/4G cellular modems. Solution An HA configuration out-of-sync status does not affect cluster operation or new configuration synchronization. While the error can be cleared temporarily after configuration changes, the issue is expected to recur. In this specific scenario, it is recommended not to run diagnose ha checksum recalculate on affected devices, as this may temporarily overwrite the WWAN IPv6 address of the other cluster unit.The issue occurs because the FortiGate cluster incorrectly considers the IPv6 address to be statically configured and eligible for HA configuration synchronization, even though they are determined dynamically and lea

Since last week we experiencing a lot of problems with Windows updates (mostly Windows 11, but there was one Windows 10 among them as well), specifically KB5040442. On about 10% of our Windows clients the update would start and go until 96% and stay there for 10-60 minutes, and then after a restart Windows would tell us that something did go wrong and it would reverse the update. This would require multiple restarts and anything in the order of 2-10h. The usual information sources did not reveal anything unusual with this update round, so it had to be some uncommon conditions here. When Windows was back online, it would sometimes (!) show an error code 0x800f0922, oftenly nothing, and on next restart it would try to install it again (and our employees losing again 4-10h with a working computer). First remedy, as described in the error code was to increase the size of the recovery partition to at least 250MB, but that helped only on one computer. No other things related to the code

DescriptionHow to capture logs through the serial console of a FortiGate-VM running on VMware ESXi when the FortiGate-VM is rebooting, crashing, or hanging. It also explains how to retrieve the output file for further investigation.The captured output is intended to include messages displayed in the ESXi VM console window, rather than output from an SSH session.Scope FortiGate VM.Solution1. Configure a Serial PortPower off the FortiGate VM.Navigate to Edit Settings -> Add Other Device -> Serial Port.Select Use output file. Specify a writable file location for the output log.Save the VM configuration.2. Retrieve the Output FileTo download the captured log file through the ESXi Datastore Browser:Navigate to Storage and select the datastore where the output file is stored.Open the Datastore Browser.Browse to the folder containing the output file configured for the serial port.Select the file and click Download.3. Retrieve the Output FileVia Datastore Browser (most common):In the vSp

DescriptionIf an SSL VPN (Agentless VPN) interface is configured in FortiOS policy routes, the route will match unintended traffic after an upgrade, potentially causing traffic misdirection or drops.ScopeFortiOS version 7.6.3 and above.SolutionSSL-VPN tunnel mode is removed in FortiOS version 7.6.3 and above; see SSL VPN tunnel mode replaced with IPsec VPN.In these firmware versions, referencing an SSL VPN or Agentless VPN interface in policy routes is a misconfiguration and will lead to unexpected traffic matches after upgrade.This can cause misrouted or dropped traffic if the route matches unintended traffic. In this case, the route will show an unexpectedly high Hit Count in Network -> Policy Routes after upgrade, while other policy routes may show an unexpectedly low or zero Hit Count.  After upgrading from lower FortiOS versions such as FortiOS version 7.4.13 to FortiOS version 7.6.3 or above, SSL VPN interfaces such as ssl.root will be treated as 'any' interface in policy rout

DescriptionThe vulnerabilities affect PHP, a widely used server-side scripting language that powers websites and web applications. They involve flaws in PHP's internal request-processing and memory-management behavior that can be triggered when handling malicious requests. Both are remote code execution (RCE) vulnerabilities rated as 9.2 (CVSS 4.0).• CVE-2026-109618 - RCE via out-of-memory corruption: An out-of-memory condition can interrupt PHP while internal request data is only partially initialized. Subsequent request-cleanup operations may incorrectly process this invalid data, potentially enabling remote code execution.• CVE-2026-109619 - RCE via stale global state: Internal request state can persist after its associated memory has been freed. A later request handled by the same worker may access this stale state before normal initialization resets it, potentially enabling remote code execution. Successful exploitation could compromise the PHP application process and potentially

DescriptionThis article describes how to resolve an issue where the Azure Event Hub integration stops collecting events after a few minutes and temporarily resumes after running the Test Connectivity option.ScopeFortiSIEM Supervisor, Collector, and Azure Event Hub integration.SolutionThe Azure Event Hub integration stops ingesting events after a few minutes of normal operation. Running Test Connectivity temporarily restores data collection, but event ingestion stops again after a short period.High network latency between the FortiSIEM Supervisor/Collector and Azure endpoints causes intermittent connectivity issues. DNS resolution for Azure endpoints may return multiple IP addresses with varying latency. Selection of a high-latency endpoint can impact communication with Azure Event Hub and interrupt event collection.Resolve the Azure hostname and determine the IP address with the lowest and most consistent latency:nslookup azure.comping <ip_address>Configure the Azure hostname in

DescriptionPHP is a widely used scripting language that runs on web servers to generate dynamic websites and applications.PHP has patched CVE-2026-109618 and CVE-2026-109619, two critical flaws that can allow unauthenticated remote code execution, potentially exposing sensitive data or disrupting services.CVE-2026-109618 is a critical memory corruption vulnerability in PHP’s out-of-memory error handling that can allow an unauthenticated attacker to execute arbitrary code through crafted web requests, potentially exposing sensitive data, enabling unauthorized modifications, or disrupting services.CVE-2026-109619 is a critical use-after-free vulnerability in PHP that can allow an unauthenticated attacker to execute arbitrary code by exploiting stale memory references across requests handled by the same PHP worker, potentially exposing sensitive data, enabling unauthorized modifications, or disrupting services.The following table lists the affected PHP versions and the corresponding fixed

DescriptionThis article describes the impact of CVE-2026-84386 on FortiClient for Windows and provides the necessary versions for remediation.ScopeFortiClient/EMS.SolutionCVE-2026-84386 affects the fortimon3 kernel driver installed with the Antivirus feature of FortiClient for Windows. A locally authenticated administrator can use an anti-exploit communication port exposed by the driver to terminate arbitrary processes. This vulnerability is rated Medium (CVSSv3 4.7), is not remotely exploitable, and requires administrator privileges on the endpoint.Affected versions:FortiClient for Windows v7.4.0 up to v7.4.7.FortiClient for Windows v7.2.0 up to v7.2.1.Fixed versions:FortiClient for Windows v7.4.8.FortiClient for Windows v8.0.0.FortiClient standalone:FortiClient standalone is an unmanaged VPN client that does not include the Antivirus feature. Because the fortimon3 driver belongs to the Antivirus feature, FortiClient Standalone is not exposed to this issue.Verification steps:To verify

Has Fortinet issued any advisory regarding the recent PHP remote code execution vulnerabilities, CVE-2026-109618 and CVE-2026-109619? Are any Fortinet products affected?

Hi all,I noticed a discrepancy between the PSIRT advisory FG-IR-26-182 and the CVE record for CVE-2026-106175 (published by Fortinet as CNA).The CVE record's "affected" section (also reflected in NVD, currently "Awaiting Analysis") lists:- FortiPAM 1.0.0 through 1.8.4- FortiSASE 25.4.c- FortiOS 7.0.0 through 7.0.19- FortiProxy 7.0.0 through 7.0.23However, none of these appear in the advisory table, the CVE description, or the CVE "solutions" field. The advisory only covers FortiOS / FortiProxy / FortiSwitch 7.2, 7.4, 7.6 (and 8.0 as not affected).In previous advisories (e.g. FG-IR-25-545, FG-IR-24-325), FortiPAM and FortiSASE were listed explicitly with their own affected versions and fixes, so this looks unusual.Questions:1. Are FortiPAM and FortiSASE actually affected by this vulnerability?2. If FortiPAM is affected, is a fixed version planned?3. Are FortiOS 7.0 / FortiProxy 7.0 affected, and is the omission from the advisory intentional (e.g. out of support)?4. FortiOS 7.6.8 is not

Hi, I do have HA Active Passive FortiGate - Active and Running. Recently, I added a new FortiManager. Kindly guide how I can add FortiGate as an HA to FortiManager. There is an option on FortiManager to add an HA Cluster. But that means that this is for a new deployment, and now I'm in production. I followed the normal way to add a node from FortiManager - Add Primary IP - Then I noted that the Secondary became out of sync. Kindly guide me to the correct way.

Hello All,We have a site-to-site IPsec VPN between an on-premises FortiGate 100F and a remote FortiGate providing access to Azure-hosted applications.We are experiencing intermittent slowness when accessing one specific Azure application. The issue is reported by users almost every day after 5:00 PM.So far, we have:Verified Phase 1 and Phase 2 VPN configurations Verified routing and firewall policies Confirmed the tunnel remains up during the issue Reviewed security profiles (AV, IPS, SSL Certificate Inspection) and found no obvious impact Adjusted TCP MSS values (1350 on the tunnel interface and 1380 on the policy)While reviewing VPN event logs, I noticed multiple "Invalid ESP packet detected" messages. Today, one such event was logged at 5:12 PM, which coincided with user complaints about application slowness.Has anyone experienced a similar issue? Could the "Invalid ESP packet detected" logs indicate packet drops, MTU/fragmentation issues, rekeying problems, or another IPsec-related

Configuring a static IPv6 address on client fails with state "dadfailed"When configuring an IPv6 address the system sends out a message to check if the address if already in use.If the Fortigate has ippool6 type nptv6 configured it acts it replies on the external-prefix configured.Similar to arp-reply enable.Adjust the nptv6 pool itself or adjust the client by using an address in the internal-prefix range or not affected by ippool6.Check other ippool6 and vip usage for overlap as well. Example On linux client: ip -6 addr EXTERNALIP shows state dadfailedDirectly after configuring the ip address we get the packet capture:  VMMAC > 33:33:ff:00:00:06, ethertype IPv6 (0x86dd), length 86: (hlim 255, next-header ICMPv6 (58) payload length: 32) :: > ff02::1:ff00:6: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has EXTERNALIP  FGTMAC > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 86: (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::FGTEUI-64 > ff02::1

How can I get a free trial to install FortiSOAR, because when i try to download the firmware image it says “You do not currently have an active support contract for this product”

Description This article describes an issue where the 1GbE SFP ports may fail to forward traffic on FortiGate 1800F/1801F after upgrading to FortiOS version 7.6.8. Scope FortiGate 1800F, FortiGate 1801F, FortiOS version 7.6.8. Solution  Following an internal driver update introduced in FortiOS version 7.6.8, the affected platforms, FortiGate 1800F and 1801F, are unable to process traffic over their GE SFP slots.As a summary: GE SFP ports 17-20 are unable to process traffic. Traffic on GE SFP ports 21–24 is unaffected Traffic through SFP ports 25-40 is unaffected. Traffic through GE RJ45 ports is unaffected.  This issue is tracked in bug ID 1353422. Fortinet has released a special build to address the issue. Contact Fortinet Technical Support to validate whether the issue applies to the affected device and obtain the special build 8768. For devices running a firmware version that supports a direct upgrade to FortiOS 7.6.8 GA, upgrading directly to special build 8768 is permitted i

Hi ,We have a FortiGate VM pair running in HA  and a FortiWEB pair running in HA, these were fabric integrated when both on the 7.4.x train, however we upgraded to the 7.6.x train (a we while ago now) and this broke the Fabric Integration.We have deleted all the integration configuration (that we know of) and started from fresh but they still will not connect.We are adding via serial number .On the FortiGate it just says “Offline” under the Fabric Connector for the FortiWEB and on the FortiWEB it just has a red round circle with a line through it.Any clues as where to look next ? Regards  

DescriptionHow to automatically update the FortiManager serial number on multiple FortiGate devices before a license change that causes an FGFM tunnel disconnection and not being able to manage these devices from the FortiManager.ScopeFortiManager, FortiGate.SolutionThere are specific cases when the FortiManager serial number may change due to one of the following situations:VM License expired, and a new license was uploaded.VM License is updated via FortiFlex.FortiManager model upgrade or RMA. FortiGate devices associated with the original serial number would be disconnected from the FortiManager and display the status of the FGFM tunnel as down. To resolve this without manually configuring each device, create and run a CLI script to update the central management settings for multiple devices or groups before changing the serial number.Note: In this particular article, the explained case is when the initial FGFM tunnel was initiated only by the FortiGate device. This method will not w

I have a web application for customers to order food & beverage items through a mobile app.the web application is sitting on the DMZ segment.printing of orders is to be done through printers in the LAN print/print server. Can this work ?DMZ web appication through tablets/smartphones -> LAN printer normal printing protocols like smb, tcp/udp 137/138.or can i do wireless printing