Recently active topics

So after all the fuss, the updates still haven't been pushed out to automatic update via the device GUI ?There's already AI based diff analysis working out what has changed and the only way to avoid potential problems is to manually update , if they haven't pulled the download while you were looking at itDoes anyone at Fortinet know what they're doing ? 

WAN1 STOPPED WORKING- I have two FortiGate 60F setups as stack (HA1 and HA2)- I have Juniper router - I have a Rogers modem with 2 public IP 187.x.x.x/30 and 184.x.x.x/30- link 1: Rogers modem port1 > FG60F WAN1- link 2: Rogers modem port2 > Juniper router- I also have a 2nd ISP (TELUS) for failover- WAN1 link shows Green UP in the GUI; WAN1 led light is blinking green/yellowProblem: WAN1 is not pulling the public ip whether in static or DHCPTS:- reboot the modem, connect my laptop with correct IP details used in FG60F (SM, GW and IP) = WORKING- leave Juniper plugged in = WORKING- turned off the modem for 10mins, removed the laptop, reconnected the FG60F = FAILED- Juniper still working- Replaced modem, reprovisioned and performed laptop testing again and still working. - Tried disconnecting Juniper from Rogers modem and leave only FG60F connected = FAILED- Internet works because of WAN2 (TELUS)Question:1. Why WAN1 not pulling the public IP? why there is no internet from WAN1? 2.

DescriptionThis article describes how to identify an upstream device filtering UDP/123 when FortiGate fails to synchronize its clock while hosts behind the same FortiGate synchronize normally.ScopeFortiOS, FortiGate, system NTP, FortiGuard NTP, packet sniffer, debug flow.SolutionSymptomsFortiGate never synchronizes. Every configured server shows no data.The last synchronization is either never or a timestamp that stops advancing:diagnose sys ntp status execute time # synchronized: no, ntpsync: enabled, server-mode: enabled ipv4 server(ntp1.fortiguard.com) 208.91.112.61 -- unreachable(0x0) S:6 T:193 no data ipv4 server(ntp2.fortiguard.com) 208.91.112.60 -- unreachable(0x0) S:7 T:209 no data ipv4 server(ntp2.fortiguard.com) 208.91.112.62 -- unreachable(0x0) S:6 T:193 no data ipv4 server(ntp1.fortiguard.com) 208.91.112.63 -- unreachable(0x0) S:6 T:193 no data current time is: 12:28:00 last ntp sync:Fri Oct 23 12:17:30 2026At the same time, hosts beh

DescriptionInstability in FortiSwitch connectivity can cause checksum mismatches in the system.dns-database table, leading to FortiGate High Availability (HA) synchronization failures and network outages.The cluster synchronization issue is caused by the 'system.dns-database' object in the GUI as shown in the image below.ScopeFortiGate, FortiSwitch.SolutionSymptomsYou may observe the following symptoms:FortiGate HA cluster status repeatedly alternates between synchronized and out-of-sync states.Managed FortiSwitches repeatedly disconnect and reconnect (flapping).Loss of internet connectivity occurs on the primary FortiGate unit, especially if uplinks route through the affected FortiSwitches.HA configuration checksum differences are identified in the system.dns-database table.Root causeInstability in FortiSwitch connectivity can trigger checksum mismatches within the system.dns-database table on FortiGate units. This mismatch prevents the HA cluster from maintaining a synchronized state

Hello, everyone. I'd like to confirm something: I can't find the Fortigate 600E model on the Fortigate lifecycle page to check the end-of-support date. Does this mean the device will continue to receive firmware updates, security patches, and other updates?I’ve also seen some websites mentioning dates this year, but if it doesn’t appear on the official Fortigate website, I guess those are just rumors, right?Thanks for your responses.

DescriptionAn issue where FortiManager Policy Package installation fails with a verification error due to the "antiphish: max-body-len" parameter under webfilter profiles.ScopeFortiManager and FortiProxy 7.4.9 and higher, FortiProxy 7.6.1 and higherSolutionWhen installing a Policy Package from FortiManager to FortiProxy 7.4.9, the installation fails with verification messages similar to the following:(vdom root: webfilter profile "monitor-all" antiphish:max-body-len) remote original: to be installed: 65536 <--- done generating verification report install failedThe same message may be reported for multiple webfilter profiles.The root cause is a difference in the default value of the max-body-len parameter between FortiProxy and FortiManager.Starting with FortiProxy 7.4.9 and 7.6.1, the default value of max-body-len was changed from 65535 to 1024. However, FortiManager continues to use 65535 as the default value for this parameter.This difference in default values can result in

Hi Team,I cannot find the FortiGuard entry on the following page anymore: https://fortiguard.fortinet.com/psirt/FG-IR-26-186When I checked it yesterday, it was listed under the "Under Investigation" section. However, it is no longer visible under either "Under Investigation" or "Not Affected Products" today.While FortiOS has been determined to be unaffected, could you please clarify whether FortiGuard (as a component of FortiOS) is also considered unaffected, or if it is still under investigation?Also, could you let us know why the item was removed from the page?Best regards,

By default if we enable MFA on fortinac for accessing web admin then the token will be expired only in 1 minute.I think 1 minute i’s to fast if we have problem with delay when we receiving the token by email. Can we increase the token expiration example to 5 minutes? 

DescriptionWhen a FortiGate interface is configured in dual-stack mode with PPPoE and IPv6 SLAAC autoconfiguration, unencapsulated ICMPv6 Router Advertisements (RAs) from the upstream link can be received directly on the parent underlay interface. When this occurs, FortiOS processes the RA on both the parent underlay interface and the virtual PPPoE interface (pppX), generating a global IPv6 address and installing a default IPv6 kernel route (::/0) for each interface.Because the parent physical underlay cannot route traffic outside the active PPPoE tunnel, self-originating IPv6 traffic generated by the FortiGate (including ping6, DNS, NTP, FortiGuard updates, and TLS active probes for SSL inspection) fails if the system routes packets through the parent interface. Forwarded traffic from internal dual-stack LAN hosts continues to function when policy routing or SD-WAN rules direct outbound sessions through the PPPoE tunnel.ScopeFortiGate.SolutionWhen you configure an interface with set m

We currently use FortiClient EMS 7.4.7 and want to assign the endpoint profiles with userbased AzureAD groups. Currently it works only with devicebased AzureAD groups. When I add  user to to the AzureAD group und resync I noticed the the user is synced with the EMS, but the device from the user is not assigned to the profile.The Fortinet Support means that it is a bug, but perhabs it is a incorrect configuration in the claims or anything else.Has anyone use userbased AzureAD groups with the version?

Hi all,I am deploying FortiNAC-F FN500F v7.6.x in a Primary/Secondary HA configuration.Is there any requirement for Port2 Isolation IP addresses to be the same on both Primary and Secondary nodes in both Layer 2 and Layer 3 HA deployments?

I have configured a dial-up IPsec VPN using IKEv2 for remote users. While working on the configuration and reviewing the documentation, I realized that it seems there is no way to separately control who is allowed to establish the VPN connection and then apply specific firewall policies once they are connected.In other words, if I configure Phase 1 authentication with "inherit policy", it appears that any user belonging to any group referenced in the firewall policy can successfully bring up the VPN tunnel. Is that correct?If so, what would be the recommended way to restrict which users are allowed to access the VPN, while also ensuring that, once connected, different firewall policies are applied based on the user's group membership?

DescriptionHTTPS sessions are reset with an SSL error when processed by the secondary unit in a FortiGate cluster configured for high availability (HA) in active-active mode with flow-based inspection.ScopeFortiOS 7.4+, 7.6+ and 8.0+.SolutionSymptoms:With FortiGate in HA Active-Active mode and load-balance-all enabled, some HTTPS sessions are blocked. Traffic logs show action server-rst and "utmaction=block". The SSL event log shows: "SSL connection is blocked due to unable to retrieve server's certificate".config system ha set mode a-a set sync-packet-balance enable set load-balance-all enable endThis affects only sessions processed by the secondary unit; the primary unit handled sessions normally.In Active-Active mode and with load-balance mode enabled, the secondary unit may process flow-based certificate-inspection sessions. To validate the server certificate, the FortiGate generates a TLS active probe (a local-out connection). Still, the HA mechanism drops this self-or

DescriptionAfter upgrading FortiGate from FortiOS v7.6.7 to v7.6.8, the 'set keytab' line is removed from the Kerberos keytab entries configured under 'config user krb-keytab'. The other settings of each entry (principal, LDAP servers, PAC data) are kept, so the entry is still present in the configuration but without its keytab.Kerberos authentication that relies on an affected entry can fail until the keytab is configured again.ScopeFortiGate, FortiOS v7.6.7 upgraded to v7.6.8, with Kerberos keytab entries configured under 'config user krb-keytab'.An upgrade from v7.6.6 to v7.6.8 is not affected.SolutionThe behavior is reproducible after the upgrade; the keytab of each Kerberos keytab entry is removed from the configuration.After the upgrade, the configuration error log shows a parse error on the 'set keytab' line of each affected entry:FortiGate (global) # diagnose debug config-error-log read >>> "set" "keytab" "ENC" "XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX ... @ VDOM_TEST.user.krb

DescriptionThe storcli64 commands to collect when a disk is reported as failed, or the RAID is degraded on a FortiSIEM Hardware Appliance, for example, when a ‘Disk Missing’ error shows under Jobs and Errors. These outputs help check the disk state, RAID level, and failure events before proceeding with an RMA.ScopeFortiSIEM.SolutionSSH to the FortiSIEM Hardware Appliance as root.The commands below only display information and do not change the RAID. The output of each command is saved in the /tmp/ directory.Controller summary, which shows the RAID controller, the virtual drives and all the disks with their current state:/opt/phoenix/config/fsmroot/usr/local/storcli/opt/MegaRAID/StorCli/storcli64 /c0 show all > /tmp/storcli-c0-allVirtual drive details, which show the RAID level and whether the RAID is Optimal or Degraded:/opt/phoenix/config/fsmroot/usr/local/storcli/opt/MegaRAID/StorCli/storcli64 /c0/vall show all > /tmp/storcli-vallDisk details, which show the model, serial numbe

DescriptionThis article describes the 'ASIC number not correct: expected 2, got 1' error in the FortiASIC EEI Test.ScopeFortiGate models equipped with CP9.SolutionFortiGate-900G # diagnose hardware test asic NOTE: Factory configurations are recommended for running HQIP Test Begin at UTC Time Mon Jun 15 08:13:25 2026 08:13:25 ( 0s) ==> FortiASIC EEI Test Test FortiASIC EEI Link. ASIC number not correct: expected 2, got 1 08:13:25 ( 0s) <== FortiASIC EEI Test - [[ X FAIL X ]] 08:13:25 ( 0s) ==> FortiASIC SSL Test Test FortiASIC VPN. ASIC 1 SSL testing... SSL DES tested SSL 3DES tested SSL HMAC-MD5 tested SSL HMAC-SHA1 tested SSL AES 128bit tested SSL AES 192bit tested SSL AES 256bit tested ASIC 1 SSL test PASSED. ASIC 2 SSL testing... SSL DES tested SSL 3DES tested

CVE IDCVE-2026-109619CVE TitleRemote Code Execution in PHP via stale global stateNVD SeverityNot AssignedFortiRecon SeverityCRITICALFortiRecon Score90/100Epss Score0.05757ExploitedYesExploited by Ransomware Group(s)NoExploited by APT Group(s)NoIncluded in CISA KEV ListNoAvailable working exploit(s)0Available POC exploit(s)376Darknet Mention(s)4 (exploit, rstforums)Telegram Mention(s)18 (PwnForums - Chat, Team1914_official, 🔪 That Dark Web Guy - Part 3 🔪, FSEC INTEL ES 2.0 📡 🏴‍☠️, Hack Institute Chat, SHINY CORP, LΣҒΔ𝕽ΩLL 🇮🇱, Cyber32 Team | سایبر۳۲, Tunisian Maskers Cyber Force, PwnForums)FortiRecon Intelligence Reporting(s)2 (Darknet), 7 (OSINT), 1 (FortiGuard Research)Vendor Advisory:http://www.openwall.com/lists/oss-security/2026/10/22/2https://www.wiz.io/blog/php2shell-php-rcehttp://www.openwall.com/lists/oss-security/2026/10/21/7http://www.openwall.com/lists/oss-security/2026/10/21/16http://www.openwall.com/lists/oss-security/2026/10/21/23http://www.openwall.com/lists/oss-se

DescriptionAtlassian provides enterprise software for project management, collaboration, software development, and IT service management. Its Data Center products are self-managed applications that organizations deploy within their own infrastructure.CVE-2026-21589 is a critical arbitrary file access vulnerability affecting multiple Atlassian products that allows an unauthenticated remote attacker to read specific files within the application’s web root directory. Successful exploitation requires knowledge of the target file’s exact name and path and could result in unauthorized access to sensitive information stored in those files.For affected and fixed product versions, refer to the Atlassian security advisory links below:CVE-2026-21589 - Arbitrary File Access Vulnerability impacts Multiple ProductsCVE ID    CVE-2026-21589FortiNDR Cloud CoverageFortiNDR Cloud v26.3+Detection Rule NameCategoryPrimary MITRE IDFortiGuard Outbreak Alert: Atlassian Multiple Product Arbitrary File Access A

We have the google FQDN's opened per their suggestion ( https://support.google.com/a/answer/2589954?hl=en ) and ( https://support.google.com/drive/answer/6163291 ) the kids have discovered a number of gaming sites on google homepages, all seem to be named "unblocked games" i.e.https://sites.google.com/site/unblockedgames4mehttps://sites.google.com/site/unblockedgames77https://sites.google.com/site/punblockedgames/ The problem is that blocking google by address doesn't seem to work as every request seems to use a different one, and I don't know why but I don't seem to be able to block by name. I put in a simple IPV4 policy, source = any,  Destination = "sites.google.com/site/unblockedgames4me",  blockand it doesn't work.  because it is a block there is no SSL inspection or anything like that.... When I look at the log there is nothing that says "sites.google.com/site/unblockedgames4me" just "encrypted-tbn1.gstatic.com" but I don't want to blo

DescriptionThis article describes troubleshooting steps for issues related to the error 'New image is too big'.ScopeFortiManager, FortiAnalyzer.SolutionTypically, this error occurs during a FortiAnalyzer or FortiManager 8.0.X firmware update when the target device lacks sufficient flash memory storage to accommodate the new firmware image.This is most commonly documented for FortiManager/FortiAnalyzer VM platforms, where the error message reads: 'New image is too big'.This error is not caused by a bug; it is due to a system requirement to upgrade the products to the latest and larger firmware releases, as indicated here:The minimum size for the flash disk in FortiAnalyzer-VM is 4 GBMost common causes:Insufficient flash disk space: The flash partition does not have enough free space to store the new firmware image during the upgrade process.Small virtual disk allocation: The VM was originally provisioned with a flash disk that is too small for the target firmware version. Diagnostic ste

Hello Fortinet Community,I would like to integrate FortiEMS ZTNA with a third-party Privileged Access Management (PAM) solution, such as JumpServer.With FortiPAM, I can associate specific ZTNA tags with secrets and restrict access based on endpoint compliance. A user must have the required ZTNA tag from FortiEMS to access a specific secret or target server.I would like to achieve the same functionality with a third-party PAM solution.My questions are: Can a third-party PAM, such as JumpServer, integrate with FortiEMS to retrieve or verify endpoint ZTNA tags? Can the PAM check the user's endpoint tag before allowing access to a specific target server or secret? Is there an API or another supported integration method to achieve this? Does this require a FortiGate ZTNA deployment, or can the integration work directly between FortiEMS and the third-party PAM? Our goal is to use FortiEMS for endpoint posture assessment and enforce tag-based access control within the PAM, similar to th

DescriptionA guide to the signatures that can help block PHP2Shell (CVE-2026-109618, CVE-2026-109619) on FortiWeb.ScopeFortiWeb.SolutionPHP uses longjmp() for out-of-memory (OOM) errors to exit the current context and abort handling of the request.Refer to this document to see the affected products: PHP core RCE vulnerability patches (CVE-2026-109618 and CVE-2026-109619).Signatures covering CVE-2026-109618 and CVE-2026-109619 are available under FortiGuard FDS update 0.00438.They are part of the Known Exploit category, under the sub-category Signatures for Common Web Applications, as signature IDs 090502648, 090502651, and 090502654.Ensure the FortiWeb FortiGuard signature database is updated to this version (or later) so that the CVE-specific signatures are loaded and enforced.Via the GUI:Log in to the FortiWeb GUI.Navigate to System -> Config -> FortiGuard (look for FortiWeb Update Service Options).Click Update Now (or Check Update).Confirm the update completes, and the FortiGu

Environment:- FortiClient VPN (free, VPN-only) 7.4.3.4323- macOS Tahoe 26.7.1 (iMac)- IPsec IKEv2 tunnel with SAML SSO/MFA, NAT-T (UDP 4500)- Not connected to EMS (log shows "Ignore Secure compliance Check as FCT is not connected to EMS")Problem:The VPN tunnel is disconnected by FortiClient itself less than one second after the macOS screen is locked. This happens even when the system is prevented from sleeping (display sleep and screensaver disabled, sleep prevented with a keep-awake utility) and while traffic is actively flowing through the tunnel.Steps to reproduce:1. Connect the IPsec IKEv2 tunnel with SAML SSO.2. Keep traffic flowing through the tunnel (e.g. a TCP check every 60 seconds to an internal host).3. Disable screensaver and display sleep, prevent system sleep.4. Lock the screen (Ctrl+Cmd+Q).5. The tunnel is disconnected within ~0.7 seconds.If the screen is not locked, the tunnel stays up indefinitely, so this is not an idle timeout, a network issue, or a gateway-side dis

Anyone else suddenly having issues seeing Chatgpt prompts and files uploaded? Application Control | FortiGuard Labs Was working last week and i can still see claude file uploads and prompts just not ChatGPT so not sure if the application signature has changed? Fortigate is 7.4.12

DescriptionRecommendations for the most appropriate FortiOS software release. The recommendations stated below are the latest as of October 2026, and are reviewed and updated every quarter.The information in this document is not meant to be exhaustive and is intended to serve as general guidance to customers, especially in cases of mass deployments/upgrades. When working with Fortinet SEs, Professional Services, or TAC: it is important to refer to their specific guidance.An additional information section has been added to the bottom of this article for answers to common questions.Subscribe to the RSS feed by selecting the three-dotted menu button to keep up to date on the latest changes to this article (note that this feature is temporarily unavailable as of June 2026).ScopeThis document is a general recommendation of FortiOS software for general customer deployments for general stability and is updated quarterly.For customers who may be leveraging the latest features, the latest Forti