Recently active topics

We have a new firewall configured and now its configured as Hub for dial up tunnels to other branches..We have many vlans in subinterfaces and they are combined to created a zone,we have added this zone as source interface in the firewall policy to reach other branchesbut then we unable to ping other branches using this zone/vlanwhile the other branches are able to ping the hub vlans without any issues

Can anyone provide any guidelines for remote ipsec VPN with fortigate 7.6.6 os & its integrate with LDAP local user many more members ? 

Hi everyone,just wondering - does anyone have any info when there's gonna be IPS signatures for the recent critical PHP vulns? Other vendors have them in place already I think. 

DescriptionThe logs to collect for FortiData when opening a ticket for support.ScopeFortiData.SolutionLogin to the CLI.Export the logs:FortiData # diagnose logs export Successfully zipped debug files to: FDT_logs_files_20261020_134046.zipEnable downloading of the exported zip file:FortiData # diagnose gui upload enableDownload the zip file using the Web UI. Go to System -> Backup & Restore -> Diagnose File Upload & Download.Upload the logs at the Fortinet support portal in the ticket for analysis.

Description   This article describes how the configuration file of a FortiGate can be retrieved by a FortiManager through the GUI or the CLI. Retrieving the configuration file using CLI can be used to gather more debug information if the retrieval process fails in the GUI. Scope   FortiManager. Solution   Via GUI: From: Device Manager -> Device & Group, as shown below:     Select the managed FortiGate for which it is necessary to retrieve the configuration. Scroll down until the section: Configuration and Installation is visible; Click the button to the right of the Total Revision number called: Revision history. In the section that appears on the right, there is the Retrieve config button.   Via CLI: Use the following debug to retrieve the OID of the device in question:   diagnose dvm device list   Once the OID value is known, the following command can be executed to retrieve the configuration file of  the device in quest

Hello, Can i deploy FortiGate VM on Huawei private cloud? is it supported and compatible ?  And could you please advise what are the supported hypervisors/platforms on Huawei private cloud for the VM Deployment? And does this one ( Huawei Cloud EulerOS 2.0 64 bit - CentOS 7.9 ) supported for FortiGate VM deployment ? Thanks in advance

DescriptionReasons why FortiNAC-F answers MAB requests for FortiGate-managed FortiAPs with an Access-Accept that carries no VLAN, and how to fix it. The fix is one global setting: Enable Network Access Policy for Wireless Access Points, under System -> Settings -> Network Device.ScopeFortiNAC-F 7.6.x (validated on 7.6.7).FortiGate acting as wireless controller for FortiAPs, modeled in FortiNAC Network -> Inventory.FortiAPs connected to a third-party access switch (example: Aruba CX 6200) that uses FortiNAC as RADIUS server for MAC Authentication Bypass (MAB).SolutionSymptoms:The FortiAP's switch port stays in the static access VLAN instead of moving to the VLAN set in the Network Access Policy.The FortiAP appears under the FortiGate in Network -> Inventory as a Wireless Access Point.Searching the AP MAC in Users & Hosts -> Hosts returns nothing.Device Profiling Rules (for example Vendor OUI, type Wireless Access Point) never process the AP.Network Access Policies who

DescriptionTroubleshooting steps to find the source of browsing delays through FortiProxy by correlating HTTP Archive (HAR) files, Web Application Daemon (WAD) debug output, and packet captures.ScopeFortiProxy, FortiProxy VM.SolutionHAR shows the browser’s request timings. WAD shows proxy processing. Packet captures show network timing on the separate client and server TCP connections. Browser "Waiting" time alone does not identify which device caused the delay.Record client IP, URL and timezone align clocks. In the browser, go to Developer Tools -> Network, enable Preserve log, reproduce once and export HAR. Note the slow request’s time, method, URL and status.In parallel, collect a short client-filtered WAD trace. Coordinate with other administrators before resetting diagnostics:diagnose debug reset diagnose debug console timestamp enable diagnose wad debug clear diagnose wad filter clear diagnose wad filter src <client-IP> diagnose wad debug enable category all diagnose wad

DescriptionSolutions for an issue where HTTP or HTTPS upload starts but hangs or fails.ScopeFortiProxy, FortiProxy VM.SolutionCompare a small and large test file using the same application and destination. Verify commands on the installed release:Collect a browser HAR and record the failing URL, HTTP method, file size, time and status. Check application/server logs. A 413 suggests a size limit; a 417 relates to an expectation failure. Identify which device generated the response.Use GUI packet capture on both proxy connections. A quick CLI timeline is:diagnose sniffer packet any 'host <client-IP> or host <server-IP>' 4 0 lStart before a fresh upload; stop with Ctrl + C. Use PCAP to check retransmissions, zero windows and resets. HTTPS packet captures alone do not reveal request headers or bodies.If HTTP processing remains unclear, collect a short filtered WAD HTTP trace. Coordinate before resetting diagnostics:diagnose debug reset diagnose wad debug clear diagnose wad filte

DescriptionThis article describes how to troubleshoot and resolve group import issues when Entra ID groups are not successfully imported into FortiNAC.ScopeFortiNAC-F.SolutionFortiNAC allows only 255 characters for the group description. If the Entra ID has a long description, FortiNAC will complain about it and will end up failing to import the Entra ID group.To troubleshoot the error, first enable the debug below:diagnose debug plugin enable AzureADApplicationInterface Make a manual poll for the Entra ID connector.Then check the output.master to see where it is failing, if there is the following error message: 'Data too long for column 'description' at row 1' then this indicates that the group description is too long and FortiNAC is unable to import it:diagnose tail -F output.master 2026-10-19 01:02:44.146 +0200 [ForkJoinPool-2-worker-3] INFO  yams.AzureADApplicationInterface - Microsoft Entra ID sync start, id: 1508680683945992, name: Microsoft EntraID Azure Connection 2026-10-19 0

DescriptionDNS filtering fails to inspect DNS over TLS (DoT) queries in certain FortiOS versions, such as version 7.6.4, leading to bypassed filtering or connection errors in proxy mode. The issue occurs when a DNS query is made over TLS after upgrading to FortiOS version 7.6.4.ScopeFortiGate.SolutionThis known issue is Bug ID 1214371.Sample: The issue is reproduced using deep inspection with DNS filter enabled for a proxy mode firewall policy.As seen in the image above, the default redirect block IP addresses (208.91.112.55, 2620:101:9000:53) were not returned over TLS. Upgrade FortiGate to FortiOS 8.0.1 to resolve the issue where DNS over TLS queries bypass filtering in proxy mode.Related documents:Resolved issuesDNS over QUIC and DNS over HTTP3 for transparent and local-in DNS modes

DescriptionThis article describes the availability of the FortiGate-400G and 401G models in the Upgrade Path Tool and provides information about supported firmware versions.ScopeFortiGate-400G and 401G: users checking supported firmware versions and recommended upgrade paths.The FortiGate-400G and 401G are now included in the Upgrade Path Tool. Select the product model, current version, and target version to view its recommended upgrade path.For example, the tool shows a direct recommended path for FortiGate-400G from FortiOS v7.6.6 M (Build 6689) to v8.0.1 F (Build 0245).These models are supported by a special branch of v7.6.6 (Build 6689), specifically designed for them: Introduction and supported models.The FortiGates-400G and 401G do not support FortiOS v7.4.x.For a FortiGate-401G, select that model separately in the Upgrade Path Tool to confirm its available versions and recommended path.Note: Release timelines are subject to change.If additional information regarding compatibilit

DescriptionHow to enable a new Layer 3 intra-controller roaming feature on a bridge-mode SSID, so wireless clients can move between FortiAP groups that are mapped to different VLANs, while retaining their original IP address.ScopeFortiGate 60F with FortiOS 7.4.11 and two FortiAP-441K access points with FortiAP firmware 7.6.3, managed by the same FortiGate.The source lab used feature-specific STS builds. The version labels above identify the tested release families and do not establish support in every build. Confirm that the target build exposes 'l3-intra-roaming' before applying this configuration.Solution1. Prepare the environmentUse two authorized FortiAPs managed by the same FortiGate and broadcasting the same bridge-mode SSID. Configure the SSID authentication before applying the following changes. The selected test used WPA2 Personal.Create two managed AP groups and assign one access point to each:FortiAPAP groupClient VLANManagement IPFAP1-loungeNorth10010.10.201.2FAP2-officeSou

DescriptionConfigure BLE scanning on a FortiAP to collect advertisements from Zebra ZS300 temperature sensors for processing and visualization by an external application.ScopeThe main proof of concept used a FortiGate 60F running FortiOS 7.4.12 and a FortiAP-233G running firmware 7.4.5. A separate local validation used a FortiAP-234F.The workflow illustrates BLE scanning on both models. Configuration availability depends on the FortiAP model and firmware.Solution1. Configure BLE scanningOn the FortiGate, create a BLE profile using the scan parameters validated during the proof of concept:config wireless-controller ble-profile edit "ZEBRA-ZS300-BLE" set ble-scanning enable set scan-type active set scan-threshold "-90" set scan-period 4000 set scan-time 1000 set scan-interval 50 set scan-window 50 next endAssign the BLE profile to the FortiAP profile. Replace <FORTIAP_PROFILE> with the existing profile name.config wire

DescriptionWhen configuration save mode on the FortiGate (aka cfg-save under config system global) is changed from automatic to either manual or revert, any configuration changes applied via CLI scripts pushed from FortiGate Cloud or FortiManager may not be saved to flash.ScopeFortiOS 7.2.x, 7.4.x, and 7.6.x.SolutionAs a quick primer: cfg-save is a configurable feature that allows FortiGate administrators to enforce manual saving of configuration changes to persistent storage, as opposed to the default behavior where the FortiGate automatically saves each change once it is committed. For more info, refer to the following Article: Technical Tip: Using the save option 'set cfg-save revert' to automatically reboot and revert to a previous configuration of a FortiGate config system global set cfg-save < automatic | manual | revert > end However, there is currently an issue where cfg-save (when set to manual or revert) can have an unexpected interaction with CLI scripts that are p

DescriptionHow to get FortiGate's NAC policies to show a list of Operating System suggestions when enabling the radio button.ScopeFortiGateSolutionThe Operating System(OS) suggestions for FortiGate's NAC policies can be populated using the following steps:Navigate to Network -> Interfaces and edit the internal-facing interfaces.Look for "Device detection" under Network and toggle it to enable.Wait for a while and check if the device connected behind the port is being detected using the following command line:diagnose user device list hosts vd root/0 00:57:69:72:1f:01 gen 272 req 0 created 166978s gen 1 seen 4s port2 gen 129 ip 10.235.1.242 src arp os 'Windows' src http id 1453 weight 130 software version '10/11' src http id 1453 weight 130 host 'WIRA-KVM31' src mwbsAfter confirming the connected device is being detected, proceed to navigate to WiFi Controller > NAC Policies and create/edit a NAC policy. Notice that after enabling the radio button for the Operating System, the de

DescriptionFortiGate may stop accepting new SSL VPN connections due to the FNBAMD process.ScopeFortiGate version 7.4.11 and previous versions.SolutionUsers configure a standard SSL VPN connection for local and remote users.Check the crash log and validate that there are multiple fnbamd crashesdiagnose debug crashlog read | grep 2026 111: 2026-03-14 15:48:14 <03214> firmware FortiGate-100 v7.4.11,build2878b2878,260126 (GA.M) (Release) 112: 2026-03-14 15:48:14 <03214> application fnbamdTake some debugs of the VPN and validate the fnbamd process that remains stuck.diagnose debug disable diagnose debug reset diagnose vpn ssl debug-filter src-addr4 x.x.x.x → replace x.x.x.x with the public IP of the user diagnose debug application sslvpn -1 diagnose debug application fnbamd -1 diagnose debug enable FGT_Test# [15553:root:2]allocSSLConn:303 sconn 0x7f9c2a558000 (0:root) [15553:root:2]SSL state:before SSL initialization (1.1.1.1) [15556:root:2]rmt_web_auth_info_parser_common:534

DescriptionThis article describes two critical Remote Code Execution (RCE) vulnerabilities in the PHP interpreter (CVE-2026-109618 and CVE-2026-109619) that allow an unauthenticated attacker to execute code on a web server running PHP by sending crafted HTTP requests. Both were disclosed by the PHP security team on October 21, 2026, alongside fixed releases for every supported branch, and both carry a CVSS v4.0 score of 9.2 (Critical). The issues were reported by researchers at Calif and OpenAI, and separately by Wiz. CVE-2026-109618 ("RCE via OOM corruption") is in PHP's out-of-memory handling. A crafted multipart/form-data request can force PHP to run out of memory while it is still building the request's internal data. PHP then aborts the request, and the cleanup step reads that half-initialized memory as if it were valid. Several multipart parsing behaviors let an attacker reach the out-of-memory condition while staying within PHP's apparent upload limits. CVE-2026-109619 ('RCE via

Description This KB article describes, how to manage an RMA request (a hardware replacement request within the technical support contract) with the Fortinet Customer Service and Support (Fortinet CSS), when another (possibly temporary) spare unit is already available on-site.   In case of a hardware failure on a Fortinet product and a need for replacement, when a spare unit is already available on-site (for example: a "cold spare" unit, or a temporarily loaned unit from a Fortinet reseller or distributor), for a smooth RMA exchange of the defective unit by the Fortinet CSS, Fortinet recommends to proceed as follows: 1. With the Fortinet CSS, create an RMA ticket first, using the serial number of the defective unit.2. In the RMA ticket, describe the problem with the defective unit, and make sure to mention to which spare/replacement unit (specify the serial number) the support contract will be transferred to.3. Once the RMA ticket has been created, req

Hi, community Forti. I have a fortigate 100D but a WAN port broke down; now ot only gives me 10 mbps instead of the normal speed. So I want to use a LAN port as a WAN port but a I have some questions.The Lan port can fuction properly? The speed is 100 mbps The Wan port can be repaired?I know that I need change policies and more things. All for the LAN port.

DescriptionThis article provides steps to protect vulnerable endpoints from man-in-the-middle (MITM) attacks on HTTPS and other traffic encrypted by SSL, including the vulnerability introduced by the October 2026 eMudhra Certificate Authority compromise.ScopeFortiOS.SolutionOn October 17th 2026, 8 private keys held by eMudhra intermediate CA certificates were proven compromised. This became public information on October 20, 2026. Refer to the third-party reference eMudhra Intermediate CA Compromise.As the affected keys are trivial to crack with known methods, it is simple for any competent attacker to impersonate the affected intermediate CAs. There is no single identifiable attack vector or campaign associated with this compromise; rather, it is a potentially widespread issue now that the weakness is known.Any endpoint that includes the following self-signed CA certificates in its trust store is considered vulnerable to man-in-the-middle attacks:emSign ECC Root CA - G3 (a widely trust

I've been brought in to help an organisation with a large branch network get proper value from their FortiManager. It was set up by someone else and never became the single source of truth. They want to push policies, templates, firmware and switch and AP settings from FortiManager, with no policy mismatches and no per-firewall changes. It's a live environment, so any approach has to avoid outages.EnvironmentFortiManager VM 7.6.x in HA, with several ADOMs100+ FortiGates (mixed 60F, 40F and 100F class units) all on the same FortiOS 7.4.x buildA large number of FortiSwitches and FortiAPs through FortiLinkHub-and-spoke SD-WAN, which works fine and is out of scopeWhat I found (read-only access)Far more policy packages than makes sense for the number of devices, and many devices have a package to themselves. This looks like cloned packages instead of meta variables and dynamic mappings.A number of devices show Modified config status, concentrated in one ADOM, and I haven't seen any Synchron

Hi everyone,We are experiencing a serious issue with the Automation Playbooks functionality in FortiAnalyzer 8.0.1 following an upgrade from FortiAnalyzer 7.6.x.All automation playbooks were working correctly on FortiAnalyzer 7.6.x. However, after upgrading to 8.0.1, multiple playbooks using different connectors stopped working.Environment: FortiAnalyzer VM: 8.0.1 Previous FortiAnalyzer version: 7.6.x FortiClient EMS: 8.0. 1. FortiClient EMS ConnectorThe FortiClient EMS connector is configured, enabled, and displayed as healthy (green) under Active Connectors.However, running actions such as Get Endpoints or Get Vulnerabilities fails with:Failed to execute task "Get Endpoints":cannot access local variable 'connection'where it is not associated with a valueThe same error occurs when using a newly created EMS connector task.2. Active Directory ConnectorAutomation tasks using the Active Directory connector also fail:Failed to execute task "Get User from AD":cannot access local variabl

Network Components:2 ISP (SDWAN)2 FW(HA)2 RTR(Redundant WAN)1 SW(L3)Current setup: LAN(L3) → FW(HA) → ISP(SDWAN) → NET                           ^→ RTR(WAN) → NET                          Routing: L3 SWChange to:  LAN(L3)--->FW(HA)-->ISP(SDWAN) →NET                                          ^→ RTR(WAN) → NET                                           Routing: FW(HA) Routing Architecture ChangeCurrently, the L3 Switch performs the routing for traffic destined for the WAN. Under the proposed design, WAN-bound traffic will instead be routed through the Firewall before being forwarded to the WAN Router.Considering the full-mesh redundant topology:Firewall HA: Active-Passive WAN Routers: Active-PassiveWhat would be the best interface design between the Firewall and WAN Routers to maintain redundancy while avoiding routing or loop issues?

DescriptionAn issue where FortiGate devices are visible in the device list but do not appear on the FortiCloud device map due to license requirements.ScopeFortiGate, FortiGate Cloud.SolutionSymptoms:FortiGate devices are listed correctly in the FortiCloud device list, but the device map section remains empty or does not display the equipment.Before: After:Root cause:The FortiCloud device map requires a specific license level to display devices. Devices with only a free FortiGate Cloud license or basic support contracts (such as FortiCare Premium) are filtered out and not shown on the map. Only devices with a standard license that includes log retention or an Enhanced license with a PREMIUM support type are displayed.Ensure that the FortiGate devices are registered with a valid subscription that supports map visualization.Verify the license status of the FortiGate devices in the FortiCloud portal.Confirm that the devices have a standard license (log retention) or an Enhanced license wit