Recently active topics

Hi all,I am deploying FortiNAC-F v7.6.x using Local RADIUS with EAP-TLS authentication and Microsoft CA.The environment uses Active Directory (AD), where client devices are required to authenticate to the network exclusively using digital certificates, without requiring a username or password.When a client successfully authenticates using a valid certificate, how does FortiNAC identify the client and determine which Role or Network Access Policy to apply for VLAN assignment?What is the recommended configuration for this scenario?

DescriptionThis article provides details about two types of DNS behavior:What happens when the first configured DNS server is down, or the response fails.How FortiMail uses TTL values from DNS.ScopeFortiMail.SolutionDNS fallback.FortiMail allows two DNS servers to be configured under the following menu:What happens if the DNS query does not get a response from the Primary DNS? Behavior depends on the type of failure:If FortiMail queries the Primary DNS server but no response is received, after ~5 seconds, an initial query is sent to the Secondary DNS.If the initial query from the Primary DNS server is responded to with 'SERVFAIL', then this time it is quicker; within a second, a query is sent to the Secondary DNS server.DNS cache.Normally, FortiMail caches DNS records based on the TTL of the record received from the DNS resolver. If TTL is 3600 seconds in the response, FortiMail keeps it for 3600 seconds and does not ask the DNS resolver for the same record within this time period.Howe

DescriptionFortiOS 7.6.5 introduces changes to the default Diffie-Hellman (DH) groups used in IPsec Phase 1 and Phase 2 configurations. These changes can affect IPsec tunnel negotiation when the remote VPN peer does not support the updated DH groups.This article explains the default DH-group changes, their impact on existing configurations, and how to verify DH-group compatibility between VPN peers.ScopeFortiGate devices running FortiOS 7.6.5 and later.SolutionUnderstand the default DH-group changes.Starting with FortiOS 7.6.5, the default DH groups for newly created IPsec configurations are changed from groups 14 and 5 to groups 20 and 21.The upgrade behavior depends on whether the existing DH groups were explicitly configured or were using the legacy default values.The following table summarizes the behavior.Configuration scenarioDH groups after upgrade or creationNewly created IPsec configuration20, 21Existing configuration using the legacy default 14, 520, 21, 14Existing configurat

Hello everyone,Since this morning, multiple clients across our network have simultaneously started receiving virus warnings from FortiClient. The legitimate Office component EUROTOOL.XLAM is being flagged as high risk.I have reviewed the hash (2C4AFE4AFEDE252158A732EDB0C3754B9CB984A7CC2EB6EEFAC47C1EF38C9753)  , file location and metadata on a number of devices and all comes back clear.Since the file is cryptographically clean and unmodified I strongly suspect this is a false positiveHas anyone else seen similar in their orgs? Thanks in advancePASMC

FortiAIGate on 8.0.2 without GPU on the node.Helm install method with values.yaml applied latest image tags. All pods are up. License applied in GUI. Workspace & model setup done but detectors for DLP, Regex & NL are missing, is GPU-enabled node a must to see/enable all the detectors?

We are currently running FortiOS 7.4.12 on multiple FortiGate 200F and 400F HA clusters in a banking environment within the EU.Following Fortinet's recent recommendation to upgrade to FortiOS 7.4.13 or later, we are evaluating an accelerated upgrade plan and would like to gather feedback from engineers who have already completed this upgrade in production.Specifically, have you experienced any of the following after upgrading from 7.4.12 to 7.4.13 (or later 7.4.x releases)?HA synchronization issues Performance degradation Unexpected failovers or cluster instability GUI access problems Routing behavior changes (BGP/OSPF/static routing) IPSec VPN stability issues SSL-VPN related issues Policy installation or FortiManager interoperability issues FortiAnalyzer anomalies Any known bugs affecting FortiGate 200F or 400F platforms specificallyFor those who have already upgraded:What platform/model are you using? Standalone or HA? Any caveats observed during or after the upgrade? Would you cons

Hello team,I am using FortiAuthenticator Tacacs+ server. It is working with Cisco but not with Nvdia Cumulus switch. Because Nvidia cumulus switch uses Linux PAM module for Tacacs and it send authorization request first instead of Authentication. There is no setting in the forti Autheticator like”allow authorization before authentication”. But cisco it works because it uses authetication and then authorization. Any suggestion how to allow authorization first in forti Authenticator? Because other Tecacs servers have this option “authorize before authenticate”

DescriptionThe connectivity failure observed when accessing the LDAP server behind FortiGate from FortiAuthenticator ('FAC') Cloud via a Zero Trust Network Access (ZTNA) tunnel.ScopeFortiOS.FortiAuthenticator.SolutionTo configure the ZTNA access to the LDAP server from FortiAuthenticator, refer to this document: Accessing an AD server with a zero trust tunnel on FortiAuthenticator.The following errors are observed on FortiAuthenticator when trying to query for group information.Sample error 1:As observed in the packet capture taken on the FortiGate (FGT), the TLS handshake fails with a "Certificate Unknown" alert sent from the FortiAuthenticator (FAC) end.Sample error 2:For the ZTNA server certificate, the self-signed certificate generated on the FortiGate (FGT) was used. The corresponding Sub-CA and CA certificates were uploaded to FortiAuthenticator (FAC) to establish the certificate trust chain. However, despite importing these certificates, the same TLS handshake failure with a "Ce

FortiAp 221e with firmware 7.4.6, connected to fortigate FG200e with firmware 8.0.2 in any physical interface, or fortiswitch vlan ,is unable to get online.It receives ip address, i can see it as an lldp neighbor ,but never goes online. Always OFFLINE.Any help ?  

DescriptionThis article describes the issue of being unable to upgrade an ADOM due to 'The string contains XSS vulnerability characters - prop[_apn]' error. The article provides a step-by-step solution to resolve this issue.ScopeFortiGate, FortiManager, FortiExtender.SolutionWhen trying to upgrade an ADOM that has FortiExtender in it, FortiManager can give an error as below:Fail (errno=171): Package copy failed. object: fortiextender. detail: failed to copy 756-3:Run the following debug command first on FortiManager CLI, and try to upgrade the ADOM, to identify the issue exactly:diagnose debug enable diagnose debug service dvmdb 255If there is an output similar to this, then the ADOM upgrade is failing due to FortiExtender values in FortiManager DB. This error is caused by FortiExtender that sends unsupported characters for '_cid', and '_apn' values. __do_cdb_node_attr_check error:_gsm_profile._apn У̿ --> commit [cate: 4026] copy _gsm_profile.(soid=10916) to dparent=29505, fail: err

HelloWe want to replace Ivanti Connect Secure with Fortigate Agentless ZTNA for RDP connections.So far everything works fine but our customer has a special configuration on Ivanti Gateway:In the Ivanti bookmark configuration, an application (mstsc) is set to start automatically.This means that after the first RDP connect, an mstsc window opens, allowing you to switch to the next RDP server.We are using a Fortigate 101F / OS: 7.6.7For ZTNA Bookmark on Fortigate I found these RDP options:# set *apptype                  Application type.verify-cert              Enable/disable certificate verification of the real server.*host                     Host name/IP parameter.description              Description.keyboard-layout          Keyboard layout.security                 Security mode for RDP connection (default = any).send-preconnection-id    Enable/disable sending of preconnection ID.load-balancing-info      The load balancing information or cookie which should be provided to the connectio

DescriptionThis article describes custom signatures that can help block the Node.js Vulnerability (CVE-2026-105483) on FortiWeb.ScopeFortiWeb.SolutionCVE-2026-105483 is a high-severity-rated vulnerability in Node.js TLS hostname verification that allows a certificate lacking a matching IP address SAN to authenticate a connection to an IPv4 address when the hostname contains non-ASCII characters, such as full-width digits(１２７.0.0.1). The issue occurs because tls.checkServerIdentity() fails to identify such hostnames as IP addresses, despite their normalization and resolution to a standard IPv4 address. Instead, the hostname is checked against the certificate’s DNS names and Common Name (CN), potentially allowing a certificate that would otherwise fail IP address verification to be accepted.Note: This vulnerability affects Node.js versions 26.x and 24.x.To block this Vulnerability on FortiWeb, create a custom signature.Navigate to the CLI of FortiWeb and run the following commands sequen

For all Cisco devices, I am getting the SNMP error below. Does anyone know how to fix it?SNMP failed for device SW01 with message SNMP getNext/getBulk Failed for device : 10.10.10.1All core functions, such as authentication and CoA, are working fine. Therefore, this issue has no impact on production services at the moment.

After upgrading a FortiGate HA cluster to FortiOS 7.6.8, the HTTPS GUI was no longer accessible. Browsers returned ERR_SSL_PROTOCOL_ERROR, while curl reported SEC_E_DECRYPT_FAILURE.The GUI worked when TLS 1.2 was explicitly enforced. The issue was resolved with:config system global    set admin-https-ssl-versions tlsv1-2    set tls-session-cache disableendA reboot was required for the TLS session cache change to take effect. After the reboot, the GUI was accessible again.Is this a known issue in FortiOS 7.6.8?

DescriptionRemote access to a FortiGate device from FortiManagement Cloud results in a blank page when a custom administration port is configured.ScopeFortiGate, FortiManagement Cloud.SolutionSymptoms.When using FortiManagement Cloud to remotely access a FortiGate device that has a custom HTTPS administration port (e.g., 4443) configured, the remote access page remains blank. The FortiManagement Cloud API incorrectly reports the administration port as 443 instead of the configured custom port.Root cause.This is a known issue in FortiManagement Cloud version 26.3.a where the system fails to correctly identify and use the custom administration port of the managed FortiGate device for remote access sessions.Resolution.Workaround.Change the FortiGate HTTPS administration port back to the default port 443. This allows FortiManagement Cloud to establish the remote access session correctly.Permanent fix.The issue is addressed in version 26.4 and correctly supports custom administration ports

Description This article explains excluding a few configs to sync between HA units.   Scope   FortiGate.Solution   When FortiGate in HA with config sync enabled, if few config needs to be exempted to sync with HA members. When both the FortiGate are in different availability zone (Cloud), both the FortiGate will have different subnets for each interfaces, so interface IP config should not sync with FortiGate member. Similarly, if any other config should be excluded from sync. To exclude the config to sync enable the Vdom-Exception. Note:  In Azure HA scenarios, it is essential to manually set the physical interface IP address (e.g., port1) and local tunnel interface IP addresses on the secondary FortiGate. HA does not automatically synchronize these IP addresses. Additionally, the loopback interface configuration must be copied manually from the HA primary to the secondary FortiGate. Configuring a VDOM exception for 'system.interface' does not affect behavior. &nb

DescriptionA FortiGate provisioned through the FortiManager ZTP workflow can remain unregistered with FortiCare for 30 minutes to several hours, even though the FortiCare portal shows valid contracts. This article describes the symptoms, the cause, and the workarounds for the delay.ScopeAll FortiGate models running FortiOS version 7.4.x or above, provisioned through ZTP by FortiManager.SolutionSymptoms.After a FortiGate is provisioned through the FortiManager ZTP workflow, the device does not reach registered status for 30 minutes, several hours, or in some cases until the next day. The device eventually registers on its own, but the delay blocks the remainder of the deployment. The issue is intermittent, and not every device in the same deployment is affected.The following conditions are present:FortiCare portal: the serial number is registered correctly, and the contracts are valid.FortiGuard updates: database updates work normally. The update debug output shows that the FDS endpoint

We have been using IPsec VPN with a peer group and peers.The peers have the CA cert of the EMS server and the subject as part of the peer identifier. This has always worked fine until the upgrade to 7.4.13 where we get an “invalid certificate” error and no connection. If the Peer Option is set to Any Peer ID then the VPN connection works. I’ve looked through the “known issues” of 7.4.13 but nothing applies.Any ideas?Thanks.

DescriptionThis article describes the process of generating and exporting debug logs from various platforms running with FortiClient and FortiClient EMS.ScopeFortiClient EMS, FortiClient EMS Cloud, FortiClient Windows, FortiClient Linux, FortiClient macOS, FortiClient Android, and FortiClient IOS.SolutionFortiClient EMS On-premises:Access the EMS console as a user with admin privileges.Under EMS -> System Settings -> Log Settings -> Log Level, change 'info' to 'debug'.Reproduce the issue being experienced.Navigate to EMS -> Administration -> Generate Diagnostic Logs -> Create.This operation may take a long time. Be patient.Once the log creation is complete, the 'Download' button will appear. Download the log.   FortiClient EMS Cloud:Note: Feature not available since version 7.4.5.Access the EMS Cloud console via the Support portal.Under EMS -> System Settings -> Log Settings -> Log Level, change 'info' to 'debug'.Reproduce the issue being experienced.Navigate

Hi.We are trying to get all our firewalls upgrading to the latest urgent patches.Forticloud shows our firewalls running 7.6.7 there is a recommended upgrade to 7.6.8, however, when we do the upgrade button, there is only 8.x listed!!!7.2 and 7.4 branches seem fine!Please tell me we don't need to manually patch these 7.6.x boxes?

Hi there,on FG71G and FG60F, I need to create certain firewall policy, and monitor all log traffic.log need contain:1. device id2. mac address id3. destination (url, etc, also services if possible)4. duration (if possible)5. time stampneed help pls.FG60, use firmware 7.2.4FG71, use firmware 7.6.6than you

Per https://www.fortiguard.com/psirt/FG-IR-26-165 we’re supposed to upgrade FortiClient.exe to 7.4.8, but the download links at https://links.fortinet.com/forticlient/win/vpnagent are only for 7.4.7 or lower. What gives? How are we supposed to remediate this if the links don’t work?

We have two Fortigate 40F running FortiOS 7.6.8 in A/P HAno dedicated management interface. no ha-direct.Requirement is to poll individual cluster membersusing authenticated and encrypted SNMPv3.Polling cluster IP works.Now I used the “management-ip” feature and configured the LAN Interfaces witha cluster IP and different management-IPs.config system interface    edit "lan1"        ...        set ip 172.16.42.1 255.255.255.0        set management-ip 172.16.42.2 255.255.255.0                         ##  ( 172.16.42.3 on secondary machine)        set allowaccess ping https ssh snmp…With that setup I can accessthe currently active machine using 172.16.42.1 the primary     machine using 172.16.42.2 the secondary machine using 172.16.42.3with pings, https and ssh separately without issues.At the moment,only the snmpd on the active machine answer to queries to IP 172.16.42.1What is needed to make SNMPv3 polling to 172.16.42.2 and 172.16.42.3 work ? 

Description   This article contains a list of resources related to Simple Network Management Protocol (SNMP) on the FortiGate. This includes: Guides for troubleshooting SNMP communication issues. Articles describing the various SNMP Object Identifiers (OIDs) and their associated use-cases.   Scope   FortiGate, SNMP   Solution   Troubleshooting and Configuring SNMP Title and Links Description Technical Tip: Download FortiOS and FortiCore MIB files KB article describing how to access/download Fortinet's SNMP MIB files (FORTINET-CORE-MIB and FORTINET-FORTIGATE-MIB). Troubleshooting Tip: How to use snmpd debug to troubleshoot SNMP Troubleshooting Tip: Troubleshooting SNMP query failure from the SNMP manager to the firewall Troubleshooting Tip: General troubleshooting guide for SNMP issues Technical Tip: SNMP access to FortiGate Technical Tip: FortiGate is not responding to SNMP queries Technical Tip: SNMP polling/snmpwalk not w

Description This article describes the configuration needed to have traffic load-balanced over multiple shortcuts for ADVPN SD-WAN 2.0  Scope Available from FortiOS 7.6.0 Solution The load-balancing of traffic over several shortcuts will be effective when the following configuration is applied:   config system sdwan config service   edit 1         set load-balance enable         set mode sla         …         set tie-break fib-best-match     next end   With the above configuration, the source spoke will establish and use a full mesh of shortcuts between all local members and all members of the remote spoke within the same transport-group. The transport-group is configured at the SD-WAN member level.   The algorithm used for load balancing is defined (once load-balance is enabled for this service) by: