Recently active topics

Currently testing FAP241K with Fortiswitch 148F-FPOE, Currently Auto transmit power is set to 17 to 20 dBm with target dBm at -70. Not using any DFS channel. Poe mode is high.why is it even with just a single AP, transmit power never goes above 17?To go higher requires setting it to percentage. 100% can go up to 28 dbm, changing it back to auto and it get stuck at 28 dbm. Any ideas? 

DescriptionThis article describes the limitations of restricting ChatGPT, Gemini, and Claude to corporate accounts using native Inline-CASB tenant control on FortiGate.ScopeFortiGate.SolutionAn example if organization may want to permit these applications with its corporate accounts e.g., 'example.com' while blocking personal accounts such as Gmail or Outlook.This requirement cannot be fully enforced using native Inline-CASB tenant control on FortiOS 8.0.0 GA. Tenant control depends on whether the corresponding SaaS application definition supports tenant extraction. Not every application listed in Inline-CASB supports this function.The limitations are as follows:ChatGPT: Native tenant extraction is not available in its Inline-CASB application definition.Claude: Native tenant extraction is not available in its Inline-CASB application definition.Gemini: Google tenant extraction is not available in FortiOS 8.0.0 GA. Partial support through the Google SaaS application is available from For

DescriptionThe LLDP related commands are missing from the command line interface (CLI) or do not function as expected on a FortiProxy device.Up to FortiProxy version 7.4.14 and 7.6.6, LLDP related commands are available but have no effect on the FortiProxy behavior when configured.Starting from FortiProxy 7.6.7, the LLDP related CLI commands are unavailable.ScopeFortiProxy 7.6.7 and above.SolutionAlthough LLDP commands appeared in the CLI reference guide for FortiProxy versions up to 7.4.14 and 7.6.6, they were not functional on the device. As a result, FortiProxy does not support the LLDP feature.FortiProxy does not support the LLDP feature.All LLDP related CLI commands were removed to prevent confusion starting from FortiProxy version 7.6.7. The CLI reference guide for FortiProxy version 7.6.7 and later no longer mentions LLDP.

DescriptionA possible reason why an SNMP query and actual uptime may be different.ScopeFortiGate, FortiOS.SolutionA monitoring tool may report an uptime of only 1 day, even though the device has actually been running for 498 days. This behavior is caused by the limitation of the following SNMP OID:.1.3.6.1.2.1.1.3.0 (sysUpTime)The OID is the 32-bit version of sysUpTime and makes it possible to retrieve the correct uptime up to 497 days. Once this limit is reached, the counter wraps around to zero, causing the monitoring tool to report an incorrect uptime.As an alternative, it is possible to use the FortiGate-specific OID fgSysUpTime (1.3.6.1.4.1.12356.101.4.1.20), which provides a 64-bit uptime value in hundredths of a second since the network management subsystem was last initialized. This avoids the 497-day counter rollover limitation.Note: Both sysUpTime and fgSysUpTime represent the time since the network management portion of the system was last initialized. Therefore, the SNMP up

DescriptionPreviously, FortiSandbox deployments on Oracle Cloud Infrastructure (OCI) were limited to Intel-based processors due to nested virtualization restrictions.After updates to Oracle Cloud Infrastructure, nested virtualization is now supported on AMD-based processors, allowing FortiSandbox to be deployed in compatible AMD-based OCI environment.ScopeFortiSandbox version 5.2.0 and above.SolutionStarting with FortiSandbox version 5.2.0, a new virtual machine model, VMU, is available to support deployments on Oracle Cloud Infrastructure (OCI) using AMD processors.The VMU image is not available for direct download from the Fortinet Support Portal. To obtain the required image, a support ticket must be opened with Fortinet TAC. See Customer Service Tip: How to create a ticket for Fortinet TAC.Important notes:Existing FortiSandbox VM deployments cannot be upgraded or converted to the VMU model. A new deployment is required.The VMU model supports both VM00 and VMS licenses.

Hi Folks,I want to create an automation stitch so I get an alert. I think I have figured out how to do the emailing etc. However I am struggling to create an automation stitch that creates alert. I want it to alert when clients (per host) exceed a bandwidth limit. I know i can do it for interfaces etc but I wanted to be more specific.ieEmail alert: Host 1.1.1.1 has just exceeded 1gb bandwidth. thanks,Chris.

DescriptionThis article describes how to get the fsm-sync-os-repo.sh for offline upgrades.ScopeFortiSIEM.SolutionAs per this document, Offline Installation and Upgrade, it is necessary to build the local repository with the fsm-sync-os-repo.sh tool. This file has to be taken from the targeted version for the upgrade.The following steps show how to retrieve the correct fsm-sync-os-repo.sh from the upgrade .zip.Download the upgrade .zip file from Support. For example: FSM_Upgrade_All_7.6.1_build0753.zip.Create the directory on the running super FortiSIEM:mkdir -p /opt/upgradeTransfer the zip file to the /opt/upgrade directory using scp.Unzip the file with:cd /opt/upgrade 7za x FSM_Upgrade_All_7.6.1_build0753.zip Retrieve the fsm-sync-os-repo.sh with:rpm2cpio FSM_Upgrade_All_7.6.1_build0753/FortiSIEM-7.6.1.0753/FortiSIEM-7.6.1.0753.rpm | cpio -i --to-stdout './opt/phoenix/deployment/jumpbox/fsm-sync-os-repo.sh' > fsm-sync-os-repo.shTransfer the/opt/upgrade/fsm-sync-os-repo.sh file to t

DescriptionThis article describes the issue when BGP session fails to establish over GRE-over-IPsec tunnel due to recursive routing where traffic to the peer public IP is incorrectly routed through the tunnel itself.ScopeFortiGate.SolutionBGP neighbors over an IPsec RE tunnel fail to establish. The tunnel status appears as UP, but BGP remains in a Connect or Active state. Packet captures show that TCP SYN packets are sent by the FortiGate, but no response is received from the peer, or the peer does not receive the packets.The issue is caused by recursive routing. When the add-route setting is enabled in the IPsec Phase 1 configuration, the FortiGate installs a route to the peer public IP via the tunnel. If this route has a better distance than the static route pointing to the WAN interface, the FortiGate attempts to send the encrypted ESP packets through the tunnel itself. The kernel detects this loop and drops the traffic with the message 'no route to <Peer_IP>, drop'.Resolution

DescriptionThis article describes how to block Log4j/JNDI traffic using FortiAppSec Cloud.ScopeFortiAppSec Cloud.SolutionObfuscated Log4j/JNDI payloads in the URL and User-Agent may evade detection by standard signatures. These standard signatures did not account for specific obfuscation techniques used to hide the JNDI sequence in HTTP headers and URLs.To block Log4j/JNDI traffic with FortiAppSec Cloud, go to WAF -> Advanced Applications -> Custom Rule and create two custom rules (one for User-Agent and the other for URL) with Operation 'Alert & Deny':Custom rule 1: Select 'HTTP Header' as Filter Type, then use 'User Agent' as Header Name and configure the following Value pattern:\$\{.*:-j\}\s*\$\{.*:-n\}\s*\$\{.*:-d\}\s*\$\{.*:-i\}.Custom rule 2: Using URL as Filter Type with the following URL pattern:/\$\{\$\{.*:-j\}\s*\$\{.*:-n\}\s*\$\{.*:-d\}\s*\$\{.*:-i\}.Configured filters based on patterns should look like these:Related document:Custom Rule

DescriptionThis article describes what a split-brain scenario is in an HA Active Passive setup, common causes, and how to prevent it.ScopeFortiWeb HA.Solution'Split-brain' is a condition in which FortiWeb appliances in an HA cluster lose communication with each other over the HA heartbeat interface. As a result, each FortiWeb appliance may assume that it should take the active role, depending on the HA configuration and election behavior.When a split-brain scenario occurs, both appliances may attempt to handle traffic for the same virtual IP addresses. If both units advertise or use the same virtual MAC addresses, this can cause MAC address flapping, ARP inconsistencies, intermittent connectivity, and service disruption. Configuration synchronization and session continuity may also be affected.Common symptoms of split brain:When logging into each FortiWeb appliance individually, the HA status may indicate that the appliance is active or primary, rather than showing the expected cluster

DescriptionThis article describes an issue where BGP sessions intermittently go down in an ADVPN environment because the FortiGate uses an incorrect source IP address after a failed IPsec Security Association (SA) negotiation.The BGP session may unexpectedly originate from a stale ADVPN shortcut IP address, WAN IP address, or management IP address instead of the tunnel IP address assigned by the dial-up IPsec VPN server.As a result, BGP neighbors remain disconnected even when the parent IPsec tunnel appears to be established. Resetting the affected tunnel temporarily restores the expected source IP address and allows the BGP session to establish again.ScopeFortiGate, FortiOS version 7.4, FortiOS version 7.6, ADVPN, IPsec VPN, IKEv2, BGP.SolutionThe issue occurs when IPsec SA negotiation fails during an ADVPN shortcut establishment between two spokes.Under certain conditions, the Internet Key Exchange (IKE) process incorrectly installs the shortcut tunnel IP address on the parent spoke-

Hi everyone,Since upgrading my FortiGate 70G from 7.6.6 to 7.6.7, I can't access the admin GUI via my Nginx Proxy Manager. Direct local IP access works perfectly...The initial HTML loads, but all subsequent parallel requests for static chunks and API calls instantly fail after a login attempt. My NPM logs show: 104: Connection reset by peer in SSL handshake while SSL handshaking to upstream 2026/10/10 08:40:08 [error] 937#937: *53149 peer closed connection in SSL handshake while SSL handshaking to upstream, client: 192.168.20.2, server: forti.local.net, request: "GET /favicon/favicon-16x16.png HTTP/2.0", upstream: "https://192.168.1.1:443/favicon/favicon-16x16.png", host: "forti.local.net", referrer: "https://forti.local.net/login?redir=%2Fprompt%3FviewOnly%3D" What I tried (without success):    Restarted the httpsd process.     Forced proxy_http_version 1.1 in Nginx to prevent HTTP/2 connection spikes.     Toggled SNI (proxy_ssl_server_name) and session reuse.     Tried SSL-offloading

Hello everybody,We're considering FortiAnalyzer Cloud for our FortiGate 70G-PoE in a small company (~50 employees).Our main goal is incident response and forensic investigations, e.g. identifying suspicious activity, investigating a compromised device or tracking a potential attacker using firewall logs.As I understand it, the last 100 days of logs are available for analytics and reporting, while logs from 100–365 days are archived.A few questions:How easy is it to search archived logs from 3-12 months ago?Can archived logs be re-indexed for FortiView, analytics, and reporting in FortiAnalyzer Cloud?Is it possible to analyze logs spanning an entire year, or are analytics limited to the most recent 100 days? Is FortiAnalyzer Cloud the right product for our use case, or should we consider something else (e.g. FortiSIEM)? Is there a trial license available to test these limitations before purchasing? Thanks in advance for any pointers!

My question is: How do I configure an email account so that it only sends emails and does not receive them, and so that if someone does send an email to that account, the sender receives a custom notification?Note: This post was machine translated to meet Fortinet Community Guidelines.

Description This article describes troubleshooting steps for cases where a connection cannot be made to FortiGate through the SSL VPN. SSL VPN Status stops at 48%. It shows a pop-up message with 'Credential or SSLVPN configuration is wrong (-7200)':   Scope FortiGate. Solution Run more debugging to gather more information to investigate the issue for the next step.   In the FortiGate CLI:   diagnose debug disable diagnose debug reset   diagnose debug application sslvpn -1 diagnose debug console timestamp enable diagnose debug enable   Results similar to the following may appear:   At FortiGate CLI command:     diagnose debug disable diagnose debug reset   diagnose debug application sslvpn -1 diagnose debug console timestamp enable diagnose debug enable 2023-11-02 14:15:59 [11178:root:32]allocSSLConn:289 sconn 0x54d60280 (0:root)2023-11-02 14:15:59 [11178:root:32]SSL state:before SSL initialization (15.15.15.15)2023-11-02 14:15:59

while i try to register my forti AP 221e device in forti cloud web portal & beliow mentioned error are comming. Please check & update the same.  Note: This post was edited to remove personally identifiable information by a moderator. A serial number was entered into the Registration Code box in the original screenshot.

Hi,I have basically this configuration:Thing is that i would like to have multiple IPSEC tunnels with same ike-saml-server, but using different loopbacks interfaces. I need this multiple tunnel solution because I need to have different access restrictions based on GEO policies depending on wich IPSEC tunnel you are using.Right now, I have multiple IPSEC tunnels using networkid parameter: But that configuration have two major issues: I can’t have a different GEO restriction for each tunnel and Forticlient android clients doesn’t support networkid parameter.Does anyone have an idea to configure multiple IPSEC tunnels with SAML on to different loopbacks interfaces?Regards 

DescriptionThe available access recovery options when administrative access to a FortiGate device is lost.Depending on the FortiOS firmware version and configuration, different recovery methods may be available.ScopeFortiGate/FortiOS version 7.2.x/FortiOS version 7.4.x/FortiOS version 7.6.x.SolutionImportant: The maintainer account was removed in FortiOS version 7.2.4.The device that is still running FortiOS versions below 7.2.4, where the maintainer account still exists, should be upgraded to the most recent firmware version for security reasons.Option 1: Recover admin access using the maintainer account:In FortiOS versions below 7.2.4, the maintainer account can be used to reset the admin password when console access is available and the account wasn't manually disabled.Follow the procedure described in Technical Tip: Resetting a lost admin password.This method requires:Physical access to the FortiGate (console cable).A reboot of the device.Entering maintainer credentials during the

Hi team,We need your suggestion & support to configure the fortiAP 221E in standalone mode because i dont have the firewall & controller. we need public the one SSID through fortiAP 221E for create the wifi zone for laptop users. please suggest the best method to me. FortiAP 221E 

DescriptionAn issue where a static route remains active in the routing table despite the IPsec tunnel being down, preventing traffic failover to backup routes.ScopeFortiGate.SolutionTraffic stops passing through a route-based IPsec tunnel, but the static route associated with that tunnel remains the best route in the routing table. Consequently, traffic does not fail over to backup routes with higher distance values.Static routes tied to a VPN tunnel are only removed from the routing table when the IPsec Phase 1 tunnel goes down. If the Phase 1 tunnel remains up while the data plane is failing or the peer is unreachable, the route stays active.To identify this, verify Tunnel Status. Run the following command to check if the IPsec Phase 1 tunnel is still active during the incident:diagnose vpn ike gateway list diagnose vpn tunnel list get vpn ipsec tunnel summaryThere are two options to address this issue. Configure Dead Peer Detection (DPD):Ensure Dead Peer Detection is configured to b

DescriptionThis article describes how to collect log samples required for investigation by the Fortinet TAC team.ScopeFortiAnalyzer.SolutionFortiAnalyzer provides two locations for collecting log samples: Log browse and Log view.When the specific log category required for investigation is unknown - whether SSL, Antivirus, Traffic, VPN, HA, Wi-Fi, or any other - downloading log files from Log browse is the recommended approach.This method covers a wide range of log categories in a single export.When the required log categories are known, Log view can be used. Filtering by device hostname, time period, and any other relevant parameters allows for a precise and targeted log export.Review 'Prerequisites' first, then follow the steps for the chosen logs location.Once the logs are downloaded, see 'Submitting the logs'.Prerequisites.Decide on the following points before collecting the logs. They apply to both Log Browse and Log View, and are used later in the device and time period steps.Devi

My building will be shutting off power for electrical work this weekend and all our hardware has to be powered down ahead of time. We have two Fortigates in an HA configuration and several managed 424E and 448E FortiSwitches. Do we need to issue shutdown commands to the switches via the CLI or will shutting down the managing Fortigates shut the switches down too?

Description   This article describes that in a FortiMail in HA mode when a configuration is updated on the Primary unit, the Secondary unit is immediately updated as well.  This is valid for both, Active-Passive HA and Config-only HA.Additionally, units in Active-Passive HA can synchronize data directories - system quarantine, email archives, email users’ mailboxes (server mode only), preferences, and per-recipient quarantines).The interval for this synchronization is up to 20 minutes on units running firmware v5.0.3 and higher. For units running firmware prior to v5.0.3, this interval is 20-40 minutes.   Scope   FortiMail. Solution   The data directory synchronization can be enabled in System -> High Availability -> Configuration.   It can also be synchronized through the CLI:   config system ha    set mail-data-sync enableend   This setting must be enabled on both cluster nodes for the feature to work.

DescriptionThis article describes how to configure the SDN Connector on the Azure FortiGate VM Active-Passive HA Cluster to do the following when failover occurs:Move the Public IP address(es) from primary to secondary FortiGate-VM, and,Update the Route Table(s) to point to the secondary FortiGate-VM private IP address.ScopeFortiGate-VM in Azure.SolutionBefore configuring the SDN Connector, make sure both FortiGates have write access to the necessary Azure resources.Review the Admin Guide for details: Access control. Configure the SDN-Connector on the FortiGates:  On FortiGate A:'config ip': This section is relevant if more public IPs are in use.'edit "RouteTable2"':Use this section if more route tables are in use.Use 'set subscription-id "sub2"' if RouteTable2 is in another subscription.Use 'set resource-group "RG2"' if RouteTable2 is in another resource group.config system sdn-connector     edit "AzureHA"         set status enable         set type azure         set use-metadata-iam e

DescriptionThis article describes how to identify and remove duplicate Request Processing Rules in FortiNAC.In the affected environment, the database contained 102 Request Processing Rules instead of the expected 51. Some rules were exact duplicates, while others had minor configuration differences.ScopeFortiNAC.SolutionIdentify the duplicate rules.Access the database using:execute db-shellRequest Processing Rules are stored in the bsc.WebServiceDefinition table.Run the following SQL query to identify duplicates:SELECT serviceType, serviceMatcher, serviceAction, serviceTarget, COUNT(*) AS duplicate_count, GROUP_CONCAT(ID ORDER BY ID) AS IDs FROM bsc.WebServiceDefinition GROUP BY serviceType, serviceMatcher, serviceAction, serviceTarget HAVING COUNT(*) > 1;In this example, the query identified 49 duplicate groups, each containing an original rule and a duplicate with a higher database ID: Remove the duplicate entries.Before proceeding, ensure a valid dat