Recently active topics

DescriptionThis article describes how to identify and remove duplicate Request Processing Rules in FortiNAC.In the affected environment, the database contained 102 Request Processing Rules instead of the expected 51. Some rules were exact duplicates, while others had minor configuration differences.ScopeFortiNAC.SolutionIdentify the duplicate rules.Access the database using:execute db-shellRequest Processing Rules are stored in the bsc.WebServiceDefinition table.Run the following SQL query to identify duplicates:SELECT serviceType, serviceMatcher, serviceAction, serviceTarget, COUNT(*) AS duplicate_count, GROUP_CONCAT(ID ORDER BY ID) AS IDs FROM bsc.WebServiceDefinition GROUP BY serviceType, serviceMatcher, serviceAction, serviceTarget HAVING COUNT(*) > 1;In this example, the query identified 49 duplicate groups, each containing an original rule and a duplicate with a higher database ID: Remove the duplicate entries.Before proceeding, ensure a valid dat

DescriptionThis article describes the option names for 'Send notification' under 'Attachment handling for deferred email' in the content disarm and reconstruction (CDR) attachment settings.Beginning with FortiMail v7.4, the option names are changed, but the functionality of each option is the same as in FortiMail v7.2.ScopeFortiMail v7.2, v7.4.Solution• Configuring content disarm and reconstruction - FortiMail v7.4.0 Administration Guide.In both FortiMail v7.2 and v7.4, the setting is located in Security -> Disarm & Reconstruction -> Attachment, under 'Attachment handling for deferred email'.Only the option names in the GUI are changed in FortiMail v7.4.Option names:'Disarm' in FortiMail v7.2 is renamed to 'Disarm Office/PDF and remove others' in FortiMail v7.4.'Remove' in FortiMail v7.2 is renamed to 'Remove all' in FortiMail v7.4.Behavior of each option:When 'Send notification' is enabled, each option works as follows.'Disarm Office/PDF and remove others' ('Disarm' in Forti

DescriptionThis article describes how to configure FortiEDR to forward event logs to FortiAnalyzer using Syslog, and how to verify that the logs are received.ScopeFortiAnalyzer.FortiEDR.SolutionPrerequisites:The FortiEDR can reach FortiAnalyzer on the chosen Syslog port (default 514, UDP or TCP). Syslog messages always originate from the FortiEDR, so allow its IP through any firewall or NAT in the path.Create the Syslog destination on FortiEDR:Go to Profiles -> Export Settings -> Syslog.Click Define New Syslog.Fill in the fields:Select which events are sent:Select the Syslog destination row.In the Notifications pane, enable Security Events, System Events and Audit trail as required.Use the settings icon next to each type to adjust the fields included, if needed.Enable syslog notification in the Playbook:Go to Profiles -> Playbooks.Open the Playbook assigned to the Collector Group of the devices to monitor.Under Notifications, enable ‘Send syslog notification’ for the required

I am trying to set up IPSEC vpn from a fortigate to FortiClient for Windows and Mac. I have it working on FortiClient for Windows. On FortiClient Mac it says Connecting, then times out. I noticed that the Mac version is missing three options in the setup that are visible on Windows and I wonder if that is my problem.The options missing are:VPN Settings: EncapsulationPhase 1: NAT TransversalPhase 2: Enable Replay DetectionCan I get those options to show somehow?The fortigate side was set up using the wizard, and this is a full tunnel.

DescriptionThis article describes how to identify and resolve a condition where an IKEv2 dial-up IPsec VPN that uses certificate authentication together with EAP never reaches the EAP phase, because the fnbamd daemon crashes while validating the client certificate against a PKI peer group that contains more than one peer user.The IKE debug stops at 'certificate validation before eap pending', the client keeps retransmitting IKE_AUTH, and the crash log shows fnbamd terminating with a segmentation fault in the peer user comparison code.ScopeFortiGate running FortiOS v7.4.11 and below, or FortiOS v7.6.6 and below, with an IKEv2 dial-up tunnel configured with 'eap-cert-auth' and a PKI peer group as the peer type.SolutionSection 1. Symptoms.Remote users cannot establish the IKEv2 dial-up tunnel. The behavior can start suddenly on a tunnel that was working, with no configuration change on the FortiGate, and it affects IKE over UDP and IKE over TCP in the same way.From the client side, FortiC

DescriptionThis article describes how to identify and temporarily mitigate PEAP-MSCHAPv2 wireless authentication failures associated with Windows NTLMv1 Single Sign-On (SSO) restrictions when using FortiNAC Local RADIUS.ScopeFortiNAC.SolutionMicrosoft documents restrictions on generating NTLMv1-derived credentials used by some MS-CHAPv2 SSO connections. Its published timeline lists October 2026 for changing the default to Enforce when BlockNtlmv1SSO has not been explicitly configured.Confirm the endpoint configuration and events before applying a workaround. An EAP failure after a Windows update does not, by itself, establish this cause.See: Manage changes to NTLMv1 and prevent network issues in Windows 11 and Windows Server 2025Check the Windows version and wireless profileRun:winverRecord the Windows version, full OS build, and the update installed before the failure started.List the saved wireless profiles:netsh wlan show profilesUse the affected profile name in the export command.

Hi everyone... I have confuse about vpn concentrator, anybody help me to describe what is vpn concentrator mean? Thanks

  Description This article describes the behavior of FTP traffic Passive Mode when using FileZilla Client and FTP Server behind FortiGate. Scope FileZilla Client v3.67.1, FortiGate v7.4.x. Solution The scenario is FTP Client is located externally and wants to access the internal FTP Server behind FortiGate:   FTP Client (10.253.0.17) --- Internet --- VIP 10.47.3.179 (FortiGate) -- FTP Server 10.171.2.142   config firewall VIP    edit "FTP"        set extip 10.47.3.179        set mappedip "10.171.2.142"        set extintf "any"     next  end    With FTP Session Helper, FortiGate will translate the 'Passive IP address' on the FTP packet to the external IP Address:   config system session-helper    edit 9        set name FTP        set protocol 6        set port 21    nexten

DescriptionThis article describes how to access the GUI of FortiAuthenticator after creating a self-signed certificate from FortiAuthenticator CA to access the GUI.After creating a self-signed certificate to access the FortiAuthenticator GUI, the following error may be visible in the CLI, and GUI access may become unavailable:ScopeFortiAuthenticator.SolutionTo fix this issue and get access to the GUI, perform the following steps:In the CLI:execute regen-cert force execute rebootTry to access the GUI again.This issue can occur as well if someone mistakenly changes the HTTPS certificate in the System Access settings:The cause of this issue is when the apache service is unable to start.Check the logs in: https://<FAC IP>/debug/Web Server -> Apache.An output similar to this will appear:[Wed Apr 01 21:29:08.750420 2026] [ssl:info] [pid 6576:tid 6576] AH01883: Init: Initialized OpenSSL library [Wed Apr 01 21:29:08.751096 2026] [ssl:info] [pid 6576:tid 6576] AH01887: Init: Initializi

DescriptionThis article describes how to resolve the password change issue that occurs while changing the password of a local user (administrator) on the server side through the SMB password changer (Samba) on FortiPAM.ScopeFortiPAM, Windows Server 2025.SolutionStarting from Windows 2025, the SAMR operation of 'SamrUnicodeChangePasswordUser2' has been blocked on the server side. Therefore the following error's received while trying to change a local administrator on the Windows Server 2025. To resolve it:On the Windows Server 2025 Domain Controller:Open PowerShell as Administrator.Type gpedit.msc and press Enter to open the Local Group Policy Editor.Navigate to Computer Configuration -> Administrative Templates -> System -> Security Account Manager -> Configure SAM change password RPC methods policy.Change the policy to Allow all change password RPC methods.Note: gpedit.msc (Group Policy Editor) modifies the local machine policy, which can be overridden by a domain-level Gr

DescriptionThis article describes why an ICMP packet will be dropped with 'no session matched' at an interval of 60 seconds with NP enabled.ScopeFortiOS.SolutionIn a normal network environment, there are a lot of devices that are under monitoring or health check by the ICMP protocol. When setting up the health check with the ICMP protocol through the FortiGate, it is found out that when the health check PING is setup with interval or 1 minute, the health check will be classified as failed.Network Flow: ICMP Client -> FortiGate -> ICMP Server.The ICMP client will ping the ICMP server with an interval of 60s.If no NPU is involved (set auto-asic-offload disable), the packet is seen in the packet sniffer as below:However, if there is the default setting which is used with NPU (set auto-asic-offload enable).The egress packet is not seen and is dropped by 'no session matched' in the debug flow:Also observed from the system session the session is disappear with exactly 60 second.This is

DescriptionThis article explains how to troubleshoot issues where the source hostname (srcname) displayed in the FortiProxy forward traffic log does not match the expected hostname.date=2026-10-11 time=11:02:50 eventtime=1791687769516418973 tz="+0800" logid="0000000010" type="traffic" subtype="forward" level="notice" vd="root" srcip=10.169.2.76 srcname="10.169.2.76" srcport=60755 srcintf="port3" srcintfrole="undefined" dstcountry="United States" srccountry="Reserved" dstip=104.20.23.154 dstname="104.20.23.154" dstport=443 dstintf="port1" dstintfrole="undefined" sessionid=332 service="Whatsapp" proxyapptype="web-proxy" proto=6 action="accept" policyid=1 policytype="proxy-policy" poluuid="c0b2827c-f1a9-51f0-3f3d-9b7c1774b4e5" policyname="All_Internet" explicitwebproxy="web-proxy" trandisp="snat" transip=10.47.18.157 transport=58032 clientip=10.169.2.76 appcat="unscanned" url="www.example.com" duration=893 user="aduser1@fortilab.local" group="KRB_GRP" wanin=8134 rcvdbyte=8134 wanout=2786

DescriptionThis article describes an issue where attempting to SSH into the secondary FortiGate from the primary FortiGate in an HA cluster fails on FortiOS version 8.0.ScopeFortiOS version 8.0.SolutionLog in to the Primary FortiGate.Open the CLI.Type 'execute ha manage 1 admin' and follow the on-screen instructions to log into the secondary FortiGate through the primary FortiGate’s CLI:(Primary) # execute ha manage 1 admin The authenticity of host '169.254.0.2 (169.254.0.2)' can't be established. ECDSA key fingerprint is SHA256:M8+Zj1CN5XSLT9O6quTOgtvz10WNOPEEi/JoWTV40pY. This key is not known by any other names. Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '169.254.0.2' (ECDSA) to the list of known hosts. Connection closed by 169.254.0.2 port 22Root cause:execute ha manage establishes an SSH session over the HA heartbeat link using the internal link-local addresses in the 169.254.0.0/16 range (specifically 169.254.0.1 / 169.254.0

DescriptionThis article describes when the secondary FortiGate in a High Availability cluster remains out of sync within the system.automation-action table despite identical configurations on both units.ScopeFortiOS.SolutionSymptomsThe secondary FortiGate unit in an HA cluster shows a "Non Sync" status in the GUI. When hovering over the status, the system indicates that the system.automation-action table is not synchronized.Root CauseInconsistent line-ending characters within the message body of an automation action cause this issue. For example, the primary unit may use Line Feed (LF) characters ( ) while the secondary unit contains Carriage Return Line Feed (CRLF) characters ( ). This discrepancy often occurs when text is copied from a text editor and pasted into the configuration, leading to a checksum mismatch that prevents HA synchronization.ResolutionRecreate the affected automation action on the primary FortiGate unit to ensure clean line endings:Log in to the primary FortiGate

DescriptionThis article describes an issue where users may not be able to authenticate using the form-based explicit proxy authentication page after a FortiOS or FortiProxy upgrade.ScopeFortiGate, FortiProxy.SolutionAfter upgrading FortiGate to FortiOS v8.0 firmware, users may be unable to authenticate only through affected form-based authentication policies.A similar symptom can be observed after upgrading a FortiProxy device to FortiProxy v7.6.7 if an antivirus profile is applied to a firewall policy with explicit-web proxy enabled.Matching configuration:config authentication scheme edit <name> set method form next endDepending on the cause, any of the following symptoms could be observed after a user submits valid credentials:Browser reloads the login page.Browser times out.Browser displays 'Connection Reset' error.The 'basic' authentication method continues to function normally.config authentication scheme edit <name> set method basic nex

DescriptionThis article describes and troubleshoots an issue when deploying a license in an air-gapped environment using FortiManager as the FDN server.The following error appears: FSR-Auth-003: License Entitlement Sync failedThe connectivity to FortiManager on port 8890 may fail with a self-signed certificate error or SSL negotiation failure, even when the certificate is trusted in FortiSOAR.ScopeFortiManager, FortiSOAR.SolutionThe issue is due to a mutual TLS authentication between FortiSOAR and FortiManager running 7.6.3 and later.The FortiSOAR fails to deliver the certificate to the FortiManager. FortiSOAR cURL output:curl: (56) OpenSSL SSL_read: error:0A00045C:SSL routines:: tlsv13 alert certificate required, errno 0 FortiManager Diagnose Debug: error:0A0000C7:SSL routines: peer did not return a certificate.Workaround: No workarounds are available. Upgrade FortiManager to a version with the fix: 7.6.8 or later, or 8.0.1 or later.

DescriptionThis article describes how the assist packet works and how to view the counter of the assist packet.ScopeFortiGate Chassis 6000F, 7000E and 7000F.SolutionThe assist packet is a UDP packet sent from FPM/FPC to FIM/MBD's DP(FG6000F and FG7000E)/NP7_LB(FG7000F) to create DP sessions.For HA master chassis, FPM/FPC will send this assist packet to FIM/MBD's DP(FG6000F and FG7000E)/NP7_LB(FG7000F) for connectionless UDP/ICMP packets as well as the ALG's expectation session.For HA secondary chassis, FPM/FPC will send this assist packet to FIM/MBD's DP(FG6000F and FG7000E)/NP7_LB(FG7000F) whenever a new session is synchronized from the Master chassis.The following command can be used to check the counter:diagnose sys fortiswitch-heartbeat assist-pkt-statsSample output as follows:

Description This article describes how time zones are updated on the FortiGate and how administrators should handle changes to local time zones, such as Daylight Savings Time no longer being observed. Notably, this article will use the 2026 changes to Canadian time zones as a central example, but this information is still applicable to other time zones experiencing similar changes. Scope FortiGate. Solution In 2026, multiple provinces in Canada (British Columbia (BC), Alberta, the Northwest Territories, and Manitoba) had officially declared that they would no longer observe the practice of Daylight Saving Time, which means that these provinces will no longer change times going forward and will persist on the Daylight Time-equivalent of their respective time zones. This has also meant that new/existing time zones would need to be updated to reflect the difference between Canadian and US time zones:B.C.'s new time zone (Pacific time) (UTC-7:00).Alberta’s new time system (ABT) (UTC-6:00).

DescriptionThis article describes a scenario where, when FortiClient (7.4.x) establishes a ZTNA connection to a FortiGate which allows only TLS 1.3, the connection fails.config firewall vip edit "ZTNA-VIP" set type access-proxy set server-type https set extip x.x.x.x set extintf "<wan>" set extport 443 set ssl-certificate "<internal server certificate>" set client-cert enable set empty-cert-action block set ssl-min-version tls-1.3 <== Minimum allowed TLS version set ssl-max-version tls-1.3 next endThe packet captures below clearly show that the FortiGate refuses the connection since no compatible TLS version was offered by FortiClient: CLIENT -> VIP:443 SYN VIP:443 -> CLIENT_A SYN/ACK CLIENT -> VIP:443 ACK CLIENT -> VIP:443 PSH <-- TLS ClientHello VIP:443 -> CLIENT_A ACK VIP:443 -> CLIENT_A FIN <-- no ServerHello sent CLIENT -

DescriptionThis article describes how to resolve the 'License does not have required entitlements' error encountered when setting up an offline repository for FortiSOAR v8.0.0 in an air-gapped environment.ScopeFortiSOAR, FortiManager.SolutionStarting with FortiSOAR 8.0, a valid license is required to download packages locally for the offline repository to deploy FortiSOAR in an air-gapped environment. However, when using a perpetual license, the download fails with the following error:[2026-07-20 10:50:08] Generating new certificates... [2026-07-20 10:50:10] Failed to extract cert/key [2026-07-20 10:50:10] {"detail":"License does not have required entitlements"}The error occurs because the repository download script requires a specific entitlement (FSRE) to authenticate with the repository server, which is not present in the perpetual license model.Workaround: To bypass the entitlement check and retrieve the required packages, authenticate using the client certificate and key instead o

DescriptionThis article describes why FortiGate blocks access to HTTPS servers that support only TLS 1.2 after the global SSL/TLS settings are hardened, and how to restore access.ScopeFortiGate.SolutionWith certificate inspection in proxy mode, FortiGate opens its own TLS connection to the server to retrieve the server certificate. This connection follows the global SSL settings, not the SSL/SSH profile.With the following setting in place, this connection offers TLS 1.3 only:config system global set ssl-min-proto-version TLSv1-3 endA server that supports only TLS 1.2 rejects the handshake. FortiGate cannot retrieve the certificate and closes the session as a UTM block.Servers that support TLS 1.3 are not affected.Some external HTTPS websites become unreachable, while other HTTPS sites keep working through the same policy.The browser shows a generic connection error, not a FortiGate replacement page.The affected sessions match a proxy-mode firewall policy with certificate inspection

automatic failover between two different ipsecvpn remote gateway public IP addresses in FortiVPN Client

Hi all,I am currently encountering an issue with SSLVPN, and would would like to seek your advices. Thank you very much.Background:Fortigate 121G(7.4.12)Forticlient(7.4.11.0198)iPad OS(16.7.16)Issue:The SSL VPN connectivity is working successfully on iPad devices running iPadOS 17 and Android devices.However, the issue happen on the iPad device running iPadOS 16.7.16. The SSL VPN connection often gets stuck at the "Connecting" stage, and the login page does not appear.(Remark:iPadOS 16 and iPadOS17 in the same network, and same ssl vpn setting)We observed that when the issue occurs, the FortiGate firewall does not receive any SSL VPN traffic from the affected device.（Enabled SSL VPN application diagnostics, but no messages were generated）

Fortigate version 7.6.7 suddenly its appear i tried below command but still same:same i have other fortigate 600G and 61F working fine.config system globalset admin-http-rate-limit-max-requests 0set gui-cdn-usage disableset admin-http-request-header-timeout 0set admin-http-request-body-timeout 0set admin-http-unauthenticated-request-body-timeout 0set gui-login-request-rate-limit 0endKindly confirm the workaround if someone facing this issue.  

Hello Team,We need some guidance regarding a FortiSIEM Active-Active HA deployment. Version 7.4.2Current EnvironmentWe currently have 1 Supervisor node running in production. Our plan is to add 2 additional Supervisor nodes to build an Active-Active HA cluster.What HappenedWe initially generated the HA certificates using the root user. While adding the two new Supervisor nodes to the HA cluster, the process failed with the error: "The database application fails." Fortinet Support removed the HA nodes, and the existing environment was restored to a healthy state.Current StatusAfter the cleanup, we attempted to configure the HA cluster again with correct certificates , but we were still unable to successfully add the Supervisor nodes to the HA cluster.While investigating, we observed that the existing Supervisor already has the following services running:patroni etcdOur PlanWe are planning to retry the HA deployment once more, this time by generating the certificates correctly using