Recently active topics

DescriptionOn a FortiSIEM Collector, FIPS mode may remain disabled even after running fips-mode-setup --enable and rebooting the system.This can occur when the default kernel entry contains the fips=1 parameter, but the parameter is missing from the actual kernel boot command line. As a result, FIPS mode is not enabled after reboot.This article describes how to verify the kernel boot parameters and regenerate the initramfs and GRUB configuration to resolve the issue.ScopeFortiSIEM.SolutionVerify the FIPS status and kernel boot parameters:fips-mode-setup --check grubby --info=DEFAULT cat /proc/cmdline cat /proc/sys/crypto/fips_enabledIf fips=1 is present in the default kernel entry but missing from /proc/cmdline, proceed with the steps below.Back Up the GRUB Configuration:Before making changes, back up the existing GRUB configuration:cp -a /boot/grub2/grub.cfg /boot/grub2/grub.cfg.bakRegenerate the Initramfs and GRUB Configuration:Run the following commands:dracut -f grub2-mkconfig -o /

I am trying to upgrade my FortiClient EMS from version 7.4.7 to 7.4.8, but I keep receiving the following error message. Does anyone know how to resolve this issue?  Reverting EMS installation files dpkg: error processing package forticlientems (--configure): installed forticlientems package post-installation script subprocess returned error exit status 1 Processing triggers for postgresql-common Removing obsolete dictionary files: Errors were encountered while processing:  forticlientems E: Sub-process /usr/bin/dpkg returned an error code (1) cp: cannot stat '/tmp/ems/info/ems.*': No such file or directory  

DescriptionThis article provides guidance on which Fortinet team should be contacted for different types of queries related to the Partner Portal, Training Portal, and FortiCloud Portal. Use the information below to ensure the query is directed to the appropriate team for faster assistance.ScopeFortinet Partner Portal, Fortinet Training and Certification Portal, FortiCloud Portal.SolutionFortinet Regional Partner Team:The Regional Partner Team should be contacted for Partner Portal-related queries, including:Request to change the Partner's primary email address.Request to merge two Partner accounts.Queries related to adding an additional user to the Partner Portal.Request to change the "FortiCloud Enabled" status of a Partner user to True or False.Issues encountered while creating a Partner account.Regional Partner Team Contacts:RegionEmail AddressAPACapac_partners@fortinet.comEMEAemea_partners@fortinet.comJAPANjapan_partners@fortinet.comAMERpartners@fortinet.comLATAMlatam_partners@for

I would like to confirm about Forticloud SSO solutions with Entra IDAfter read document it seems working as below conceptsConfigure IAM with IdP on forticloud portal (Entra ID → FortiCloud) Enable FortiCloud SSO on the FortiGateHowever, this first time for me & not sure there are any concern point that need to be aware or any required special license? anyone have experice on this please suggest me, thanks

Because SSL VPN will retired then i try to create IPSec VPN Remote Access with below setting:phase1 :edit "VPN-RA"        set type dynamic        set interface "port2"        set local-gw xxx.xxx.xxx.106        set peertype one        set net-device disable        set mode-cfg enable        set ipv4-dns-server1 10.105.10.5        set proposal aes256-sha256 aes128-sha1        set localid "vpnra"        set dpd on-idle        set dhgrp 20 5        set peerid "vpnra"        set ipv4-start-ip 10.203.203.1        set ipv4-end-ip 10.203.203.200        set ipv4-split-include "LAN"        set unity-support disable        set psksecret ENC xxxxx        set dpd-retryinterval 60    nextphase2:    edit "VPN-RA"        set phase1name "VPN-RA"        set proposal aes128-sha1 aes256-sha256        set pfs disable    nextAnd below is my forticlient setting But why i always get timeout?  

Is there a possible way to schedule FortiClient VPN (FREE) to login on a schedule ? For Example i want a client machine to connect daily at 12PM to the forticlient VPN. 

Hi,What's the deal with the free version of the VPN agent? According to the documentation, it should be 7.4.3.4799, but only version 7.4.3.4726 is available.What's the deal?

DescriptionThis article describes how to upgrade an individual secondary member of an FGCP cluster from the CLI when the cluster is in multi-version cluster (MVC) upgrade mode and the upgrade option is missing from the secondary's GUI.When 'upgrade-mode' is set to either 'local-only' or 'secondary-only', a secondary is upgraded by uploading the image on that secondary itself. The Administration Guide allows this from the secondary's CLI console or from its GUI over the HA management interface.On FortiOS 7.6, the 'System -> Firmware & Registartion' page of the secondary's GUI shows no upgrade button in either MVC mode. This is bug ID 1226122, resolved in FortiOS 8.0.1 and not fixed in the 7.6 branch at the time of writing. Until a fixed release is installed, the secondary must be upgraded from its CLI.ScopeFortiGate FGCP HA clusters (two or more members) running FortiOS 7.6.x on the secondary, with 'upgrade-mode' set to either 'local-only' or 'secondary-only'. Verified on a three

DescriptionWCCP traffic is not redirected to the web cache even though the cache is registered and usable. The FortiGate receives the Redirect Assign message but rejects it during mask assignment validation, logging 'cannot find cache server: 0.0.0.0'. Switching both devices to hash assignment resolves it.This article describes how to troubleshoot a WCCP service that negotiates successfully but never redirects traffic, where the FortiGate rejects the Redirect Assign message sent by the web cache.The symptom is easily misread as a FortiGate policy problem, because a firewall policy carrying 'set wccp enable' stops matching traffic altogether when the WCCP service is not installed in the kernel.The article covers the diagnostic sequence used to separate a control-plane failure from an assignment failure, the meaning of the 'cannot find cache server: 0.0.0.0' message, and the resolution.ScopeFortiGate acting as a WCCP router, with any third-party web cache acting as the WCCP cache engine.

I achieved my NSE 6 at the weekend, but I didn't realise that it wouldn't extend the validity date of my NSE 4 (1-3 were extended). I am going to study for my NSE 7 in Secure Networking now, but I only have 18 months to do this as my NSE 4 will expire then.I can see on their website that you can renew NSE 4 by "Complete the online NSE 4 recertification assessment if you passed one NSE 4 exam no more than 2 years ago", but I can't find a way to do this without sitting the full exam again (not an issue if required)Just wondered if anyone has done this before? 

nslookup v4-aws.api.intuit.com 96.45.45.45Server: dns1.fortiguard.netAddress: 96.45.45.45*** dns1.fortiguard.net can't find v4-aws.api.intuit.com: Server failednslookup v4-aws.api.intuit.com 96.45.46.46Server: dns2.fortiguard.netAddress: 96.45.46.46*** dns2.fortiguard.net can't find v4-aws.api.intuit.com: Server failed

DescriptionThis article describes an issue when confuring IBM Guardium connector in FortiSoar. When configuring a custom IBM Guardium connector in FortiSOAR, a GET request that executes successfully in Postman may fail in FortiSOAR with an SSLZeroReturnError, indicating that the TLS/SSL connection was closed unexpectedly. This article describes the symptoms and troubleshooting steps to investigate and resolve the HTTPS connection failure.When attempting to make an HTTPS request via a connector in FortiSOAR, the following error occurs: HTTP request failed: HTTPSConnectionPool Caused by SSLError(SSLZeroReturnError(6, 'TLS/SSL connection has been closed (EOF) (_ssl.c:1147)'))) Connectivity tests may show that API address resolution and TCP connectivity pass, but the TLS handshake fails.The issue is caused by a TLS handshake failure. This typically occurs when the FortiSOAR system does not trust the certificate chain of the remote server or when there is a mismatch between the configured h

DescriptionThis article describes the situation where an user is observing initial Setup Wizard during GUI login, for a FortiManager which was already deployed and not expected to go through setup proces once more.ScopeFortiManager. SolutionEven though FortiManager was deployed and used for some time, there are situations when, instead of the proper GUI login process, the following wizard could be observed:The issue happens when the number of added devices\VDOMs is higher than licensed.Here is the License Information widget before excessive devices\VDOMs were added:And that is how the widget looks after the limit is reached:Despite GUI access looking locked, it is possible to proceed with the wizard and decline all changes\setup options to get further access, double-check licensing details and either apply new license with higher number of devices or remove some of availabe one to go below the threshold.To verify the number of managed devices and available licenses, the following CLI c

Hi,after the win 11 upgrade to 25h2 version more notebook/pc dont connect trough vpn ipsec .IF I disable in network adapter the Fortinet  NDIS packet can connet but dont reach any devices  on remote network  and dont receve traffic. I tried Forticlient 7.2,  7.4 versions but nothing.Please HELP ME! Thanks in advance.     

DescriptionThis article describes the new feature added for ADVPN 2.0 deployment with multiple underlaying links. The new setting allows the BGP session to perform failover using SD-WAN rules.ScopeFortiGate.SolutionIn an SD-WAN hub-and-spoke deployment, a spoke FortiGate may have multiple underlay connections to reach a hub. If a BGP session uses a loopback address as its update source, locally generated BGP traffic (TCP port 179) may follow the routing table rather than the SD-WAN rules used to steer regular traffic. Consequently, BGP connectivity may become unstable when an underlay link is degraded, even though SD-WAN redirects user traffic to a healthy link.Starting with FortiOS 7.6.7 and 8.0.0, the use-sdwan option under the BGP neighbor configuration allows locally generated BGP connections to use SD-WAN rules. This helps align BGP connection traffic with the intended SD-WAN path-selection strategy.Enable use-sdwan on the relevant BGP neighbor on the spoke FortiGate:config router

DescriptionThis article describes how to troubleshoot issues where the logging page keeps loading and does not respond.ScopeFortiWeb, FortiWeb-VM.SolutionFortiWeb logging pages may hang and only keep loading the page and spinning. This can happen on either of the three logging pages, or on all of them (Attack, Event and Traffic).The logging page looks like this when the issue occurs:This may be a GUI issue or a Logdisk issue. Follow these steps to narrow down the problem:Open the FortiWeb window in Incognito mode or clear browser cache or test on another laptop/desktop. If the issue still persists, move to step 2, as this may not be a GUI issue.Capture debug logs for the logd demon by running the following commands, and examine the output for errors. These commands can be found in Common troubleshooting methods for issues that Logs cannot be displayed on GUI.diagnose debug application logd 7 diagnose debug application indexd 7 diagnose debug enableIf any errors are seen, copy the logs

If the FortiOS 7.6/8.0 Administrator Self-Paced lessons (not including the paid for Labs or Instructor led classes) are completed do you get a course completion certificate? My Employer currently lacks the budget to provide paid for training including the labs/classes however if a course completion certificate is given upon completion of the lessons then my employer may allow us to complete the training during working hours as a compromise.

Hi,a few days we updated from FortiOS 7.2.13 to 7.6.6.Now we can’t download “*.xlsx” files, because our DLP profile is blocking that.But we have only “*.xls” configured for blocking and not “*.xlsx”.When i remove the “*.xls” pattern, we are able to download “.xlsx” Files again.It looks to me that he is using “*.xls*” when entering “*.xls”. Is this a bug or a expected behavior? What do i need to enter, when i only want to block “*.xls” and not “*.xlsx”?A second problem, when i edit the DLP profile i can’t see the file types and can’t edit them. A other admin who is in the same admin group see 2 more colums in the profile table and is able to edit the file types. I switched on already all features in the feature visibility and cleard the browser cache, but no change. Has someone a hint for me?Kind regardsStefan

Hello all,we have an Exchange Hybrid setup with all our mailboxes on-prem. We need to let graph send emails via Exchange Online but we would need to relay these emails via our Fortimail appliance. So the Exchange Online environment does not send these itself without going through the Fortimail first. We found this in the cookbook:How to integrate FortiMail into Microsoft 365 | FortiMail Appliance and VM 7.4.0 | Fortinet Document LibraryAnd this technical guideline:Technical Tip: Office365 Secure Relay via FortiMail to avoid unauthorized email relay | CommunityAnd it seems like we can’t let graph talk directly to our on-prem Exchange servers:https://learn.microsoft.com/en-us/graph/hybrid-rest-support So we wondered how does the Technical Tip from fortinet make sure that we are not risking the relaying of unwanted emails. The authenticated part in the technical guideline does not apply here, no? Because our user mailboxes are all on-prem? And regarding the cookbook: our concern is that w

DescriptionThis article describes an issue where a 'system.federated-upgrade' checksum causes an HA desync. Or when it impedes creating a cluster from scratch.ScopeFortiGate.SolutionWhile hovering over the HA device, it will show 'system.federated-upgrade' has a mismatch in checksum values. This error is triggered in different scenarios.Scenario 1: When the fabric upgrade is enabled on the HA devices, and after the targeted firmware upgrade is finished, the cluster still goes out-of-sync. If HA reservation management is enabled, log in to the secondary device via the GUI and disable the Fabric upgrade.The following is what the configuration looks like: FortiGate-60F # config global FortiGate-60F (global) # config system federated-upgrade FortiGate-60F (federated-upgrade) # sh config system federated-upgrade     set status ready     set upgrade-id 2     set ha-reboot-controller "FGT60FTK2000YYYY"         config node-list             edit "FGT60FTK2000YYYY"                 set timing s

I would like to Integrate Tufin with Remedy in such a way that the CRQs requesting Fortimanager security policies configurations get automated, meaning that Tufin would be able to see the CRQs on Remedy and automatically configure the rules on Fortimanager:Tufin pick up Remedy ticket, figure out which firewall, check for conflicts, push rule to FortiManager. FNDN/API comes in is for the extra checks — like checking FortiAnalyzer logs to confirm the traffic is blocked, verifying policy package sync status, catching duplicate objects with different names, etc. Basically the stuff we'd manually check before making changes. FNDN/API comes in is for the extra checks — like checking FortiAnalyzer logs to confirm the traffic is blocked, verifying policy package sync status, catching duplicate objects with different names, etc. Basically the stuff we'd manually check before making changes.Is there any documentation or support that I could have access to accomplish this? Thank you & best re

Description This article explains how to check user authentication success and failure via logs.ScopeFortiMail.SolutionAdministrator authentication success/failure is logged in the System Event log.legend: "#","Date","Time","Subtype","Message","Level","Log ID"Via GUI:0,"2026-03-26","14:32:16.740","admin","User hoge login successfully from GUI(192.168.1.xxx)","information","0701003024"0,"2026-03-26","14:32:26.030","admin","User hoge login failed from GUI(192.168.1.xxx)","information","0701003024"Via SSH:0,"2026-03-26","14:28:06.983","admin","User hoge login successfully from ssh(192.168.1.xxx)","information","0701009794"0,"2026-03-26","14:30:00.064","admin","User hoge login failed from ssh(192.168.1.xxx)","information","0701009824"WebMail, SMTP(S), IMAP(S), and POP3(S) authentication success and failure events are logged in the Mail Event log.Via WebMail:legend: "#","Date","Time","Subtype","Message","Session ID","Level","Log ID"0,"2026-03-13","15:22:36.803","webmail","WebMail: User hoge

DescriptionThis article describes the steps to troubleshoot the issue with the security JavaScript code inserted by MITB Protection which causes error on file upload to non-HTTP local URI schemas such as blob:, ‘data:’, ‘file:’ etcScopeFortiWeb.SolutionPrerequisite:FortiWeb Firmware version v7.6.10 and older.FortiWeb Server Policy has the MITB (Man in the Browser) protection module configured with Ajaxcheck Status option enabled.The protected application page has the file upload function with non-HTTP local URI schemas such as ‘blob:’, ‘data:’, ‘file:’ etc. Issue:The Man-in-the-Browser (MITB) protection module with Ajaxcheck Status enabled in FortiWeb inserts JavaScript code into HTTP response bodies to protect user data from being sniffed by compromised browsers. A known issue was found where the injected script does not support non-HTTP local URI schemas, such as 'blob:', 'data:', and 'file:'. This causes failures when applications attempt to upload images using 'blob:' URLs. The Mit

DescriptionThis article describes how to resolve the issue where the upgrade to FortiClient EMS version 7.4.5 is stuck with the message 'Upgrade EMS: tar: Removing leading `/' from member names'.ScopeFortiClient EMS version 7.4.4 and below.SolutionWhen performing a FortiClient EMS upgrade to version 7.4.5 manually via CLI, it may get stuck on the 'Upgrade EMS: tar: Removing leading `/' from member names' message.execute upgrade ems --local.file forticlientems_7.4.5.2111.M.amd64.bin Upgrade EMS: ------------------------------ Upgrade EMS: Recovered DB password from previous version Upgrade EMS: Database collation version: 2.39 Upgrade EMS: System (glibc) version: 2.39 Upgrade EMS: EMS dpkg installation Status = iHR Upgrade EMS: EMS dpkg installation Status = iHR Upgrade EMS: EMS current installation version is 7.4.4.2034 Upgrade EMS: EMS current installation version is 7.4.4.2034. EMS will be upgraded. Upgrade EMS: Backing up current EMS installation files of version 7.4.4.2034 Upgrade

DescriptionThis article describes a known issue that causes FortiToken two-factor authentication to fail after a FortiOS upgrade due to token timing validation.ScopeFortiGate v7.6 and v8.0.SolutionThis issue can occur after upgrading FortiOS from version 7.6.4 to versions 7.6.5 or 7.6.6. During authentication attempts, the error displays as Authentication Failure, and the system event log records Invalid Token.status="failed" reason="token_invalid" msg="login failed because of an invalid token code" To confirm this behavior, run the following commands on the FortiGate to collect debug logs while performing a FortiToken-based login attempt:diagnose debug reset diagnose debug application forticldd 255 diagnose debug application fnbamd -1 diagnose fortitoken debug enable diagnose debug console timestamp enable diagnose debug enable Additionally, run the command diagnose fortitoken info before and after the command execute fortitoken sync <FortiToken_Serial> <code_1> <code_2