Recently active topics

DescriptionThis article describes how to enable or disable the PQC algorithm in the TLS handshake for LDAPS connections.ScopeFortiGate 8.0.1.SolutionFortiOS 8.0.1 introduced the 'pqc-policy' parameter in the LDAP configuration.This provides granular control so that FortiGate can offer hybrid or pure PQC key-exchange groups during the TLS handshake used by secure LDAP.Enable: FortiGate will send the PQC algorithm in the TLS Client Hello packets.Disable: No PQC algorithm is sent in the TLS Client Hello packets.Note: In 7.4.12 and 8.0.0 the PQC algorithms were disabled globally. FortiOS 8.0.1 re-enabled them by default for LDAP but added the per-server pqc-policy knob so administrators can disable them only where needed.The default setting is 'set pqc-policy enable':config user ldap edit "AD" set uuid 097db692-bdbb-51f1-e23a-bd51fe2426b3 set server "192.168.7.10" set cnid "sAMAccountName" set dn "dc=fortinet,dc=br" set type regular set u

DescriptionExpected behavior where the FortiGate starts blocking connections that use TLS version 1.0 when SSL certificate-inspection profiles are applied to Firewall Policies.ScopeFortiGate 7.6.7 and 8.0.0.SolutionIn FortiOS v7.6.6 and earlier, the FortiGate would allow HTTPS user traffic to utilize any standard version of TLS, even if it was deprecated (SSL 3.0, TLS 1.0/1.1/1.2/1.3). Any versions not on this list would otherwise be disallowed via the default set unsupported-ssl-version block setting:config firewall ssl-ssh-profile edit "certificate-inspection" config https set ports 443 set status certificate-inspection set client-certificate bypass set unsupported-ssl-version block set cert-probe-failure allow set encrypted-client-hello end next endHowever, starting from FortiOS 7.6.7 and 8.0.0, the FortiGate is now treating TLS 1.0 and SSL 3.0 as unsupported. This means that any connect

DescriptionHow to resolve an issue where FortiGate cannot update its FortiDDNS IP address, resulting in the error 'Failed reading pkg header'.ScopeFortiGate.SolutionIf the FortiGate cannot update the DDNS IP address, it may be due to packet fragmentation or Maximum Segment Size (MSS) issues when communicating with FortiGuard servers. This often manifests as a 'Failed reading pkg header' error in the debug logs.Verify the DDNS debugs using the following command:diagnose debug reset diagnose debug application ddnscd -1 diagnose debug enable 1790319253: Start to update FortiGuardDDNS (adealquoz34.fortiddns.com) 1790319253: next wait timeout 10 seconds fgd_ddns_socket()-896: connected to 173.243.138.226:443 [276] __ssl_init: Done [119] __ssl_cert_ctx_load: Added cert FGT60FTK21000124, root ca Fortinet_CA, idx 0 (default) [119] __ssl_cert_ctx_load: Added cert FGT60FTK21000124, root ca Fortinet_CA_Backup, idx 1 [843] ssl_ctx_create_new: SSL CTX is created [870] ssl_new: SSL object is create

DescriptionThis article describes why Source NAT (SNAT) can change the source port of IKE traffic passing through a FortiGate firewall.ScopeFortiGate.SolutionThe source port selected during SNAT depends on the FortiOS version and the original source port number.Scenario 1: Original source port is between 5117 and 65533.Beginning in FortiOS 7.4.4, port preservation is enabled by default. When port preservation is active, FortiGate attempts to retain the original source port during SNAT if the port is available.Port preservation is supported only for source ports in the range 5117-65533. If the source port is already in use by another session, FortiGate selects an alternate port.The following command can be used to verify whether the translated IP address and source port are already in use:diagnose sys session list | grep <Translated_IP>:<Original_Port>For additional information, see Fine-tuning source-port behavior for SNATScenario 2: Original source port is lower than 1023.

Hi everyone,We are experiencing an issue with FortiClient VPN 7.4.3.1790 on some PCs belonging to one of our customers.After Windows starts, the following error message is displayed:“A JavaScript error occurred in the main process”The VPN itself continues to work correctly despite the error.We have searched online and found a possible workaround that seems to resolve the issue: Uninstall the existing FortiClient installation using Revo Uninstaller. Remove any old Microsoft Visual C++ Redistributable packages (e.g. 2008, 2013) using Revo Uninstaller. Restart the PC. Install the latest Microsoft Visual C++ Redistributable. Reinstall FortiClient. This procedure worked on some of the affected PCs.However, we now have a different limitation: FortiClient can no longer be installed manually using the installer. It must be deployed through Microsoft Company Portal, and the issue has started occurring again on the affected PCs.The environment is also EMS-managed.Has anyone experienced t

Hello,I am trying to activate the Permanent Trial / Evaluation license for FortiGate-VM 7.6.6 running on Microsoft Hyper-V.When I run:execute vm-licenseI receive:Failed to download VM license.The VM license status is:diagnose hardware sysinfo vm fullvalid: 0status: 3code: 502The VM itself is recognized as an Evaluation VM:diagnose debug vm-print-licenseModel: EVAL (1)CPU: 1MEM: 2048I have tested the license activation in two different network environments:Corporate network using an HTTP proxy Mobile hotspot without the corporate proxyOn the mobile hotspot, the FortiGate could successfully reach both 8.8.8.8 and usupdate.fortiguard.net, but execute vm-license still returned Failed to download VM license.I also ran:diagnose hardware sysinfo vm setupbut the license status remained:valid: 0status: 3code: 502Fortinet Customer Service confirmed that FortiOS 7.6.6 supports the Permanent Trial license and that there is no issue with the Evaluation license activation or registration on the Fort

Hello Team,can anyone help me with dial up vpn configuration with PKI user.It is working fine with radius user but the requirement is for internal users vpn should be connected with certificate instead of username and password. any step by step configuration guide and troubleshooting links would be helpful

Hi I am trying to install my FortiClient but I am getting this error. I have had it installed before but then I had to uninstall it due to issues.   

Hey guys, Am facing issue with one of my fortigate device. The config status is shown as conflict. After a commit. The changes are reflected in the device level. Also once am trying to retrieve the config it is stuck. Does anyone had this issue before FMG version : v7.4.9Fortigate version : v7.4.7

Download links for FortiClient EMS invitations are not working because the filename in the invitation are Initial Cap, while the filenames are all lower case. Running version 7.4.8. This was working up to yesterday.

Is there a way to restrict vpn traffic from my external ip to IP that vpn would connect to using fortigate?

 Hi,I am troubleshooting an N+1 synchronization issue on FortiWLC 8.6-5build-8.The N+1 status currently shows Healthy, but configuration changes are not being synchronized to the secondary.I found the following error in the primary controller logs:Oct 1 2026 11:30:59 <controllername> nplus1_Primary:ERROR: Error: Ignored (/opt/meru/np1/scripts/np1-files)(np1sync_files.tgz) in middle of making sync package.I would like to understand exactly what this error means.In particular: Why is np1sync_files.tgz being ignored while the N+1 sync package is being created? Is /opt/meru/np1/scripts/np1-files a normal FortiWLC N+1 directory? Is np1sync_files.tgz a temporary file generated during the synchronization process? Could this "Ignored" message cause the N+1 configuration synchronization to fail? Is there a supported way to access or inspect /opt/meru/np1/scripts/np1-files on a FortiWLC controller? If shell/SSH access is available, what account or method should be used to inspect

Description   This article describes how to use FortiAuthenticator as a TACACS+ server for Cisco and clear pass remote user authorization. FortiAuthenticator can perform central authentication as a TACACS+ Server and authorize which commands are allowed or not on Cisco Switches.    Scope   Specific remote users on FortiAuthenticator should be able to authenticate and access the switch by matching the different authorization rules. The full configuration on the Cisco Switch side is not covered in this article. For more information, consult Cisco support.   Solution   FortiAuthenticator Configuration example for Cisco Switch:   Create TACACS+ Service Go to TACACS+ Service -> Authorization and select Services on the Top Right. Create a new service with: Name: <Whatever name>. Service: <service name>. Default permission for attributes: Allow. Select the newly created service and select 'Add Attribute'.   Add the following: Att

DescriptionThis article describes how to troubleshoot a FortiNAC system reported as unstable, where attempts to generate a log snapshot fail and further investigation shows that the /storage filesystem is nearly full.ScopeFortiNAC.SolutionIn the investigated case, the initial complaint was instability. During troubleshooting, multiple symptoms were observed, including:GUI/system behavior suggesting instability.Errors while trying to generate a log snapshot.Operational errors such as interface resynchronization failure./storage utilization reported at 98% in the GUI.Confirm the symptom from the GUI:Enter the FortiNAC shell and check the file system utilization:execute enter-shell df -hTIdentify top 20 largest directories under /storage:du -xh /storage --max-depth=1 | sort -rh | head -20After, drill down to the directory which is consuming more space:du -xh /storage/bsc --max-depth=1 | sort -rh | head -20 du -xh /storage/bsc/campusMgrUpdates --max-depth=1 | sort -rh | head -20 du -xh /st

Description This article describes how to configure a remote user IPsec VPN using IKEv2 with StrongSwan on a Linux system (Ubuntu 24.04). It also outlines the necessary steps to troubleshoot standard connectivity and traffic flow issues that may arise during the setup. Scope FortiGate v7.4.x. Solution Here is a sample of a standard configuration on the FortiGate :   config vpn ipsec phase1-interface    edit "strongSwan"        set interface "wan1"        set ike-version 2        set peertype any        set net-device disable        set mode-cfg enable        set ipv4-start-ip 10.10.10.10        set ipv4-end-ip 10.10.10.100        set ipv4-netmask 255.255.255.0        set ipv4-split-include "strongSwan_split"        set proposal aes256-sha256      &n

DescriptionThis article describes how to troubleshoot a RADIUS Virtual Server that cannot be deleted from the FortiNAC GUI.ScopeFortiNAC.SolutionThis article describes how to troubleshoot a RADIUS Virtual Server in FortiNAC that cannot be deleted from the GUI.When attempting to delete the affected Virtual Server, the GUI may return "Server Error: 500 OK" and the browser Developer Tools may show an exception similar to "org.hibernate.exception.ConstraintViolationException".Identify the affected server from the database:SELECT ID,name,type,tlsServiceConfiguration,LAST_MODIFIED_BY,LAST_MODIFIED_DATE FROM bsc.RadiusServerConfig WHERE name = 'Radius_wired'; +----+--------------+------+-------------------------+------------------+---------------------+ | ID | name | type | tlsServiceConfiguration | LAST_MODIFIED_BY | LAST_MODIFIED_DATE | +----+--------------+------+-------------------------+------------------+---------------------+ | 3 | Radius_wired | 1 | NULL

Description This article describes how to make an Automation stitch that monitors and adds remote IP addresses associated with failed IPsec logins to a permanent block list. Scope FortiGate, IPsec. Solution There are scenarios where a bad actor wants to brute-force an IPsec VPN over the default ports of IKE (500 and 4500 UDP ports). The FortiGate and the IKE protocol have their own methods to protect against a bad actor attempting to connect or perform a brute-force attack. However, there will be a lot of logs generated by failed attempts, leading to false positives when trying to troubleshoot an issue of IPsec communication, or generating logs that could delay proper troubleshooting.   Important Note: This guide is meant to block the first failed attempt, meaning that if a user fails to log in because of wrong credentials one time, the public IP used for connection from that user will be permanently blocked until the administrator of the FortiGate manually goes to the add

DescriptionThis article describes the best practices that need to be followed when upgrading FortiSandbox devices in a high availability cluster.ScopeFortiSandbox.SolutionStep 1: Understand the order of upgrade execution.Follow/understand the order of upgrade execution as outlined in this document: upgrading-or-rebooting-a-cluster.Step 2: Upgrade preparation.Verify the upgrade path from OS release notes.Ref: https://docs.fortinet.com/document/FortiSandbox/Backup configuration files.Verify HA cluster status prior to the upgrade.Download target OS images from support portal.Step 3: Upgrading the FortiSandbox nodes.In this article, upgrading cluster nodes is performed through the primary unit's Cluster Management page.Navigate to the primary unit's Cluster Management tab.Upload an OS image on one of the worker nodes to upgrade that particular node.Proceed with upgrading the remaining worker nodes.If worker nodes are of the same model, and if scan load is relatively low, all worker nodes c

DescriptionThis article describes a FortiClient installer download failure associated with spaces in the installer package name and provides a workaround with examples.ScopeFortiClient EMS 7.4.8 and FortiClient EMS Cloud.SolutionA space in the installer package name may cause the executable download to fail, even when the package directory is accessible and lists the installer files.Example 1: Package name containing a space:For the package named fct 7.4, the directory listing displays the executable forticlientsetup_7.4.8_x64.exe. However, selecting the executable returns the following error:Not FoundThe requested resource was not found on this server.Example download path:/installers/default/fct%207.4/forticlientsetup_7.4.8_x64.exeThe %20 sequence represents the space in the package name. The directory listing shows that the file is present, but does not confirm that its download will succeed.Example 2: Package name without spaces:For the package named 7.4.8, selecting the executable

DescriptionThis article describes how to troubleshoot a FortiNAC RADIUS service startup failure caused by multiple DefaultConfig entries in the RadiusServerConfig database table.Scope FortiNAC.SolutionThe RADIUS service may fail to start with an error similar to:/etc/raddb/radiusd.conf[89]: Duplicate home server name DefaultConfig radius.service: Failed with result 'exit-code' Failed to start fortinac system radius serverThe condition occurs when more than one RadiusServerConfig object named DefaultConfig exists and FortiNAC generates multiple FreeRADIUS home_server definitions with the same name.In the affected environment, seven DefaultConfig entries were present.Identify all DefaultConfig records:SELECT ID, name, type, tlsServiceConfiguration, LAST_MODIFIED_BY, LAST_MODIFIED_DATE FROM bsc.RadiusServerConfig WHERE name = 'DefaultConfig' ORDER BY LAST_MODIFIED_DATE;In the affected environment, the following records were found:| ID | Name | TLS S

DescriptionThis article describes how a FortiGate device can be added as Model device on FortiAnalyzer using the API.ScopeFortiAnalyzer /  FortiAnalyzer-VM.SolutionModel device support for central logging on FortiAnalyzer has been implemented as of FortiAnalyzer version 7.0.See Model device support for central logging for instructions on how to add from the GUI directly. Use the following API call to add a Model FortiGate device on FortiAnalyzer:"method": "exec", "params": [ { "data": { "add-dev-list": [ { "name": "FortiGate", "platform_str": "FortiGate-VM64-KVM", "device action": "add_model", "os_ver": 7, "mr": 4, "mgmt_mode": 3, "sn": "FGVM01TM00000000", "adm_usr": "admin", "faz.perm": 15, } ], "adom": "root" }, "url": "/dvm/cmd/add/dev-list" } ], "session": "xxxxxxxxxxxxxx", "id": 1 } Once the API call is sent, FortiAnalyzer will add the entry in GUI under Device Manager, but it will show as Down.FortiAnalyzer GUI:Configure the FortiGate with the FortiAnalyzer IP to let the FortiGat

DescriptionThis article describes an issue where FortiGate HA cluster members are not able to detect each other and join the HA cluster. In this scenario, one FortiGate may operate as the primary because it is unable to detect the peer, while the other unit can detect both members and shows the expected HA relationship.ScopeThis issue may occur in a FortiGate HA A-P cluster when HA heartbeat packets are not received by one of the cluster members.In the reported scenario:FortiGate-VM64-KVM is configured in HA A-P mode.HA heartbeat communication uses the default EtherType 0x8890.The secondary unit can see HA heartbeat traffic in both directions.The primary unit only sees HA heartbeat traffic being transmitted and does not receive the corresponding packets from the secondary.This results in the primary considering itself the only member of the cluster.SolutionVerify the HA status on both FortiGate units:Run the following command on both HA members:get system ha status HA Health Status: O

Hi, I’m having an issue where users are missing from groups synchronized with Entra ID. I can browse and import groups from Entra ID, but when I go to System > Groups > Remote Groups and select "Show members," the list is empty. I suspect a missing API permission, but I’ve checked everything and the configuration looks correct. Has anyone encountered this problem before?P.S. The connection to Intune is configured and working without issues.   

DescriptionThis article describes how to handle, under ClickHouse, the duplicate data part error.ScopeFortiSIEM.SolutionIf a 'DUPLICATE_DATA_PART' error occurs in ClickHouse, the service may be stopped.To review its status:systemctl status clickhouse-serverCheck the logs for details.Review the ClickHouse server logs to identify the specific parts causing the error. The logs are typically located at:grep -i duplicate /opt/clickhouse/log/clickhouse-server.log /opt/clickhouse/log/clickhouse-server.err.loggrep -i duplicate /opt/phoenix/log/phoenix.log /opt/glas*/dom*/dom*/logs/phoenix.logDetach or remove duplicate parts (if the service is running).If the logs indicate specific duplicate parts, it may be necessary to take action:Detach duplicate parts: This can be done using the following command:clickhouse-client -q "ALTER TABLE <table_name> DETACH PART '<part_name>';"Remove duplicate parts: If detaching does not resolve the issue, it may be necessary to drop the duplicate par

Hi Fortinet Team / Community,I am currently working on a FortiSIEM CMDB restore and am facing an issue where the FortiSIEM services do not come back up after completing the documented CMDB restore procedure and rebooting the Supervisor.I followed the procedure documented here:FortiSIEM 7.6.0 – Backing Up and Restoring DatabasesCMDB Restore Procedure FollowedI performed the following steps on the Supervisor:systemctl stop phxctlphtools -stop allWaited approximately 20 seconds and then executed:killall -9 javakillall -9 phMonitorI then copied the latest phoenixdb_<timestamp> backup to /tmp and executed:cd /opt/phoenix/deploymentdb_restore /tmp/phoenixdb_<timestamp>The restore process completed, after which I rebooted the Supervisor:rebootIssue After RebootAfter the system came back up, most of the FortiSIEM services are still showing as DOWN. For example:Only some supporting services such as phMonitor, Apache, Rsyslog, Redis, ClickHouseServer, etc. appear to be running.I have