Recently active topics

Hi All,Any idea how we can do the automate to extract ABLR report that uses diffrence Sets of Queries ?Which currently we do it manually with more than 35 types of queries.

DescriptionThis article describes how to troubleshoot FortiGate unable to ping FortiManager/FortiAnalyzer even the ping is allow.ScopeFortiManager and FortiAnalyzer.SolutionDevice information:FortiGate port1 = 10.47.6.72/20 ; port4 = 10.133.6.72/20.FortiAnalyzer port1 = 10.47.3.243/20 ; port3 = 10.133.3.243/20.Expected scenario:FortiGate port1 is able to ping FortiAnalyzer port1.FortiGate port4 is able to ping FortiAnalyzer port3.Issue scenario:FortiGate port1 is able to ping FortiAnalyzer port1.FortiGate port4 is unable to ping FortiAnalyzer port3.Check steps:In FortiAnalyzer, check that both port1 and port3 configurations are allowed to use the ping service.At FortiAnalyzer, check whether all Administrator Accounts are configured as Trusted Hosts. Solution steps:When in FortiManager/FortiAnalyzer, all Administrator Accounts are configured as Trusted Hosts, the FortiManager/FortiAnalyzer Administrative Access settings will be allowed based on the Trusted Host information.Therefore in

DescriptionThis article describes an issue that can occur where the FortiGate repeatedly shows the message 'Too many entries in all tables of 'casb.saas-application'' in the serial console after downgrading from FortiOS v8.0 to an older branch of firmware.ScopeFortiOS v8.0.SolutionAfter downgrading from FortiOS v8.0 to an older version (v7.6, v7.4, etc.), administrators may observe the FortiGate showing the following repeating output in the serial console: [...] <pid-162 /bin/cmdbsvr> Too many entries in all tables of 'casb.saas-application' in vdom root: 512 / vdom-max = 512 <pid-162 /bin/cmdbsvr> Too many entries in all tables of 'casb.saas-application' in vdom root: 512 / vdom-max = 512 <pid-162 /bin/cmdbsvr> Too many entries in all tables of 'casb.saas-application' in vdom root: 512 / vdom-max = 512 <pid-162 /bin/cmdbsvr> Too many entries in all tables of 'casb.saas-application' in vdom root: 512 / vdom-max = 512 <pid-162 /bin/cmdbsvr> Too many entries

DescriptionThis article describes the issue of the FortiClient Mac installer not working when Apple's Gatekeeper is set to 'App Store only'.ScopeFortiClient.SolutionWhen trying to deploy the FortiClient Mac installer via a Jamf Pro instance, the installer generated by FortiClient/EMS does not work in this context.To resolve the issue of the FortiClient Mac installer not working with Gatekeeper, follow these steps:Locate the FortiClient app in Finder (e.g., Downloads folder).'Right-click' (or 'Ctrl-click') the FortiClient app icon.Select Open from the context menu.A warning dialog will appear; select Open.This creates a specific exception for that specific application. After doing this once, FortiClient will open normally by double-clicking in the future.Alternatively, it is possible to try temporarily disabling Gatekeeper:Go to System Preferences -> Security & Privacy -> General.Select the lock icon and enter the password to make changes.Change the setting from App Store to A

DescriptionThis article describes a scenario where a FortiAP device is not providing service on any of its radios. The device has been removed and re-added, but the issue persists.ScopeFortiAP 443K, FortiGate.SolutionTo troubleshoot this issue, first ensure the FortiAP is being energized with the correct power supply. The FortiAP requires one of the following connections to provide service:Full mode = 1 connection 802.3bt on LAN1, or 2 connections 802.3at on LAN1 and LAN2.High mode = 1 connection 802.3at on LAN1, or 2 connections 802.3af on LAN1 and LAN2.Energize the FortiAP using the PoE injector provided in the box. Then, run the following commands on the FortiAP's CLI to check the status:fap-get-status cw_diag power rcfgThese commands will help determine if the radios have turned on after energizing the FortiAP correctly. Refer to the FortiAP™ Series Data Sheet for more information on the power requirements.

I have one FGT node in one data center and another node in a different data center. Currently, each one has its own management IP: 10.10.10.1 and 10.10.10.2.This is a deployment from scratch, so we are going to connect a cable between the HA ports of both nodes.My question is: I now need to configure an A-P HA cluster between the two nodes. However, in the past, when I enabled HA Reserved Management in an attempt to keep both management IPs independently accessible, I lost access to the firewalls through their management interfaces.What would be the correct steps to set up an A-P HA cluster between these two nodes without losing access to either of them through their respective management interfaces?

Currently, I have a FortiGate configured with two ISPs, with WAN1 as the primary connection and WAN2 as the secondary connection.For the LAN-to-Internet policy, I have a fixed IP pool NAT configured using the usable IP provided by WAN1. When I introduced an additional IP pool NAT on the LAN-to-Internet policies using the WAN2 Interface IP, users reported that they were unable to access the internet.After reverting the change and removing the WAN2 IP pool, internet connectivity was immediately restored for the users.My question would be:- What is the recommended NAT design for a FortiGate with DUAL ISP connectivity when an existing IP pool nat is already in use?- Are there known considerations or limitations when using fixed IP pool NAT address in a multi-WAN deployent?- Are there any FortiGate best practices for maintaining internet connectivity while introducing NAT rules in a dual ISP environment?

I have enabled pmtu-discovery as per instructions from this topic Dynamic MTU Configuration in SD-WAN Deplo... - Fortinet Community but MTU on the GRE tunnel remains 1476. I want it to be 1356 for this state when ipsec is off. one side of that mikrotik - fortigate link is discarding ldap traffic so domain users are unable to log into their computers because of problem in communication between computers and domain controllers... ldap traffic from windows 11 clients to domain controller on port tcp88 and vice-versa has DF bit set and traffic may not be fragmented..

DescriptionThis article describes an issue where, after upgrading FortiSwitch 108 to versions 7.6.6, 7.6.7, or 7.6.8, SSH access to the switch may fail.ScopeFortiSwitch 108 running versions 7.6.6, 7.6.7, or 7.6.8.SolutionWhile performing SSH to the FortiSwitch, the message below appears:host:~$ ssh admin@FortiSwitch IP admin@FortiSwitch IP's password: client_loop: send disconnect: Broken pipeWhile collecting sshd application debug, the following message appears on the FortiSwitch, and it fails at this point:SSH: send packet: type 51 SSH: receive packet: type 50 SSH: userauth-request for user ansible service ssh-connection method publickey SSH: attempt 1 failures 0In the FortiSwitch crash log, a constant crash of the sshd process can be seen70: 2026-06-08 21:16:12 the killed daemon is /bin/sshd: status=0x100 71: 2026-06-08 21:16:14 the killed daemon is /bin/sshd: status=0x100 72: 2026-06-08 21:16:16 the killed daemon is /bin/sshd: status=0x100 73: 2026-06-08 21:16:18 the killed daemon

DescriptionThis article describes the process for selecting an LDAP group when doing a firewall policy lookup.ScopeFortiGate.SolutionUnder 'Policy & Objects', select Firewall Policy -> Policy Match Tool. After filling the fields, select 'Remote server' and then select 'Browse':On the window that will be opened, select 'Groups' and then press the right button of the mouse and choose the option '+ Add Selected -> OK, as shown below:After selecting the LDAP group, it will be shown as below:In this way, it is possible to perform a firewall policy lookup for a specific LDAP group.CLI equivalent (enhanced lookup).Use the extended diagnose command for identity-based matching (available when more than the basic 6 parameters are supplied):diagnose firewall iprope lookup <src_ip> <src_port> <dst_ip> <dst_port> <protocol> <device> <policy_type> [<auth_type>] [<user/group>] [<server>]Example (group-based):diagnose firewall iprop

DescriptionThis article describes how to resolve the 'entry not found in datasource' error when adding FortiSwitch ports to a manual trunk.ScopeFortiSwitch.SolutionWhen two FortiSwitches are directly connected, an ISL trunk is automatically created between the connected ports by default.For example, the following auto-ISL trunk uses port3 and port4:config switch trunk edit "8DVQY7RFQH946-0" set mode lacp-active set auto-isl 1 set members "port3" "port4" next endWhen attempting to use the same ports in a manually configured trunk:config switch trunk edit "AE22" set mode lacp-active set members "port3" "port4"The configuration fails with the following error:entry not found in datasource value parse error before 'port3' Command fail. Return code -3This occurs because port3 and port4 are already members of the auto-ISL trunk.Deleting the auto-ISL trunk while the FortiSwitches remain connected may not be sufficient, as the auto-ISL trunk

DescriptionThis article explains why a FortiNAC HA node in a 'Running - Not In Control' state fails to respond to RADIUS or Persistent Agent traffic, despite having the necessary allowaccess settings. The allowaccess list functions as a FortiNAC-OS host ACL that remains unchanged by the HA role. Because these services only run on the primary node, the ports are open but lack active listeners. Moreover, even if these services are enabled manually, they are automatically removed from the interface of the secondary node.ScopeFortiNAC-F / FortiNAC-OS v7.2 and greater, in a primary/secondary High Availability configuration (Layer 2 and Layer 3).FortiNAC-OS appliances (FNC-CAX-xx), where inbound service access is controlled with set allowaccess.Applies to RADIUS authentication and accounting, Persistent Agent communication.SolutionSymptoms:The node in control authenticates endpoints normally. Against the other node:A switch or wireless controller marks the secondary FortiNAC RADIUS server de

DescriptionThis article describes how to investigate a '403 domain fronting blocked' error that occurs when accessing a website.ScopeFortiSASE.SolutionIn the browser, press F12 to open network inspection tools before accessing the website, then reproduce the issue.Inspect which port number is used when accessing the website. When accessing an HTTPS website, it should show port 443.Port 9443 is the FortiSASE proxy default port. When using the proxy service, it is not possible to connect to the SIA tunnel at the same time.The issue can be resolved by disabling the proxy settings on the endpoint machine and use only SIA tunnel for connection.Root cause: The Server Name Indication (SNI) is changed by the FortiSASE proxy service, and when the traffic reaches FortiSASE via the SIA tunnel, it is denied.The FortiSASE proxy and the SIA tunnel should not be used at the same time.

DescriptionThis article explains the circumstances in which remote LDAP administrators on FortiGate may bypass two-factor authentication (2FA) requirements, as well as possible solutions.ScopeFortiOS.SolutionFortiGate offers the option of adding a second factor to user and administrator authenticator for additional security, and is generally recommended for increased security.However, under specific circumstances it may be possible to bypass second factor requirements for LDAP users or administrators on FortiGate.Details on bypassing two-factor authentication for remote LDAP users, and how to resolve it, may be found here:Technical Tip: Description of CVE-2020-12812 (bypassing two-factor authentication for LDAP users) and remediation optionsFor LDAP administrators, the following conditions have to be met for a bypass to be possible:A remote LDAP administrator exists on FortiGate and is linked to a two-factor authentication method.A remote wildcard administrator account exists on FortiG

DescriptionThis article describes the cause of SCEP decryption failures on FortiAuthenticator when receiving enrollment requests encrypted with aes-256-cbc from certain third-party devices.ScopeFortiAuthenticator, FortiManager, FortiGate.SolutionWhen a third-party device uses aes-256-cbc encryption for SCEP enrollment requests, FortiAuthenticator may fail to decrypt the PKCS#7 enveloped data. This results in a decryption failure during the SCEP process.Root cause:The issue is caused by a compatibility problem in how FortiAuthenticator handles SCEP requests encrypted with aes-256-cbc.While other encryption methods like des-ede3-cbc work correctly, requests using aes-256-cbc trigger a decryption error in the SCEP daemon.Symptoms:The following error messages appear in the FortiAuthenticator debug logs:PKCS7 message encrypted with aes-256-cbc (427) utils.cpp:386: decryption failed mo_pkcs7unwrap.cpp:526: cannot decrypt PKCS#7 enveloped data error:1C800064:Provider routines:ossl_cipher_unpa

DescriptionThis article describes the reason why, on FortiAuthenticator 6.6.10, exporting an intermediate CA certificate with its private key in PKCS#12 format fails with the error 'Cannot export PKCS#12 certificate'.ScopeFortiAuthenticator 6.6.10.SolutionThe issue occurs when an intermediate CA is created using a root CA that is hosted on the FortiAuthenticator. When attempting to export the intermediate CA together with its private key and a password in PKCS#12 format, the export fails.Cannot export PKCS#12 certificate: failed to extract enum CertificateOrPKCS12Certificate ('Certificate | PKCS12Certificate') - variant Certificate (Certificate): TypeError: failed to extract field CertificateOrPKCS12Certificate::Certificate.0, caused by TypeError: 'X509' object is not an instance of 'Certificate' - variant PKCS12Certificate (PKCS12Certificate): TypeError: failed to extract field CertificateOrPKCS12Certificate::PKCS12Certificate.0, caused by TypeError: 'X509' object is not an instance o

DescriptionThis article describes how to deploy a FortiGate Active-Passive High Availability cluster in Amazon Web Services using three Elastic Network Interfaces per instance by combining HA synchronization and HA management functions.ScopeFortiGate AWS/Azure 7.0.1+.SolutionStarting with FortiOS v7.0.1, the High Availability (HA) heartbeat/synchronization and HA management functions can share the same interface. This allows a deployment to use three Elastic Network Interfaces (ENIs) instead of four.Recommended interface design:ENI 1: External/WAN.ENI 2: Internal/LAN.ENI 3: HA synchronization/heartbeat and HA management.Configuration steps:Update the HA configuration on both FortiGate units to ensure the HA sync and HA management use the same interface.Allow HTTPS access to the HA sync interface to enable management connectivity.Re-associate the Elastic IP (EIP) with the HA sync ENI, as this interface now serves as the HA management interface.Ensure the HA sync subnet has Internet conn

Can we query fortinac license usage using snmp? I need historical license consumption every hours.

DescriptionThis article describes how to troubleshoot when an import configuration causes a security profile configuration conflict with another FortiGate.ScopeFortiManager and FortiGate.SolutionScenario:Both FortiGateA and FortiGateB use the same Web Filter Security Profile name (Example: TestWebFilter Web Filter Security Profile)FortiGateA's TestWebFilter Web Filter Security Profile is configured to block Games, monitor Shopping.FortiGateB's TestWebFilter Web Filter Security Profile is configured to block Shopping, monitor Games.When performing Import Configuration for FortiGateA at FortiManager, then inside FortiManager's TestWebFilter, the Web Filter Security Profile will be updated to block Games, monitor Shopping.Afterwards, perform policy package installation for FortiGateB; the install preview will show TestWebFilter Web Filter Security Profile as block Games, monitor Shopping.If performing the Import Configuration for FortiGateB at FortiManager now, then inside FortiManager's

DescriptionThis article explains how to resolve VPN access failures and frequent connection drops on Windows 11 machines caused by software incompatibility.ScopeFortiGate, FortiClient/EMS.SolutionVPN access failure on Windows 11 often occurs when the Windows Program Compatibility Assistant blocks an outdated version of FortiClient from running.This results in compatibility warnings and unstable connections. Verify the current versions of FortiGate and FortiClient.Check the Fortinet Product Lifecycle to ensure the FortiGate version is still supported.Consult the FortiClient EMS Compatibility Matrix to identify a FortiClient version supported on Windows 11.Upgrade FortiClient to a version compatible with Windows 11.Upgrade FortiGate to a supported FortiOS release.Related document:Troubleshooting Tip: A new Windows 11 device gets stuck connecting to FortiClient

DescriptionThis article describes how to troubleshoot when FortiManager is unable to create a FortiAP K series operation profile, even though FortiManager is compatible with FortiAP K series.ScopeFortiManager and FortiGate.SolutionIn FortiManager, run the following CLI command to check compatibility between FortiManager and FortiAP Models:  diagnose dvm supported-platforms listThe results show that FortiManager is compatible with the FortiAP 231K model, however, FortiManager is unable to create an Operation Profile.This is because the results show that FortiManager is compatible with FortiAP 231K model for version 7.4, but not version 7.2.Therefore, FortiManager ADOM version 7.2 will not able to create an Operation Profile for FortiAP 231K.To create an Operation Profile for FortiAP 231K, use FortiManager ADOM version 7.4.

We are observing an issue with FortiClient authentication where the expected “Wrong Password/Invalid Credentials” popup is not displayed when an incorrect password is entered.The issue is a for both local and remote users,Kindly assist us in troubleshooting this issue and identifying the root cause.