Recently active topics

DescriptionFortiAP CAPWAP AP-leave/join behavior with reason "AP DTLS peer disconnected".ScopeAffected products and versions:FortiAP 7.6.4FortiGate 7.4.11A FortiAP managed on the FortiGate FirewallSolutionThis particular type of FortiAP CAPWAP AP-leave/join error, "AP DTLS peer disconnected" with message "CWWE_DC_DEAD_INTERVAL_EXPIRE(103) new DTLS_TD(13)" typically occurs when the FortiAP does not get a CAPWAP Keepalive response from the uplink Network (Switch/FortiGate):date=2026-03-03 time=14:47:30 eventtime=177252944964231XXXX tz="+0530" logid="010404XXXX" type="event" subtype="wireless" level="notice" vd="root" logdesc="Physical AP leave" sn="FP231FTF2300XXXX" ap="AP01" profile="231F" ip=172.16.104.53 meshmode="mesh root ap" snmeshparent="N/A" action="ap-leave" reason="AP DTLS peer disconnected" msg="AP AP01 left." 1661.713 AC0,1 FSM0:old RUN(22) ev CWWE_DC_DEAD_INTERVAL_EXPIRE(103) new DTLS_TD(13)To identify if the cause of the CAPWAP re-join issue is related to the FortiAP, Fort

DescriptionConnections to ZTNA destinations over RDP or HTTP take 10 to 20 seconds when IPv6 is enabled on the network adapter of a Windows endpoint running FortiClient. This article describes the symptoms, the cause, and the workarounds.ScopeFortiClient 7.4.7 and 7.4.9 for Windows with ZTNA enabled, managed by FortiClient EMS, connecting to FQDN-based destinations through a FortiGate ZTNA access proxy.SolutionSymptomsConnection delay: connecting to a ZTNA destination over RDP or HTTP takes 10 to 20 seconds.DNS behavior: nslookup for the ZTNA destination FQDN times out or returns a non-existent domain response.IPv6 dependency: disabling IPv6 on the network adapter of the endpoint reduces the connection time to approximately 1 second.Unaffected destinations: destinations configured with literal IP addresses do not trigger a DNS lookup and are not affected.CauseFortiClient intercepts ZTNA traffic for FQDN-based destinations through a DNS proxy. An IPv6 DNS server bypasses this proxy, so

DescriptionAn issue where an delivered to the Office 365 network from FortiMail is rejected with the error "TenantInboundAttribution".ScopeFortiMail.SolutionIn Office 365, you can use connectors to enforce certain restrictions. For example: you can allow/reject incoming connections based on the Subject Names of the certificate presented or restrict simply based on the source IP. If there is any sort of mismatch between what you have configured in the connector and real incoming connection, email delivery might fail.One possible error you might receive is attached here for reference:550 5.7.51 TenantInboundAttribution; Rejecting. Recipient has a partner connector with RestrictDomainsToIPAddresses or RestrictDomainsToCertificate set. Connector ID: 8e8cc23d-42bb-4dac-be93-c6886e.If this issue suddenly occurs after email delivery has otherwise been working as expected, there are two likely reasons:The Inbound Partner Connector on Office 365 has a security restriction which is rejecting con

Hello,I found strange issue with FAC in Azure (from marketplace).When I am trying to do a rollback, using disks created from snapshots (OS and Date), FAC VM doesn’t start.There is an error:“Failed to start virtual machine 'fac-vm-azure'. Error: Creating a virtual machine from a non-Marketplace image does not need Plan information. Please remove the Plan information from VM”And there is no way to fix it (I tried many ways suggested by Copilot etc.).What is the solution for creating a backup (and successful rollback) for FAC in Azure ?Regards,Krzysztof

DescriptionMultiple VLANs trunking (set vids) feature limitation for the LAN Extension mode on the FortiExtender-200F model.ScopeFortiExtender-200F 7.6.5.FortiGate-100F 7.6.6.A FortiExtender managed on the FortiGate Firewall in the LAN Extension modeSolutionAll FortiExtender models support VLAN tagging, but only certain models allow VLAN trunking on the FortiExtender downlink ports, which can only be set up through the FortiOS CLI.Therefore, as shown in the config snippet below, under "config downlinks", the "vids" command option is not available to configure the VLANs for the FortiExtender-200F model:config extension-controller extender-profile edit "FX200F" set id 0 set model FX200F set extension lan-extension set allowaccess ping https ssh config lan-extension config downlinks edit <Trunk Name> set type port set port port5 set pvid 1

DescriptionDHCP IP address assignment failure only on specific VLANs 97 and 98 on a Bridge mode SSID on the FortiAP-221E model.ScopeFortiAP-221E 7.4.6, FortiGate 7.6.6.SolutionVLAN 97 and 98 are reserved for Internet use on the FortiAP-W2 models. Therefore, do not use those VLAN IDs in the FortiAP management VLAN, SSID static VLAN, and dynamically assigned VLAN. Refer to Reserved VLAN IDs.Since the FortiAP-221E is now a legacy model, and this behavior is as per the design and is expected on the E series FortiAP models, there are currently no plans to modify this functionality on this model. To move forward, consider either:Using alternative VLAN IDs instead of 97 and 98, or:Upgrading to a newer FortiAP model, as the current F, G, and K series FortiAPs support these VLAN IDs.

Dear Mate, what  npu-offload and what is use case to use  npu-offload in forti SDWAN. Thanks

I am trying to configure my Fortigate 60E using the Ansible ForiOS Galaxy plugins. Currently I am working on the vip configuration. For most of the vips it is working fine but I can't get the ssl vip to work.I would like to set up a ssl vip of type server-load-balancer like this:- name: "Configure {{ vdom }} vdom virtual IP for IPv4" fortios_firewall_vip: vdom: "{{ vdom }}" state: "{{ state }}" access_token: "{{ token }}" firewall_vip: name: "vip_ssl_placeholder" extintf: "management" extip: "10.10.10.1" extport: "6363" type: "server-load-balance" server_type: "ssl" monitor: - name: "tcp-6363-link-monitor" ldb_method: "least-rtt" persistence: "ssl-session-id" realservers: - id: "1" ip: "10.16.10.1" port: "6363" - id: "2" ip: "10.16.10.2" port: "6363" ssl_mode: "full" ssl_certificate: "Fortinet_Factory"However, when applying the script I get an error -56 from the Fortigat

Hi,can someone explain to me what the FortiAuthenticator-VMS-DR license (HA/DR/Load Balancing node license for FortiAuthenticator VM Subscription, with FortiCare Elite Support) is used for?It is not listed in the Ordering guide. If I understand it correctly, does this license allow for the deployment of a cluster (a second unit)?Zhank you

DescriptionHow to block Anthropic's Claude web chat feature while allowing other features, such as Code CLI, when FortiGate is running as an explicit proxy. In addition, it is possible to allow only the Chat feature via the Desktop App while blocking the web chat, which is also described in this article.ScopeFortiGate configured with the explicit proxy feature.SolutionAnthropic's Claude can be accessed using multiple clients, such as the Claude.ai web interface, the Claude Desktop App, and developer-oriented tools such as Claude Code CLI. If the security requirement for an organization is to allow programmatic API Access, while blocking the consumer-grade channels, this can be achieved on FortiGate by following these steps:Create a proxy address for .claude.ai:config firewall proxy-address edit ".claude.ai" set type host-regex set host-regex ".*claude\\.ai" next endUse a RegEx pattern to scope the block to the chat conversation path only.config firewall proxy-address edit "claude-chat"

DescriptionHow to troubleshoot a FortiGuard update failure where package downloads succeed, but the installation stage fails because of underlying disk I/O and filesystem errors on /dev/sda.In this scenario, FortiGuard communication can be operational and update packages can be downloaded successfully. However, the downloaded package cannot be installed because the FortiGate is experiencing I/O errors affecting the system disk.The key indicators are kernel messages similar to:print_req_error: I/O error, dev sda, sector 1 Buffer I/O error on dev sda1, logical block 0, async page read EXT2-fs (sda3): previous I/O error to superblock detected EXT2-fs (sda2): previous I/O error to superblock detectedThese errors can be observed in the console, COMLog, system event logs, or crashlog.ScopeAffects:FortiGate.FortiOS.FortiGuard update failures associated with disk or filesystem errors.SolutionSymptomsThe FortiGate may experience one or more of the following symptoms:FortiGuard IPS, AV, Applicat

I am new to the fortisiema & fortisoar , please help me and share the full guidelines how to cover these area and as a technically how can i achieve all of these please someone share the full guideline with me to help me to cover the fortisiem and fortisoar 

Description This article describes how to use a TCL script in FortiManager to fetch the MAC address of all physical interfaces of FortiGate(s). Scope FortiManager, FortiGate. Solution Follow the initial steps from this article on how to enable and run TCL scripts in FortiManager: Technical Tip: How to use TCL script...existing route   Go to Device Manager -> Scripts, select type TCL Script, and select 'Create new'.Create the following TCL script: #!proc do_cmd {cmd} {puts [exec "$cmd\n" "# "]}## Execute command to get system status#set status [exec "get system status\n" "# " 15]## Check if VDOM is disabled#if {[regexp {Virtual domain configuration: disable} $status]} {set vdom_enabled false} else {set vdom_enabled true}## Enter Global if VDOM enabled#if {$vdom_enabled} {do_cmd "config global"}## Getting the names of all interfaces#foreach line2 [split [exec "show system interface\n" "# "] \n] {#if {[regexp {edit[ ]+"(\w+)"} $line2 match2 intf2]} {continue## Che

DescriptionWhen the session count on the FortiGate is not high, but softirq is high and contributes to HA port flapping:The HA port flapping causes HA role flap, and results in MAC address flapping on the upstream and downstream switch that connects to it.This issue occurred on an HA cluster that has session synchronization across the members.Note:There could be other factors that could cause high usage of softIRQ on the FortiGate, and initial troubleshooting should be done to determine what could have caused the high softIRQ:Technical Tip: Understanding and analyzing high SoftIRQCommon factors that cause high softirq:Layer 2 loopingBroadcast stormDoS/DDoS attackHigh volumes of denied traffic or asymmetric routingExcessive traffic volume and high session setup ratesScopeFortiOS versions below 7.6.8.SolutionIn this article, the HA flap was a result of a chain of incidents that is being illustrated below:Endhost creates multiple connections with a set of target servers at a short interva

DescriptionMachine Learning training fails to establish a baseline and displays a Training on Hold status following an upgrade from FortiNDR version 7.4.10 to 7.6.4.ScopeFortiNDR.SolutionSymptomsAfter upgrading FortiNDR from version 7.4.10 to 7.6.4, the following issues occur:The ML training status displays "Training on Hold (no active sensor in this sensor group...)".The completion time for ML training is incorrect.Sensors may appear to be removed from the ML training group.Database errors are present in the system logs.Root CauseDuring the upgrade from version 7.4.10, a SQL statement execution error occurs. This prevents subsequent SQL statements from executing, which results in the ML baseline and training data not being migrated or created correctly. Consequently, the system cannot establish a baseline even though ML training is automatically triggered after the upgrade. ResolutionTo resolve this issue and ensure a successful upgrade, follow these steps:While the system is still ru

Description A list of the time zones and time zone IDs available on FortiSwitch and an explanation of how to manually configure the time zone, date, and time through the FortiSwitch CLI.ScopeFortiSwitch.SolutionList of Available Time ZonesThe following time zones are available for configuration on FortiSwitch:ID Timezone 00 (GMT+12:00) Eniwetok, Kwajalein 01 (GMT-11:00) Midway Island, Samoa 02 (GMT-10:00) Hawaii 03 (GMT-9:00) Alaska 04 (GMT-8:00) Pacific Time (US & Canada) 05 (GMT-7:00) Arizona 06 (GMT-7:00) Mountain Time (US & Canada) 07 (GMT-6:00) Central America 08 (GMT-6:00) Central Time (US & Canada) 09 (GMT-6:00) Mexico City 10 (GMT-6:00) Saskatchewan 11 (GMT-5:00) Bogota, Lima, Quito 12 (GMT-5:00) Eastern Time (US & Canada) 13 (GMT-5:00) Indiana (East) 14 (GMT-4:00) Atlantic Time (Canada) 15 (GMT-4:00) La Paz 16 (GMT-4:00) Santiago 17

DescriptionZip file downloads are blocked on FortiGate version 8.0.0 when the Antivirus profile is configured in Proxy mode and uses stream scan.ScopeFortiGate.SolutionSymptoms.Zip file downloads are blocked when the following conditions are met:• The FortiGate runs version 8.0.0.• The Antivirus profile is configured in Proxy mode.• The scan mode is set to stream scan (default setting).Root cause.Bug ID 1260804 in FortiGate version 8.0.0 causes ZIP file downloads to be blocked when the Antivirus profile uses stream scan in Proxy mode.Resolution.Option 1: Upgrade FortiGate.Upgrade the FortiGate to version 8.0.1 or later to resolve this issue.Resolved Issues 8.0.1Option 2: Workaround.Change the Antivirus scan mode from stream scan to legacy scan if an upgrade is not immediately possible.Open the Command Line Interface (CLI).Run the following commands to change the scan mode to legacy:config antivirus profile edit <antivirus-profile-name> set scan-mode legacy next en

DescriptionWhen a firewall policy runs flow-based inspection with Deep SSL Inspection and an IPS sensor, an HTTPS application can intermittently fail mid-session.Scope FortiOS 7.6.7.SolutionSymptomsUsers may experience intermittent failures when loading or submitting content on specific websites, resulting in a blank page.The browser may report net::ERR_SSL_PROTOCOL_ERROR, with the failed request showing:Status = 0No HTTP versionNo server IP addressNo response bytes receivedFortiGate SSL inspection logs indicate that the affected sessions are otherwise processed successfully, including:action="accept" and utmaction="allow"Successful SSL/TLS handshake completion (handshake-done)mitm="yes" indicating successful deep inspectionA valid server certificateIn some cases, traffic flows terminate with action="client-rst" while utmaction="allow" remains unchanged.IPS debugging shows that the corresponding session is finalized (ips_tcp_layer_fini) during an idle period. When the client subsequent

DescriptionCustom signatures that can help block Node.js Vulnerability (CVE-2026-106072) on FortiWeb.ScopeFortiWeb.SolutionThis vulnerability affects Node.js 26.x, 24.x, and 22.x.The severity level of this Vulnerability is considered Medium.To do this, create a custom signature:Navigate to the CLI of FortiWeb and run the following commands sequentially: config waf custom-protection-rule edit "CVE-2026-106072" set action alert_deny config meet-condition edit 1 set request-target REQUEST_HEADERS REQUEST_COOKIES ARGS_VALUE REQUEST_RAW_BODY set expression "\\b0x[0-f]{2}(\\.\\d{1,3}){3}\\b" next end next end config waf custom-protection-group edit "node" config type-list edit 1 set custom-protection-rule CVE-2026-106072 next end end This Vulnerability is still under investigation; updates can be checked in this article:Node2Shell CVEs

DescriptionCertain fields are missing from Antivirus logs (Message ID 8195) when the HTTP Content-Type is multipart/form-data and proxy-based inspection is used.ScopeFortiGate.SolutionSymptoms.When using proxy-based inspection for HTTP or HTTPS traffic with a multipart/form-dataContent-Type, the Antivirus logs (Message ID 8195 for monitored actions and Message ID 8194 for blocked actions) do not contain the following fields:agent.httpmethod.referralurl.This issue only affects the log information and does not impact the actual Antivirus detection, monitoring, blocking, or traffic flow.Root cause.Bug ID 1281140 (Resolved issues) in FortiOS causes these specific fields to be omitted from the log output when the traffic is processed using proxy-based inspection and contains multipart form data.Resolution.Affected versions:FortiOS version 7.6.6.FortiOS version 8.0.0.Resolved versions:FortiOS version 7.6.7.FortiOS version 8.0.1.Resolved issues 8.0.1Resolved issues 7.6.7Upgrade the FortiGate

DescriptionThis article describes a known issue where SSH Deep Scan cannot be successfully configured in the SSL/SSH inspection profile.ScopeFortiGate low-end models.SolutionOn certain entry-level FortiGate models (such as 40F, 50G, 60F, and 60E) with 2 GB of memory, after upgrading FortiOS from versions 7.4.8 to 7.4.10 or 7.4.11, an unexpected behavior is observed where the SSH Deep Scan option under the SSL/SSH inspection profile is no longer retained or cannot be enabled. When attempting to enable it, the feature appears enabled; however, after returning to the same screen, the feature remains disabled. Additionally, the related CLI commands are no longer available, even though the option is still displayed in the GUI. When attempting to enable the feature through the CLI, the command cannot be found, as shown below.FGR60F-2 # config firewall ssl-ssh-profile FGR60F-2 (ssl-ssh-profile) # edit dip-certificate-inspection new entry 'dip-certificate-inspection' added FGR60F-2 (dip-certif

DescriptionThis article describes how to resolve the failure of a FortiClient IPsec IKEv2 remote access VPN connection that uses SAML authentication with FortiIdentity, where the SAML login succeeds but the FortiGate denies the user with the message 'Failed SAML cache group matching'.ScopeFortiGate, FortiIdentity.SolutionSymptoms.When connecting with FortiClient to a FortiGate IPsec IKEv2 remote access VPN that uses SAML authentication with FortiIdentity, the SAML login completes successfully in the browser, but the tunnel is not established. FortiClient reports an authentication failure. FortiIdentity returns StatusCode: Success, and the FortiGate debug output shows that the SAML assertion is accepted, but the user is denied during group matching:fnbamd_saml_auth_cache_lookup-Authentication passed. fnbam_user_auth_group_match-req id: ..., server: FortiIdentity, local auth: 0, dn match: 0 __group_match-Check if FortiIdentity is a group member handle_req-Failed SAML cache group matching

Which is the latest FortiOS version that still supports SSL VPN?

I have a Role Access Matrix containing over 30 roles and 40 resources. I would like to use this matrix to monitor user activity and identify instances where a particular role accesses a resource that it is not authorized to access.Instead of creating separate rules for every role-resource combination, I would like to create a centralized repository or lookup table containing the authorized role-to-resource mappings. During rule evaluation, the SIEM rule should reference this repository and trigger an alert whenever the observed Role + Resource combination does not exist in the authorized access matrix.Example logic:Observed Role + Resource → Check Role Access Repository → Authorized = Allow / Unauthorized = Trigger IncidentHow can I create and maintain such a repository in FortiSIEM, and how can I reference it dynamically when creating the correlation rule?

Does anyone else experiences issues with login into customersso portal ( https://customersso1.fortinet.com/saml-idp/ ) when trying to access anything that requires authentication with it?I dont get the the push notification in the mobile app and upon entering the token manually I get  Invalid token code entered or your session has timed out. Please re-enter your credentials. Is there a known issue with this service ? L.E. figured out my manual input issue is due to entering the wrong token assigned to the account ( having multiple ones in the app ) , but the push notification from the app still doesnt work