Recently active topics

Description Steps to fix phParser crashes in FortiSIEM 7.6.1. Scope FortiSIEM 7.6.1. Solution In FortiSIEM 7.6.1, there is a known bug where phParser process can crash based on some internal race conditions. Use the following patch to apply in Supers, Workers and Collectors and follow these steps to fix it: Download the libphParser.so.zip attached file and transfer it to /tmp with the SCP tool. Stop the phParser process:   phtools --stop phParser   Take a backup:   cp -a /opt/phoenix/lib64/libphParser.so /opt/phoenix/lib64/libphParser.so.original   Apply the patch:   cd /tmp7za x libphParser.so.zipmv libphParser.so /opt/phoenix/lib64/chown admin.admin /opt/phoenix/lib64/libphParser.sochmod 755 /opt/phoenix/lib64/libphParser.so Repeat these steps in supers, workers and collectors.  

DescriptionComparison of the software components between the WIN11O21V1 and WIN11O21V2 guest images used in FortiSandbox.ScopeFortiSandbox.SolutionRoot CauseThe WIN11O21V2 guest image is an updated version of the WIN11O21V1 image, specifically modified to include a Python runtime environment for analyzing Python scripts.ResolutionThe differences between the two guest images are as follows:WIN11O21V2: Includes Python version 3.12.10.WIN11O21V1: Does not include Python.If the environment does not require the scanning or execution of Python scripts, there is no material difference in file rating capabilities between these two images.

DescriptionThis article describes a FortiClient installer showing '{"result": {"retval": -1, "message": "File not found"}}' in the email invitation.ScopeFortiClient EMS version 7.4.8 and FortiClient EMS Cloud.SolutionWhen a user selects the FortiClient installer download link in an EMS invitation email, the browser displays the following error:The installer filename in the invitation URL may contain uppercase characters, while the actual filename on the EMS server uses lowercase characters. Since filenames can be case-sensitive depending on the underlying file system, this mismatch may cause the download to fail.Workaround: Change the installer filename in the URL to lowercase.For example, change:https://10.47.4.59:10443/installers/default/7.4.8/FortiClientSetup_7.4.8_x64.exeTo:https://10.47.4.59:10443/installers/default/7.4.8/forticlientsetup_7.4.8_x64.exeNote: This is a workaround for the known issue documented in the FortiClient EMS 7.4.8 release notes. Refer to the applicable relea

DescriptionHow to enforce quarantine email when (p=none, final action for each recipient depends on system or domain-level DMARC failure action setting) is enabled.Scope FortiMail.SolutionWhen a DMARC policy of a certain company is published as (p=none) its directive explicitly tells receiving mail servers not to block or modify delivery based only on a DMARC failure.Below is an example of an email FortiMail failed to quarantine even though the AntiSpam profile clearly instructed it to quarantine when the DMARC check fails.In the AntiSpam Profile, it shows that DMARC Fail with Default action = UserQuarantine:Solution: Perform the following CLI command:config antispam settings set dmarc-failure-action use-profile-action endIt enforces the AntiSpam action profile instead of honoring the DMARC record published by the sender for (p=none).

DescriptionHow to troubleshoot high memory utilization that causes the FortiNDR web GUI and SSH access to become unresponsive or slow after upgrading to version 7.6.4.ScopeFortiNDR.SolutionSymptomsAfter upgrading to FortiNDR version 7.6.4, the following symptoms occur:Memory consumption spikes to critical levels (up to 99%).The web GUI is unresponsive.SSH sessions time out or drop with "Remote side unexpectedly closed network connection" errors.Root CauseThe PCAP dump feature is memory intensive. When enabled, it captures raw full packets for entire sessions, which can lead to high memory usage. If memory becomes exhausted, critical processes (such as the database handler) may be terminated by the system (Out of Memory killer), leaving the database in an inconsistent state and rendering the management interfaces unresponsive.ResolutionTo resolve the unresponsiveness and normalize memory usage, perform the following steps. Console access is required if SSH and GUI are non-functional.Con

DescriptionThis article describes how to troubleshoot when FortiManager/FortiAnalyzer is unable to access the Internet.ScopeFortiManager and FortiAnalyzer.SolutionHow to check:At FortiManager, perform the following actions: execute ping google.com execute traceroute google.com execute traceroute 8.8.8.8From the results, FortiManager currently has 2 issues:Unable to translate the google.com URL into an IP address, which is related to a DNS issue.Unable to route out and reach 8.8.8.8, which is related to a routing issue.After that, at FortiManager, go to System Settings -> Network:Check the current DNS setting.Check the current Routing table setting.Solution:In FortiManager, configure a default route to resolve the routing issue.Commands to configure a static route from the FortiManager CLI:config system route edit 1 set device interfacename set gateway x.x.x.x next endIn FortiManager, configure the DNS settings to resolve the DNS issue.

DescriptionHow to bring up the menu (Add VMs from FortiGuard) on FortiSandbox.Scope FortiSandbox.SolutionDuring the initial setup, the menu (Add VMs from FortiGuard) is missing from the VM Settings.Solution:To bring up the menu, navigate to System -> FortiGuard -> Module Information. Click on Update from FDN Now to manually trigger the update.Perform the following command to review the debug to monitor whether FortiSandbox is capable of reaching fds1.fortinet.com to get the FDN server list:diagnose debug fdnOnce successful, the menu (Add VMs from FortiGuard) will appear and allow VMs to be downloaded from the FDN.

DescriptionThis article describes how to restrict browsing in Incognito/Private mode when the user has not allowed the FortiDLP browser extension.ScopeFortiDLP Agent, FortiDLP browser_extension.SolutionDefault browser extension behavior in Private/Incognito windows.Browsers (Chromium/Firefox) disable all extensions when a Private (Incognito) browser session begins. This means that the FortiDLP agent has no visibility to any browser events, and browser policies will not be enforced.The following will give some options for how this limitation can be overcome.Restrict the ability to use Private browsing.One option is to restrict the use of Private browsing. This can be accomplished either via MDM (i.e., GPO, Jamf, etc.) or via FortiDLP Agent Configuration profile setting:Only allow private browsing if the extension is enabled.A subset of browsers support enforcement of extensions in private browsing windows, allowing users to browse privately for business workflows while ensuring this act

DescriptionThis article describes a quick fix to disable the prompt to migrate the config with FortiConverter.ScopeFortiGate with FortiOS v7.6+.SolutionThe FortiGate was upgraded to FortiOS v7.6.x, it is common to see a prompt to migrate the configuration with FortiConverter:To avoid any confusion that may result in extra unnecessary steps to set up an account with FortiConverter in the cloud, including loss of time and productivity, it is recommended to disable this prompt after selecting 'Later' in the above screen and making a change on FortiGate CLI with the following command and using the 'hidden' option:diagnose sys forticonverter set-prompt-visibility [hidden|visible]Once this setting is applied, any further logins to the FortiGate via the GUI will not be challenged with the FortiConverter migration dialog.

After upgrading to 7.4.13, many APs are no longer connecting to the firewall. A small number are connected, but most are not.What can be done, or is this a known issue?

Description This article provides information and instructions on how to fix the FTIx0002 or FTIx0001 error when accessing Fortinet Training Institute portal.       As of May 5, 2025, FortiCloud has become the default authentication method for all users accessing the Fortinet Training Institute portal. To log in, users must use an organization admin/master FortiCloud account. If a user receives error FTIx0002 or FTIx0001, it may be due to one of the following reasons: The user has not completed the Support Portal profile. Or the user has not created a Master FortiCloud account. The user is using an IAM or IDP account to log in instead of an email-based account. Scope Customer Service. Solution To resolve this error, ensure that each user has an individual 'master account' in FortiCloud with a completed Support Portal profile. IAM or Sub User accounts are not supported for accessing training accounts. To create a FortiCloud account, see  Creating a

DescriptionInstructions for initiating a patch-level upgrade when the device has no support contract.ScopeFortiOS 7.4 and 7.6FortiGate devices with no firmware contract.SolutionIn FortiOS 7.4.2 and higher, it is not possible to upgrade to later firmware versions in the GUI if the device has an expired firmware license.The FortiOS GUI will display the warnings such as "This is a FortiOS v7.4.5-build2702 firmware image that cannot be installed because the device's FortiGuard license for firmware upgrades could not be verified or may have expired. Verify or renew the license to install upgrades." Even if a device has no valid support contract, it is strongly recommended to maintain a patched firmware version. See available upgrade methods below. Upgrade using forced FortiGuard update:This method applies to the following FortiOS firmware versions:FortiOS 7.4.8 and higherFortiOS 7.6.4 and higherThese firmware versions support forced firmware upgrade within the same minor firmware version ev

How and more importantly when are we supposed to update the OS using emscli please?This is the EMS Ubuntu 22 appliance from Fortinet running EMS 7.4.8 not a DIY Ubuntu build with EMS installed on it.EMS is up to date but the documentation doesn't seem to cover the OS updates but you read things on here about not updating because it can break EMS and so on.

We have standardized on using Power BI for reporting metrics on our different systems.  Has anyone created FortiSOAR reports using an external report system like Power BI?  If so, how did you accomplish this?

I’m using Fortianalyzer 1000F version 7.6.8. I have a myriad reports that run daily based on traffic logs. These reports get mailed to IT and Security staff. What I find though is that the reports get sent even if there are no results. Any other reporting tool I have seems to have an option to only send mail alerts/reports if there are results (Splunk etc.)Is this possible in Fortianalyzer? If not, are there alternatives ?

Hello everyone,I’m trying to run sudo commands using the csadmin user, but I’m getting the following error:Sorry, user csadmin is not allowed to execute '/bin/vi /etc/pki/tls/openssl.cnf' as rootI’m trying to follow this article about troubleshooting the Exchange/Microsoft WinRM connector error: Also I don’t have access to the root account, and I’m also unable to change the root password.Could anyone advise me on the correct way to:Edit /etc/pki/tls/openssl.cnf using the csadmin account? Obtain the required sudo/root privileges? Reset or change the root password if necessary?Thank you.

Hello everyone,I know that the collector should be in sync with the supervisor and worker cluster. But what if the collector is deployed in an environment with a different time zone?For example, if the cluster is configured to use UTC+2, but the collector is deployed in an environment using UTC+1, should I configure the collector to use UTC+1 in time zone? or UTC+2?Will the logs work normally, or will there be a time skew issue?Thank you!

Hi Everyone,We have a fortigate firewall with HA and FortiOS is 7.4. also laid few client based FortiGate SSL-VPNs accounts.Now we have to upgrade either 7.6 or 8.0, where as not support the client based FortiGate SSL-VPNs accounts. So, what is the best practice for moving to 7.6 or 8.0 version?.Before upgradation can we use any migration tool only for SSL-VPN accounts to IPsec or any other?.MY SSL-VPN purpose is providing the RDP access & Web based internal urls.  Anyone guide me for best practice for without any production impact?.Thanks in advance.  

Running FortiClient 7.4.8.2066 on Windows 11 25H2.What’s happening, Users can connect, everything works.  Next time they open laptop, unable to connect VPN Software.The Fortinet SSL VPN Virtual Ethernet Adapter is disabled.  Simple restart of laptop re-enables card, works again.    100 Users, at any one moment in time, 30 NICs are disabled on average.My best guess, and it is a guess, relates to Power Management on WiFi card.  Windows is disabling WiFi when you put laptop to sleep.  This event disables FortiClient NIC.  Wake laptop up, WiFi enables itself, FortiClient doesn’t.Has anyone seen this before ThanksBryan

Since yesterday morning a lot of websites give a 400 Bad Request ( see screenshot) when DeepInspection is enabled.Disabling DeepInspection fixed the problem.I also saw other issues relating DeepInspection(https://community.fortinet.com/support-forum-92/some-website-not-loading-with-deep-inspection-230891) But this seems to be other. We already have policy in Proxy mode en disabling AV is also not working.We use firmware level 7.4.13. More people have issues with this? 

DescriptionTroubleshooting steps for installation failure in FortiManager version 7.6.8 due to the 'udp-not-quic' option under 'config firewall ssl-ssh-profile' when installing to FortiGate models with 2GB of memory.ScopeFortiManager.  SolutionIn version 7.6.8, FortiManager has added some lines to the configuration to push. For example:config firewall ssl-ssh-profile edit "custom-deep-inspection" config https set udp-not-quick allow end config dot set udp-not-quick allow end next endWhen installing on FortiGate models with 2GB of memory, this change causes the installation to fail.These models do not support this option in FortiOS version 7.6.This behavior is due to a known issue, with ID 1352524.Workaround: Set 'udp-not-quic' to 'block' in the affected SSL/SSH profiles.Set udp-not-quic to block in the https and dot sections of the affected SSL/SSH profiles.Go to Policy & Objects -> Advanced.Select the CLI Configura

Fortinet Video Library — October 2026 Roundup Hi everyone, here are 12 full-length videos published on Fortinet’s official Video Library YouTube channel during October, checked through October 30. I’ve grouped them by product and included YouTube and video.fortinet.com links. Shorts are excluded.FortiGate & FortiOSOct. 28 — FortiOS 8.0.1: Configuring Hashed External Feeds to Block WebsitesYouTube | Fortinet Video Library Oct. 27 — FortiOS 8.0: Steering SD-WAN Traffic Based on Underlay BandwidthYouTube | Fortinet Video Library Oct. 22 — FortiOS 7.6.8: Configuring Application Hold Timer to Hold Newly Created Application SignaturesYouTube | Fortinet Video Library Oct. 13 — FortiOS 8.0: Using IPAM for Dual-Stack IPsec VPN Remote Endpoints' IPv6 Address AssignmentYouTube | Fortinet Video Library Oct. 8 — FortiOS 7.6.7: Enabling NPU Offloading for IPsec VPN over VNE Interfaces to Improve PerformanceYouTube | Fortinet Video Library Oct. 6 — FortiOS 8.0.1: Configuring User-Defined Applicat

DescriptionAfter upgrade to FortiOS 7.6.8, administrator SSO authentication fails. FortiOS access requires a local administrator or a RADIUS/LDAP/TACACS+ administrator account.ScopeFortiOS 7.6.8.SolutionAfter upgrade, administrator SSO will fail with the error message "Single Sign-On Failed", without presenting any option to enter an SSO administrator credential.The following FortiOS login methods are confirmed affected by the issue:Administrator FortiCloud SSO.Administrator third-party SSO, for example see Technical Tip: Configuring SAML SSO login for FortiGate administrators with Entra ID acting as SAML IdP.Security Fabric SSO with root FortiGate as IdP, for example see Configuring single-sign-on in the Security Fabric.Confirmed not affected:VPN user SSO authentication.Other FortiOS versions including FortiOS 7.2.14, 7.4.13, 7.6.7 and 8.0.2.Local administrator authentication.Remote administrator authentication using RADIUS/LDAP/TACACS+.While access to the FortiGate from FortiManageme

DescriptionAfter upgrading to FortiOS 7.6.8, administrators may be unable to configure an IP address for new VPN tunnels via the GUIScopeFortiOS 7.6.8.SolutionIf you try to configure only the IP address, the following behavior is observed: The FortiGate will not display any error message, but the Tunnel interface will remain with the default IP address 0.0.0.0/0.0.0.0.If you try to configure the tunnel IP address and the Remote IP address at the same time, the IP field will revert back to 0.0.0.0 and the GUI will display an error message:Error message:IP must be set if remote IP is defined.Must set ip if remote-ip is defined.Object set operator error, -118 discard the setting.SolutionThe issue is under investigation, and a permanent fix is not available yet.WorkaroundConfigure the IP address and remote address via the CLI with the following commands:config system interface edit <tunnel-interface> set ip <ipaddress> 255.255.255.255 set remote-ip <remot

DescriptionAn explanation of the retirement of Legacy FortiDLP Tenant Domain.ScopeFortiDLP.OverviewOn November 30th, 2026, two years after Fortinet acquired Next DLP, access to the FortiDLP Console using the legacy reveal.nextdlp.com domain will no longer be supported. The FortiDLP Console will only be accessible via the FortiCloud Services menu or https://fortidlp.forticloud.com.From that date onward, to access the FortiDLP Console, the following is required:A FortiCloud account containing a valid FortiDLP license registration.All FortiDLP operators must be configured in the FortiCloud account as IAM users with access to FortiDLP.FortiCloud accounts can also be integrated with an external IdP for SAML SSO login. For assistance, contact your Fortinet Account Representative.For a smooth transition, complete the following steps before November 30, 2026:Verify that all operators can log in to the FortiDLP Console using their FortiCloud IAM User accounts.Update all references to the legacy