Recently active topics

Irrespective whether the FortiGate server certificate is directly issued by a Root CA or by an Intermediate CA, the Root CA is always sent to the IPsec VPN client in the CERT payload of the IKE_AUTH response. This doesn't make any sense since no peer is going to trust a self-signed certificate received via an untrusted channel. Omitting the unnecessary Root CA certificate would help to reduce the number of IKEv2 fragments needed to transmit the huge IKE_AUTH response.

Hi, does anyone found a solution, to hold the VPN up and running when the screen is locked? OS: MacOS Sequoia 15.4 and MacOS Sequoia 15.5FortiClient: VPN 7.4.3.1761I had to install the newest FortiClient VPN version after a firewall upgrade as the older versions running in some connection problems.The older versions were stable and connected when the screen was locked. With the new version, the VPN disconnect each time the screen locks. In fortitray.log it is good to see, a message is send to forticlient and immediately after the message, the ssl-vpn is disconnecting. 20250508 14:55:24.613 TZ=+0200 [FortiTray:DEBG] AppDelegate.swift:390 System is locked/sleep20250508 14:55:24.620 TZ=+0200 [FortiTray:DEBG] AppDelegate.swift:404 System is going to sleep20250508 14:55:24.646 TZ=+0200 [FortiTray:INFO] VpnManager.swift:2163 Check VPN Connect without Reauth20250508 14:55:24.657 TZ=+0200 [FortiTray:DEBG] VpnManager.swift:2174 VPN Connection without reauthenticati

Description This article describes how to troubleshoot a FortiAuthenticator ZTNA certificate error on FortiGate. Scope FortiAuthenticator, FortiGate. Solution FortiAuthenticator v6.4.4 introduced a Zero Trust Tunnel Feature, which is used to securely connect with an on-prem Active Directory Server(LDAP).   Zero trust tunnels FortiAuthenticator v6.4.4This article assumes that the initial setup for this feature has been completed:Setting up a zero trust tunnelIf the ZTNA tunnel is failing on the FortiGate, check the ZTNA traffic logs on FortiGate: Log & Report -> ZTNA Traffic.In the screenshot above, the error 'Traffic denied because cert auth failed' shows up.To resolve this issue, ensure the ZTNA CA certificate has already been uploaded onto the FortiGate:If the CA certificate does not exist, import it and make sure to take note of the name after importing the CA certificate. In the screenshot above, the name is 'CA_Cert_2'. The FortiGate will need to use the C

DescriptionThis article describes how to enable Security Event logging when Security Fabric is enabled.It applies to both Fabric root and subordinate FortiGates.ScopeFortiGate.SolutionBy design and by default, all firewall policies (except for the implicit deny policy) log all sessions after Security Fabric has been enabled.Users cannot directly change the logging configuration on downstream (i.e. non-root) FortiGates as the option is greyed out as shown below: When the info indication highlighted above is hovered over, it shows: 'Security fabric is enabled so logging will exempt traffic from downstream FortiGates'.Although it is possible to change the logtraffic option manually in FortiGate CLI, this change will not be reflected in the GUI, and the session will continue to log all traffic.For example, the following configuration change would cause only security events to be logged if the FortiGate was not part of a security fabric, but is ignored for fabric FortiGates:config firewall

I have not gotten email yet when I tried to register to download FortiClient VPN only. That email is needed to use FortiToken app.

Hi everyone, I am trying to add a Fortigate VM eval, generated via the FortiCloud account to the FortiManager VM eval, also generated via the FortiCloud account. So, both units are "self-generated" evals. I am not talking about evals obtained through the local supplier. It is not working!!! From the debug output on FGM, it seems like the FG is not sending any certificate to the FGM while trying to setup communication via FGFM. This is a debug output from the FGM:2025-02-11 06:44:29 Use cert idx=0 by peer_ca = 1 2025-02-11 06:44:29 __info_callback,993: role=svr,state=23, TLSv1.3 SSLv3/TLS write certificate 2025-02-11 06:44:29 __info_callback,993: role=svr,state=40, TLSv1.3 TLSv1.3 write server certificate verify 2025-02-11 06:44:29 __info_callback,993: role=svr,state=36, TLSv1.3 SSLv3/TLS write finished 2025-02-11 06:44:29 __info_callback,993: role=svr,state=46, TLSv1.3 TLSv1.3 early data 2025-02-11 06:44:29 __info_callback,993: role=svr,state=46, TLSv1.3 TLSv1.3 early da

Hello Fortinet Community,I am using FortiGate with FortiOS 7.4.13 and want to prevent employees from uploading any file type (PDF, TXT, Microsoft Office, EXE, ZIP, RAR, etc.) to any external website or service.However, I need to ensure that Windows Update and Kaspersky updates and cloud services continue to work normally, without being affected by this policy.What is the recommended configuration to achieve this? Should I use DLP File Patterns with Flow-based or Proxy-based inspection? Is SSL Deep Inspection required?I would appreciate a step-by-step guide or an official Fortinet reference.Thank you.

DescriptionThis article describes an issue on FortiOS version 7.6.7: some administrators are kicked back to the login page right after a successful GUI login; it is necessary to enter credentials a second time before the dashboard loads. In other cases, the first attempt shows a blank/white page, and a later attempt loads normally. The login may be recorded in the event log together with an HTTPS connection error, even though authentication itself succeeds.ScopeFortiOS version 7.6.7.SolutionSymptoms:After entering the username and password, the login page reappears instead of the dashboard. Entering the credentials a second time succeeds and the GUI loads.The issue affects GUI (HTTPS) logins only, SSH sessions are not affected. It may be seen across Chrome, Edge, and Firefox, and sometimes in /private mode as well.An 'HTTPS connection error' may be logged in the event log.Root cause:When signing in through a web browser, the page loads a large number of small resources all at once (far

DescriptionWhen a BGP VPNv4 route(s) are received, the route(s) fail to be installed in the VRF routing-table when an extended community value is missing.ScopeFortiOS.SolutionIn an MPLS L3VPN environment integrating FortiGate firewalls, MP-BGP VPNv4 routes and VRF route-tagging mechanisms help maintain routing separation between customer networks while controlling route exchange across the provider backbone. By combining FortiGate routing policies and VRF-based segmentation with appropriate BGP route-target import/export policies and route-tag controls, service providers can reduce unintended route propagation and strengthen customer traffic isolation.This article focuses on the route installation issue. The configuration part is assumed to be working, and BGP neighborship between FW-01 and FW-02 is established.In this scenario, FW-01 receives the route 10.115.1.0/24 from Customer-A on VRF 115. FW-01 advertises this route to FW-02. The same route must be installed to FW-02 VRF 115 rout

DescriptionHow to prevent remote users connecting via dial-up IPsec VPN from being assigned IP addresses already in use by other active sessions, leading to connectivity drops and authentication failures.ScopeFortiGate, FortiClient/EMS.SolutionSymptomsUsers connecting to a dial-up IPsec VPN configured with "net-device disable" experience connection drops immediately after completing Multi-Factor Authentication (MFA). Logs indicate that the IP address assigned to a new user is already linked to another active VPN session.The issue occurs when the system reassigns IP addresses too quickly after a session ends or when the tunnel configuration does not properly manage the IP pool reuse interval. This can lead to IP address conflicts where multiple users are assigned the same address from the configured range.ResolutionTo resolve IP address duplication and improve connection stability, perform the following steps:Configure IP address reuse delay:Increase the time the FortiGate waits before

DescriptionFortiGate generates excessive traffic logs for proxy policies even when the log traffic setting is disabled, leading to increased log volume on FortiAnalyzer.ScopeFortiGate, FortiAnalyzer.SolutionAfter upgrading to FortiOS versions 7.6.6 or 7.6.7, the volume of daily logs sent to FortiAnalyzer increases significantly. Traffic logs with Log ID 13 continue to be generated for policies where logging is explicitly disabled using the set logtraffic disable command.A bug in the logging logic of FortiOS 7.6.x causes traffic logs to be generated for proxy policies regardless of the logtraffic configuration. This issue affects both explicit proxy policies and standard firewall policies configured with inspection-mode proxy.Resolution:Upgrade the FortiGate device to FortiOS 7.6.8 or a later version. This release contains the fix for the logging logic that prevents the unauthorized generation of traffic logs when logging is disabled.Verification steps:To confirm if the issue is present

I all. I would like to obtain information about my network, mainly related to bandwitch usage. I go to install to obtain this information a netflow collector.I have read about some problems with some third party Netflow collectors and I would like to answer about your experience to install a good Collector to work with Fortigate Firewall.  Please, could you recommend me a netflow network analyzer, free if its possible and it works well with fortigate, to can monitorice the bandwitch of my network in a way that I can get more information  than the information that a widget or fortiview gives me?Thanks ¡¡¡

DescriptionIn environments utilizing Fortinet Single Sign-On (FSSO) Terminal Server Agent (TS Agent), if a host running the TS Agent service is decommissioned, shut down, or has the TS Agent software uninstalled, its assigned port-range logon sessions (type fsso_citrix) may persist indefinitely on the Collector Agent and continue to be advertised to FortiGate firewalls.Symptoms:Stale TS-Agent sessions persist indefinitely in the Collector Agent (show logon users) after the TS Agent service is stopped or uninstalled.Stale TS-Agent sessions coexist with fresh standard logons (such as EventLog polling or DC Agent) for the same IP address.User traffic using outbound source ports outside the assigned range fails identity-based firewall policies.Cause:Aging timer exclusions: Standard Collector Agent aging timers (Dead Entry Timeout, Workstation Verification, and DNS verification) are architected for single-user endpoints and deliberately exempt multi-user TS-Agent sessions.Silent service shu

DescriptionUsers connected to Ruckus wireless do not move to a new VLAN after a role change unless they manually disconnect and reconnect to the Wi-Fi.ScopeFortiNAC-F v7.6.5.SolutionSymptoms.When a user role is changed in FortiNAC, the user remains in the current VLAN. The user must manually disconnect and reconnect to the wireless network to be moved to the new VLAN. A packet capture shows that FortiNAC sends a Disconnect-Request, but the Ruckus controller responds with a Disconnect-NAK.Root cause.The Ruckus controller requires specific attributes in the RADIUS Disconnect-Request message to identify the session. If these attributes are missing, the controller rejects the request with a Disconnect-NAK.Resolution.To resolve this issue, configure a custom attribute group and apply it to the device model configuration using RFC5176 mode.Step 1: Create a custom attribute group.Create a new custom attribute group.Add the following attributes to the group with the specified values:NAS-IP-Add

DescriptionUpgrading FortiNAC from version 7.6.6 to 7.6.7 may cause Layer 2 isolation and remediation interfaces to lose their IP addresses, resulting in DHCP and captive portal failures.ScopeFortiNAC-F v7.6.7.SolutionSymptoms.After upgrading FortiNAC from version 7.6.6 to 7.6.7, the following issues occur in Layer 2 isolation mode:The Configuration Wizard Summary displays the message "No isolation networks configured" even when isolation is correctly configured.Isolation and remediation interfaces lose their assigned IP addresses.DHCP services and the captive portal on these networks stop responding.The DHCP service may become inactive.Verify the DHCP service status using the following command:execute service status kea-dhcp6The output shows the service as Active: inactive (dead).Applying the config wizard displays the following result:Results 2026/10/13 15:04:56 Successful Configuration, scroll down for details. You will need to reboot your FortiNAC-CA. Results are written to the

DescriptionInstructions to bypass FortiCare registration through BIOS.ScopeFortiGate.SolutionOn newer FortiGate models, FortiCare registration is required before accessing the GUI. After the first login, you will be automatically redirected to the registration page. Once the device is registered, you can proceed with the configuration.However, there are situations where internet connectivity cannot be established through the CLI, preventing FortiCare registration, or where the air-gapped deployment option does not function as expected. Please try this methods first before changing BIOS settings: Enforce FortiCare registration.Example 1: It is not possible to select the reseller because the device does not have an Internet connection configured and there is no other option to bypass registration:Example 2: Before FortiCare registration is completed, the FortiOS CLI is restricted to read-only access, with only a subset of network configuration commands permitted. In theory, these command

DescriptionThis article discusses how to configure an LDAP user query for LDAP authentication on FortiRecorder to restrict access to users within a specific group in Active Directory(AD).ScopeFortiRecorder.SolutionSet 'User Authentication Options' to 'Search user and try bind DN', and change the user query as below, replacing the text in bold with appropriate config relevant to the network: '(&(|(objectClass=user)(objectClass=group)(objectClass=publicFolder))(|(proxyAddresses=smtp:$m)(mail=$m)(sAMAccountName=$u))(memberOf=CN=<group name>,OU=<OU or CN>,DC=<domain>,DC=<com>))'. Example:FK-SVM0000000000 # show profile ldap config profile ldap edit AD set server 10.1.1.3 set base-dn dc=test,dc=com set bind-dn "test\\Administrator" set bind-password ENC xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx set query "(&(|(objectClass=user)(objectClass=group)(objectClass=publicFolder))(|(proxyAddresses=smtp:$m)(mail=$m)(sAMAccountName

DescriptionThis article describes the issue of multiple alerts appearing on the FortiGate GUI after upgrading to FortiOS v7.6.7. The user may experience this issue when logging in to the FortiGate GUI in read-only mode, even without making any changes to the dashboard.ScopeFortiGate.SolutionFor FortiGate FortiOS V7.6.7 managed by FortiManager, when logging in to the GUI using a read-only account, multiple alert messages will appear: Dashboard changes will not be saved due to the device being managed by FortiManager.The alerts are cosmetic as FortiOS v7.6.7 restricts read-only accounts to make changes to the FortiGate GUI dashboard.The alerts only appear when logging into the GUI using a read-only account. Read-write accounts do not show the alerts.As a workaround, a dummy GUI dashboard configuration can be added to the read-only account.config system admin edit <read-only-account-name> config gui-dashboard edit 1 set name "Status" set vdom "root" set layo

DescriptionAn error during the authentication of a REST API super-admin profile admin account and available workarounds.ScopeFortiOS 7.4, 7.6.SolutionThere is a KB article, Technical Tip: FortiGate REST API access using PKI group, describing an option to use PKI user settings on FortiOS for REST API admin authentication with a token and certificate.REST API super-admin profiled admin access using a PKI group fails with errors “No matched peer found for given certificate”, “Peer certificate invalid or missing,” and “Failed api-key login attempt”.These debugs should be enabled to see authentication attempts:diagnose debug reset diagnose debug application httpsd -1 diagnose debug application fnbamd -1 diagnose debug console timestamp enable diagnose debug enableDebug snippets while a super-admin-profiled REST API admin sends a request to any interface with enabled HTTPS service. Some debug outputs are skipped intentionally:2026-10-09 12:46:19 [httpsd 1042 - 1791542779 info] fweb_debug

DescriptionThis article describes the requirement for Fully Qualified Domain Names (FQDNs) and provides guidance on configuring outbound access controls to ensure Fortinet products like FortiGate and FortiWeb can connect to FortiGuard update services.ScopeFortiGate, FortiWeb, FortiGuard.SolutionSymptoms.Fortinet products like FortiGate and FortiWeb appliances may experience intermittent failures when downloading security signature updates if outbound security controls restrict traffic to specific IP addresses. This occurs because the IP addresses associated with FortiGuard update services change dynamically.Root Cause.FortiGuard services use dynamic IP addressing. If a network environment uses a strict allow-list based on individual IP addresses rather than FQDNs, connectivity is lost when the service resolves to a new IP address not present in the allow-list.Resolution.Recommended Configuration.Reference FortiGuard services by FQDN to avoid connectivity issues caused by IP address cha

 friends a question:As you know, the NSX no longer exists. Before, the NSE1 NS2 were free. My question is, now with the changes made by Fortinet, are there still free exams? which are?

DescriptionFortiManager allows administrators to configure an EMS connector at the ADOM level. By default, the configured EMS connector is pushed to all FortiGate devices within the ADOM. For FortiGate devices operating in multi-VDOM mode, this configuration is applied at the Global level.However, in a multi-VDOM environment, individual VDOMs can override the Global EMS configuration to connect to their own EMS servers. VDOMs that do not enable the override continue to inherit the Global EMS configuration.ScopeFortiManager 7.4, 7.6, 8.0.SolutionBackgroundThe EMS connector can be configured in FortiManager under Fabric View -> Fabric connector -> Enable EMS.When configured at the ADOM database level, the EMS connector is intended to be distributed to the FortiGate devices managed by that ADOM. In multi-VDOM mode, the configuration is applied at the Global level.FortiGate also supports configuring an EMS connector override at the VDOM level. When the override is enabled, the VDOM c

DescriptionThis article is written based on the FortiGate-60F. The WAN configuration with multiple VNE interfaces requires FortiOS 7.6.1 or later. If required to use multiple VNE interface features, make sure to upgrade FortiGate in advance. For information on the firmware upgrade path and how to upgrade, please refer to the release notes or manuals.ScopeFortiGate 7.6.1 and later.SolutionWAN 1 Interface IPv6config system interface edit "wan1" set vdom "root" set mode dhcp set allowaccess ping set type physical set role wan set snmp-index 1 config ipv6 set dhcp6-information-request enable set autoconf enable set unique-autoconf-addr enable end next end VNE configurationconfig system vne-interface edit "vne.wan1" set interface "wan1" next end IPv4 Default Routeconfig router static edit 1 set device "vne.wan1" next end IPv4 firewall policyconfig firewall policy edit 1 set name "internal-vne.wan1

I configured an IPsec Remote Access VPN. When I use local authentication, the VPN works fine. However, when I switch to SAML authentication, the SAML login completes successfully, but FortiClient returns to the main screen instead of establishing the VPN connection.Has anyone experienced this issue before or knows what could be causing it? 

DescriptionA firmware upgrade behavior issue observed in a High Availability (HA) cluster. In an HA cluster, when the FGCP Multi-Version Cluster (MVC) upgrade mode is enabled using set uninterruptible-upgrade enable, the upgrade behavior will upgrade the Secondary unit first followed by the Primary unit.However, there are cases where the firmware upgrade may not proceed to the Primary unit even after the Secondary unit has been successfully upgraded.For example:The Secondary unit has been successfully upgraded to firmware version 7.6.7.However, the Primary unit remains on firmware version 7.4.11.ScopeFortiGate.SolutionRecommended action:Do not reboot the Primary unit or initiate a failover. Doing so while the cluster runs mixed versions can disrupt traffic or cause an unplanned role change.Re-run the firmware upgrade from the Primary unit to trigger the upgrade process again.Wait for the Primary unit to upgrade and reboot. The cluster then re-forms on the new firmware version.Run "get