Unanswered questions

Hi allI have noticed a weird issue, client had a power outage over the weekend as the redid the server room UPS.Now my AP’s show “Connected VIA” my VOIP interface on the FortiGate, even tough they are connected via FortiSwitches and the LLDP Neighbors are correct, also the IP’s they get are from my DATA VLAN.They use to say connected via DATA VLAN and once rebooted they now show VOIP. all troubleshooting points to they are indeed connect via DATA VLAN.GUI BUG? FortiGate 7.4.12 , FortiSwitches 7.4.8 and FortiAP’s 7.4.6Please let me know if anyone has experienced this and why now all of the sudden?

Hello community, We are currently running Forti EMS Cloud 7.4.3 with several endpoint versions, mainly FortiClient 7.2.11 y 7.0.X on Windows 11 devices.We are working together with the customer and Microsoft support to troubleshoot an issue where Windows Update downloads do not complete and the update process becomes extremely slow or stuck. Issue Description:When endpoints have a FortiClient profile with Sandbox enabled, Windows Update shows the following symptoms:Update download does not completeIf we change the endpoint policy to Default profile (no Sandbox), the Windows Update process completes successfully. Tests Performed To verify this behavior, we performed the following tests: Disabled Sandbox profile → Windows Update completes normallyRe-enabled Sandbox profile → Windows Update fails or hangsWe tested with multiple Windows Update components excluded:TrustedInstaller.exeTiWorker.exe (Windows Modules Installer Worker)DISM.exeC:\Windows\WinSxS\C:\Windows

Good morning, everyone. I have the following problem, but first, let me describe the scenario. I have a virtual FortiGate 8.0 installed (OVF file imported into VMware Workstation 25h2). It's already installed and configured correctly with web access. The issue arises when I try to install FortiManager, the same version as the FortiGate. The OVF file is available in the VM section of the Fortinet support page, and I can download and import it without problems. The problem starts when I launch the VM; it gets stuck in an infinite loop between 'vmlinuz' and then 'extracting the GZ file,' and it never gives me the login option. Can you help me with this?

 [delete post]

Hi FGT adminsFortiOS 7.4.12. All HTTPS sited are blocked with error: “SSL connection is blocked due to unable to retrieve server's certificate”.In the latest FOS updates the FGT probes the certificate itself (self generated traffic) before allowing or denying the traffic, right.I checked this tech tip and I know we can change cert-probe-failure as workaround.But I my case I know the issue is caused by my WAN interface having one primary private IP and one public IP as secondary IP (ISP constraint). I had to change source-ip for many services like DNS and FortiGuard in order to make them reachable. But can’t find similar source-ip for certificate probe traffic.I know one other workaround is to make public IP primary and private IP secondary but I prefer avoid this change in case there is “source-ip” customization for cert probe.Any useful info would be appreciated.

I have integrated Darktrace Syslog with FortiAnalyzer. When Darktrace sends logs in JSON format, the log messages are truncated in FortiAnalyzer. However, when I configure Darktrace to send logs in CEF format, the Message field in FortiAnalyzer is empty.Could you please advise on the cause of this behavior and recommend the appropriate configuration to ensure the complete log message is displayed in FortiAnalyzer?

Hi everyone,I'm trying to integrate FortiWLC 8.6-5 build-8 (FortiWLC-500D) with Aruba ClearPass Guest (ClearPass Policy Manager 6.12.7.308288 on C3010 platform) as an external captive portal.Current setupFortiWLC 8.6-5 build-8 External captive portal: Aruba ClearPass Guest Authentication type: RADIUS Captive Portal External Server Type: Fortinet-Presence External URL:  https://<clearpass fqdn>/guest/guest_register_3.phpThe captive portal profile is configured as:Authentication Type: radiusCaptive Portal External Server Type: Fortinet-PresenceSuccess Redirect URL: https://<default redirect url>Login flowClient connects to SSID.FortiWLC redirects the client to the ClearPass Guest portal.The login page receives all FortiWLC parameters correctly, including:magicusermacuseripserveripapmacapidapnodeidssidpost=https://<controllerip>:8081/vpn/loginUser? User enters username/password.ClearPass successfully authenticates the user against the authentication source.After successf

Hi,I recently implemented FPAM and I have a strange behavior with all the web launching sessions.The FPAM is in a subnet dedicated.My pc is on another subnet and the internal services and external(obviously) are on other subnets.In the middle there’s a Fortigate.I have also an ACL for deny the traffic to the internal services from my pc, so I must traverse the FPAM to reach the services.I launch multiple web launching sessions to multiple sites internal and external and after so much time, I can’t define how much, I receive some ERR_CONNECTION_TIMED_OUT from random sites.If I try to reopen the site, I can no longer access it; I have to wait a long time before it starts working again.From what I've gathered so far, connections are more stable if I use the site's IP address directly instead of the FQDN, but sometimes are slowly(But at least they don't time out.)When I have the reset, the FPAM is capable of ping and resolve the destination internal or external site, seems to be a problem

Hi All Community member and expert. Do want to request whether you guys encounter or experience issue as below: Incident that when request change of FortiSASE POP, the Fortinet engineer change without validating the settings (Which require deletion of Geo Fencing), which have configuration dependencies causing our specific POP down including whole SAML service down in FortiSASE on production. (Ticket 11464065) While providing feedback on same ticket (11464065), the related Fortinet Manager promise to improve the procedure on next time check to check on the Geo Fencing and Fortinet engineer had log a bug in ticket (11398499) that will check whether there is existing Geo Fencing if customer request POP changes before implement. We trusted Fortinet on that at the moment regarding the fix and procedure improvement.Due to we have different Business Unit, we have another FortiSASE need request to change POP, then same issue happen causing production impact, further reported in ticket (114276

Hi,after upgrading our FortiGate HA cluster from 7.4.12 to 7.6.7, we noticed a significant increase in the daily log volume sent to FortiAnalyzer.Environment:FortiGate: 2x FG-200F in HAFortiOS: 7.6.7FortiAnalyzer: VM, currently 8.0.0Logging: FortiAnalyzer​Before the upgrade, our daily log volume was normally below the licensed GB/day limit (15 GB). After the upgrade, the daily log rate increased by approximately 8–10 GB per business day, without any intentional configuration changes on the FortiGate side.For a normal business day we now see approximately: Application Control log: ~10 GB/day, Traffic log: ~9 GB/day​No firewall policies were intentionally changed, and we did not enable any additional logging options manually after the upgrade.We have already checked the following:- no known configuration change was made on the FortiGate before/after the upgrade- application Control logging is enabled as before- SSL inspection is enabled- FortiAnalyzer is receiving logs correctly- The inc

Hi,I’m trying to change default admin account, but after rename command in the cli I have error:fml (admin) # rename admin to admin_disabledCommand failed(-37). Error string:Is not possible to change this account on fortimail?

Hi FAZ、FMG created same ADOM name for manage FAZfollow this guidehttps://docs.fortinet.com/document/fortimanager/7.4.0/examples/289359/adding-fortianalyzer-to-fortimanager  at FAZ, ADOM name ”ADOM_v74” have one device at FMG, have same ADOM  name”ADOM_v74”, and same devicebut in this ADOM, the left sidebar doesn't even have a Log View or FortiView to check traffic or other logs.only “FAZ” ADOM have Log View and Forti View 

I've been experiencing a wide array of issues with FNAC lately.I won't get into them all, but one that is really irking me is when I browse to the FNAC home page via HTTPS, I login successfully, I click on any navigation item (i.e Inventory) and then I immediately lose connectivity to the UI and am not able to reconnect. Only via a reboot is the page restored.I also lose SSH access. The only remote access that remains is via console.We are in HA and that does not invoke either. FNAC still responds to ping so presentably that is why.Kinda getting sick of it.

If the endpoint was idle for some time then when i change the group on the NAC, I can see the fortinac not send the CoA to the switch.We can see here the last fnac send the CoA is 14:02:18 then i change the group for that host at 14:30 and there is no CoA bsend to the switch  

We recently upgraded our FortiGate firewall firmware from version 7.6.6 to 7.6.7.After the upgrade, we started experiencing issues with several applications, including WhatsApp Web, Canva, Figma, and Microsoft 365 Copilot. Users receive the following error message:"Please check your network and try again."As part of our troubleshooting, we manually added the required FQDNs to the SSL/SSH Deep Inspection profile within the security policies. However, Microsoft 365 Copilot is still not functioning properly.Could you please advise on any additional configurations, known issues, or recommended troubleshooting steps for resolving this problem?

Issue: I’m deploying the FortiSIEM 7.5.0 Headless Windows Agent on a Windows machine in an OT environment. The communication path is Headless Agent → Diode Collector → L2.5 Virtual Collector → Supervisor. The Windows agent installation completes successfully, and the host is discovered in FortiSIEM, but no Windows Event Logs are being ingested. Objective: I’m trying to collect Windows Event Logs using the Headless Agent through the Diode Collector architecture. The OT Host Template is configured for Windows Event Logs. Has anyone encountered this issue or are there any additional configuration steps or prerequisites required for this deployment?​@AEK   

Hello Team,We need some guidance regarding a FortiSIEM Active-Active HA deployment. Version 7.4.2Current EnvironmentWe currently have 1 Supervisor node running in production. Our plan is to add 2 additional Supervisor nodes to build an Active-Active HA cluster.What HappenedWe initially generated the HA certificates using the root user. While adding the two new Supervisor nodes to the HA cluster, the process failed with the error: "The database application fails." Fortinet Support removed the HA nodes, and the existing environment was restored to a healthy state.Current StatusAfter the cleanup, we attempted to configure the HA cluster again with correct certificates , but we were still unable to successfully add the Supervisor nodes to the HA cluster.While investigating, we observed that the existing Supervisor already has the following services running:patroni etcdOur PlanWe are planning to retry the HA deployment once more, this time by generating the certificates correctly using

 Hi everyone,I’m having an issue when trying to activate the trial license on a FortiGate VM running on GNS3 (KVM).When I execute the following command:execute vm-licenseand confirm with y, I get this error:Requesting FortiCare Trial license, proxy:(null) curl forticare failed, 28 Failed to request forticare license 28. Failed to download VM license.Additional system information:FortiGate-VM64-KVM # get system status Version: FortiGate-VM64-KVM v7.2.13,build1762,260128 (GA.M) License Status: Invalid VM Resources: 1 CPU/1 allowed, 1992 MB RAM/2048 MB allowedThe VM image used:FFW_VM64_KVM-v7.2.13.M-build1762-FORTINET.out.kvm.zipThis is a fresh deployment on GNS3 using KVM.  

Hello FortiSIEM Community,I am developing a custom parser for a log source where both the Event Name and Event Type are dynamic strings extracted directly from the CEF log headers using regular expressions.We recently upgraded our environment from v7.5.0 to v7.5.1, and we have run into a strange parsing behavior that wasn't happening in the previous version.The Issue:In the Parser Test UI: When pasting a sample log into the debugger/test utility, the regex captures the tokens perfectly. eventName and eventType are differentiated and display their respective unique values. Over Live Syslog: Once the parser is saved and a live log is forwarded via Syslog, the eventType value completely overwrites the eventName attribute. In Analytics, both fields end up showing the exact same value (the event type string).Has anyone experienced this specific regression or behavior change in the 7.5.1 live engine pipeline? Is there an updated syntax or a specific workaround to stop FortiSIEM from dynamica

Regarding a FortiGate system configured in an active/standby high-availability (HA) setup,we initially set the Device Priority value for Unit 1 to 200 and the Device Priority value for Unit 2 to 128 (the default).However, even though we hadn’t made any changes, the priority value on the standby unit had changed to 200, the same as the active unit. We attempted to manually change the priority value on the standby unit back to its original value of 128, but an error message stating “The entered value is incorrect” appeared, and we were unable to make the change.The system recognizes the active/standby configuration and no abnormalities are apparent in the HA setup, but what is the cause and how should we proceed?

How to Protect Fortigate from IPv6 Security Risks

Working on a branch office to HQ redundant vpn setup.  Each location has 2 ISPs and I had planned on following this: Manual redundant VPN configuration | FortiGate / FortiOS 8.0.0 | Fortinet Document Library just using 2 tunnels (primary ISP to primary iSP, backup ISP to backup ISP) with static routes to force the backup tunnel over the secondary WAN at each location.  Is there any drawback to this approach?  I had considered using SD-WAN for the vpn traffic or possibly BGP but wasn’t sure if either offered a significant advantage in this situation.  The branch office has a single /23 network and HQ has only 3 or 4 networks that need to be accessible.  And the request is for the tunnels to utilize ISP1 as the primary when available.

Where I can find click house schema file for FortiAnalyzer ?According to docs.fortinet.com:Each log table stored in an SQL database contains log fields that can be used in datasets.You can view a full list of the fields available for each log type in the FortiAnalyzer ClickHouse Schema file available from the FortiCloud Support page.But I cannot find it.

Good day, everyone.I have been experiencing intermittent SPF false positives in **FortiMail 8.0.0**. In some cases, FortiMail reports that the sender's domain does not have an SPF record. However, after verifying the domain manually using both our internal DNS servers and public DNS servers, the SPF record is available and resolves correctly.I would like to know if there is any configuration or best practice that could help reduce these false positives. For example:* Is it possible to increase the DNS query timeout used by FortiMail?* Is it possible to adjust or reduce the DNS cache timeout?* Are there any recommended DNS-related settings for improving SPF validation reliability?One behavior I have noticed is that multiple emails from the same sender domain, received at nearly the same time, may produce different SPF results. Some messages pass SPF successfully, while others are rejected because FortiMail reports that no SPF record was found.Our environment consists of **two FortiMail

Can Fortisiem be integrated with PowerBI for reporting? if yes, how? or which reporting tool can be integrated with Fortisiem?