Unanswered questions

 Product: FortiManager VM64-KVM, v7.4.12 build 2836 (GA.M), downloaded from the support portal (VM Images, KVM).Problem: On first login the GUI shows the license page. With “Free trial” selected and FortiCloud login (valid account, the credentials work on the FortiCloud portal), the activation fails.GUI message: “Unexpected error happened while processing your request, please refer to error section in response for more details.” HTTP: POST /gui/userauth returns 401. CLI debug (diagnose debug application gui 8 / curl 8): “Error when retrieving trial license from FortiCloud: Unexpected error happened while processing your req.”Environment: KVM/QEMU on Ubuntu (WSL2), user-mode NAT networking, outbound HTTPS works (forticloud.com reachable, DNS OK). Serial shown: FMG-VM0000000000, License Status: Valid in get system status but the GUI keeps forcing the license page. VM UUID is set and unique. System time is correct.Already tried: reboot, fresh disks, DNS fixed, different attempts; the same

Mostly AI Generated, but results of my own work. After considerable troubleshooting, I've successfully implemented Windows Native Always On VPN (AOVPN) Device Tunnel with FortiGate 7.4.13, using machine-certificate authentication, Microsoft Intune, and Active Directory authorization.First, credit where it's due: Richard Hicks (richardhicks.com) has published excellent documentation on Windows AOVPN that helped tremendously.Also, let's be clear: FortiClient already provides always-on, pre-logon VPN connectivity using machine certificates and, in my experience, does it better than Windows native AOVPN.However, if you're like me and have valid reasons not to use FortiClient VPN, this post is for you.Our EnvironmentWe're using: FortiGate running FortiOS 7.4.13 Windows native IKEv2 Device Tunnel Enterprise CA with machine certificates deployed through Intune SCEP Microsoft Entra hybrid-joined Windows computers Active Directory LDAP for computer authorization Intune-managed split-t

We have been using IPsec VPN with a peer group and peers.The peers have the CA cert of the EMS server and the subject as part of the peer identifier. This has always worked fine until the upgrade to 7.4.13 where we get an “invalid certificate” error and no connection. If the Peer Option is set to Any Peer ID then the VPN connection works. I’ve looked through the “known issues” of 7.4.13 but nothing applies.Any ideas?Thanks.

After upgrading to 7.4.13, many APs are no longer connecting to the firewall. A small number are connected, but most are not.What can be done, or is this a known issue?

I’m using Fortianalyzer 1000F version 7.6.8. I have a myriad reports that run daily based on traffic logs. These reports get mailed to IT and Security staff. What I find though is that the reports get sent even if there are no results. Any other reporting tool I have seems to have an option to only send mail alerts/reports if there are results (Splunk etc.)Is this possible in Fortianalyzer? If not, are there alternatives ?

Hello everyone,I’m trying to run sudo commands using the csadmin user, but I’m getting the following error:Sorry, user csadmin is not allowed to execute '/bin/vi /etc/pki/tls/openssl.cnf' as rootI’m trying to follow this article about troubleshooting the Exchange/Microsoft WinRM connector error: Also I don’t have access to the root account, and I’m also unable to change the root password.Could anyone advise me on the correct way to:Edit /etc/pki/tls/openssl.cnf using the csadmin account? Obtain the required sudo/root privileges? Reset or change the root password if necessary?Thank you.

Hello everyone,I know that the collector should be in sync with the supervisor and worker cluster. But what if the collector is deployed in an environment with a different time zone?For example, if the cluster is configured to use UTC+2, but the collector is deployed in an environment using UTC+1, should I configure the collector to use UTC+1 in time zone? or UTC+2?Will the logs work normally, or will there be a time skew issue?Thank you!

How and more importantly when are we supposed to update the OS using emscli please?This is the EMS Ubuntu 22 appliance from Fortinet running EMS 7.4.8 not a DIY Ubuntu build with EMS installed on it.EMS is up to date but the documentation doesn't seem to cover the OS updates but you read things on here about not updating because it can break EMS and so on https://100001.onl/ .

Hi All,I have fortigate firewall (OS 7.6.7) with two WAN interfaces (WAN1: 10.10.10.1 & WAN2: 20.10.10.1)And configured IPsec tunnel on WAN1 10.10.10.1), generally we can add another public IP as secondary IP to IPsec tunnel.But now I want to add WAN2 IP (20.10.10.1) as secondary IP to my existing tunnel, which is configured on WAN1 interface. Will it possible?, or in traditional way have to configure two IPSec tunnels?

I am trying to configure my Fortigate 60E using the Ansible ForiOS Galaxy plugins. Currently I am working on the vip configuration. For most of the vips it is working fine but I can't get the ssl vip to work.I would like to set up a ssl vip of type server-load-balancer like this:- name: "Configure {{ vdom }} vdom virtual IP for IPv4" fortios_firewall_vip: vdom: "{{ vdom }}" state: "{{ state }}" access_token: "{{ token }}" firewall_vip: name: "vip_ssl_placeholder" extintf: "management" extip: "10.10.10.1" extport: "6363" type: "server-load-balance" server_type: "ssl" monitor: - name: "tcp-6363-link-monitor" ldb_method: "least-rtt" persistence: "ssl-session-id" realservers: - id: "1" ip: "10.16.10.1" port: "6363" - id: "2" ip: "10.16.10.2" port: "6363" ssl_mode: "full" ssl_certificate: "Fortinet_Factory"However, when applying the script I get an error -56 from the Fortigat

Hi Everyone,We have a fortigate firewall with HA and FortiOS is 7.4. also laid few client based FortiGate SSL-VPNs accounts.Now we have to upgrade either 7.6 or 8.0, where as not support the client based FortiGate SSL-VPNs accounts. So, what is the best practice for moving to 7.6 or 8.0 version?.Before upgradation can we use any migration tool only for SSL-VPN accounts to IPsec or any other?.MY SSL-VPN purpose is providing the RDP access & Web based internal urls.  Anyone guide me for best practice for without any production impact?.Thanks in advance.  

Running FortiClient 7.4.8.2066 on Windows 11 25H2.What’s happening, Users can connect, everything works.  Next time they open laptop, unable to connect VPN Software.The Fortinet SSL VPN Virtual Ethernet Adapter is disabled.  Simple restart of laptop re-enables card, works again.    100 Users, at any one moment in time, 30 NICs are disabled on average.My best guess, and it is a guess, relates to Power Management on WiFi card.  Windows is disabling WiFi when you put laptop to sleep.  This event disables FortiClient NIC.  Wake laptop up, WiFi enables itself, FortiClient doesn’t.Has anyone seen this before ThanksBryan

Since yesterday morning a lot of websites give a 400 Bad Request ( see screenshot) when DeepInspection is enabled.Disabling DeepInspection fixed the problem.I also saw other issues relating DeepInspection(https://community.fortinet.com/support-forum-92/some-website-not-loading-with-deep-inspection-230891) But this seems to be other. We already have policy in Proxy mode en disabling AV is also not working.We use firmware level 7.4.13. More people have issues with this? 

This article describes how to identify a Supervisor with DB node whose PostgreSQL replica stopped following the database Leader after a failover or switchover. It also describes how to rebuild the replica and how to detect the issue before it affects the cluster.

Fortinet Video Library — October 2026 Roundup Hi everyone, here are 12 full-length videos published on Fortinet’s official Video Library YouTube channel during October, checked through October 30. I’ve grouped them by product and included YouTube and video.fortinet.com links. Shorts are excluded.FortiGate & FortiOSOct. 28 — FortiOS 8.0.1: Configuring Hashed External Feeds to Block WebsitesYouTube | Fortinet Video Library Oct. 27 — FortiOS 8.0: Steering SD-WAN Traffic Based on Underlay BandwidthYouTube | Fortinet Video Library Oct. 22 — FortiOS 7.6.8: Configuring Application Hold Timer to Hold Newly Created Application SignaturesYouTube | Fortinet Video Library Oct. 13 — FortiOS 8.0: Using IPAM for Dual-Stack IPsec VPN Remote Endpoints' IPv6 Address AssignmentYouTube | Fortinet Video Library Oct. 8 — FortiOS 7.6.7: Enabling NPU Offloading for IPsec VPN over VNE Interfaces to Improve PerformanceYouTube | Fortinet Video Library Oct. 6 — FortiOS 8.0.1: Configuring User-Defined Applicat

Product: FortiGate-80F-POE, S/N FG80FPTK24000713 Firmware: FortiOS v7.6.8 build3744 (GA.M); IPS Engine 7.01200; AV Engine 7.00062 Severity: 3 (business impact, workaround available)SummarySince Windows clients started sending hybrid post-quantum key shares (OpenSSL 3.5+, Chrome/Edge), TLS 1.3 handshakes from Windows hosts through our FortiGate time out. The ClientHello (~1.5–2 KB) is split into two TCP segments. For sessions without the TCP timestamp option (Windows default timestamps=allowed), the FortiGate ACKs the second segment to the client on behalf of the server. It then retransmits that segment on wan1 about 6 times, and the server never acknowledges it. The handshake hangs until the client times out (FIN from server after ~15 s, or RST after ~35 s).macOS clients (TCP timestamps on) are unaffected through the same policy, with the same NAT IP and destination, and even with a byte-identical ClientHello split at the same offsets.This looks related to KB “ERR_SSL_PROTOCOL_ERROR wh

Hello team,I am using FortiAuthenticator Tacacs+ server. It is working with Cisco but not with Nvdia Cumulus switch. Because Nvidia cumulus switch uses Linux PAM module for Tacacs and it send authorization request first instead of Authentication. There is no setting in the forti Autheticator like”allow authorization before authentication”. But cisco it works because it uses authetication and then authorization. Any suggestion how to allow authorization first in forti Authenticator? Because other Tecacs servers have this option “authorize before authenticate”

Our 700G, running version 7.4.12, is not showing a notification that version 7.4.13 is available (I expect I’ll just update it manually soon). The licenses are valid, and the Fortinet servers are reachable. Do you know why this is happening? Is anyone else experiencing this? 

Hello everyone,I'm not sure if I'll get any help on this topic here, but I'll give it a try anyway.We primarily use FortiClient VPN to establish a VPN connection to our Fortigate via IPsec using SAML.Some employees who do not work in the company, but are mainly in the home office or work on the road, have the Microsoft Global Secure Access Client installed on their Windows devices.With the background of tunneling the Microsoft365 connections and web connections via the EntraID GSA without FortiClient VPN.https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-accessIn exceptional cases, however, these employees may still require an IPsec VPN connection in order to access various VLANs behind the Fortigate.The problem is as follows. The employee can connect to the FortiClient VPN, but the connection is terminated after approx. 10 seconds. Nothing can be seen in the FortiClient VPN for incoming traffic.The FortiClient VPN log files there is nothing use

We have a few switches (124G) which are standalone, but daisy changed together in a loop, one switch per building. This all works. We have 3 ISPs, one in each building. We have two Fortigates, so two of the switches have links to a Fortigate port, one port per ISP. We do this for redundancy. My question is: Should I do any special commands on these standalone switches for hardening purposes? Since at least some of the ports are directly connected to the ISP.Thanks.

I recently encountered and resolved the following issue, and I am sharing the troubleshooting process because the FortiClient error did not immediately indicate the actual cause.EnvironmentFortiClient EMS: 7.4.8 FortiClient for Windows: 7.4.8 FortiAuthenticator: 6.6.9 FortiGate VM: FortiOS 7.4.13 VPN type: IKEv2 IPsec Authentication method: EAP-TTLS User source: LDAP/Active Directory Two-factor authentication: FortiToken managed through FortiAuthenticatorIssueWhen I tried to establish the VPN connection using a domain account, FortiClient returned the following error:EAPPasswordErrorThe authentication process failed, and the VPN connection could not be established.Since I was taking over an existing installation, I was not yet fully familiar with every step of the authentication flow between FortiClient, FortiGate, FortiAuthenticator, and the LDAP server.Troubleshooting performedI initially verified the following points: The FortiGate was reachable from the client’s public IP address.

Hi.We are trying to get all our firewalls upgrading to the latest urgent patches.Forticloud shows our firewalls running 7.6.7 there is a recommended upgrade to 7.6.8, however, when we do the upgrade button, there is only 8.x listed!!!7.2 and 7.4 branches seem fine!Please tell me we don't need to manually patch these 7.6.x boxes?

Hi,can someone explain to me what the FortiAuthenticator-VMS-DR license (HA/DR/Load Balancing node license for FortiAuthenticator VM Subscription, with FortiCare Elite Support) is used for?It is not listed in the Ordering guide. If I understand it correctly, does this license allow for the deployment of a cluster (a second unit)?Zhank you

Hi all,I've been building FortiSOAR playbooks for SOC work and turned the lessons I learned into a free, open-source skill for Claude AI.You describe the playbook in plain English, and Claude writes a complete FortiSOAR playbook JSON export that you can import directly. A bundled Python validator checks the export first for problems FortiSOAR would reject on import (broken step routes, Jinja syntax and similar).Example prompt:"Build a FortiSOAR playbook that runs on alert create, enriches every IP with FortiGuard and VirusTotal, and closes the alert as false positive if all are clean."What it covers:- Alert triage and incident response- IOC enrichment and phishing analysis- FortiSIEM / FortiAnalyzer queries (uses a reference of 7,000+ FortiSIEM event attributes)- Response actions with client approval (manual input) links- PDF / HTML reports generated inside FortiSOAR- Reviewing, debugging or adapting an existing playbook exportIt doesn't connect to your FortiSOAR instance. You import t

Hello Fortinet Community,We are facing a persistent issue with a FortiAP 231K that fails to come online on our FortiGate 60E. Interestingly, the same behavior has also been observed on the replacement FortiAP received through RMA.We would appreciate guidance from the community or Fortinet engineers who may have encountered similar symptoms.EnvironmentFortiGate: FortiGate 60E FortiOS: 7.4.12 Access Point: FortiAP 231K AP management: FortiGate wireless controller Original testing topology: FortiGate -> PoE switch -> FortiAP 231K Replacement AP testing setup: PoE injector -> FortiAP 231K, with a laptop connected for testing and a serial console connection through PuTTYWe have checked the official FortiAP and FortiOS Compatibility Matrix and are investigating the issue using the supported firmware combination listed for the FortiAP 231K and FortiOS 7.4.12.Issue ObservedThe FortiAP boots successfully but does not come online or establish a stable CAPWAP connection with the FortiGat