| Solution | Run the following commands on FortiGate CLI: diagnose debug application fcnacd -1
diagnose endpoint filter show-large-data yes
diagnose debug console timestamp enable
diagnose debug enable To disable debug: diagnose debug disable
diagnose debug reset Review the debug output and look for the highlighted lines. 2026-01-26 15:43:03 [sys_handle_dynamic_address_update:1136] Command:update (12)
2026-01-26 15:43:03 [__process_dynamic_address_entries:984] command type:12 addresses entries:2
2026-01-26 15:43:03 Too many entries in all tables of 'firewall.address' in vdom root: 20000 / vdom-max = 20000
2026-01-26 15:43:03 [__process_dynamic_address_entries:1036] address after apply:
[ { "uuid": "35de7ae2-54fe-4498-9805-092d225b39cb", "tag_properties": { "name": "Windows_11_Again_Tag", "type": "zero_trust" }, "type": "ipblock", "values": [ { "start": "10.212.134.0", "bitmap": "3fdbfdefef5bfe0000000000000
000000000000" }, { "start": "172.16.1.0", "bitmap": "880000c000060500184e" } ], "result": "DYNAMIC_ADDRESS_UPDATE_RETVAL_CMDB_TOO_MANY_ADDRESSES" }, { "uuid": "35de7ae2-54fe-4498-9805-092d225b39cb", "tag_properties": { "name
": "Windows_11_Again_Tag", "type": "zero_trust" }, "type": "mac", "values": [ "98:59:7a:c5:cf:74", "ac:1a:3d:69:64:4a", "ac:1a:3d:87:78:b5", "7c:50:79:59:b0:ff", "e4:54:e8:60:f9:ef", "ac:1a:3d:69:64:97", "08:bf:b8:76:ca:88",
"14:18:c3:88:c8:b3", "38:14:28:bc:c5:be", "d8:9e:f3:16:e0:3c", "38:14:28:bc:c5:00", "38:14:28:48:8c:da", "38:14:28:49:1f:7d", "c4:5a:b1:f7:dd:66", "90:8d:6e:be:35:a9", "e4:54:e8:60:ef:c6", "10:a5:1d:fd:ea:30", "a0:29:19:a7:
90:95", "ac:1a:3d:69:64:b5", "14:18:c3:89:4a:d6", "d8:9e:f3:10:20:ea", "ac:1a:3d:69:64:99", "14:18:c3:89:b9:9e", "80:ee:73:f1:c7:20", "38:14:28:bc:c5:f6", "98:59:7a:c7:19:15", "14:18:c3:88:ac:1b", "6c:2b:59:f2:b0:aa", "90:8d
:6e:be:e6:36", "98:59:7a:c5:c9:1b", "ac:1a:3d:69:64:4b", "90:8d:6e:be:d6:ba", "ec:4c:8c:3d:9f:0f", "14:18:c3:89:b9:a3", "7c:10:c9:b7:d3:d1", "70:1a:b8:82:2a:62", "c4:ff:99:fa:0d:fc", "ac:91:a1:c5:09:9a", "98:59:7a:c6:5d:59",
"60:5b:30:75:30:71", "7c:50:79:59:b3:d4", "98:59:7a:c5:c5:47", "e0:2e:0b:0f:f3:8e", "e4:54:e8:73:b2:be", "38:14:28:48:8e:95", "14:18:c3:89:b8:ea", "6c:2b:59:cd:74:ba", "a0:29:19:29:2e:a9", "98:59:7a:c5:b2:05", "b8:31:b5:7a:
dd:55", "bc:6e:e2:fc:f7:f1", "a0:29:19:e2:09:b2", "98:59:7a:c5:b2:5f", "ac:1a:3d:69:64:dc", "14:18:c3:89:b9:4e", "14:18:c3:89:b9:62", "14:18:c3:89:49:8c", "38:14:28:bc:c6:61", "ac:1a:3d:69:64:e1" ] } ]
2026-01-26 15:43:03 [_update_obj_stats:365] Storing (10, MSA-EMS1, 10)
2026-01-26 15:43:03 [ec_ez_worker_process:458] Call completed with failure.
obj-id: 10, desc: "REST API to get updates of tag endpoints.", entry: "api/v1/report/fct/tags".
error info: Error (-1@_tags_uuid_process_result:150). Processing API failed. The cause of the problem above is a failure in processing the API request to update tag endpoints. This error arose because the FortiGate has reached the maximum number of address entries allowed in the 'firewall.address' table for the specified VDOM. The current number of entries is 20,000, which also happens to be the maximum allowed. In some cases the addresses can be generated by an automation stitch (for example, Technical Tip: How to permanently block SSL VPN failed logins using an Automation Stitch), and over time, the accumulated objects exceed the table limits.
To check the maximum value table of the firewall, refer to: Technical Tip: FortiGate maximum values table. To resolve the issue, follow these steps: Go to FortiGate -> Firewall -> Address and check the number of address entries. If the number of address entries has reached the maximum allowed (20,000 in this case), delete some of the firewall addresses to free up space. After deleting the addresses, go to FortiGate -> Endpoint Control -> ZTNA and check if the tags are now visible. Related article: Troubleshooting Tip: ZTNA Tag are not syncing with the FortiGate |
