Fortinet Community

Hello everyone,I have a FortiPAM version 1.5.0 and I’m looking for a way to restrict access to passwords that are shown in clear text for users who are allowed to launch a secret. BR,

Dear Expertise,I would like to ask you about the issue "could not produce the expected behavior" as follows,so I would like to ask for your guidance on what settings are required to control uploads.■ Settings1. Set Application Control With Inline-CASB ⇒ Categories ⇒ "Storage.Backup" to Block.2. Set Application and Filter overrides ⇒ "OneDrive_File.Upload" to Block.As urgent confirmation is required, we would greatly appreciate it if you could respondas soon as possible,despite your busy schedule.##Additional information##・Already set "DeepInspection"・Already applied "SecurityProfile" due to the relevant policy・Excluding below list in the "URLFilter" settings     *.onedrive.live.com     *.live.com    *.api.onedrive.comThanksRegards,Inoue

As modern networks continue to expand across distributed branches, hybrid workplaces, and cloud-connected infrastructures, the operational burden on IT teams is only intensifying. Alert fatigue, complexity in troubleshooting, and gaps in wireless visibility often delay remediation and drive-up operational costs. With FortiAIOps 3.0, Fortinet set a new benchmark—moving network operations from reactive fault monitoring to predictive, context-aware intelligence. Now, with the release of FortiAIOps 3.2, this evolution goes even further. FortiAIOps 3.2 introduces a suite of advanced capabilities designed to strengthen wireless intelligence, automate resource optimization, and deliver deeper end-to-end visibility across both infrastructure and client experiences. Enhanced AI-driven analytics, richer Wi-Fi insights, and expanded monitoring ensure that IT teams can troubleshoot faster, anticipate issues earlier, and maintain higher service quality across the board. Let’s explore what’s new in

Good afternoon.  My question is pretty simple:  I've used Fortigates (although it has been a while.)  I want to create a personal lab for practice and certification purposes.  Does anyone have a suggestion on how to get this accomplished?I do have an Azure account. Support from the sales team at Forti has not been forthcoming.Any help is appreciated! Thanks in advance

Hi!As I understand, "port_ha" is virtual manifestation of physical "ha1" or "ha2" (depending on priority), so, why am I seeing its drops counter increasing but not either of latter?<node_redacted> (root) # diagnose netlink device list | grep port Inter-|Receive |Transmit face |bytes packets errs drop fifo frame compressed multicast|bytes packets errs drop fifo colls carrier compressed : port_ha: 59307243213 183676419 0 268802671 0 0 0 0 |2695447833533 2029323361 0 1 0 0 0 0 : | ha2: 442088029516 531221403 0 0 0 2 0 4059668 |2709586459181 2051768332 0 0 0 0 0 0 ha1: 43740481445 77620950 0 0 0 0 0 2989697 |13166888759 21729664 0 0 0 0 0 0 : |Thanks!

Hi,I am unable to log in to the FAC via the GUI. Authentication is working however GUI access is not working cu. I can access FAC via CLI.  Farooq  

Network ScenarioI have a router that terminates VPN connections and a FortiGate firewall behind it. Behind the FortiGate, an internal VLAN contains multiple servers.VPN users can successfully connect to the router-based VPN and get an IP address. After connecting, the user can ping the VLAN gateway interface on the FortiGate, but cannot ping or SSH to the actual servers inside that VLAN.Current ConfigurationOn the Router:Static route added for the internal server network pointing to the FortiGate.On the FortiGate:IPv4 policy created to allow traffic from the VPN subnet to the server subnet.NAT is disabled.Problem DescriptionVPN users can reach the FortiGate VLAN interface IP (gateway).VPN users cannot ping or SSH to any individual servers in that VLAN (request timed out).What I’m Trying to UnderstandCould this be a return path issue from the servers?Do I need additional static routes on the FortiGate or on the servers’ gateway?Question to CommunityWhat configuration is typically requir

Hello All,I hope you're doing well.I have this error ([1186] fnbamd_ldap_parse_response-Error 1(000004DC: LdapErr: DSID-0C090D93, comment: In order to perform this operation a successful bind must be completed on the connection., data 0, v4563))  on ldap debug when i try to access one of my sites through IPSec VPN from FortiClient.I use an AD account for authentication. For the bind type, It's Regular. please what is the issue ? 

Hi there, I've configured a DPI (with CA-cert etc) and web-filtering profile (proxy-based) successfully on FortiGate, with web-filtering configured to block access to streaming category. These profiles are applied to a proxy-based security policy.  The policy is working great, however some streaming sites are accessible for users, i.e. Crave.ca. Digging into the logs I can see the URL for the site I want to block but is accessible by the user isn't appearing in the URL field, but is appearing in the referralurl field. The FortiGate matches the URL field entry to an allowed category (i.e. 'Search Engines and Portals'). Is there a way to apply web-filtering to referral URLs as well? Also, this behaviour is only see by FortiClient VPN users. Non-VPN users (i.e. inside) behind the FortiGate are blocked as expected for the same sites which appear as referral URL for FortiClient VPN users. Wondering why this is? Security policy is configured the same in both cases.&n

Hello, some of our MacOS users are experiencing issues accessing servers within the office network when connecting via VPN. The problem is that the network range in the office is the same as their home network, like 10.0.0.0/24.To ensure access to office servers on these users' MacOS devices, routing must be configured correctly, but the address assigned to the VPN client by FGT is dynamic from the specified range.Another issue is that users are authorized in FGT through their Entra ID accounts (SAML authentication with Entra ID is configured in FGT). It seems this article (https://community.fortinet.com/t5/FortiGate/Technical-Tip-Reserve-SSL-VPN-client-IP-addresses-without-an/ta-p/367799) is not applicable in this case, since the VPN portal only allows you to specify a local FGT user, either RADIUS or LDAP, but not a user authorized via SAML from the external cloud identity.Unfortunately, we are currently unable to change the address range of the office network or connect a third

Hello team!! In one of our fortigates I need to create different security profiles based in the Entra ID user.I am trying to follow this, but I have many doubts:https://docs.fortinet.com/document/fortigate/7.6.4/administration-guide/33053/outbound-firewall-authentication-with-microsoft-entra-id-as-a-saml-idpThis Fortigate has 7.6.4 In the first explanation, the second point says:"The FortiGate redirects to the local captive portal port (default is 1003), then redirects the user to the SAML IdP."Does this means that the user must write his Entra ID credentials to navigate?Is there a way to use passive authentication? Based in the response, probable I will need to ask more questions Thanks in advance.Regards,Damián 

So I have an VPN tunnel with a client, which is UP, and I revive traffic from him but I cannot respond(I'll attach an image of the sniff) To explain it a bit i have 2 Fortigates, one for public IP's and exterior, where i have the Tunnel, and other for the internal subnets, where i have that subnet 192.168.2.0, and they are connected by that interface "INTERCONET-VPN" which is on port 2. From what i know i did everything for the Tunnel to work( firewall rules in and out, static route for their IP to be routed trough tunnel, nat is not enable for any of the subnets). This is a print of the tunnel if it helpsDo you have any ideas why this happens? 

I'd like to take advantage of this new feature (routing offload) on a pair of 1000-series switches. I'm following the commands listed in the article below, but one of the commands is missing entirely. Its the "set switch-controller-offload-ip <IP_address>" command. Has anyone tried this yet? Is it possible this feature requires the "Advanced Features" license for FortiSwitch? Running FortiOS 7.4.2.Support inter-VLAN routing by managed FortiSwitch units 7.4.1 

I need a way to tie user activity with the fortigate firewall logs.  I have source IP information but I need a way to also collect which AD user is doing that.  I have looked at some of the utilities on the download page but those look like SSO type things.  I dont need users to sign-in or authenticate, but I do need the log files to show per-user activity.  We are using 70F's on 7.6.4 firmware.Palo Alto Networks products allow this with either a USER-ID agent or CID setup.  I need the fortinet equivalent.

Hi all,I am running A-P cluster of FortiGate-200F with FortiOS 7.2.10 connected to management network consisting of Juniper EX4400-48T and I am observing:- when node was in secondary and I will failover to make it primary, everything works as expected- when node was rebooted, being secondary and I will failover to make it primary, on switch facing MGMT port I do observe twice hit storm control:Dec 4 11:44:26 EX4400-48T l2ald[38686]: L2ALD_ST_CTL_IN_EFFECT: ge-0/0/19.0: storm control in effect on the portDec 4 11:44:26 EX4400-48T l2ald[38686]: L2ALD_ST_CTL_DISABLED: ge-0/0/19.0: storm control disabled portDec 4 11:49:17 EX4400-48T l2ald[38686]: L2ALD_STCTL_IF_RECOVERY: ge-0/0/19.0: storm control enabled port. Port recovered on 'Clear ethernet-switching recovery-timeout'- manual clearing of storm control Dec 4 11:49:22 EX4400-48T l2ald[38686]: L2ALD_ST_CTL_IN_EFFECT: ge-0/0/19.0: storm control in effect on the portDec 4 11:49:22 EX4400-48T l2ald[38686]: L2ALD_ST_CTL_D

Greetings,I am reaching out for help on how to block malicious PostgreSQL scripts/commands like disabling database triggers, updating and deleting database records targeting PostgreSQL  hosted in a Linux server.

Hi everyone, I had 13 Forti AP 421E, and I just purchased 8 AP 241K. I just found that we cannot manage these APs (both E series and K series) on my same FortiGate 100E. Can I migrate all these AP to FortiEdge cloud? I am not sure 421E is supported on FortiEdge cloud?

I have around 180 IPsec tunnels established using Dynamic DNS for the remote gateway.  The local end is a FortiGate 300E running v7.4.7 build2731.  The remote ends are Digi cellular routers installed on our fleet of transit buses.  As they are located on buses, obviously the tunnels are not up and running all the time, just when the bus is in operation.  At times, the FortiGate seems to miss a Dynamic DNS update which will cause that tunnel not to come up.  In most cases, the record from our DNS provider updates correctly to reflect the buses' new public IP address.  But for whatever reason, the FortiGate continues to try to connect to the old IP address.  If I go into the FortiGate and force it to do a DNS query for the tunnel (generally by changing the Dynamic DNS entry to a different DNS entry and then changing it back to the correct one), the FortiGate will update the address and the tunnel will come right up. So I'm wondering if there i

Hi all, I have around 45 FortiGates 40F-3G4G with FortiOS version 7.2.11 that I registered with a FortiManager-VM version 7.4.7. It happened to me about 6 times that our Fortigates lost part of their configuration after a sudden power outage. All settings for IPSec VPNs disappeared, together with policy and static route that were referencing them. Among settings that remained are central management address and tunnel interface that was associated with the VPN: Interfaces list screenshot I'm using the following pre-run CLI script in FortiZTP:config system globalset timezone 29endconfig vpn ipsec phase1-interfaceedit "Administrative"set interface "wwan"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256set localid "{{fgt-sn}}"set dhgrp 19 18 17set remote-gw <HQ_IP_address>set psksecret <PSK>nextendconfig vpn ipsec phase2-interfaceed

Hi All Relatively new to FortiVoice and trying to learn how to use some of it's handy features to make life easier. This May be a noob question but I am stumped so I am asking it.I have the LDAP profile setup on my FVE 2000VM 6.4.4.  Works fine for setting up LDAP authenticated admins. I am a bit lost on how I can use LDAP for extension logins on the user portalMy goal at the moment to create a number with access to the user portal that I can have my On-Call team login to and change the call forward. So instead of using the ext as the login, I figured LDAP would be better.According to this article http://docs.fortinet.com/document/fortivoice-enterprise/6.4.4/fortivoice-cookbook/344148/applying-the-ldap-profile-to-an-extensionI am to use Search User and Try Bind DN, then leave the Authentication ID field empty for my settings.  What I don't know is how I associate the user to the extension. I am guessing this is what the extension&n

I've been searching and searching on the best way to do this.  I need to configure redundant dial in IPSEC VPN for FortiClient users.  Meaning If WAN1's internet is down WAN2 will kick in and work Just like in an SD-WAN failover situation.  I have not been able to find a clear answer on a config to do this.  I know how to implement SD-WAN over IPSEC in a site to site config but there doesn't seem to be a clear config for dial in users using Forti Client.  Any help is appreciated.  

Dear Concerns,Can I perform application-based routing on the FortiGate firewall? I have two ISPs (Primary & Secondary), and I want specific application traffic such as Microsoft Teams to go through the Secondary ISP.I attempted to configure this using a policy route, but there is no option to select traffic based on applications (e.g., if the source is a specific application, the outgoing interface should be the Secondary ISP).   Please guide me on how I can achieve this on my FortiGate.Currently running firmware version v7.6.2 build 3462.

Hi,  I blocked the Social Networking category on the firewall but attempted to exempt one specific site, facebook.com, by adding it to the static URL filter with the action set to Exempt. While this allowed the main site to load, certain elements such as logos and images were still blocked.Upon reviewing the logs, I discovered that Facebook relies on additional content delivery domains (e.g., static.xx.fbcdn.net) to fully render the site. Since these dependent URLs were not included in the exemption, they were automatically blocked by the firewall. After explicitly allowing these domains, the website loaded correctly and became fully functional.The challenge is that the firewall’s static URL filter does not automatically recognize or exempt dependent domains when the primary domain is allowed. Each supporting domain must be manually identified and added to the exemption list. Is there any way we can do this so the firewall automatically recognize it and allow ?

i am using macOS sequioa 15 and when trying to install forticlient vpn, faced issue and can't proceed downloading window takes too much time in downloading then got the error can't connect to update server 

Hi EMS adminsFortiEMS 7.4.4, FortiOS 7.4.8.Knowing that, starting from FortiOS 7.4.x, ZTNA gateway info and 2TNA apps are imported by EMS from FGT automatically.The issue comes when my FGT is behind NAT, so my FGT WAN interface has a private IP.So when I configure ZTNA server on my FGT it must have the private IP of the interface, like shown below.  The when imported automatically bu EMS, the gateway IP is the same, and it is pushed to clients as is.So when off-fabric client's want to access a ZTNA app they us this private IP, which is not possible because they are off-fabric.(In scenarios where the public IP is on the WAN interface all works fine).To resolve my issue I had to manually recreate the ZTNA gateway and all ZTNA apps on EMS, which is lot of work to do just because of this IP address, because imported gateway and apps are not editable on EMS.Do you know any simpler way to resolve it? Like is there a way to keep the auto imported info and just replace the gateway IP