Fortinet Community

Privileged Access Management keeps getting more demanding. Between hybrid cloud sprawl, contractor and vendor access, and regulatory pressure to prove least-privilege everywhere, PAM platforms have to do a lot more than just vault a password anymore. Fortinet's latest release,FortiPAM 1.9.0, reflects that shift — it's a substantial update that touches secret launching, Just-In-Time privilege, identity federation, network architecture, and hardware scale all at once.Here's a breakdown of what's actually new, and why it matters if you're running (or evaluating) FortiPAM.Secret Launch & Session ImprovementsThe bulk of this release is focused on how secrets get used — not just stored.TCP forwarding for native RDP. Native RDP launches can now route through TCP forwarding instead of the standard native path. This exists mainly to work around real-world friction: certificate revocation check failures, legacy/3rd-party RDP servers that only speak plain-text RDP, and RDP protocol changes th

UNAUTHORIZED Your account cannot be found. Your email address () is not associated with our Customer Service and Support site account. Make sure you use the correct email address or register your account on our Customer Service and Support website by clicking the "Create new customer account" button below. Code: A02E03-151   I want to learn, but my account doesn't exist, yet it lets me log in, and I can't even create another account.

Is anyone able to provide me with the firmware for a Fortinet 60F firewall?

Hello buddies,I’m new to the Fortinet community and would like to start learning how to properly configure and manage FortiGate.My goal is to set up a small hands-on lab where I can learn about firewall policies, VLANs, VPNs, web filtering, and basic network security without affecting the production environment.Could you recommend a learning path, course, documentation, or lab setup suitable for beginners? Would FortiGate-VM be suitable for this purpose? What networking knowledge should I have before getting started?Thanks for any guidance or recommendations here. 

I hve a FortiGate 60F and when I console to it I have a message that Password reset functionality is disabled.  WhenI try using maintenance mode or the hard reset button it does not working.  What options do I have to get in this device?  If I have to reset it fully I will as long as I can get into it.

Securing AI at Runtime: Closing the Gap Between AI Adoption and SecurityAI adoption is accelerating across the enterprise. Organizations are using private AI and large language models (LLMs) for software development, research, workflow automation, customer engagement, and other business-critical applications.But as AI moves from experimentation into production, security teams face a growing challenge: traditional security controls were not designed to understand how AI applications process prompts, data, and model responses. Organizations need a security approach that can protect AI workloads while allowing teams to continue adopting the technology at scale.AI Adoption Is Creating New Security RisksMany organizations begin with small AI pilots before expanding AI into critical workflows. As deployments grow, however, the security requirements become more complex. Security teams need to understand who is using AI, what information is being submitted, what the model can access, and what

Hey everybody I'm new . currently I'm working as a desktop engineer and I'm planning to start studying. In a fortigate firewall now can anyone tell me where to start this course any free resources youtube channel n all. 

Hello,I would like to ask if anyone has experienced a similar issue with FortiOS 7.4.12 build 2902.I have a FortiGate 100F, and I upgraded FortiOS from 7.4.11 build 2878 to 7.4.12 build 2902.Before the upgrade, I had configured a Traffic Shaper to be applied only to the **SNS (Social Networking) category** in Web Filter.After upgrading to FortiOS 7.4.12 build 2902, the Traffic Shaper was unexpectedly applied to **all web traffic**, not only the SNS category.The configuration itself appeared to be unchanged.I then disabled the Traffic Shaper and enabled it again. After doing this, the Traffic Shaper returned to the expected behavior and was applied only to the SNS category.The sequence was:1. FortiOS 7.4.11 build 28782. Upgrade to FortiOS 7.4.12 build 29023. Traffic Shaper unexpectedly applied to all traffic4. Disable the Traffic Shaper5. Enable the Traffic Shaper again6. Traffic Shaper correctly applied only to the SNS categoryHas anyone experienced a similar issue with FortiOS 7.4.12?

Forticlient ipsec dialup vpn setup in andriod mobile

Is there a way to view the camera serial number form the FortiRecorder?If not?  How can I retrieve the camera sn? Thanks & appreciate the help..  new to the Fortirecorder/camera Cheers! 

Hello, I would like to know if it is possible to force a check for a new version. The issue is that it takes a few days for my EMS in Europe to detect a new version once it is released in the US side. Is it possible to trigger the check or download it manually via the GUI ? There is a workaround via the CLI using an SCP transfer but it’s not the simplest method. Thanks

Hello Experts, we are looking at migrating our existing FortiAuth and FortiManager to a new VM on Vmware and re-ip both of them (currently sitting HyberV), havent done this before and would appreciate some insights on how i can perform this and roll back in case something happens.FortiAuth - things to consider to migrate from hyperV to vmware and re-ip FortiAuth, backup config process and tokens etc, if we can restore the entire VM from HyperV not sure if thats an option etc. FortiManager - move to vmware from hyperv and re-ip it, things to consider and migration process and sync back all other site fortigate boxes and perform tests etc.Thanks,KD

I have deployed FortiAnalyzer-VM64-KVM v8.0.0 build 0105 (GA.F) on Proxmox VE 10.1.2.VM configuration:CPU: 4 cores RAM: 8 GB Disk: 4 GB system disk + 100 GB scsi1 Machine: Q35 SCSI controller: VirtIO SCSI Single Network: VirtIO → vmbr0 Proxmox host IP: 172.20.69.14/24 FortiAnalyzer port1: 172.20.69.51/24 allowaccess: ping https sshProblem:FortiAnalyzer boots successfully and console login works. get system interface port1 shows port1 UP with 172.20.69.51/24. From the Proxmox host, ping 172.20.69.51 works. HTTPS port 443 is reachable. curl -k https://172.20.69.51/ returns HTTP 301 to /faz-webapp/ui/. curl -k https://172.20.69.51/faz-webapp/ui/ returns HTTP 200 and the complete HTML/JavaScript page. Static JavaScript files also return HTTP 200. However, accessing https://172.20.69.51/faz-webapp/ui/ from a browser results in ERR_CONNECTION_TIMED_OUT / page keeps loading. Another FortiAnalyzer/FortiGate at 172.20.69.50 is accessible normally from the same network.Relevant FAZ status: Platf

Hi, We are having issues to install the latest FortiClient VPN on macOS, because there was an older version installed that we are unable to delete. Is there a proper uninstall guide like the Windows for macOS? one? https://community.fortinet.com/t5/FortiClient/Technical-Tip-Uninstall-of-FortiClient-software/ta-p/191604 Thank you. Kind regards, Ruud

I installed the free FortiClient VPN agent on my mac and it has a small lock icon on it.  I need to uninstall and start over with this because it is not properly installed.  Any help is appreciated.

Hello, we updated to FortiSOAR 8.0.0 and when i try to edit sudo vi /opt/cyops-integrations/.env/pip.conf to add pypi.org as an extra-index-url we can’t i get [readonly] we tried to add an override flag but nothing is working under sudo -u fsr-integrations or root user, we need to add an extra index for deps since https://repo.secops-content.forticloud.com/connectors/pip312/deps/simple/ does not have everything and i don’t want to do CLI installation for each dependency.

I am trying to install the FortiClient VPN on my mac (macOS 15.5)I get the following error - however, when navigating to the open Security & Privacy Settings I don't see the FortiClient.I only see the following in my network extensions. The only place, I see Fortitray is in my VPN panel. However, there I cannot toggle it to enable it. I tried to see other post, but none of them seemed to fix it. Do you guys maybe know the solution to fix this?Thanks  

 HiCould you help me solve this problem, the following image appears when I want to make a VPN-SSL connection through forticlient on a MacOS computer, from what I see it may be issues of permissions to a process, but if someone can help me explain more in depth why the problem occurs, I would appreciate it Reggard

I’m currently considering transitioning our firewall and VPN solution to Fortigate. I’ve used Fortigate VPN in the past and found it to be reliable. However, a colleague recently mentioned that the VPN client may not perform as well on macOS and Linux systems compared to Windows.I’d appreciate hearing about your experiences with Fortigate VPN, particularly on macOS:How stable is the client on MacOS?Have you encountered any compatibility or performance issues?What has your experience been like managing the client on both Windows and macOS systems?Any additional feedback or insights would be greatly appreciated.

The problem on the macbook on the M1 Mac OS. During the connection, a message that Forti asks for access to the Key of the System and so, cut it up to the MFA and three times after, terribly annoying the same password 6 times. Tell me how to fix it?

In my case, I installed the application on a separate server. Follow the instructions to install ithttps://www.elastic.co/docs/deploy-manage/deploy/self-managed/installing-elasticsearch Change the Elasticsearch server settings in the file:/etc/elasticsearch/elasticsearch.yml=========Replace the values:node.name: nameofyourhostcluster.initial_master_nodes: ["nameofyourhost"]network.host: 0.0.0.0http.port: 9200add the line:action.auto_create_index: .monitoring*,.watches,.triggered_watches,.watcher-history*,.ml*==========Add the password. Create the file with password in any good directory (create the directory)nano /opt/elasticsearch_password/elasticsearch_password.txt change user access to the file:chown elasticsearch:elasticsearch /opt/elasticsearch_password/elasticsearch_password.txtchmod 600 /opt/elasticsearch_password/elasticsearch_password.txt restart the service:sudo systemctl set-environment ES_KEYSTORE_PASSPHRASE_FILE=/opt/elasticsearch_password/elasticsearch_password.txtsudo sy

Hi everyone,I’m working with FortiADC 7.6.4 and would like to ask about a couple of CLI commands. If anyone has information, I’d appreciate your help. 1. Checking interface link status    Is there a CLI command that shows the actual link status of an interface?    According to the documentation, the command    "get system interface"    only provides the enabled/disabled status, so I understand it does not show the real-time link state.     I also looked at the following command:    "diagnose hardware get deviceinfo nic-detail"    which appears to offer detailed NIC information, but it does not show the link status for aggregated (LAG) interfaces. 2. Deleting backup configuration files    I know that configuration backups can be created using:    "execute restore config disk <name>"    However, I haven’t been able to find a CLI command that deletes configuration backu

Hi!I’ve been testing Fortinac 7.6.7 in lab. It seems, that they did major changes to the RADIUS configurations. Changes are welcome, if you have not implemented Fortinac yet, but for existing installation, it might cause some work.I have been told, that  nothing changes when I’m using Fortinet only devices (Fortigate, Fortiswitches and FortiAPs).That’s not true, if you are using RADIUS (in practise 802.1x)Or we can say, that nothing changes in 7.6.7 for existing devices, but if you are going to add new devices, you have to use the new selector based method. And later you have to migrate all existing devices.(https://docs.fortinet.com/document/fortinac-f/7.6.7/support-for-radius-only-devices/276659/overview)You have to migrate all existing devices to the new method before future release, because the support for the legacy method will be removed. There is a great migration tool, but it creates individual configurations for every device. It works, yes, but is quite a big mess.Missing best

Hi Team,We are using FortiClient EMS-managed IPsec Remote Access VPN (IKEv2) with split tunneling.Our FortiGate Phase 1 is configured with:mode-cfg enableipv4-split-include containing only RFC1918 networksNo full-tunnel configurationAfter connecting, the Windows routing table shows two default routes:0.0.0.0/0 -> 192.168.1.1   Metric 40   (Local Gateway)0.0.0.0/0 -> 10.68.1.14    Metric 9001 (VPN Gateway)The local gateway has the lower metric, so Internet traffic should continue to use the local ISP, which appears to be working correctly.However, we occasionally observe some Internet-bound traffic in the FortiGate traffic logs from VPN users, even though only RFC1918 routes are configured in the split tunnel.My questions are:Yes, this is expected behavior. FortiClient installs a secondary default route with a very high metric as part of its standard IKEv2/IPsec split tunneling implementation. This route acts as a fallback or "trap" route and does not override the primary local ga

Environment: FortiGate-VM64-OPC on OCI, FortiOS 7.6.7, A-P unicast HA, ha-mgmt-status enabled on port1 (reserved management interface, config ha-mgmt-interfaces with its own gateway).Two related issues, same root cause suspected:1. FortiToken Cloud MFA fails when logging into a unit directly via its own management IP - works on one unit, fails on the other. Traced to: the unit whose management interface needs to reach FortiGuard/FortiToken Cloud for validation has no outbound path. Confirmed via execute ping-options source <port1 IP> + ping 8.8.8.8 -> 100% loss, on both HA members (tested independently, not just the HA secondary).2. Separately, our OCI SDN connector (used for HA VIP failover) never completes the "refreshing IP info of instance / checking secondary ip" step in its debug output - it finishes generic resource inventory and just loops, never attempting the actual private IP move. Wondering if this is related to the same interface/routing gap.What we've confirmed:-