Fortinet Community

Hello Fortinet Community,I have an HA cluster with two FortiGate 1800F units FortiOS v7.6.7. The primary and secondary are communicating, but the HA status shows Not Synchronized because the wireless-controller.wtp-profile table is out of sync.I would like to understand why this specific WTP profile table is not synchronizing between the HA members and whether there is a way to resolve the synchronization issue without manually restoring or copying the entire primary configuration to the secondary.Also, does the wireless-controller.wtp-profile table have any special behavior in HA that would prevent or delay synchronization?Any guidance on the root cause and the safest way to bring the HA pair back into sync without manually restoring the primary configuration would be appreciated.

Hello,Has anyone experienced an Internet access issue after upgrading FortiProxy from version 7.4.9 to a 7.6.x version?We are currently facing the following situation:FortiProxy 7.4.9: Internet access works normally. After upgrading to 7.6.x, Internet access is no longer available (only fortinet domain). We reproduced the issue on a new FortiProxy VM running 7.6.7. We also tested with a clean configuration, using a simple policie. The issue persists.In our case, any version newer than 7.4.9 that we have tested results in the loss of Internet access.Has anyone encountered a similar behavior when upgrading from 7.4.9 to 7.6.x?If so, were any specific configuration changes required, or is there a known issue related to this upgrade path?Any feedback or experience would be greatly appreciated.Thank you.

Hi everyone,Today, I upgraded two FortiGate units in an active-passive HA setup from 7.6.6 to 7.6.7.After the upgrade, I tested HA failover and noticed that the secondary IP did not move to the passive FortiGate as expected.When I downgraded back to 7.6.6, everything worked normally again.Has anyone experienced a similar issue with FortiOS 7.6.7? If so, is there any known fix or workaround?Thanks!

Hello, I am testing dynamic MAP-E connectivity on a FortiGate-100F running FortiOS 8.0.0 build 0167. The Internet service is So-net over the NTT East FLET'S network in Japan. The VNE service appears to be JPIX “v6 Plus.” DHCPv6-PD is working. The FortiGate receives a /56 delegated prefix and the WAN interface receives an IPv6 address derived from that prefix. The relevant WAN configuration is:  config system interface    edit "x1"        set mode dhcp        set role wan        config ipv6            set ip6-mode delegated            set dhcp6-prefix-delegation enable            set ip6-delegated-prefix-iaid 1            set ip6-upstream-interface "x1"            set ip6-subnet ::1/64            config dhcp6-iapd-list                edit 1                    set prefix-hint ::/56                next            end        end    nextend  After applying this configuration, the VNE diagnostic correctly recognizes the delegated prefix and WAN IPv6 address:  end user ipv6 prefix: 240b:10:xx

Hi all, I was looking at quoting the ADOM Subscription License for FortiManager S-Series, but noticed it’s no longer in the current price book and is marked: “End of Order Announcement – Will be removed from 2026 Q3 pricelist.”Does anyone know if this means FortiManager S-Series no longer needs a separate licence for additional ADOMs?If that’s the case, what is the maximum number of ADOMs supported now?Just trying to work out whether the licensing model has changed or if there’s a replacement SKU I should be using.Thanks.

I try to build VPN remote access using ipsec to preparing upgrade my fortigate production from 7.2 to 7.6 on my lab.My fortigate lab use version 7.6.4 and after i create vpn tunnel, the forti client is connected and get the ip address but the client is not able to reach to anywhere. The firewall policy and static routing was working fine.Open case to the fortigate support and they also feel strange with this issue. Someone here can help how to toubleshoot?Here my VPN config===========================config vpn ipsec phase1-interfaceedit "VPN-RA"set type dynamicset interface "port1"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal aes128-sha1set add-route disableset comments "VPN Remote Access"set dhgrp 5 20set wizard-type dialup-forticlientset transport autoset fortinet-esp enableset ipv4-start-ip 10.64.200.20set ipv4-end-ip 10.64.200.50set dns-mode autoset save-password enableset client-auto-negotiate enableset client-keep-alive enableset psksecret

For cost tracking purpose then i need to capture how much data transferred (in and out) from my onprem to the azure and vice versa. Can we capture it from tunnel interface? If yes then can i know how?

Hello,I am consistently unable to activate my FortiGate VM evaluation license,despite multiple attempts using different versions andconfirmed network connectivity. License information:- Serial number: FGVMEVKLM66LZP57- Type: VM (KVM) evaluation license Versions tested:- FortiGate-VM64-KVM v7.4.12, build 2902 (GA.M)- FortiGate-VM64-KVM v8.0.0, build 0167 (GA.F) Observed symptoms:- The “execute vm-license” command (permanent trial) runs normally,  prompts for confirmation, reboots the system, but then fails with:  “curl forticare failed, 28” / “Failed to download VM license.”- The output of “get system status” consistently displays:  Serial-Number: FGVM00UNLICENSED  License Status: No License / Invalid Diagnostics already performed:- Internet connectivity confirmed (pings to 8.8.8.8 and 1.1.1.1 are working,  0% packet loss)- DNS resolution working (resolution of fortiguard.com confirmed)- Network capture (diagnostic packet sniffer on port 1 ‘TCP port 443’) showing a  complete TCP handsha

Hello,I took the recertification assessment. I completed the course and passed the exam, but my certificates have not been updated. It shows that they are set to expire on September 21.What should I do?Thank you for your help.Best regards,

https://cybersecuritynews.com/hackers-selling-fortinet-fortigate-1-day-vulnerability/Do we know if there's any truth behind this claim?  

Hi all,Independent security researcher here (published CISA advisories, ICS/OT focus). I'm building out a local lab with various Fortinet VM images for firmware analysis and vulnerability research.I've been able to pull FortiGate, FortiAnalyzer, FortiManager, FortiADC, FortiWeb, and FortiFirewall KVM images through the standard support portal with a basic FortiCare account. However, I'm hitting a wall on products that require an active support contract to download:- FortiProxy (FPX_KVM)- FortiMail (FML_VM64_KVM)- FortiSandbox (FSA_KVM)- FortiSIEM- FortiNDR- FortiDDoS-FA few questions for the community:1. Is there an evaluation or researcher program that provides access to VM images for these products? I've looked at FNDN but haven't dug deep enough yet.2. For anyone doing RE on FortiProxy or FortiMail specifically - where did you start? Any recommended tooling, known filesystem structures, or resources (Fortinet Gurus, writeups, etc.)?3. Has anyone used the FortiSandbox or FortiSIEM KV

This was working fine until I upgraded the firmware to v8.0.0 B0167.  It’s an IKEv1 using 3DES/SHA1 both phases.  Now this one particular node will not connect. ike V=root:0:IPSec2xxxx:IPSec2xxxx: IPsec SA connect 5 xxx.xxx.xxx.xxx->xxx.xxx.xxx.xxxike V=root:0:IPSec2xxxx: ignoring request to establish IPsec SA, no policy configured 

Hi Everyone,We have a predefined list of company-owned MAC addresses. We want FortiNAC to classify devices whose MAC addresses are in this list as Company Devices, while devices whose MAC addresses are not in the list should be classified as Personal/BYOD Devices.After classifying the devices into these two groups, we would like to apply different compliance policies to each group based on their device ownership. What is the recommended way to implement this in FortiNAC 7.6.x?

 Dear Community Team,Could you please confirm the current Product Lifecycle status of the FortiSwitch FS-124F-POE?Specifically, I would like to confirm: Has an End of Order (EOO) date been officially announced for the FS-124F-POE? Has an End of Support (EOS) date been officially announced for this model? Based on Fortinet's current Product Life Cycle Policy, what is the expected remaining technical support period for the FS-124F-POE, and will technical support, FortiCare services, firmware updates, and security fixes remain available for at least the next three years? Is there any official Fortinet document confirming the above lifecycle and support period? The units under consideration are FS-124F-POE manufactured in 2025.I would appreciate an official confirmation and, if available, a link to the relevant Fortinet Product Lifecycle documentation.Best regards,

We are trying DOT1x auth via AD user .Endpoint going in dot1x process and Cisco Switch forward the request to Fortinac but the authentication process is not completing .Continuously showing “RADIUS not enabled on device”.

I have 2 cisco switch managed by fnac and i add the 3rd cisco switch.After i configure the dot1x on the 3rd switch then the authentication is rejected with below errorWhat mean of RADIUS not enabled on device? IN the inventory the RADIUS was enabled. 

​mailfilterd stuck at ~100% CPU, FortiMail 8.0.0 build 183 — cause unclearFortiMail 8.0.0 build 183. mailfilterd sits at ~99.8% CPU continuously (not a spike), RSS grown to ~1.5GB (baseline is usually ~100MB). All other processes idle. Session count (24–50) and bandwidth are normal, so it's not a traffic flood.Enabled diagnose debug application mailfilterd level 8 + duration 30 and pulled the Trace Log. The only thing logged for 10 minutes was:FmailAIClient.cpp:931:ping():entryrepeating once a minute, on a single thread, with no other activity captured — looks like a routine heartbeat, not the actual hot path.I can't figure out what's actually causing the 100% CPU. Any help would be appreciated.

Hi Fortinet Community,I have a question regarding FortiToken Mobile and MFA recovery.I currently have more than 30 FortiTokens installed on my FortiToken Mobile application for different FortiGate/FortiAuthenticator accounts.My concern is the following:If my mobile phone is lost, damaged, reset, or becomes unusable for any reason, I may lose access to all of these tokens. In that situation, I would not be able to use the FortiToken Mobile app to generate OTPs and could potentially lose access to the protected accounts.I would like to know:Is there any official backup or recovery mechanism for FortiToken Mobile? Can FortiTokens be restored on a new phone if the original phone is lost or damaged? Is there any way to synchronize or back up FortiToken Mobile tokens securely? Can FortiGate/FortiAuthenticator MFA use Google Authenticator instead of FortiToken Mobile? Can Microsoft Authenticator be used for FortiGate/FortiAuthenticator MFA? Is it possible to configure MFA using TOTP in a way

ScenarioEnvironment with multiple FortiGate firewalls connected to a FortiAnalyzer VM for centralized log collection and analysis.Environment VersionsFortiAnalyzer VM: 7.4.11FortiGate: 7.2.13Fabric ADOM enabledSome FortiGate devices operating in HA cluster modeAfter upgrading the FortiAnalyzer from version 7.4.6 to 7.4.11, the FortiGate devices stopped displaying FortiAnalyzer logs directly from the FortiGate GUI.SymptomsWhen accessing logs from the FortiGate GUI:Log & Report → Forward Traffic / Event Logsthe page remained completely blank.However:FortiAnalyzer continued receiving logs normallyDevices remained online in Fabric View / Device ManagerLogs were visible directly in the FortiAnalyzer GUINo explicit communication or authorization errors were displayedAdditionally, the following behaviors were observed:Analytics (actual/config days) above 100%Archive Usage above 90%diagnose dvm device list showing:conn: unknownconf: unknowndev-db: unknownThis initially suggested a possible

Hello Team,Following a recent electric power outage, HA FortiGate 201G v7.4.11 build2878 (Mature) cluster displayed the attached alert:“File System Check Recommended"Both units in the HA cluster are synchronized and operating normally,What is the recommended best action to handle this alert in an HA environment?Appreciate your guidance to ensure system stability and prevent potential disk issues. Thank you,

Is it possible to modify the landing page when you open the client to be the Remote Access Tab with it defaulting to a specific connection? The policy calls a profile that has both IPsec and SSL vpn. Wanted to push users to start using the IPSec connection and would be simpler if they just opened the client to that section rather than having to explicitly select the IPsec vpn connection. 

After I upgrade our FGT 100F from version 7.2.13 to version 7.4.12, I started having connectivity issues with some of our internal services.  And since I did not have time to troubleshoot the issue we had to revert back to version 7.2.13...Has anyone had this experience before?  Thanks !

Hello Team I want to know for which conditions FortiGate can be blocked because of the licences? 

We are in the process of switching to fortigate and fortiap, : we have an environment that we are testing on and the radius server is a Microsoft NPS server, when we use user certificates, the dynamic VLAN works, and the user ends up on the VLAN that the NPS provides, but if we set it so that via the policy it is the machine certificate that is to be used, then the client is not moved to the VLAN that the NPS says, but the client remains on what you can say "onboarding" the VLAN, so the CEO can be the difference from the user that works but not when the machine does not?

I've been requested to stretch a few VLANs across our two networks. Both networks live on the same Fortigate as different VDOMs. Each network has their own storage cluster, which our sys admin has requested I stretch their VLANs across to each other over an L2 connection as it would be faster than L3.Anyway, I'm not sure exactly how to accomplish this. None of the VXLAN diagrams look exactly like my setup. I'm thinking a VWP on the FG between two ports assigned to each network, but not sure where to go from there.Any help would be much appreciated. Also if this is a dumb idea please let me know that too.