Fortinet Community

Hello, I have configured FortiNAC-F 7.4.1 to use a guest captive portal for self registration. A FortiGate is configured using radius locally on FNAC. This is successfull in the FGT UI. On FNAC I have role based access enabled for the SSID, and the dynamic VLANs. The Guest modelling config also has registration set to enforced. My problem is that any client trying to connect to the SSID doesn't appear to be authorized to register. Has someone come across this issue before and could point me in the right direction?The error is Registration - Access Deny (Post-Auth) and the client will not be redirected to the captive portal.     

My Fortigate equipment lost its license, so right now, as an emergency measure, I have all traffic open, but when I try to open this site https://psicotest.app/login, the site does not work, nor do other common sites such as fb.com, youtube.com, etc. I have access to all of them, but this one in particular does not work. It should be noted that, outside of this network, the psicotest site works without any problems. Has anyone else had a similar problem? I have already tried different configurations, such as adding it to override, but that did not work either. Obviously, I need a license for the other things to work, but if the traffic is open, everything should work without any problems, right? NatInactivePing

Hello All, There are many firewalls which we have upgraded to 7.4.6M from 7.4.5Mnow issue reported that firewall stuck and production had to reboot the firewall manually.we have checked the logs but nothing showed in Crash logs. 6737: 2025-03-06 18:06:34 msg="Kernel exits extreme low memory mode"6738: 2025-03-06 18:06:34 service=kernel conserve=exit total="1918 MB" used="1555 MB" red="1687 MB"6739: 2025-03-06 18:06:34 green="1572 MB" msg="Kernel exits memory conserve mode"6740: 2025-03-07 14:20:18 the killed daemon is /bin/sflowd: status=0x06741: 2025-03-19 09:41:34 the killed daemon is /bin/dhcpd: status=0x06742: 2025-04-29 10:49:17 the killed daemon is /bin/sflowd: status=0x06743: 2025-05-26 19:19:11 the killed daemon is /bin/eap_proxy: status=0x06744: 2025-05-30 22:10:28 the killed daemon is /bin/sflowd: status=0x06745: 2025-05-30 22:10:37 the killed daemon is /bin/eap_proxy: status=0xd6746: 2025-05-30 22:10:39 the killed daemon is /bin/eap_proxy: status=0x06747: 2025-06-2

Hello Fortinet Community,I’m currently working on automating firewall address object updates in FortiManager via the JSON RPC API. My goal is to programmatically add entries to the dynamic_mapping array of a firewall address object.Here is the structure of the dynamic_mapping entry I am trying to add (simplified example):{"_scope": [{"name": "DeviceName","vdom": "root"}],"allow-routing": 0,"associated-interface": "any","clearpass-spt": 0,"color": 0,"dirty": 1,"fabric-object": 0,"node-ip-only": 0,"obj-type": 9,"route-tag": 0,"subnet": ["10.164.110.0","255.255.255.0"],"type": 0}Error i get:{'code': -10, 'message': 'The data is invalid for selected url'} Could anyone please advise what might be missing or incorrect in the payload format for dynamic_mapping? Are there any known quirks or additional required fields? Any examples of a working dynamic_mapping update via API would be greatly appreciated.Thanks in advance for your help!Its part of a script what checks automatic interfaces

Hello, we are preparing the FG90G models to substitute the FG81E cluster. Right now we have 7.4.7 and I was able to enable SSL VPN por CLI. Since we are using 50 FortiTokens (no Cloud Tokens) for the SSL VPN right now I guess we have to transfer them via the Fortinet Support to the new models. > I guess we cant copy the user with the Tokens to the new model and I am preparing to configure them via LDAP as new users and later assign them the FortiTokens I will get via transfer. I dont think there is a better way, no? > There will be no more SSL VPN for this model since we tested with 7.4.8 and I could not enable SSL VPN. Since we have to start over with all users because of the Token we will have to change to IPSec and start over with PSK. I dont think there is a better way, no?> One thing I still have not figured out is the problem with the SSL connection from users behind customer firewalls. So far we have not localized an actual user with this problem but it c

Hi Everyone, Can anyone tell me that which Fortinet firmware used to do intervdom lab in Fortinet trial license's.I.e. which OS version can i use to do vdoms lab. Thanks.

Hi Team,I deployed two FortiGate firewalls in HA (Active-Passive) ELB/ILB through Azure Marketplace. Configured IPSec remote access VPN using the wizard, created user, policy, and allowed ports 500/4500 in the external load balancer.VPN is not connecting. Please help if any additional config is needed, or share any working reference link.Thanks,Krutibasa 

Hi  im trying to use two switches on 60F fortilink ports a and b.  The problem is only one switch is showing on port a.  Switch on port B is not showing.  Help please thz

Hi guys, I already completed and passed FCP - FortiGate Administrator exam last December 2024 and I am planning to take the FCP - FortiManager Administrator to complete the FCP - Network Security certification. But my question is, what is the duration in taking the exams? Should I just complete the exams for FCP within a year? or less? THank you. 

Hi everyone,In a few days we had some problems with FortiGate that stopped the log system and traffic; after that, the network communication was blocked, and to work normally, we had to reboot.The crash log is that of this day.2544: 2025-06-21 04:53:42 the killed daemon is /bin/updated: status=0x02545: 2025-06-21 04:53:42 the killed daemon is /bin/cloudapid: status=0x02546: 2025-06-21 04:53:43 the killed daemon is /bin/cloudapid: status=0x02547: 2025-06-21 04:53:45 the killed daemon is /bin/cu_acd: status=0x02548: 2025-06-21 04:55:13 the killed daemon is /bin/updated: status=0x02549: 2025-06-21 04:55:13 the killed daemon is /bin/cloudapid: status=0x02550: 2025-06-21 04:55:15 the killed daemon is /bin/cloudapid: status=0x02551: 2025-06-21 04:55:17 the killed daemon is /bin/updated: status=0x02552: 2025-06-21 04:55:17 the killed daemon is /bin/cloudapid: status=0x02553: 2025-06-21 04:55:18 the killed daemon is /bin/cu_acd: status=0x02554: 2025-06-21 04:55:18 the killed daemon is /bin/upd

Hi,we are trying to set up an Hub and Spoke VPN where Spoke have firmware 7.4.8 while Hub has firmware 7.2.11 We found some problems with these versions, while seems to work with spoke with firmware 7.4.7 We got troubles when we set up these flags: auto discovery receiver -> ENABLEDdevice creation  -> ENABLED on the spokes Are there any bugs with latest firmware 7.4.8 ?Are there minimum requirements with Hub firmware versions to support Spoke with 7.4.8 firmware? Thanks

our org has several sites using FortiGate's. We have started having Connectivity issues while using non-domain routable SSIDs. This being from the local WiFi Radio. Complaints seem to have coincided with the 7.2.11 firmware upgrades last week. Nothing in the release notes for 7.2.11 regarding known issues for WiFi/DNS. Some things I've tried where to edit the WiFi settings (2.4Ghz > 5Ghz, TX/RX power set to 100%, etc.) I've also tried manually setting DNS on those interfaces to 8.8.8.8 and 8.8.4.4 rather than using system DNS (FortiGuard DNS)

Hi all, I am attempting to build a Fortinet Lab. I have a FortiGate version 7.6.1 and FortiManager 7.6.2. Both devices are using trial licenses.  When attempting to add the FortiGate to the Manager, I am getting a "probe failed" error.  On the FortiGate I have FMG-Access selected, I configured the ENC-algorithm to default On the FortiManager I configured ENC-algorithm to low and fgfm-ssl-protocol sslv3 When attempting to add the FortiGate to the FortiManager from the FortiGate Security Fabric -> Fabric Connectors I get the below error Any assistance will be greatly appreciated  

Can we create a VLAN in fortigate firewall, let say VLAN 100 and assign VLAN 100 to port1 and port2?

Hello Everyone, I am wondering about Fortigate with NAC license vs FortiNAC for OT device discovery and if there is any comparison ?  I know that Fortinet OT Security Service for Fortigate is for OT attacks and that for OT device discovery FortiNAC that is connected on layer 2 with the OT environment is needed as to be able to see arp, dhcp, dns, etc. and other OT related information but what about Fortigate with NAC license connected with fortilink to Fortiswitches?  From what I have found as info FortiNAC has better Advanced with profiling, behavior analysis for OT devices compared to FortGate with NAC license. But Maybe I am wrong ? I also think you can't stream logs to FortiNAC from Fortigate as so the FortiNAC to not be layer 2 connected to the OT environment which is a limitation if the Fortigate is already layer 2 connected and thus the FortiNAC also needs layer 2 connection even if Fortigate is already layer 2 connected but I could b

Hey! Sure my topic is a no-brainer for most here, but bare with me as this is all really new to me.I've got an assignment to take a subnet from our ISP and bridge/distribute it endpoints in a LAN.In the LAN some are in need of external IP's and some are not. Those who don't need externalsI can handle fine with simple NAT. However I'm alittle lost as to what to do with the external ones and how do I make the FortiGate play along.The endpoints set a static ip we agree on from the ISP subnet and I need to organise the endpoints flowcorrectly with the FortiGate, but this is where I'm at a loss. Like what steps to take and so on. Any help would be much appreciated!Using FortiLink if that makes any difference by the way. Thanks!

After the update to 7.6.3 and losing SSL vpn, I've been trying to get a new IPSec vpn setup but have been having two issues. First and most importantly, here's the setup of the network: IPSec Config: Policies: Now the issue: I can successfully connect to the vpn and browse the internet. When I try and ping the internal network in the 10.0.0.0/8 range I can with the exception that I can't ping or rdp into WDS (10.91.16.101), nor ping PC1 from WDS. From the remote PC1, I can get to DC06 (10.91.16.100) just fine and ping back PC1. I don't see how anything in the configuration would be blocking specific hosts in the 10.91.16.0/24 range. I'm told that Crowdstrike isn't in the way of this. If anyone could shed some light as to why I can only get to the DC and no other hosts on that network, I'd be grateful. Also, when connecting with an iPhone, the token is never asked for, and I get "The VPN server is not responding". Windows and Mac's get the prompt and can connect

Hi, we have two DC onprem and two on Azure, installed agents 5.0.0314 on all four, created a network rule on azure firewall to allow all traffic (* ports and * protocols) between Fortigate appliance and all the DC (windows server 2019) (we have also a VPN from prem toward azure subnets), well, when it's time to switch connection between the DC's  agents only the two onprem talk with the appliance no traffic coming to the appliance from the two DC on azure, tried to telnet in every direction on 8000 and it shows me the service listening... any hint? thanks.

Hello team please help me to resolve this errorI have restarted my FW but same errorError Cose 500: Internal Server Error

While we've been running FortiManager for years, we finally took the time to setup it up to fully provision a firewall using Provisioning CLI Templates. We built around 17 individual CLI Templates that configure various sections of the config, and once we could fully provision a firewall running them one at a time, we grouped them up into a CLI Template Group and were so disappointed when it immediately failed.  It appears that regardless of how you arrange the individual scripts in the Group, when you execute the script, it doesn't execute them sequentially, it consolidates all of the configuration and pushes in whatever order it feels like. In our case, the very first config it tries to push has a dependency on an interface that hasn't been created yet. I opened a support ticket reporting the Provisioning CLI Templates are running out of order and asked how to fix it. The answer I got was to run some of the CLI Templates independent of the Template Group, to ensure the

After upgrading our FortiGate cluster from 7.4.7 to 7.4.8 yesterday, our ZTNA is no longer working. I don't see any external connections under ZTNA in the logs. Internal traffic with EMS tags is still working as expected. We are using the cloud version of FortiEMS. Has anyone experienced a similar issue after the update?I'm struggling to understand the issue, as there are no visible error messages. The EMS server appears to be functioning normally — all connections are established, and clients show as connected  https://routerlogin.uno/ .

Good evening everyone,I hope this message finds you well.I’m currently working with a FortiWiFi-60D-POE, running firmware version v6.0.12, build0419 (GA), which I intend to configure and connect to my internet box.I created a WiFi SSID interface with the following settings:A DHCP address rangeCaptive portal enabledMAC address authentication enabledAfter completing the setup, I tested the captive portal connection. I was able to obtain an IP address, but the captive portal page does not appear.I’ve tried accessing it over HTTPS using ports 1000 and 10003, but without success.Additionally, I’ve noticed that this device is running an older firmware version.Could this issue be related to a bug in this version?If anyone has experienced this or has a solution, your help would be greatly appreciated.Thank you in advance!   

Every once in a while our users will get told that the certificate is not private but if they accept that they are able to login and 2FA against our SAML. The certificate that shows up as "not private" is a certificate we purchased from GoDaddy.  Every browser should have the GoDaddy CA to validate the cert so I am not exactly sure why we are getting this error.  The SAML server is ADFS running in AWS.  The ADFS hostname is a different domain then the cert ZTNA is complaining about. So I do not know if thats the problem or not.  However, this only happens once in a while and not to everyone and even before ZTNA we never had an issue with ADFS cert. Anyone have any ideas?

Hi, is there any way to disable the time zone automatic daylight saving time, or alternatively set a fixed timezone (e.g. UTC+1)?My requirement is to have fixed local time all year round (without daylight saving), in detail I'd like to set UTC+1. Thank you for any help.Best regards,Lars

Hi, I do not know if anyone has tried this or that I'm implementing this wrong;I have a customer with 2 sites with 2 Fortigates, connected with a site-to-site IPSec VPN connection. At the office:At site A i have a Domain Controller, users can access data on site B, everyone at the office is happyAt site B i have a Domain Controller, users can access data on site A, everyone at the office is happy Now users who are outside the buildings:What we want is that a user connects remotely to site A (using the VPN Client on a Windows system) can access data at site B.For now they disconnect site A and connect to site B, but can this be done without this step? I hope you understand what I mean by this? I've already searched these forums in hope to find anyone with the same setup but am not able to find any cases..