Fortinet Community

I am French, I bought a MacBook in July from an individual. He told me he won it thanks to his company that gives gifts, so with an Apple care guarantee. Nothing alarming, everything seemed normal, up to a few days. It is written that the MacBook belongs to this company. With attached a proof and a code requested. I can't get anyone from the company who can contact me, to learn more and get more information.It says it belongs to Fortinet France, but I only find sites in English and no French interlocutor can anyone help?  

I have problem with my NAC where sometime the endpoint is loss connectivity both for wired and wifi. Previously i post error from client side here and now after i enable authentication log from FNAC then we can see for same endpoint the authentication can be success and sometime is fail.The fail message is ‘No EAP session macthing state’ View from authentication step then i got message ‘outer-method failed to authenticate Switch_IP → FNAC IP’The issue is from FNAC?

Configuring a static IPv6 address on client fails with state "dadfailed"When configuring an IPv6 address the system sends out a message to check if the address if already in use.If the Fortigate has ippool6 type nptv6 configured it acts it replies on the external-prefix configured.Similar to arp-reply enable.Adjust the nptv6 pool itself or adjust the client by using an address in the internal-prefix range or not affected by ippool6.Check other ippool6 and vip usage for overlap as well. Example On linux client: ip -6 addr EXTERNALIP shows state dadfailedDirectly after configuring the ip address we get the packet capture:  VMMAC > 33:33:ff:00:00:06, ethertype IPv6 (0x86dd), length 86: (hlim 255, next-header ICMPv6 (58) payload length: 32) :: > ff02::1:ff00:6: [icmp6 sum ok] ICMP6, neighbor solicitation, length 32, who has EXTERNALIP  FGTMAC > 33:33:00:00:00:01, ethertype IPv6 (0x86dd), length 86: (hlim 255, next-header ICMPv6 (58) payload length: 32) fe80::FGTEUI-64 > ff02::1

Subject: FortiLink Through Standalone FortiSwitches in an MCLAG DesignHello Fortinet Community,I would like to get your advice on a planned network design involving FortiGate, standalone FortiSwitches, managed FortiSwitches, and FortiAPs.Proposed Network Topology          FortiGate                 | Standalone FortiSwitches      (MCLAG Peer Pair)                 | Managed FortiSwitches                 |           FortiAPs In this design, the FortiSwitches directly connected to the FortiGate will operate in standalone mode as an MCLAG peer pair. The downstream FortiSwitches will be managed by the FortiGate through FortiLink, and the FortiAPs will connect to the managed FortiSwitches.I would appreciate your advice on the following questions:Design feasibility: Is this topology supported by Fortinet, particularly when using standalone FortiSwitches as an intermediate layer between the FortiGate and the managed FortiSwitches? FortiLink connectivity: Can the FortiGate discover, authorize, a

firewall Remote-IPsecVPN not able to get ping WAN ip,rest of the all services is okay including router IP.which is same series. 

Hi , i have Question about Using Multiple IKEV2 Dial-up VPN with PeerID is that possible ? i note in the FortiGate_7.6_Administrator_Study_Guide-Online page 363 saying:“When you configure multiple dial-up IPsec VPNs, IKEv2 makes it simpler to match the intended gateway bypeer ID. With IKEv2, you can either use the standard peer ID attribute or the Fortinet proprietary network IDattribute to indicate the phase 1 gateway to match on the dial-up server, regardless of the authentication modein use.”while the technical tips i saw saying you can only use network id   

Hello,We're currently migrating users from EMS to FortiSASE and have run into an issue with pre-logon VPN connectivity.The customer requires a pre-logon tunnel using machine certificate authentication (PKI), allowing the endpoint to connect before the user signs in.What we observe:The endpoint initiates the pre-logon connection. FortiSASE indicates that the connection is successfully established. Shortly afterwards, the session is terminated. The FortiClient on the endpoint never shows the pre-logon tunnel as connected.We have tested multiple certificate configurations, including certificate chains with and without an intermediate CA, but the results are identical.A Fortinet PS engineer is involved and a support case has already been opened, but so far we have not found the root cause.Has anyone experienced this before or successfully deployed pre-logon PKI-based tunnels with FortiSASE?

Fortigate firewall didn’t connect by remote users when using remote ipsec vpn 7.6.6 OS. But client getting all other services after created policy remote user interface to wan. Please help me if any other solution for it. I follow the below link remote access vpn for AD users through LDAP server  

FortiClient VPN is failing to connect and gives "Timed out" when trying to connect. Connecting via mobile hotspot works fine which rules out config issue. On the Smart Hub I have disabled IPv6 and confirmed the LAN range does NOT clash with the target VPN site. "Port Clamping" is set to on. The VPN is using IKEv2 IPSec. 

Hi everyone,we using a Fortigate G900 with v7.6.7 as explicit proxy.Since a couple of weeks, we have the problem that, when using Firefox, we can’t use the Google Search.After we type anything in the search bar, we get the following error:502 unknown content-encodingThe webserver reported that an error occurred while trying to access the website. Please return to the previous page.URL     https://www.google.com/search?client=firefox-b-d&q=fortigate Other Websites / Search-Engines with Firefox are working fine. With Edge or Chrome Browser Google works as well.Have somebody an idea? Regards, Michel

Hi all,I noticed a discrepancy between the PSIRT advisory FG-IR-26-182 and the CVE record for CVE-2026-106175 (published by Fortinet as CNA).The CVE record's "affected" section (also reflected in NVD, currently "Awaiting Analysis") lists:- FortiPAM 1.0.0 through 1.8.4- FortiSASE 25.4.c- FortiOS 7.0.0 through 7.0.19- FortiProxy 7.0.0 through 7.0.23However, none of these appear in the advisory table, the CVE description, or the CVE "solutions" field. The advisory only covers FortiOS / FortiProxy / FortiSwitch 7.2, 7.4, 7.6 (and 8.0 as not affected).In previous advisories (e.g. FG-IR-25-545, FG-IR-24-325), FortiPAM and FortiSASE were listed explicitly with their own affected versions and fixes, so this looks unusual.Questions:1. Are FortiPAM and FortiSASE actually affected by this vulnerability?2. If FortiPAM is affected, is a fixed version planned?3. Are FortiOS 7.0 / FortiProxy 7.0 affected, and is the omission from the advisory intentional (e.g. out of support)?4. FortiOS 7.6.8 is not

I integrated my Cisco C1300 to NAC and all is working fine except for CoA. When i manually execute send CoA then in the switch i got message ‘13-Oct-2026 13:37:21 %RADIUS-I-CoAREJECT: CoA Request from 10.10.10.9 rejected. Reason: Missing NAS identification attribute’I try add NAS-Identifier in Radius Attribut with value %AUTH%, %ACCESS_VALUE”, %SYSTEM% and %ACCT% with no success. Anyone know why?Same radius attribute is working fine for Cisco Catalyst switch even in the radius attribute no NAS-Identifier. 

itle: FortiGate 100F – EMAC-VLAN across multiple VDOMs with a routed /28 subnet over /30Hello Fortinet Community, We are testing a FortiGate 100F running FortiOS 7.6.6 with two VDOMs (root and Production), using EMAC-VLAN interfaces. Our configuration: - Physical "wan1" interface belongs to the root VDOM.- "wan1" has an IP address in the ISP's "/30" transit network.- Two EMAC-VLAN interfaces ("outside_Root" and "outside_Prod") share "wan1" as their parent interface.- Each EMAC-VLAN belongs to a separate VDOM and has its own public IP address from the same "/28" subnet.- Both VDOMs have independent IPsec VPN tunnels. What works: We have successfully tested EMAC-VLAN when the upstream router or Layer 3 switch has an IP address in the same public subnet as the EMAC-VLAN interfaces. In this setup, the router can resolve each EMAC-VLAN interface's unique MAC address using ARP, and traffic reaches the correct VDOM. Our problem: Our ISP provides two separate IPv4 networks: - A "/30" transit n

WAN1 STOPPED WORKING- I have two FortiGate 60F setups as stack (HA1 and HA2)- I have Juniper router - I have a Rogers modem with 2 public IP 187.x.x.x/30 and 184.x.x.x/30- link 1: Rogers modem port1 > FG60F WAN1- link 2: Rogers modem port2 > Juniper router- I also have a 2nd ISP (TELUS) for failover- WAN1 link shows Green UP in the GUI; WAN1 led light is blinking green/yellowProblem: WAN1 is not pulling the public ip whether in static or DHCPTS:- reboot the modem, connect my laptop with correct IP details used in FG60F (SM, GW and IP) = WORKING- leave Juniper plugged in = WORKING- turned off the modem for 10mins, removed the laptop, reconnected the FG60F = FAILED- Juniper still working- Replaced modem, reprovisioned and performed laptop testing again and still working. - Tried disconnecting Juniper from Rogers modem and leave only FG60F connected = FAILED- Internet works because of WAN2 (TELUS)Question:1. Why WAN1 not pulling the public IP? why there is no internet from WAN1? 2.

Hello Everyone, I would like to test my knowledge in NSE 4 - 7 via the use of past exam papers. Is there a repository I can connect to? 

Currently we have a Microsoft Server 2016 server as our radius server.We intent to upgrade to Server 2025.is there anything for us to take note when we upgrade to Server 2025 ?

Am final year in college I already have CCNA.My next goal is Security fundamental for Network Security, What about NSE4 and Sec+?, What i should focus on and worth for Entry level in Network security ? 

Anyone else suddenly having issues seeing Chatgpt prompts and files uploaded? Application Control | FortiGuard Labs Was working last week and i can still see claude file uploads and prompts just not ChatGPT so not sure if the application signature has changed? Fortigate is 7.4.12

I’m on a FortiGate 61F version 7.4.11 and FortiClient Windows version 7.4.3.I am trying to set up IPSec VPN for my remote users so that I can upgrade the FortiGate (knowing that SSL is no longer supported).  I’m running into trouble with Authentication when it comes to PSK vs Peer ID from dialup group.  What I want is for the tunnel to accept users from a specific local user group on the FortiGate.  My problem is that if I change the Peer Options to Peer ID from dialup group, the Pre-shared Key box goes away.  That’s then a problem on FortiClient since I can't leave the PSK box blank.  Any help on how to solve this?  Thank you! Side Note: I have an IPSec VPN for remote users set up on a different box running 7.6.6 doing exactly what I want.  There are more options for Authentication on that version and I can have a PSK and the tell it to use user group I want.

Hello, the content on the fortigate management interface doesn't load because fortinet's cdn certificate seems to have expired.For example the browser doesn't load the content at https://fos-cdn.fortinet.com/artifacts/fos/7.2.10/b1706/3655.js, if I try to open the url directly in the browser I see  that the domain SSL expired one Oct 30thAnd the cert Is indeed expired

fortigate FG201f running 7.4.12 b2902forticlient 7.4.8, managed by forticloudintune pki (CloudPKI)the payload (via sniff) appears to be sent, but fortigate ignores as the tunnel has been ignored.wanting to set up a device cert based TCP IPSEC tunnel.  end goal is for the device to connect without user involvement.from the ike debug logs:session started on tcp 8443proposal acceptedcert requestedcert sent (in 6 piecescert received and reassembledclient details sent, mostly correct except the OSVER.  this is a Win 11 devicepeer is matched“AUTH payload not received”tunnel is closed How do I diagnose why the tunnel was closed?  Why is the OSVER wrong? debug log:ike V=root:accepts ike tcp-transport(vd=0, vrf=0, intf=0:27, 162.252.yyy.yy:8443->142.167.xx.xx:58204 sock=42 refcnt=2 ph1=(nil)) (1).ike V=root:0: comes 142.167.xx.xx:58204->162.252.yyy.yy:8443,ifindex=27,vrf=0,len=606....ike V=root:0: IKEv2 exchange=SA_INIT id=225ee7034892962d/0000000000000000 len=606ike 0: in 225EE7034892962

Hello Fortinet Community,We are facing a persistent issue with a FortiAP 231K that fails to come online on our FortiGate 60E. Interestingly, the same behavior has also been observed on the replacement FortiAP received through RMA.We would appreciate guidance from the community or Fortinet engineers who may have encountered similar symptoms.EnvironmentFortiGate: FortiGate 60E FortiOS: 7.4.12 Access Point: FortiAP 231K AP management: FortiGate wireless controller Original testing topology: FortiGate -> PoE switch -> FortiAP 231K Replacement AP testing setup: PoE injector -> FortiAP 231K, with a laptop connected for testing and a serial console connection through PuTTYWe have checked the official FortiAP and FortiOS Compatibility Matrix and are investigating the issue using the supported firmware combination listed for the FortiAP 231K and FortiOS 7.4.12.Issue ObservedThe FortiAP boots successfully but does not come online or establish a stable CAPWAP connection with the FortiGat

Where we can find supported device by FortiNAC?

Trying to create IPSEC Dialup using device certificates.  The authentication is not succeeding.This is the ike debug log:ike V=root:0:EMS-TCP-VPN:179: received FCT-UID : 66FEE5B1BADB40A799FEAAD9D836EFF4ike V=root:0:EMS-TCP-VPN:179: received EMS SN : FCTEMS8825002268ike V=root:0:EMS-TCP-VPN:179: received EMS tenant ID : 00000000000000000000000000000000ike V=root:0:EMS-TCP-VPN:179: received peer identifier DER_ASN1_DN 'CN = xxxx-000000'ike V=root:0:EMS-TCP-VPN:179: match gw peer ID by FNBAMike V=root:0:EMS-TCP-VPN:179: AUTH payload not receivedike V=root:0:EMS-TCP-VPN:179: schedule delete of IKE SA 7bd8a3c30b6c6d6f/7234bdc65e60b4a4ike V=root:0:EMS-TCP-VPN:179: scheduled delete of IKE SA 7bd8a3c30b6c6d6f/7234bdc65e60b4a4ike V=root:destorys tcp-transport(vd=0, vrf=0, intf=27:27, 162.252.xxx.xx:8443->142.167.xx.xx:53461 sock=42 refcnt=0 ph1=(nil)) (0).ike V=root:0:EMS-TCP-VPN: connection expiring due to phase1 downike V=root:0:EMS-TCP-VPN: going to be deletedike V=root:0:EMS-TCP-VPN: res

I have a fortigate 70G (v7.4.12 build2902) setup as the wireless controller of a mesh network. A fortiap 421E (FP421E-v6.4-build0492) is the root, and then the two leaf ap's are another 421E (v6.4.0 build0492) and a 221E (v7.4.4 build0644). When I first configured this several months ago, everything worked great. Then recently my daughter started mentioning that the internet seemed slow.I looked into it and although I hadn't changed anything, the leaf ap's were no longer connected to the mesh network, so all traffic was routing through the root ap.Through some reboots I was able to get the entire mesh up again. However, no clients will connect to either of the leaf ap's.This configuration was previously working with no changes made and then stopped working. What should I do?I don't believe any of the ap's auto updated nor did the FG. None of the devices are registered for support, but that has been true for quite a while, definitely while the mesh was up and working.Any help and advice