Fortinet Community

FortiAIGate 8.0.2 can see traffic logs that my UI and postman API request were caught but traffic log details show Request Refused 'The gateway refused this request (404, HTTP 404)'ChatUI & Postman API calling to FortiAIGate 8.0.2 following FortiAIGate Administration Guide [Send a normal request]:https://docs.fortinet.com/document/fortiaigate/8.0.2/fortiaigate-administration-guide/531206/appendix-a-api-endpoints-and-request-examples#select-an-api-dialectAny idea?

Hello, our organization recently obtained a few MacBook Neos and Airs to test, running on macOS 27 Golden Gate. However, after installing FortiClient and connected to the office network, at random times, the Wi-Fi and Bluetooth would switch off and cannot be turned back on manually. After 2-3 minutes of this, the MacBook will then freeze then immediately restart on it’s own. Following a restart, everything seems normal, but this issue can repeat multiple times in a day, but as the day goes on, it becomes stable. This happens the moment I disconnect and reconnect back to the office network. Especially after bringing home and returning to the office with the MacBook. This issue does not happen with a private home network or hotspot. Resetting the MacBook does not resolve the issue either. When FortiClient is not installed, the MacBook behaves normally. 2 older MacBooks obtained last year does not experience this issue. We have disabled / blocked Apple Account login, Mail, Calendar, iClou

Hello team,I am using FortiAuthenticator Tacacs+ server. It is working with Cisco but not with Nvdia Cumulus switch. Because Nvidia cumulus switch uses Linux PAM module for Tacacs and it send authorization request first instead of Authentication. There is no setting in the forti Autheticator like”allow authorization before authentication”. But cisco it works because it uses authetication and then authorization. Any suggestion how to allow authorization first in forti Authenticator? Because other Tecacs servers have this option “authorize before authenticate”

Title: Multiple Users Experiencing Frequent SSL-VPN Disconnections – FortiClient VPN 7.4.3 Hotfix 1.8758Hello Fortinet Community,We are currently experiencing frequent and intermittent SSL-VPN disconnections affecting multiple users across our organisation.Our environment uses FortiClient VPN-only (Free Version) 7.4.3 GA Update 1 (Hotfix 1.8758).The VPN connections were stable for a long time. However, recently, multiple users have started experiencing unexpected and frequent disconnections.Environment Details: Product: FortiClient VPN-only (Free Version) Version: 7.4.3 Hotfix: 1.8758 Full Version: 7.4.3.1790.1.8758 VPN Type: SSL-VPN Operating Systems: Windows 10 and Windows 11 Impact: Multiple users across the organisation Observed Issues: VPN connections disconnect intermittently. Multiple users are experiencing the same issue. Users need to reconnect manually after disconnection. The issue has become increasingly frequent recently. Questions: Has anyone experienced

FortiClient VPN 7.4.11.0198 on iPadOS 26.7.1 fails to establish an IKEv2 IPsec tunnel to FortiGate running FortiOS 7.4.12 build 2902 when Phase 1 uses AES256-GCM with PRF-SHA384 or PRF-SHA512.FortiGate accepts the Phase 1 proposal:ENCR: AES_GCM_16, 256 bitINTEGR: NONEPRF: PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512DH: MODP2048 or MODP3072However, FortiClient does not send the subsequent IKE_AUTH request. FortiGate eventually reports:negotiation timeout, deletingconnection expiring due to phase1 downThese combinations were tested:AES256-GCM / PRF-SHA256 / DH15: worksAES256-GCM / PRF-SHA384 / DH14 or DH15: fails after IKE_SA_INITAES256-GCM / PRF-SHA512 / DH14 or DH15: fails after IKE_SA_INITAES256-CBC / SHA384 / DH15: worksPhase 2 with AES256-GCM works correctly when Phase 1 uses either AES256-GCM/PRF-SHA256 or AES256-CBC/SHA384. The problem occurs with both SAML SSO and local username/password authentication, although authentication is never reached in the failing cases.I reproduced the issu

Have an FS108.Reset the FS108 to factory defaults using paperclip + reset button.Manually assigned my laptop Ethernet adapter IP address 192.168.1.1 mask 255.255.255.0 GW 192.168.1.99Connected Ethernet cable between my laptop and port 1 on FS108.Open browser, go to http://192.168.1.99 and nothing. Also tried https...still nothing.Console to FS108 and exec factoryreset and factoryresetfull ….still nothing. I could set this up using the console, but I’d really like to know why it is not working as advertised.I have many more FS108’s to deploy and need to figure out if the “Easy FortiSwitch Setup” is not going to be so easy.

How can i change the FSSO Connection Password between a FortiGate and the FSSO? I tried FSSO_Setup_5.0.0337_x64 and FSSO_Setup_5.0.0335_x64, no luck.In the FSSO Agent config i do thisrun as Administrator Change the Password in Authentication  Leave the Ceckmark for Require authentication Click on Apply Click on Save&Close i Restart the Fortinet Single Sign On Agent ServiceThe firewall will always connect to the FSSO agent, no matter what password i enter here.This works as long as i use the default password of the FSSO Agent (that came with the installation).this password is even writtenin cleartext inside the collectoragent.exe.you will find it even with notepad.any idea

Hi Everyone, I  am facing  issue to downaload an image of Forigate 200f. My license is expired.. Please guide or share me how can i download the image..?? 

Hi! I´m looking for advice configuring an IPSec hub with FortiOS 8.0.1 for terminating IPSec site-to-site tunnels from multiple remote sites.We have a relatively high number of remote sites >50 with very low traffic (just remote management), but overlapping IP ranges.The IPsec tunnel interfaces (the inside of the tunnels) would need to connect to different VRFs. The tunnels would be initiated by the remote sites, which have different source IPs in the Internet,  but on the hub site all IPsec tunnels are terminated on a single public IP. Can I create a VRF instance per remote site?Having >50 VDOMs would not be feasible, as we are talking about maybe 10Mbps aggregate traffic and a relatively small firewall at the hub site, which can only support 10 VDOMs (like a an FG-120G).Some remote site will not have Fortigates, but most of them have. Is this doable at all? BR Peter 

 Hello everyone,I am troubleshooting a dial-up IPsec VPN connection issue affecting one client in Egypt. Our VPN connections work normally for clients in Lebanon, Germany, and Spain.The affected client is our only client in Egypt, so I cannot confirm whether this affects other users there.IssueThe client’s initial IKE request reaches our FortiGate. The FortiGate selects a matching proposal and generates an SA_INIT_RESPONSE. However, the client continues retransmitting the initial request, and the FortiGate repeatedly resends its response.It appears that the response may be getting dropped on the return path, although the firewall logs alone do not confirm where the issue occurs.Troubleshooting completed Tested three different VPN tunnels using different public IP addresses. Suspected filtering of UDP ports 500/4500 and tested IPsec over TCP on one tunnel, but the connection still failed. The client tested another ISP and a different PC, with the same result. Egypt is allowed in o

Good Afternoon, Since upgrading Fortianalyzer VM to 7.4.12, within the Fortiview → Traffic → Top Source, I am no longer able to filter a SourceIP by CIDR notation in the GUI. In the past, I’ve been able to use e.g. 172.1.1.0/16, and will get results for traffic only for that specific subnet.  Since upgrading, I receive “no records found”, when the CIDR notation would align with individual IPs I can see in the traffic Fortiview. I am not seeing in the release notes that this was taken out or is a known issue.  Is anyone else experiencing this, or is there another method to filter by subnet within Fortiview on Fortianalyzer 7.4.12? Thank you!

Hello traveler, I'm assuming you've stumbled upon this post after using very specific search terms and are perhaps now at the end of your rope. I hope I can maybe be your last stop. There's a lot that's going to depend on your own setup, such as which cipher suites you're using, your local and remote subnets, etc. I'm not posting this as a definitive guide to get your swanctl.conf perfect - I'm assuming you've already got it to a place where it "should be working". My goal is instead to draw attention to the changes that took my tunnel creation getting totally dropped and ignored by the FortiGate after first contact, to it actually trying to authenticate. It was of course, very simple, but took me hours upon hours to finally get right. The lynchpin was this: Set Remote auth to PSK. Set Local auth to EAP. Make sure Local is set to round 2, otherwise it sends your EAP credentials before it's asked and the Fortigate shrugs it off. Note that on my FortiGate side, I'm no

Hello Fortinet Community,We are facing an issue with Active Directory user visibility and User-Host mapping in FortiNAC.Environment FortiNAC version: 7.6.7 Active Directory configured as the LDAP identity source. The LDAP bind account configured in FortiNAC is a domain user account. Authentication method: 802.1X – PEAP-MSCHAPv2.   Observations: LDAP Validate Credentials: Success. Synchronize Users with Directory: Success. Hosts are discovered successfully, and their MAC addresses are visible. AD users are not visible in FortiNAC. Registered To and Logged On User fields are empty.   Why are AD users not appearing in FortiNAC even though LDAP validation and directory synchronization are successful? Is there any additional configuration required to retrieve and display AD users in FortiNAC? Thank you for your help.

Hello Fortinet Community,I have installed FortiGate-VM64 FortiOS 8.0.0 in my EVE-NG lab environment.The FortiGate VM boots normally, and I am able to access the GUI login page.Current IssueI can successfully enter my credentials and the GUI appears to authenticate successfully. However, immediately after login, I am logged out and redirected back to the login page.In other words:Open FortiGate GUI. Enter username and password. Authentication appears successful. GUI starts to load. Immediately after that, the session is terminated and I am returned to the login screen.EnvironmentPlatform: EVE-NG Device: FortiGate-VM64 FortiOS: 8.0.0 Build: 0167 Image: FGT_VM64_KVM-v8.0.0.F-build0167-FORTINET.out.kvm.zip Deployment: KVM/EVE-NGLicense StatusThe FortiGate license is showing Up to Date / Active, so there does not appear to be an obvious licensing issue.What I have checkedFortiGate VM is booting normally. GUI is reachable. Username/password are accepted. License status shows up to date. The

Mostly AI Generated, but results of my own work. After considerable troubleshooting, I've successfully implemented Windows Native Always On VPN (AOVPN) Device Tunnel with FortiGate 7.4.13, using machine-certificate authentication, Microsoft Intune, and Active Directory authorization.First, credit where it's due: Richard Hicks (richardhicks.com) has published excellent documentation on Windows AOVPN that helped tremendously.Also, let's be clear: FortiClient already provides always-on, pre-logon VPN connectivity using machine certificates and, in my experience, does it better than Windows native AOVPN.However, if you're like me and have valid reasons not to use FortiClient VPN, this post is for you.Our EnvironmentWe're using: FortiGate running FortiOS 7.4.13 Windows native IKEv2 Device Tunnel Enterprise CA with machine certificates deployed through Intune SCEP Microsoft Entra hybrid-joined Windows computers Active Directory LDAP for computer authorization Intune-managed split-t

Hi all,I am deploying FortiNAC-F v7.6.x using Local RADIUS with EAP-TLS authentication and Microsoft CA.The environment uses Active Directory (AD), where client devices are required to authenticate to the network exclusively using digital certificates, without requiring a username or password.When a client successfully authenticates using a valid certificate, how does FortiNAC identify the client and determine which Role or Network Access Policy to apply for VLAN assignment?What is the recommended configuration for this scenario?

Hello everyone,Since this morning, multiple clients across our network have simultaneously started receiving virus warnings from FortiClient. The legitimate Office component EUROTOOL.XLAM is being flagged as high risk.I have reviewed the hash (2C4AFE4AFEDE252158A732EDB0C3754B9CB984A7CC2EB6EEFAC47C1EF38C9753)  , file location and metadata on a number of devices and all comes back clear.Since the file is cryptographically clean and unmodified I strongly suspect this is a false positiveHas anyone else seen similar in their orgs? Thanks in advancePASMC

FortiAIGate on 8.0.2 without GPU on the node.Helm install method with values.yaml applied latest image tags. All pods are up. License applied in GUI. Workspace & model setup done but detectors for DLP, Regex & NL are missing, is GPU-enabled node a must to see/enable all the detectors?

FortiAp 221e with firmware 7.4.6, connected to fortigate FG200e with firmware 8.0.2 in any physical interface, or fortiswitch vlan ,is unable to get online.It receives ip address, i can see it as an lldp neighbor ,but never goes online. Always OFFLINE.Any help ?  

HelloWe want to replace Ivanti Connect Secure with Fortigate Agentless ZTNA for RDP connections.So far everything works fine but our customer has a special configuration on Ivanti Gateway:In the Ivanti bookmark configuration, an application (mstsc) is set to start automatically.This means that after the first RDP connect, an mstsc window opens, allowing you to switch to the next RDP server.We are using a Fortigate 101F / OS: 7.6.7For ZTNA Bookmark on Fortigate I found these RDP options:# set *apptype                  Application type.verify-cert              Enable/disable certificate verification of the real server.*host                     Host name/IP parameter.description              Description.keyboard-layout          Keyboard layout.security                 Security mode for RDP connection (default = any).send-preconnection-id    Enable/disable sending of preconnection ID.load-balancing-info      The load balancing information or cookie which should be provided to the connectio

For all Cisco devices, I am getting the SNMP error below. Does anyone know how to fix it?SNMP failed for device SW01 with message SNMP getNext/getBulk Failed for device : 10.10.10.1All core functions, such as authentication and CoA, are working fine. Therefore, this issue has no impact on production services at the moment.

Hi.We are trying to get all our firewalls upgrading to the latest urgent patches.Forticloud shows our firewalls running 7.6.7 there is a recommended upgrade to 7.6.8, however, when we do the upgrade button, there is only 8.x listed!!!7.2 and 7.4 branches seem fine!Please tell me we don't need to manually patch these 7.6.x boxes?

Dear Mate, what  npu-offload and what is use case to use  npu-offload in forti SDWAN. Thanks

I am trying to configure my Fortigate 60E using the Ansible ForiOS Galaxy plugins. Currently I am working on the vip configuration. For most of the vips it is working fine but I can't get the ssl vip to work.I would like to set up a ssl vip of type server-load-balancer like this:- name: "Configure {{ vdom }} vdom virtual IP for IPv4" fortios_firewall_vip: vdom: "{{ vdom }}" state: "{{ state }}" access_token: "{{ token }}" firewall_vip: name: "vip_ssl_placeholder" extintf: "management" extip: "10.10.10.1" extport: "6363" type: "server-load-balance" server_type: "ssl" monitor: - name: "tcp-6363-link-monitor" ldb_method: "least-rtt" persistence: "ssl-session-id" realservers: - id: "1" ip: "10.16.10.1" port: "6363" - id: "2" ip: "10.16.10.2" port: "6363" ssl_mode: "full" ssl_certificate: "Fortinet_Factory"However, when applying the script I get an error -56 from the Fortigat

Hi,can someone explain to me what the FortiAuthenticator-VMS-DR license (HA/DR/Load Balancing node license for FortiAuthenticator VM Subscription, with FortiCare Elite Support) is used for?It is not listed in the Ordering guide. If I understand it correctly, does this license allow for the deployment of a cluster (a second unit)?Zhank you