Fortinet Community

So im 99.9% positive we had a DDOS attack today. I Think this because the network utilization graph shot from 5mbps to 5gbps and stayed there for probably 5 or so minutes. By the time I figured out that was what had happened it had almost ended. I am in K12 so sometimes Kids hire services to do this. From what I've seen usually the Free ones don't have the capabilities to fill a 5gb circuit. Any truth to this? Not that it matters more just curious. Second Question the fortigate CPUs shot to a 100% so it took down our internal network. This was caused by the miglogd process which im assuming was because it was bombarded by so many packets from so many sources? After it was over I tried to look at the log and couldnt really find much nor was it respnding well most likely because of the magnitude of logs? Is there certain things to look for? Certain things to setup for logging that would give you more insight? I know alot of that doesn't matter because the attack is distributed just curio

We were all set to upgrade our main firewalls (IDC, AWS, Azure) to OS 7.2.12. However, the new SSO CVE reported last Tuesday, followed by another critical CVE on Friday, has put us in a very awkward position. With version 7.2.14 likely on the horizon, jumping to 7.2.12 now feels like a wasted effort.

AS pere FortiGuard Advisory FG-IR-26-060 https://www.fortiguard.com/psirt/FG-IR-26-060, we are planning an emergency upgrade to remediate CVE-2026-24858 (Critical SSO Authentication Bypass).Forti OS to 7.4.11 or 7.6.6 this both are newly released. Any one upgrade this FortiOS and found any problem.

hello community ,I am trying to integrate an on-prem FortiGate (FortiOS 7.6.5) with FortiClient EMS on-prem (version 7.4.5 build 2111). FortiGate license: Evaluation licenseFortiClient EMS license: Trial licenseNetwork connectivity between the two devices is working correctlyHowever, the FortiGate remains “Not Authorized” and the integration cannot be completed.Observed BehaviorOn the FortiGate, the EMS connector shows:Connection status: ConnectedAuthorization status: Not Authorizeddiagnose endpoint fctems test-connectivityConnection test had an error -8 : EMS server connection failed.Authentication failedIn the FortiGate event logs, I see the following error:Issue in reply of REST API call to api/v1/settings/server/public_address HTTP Code: 401 (Unauthorized) cURL result: (0) No errorFCEMS entry has failed to be verified  . EMS certificate can't be verified: issue in getting capabilities. EMS server connection failed. Authenticationfailed\nError (-1@_get_capabilities:519).\n

Coincidentally since we updated to 7.4.0, we have the agent stats for a call queue, in call center console not resetting for 48 hrs. So for example this morning, the number of answered calls there didn't reset to zero and are showing yesterday's calls and adding to that. This used to reset to zero each new day. Has anyone else seen this?

I set up a WireGuard (192.168.100.61) on the internal network and created a WireGuard VPN to connect to another network (192.168.101.0/24). I configured a static route for 192.168.101.0/24 pointing to WireGuard (192.168.100.61). The issue now is that I can access the remote network, but when the other side tries to access here, it shows a "no session matched" error. If NAT is not configured, how can this issue be resolved?logsvd-root:0 received a packet(proto=1, 192.168.100.25:1->192.168.101.51:0) tun_id=0.0.0.0 from vlan100. type=0, code=0, id=1, seq=101.find a route: flag=05000000 gw-192.168.100.61 via vlan100no session matched 

My company did a recent update to our VPN program but I cannot get it to take effect because I don't know what my password is. Is there a way to reset your password to a new one?

Hello colleagues! Got confused with a simple case with IPsec on the first view. The situation:We have a 3rd party partner who is not smart enough unfortunately. We have to establish an IPsec tunnel via 2 different link , but with policy base only(don't ask why). The partner has the only single IP for IPsec tunnels where I have to connect , the route for this IP I receive from BGP from both "outside" links (with \30 link's subnets) , one as a main and another as a backup. We have a subnet on a vlan-interface that we announce into the BGP and we have to establish the IPsec Phase1 with the source IP from the subnet. So the problem is that the subnet that we have to use as IPsec source is different from the Outside's interfaces. In my opinion in theory it's possible, looks like a simple routing , an IP packet from my FG will be NAT-ed (SrcNat) with one of IP's from the announced subnet , there is a route toward the partner's IP, the backward packet will get the outside interface with the s

Hi, I have configured a ZTNA profile for RDP access and wondered what security profiles are best to apply to this rule or if required at all. Doing web research is giving me mixed results so thought I better ask and get peoples opinions. 

could you please advise for below Question:How to block streaming in fort proxy 400E for specific Users in the domain 

Hi everyone,I'm preparing to deploy a FortiVM cluster for my customer and want to use as few subnets as possible. Therefore, I'd like to ask if I can use port 1 for both MGMT and Unicast Heartbeat. I'm trying to deploy it on my test environment, but the synchronization process is taking too long and I think it's not feasible.

Hello Fortinet Community,I am facing an unexpected behavior when publishing a web application using a Virtual Server.ContextWeb application hosted on an internal server listening on port 80Virtual Server configured with:External port: 3000Mapped to internal port: 80Purpose: publish the application on a non-standard external port (3000) while the backend remains on port 80Observed behaviorFirewall policy allows only port 3000Accessing https://webapp.com:3000 → Does NOT workAccessing https://webapp.com:80 → Does NOT workFirewall policy allows only port 80Accessing https://webapp.com:3000 → Works correctlyAccessing https://webapp.com:80 → Does NOT work What I am trying to understandAt which stage does FortiGate evaluate the firewall policy in relation to:DNAT / Virtual Server port translationWhy the policy seems to match on the post-NAT (internal) service/portWhether this behavior is:By designSpecific to Virtual ServersDifferent from standard VIPs or central NAT QuestionI would

Hello, We experience an issue where we have 2 Fortigate clusters in the same datacenter.We have an Fortigate 100F cluster in Active-Passive with an IPSEC tunnel towards an Fortigate 60F cluster in Active-Passive. Both are running the 6.4.9 firmware.When the 100F cluster is running on the primary, traffic is passing along the IPSEC tunnel fine.As soon as I failover the 100F cluster to the passive firewall, traffic stops passing (in both directions) along the tunnel. When I failover the 60F firewalls, this issue does NOT occur, and traffic keeps on passing. The HA setup is the same, except for the 100F cluster which runs VDOM's (the IPSEC tunnel is NOT in the root VDOM) and the 60F cluster does NOT. Anyone has seen this before and has the solution?This issue does NOT occur when we failover the 60F cluster.

Hi,I fully understand the logic, the view on the screen: "Policy &Object/ IPv4 Policy" is showing policies in order how they are applied , but for the maintenance reasons, like even for quick checking number of all policies, or to see when some policy was created first and which after that, there should be a such simple option like "Sorting by IDs number" in ascending/descending order ! It's need for example to see what policies were added one after another in some period of time.Is that option hidden somewhere or just missing here at cogwheel , at "ID" search option ?

Hello, is there a way to bulk update Hit Counters on Fortimanager for all or selected Fortigates?I mean trough a Script in "Device Manger" - "Scripts" and schedule it on a ex. daily basis? I do not need the Hit Counters containing the last few minutes, it would be sufficient if i reset Policies in a Policyblock and on next Workday i can see which policies are used without Clicking "Retrieve Hit Counts" and wait until it is updated. 

Hi everyone, I need support about Management Interface Reservation, i'm using port1 to manage and wanna add this port to Management Interface Reservation but when i click on this field i can't see where is option port1. What i do wrong?

Since upgrading FortiGate to 7.4.8, the "FortiSwitch Ports" section is totally screwed.It sorts the switches based on god knows what and if there are a lot of switches, it lags out when using the search field.  Also, it is no longer possible to edit the description of multiple ports at once.  Is anybody else experiencing these issues and is there anyway of reporting this to the devs, so that the old view is restored (since this worked with 7.4.7 and downwards)?

I've been trying to install the SSL VPN Only forticlient install on an employee's workstation and the install process gets almost all the way finished but then errors out and rolls back. There is no actual error message listed in the installer. I can see the MSIexec logs in windows starting the install and ending it but there are no errors there either. There also doesn't appear to be a log file created locally by the installer in the software or app data directories. I've tried multiple versions of the offline install from fortinet's downloads page as well as the default auto installer. I noticed that after a failed install the registry creates a "Fortinet>Volatile" entry under local computer with a "requires reboot" value of 1 but even after a reboot the install just fails again. Removing the Fortinet registry value does not change the outcome either. As a work around I installed the full forticlient with only the required install components and the SSL VPN. This install

Dear community,in the "Addresses" menu, it was possible to sort by name or IP until maybe 2 weeks or so.Also when I create/edit a firewall policy and want to select a "Source" or "Destination" the addresses aren't sorted anymore like they have been before. They are fully mixed up now.Is there a way to make sorting by e.g. names or IPs in "Addresses" possible again?Maybe the reason is the latest firmware update? Thank you very much for your help!

Hello, May I have some help with connecting FGT to FEMS please?FGT version is 7.4.x FEMS version is 7.4.5. Error on FGT after accepting the cert: Connection status : FortiGate not authorizedI cannot find any pending request on the Forticlient EMS under: "Fabric & Connectors-> Fabric Devices" What is missing? Thanks in advance! Screeshot of the FGT and FEMS settings:https://ibb.co/Gf3n4Lfghttps://ibb.co/PGNPFt0bhttps://ibb.co/qYzvB8Q4 Debug on FGT:FGT7 (global) # diagnose test application fcnacd 13FGT7 (global) # diagnose debug application fcnacd -1Debug messages will be on for 30 minutes.FGT7 (global) # diagnose debug enableFGT7 (global) # [ec_ez_worker_base_prep_resolver:379] Outgoing interface index 3 for 1 (EMS-1).[ec_ez_worker_base_prep_resolver:390] intf name: port1[ec_ez_worker_base_prep_ssl:429] verify peer method: 2, current ssl_cb: (nil), new ssl_cb: 0xa5e300[ec_ems_context_submit_work:578] Call submitted successfully.obj-id: 0, desc:

Hello everyone, I have a question about the use of Always On and Always Up in combination with Fortinet EMS, Intune, and Android/iOS devices.Within EMS I have created a profile with the following relevant settings:<keep_connection_alive>1</keep_connection_alive><keep_running>1</keep_running><autoconnect_tunnel>TUNNEL</autoconnect_tunnel><on_os_start_connect>TUNNEL</on_os_start_connect><on_os_start_connect_has_priority>1</on_os_start_connect_has_priority><disable_connect_disconnect>1</disable_connect_disconnect> With these settings, I expect my Android device to automatically connect and to always try to keep the connection up. However, this does not happen. I have the impression that these settings are intended only for Windows, because it does work there.If I enable the options show always up and show autoconnect, the user can check these options in the FortiClient app, after which it works correctly. In my o

Hi all ¡I have several fortigate IP sec tunnels but one of them is acting strangely. The tunnel is stablished with another fortigate correctly. Internal network 10.10.10.0/24 --> Fortigate 1Internal network 11.11.11.0/24--> Fortigate 2. I have static routes in both fortigates etc...  If internal network of fortigate 1 sends traffic to internal network of fortigate 2, fortigate 1 ask about the ARP of the destination IP:in arp who-has 11.11.11.1 tell Fortigate 1 If the internal network of fortigate 2 sends traffic to internal networ of fortigate 1, it works. I'm sure that I have not previous sessions to 11.11 network, only one route and no other routes or connected interfaces. If I do a route lookup the destination interface is the correct VPN Interface... Could you help me? Why Fortigate 1 ask about ARP and it not sends traffic to the tunnel interface? I have checked routing, phase 2 selectors etc.. I can't find the problem. Thanks.

I have an issue when accessing url by ip address using https. Why does the firewall block web access and how do I solve it? all i can see in the log is: 

Directly on the fortigate firewall I would just right click a rule and select 'clear counters' but I can't figure out how to do it in fortimanager.  This is the only document I could find on it and it doesn't mention clearing the hit counter.  https://docs.fortinet.com/document/fortimanager/7.6.2/administration-guide/397218/policy-hit-count  Sort of a huge fail for FortiManger because I clear the hit counters on certain rules all the time.

WHY!!!!