Solved

Hi, I did some comparison for throughput of Fortigate IPSEC tunnel on AWS. Here are my findings:Encryption load is not scaled between multiple CPU cores (not a surprise)A more complex (higher DH-group or hash function) does not result in worse performanceAES256GCM (and other non AES-CBC algorithms) were a (bad) surpriseGiven that additional CPU cores did not improve the throughput, I only tested instances with 2 vCPUs. Instance c7i.large, aes256-sha512 dh-group 21: 2 Gbit/sInstance c5n.large, aes256-sha512 dh-group 21: 1.43 Gbit/sInstance c7i.large, aes256gcm dh-group 21: 70 Mbit/s (!) Is there any guidance available which is the best (most optimized) instance / cipher combination to get max throughput on AWS ec2?

Hi,I want to understand what's the steps for configure a secret with domain credentials (a secret in my personal folder) and use it in other windows/ssh secrets and targets(shared in the public folder with others).Obviously every user needs to have its domain credentials. The users in fortipam must be local users. I'im trying to do this with smart associations but with some difficulties. Thanks in advance

I have a Fortigate Instance deployed on AWS with 4 ENIs.. instance type c5.xlarge Recently we reduced the license from 4vCPU to 2vCPU and now i am looking to change the instance type accordingly. But as i am using 4ENIs the only viable option i see with 2vCPU is r7i.large .. will it support the fortigate vm or are there any other checks i need to look into ? or a compatibility matrix Thanks

Hello Guys, I downloaded FortiGate Hyper-V version. after installing and activated port1 it. I try to login using Browser Interface it become blink and the URL went to: https://FortiGate IP /prompt/fortigate-setup?viewOnly=1anyone know how to solve this issue.Thanks in advance Mina Greas

Hello everyone,I am currently configuring administrator authentication on a FortiWeb appliance using RADIUS against FortiAuthenticator with FortiToken MFA, and I am experiencing a login loop after the OTP step.EnvironmentFortiWeb: admin authentication via RADIUSFortiAuthenticator: used as RADIUS serverAuthentication source: LDAP / Active DirectoryMFA: FortiToken MobileFortiWeb admin group configured with RADIUS serverLogin flowUser enters username and password on the FortiWeb login page.Authentication proceeds and FortiWeb prompts for Token Code (OTP).OTP is entered.Instead of logging in, FortiWeb redirects back to the login page.Relevant log from FortiAuthenticatorAuthentication Failed Bad TokenDescription: Authentication failed, bad token codeMessage:Remote LDAP administrator authentication with FortiToken failed: invalid tokenThings already verifiedUser exists in AD and can authenticate normally.FortiToken is assigned to the user and active.RADIUS client configured correctly on Fort

Hi Community,I wanted to change the email subject for the manual input email notification. I updated the Title field in the manual input playbook step with the subject as i want, as shown in the image below:    I captured this title field data in the email notification template inside Subject field, as you can see in the image below:    However, the email is still showing the default subject: "A FortiSOAR playbook is requesting your input"as shown in below email screenshot and I would like to understand where this default email subject is coming from and how I can change it.  I would appreciate help on how to change the email subject for the manual input notification.FortiSOAR Version: FortiSOARTM 7.6.2-5507Regards,Ranjeet

hi, we want to add blackhole route on fortigate to save the resource. we have one public subnet for example 192.1.0.0/24.Some IP addresses of this subnet are configured on internal servers behind the internet firewall. static routes are configured for this 2x IP on the firewall.    192.1.0.10 configured on internal server 1   192.1.0.11 configured on internal server 2And some IP addresses of the subnet 192.1.0.0/24 are configured on SNAT and DNAT rules.    192.1.0.101 is used as source NATTED IP for some internal hosts.   192.1.0.201 is used as Destination IP on DNAT rule. Now we want to drop the inbound access to the rest IP addresses of the subnet 192.1.0.0/24 on firewall. We plan to add a blackhole rule on the firewall to save the resource. Will this blackhole routing rule affect SNAT and DNAT? I think it should not affect, but not very sure. Can anyone please help to and advise and confirm? Thanks in advance! &nb

I connected my fabric root FortiGate, which happen to be my edge firewall to the FortiClient EMS Cloud just fine via the fabric connector. My other fabric FortiGates show up in EMS Fabric soon after, so I authorized them there and attempted to finish the authorization at the fabric firewalls. When I click authorize on the fabric connector on the firewall, I am presented with the certificate to accept or deny. I accept and it goes back to the fabric connectivity window for EMS Cloud on the FortiGate in question, yet never "connects"... it's still in that pending state of showing the EMS Cloud information coming from my root, yet will not connect successfully like my fabric root edge firewall did.

I’m trying to configure remote administrator access via SSH on a FortiGate using RADIUS (FortiAuthenticator), where the admin privileges on the FortiGate depend on the user’s Fortinet VSA (e.g. Attribute: Fortinet-Group-Name, value: ADMIN_FORTIGATE) and corresponding remote-group mapping.Goal: allow different remote admins to log in via SSH with different admin access profiles, for example a read-only admin using the built-in super_admin_readonly (or a custom read-only accprofile).I noticed that:If the admin entry is configured with set accprofile "super_admin", SSH login works and the FortiGate does send RADIUS Access-Request to FAC.If the same admin is configured with any other accprofile , SSH login fails with a generic Failed password, and no RADIUS traffic is generated at all.So, it looks like remote admin authentication via SSH is only triggered when the admin has&nb

I looking a way to fix the CVE-2025-31514 then i got this article PSIRT | FortiGuard Labs.Can i know what mean of 'Migrate to a fixed release'?  My FGT running on version 7.4.11 

Hi,I'm new to Fortipam and I want to understand if there is a desktop application of Fortipam for the IT personal that connects to the fortipam and where you can create and use your secrets. Thanks in advance

HiI need to migrate all IPSec Tunnel to one zone to create a single policy.Now i can't migrate tunnel because "Integrate Interface" is gray and it can't select it. 

Here is a cleaner and more professional version for your post:Hello everyone,I’m currently working with a FortiExtender (FEX) using LTE connectivity, and I’m facing an issue related to public IP changes.Every time the LTE provider assigns a new IP address, the connection drops completely. The only way to restore connectivity is by rebooting the FortiExtender.Has anyone experienced a similar behavior?I would like to understand:Is this expected behavior with LTE dynamic IP?Is there any configuration (keepalive, DPD, monitoring, etc.) that can prevent losing connectivity after an IP change?Would enabling specific SD-WAN or tunnel monitoring settings help in this case?Any recommendations or best practices would be greatly appreciated.Thanks in advance!

Hi,I tested a FortiExtender LAN Extension on an FGVM-02. After removing the Extender configuration, only the tunnel interface remains, which cannot be deleted. The error message is: (phase2-interface) # delete fext-ipsec-***Can not delete a static table entryCommand fail. Return code -61 Does anyone have an idea how I can remove it? Thanks. 

Hey guysI already know that we can update IPS Engine manually.https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-manually-upgrade-the-IPS-Engine/ta-p/194513https://community.fortinet.com/t5/FortiGate/Technical-Tip-Upgrading-IPS-Engine-on-the-primary-FortiGate-will/ta-p/202345But can we update IPS Engine automatically ? Are there any related document ?

Hi all. A dump question.Can we install the AD connector within the AD server?Cause in the article didn't mention about the connector is not allowed to install with the AD server.It only mention install in the host that can connect to both EMS and AD server but the host spec also not given.    

Hi to all,I would like to disable VPN on my Fortigate. It was configured by the company who installed the firewall but I will not use it. Which command do I have to run because I have asked to the Forticare and they told me to run the following which does not seem to correspond to unable the VPN but the opposite: config vpn ipsec phase1-interface    edit "VPN_Forticlient"        set type dynamic        set interface "wan"        set peertype any        set net-device disable        set mode-cfg enable        set proposal aes128-sha256 aes256-sha256 aes128-sha1 aes256-sha1        set comments "VPN: VPN_Forticlient (Created by VPN wizard)"        set wizard-type dialup-forticlient        set xauthtype auto        set authusrgrp "VPN_Group"        set i

We have several user groups mapped to separate, corresponding SSL-VPN Portals. Each of these portals has Split Tunnel Enabled Based on Policy Destination. Each of these portals also has Routing Address Override with network addresses that match the same "allowed destination" addresses in their corresponding policies. Is Routing Address Override even needed?According to Split Tunnel Enabled Based on Policy Destination, "Only client traffic in which the destination matches the destination of the configured firewall policies will be directed over the SSL-VPN tunnel."So in an example where the Accounting network is 192.168.0.0/24 and a user is in the Accounting Group, which is assigned to the Accounting Policy (that allows access to the 192.168.0.0/24 network); Would I even need any address in the Routing Address Override for the Accounting SSL-VPN Portal?From what I understand, any traffic to 192.168.0.0/24 would go over the SSL-VPN with Split Tunnel Enabled Based on Policy Destinati

Good day,      I'm trying to install a Fortigate 7.6.6 VM for a lab and have this issue      After that I only get a white screen, and enter the trial license window or the device or anything. This is my configuration FortiGate-VM64-KVM (port1) # showconfig system interfaceedit "port1"set vdom "root"set mode dhcpset distance 1set allowaccess ping https ssh httpset type physicalset snmp-index 1nextend FortiGate-VM64-KVM (dns) # showconfig system dnsset primary 8.8.8.8set secondary 8.8.4.4end FortiGate-VM64-KVM (1) # getseq-num : 1status : enabledst : 0.0.0.0 0.0.0.0gateway : 10.16.13.20preferred-source : 0.0.0.0distance : 1weight : 0priority : 1device : port1 This is what I get when I do the  diagnose debug enable diagnose debug application update -1 execute update-now FortiGate-VM64-KVM # execute update-nowupd_daemon[1981]-Received update request from pid=2518FortiGate-VM64-KVM # do_setup[349]-Starting SETUPupd_

Our district has started an esports program and we're having difficulties with Nintendo Switches on our network. NAT Type is B. UDP ports are not blocked. When hosting a game on a switch on our network, those outside the network cannot connect. They get a NAT Transversal error. What settings do I need to have on the FortiGate to allow esports traffic for the Nintendo Switches?

When we use IPSec for remote access with Split tunnel enabled, can we make the fortiget to not set dns in the client?Now when the forticlient connected to the VPN then the client can't access the local domain.

Hi all, We are building an automated pipeline to continuously collect SSL-VPN and IPSec debug logs from our FortiGate 90G devices, using:diagnose debug application sslvpn -1diagnose debug application fnbamd 8diagnose debug enable We specifically need the raw debug output (e.g. "SSL established: TLSv1.3 TLS_AES_256_GCM_SHA384") which is not present in structured logs and therefore not available via FortiAnalyzer or syslog. We have already gone through the following KB articles:• Continuous debug monitoring with Bash and Crontab:https://community.fortinet.com/t5/FortiAnalyzer/Technical-Tip-Continuous-debug-monitoring-with-Bash-and-Crontab/ta-p/305973 • FortiGate remote monitoring and logging CLI command output into a file:https://community.fortinet.com/t5/FortiGate/Configuration-Example-FortiGate-remote-monitoring-and-logging/ta-p/189892 Based on our research, it appears that the debug subsystem and the structured logging pipeline are architecturally separate, th

Can two FortiGate clusters (each configured in Active-Passive HA with 2 units) be interconnected through a Core switch?

FortiGate - 7.6.3FortiClient - 7.2.9 (Windows and Mac) I have been working with Support for weeks now with no success so hoping I can get help here.Fortigate config:config vpn ipsec phase1-interfaceedit "OpsIPSecVPN"set type dynamicset interface "port1"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset proposal des-sha512 aes256-sha512set comments "VPN: OpsIPSecVPN -- Created by VPN wizard"set dhgrp 14set wizard-type dialup-forticlientset nattraversal disableset network-overlay enableset network-id 0set transport tcpset fortinet-esp enableset assign-ip-from nameset dns-mode autoset ipv4-split-include "OpsIPSecVPN_split"set ipv4-name "VPN_PCI_Operations_us2"set save-password enableset client-auto-negotiate enableset client-keep-alive enableset psksecret ENC *** FortiClient config:<connection><name>us2-LOACAL2</name><type>manual</type><ike_settings><keep_fqdn_resolution_consistency>0</keep_fqdn_resolution_c

Je viens de créer un tunnel VPN IPsec grâce à l'option VPN Wizard qui a automatiquement créé les politiques et les objets. Quand je lance mon FortiClient, je n'arrive pas à me connecter : un message d'erreur apparaît. J'ai récupéré les logs mais je ne trouve toujours pas ce qui bloque. C'est un Fortinet 101F avec la version v7.6.6 build3652voici quelque partie des logs ike 0:VPN:64: out B264FC333EFD2592341205A9F51C32110110020000000000000000C80D00003C000000010000000100000030010100010000002801010000800B0001000C00040001518080010007800E008080030001800200048004000E0D0000144A131C8107035845 5C5728F20E95452F0D000014AFCAD71368A1F1C96B8696FC775701000D00000C09002689DFD6B7120D00001412F5F28C457168A9702D9FE274CC02040D0000144C53427B6D465D1B337BB755A37A7FEF000000148299031757A36082C6A621DE00000000 ike V=root:0:VPN:64 : envoi d'un message IKE (ident_r1send) : , longueur=200, vrf=0, id=b264fc333efd2592/341205a9f51c3211 ike : réduction de la mémoire de 159 744 octets ike V=root:0 : réception de, ifin