Solved

Working on a FortiManager–FortiGate integration scenario and observed an interesting behavior — looking for insights from the community.I configured the following directly on FortiGate:Firewall policiesAddress objects & groupsStatic routesPrefix listsRoute mapsEverything works perfectly on the firewall.However, when I perform “Import Configuration” into FortiManager:Policies, objects, and static routes are imported correctlyPrefix list and route map names appear, but their entries/content are missingOn the other hand, when I perform a “Retrieve Configuration”, I can see the full configuration including prefix list and route map entries.So the questions:Why does FortiManager import process not fully bring in prefix list / route map configurations?Is this expected behavior (device-level vs policy-level separation), or a limitation/bug?What is the recommended production approach to manage routing objects like prefix lists via FortiManager?Would appreciate insights from anyone who has

Hello There,1- I have been facing an issue with IPsec and need your opinions plz.i have sdwan zone with 5 wan links for internet, site-to-site is configured binding wan1 and works fine, once i confure ipsec-remote vpn on wan1 it works fine too but site-to-site goes down after some time and does not come up unless i completely delete the remote vpn.2- I decided to setup remote vpn on another wan link to avoid any possible conflict having at wan1, but remote vpn does not work at all at WAN2 or WAN3, even though the sdwan rule also created for port 500 4500 via wan2-wan3.

Hi everyone,I’ve deployed an IPsec dial-up VPN to allow users to connect via FortiClient.The VPN uses IKEv2 and a RADIUS server, and all users belong to the emergency group.After configuring FortiClient with all the correct phase 1 and phase 2 parameters, I consistently get the following error when trying to connect:"WRONG CREDENTIAL EAP FAILED CONNECTING TO 8.x.x.x"Below I’ve included the phase 1 and 2 configuration, along with the log captured from the FortiGate.The log clearly shows that the user is correctly identified, as well as their group membership.However, shortly before the error, this message appears:ike V=Vpn:1:Emergency:1804 EAP 14757603831873 result FNBAM_DENIED ike V=Vpn:1:Emergency: EAP failed for user "jjonh"Phase1 configuration:edit "Emergency"set type dynamicset interface "WAN"set ike-version 2set peertype anyset net-device disableset mode-cfg enableset ipv4-dns-server1 8.8.4.4set proposal aes256-sha256set dpd on-idleset dhgrp 14set eap enableset eap-identity s

Due to a recent vulnerabiliy reported on 7.4.9 i need to upgrade to 7.4.11 but in the fortigate GUI unders system firmwares i can only see upgrae to 7.4.10 available. However on the support portal 7.4.11 image is available for download ?  Does this mean 7.4.11 not recommended for upgrade ? why it is not showing in upgrade path 

Hello everyone,I’m encountering a strange behavior with my FortiNAC architecture (v7.4.2) running in Layer 3 mode. Everything was working perfectly for months, but suddenly, the VLAN assignment logic seems broken.My Setup:FortiNAC Version: 7.4.2Mode: L3 with Registration VLAN activated.DHCP: Pool declared directly on FortiNAC for the Guest/Registration scope.Switch Configuration: Standard Radius config applied to the ports.Port Group Membership: Initially, only "Role-Based Access" was checked.Troubleshooting attempted: To mitigate this, I recently had to check "Forced Registration" in the Port Group Membership settings. However, I never needed this before; it used to work perfectly with only "Role-Based Access" enabled.Question: Why did the default behavior change? Has anyone seen a bug in 7.4.2 where unknown hosts bypass the Registration VLAN and get Production access by default?

Hi,I'm configuring my first Fortinac.I have a problem whit switching vlan. When I plug on switch an pc  Fortinac receive snpm trap but the switch to isolation vlan is done after 40/50 seconds about.So pc get IP of production and after switching VLAN it don't get a IP of isolation subnet until I do ipconfig /renew.here what I see on switch:Aug 28 15:06:16: %LINEPROTO-5-UPDOWN: Line protocol on Interface GigabitEthernet0/1, changed state to upAug 28 15:06:59: %SYS-5-CONFIG_I: Configured from console by admin on vty1... Could you help me? Thanks in advance

Hello everyone, I am new to Fortinet products and have two questions regarding password history thresholds and account lockout settings. I have already reviewed the available online documentation and community forums but was unable to find definitive answers.  Thank you. How can I check the current account lockout settings from the command line? The documentation I found only explains how to configure (set) these values, but not how to display the existing configuration.config system global set admin-lockout-threshold <failed_attempts> set admin-lockout-duration <seconds> end 2. What is the expected outcome if the Password history threshold is set to 3, while Allow password reuse → Specify is set to 8? According to the administrator guide, the reuse value must be lower than the password history threshold. In this case, which setting would take precedence, and how would the system enforce the policy?   

It was updated to this version and the eye icon that allowed you to see the password in plain text no longer appears in the wireless controller where the SSIDs are located. Any Help?

 Hi all,I would like to clarify a best practice regarding the management of local users on FortiGate when the device is managed by FortiManager.Scenario:FortiManager 7.6.xFortiGate clusters running FortiOS 7.4.xDevices are fully managed by FortiManager (policy packages and device settings)Multiple VDOMs in useQuestion:Local users are configured under:config user localThese users are used for:SSL VPN authenticationExplicit proxy authenticationFrom my understanding:Local users are defined directly on the FortiGateFortiManager does not natively manage them as part of policy packagesWhat is the recommended approach in production environments?Specifically:Is it considered best practice to manage local users directly on the FortiGate even when the device is managed by FortiManager?Is there any supported/reliable way to manage local users from FortiManager without risking inconsistencies or purge during install?How do you handle scenarios where local users are actively used (e.g. proxy o

I am diving into the world of ZTNA and figuring things out still. Ai is suggesting the use of a loopback interface, but I am not really seeing much in regards of any documentation of ZTNA and loopback together. It's suggestion was to create a VIP to my loopback, specifying my loopback in my ZTNA server config, then if I wanted to have the same consistency between my internal and external users, to hairpin ZTNA so those internal users hit my public IP. Thoughts?

LS, We have on multiple locations a distribution layer consisting of S424F switches with the S148F or E or S124F or E versions in the access layer. We have seen on one location the following error message in the analzyer. On one location we had a complete network black out.On one location we are having currently cisco switch in de access layer and are installing the S148F units and connecting them to the distribution layer. Only connecting causes intermitting networking issues. To mitigate this we have disconnected the new switches from the distribution layer and the migration project is currently paused. We are running 7.4.8 or 7.4.9 FortiOS on all our switches. Looking around, are we on our own, I did find this one.https://www.reddit.com/r/fortinet/comments/1rv2i1g/high_cpu_spikes_on_fortiswitch_148ffpoe_when/So the good news is we are not alone.  Looking into the Analyzer, Logview, Event, Switch Controller (filter=msg~"CPU_SENSOR")datetimevdtypesub

Hello everyone,we would like to distribute an IPSec tunnel configuration to other users, including external contractors, using the export/import of an XML file.However, I’ve noticed that when a user imports such an XML file, it overwrites all previously configured tunnels.Is there any way to create an XML file that allows users to import only one or several tunnels in a simple and user-friendly way, without replacing all existing ones?Thank you very much in advance for your help!

Hi,We recently released two Linux VMs (Ubuntu 24.04 LTS) to configure the EMS server and external DB Postgres. The architecture is EMS with standalone remote DB without Docker (as reported on the Fortinet official document).With this introduction, I'll explain that the problem we encountered occurred 10 days after completing the configuration.Suddenly, the EMS GUI was no longer usable, displaying an error 500 (see image below). Both VMs, the one hosting the EMS and the one hosting the external DB, were correctly reachable via SSH. As additional information, I'd like to point out that the EMS server and external DB are on the same network and there are no network devices in between them. Furthermore, the hardware resources of both VMs are oversized compared to Fortinet's minimum requirements, and during the error, we didn't detect any problems or resource spikes on the VMs (e.g., disk full or resource spikes).Since the error persisted, we first attempted to restart the systems in t

Hello TAC,We are replacing 2 × FS-424D core switches (FortiLink-managed, configured as an MC-LAG pair with ICL) with 2 × FS-424E.When we attempted to replace the first switch, all downstream switches and APs went offline.Can you confirm the correct replacement sequence for this scenario, and whether the new 424E switches must be pre-configured before connection or if they will automatically inherit configuration from FortiLink after joining the fabric?Thanks.

Please help me block logs saved to the SSD. I'm referring to "Local Traffic" and entries that appear even 2-3 times per second. For now, I've disabled "Local Traffic" logging on the SSD, but I'd like to see traffic from Fortigate (e.g., to globalguardservice, NTP, etc.). The FG61E is in transparent mode, connected to the internet via the Local Interface.This large number of entries concerns local network connections from some devices. These entries include:Source=192.168.3.XX (LAN addresses)Destination=255.255.255.255 or 192.168.3.255Application Name="DHCP/DHCP Relay" or "udp/15600"Destination Interface=[object Object]Source Interface=internalHow can I block this, but still allow other connections, such as those to Fortigate servers and other services, to be visible?

FortiManager 7.4.9 Free Trial managing FortiGate 100F on 7.4.9 Config status: Synchronized On FortiManager I've created a new IP reservation under IP Assignment Rules, device global DB status changes to modified, yet when I use the install wizard I'm unable to push the reservation to the FortiGate 100F. The install preview is empty and it doesn't recognize the reservation. Either new one or deleting an old reservation.I have tried to modify a firewall policy along with the reservation but it only recognizes changed policy not the reservation. 

I created a LETS ENCRYPT Cert on my FortiAuthenticator and Fortigate that has the SSID for Guests, always had an issue with GODADDY on Apple devices, so we moved to LE. creating the cert via ACME was ll good, cert is valid , matches the FQDN etc, but now annoyingly the problem is worse, Apple and Android dont trust the cert! when they connect to the GUEST SSID, the phones browser says "Security Warning SSL_UNTRUSTED""This certificate isn't from a trusted authority" but the common name "myfortiauthenticator.mydomain.net" is signed by Lets Encrypt: Issued by:Common name:R13Organisation:Lets Encrypt and the cert is 100% valid.  Fortinet support Lets Encrypt and ACME, and is a perfect solution, but whats the point if Apple and Android dont trust it? or am I missing something?   

hi there,I need help please.I use FG60F with firmware 7.2.x I've created firewall policy with webfilter and ssh inspection. suddenly, some computers can't access certain https website, but the other PC still can access the web without issue. if the -problem computers- use direct internet (not via fortinet), they can access the website. where is the issue? anyone has same experience? thank you

I'm trying to allow CoPilot in office.outlook.com sessions, but block copilot.microsoft.com in general browser sessions, as well as all other LLMs My web filter has Artificial Intelligence Technology blocked in the Fortiguard category based filter, and a URL filter: *.google.com/*udm=50**.google.com/*udm=14*m365.cloud.microsoftbing.com/chatcopilot.microsoft.com*.bing.comcopilot.microsoft I also have an application control profile on the proxy policy, with the  GenAI category blocked. The only way I can get it working is to have the AI blocking web filter in both the the firewall and proxy policies. Having the web filter in just the proxy policy works for most LLMs via browser, except CoPilot. It works, but I'd like to know why, as this goes against the admin guide on transparent proxies. https://docs.fortinet.com/document/fortigate/7.6.6/administration-guide/15908/transparent-proxy I don't like not understanding my firewall's config :( &nbsp

I had configured our email server and setup notifications for rules i.e account lockout. It was working in the past but suddenly stopped. I can successfully send a test email from the super but when I view incidents I can see account lockouts but the Notification Status shows as failed and we are not getting the email notification. "Failed" is kind of vague. Is there anywhere else I can look to get an indication of why it is failing?                                  

Hi everyone,I'm facing a persistent login loop with a Blazor Server (.NET Core) application hosted on IIS 10, sitting behind a FortiWeb appliance. The setup: External Traffic: HTTPS (SSL handled by FortiWeb).Internal Traffic: HTTP (between FortiWeb and IIS).Server Side: I have configured IIS URL Rewrite to force HTTPS=on server variable and enabled X-Forwarded-Proto support. The Problem:When users try to log in, the authentication cookie (.AspNetCore.Cookies or .AspNetCore.Identity.Application) is never stored in the browser, although other cookies like .AspNetCore.Session and FortiWeb's persistence cookies are present. This causes an infinite redirect loop back to the login page.Locally (bypassing FortiWeb), the application works perfectly and the authentication cookie is generated correctly. What I've tried so far: Enabled "Add X-Forwarded-Proto" and "Add X-Forwarded-For" in the FortiWeb X-Forwarded-For Rule.Verified that "Cookie Security" is disabled in the

I have this policy to assign vlan 17 for devices which not managed by MDM.But the result why devices managed by MDM also hit this rule? 

I recently purchase some FortiAP-433G. I connected them to a Cisco 9200L PoE switch. The AP and switch negociate PoE succesfully at 802.3at, and the switch supplies 30W.This AP, according to the spec sheets can operate at 802.3at (30W) or 802.3bt (60W) When creating more than 2 SSIDs on the AP, ir begins to constantly reboot it self. Has anyone experience this issue as well?

Hello,Seems we are forced to move from SSL to IPSEC VPN so we are actually trying it on our FTG901G v7.4.9Our authentication is direct from the fortigate to Active Directory (ldaps)It is working since we activated EAP-TTLS thank's to this trick : https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-EAP-TTLS-for-IPSec-IKEv2-tunnels-in/ta-p/408602 BUT, it is not working when we add a FortiToken on the account I saw on this page that 2FA is supported from client v7.4.4 with IKEv2 ldap users : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Overview-of-compatible-IKE-versions-user/ta-p/420733The little stars lead us to this Technical Tip and this Special Notice which explain that there is no free version of the 7.4.4 Forticlient, BUT the 7.4.3 free VPN-only agent is supposed to do the same job : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Multi-Factor-Authentication-support-for-Windows/ta-p/407272https://docs.fortinet

Hi,I am looking for older version of FortiClient VPN version 7.0.8.0427.Can someone please help me with the information about where I can get the software.Thanks,