Solved

Hello Team, I have two FortiGate 2600F FGCP clusters (active/standby) with FGSP enabled between them for a specific VDOM. I would like to verify whether FGSP sessions are synchronized and see which ones are. The following CLI commands appear to report FGCP session information only:diagnose sys session syncdiagnose sys session list  How can I retrieve session information for FGSP specifically? Thanks in advance for the supportBest Regards 

HiI have two questions. 1. Is there a way to set admin-lockout-duration to 100000 and let another administrator unlock it when the account is locked? 2. Is the criteria by which the account is locked not the account name but IP based? Thank you

BodyHi everyone,GoalI want my FortiGate 60F to continuously ping a specific host, for example 172.16.23.254. If it stops replying, I need FortiGate to trigger a webhook that will notify a Telegram group. The Telegram webhook side is already working, so I only need help with the FortiGate trigger.EnvironmentModel: FortiGate 60FFortiOS: 7.4.8Target to monitor: 172.16.23.254The target is on LAN, reachable via interface: internal4What I have workingA webhook action that successfully sends a message to my Telegram bot when manually tested.What I am trying to achieve on FortiGateSet up a reliable ICMP probe to 172.16.23.254Generate a log event when the host is considered down, and again when it recoversUse an Automation Stitch to catch that event and call the webhookQuestionsWhat is the best practice approach for my case?Desired outcomeWhen 172.16.23.254 fails ICMP for N consecutive probes, FortiGate sends a webhook to Telegram with a short message that includes the host, status, and time.Wh

Hello All, Have issue on both Fortigate's (v 7.4.8 and 7.6.4). I'm import endpoint certificate via PFX (wildcard). Import two certificates - root and intermediate to "Remote Certificate". If I open info of endpoint certificate and view Serial Numbers of intermediate and ca certificates - its identical for Serial Numbers of imported certificates. But in test via openssl s_client -connect mysite:443 -servername mysite -showcerts I'll see error "Verify return code: 21 (unable to verify the first certificate)"What's wrong, what I missed?

Hi FGT adminsToday I saw 2 FortiGate physical appliances, with FortiOS 7.2.10, having a strange admin that I've never seen before on any other FGT.On first FGT:On other FGT: What is this account user for? Or should this be removed?

Hi all,  I hope you're well.  I am installing 4 x 120G FortiGates into a DC, but these firewalls will not be on the edge therefore no direct internet access. Another layer of firewalls is in front, I need to create an explicit list of IPs, domains, services etc to provide to the individuals who currently manage them to ensure the FortiGates has access to required services for NGFW features.    I am currently building a policy on a lab firewall with what I know and can see is required but is there an explicit list available so I can ensure everything is covered? Thanks, Dan. 

Hello, I am a monitoring analyst, and I have access to FAZ1000F v7.6.3. When I go to “Incidents & Events,” I find a large number of incidents, but when I take the source IP of these events and go to “Log View,” I find that the event was blocked by the firewall. I understand that for FAZ it is an incident even if it has been contained, but it generates noise for me. I am interested in seeing only the incidents that were not blocked. Is this possible? If so, how can I do it? Thank you.  

I have SAML SSO enabled on the FortiGate using Azure as the IdP, and it's working well. I'm now trying to enable the SP certificate. I tested several certificates from the FortiGate certificate list, but each one fails with the error:"Signature algorithm used to sign data is not supported." The IdP metadata shows Azure requires this signature method in SAML metadata:<SignatureMethod Algorithm="...rsa-sha256" /> How can I generate or issue a certificate on the FortiGate that will produce RSA with SHA-256 signatures via CLI? Please help with CLI commands or steps. 

🧱 EnvironmentFortiGate model: FG-101FFortiOS version: (please add, e.g. 7.4.3 or 7.2.6)VPN type: IKEv2 IPsec (remote access)Authentication: LDAP users & groupsClient: FortiClient 7.4.3 (Windows 10 Pro 64-bit)🪪 ScenarioI’m configuring an IKEv2 IPsec remote access VPN that authenticates users via an LDAP server.The connection is established from FortiClient successfully up to Phase-1 (SA_INIT), but it fails during user authentication (EAP phase).EAP failed for user "test"EAP response is emptyconnection expiring due to EAP failure

FortiGate VPN Device Integration to FortiNAC.I am currently working on integrating FortiGate with FortiNAC.I need assistance with the configuration steps and the guide that outlines how to properly integrate FortiGate (FGT) with FortiNAC (NAC) for VPN-based access control.The officel guide I already read.Is there have any guide for this .   

Hi all, I'm having trouble getting 2 fortigate firewalls to connect via VPN, it looks like the phase1 is up but the phase2 never gets triggered. Even if I execute a ping between the two sides it never comes up. I've attached a screenshot of the VPN settings at both ends as well as the static routes and the firewall rules that I've got configured. I've tried running the Fortigate to Fortigate IPSEC wizard and I get the same result. I currently have NAT disabled at both ends but I've tried it with it enabled and enabled/disabled at both ends. I've checked and the preshared keys are the same and they're both using AES256-SHA256 DH14 on both the phase1 and phase2s I'm really confused, can anyone offer any advice?  

On MacOS 15 (FortiClient version 7.2.6), at the MacOS login screen a message appears prompting for credentials.  The message states: FortiClientAgentYou are making changes to your Certificate Trust Settings.Enter the name and password of a user in the "(null)" group to allow this. No matter what credentials are entered, it won't accept them. I've opened a case with support, to no avail so far.They referred me to this article (for an older version of FortiClient), and I added all the services it mentions that need full disk access and checked the other settings:https://docs.fortinet.com/document/forticlient/7.0.9/macos-release-notes/223986 I would investigate downgrading to see if that helps, but we want to be on the latest release so that we are up-to-date on security patches. Does anyone have any suggestions? Thanks in advance for any advice.

Hello,A little surprise today while I was creating my playbook, it seems that the following actions are still using the CrowdStrike API endpoints that were decommissioned on September 30th. - detection_search : use /detects/queries/detects/v1- detection_aggregates : use /detects/aggregates/detects/GET/v1- update_detection : use /detects/entities/detects/v2- get_detection_details : use /detects/entities/summaries/GET/v1 In accordance with the CrowdStrike documentation, it appears that these API endpoints have been merged into the Alerts section. The documentation say "Detections are no longer stored in their legacy format."https://falcon.eu-1.crowdstrike.com/documentation/page/d02475a5/converting-from-detects-api-to-alerts-api# Could we please, in the next update, either remove these actions or update them to use the correct endpoints (for example, the ones already used in the update_alert action) ?

Hello FML admins, I am currently testing the Mail Migration feature in FortiMail to migrate email data from Gmail to FortiMail.I have followed the procedures outlined in the following documentation: https://docs.fortinet.com/document/fortimail/7.6.3/administration-guide/326016/migrating-email-from-other-mail-servers-server-mode-only#domain_user_1224406687_2752746https://community.fortinet.com/t5/FortiMail/Troubleshooting-Tip-FortiMail-migration-users-does-not-work/ta-p/306683 However, I consistently encounter an “Authentication failed” error during the migration process.Could you please confirm if there are any additional configurations or permissions that need to be set on the Gmail side to allow FortiMail to perform the migration successfully? Any tips would be much appreciated.Kind regards,

Hello,I'm new here, i have installed forticlient 7.4 in ubuntu 24.04.I was connected to my VPN server. after a week when i tried to reconect i had this error "config DNS failed".these are the logs from the forticlient:20241212 13:01:50.744 TZ=+0200 [sslvpn:INFO] main:2168 Init20241212 13:01:50.744 TZ=+0200 [sslvpn:INFO] main:2186 VPN is running in restore DNS mode20241212 13:01:50.750 TZ=+0200 [sslvpn:INFO] nettools:1854 More than one device with index 2 can be found20241212 13:01:50.751 TZ=+0200 [sslvpn:INFO] nettools:1854 Device address details: local_address xx.xx.xx.xx, device_index 2, device name eth0 (read from netlink)20241212 13:01:50.751 TZ=+0200 [sslvpn:INFO] nettools:1854 Device address details: local_address xxxx::xxx:xxxx:xxxx:xxxx, device_index 2, device name eth0 (read from netlink)20241212 13:01:50.781 TZ=+0200 [sslvpn:DEBG] vpn_util:299 Get connection name: netplan-eth020241212 13:01:50.791 TZ=+0200 [sslvpn:INFO] nmtools:865 Network Manager settings backup file doesn't

Hi there, is there a roadmap for supporting FortiEDR under macOS tahoe?We are currently using a 6.0.1.1022 version on macOS 15 but want to go forward to 26. Are there any plans on supporting it any time?Best regards

Simple question.  Should I be concerned that one FortiGate 101F consistently runs at 60% - 75% memory used, while a like 101F with a significantly larger network and hardware load uses 25% - 35% of memory on a daily average.Both 101s share the same OS version, internal hardware configuration, and basic firewall and SD-WAN configurations.  They differ in that the high-memory use 101 has three 4- port FortiSwitches serviced by FortiLink, roughly 14,000 entries in the routing table, and roughly 500 sessions.  The 101 using less memory hosts 10 48-port FortiSwitches, a 21,000 entry routing table, and roughly 4500 sessions.Neither 101 exhibits anomalous behavior at the moment.  Still, I wonder if I should expect trouble in the future.Thanks.

Hi everyone,I’m planning to upgrade a FortiGate 101F currently running FortiOS 7.0.8 to a newer 7.x version (likely 7.2 or 7.4).My client is a bit concerned about the BGP stability after the upgrade, since the FortiGate is currently handling BGP routing.Before proceeding, I’d like to ask if anyone has already performed this specific upgrade and could share their experience;Any issues encountered with BGP sessions, neighbors, or route redistribution after the upgrade.Whether you recommend going straight to 7.4.x or stopping at 7.2.x for now.Any insights, tips, or best practices would be greatly appreciatedThanks in advance for sharing your experience!

Hello, I have a specific deployement scenerio in my hand. My customer has a closed circuit production plant. There are handfull of PCs and a lot of cameras, industrial devices, industrial printers...etc. I have no problems with enviromental devices. The problem is this plant has limited internet connection and does not use LDAP. PCs are joined to a domain and configured in HQ. Then send to this plant. My question is: Can I use agent without LDAP integration for doing basic scans for applications and viruswall? Since there are no LDAP, I am thinking of using self signed certificates and trust them manually from client agents. But I still need to login to the agents, which I won't be able to match to an LDAP. I did some researchs, I have some ideas but I was not able to come up with a viable solution. If you guys can steer me to a right direction I will be glad.  thanks in advance.#fortinac

Hi everyone,I want to set up ipsec with FortiClient as dialup client (as mentioned here: https://docs.fortinet.com/document/fortigate/7.4.8/administration-guide/785501/forticlient-as-dialup-client).  Since ipsec seems to have way more options than ssl vpn - if I go trough the IPsec Wizard for remote access. Are these default settings ok (safe) to use?

I have Setup FSSO Collector Agent to be radius accounting server so that it monitors FSSO users and Radius Wifi users , NPS Server forward accounting requests to the FSSO but i have two problems with this setup:1- The FSSO Agent receives accounting stop messages ( confirmed through debug log) but it doesnt remove the user from login users list and neither tells fortigate to remove users 

From the debug, we can see that there is no problem with the time on both sides. 

Hi, On PSIRT i have now seen a few posts now where the solution for a CVE is to update to FortiOs 7.2.12.For example: https://fortiguard.fortinet.com/psirt/FG-IR-25-026But version 7.2.12 does not exist. Or am i confused?  BR,Arnold 

hello everybody: I installed a virtual machine on my computer (Oracle Virtual Box) to run behavior tests on my network. I noticed that even though it's not loaded, it browses normally. I'd like to know how to prevent any machine running in a virtual machine from browsing. I've tried to detect the virtual machine by MAC or IP, but I can't. How can I block virtual machines? I searched the security profiles and only found VMware. Can you give me some ideas on what to do?Thank you very much.

Hi everyone, Looking for help with a strange API authentication issue on one specific FortiGate. Setup:25 FortiGate firewalls managed via automated backup scriptUsing API v2 endpoint: /api/v2/monitor/system/config/backup?scope=globalSame API user (BACKUP-SUPER_ADMIN) configured on all devicesProblem: One firewall (let's call it FW-TEST) consistently returns HTTP 401 Unauthorized, while the exact same script works perfectly on the other 24 devices. What I've tried:Regenerated API token multiple timesVerified user permissions (identical to working firewalls)Manual test with Postman: same 401 errorGUI login with same account: works fineCompared API settings between working and non-working FW: no differences foundQuestion: Has anyone encountered a situation where one FortiGate rejects API authentication while others with identical config work fine? Could there be hidden settings or firmware-specific quirks that affect API token validation? Using FortiOS version if you k