Solved

Our internal tools use FMG API to manage it and we were looking to create a Threat Weight Template using API.I have checked:https://fndn.fortinet.net/index.php?/documents/file/521-fortimanager-76-json-api-full-reference/https://how-to-fortimanager-api.readthedocs.io But did not find the API endpoints.If someone has done it before or has any API collection they can share ?

When we use DHCP fingerprint for device profiling then we need to add ip helper on L3 interface. How if the L3 using fortigate, there is no ip helper command?

Hello, apologies if this has been posted before, but I could not find anything in the forums.We are a K-12 that recently switched to a FortiStack (Gate (100F), switches (148FPOE), WAPs (231G and K series). We are coming from Cisco Meraki and missing a big feature (or cannot find said feature) that I’m hoping to duplicate with FAZ. Being K-12, we have students lose devices on campus. We were able to log into the Meraki portal., look up a device hostname/mac and see what access point that endpoint last connected to. This helped students track their lost device.I cannot find anything simliar in the FortiWorld. I've piecemealed a dataset in FAZ from the Gate Event logs that gives me the client mac, last connected AP, and the last_seen time. I’ve parsed that along with a query based off Gate > Application Control > aware-New-Endpoint-Devices dataset. It looks like it would be what I need but I think the last_seen time is when it was FIRST connected to a particular access point. I real

I am having an issue with the FortiClient IPsec IKEv2 VPN connection on Android. I entered all the required information correctly and tried many configuration changes, but the issue still persists. When I attempt to connect, I receive a “Null” error message.At the same time, I tested the same VPN configuration on my iPhone, and the connection works perfectly without any issues.  Iphone Settings  Android Phase2 Settings    Andorid VPN Settings 

Hello, I have a frustrating case where a H-A cluster successfully authenticates against an external LDAP server using port 636, but is not able to browse the users in it.Testing a user is successful as well. Look at the attached screenshots.I changed the “cnid” field several times, including “sAMAccountName”.The version we are using is 7.4.12. 

Hi everyone,I'm currently setting up FortiXDR and I'm a bit confused about the required FortiAnalyzer configuration.Our environment consists of:FortiClient EMS Cloud FortiXDR license Local FortiAnalyzer VM (no FortiAnalyzer Cloud license)We do not have a FortiAnalyzer Cloud license, only a local FortiAnalyzer VM.My question is:For FortiXDR, where should the FortiClient logs (configured in the System Settings Profile) be sent?Should the FortiClients send their logs to a FortiAnalyzer Cloud instance, even though we don't have a FortiAnalyzer Cloud license? Or is it supported to send the logs directly to our local FortiAnalyzer VM while still using FortiXDR?Most of the users work from home, so we are currently using a DNAT with TLS configuration.Has anyone successfully deployed FortiXDR with EMS Cloud + local FortiAnalyzer?Kind regards,MG4

Hi,  Please, can you change my Fortinet Community Username to "FortiEng_345"?Bests,

My port switch config isinterface GigabitEthernet1/0/1switchport access vlan 100switchport mode accessswitchport voice vlan 200authentication order dot1x mabauthentication port-control autoauthentication periodicmabsnmp trap mac-notification change addedsnmp trap mac-notification change removeddot1x pae authenticatorspanning-tree portfastend I think i no need to add two bold command above since the radius will be used and not snmp. Am i right? 

Hello,We are experiencing an issue with RADIUS authentication on FortiNAC after upgrading the appliance.The problem only affects newly added switches. Any switch that is added to the FortiNAC inventory after the upgrade is unable to authenticate via RADIUS.Existing switches that were already present in the inventory before the upgrade continue to work correctly, including switches on which I have recently enabled RADIUS. However, as soon as a new switch is added to the inventory and RADIUS is configured, all RADIUS authentication requests are rejected.The RADIUS server is reachable and RADIUS tracking is configured correctly. On the Aruba switch, the RADIUS server status is healthy and there are no connectivity or shared secret issues.The following message is logged on the FortiNAC RADIUS server: Mon Aug 3 16:02:03 2026 : Auth: (24) Invalid user (RADIUS not enabled on device): [ArubaTstRadius] (from client 10.11.49.12 port 0)Mon Aug 3 16:02:03 2026 : Auth: (24) Login incorrect (RADIU

Hi! I would like to install the FortiClient VPN including the VPN settings with Microsoft Intune. We have more than 150 Windows PCs for installation.So, is it possible to do this? Note please, the vpn settings for remote access is IPSec. Bests,FortiEng 

Why link status for each port is different between the device and fortinac? On the device port g1/0/27 - 31 is up but in the NAC is different 

Hi everyone,We recently ended our support contract with our previous vendor and decided to renew with a different support provider.Unfortunately, the previous vendor has refused to provide the FortiGate administrator credentials and has also refused to share the latest configuration backup.we tried using the maintainer account with the password format bcpb+<Serial Number>, but I received the following error:login: maintainerPassword:Verifying password...Login incorrectDevice Model: FortiGate 200FIs there any supported method to reset or recover the administrator password without performing a factory reset, so that the existing configuration is preserved?Any guidance or recommendations would be greatly appreciated.Thank you.

I enrolled my forticlient with the EMS, it shows “connected”.When I try to connect to the VPN (SAML Login), it’s stuck “connecting”.Two problems come to mind:* It doesn’t show the SAML popup (auth through azure) as it does on windows.* when looking at service log, last line says /opt/forticlient/iked: invalid option -- 'P'I tried a number of things, starting the session with X or Wayland, no change, setting the open in external browser setting flag … with no success.Help

Hi everyone,I'm trying to integrate FortiWLC 8.6-5 build-8 (FortiWLC-500D) with Aruba ClearPass Guest (ClearPass Policy Manager 6.12.7.308288 on C3010 platform) as an external captive portal.Current setupFortiWLC 8.6-5 build-8 External captive portal: Aruba ClearPass Guest Authentication type: RADIUS Captive Portal External Server Type: Fortinet-Presence External URL:  https://<clearpass fqdn>/guest/guest_register_3.phpThe captive portal profile is configured as:Authentication Type: radiusCaptive Portal External Server Type: Fortinet-PresenceSuccess Redirect URL: https://<default redirect url>Login flowClient connects to SSID.FortiWLC redirects the client to the ClearPass Guest portal.The login page receives all FortiWLC parameters correctly, including:magicusermacuseripserveripapmacapidapnodeidssidpost=https://<controllerip>:8081/vpn/loginUser? User enters username/password.ClearPass successfully authenticates the user against the authentication source.After successf

Hello team, I have interesting situation. there are 4xFg900G in cluster. there is FTP server in vlan 100.L3 DG address for that vlan 100 is on Fortigate.When secondary 900G FGs from cluster want to reach ftp they can not.We also have cluster of 4xFG 400F for additional services, and they can all reach ftp server , no matter primary or one of 3 secondary FGs How to solve this situation?My final aim is to upgrade one of secondary FGs regarding MVC (Multi-version cluster) option, set upgrade-mode local-only, and upgrade one of secondaries and then reset ha uptime so that upgraded one become primary. Reason for that is because we must not have any downtime, and we want to take test after upgrade if all services are ok

 EnvironmentPlatform: FortiGate (hardware appliance)HA mode: Active / PassiveFortiOS current version: 7.4.8Target version: 7.4.10HA priorities:Unit A (Master): priority 200Unit B (Slave): priority 100Expected upgrade behavior (normal case)Based on Fortinet documentation and past experience, the expected HA upgrade sequence is:Firmware upgrade starts on the slave unit (B).Slave reboots and temporarily disconnects from HA.Cluster fails over to the upgraded slave.Firmware upgrade is then applied to the former master (A) in background.Final failback occurs according to HA priority (unit A becomes master again).Observed behavior / Issue descriptionDuring the upgrade from 7.4.8 to 7.4.10 (firmware uploaded via GUI using .out file downloaded from fortinet official source):The upgrade process took more than 20 minutes, significantly longer than usual.HA became disconnected, and unit B (slave) was no longer visible from the cluster GUI.Accessing unit B directly via Console & Management

What can i do if endpoint ip address on the device inventory and on the adapter showing wrong ip?actually the endpoint get ip 10.100.50.168 

Hi everyone, I'm experiencing a strange issue with an IPsec Dial-up VPN after migrating users from SSL VPN. The environment is FortiGate 400F  with FortiClient VPN 7.4.3.4323 on macOS Sonoma 14.1. The problem only affects macOS clients; Windows clients using the same VPN configuration and user account work correctly. Split tunneling is enabled, and all firewall address objects are configured correctly as /24. However, after connecting from macOS, one of the split-tunnel routes is installed with an incorrect mask (for example, 10.10.10.0/24 becomes 10.10.10.0/31). If I remove that subnet from the split-tunnel group, the issue moves to the next subnet (10.10.11.0/24 becomes 10.10.11.0/31), so the problem follows the route order rather than a specific network. I also tested with a split-tunnel group containing only three networks, and everything works correctly on macOS. The production split-tunnel group contains around 190–200 routes. Has anyone encountered a similar issue or knows wheth

Hi,FortiGate 7.6.7, IKEv2 dialup with EAP, mode-cfg and IPv4 split tunnel enabled. internal-domain-list is configured, but split DNS never takes effect: every DNS query from the client reaches the FortiGate, not only the two internal domains.config vpn ipsec phase1-interface    edit "<tunnel>"        set type dynamic        set interface "<wan-if>"        set ike-version 2        set peertype one        set net-device disable        set mode-cfg enable        set ipv4-dns-server1 <internal-dns-ip>        set internal-domain-list "domain1.local" "domain2.local"        set eap enable        set eap-identity send-request        set ipv4-split-include "<split-group>"    nextendVerified with: diagnose sniffer packet any "port 53" 4 0 l — public domains such as google.com show up as well. Same result on FortiClient (Windows) 7.4.3 and FortiClient mobile 8.0.0. VPN was fully reconnected after each change.Questions:1. Anything else required in 7.6.7 for internal-domain-

What are these highlighted labels??? All testing passed???Seen after upgrading from 7.6.6 to 7.6.7 (Azure) 

Hi everyone,I wanted to know if it's possible to manually edit these parameters on the unlicenced FortiClient (VPN Only) version for MacOS ?See the image below:  In particular, I need to be sure whether the <eap_method>2</eap_method> parameter (which corresponds to EAP-TTLS/PAP) can actually be configured.I'd like to know if anyone on MacOS has managed to apply these settings, or if I'm forced to purchase the FortiClient Standalone Edition (the client doesn't have the option to buy an EMS server).For additional context regarding my question: currently, we have an IPsec Remote Access VPN setup using IKEv2 + LDAP + MFA (via SMS).Thank you all in advance.

Hello,I am trying to deploy the FortiFirewall-VM64-KVM v7.6.7 (build 3704) permanent evaluation on Proxmox VE (KVM).After the initial boot, the GUI always redirects to:/prompt/fortigate-setup?viewOnly=1&startup=1but the page remains completely white and the setup wizard never loads.The CLI shows:License Status: InvalidRunning:exec vm-licensereturns:This VM is using the evaluation license.Failed to download VM license.Output of:diagnose hardware sysinfo vm fullshows:valid: 0status: 3code: 0Things I have already tried: Deployed multiple fresh VMs. Factory reset. Tested with multiple browsers. Verified Internet connectivity and DNS. Successfully pinged update.fortiguard.net and support.fortinet.com. Followed the suggestions from this Community post:https://community.fortinet.com/support-forum-92/issue-installing-a-vm-fortigate-223043?postid=223128#post223128 The behavior remains exactly the same.I also found posts mentioning activation via TFTP using a .lic file, but since I

Dear Experts,I’m working with FortiWeb, which deployed 6-8 months ago and security policy in monitor mode. Now, customer decided to change security policy to Blocking Mode from Monitor mode.I have checked for Fortinet official document, but didn’t see any recommendation or workaround for such transition from Monitor mode to Blocking mode. Appreciate, if experts can advise on this.  Regards, Faridul

Based on below article, can i know if every group in fnac inventory should have L3 device for L3 polling? 

Hello everyone,I am running into an issue regarding a duplicate device in EMS , and I am unable to delete the stale record because of the Azure AD sync lock.Environment: FortiClient Version: 7.2.12 OS: Windows 11 Enterprise EMS Integration: Synced with Azure AD (Entra ID) The Current Issue: Telemetry is Connected: The clean reinstall fixed the WMI conflict. Forticlient Telemetry now successfully connects to EMS. Duplicate Device in EMS: Because of the clean reinstall, the endpoint generated a new UID. EMS now shows two records for the exact same Hostname/MAC Address. One is Offline (old UID) and one is Online (new UID). Cannot Delete the Stale Record , but the license was used twice on the same device My Questions:What is the best practice to remove or merge this stale duplicate device in EMS?Any insights or workarounds would be greatly appreciated. Thank you!