Solved

I'm trying to setup a POC to demo ZTP.....Using the Fortigate Cloud service, I was able to provision a Fortigate to it's proper On-Prem FMG. However I was unable to get the gate provisioned to the proper CLOUD FMG. (Even though it says it's supported). I then tried using FortiZTP service and was able to provision to the CLOUG FMG successfully.   Has anyone else run into this ? Should we be using the FortiZTP since it's still in beta ?   Tom

Hello FTNTI see in known issues of FortiOS 7.4.11 the following bug id. 1256278 Packet loss occurs when asic-offloading is enabled on FortiGate.  Can anyone explain in which models and/or circumstances this can happen?

Hello,Would really appreciate it if someone can point me to the right direction or help me with the following. Using DoS policy would like to know if its possible to create 2 polices with source like soPolicy#1 IPs from specific country. The limits are set higher or set to disable.Policy#2 All other IPs . The limits are set very low The questions are Does Fortigate support anything similar to the above? If both policies are enabled Will this lead to an increase in the resource usage of the Fortigate firewall? Thank you in advance.

Over the past month, the Fortinet Community has continued to flourish—and it’s all thanks to you. This month we relaunched the Community with a new look and feel, bringing the forums and knowledge base up to date, whilst keeping the familiar navigation and bringing you the latest articles and solutions. Whether you’ve been sharing expertise, asking thoughtful questions, or helping others solve complex challenges, your contributions are what make this space truly special. The Community remains one of the most vibrant hubs for collaboration, learning, and innovation across the Fortinet ecosystem.   Key Wins from the Past MonthWe’ve seen some fantastic momentum recently, with a number of highlights:  Growing Engagement and Collaboration Participation across forums has been stronger than ever. More members are joining conversations, offering solutions, and engaging with peers—creating richer discussions and faster problem-solving for everyone. In the past month, 1500 of you have posted rep

I login to this portal (Fortinet Community) and the vertification code sent to the email. How i can change the vertification code from email to authenticator app?

Hello Wi-Fi adminsThis tech tip explains how to allow a VPN user change his LDAP password when it expires.I tried do the same for my Wi-Fi (managed FortiAP), same described config on FGT and FAC, but when user with expired password tries to connect it just fails to connect, and FAC shows the following message.Windows AD user authentication from (null) (mschap) with no token failed: user password change requiredThe user password must be changed before logging on the first time. (0xc0000224)Any idea what I might have missed?

Hi everyone,We are troubleshooting a FortiGate-6000F running FortiOS 7.6.6 build3652 GA.Two FPC blades, slot 2 and slot 3, are stuck in Dead state with:Status Message: "Waiting for configuration sync."Heartbeat Data: FailedThe other FPCs are working normally.Current load-balance statusFortiGate-6000F (global) # diagnose load-balance status==========================================================================MBD SN: F6KF30T018900031  Primary FPC Blade: slot-1     Slot  1: FPC6KFT018900628       Status:Working   Function:Active       Link:      Base: Up          Fabric: Up       Heartbeat: Management: Good   Data: Good       Status Message:"Running"     Slot  2:       Status:Dead      Function:Active       Link:      Base: Up          Fabric: Up       Heartbeat: Management: Good   Data: Failed       Status Message:"Waiting for configuration sync."     Slot  3:       Status:Dead      Function:Active       Link:      Base: Up          Fabric: Up       Heartbeat: Management: Good   Data

Hello all, I am looking for some assistance regarding using AD groups in EMS policies. My scenario is as follows: I have created a security group for people allowed to use dropbox and configured the web filter and application filter appropriately. I have also created a security group to be allowed to use certain AI applications only and configured the filters appropriately. Based on what I have read is where I am hitting an issue: “Priority-Based Evaluation: EMS typically allows administrators to assign priority levels to different policies. If a user belongs to multiple groups (e.g., both "Standard Staff" and "Remote Workers"), EMS applies the configuration set by the policy with the highest priority.”If reading this correctly, if I am a member of both security groups, I will use the first policy I match with highest priority. So if I put the “allow dropbox” rule first that also blocks the AI Apps, I will not hit the “allow AI apps profile” that follows. Is there a way to control this

Hello,I have been trying to get into the FortiEDR Workflow, but I can’t seem to create or manage the Collector Groups in the FortiEDR Cloud with a FortiEndpoint license. I know that FortiEndpoint EDR is different from the normal FortiEDR, but I have not found a document which said you can’t manage Collector Groups with FortiEndpoint EDR. Even the Administrator Guide for FortiEndpoint does not mention that you can’t configure Collector Groups.

How to apply the Replacement Message in Security Profile in your Policy when accessing the blocked websites?

On FortiAnalyzer, the devices added under Device Manager show "Last Log Time: N/A". However, when checking the dashboard, logs appear to be arriving normally. At the same time, the Log Viewer cannot be opened, and the Reporting section is also inaccessible.The currently used version is 7.4.2, and it seems that there are known issues related to this behavior in this release. Could you please confirm whether this is a known bug and advise on any available workaround or recommended upgrade path?  

Hello,  My Firmware is 7.4.11 I managed to get SSO authentication working correctly via EntraID. The last thing I wanted to do was connect it to the FQDN and run it via my own SSL certificate. I have the certificate imported and it works correctly on the Fortigate login page. I can't get this certificate to work on the authentication port. The default certificate is still visible.FortiGate-60F # get vpn certificate local== [ Fortinet_Factory ]name: Fortinet_Factory   == [ Fortinet_Factory_Backup ]name: Fortinet_Factory_Backup   == [ Fortinet_CA_SSL ]name: Fortinet_CA_SSL   == [ Fortinet_CA_Untrusted ]name: Fortinet_CA_Untrusted   == [ Fortinet_SSL ]name: Fortinet_SSL   == [ Fortinet_GUI_Server ]name: Fortinet_GUI_Server   == [ Fortinet_SSL_RSA1024 ]name: Fortinet_SSL_RSA1024   == [ Fortinet_SSL_RSA2048 ]name: Fortinet_SSL_RSA2048   == [ Fortinet_SSL_RSA4096 ]name: Fortinet_SSL_RSA4096   == [ Fortinet_SSL_DSA1024 ]name: Fortinet_SSL_DSA1024   == [ Fortinet_SSL_DSA2048 ]name: Fortinet_SS

I have a question, for NSE4 please.wants to configure dead peer detection (DPD) on IPsec VPN for detecting dead tunnels. Therequirement is that FortiGate sends DPD probes only when there is no inbound traffic.Which DPD mode on FortiGate meets this requirement?A. EnabledB. On IdleC. DisabledD. On Demand    

How to implement of DNS and IP Address blocking in FortiGate?

Hi all, I am installing FortiNAC in a large environment and I added the Aruba WLC to FortiNAC without any issues. 3 days later, FortiNAC performed L2 pooling and discovered over 400,000 rogue hosts. After that, I disabled L2 pooling for the WLC, which stopped it from discovering.I use FortiNAC version 7.6.6 and have increased the VM to 16 CPUs and 32 GB of RAM.After that, I set the aging period to 1 day for the rogue hosts, but it did not work. I found this command, but it returned an error;> execute enter-shell# client -rog -op delete errorDuring this time, the FortiNAC RAM usage was at 92%, and the server was extremely slow.I could not find a way to get rid of these rogue hosts. While I was working, it did not affect the appliance, but when I configured PA for endpoint compliance checks, it did. While testing, I saw that many hosts were at risk, so I tried to mark them all as safe, but FortiNAC got stuck, so we had to restart the appliance.After that, I listed all the risky hosts

When using ipsec-vpn user IKEv1 dial-up VPN. Did all things still same issue also change wan interface still same issue. attached picture of the error. urgent support needed. forticlient version 7.4.3.4726    

Does the fortigate consider a specific configuration for SAP Cloud . Cisco ASAanything or changed the parameter.IKEv2  

Hello Fortinet Support, We are facing an issue where EMS logs are not being ingested into Forti Analyzer. At present, only FortiClient logs are visible, but EMS server activity/logs are not showing up.Details:Product: Forti Analyzer & FortiClient EMSIssue: EMS logs not ingesting/forwarding to Forti AnalyzerObserved: Only FortiClient logs are displayedExpected: Both FortiClient and EMS logs should be ingested for full visibilityRequest:Could you please assist us in troubleshooting and resolving this? If any specific configuration or version requirements are needed for EMS log forwarding, kindly provide guidance.

In an HA setup using FortiGate 200F, if the primary firewall is connected from the LAN port to the server, should the secondary firewall also be connected the same way?

Hello,While configuring Administrator Profile Mappings on FortiNAC, I accidentally associated all administrator profiles, including local administrator accounts, with a limited “Device Manager” type profile group. Since this change, I no longer have Full Admin privileges.I only created a profile mapping, is there a way to delete this Administrator Profile Mapping from the CLI?I found the following CLI command that allows restoring a previous configuration backup:execute restore config local <backup_name>If I restore a backup taken before this misconfiguration, will it restore the previous administrator mappings and resolve the issue? best regards.

Is TPlink wireless controller (Omoda) can be managed by FNAC?

We use captive portal for contractor and they should enter the entra id to connect to the network.We have some entra id group, example contractor_IT and contractor_SALES and each group have their own vlan.When the contractor authenticated successfully then the contractor still sit in isolation vlan and not changed to the respective vlan. My fnac vendor say when user authenticated thru entra id captive portal then fnac cannot bring entra group ID, is that true

I have guest ssid on the cisco wlc9800 and if there are user want connect to this ssid then the user will authenticate by captive portal with entra id.After the authentication successfull the client should be move from isolation network to guest network, in my case the client was moved to guest network if i see from fortinac policy but the client itself still connect to isolation network.Already ask to cisco support then they said the cisco not receive the coa to change the vlan. Anyone know here how to change thje vlan to teh cisco wlc9800?

Hi ,I would like to ask for some clarification regarding Flow-Based Antivirus behavior and architecture on FortiGate.I reviewed the Administration Guide and several technical documents, but I could not find detailed explanations for some internal Flow AV processing behaviors.I would highly appreciate it if you could clarify the following points or provide any related technical documentation, KB articles, technical tips, or architecture references.In Flow-Based Antivirus mode, is there still a file size limit / oversize handling mechanism similar to Proxy-Based AV, or is the oversize behavior only applicable to Proxy mode? In Flow mode, when scanning large files, does FortiGate bypass scanning after reaching a specific internal threshold, or can it continue scanning regardless of file size? Does Flow-Based Antivirus use the same Antivirus databases (Normal / Extended / Extreme) as Proxy-Based AV, or does Flow mode use a different AV engine/database architecture? If Flow mode does not fu

Hi all, when I try to add a firmware template to a FG80F the Fortimanager Cloud returns me the following error: "[-9001] invalid template assignment - conflicting template assignment scope: device FG-BENIARJO, vdom root, firmware template object [(null)] and [Template_Upgrade_Beniarjo]" (attached screenshot). As you can see the template has no device assigned.  The FG does not have any firmware or provisioning template configured. On the other hand, another FG with the same characteristics, and being the template a clone, I have not had any problem. Any ideas? Best regards!