Solved

 Hi all,I would like to clarify a best practice regarding the management of local users on FortiGate when the device is managed by FortiManager.Scenario:FortiManager 7.6.xFortiGate clusters running FortiOS 7.4.xDevices are fully managed by FortiManager (policy packages and device settings)Multiple VDOMs in useQuestion:Local users are configured under:config user localThese users are used for:SSL VPN authenticationExplicit proxy authenticationFrom my understanding:Local users are defined directly on the FortiGateFortiManager does not natively manage them as part of policy packagesWhat is the recommended approach in production environments?Specifically:Is it considered best practice to manage local users directly on the FortiGate even when the device is managed by FortiManager?Is there any supported/reliable way to manage local users from FortiManager without risking inconsistencies or purge during install?How do you handle scenarios where local users are actively used (e.g. proxy o

I am diving into the world of ZTNA and figuring things out still. Ai is suggesting the use of a loopback interface, but I am not really seeing much in regards of any documentation of ZTNA and loopback together. It's suggestion was to create a VIP to my loopback, specifying my loopback in my ZTNA server config, then if I wanted to have the same consistency between my internal and external users, to hairpin ZTNA so those internal users hit my public IP. Thoughts?

LS, We have on multiple locations a distribution layer consisting of S424F switches with the S148F or E or S124F or E versions in the access layer. We have seen on one location the following error message in the analzyer. On one location we had a complete network black out.On one location we are having currently cisco switch in de access layer and are installing the S148F units and connecting them to the distribution layer. Only connecting causes intermitting networking issues. To mitigate this we have disconnected the new switches from the distribution layer and the migration project is currently paused. We are running 7.4.8 or 7.4.9 FortiOS on all our switches. Looking around, are we on our own, I did find this one.https://www.reddit.com/r/fortinet/comments/1rv2i1g/high_cpu_spikes_on_fortiswitch_148ffpoe_when/So the good news is we are not alone.  Looking into the Analyzer, Logview, Event, Switch Controller (filter=msg~"CPU_SENSOR")datetimevdtypesub

Hello everyone,we would like to distribute an IPSec tunnel configuration to other users, including external contractors, using the export/import of an XML file.However, I’ve noticed that when a user imports such an XML file, it overwrites all previously configured tunnels.Is there any way to create an XML file that allows users to import only one or several tunnels in a simple and user-friendly way, without replacing all existing ones?Thank you very much in advance for your help!

Hi,We recently released two Linux VMs (Ubuntu 24.04 LTS) to configure the EMS server and external DB Postgres. The architecture is EMS with standalone remote DB without Docker (as reported on the Fortinet official document).With this introduction, I'll explain that the problem we encountered occurred 10 days after completing the configuration.Suddenly, the EMS GUI was no longer usable, displaying an error 500 (see image below). Both VMs, the one hosting the EMS and the one hosting the external DB, were correctly reachable via SSH. As additional information, I'd like to point out that the EMS server and external DB are on the same network and there are no network devices in between them. Furthermore, the hardware resources of both VMs are oversized compared to Fortinet's minimum requirements, and during the error, we didn't detect any problems or resource spikes on the VMs (e.g., disk full or resource spikes).Since the error persisted, we first attempted to restart the systems in t

Hello TAC,We are replacing 2 × FS-424D core switches (FortiLink-managed, configured as an MC-LAG pair with ICL) with 2 × FS-424E.When we attempted to replace the first switch, all downstream switches and APs went offline.Can you confirm the correct replacement sequence for this scenario, and whether the new 424E switches must be pre-configured before connection or if they will automatically inherit configuration from FortiLink after joining the fabric?Thanks.

Please help me block logs saved to the SSD. I'm referring to "Local Traffic" and entries that appear even 2-3 times per second. For now, I've disabled "Local Traffic" logging on the SSD, but I'd like to see traffic from Fortigate (e.g., to globalguardservice, NTP, etc.). The FG61E is in transparent mode, connected to the internet via the Local Interface.This large number of entries concerns local network connections from some devices. These entries include:Source=192.168.3.XX (LAN addresses)Destination=255.255.255.255 or 192.168.3.255Application Name="DHCP/DHCP Relay" or "udp/15600"Destination Interface=[object Object]Source Interface=internalHow can I block this, but still allow other connections, such as those to Fortigate servers and other services, to be visible?

FortiManager 7.4.9 Free Trial managing FortiGate 100F on 7.4.9 Config status: Synchronized On FortiManager I've created a new IP reservation under IP Assignment Rules, device global DB status changes to modified, yet when I use the install wizard I'm unable to push the reservation to the FortiGate 100F. The install preview is empty and it doesn't recognize the reservation. Either new one or deleting an old reservation.I have tried to modify a firewall policy along with the reservation but it only recognizes changed policy not the reservation. 

I created a LETS ENCRYPT Cert on my FortiAuthenticator and Fortigate that has the SSID for Guests, always had an issue with GODADDY on Apple devices, so we moved to LE. creating the cert via ACME was ll good, cert is valid , matches the FQDN etc, but now annoyingly the problem is worse, Apple and Android dont trust the cert! when they connect to the GUEST SSID, the phones browser says "Security Warning SSL_UNTRUSTED""This certificate isn't from a trusted authority" but the common name "myfortiauthenticator.mydomain.net" is signed by Lets Encrypt: Issued by:Common name:R13Organisation:Lets Encrypt and the cert is 100% valid.  Fortinet support Lets Encrypt and ACME, and is a perfect solution, but whats the point if Apple and Android dont trust it? or am I missing something?   

hi there,I need help please.I use FG60F with firmware 7.2.x I've created firewall policy with webfilter and ssh inspection. suddenly, some computers can't access certain https website, but the other PC still can access the web without issue. if the -problem computers- use direct internet (not via fortinet), they can access the website. where is the issue? anyone has same experience? thank you

I'm trying to allow CoPilot in office.outlook.com sessions, but block copilot.microsoft.com in general browser sessions, as well as all other LLMs My web filter has Artificial Intelligence Technology blocked in the Fortiguard category based filter, and a URL filter: *.google.com/*udm=50**.google.com/*udm=14*m365.cloud.microsoftbing.com/chatcopilot.microsoft.com*.bing.comcopilot.microsoft I also have an application control profile on the proxy policy, with the  GenAI category blocked. The only way I can get it working is to have the AI blocking web filter in both the the firewall and proxy policies. Having the web filter in just the proxy policy works for most LLMs via browser, except CoPilot. It works, but I'd like to know why, as this goes against the admin guide on transparent proxies. https://docs.fortinet.com/document/fortigate/7.6.6/administration-guide/15908/transparent-proxy I don't like not understanding my firewall's config :( &nbsp

I had configured our email server and setup notifications for rules i.e account lockout. It was working in the past but suddenly stopped. I can successfully send a test email from the super but when I view incidents I can see account lockouts but the Notification Status shows as failed and we are not getting the email notification. "Failed" is kind of vague. Is there anywhere else I can look to get an indication of why it is failing?                                  

Hi everyone,I'm facing a persistent login loop with a Blazor Server (.NET Core) application hosted on IIS 10, sitting behind a FortiWeb appliance. The setup: External Traffic: HTTPS (SSL handled by FortiWeb).Internal Traffic: HTTP (between FortiWeb and IIS).Server Side: I have configured IIS URL Rewrite to force HTTPS=on server variable and enabled X-Forwarded-Proto support. The Problem:When users try to log in, the authentication cookie (.AspNetCore.Cookies or .AspNetCore.Identity.Application) is never stored in the browser, although other cookies like .AspNetCore.Session and FortiWeb's persistence cookies are present. This causes an infinite redirect loop back to the login page.Locally (bypassing FortiWeb), the application works perfectly and the authentication cookie is generated correctly. What I've tried so far: Enabled "Add X-Forwarded-Proto" and "Add X-Forwarded-For" in the FortiWeb X-Forwarded-For Rule.Verified that "Cookie Security" is disabled in the

I have this policy to assign vlan 17 for devices which not managed by MDM.But the result why devices managed by MDM also hit this rule? 

I recently purchase some FortiAP-433G. I connected them to a Cisco 9200L PoE switch. The AP and switch negociate PoE succesfully at 802.3at, and the switch supplies 30W.This AP, according to the spec sheets can operate at 802.3at (30W) or 802.3bt (60W) When creating more than 2 SSIDs on the AP, ir begins to constantly reboot it self. Has anyone experience this issue as well?

Hello,Seems we are forced to move from SSL to IPSEC VPN so we are actually trying it on our FTG901G v7.4.9Our authentication is direct from the fortigate to Active Directory (ldaps)It is working since we activated EAP-TTLS thank's to this trick : https://community.fortinet.com/t5/FortiGate/Technical-Tip-How-to-enable-EAP-TTLS-for-IPSec-IKEv2-tunnels-in/ta-p/408602 BUT, it is not working when we add a FortiToken on the account I saw on this page that 2FA is supported from client v7.4.4 with IKEv2 ldap users : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Overview-of-compatible-IKE-versions-user/ta-p/420733The little stars lead us to this Technical Tip and this Special Notice which explain that there is no free version of the 7.4.4 Forticlient, BUT the 7.4.3 free VPN-only agent is supposed to do the same job : https://community.fortinet.com/t5/FortiGate/Technical-Tip-Multi-Factor-Authentication-support-for-Windows/ta-p/407272https://docs.fortinet

Hi,I am looking for older version of FortiClient VPN version 7.0.8.0427.Can someone please help me with the information about where I can get the software.Thanks,

We use LDAPS to check users belong to an AD group in our explicit proxy policies. Ever since we replaced our domain controllers with Server 2025, users receive a pop-up saying proxy authentication is required. We use regular bind type, with our AD CA's certificate. This test OK, and diagnose debug application fnbamd -1 shows the certificate working.The CNI is cn, but I've tried using sAMAccountName and uid. Looking in Event Viewer on the DCs, I see lots of event id 1216 and 15351535Internal event: The LDAP server returned an error.Additional DataError value:00000003: LdapErr: DSID-0C060666, comment: Error decrypting ldap message, data 0, v65f41216Internal event: An LDAP client connection was closed because of an error.Client IP: <ip of firewall>:17943Additional DataError value:3 The system cannot find the path specified.Internal ID:c06065f I briefly tried disabling ldapserverintegrity and LdapEnforceChannelBinding on the DCs to see if that was the cause, but no cha

Do I need an Advanced Bot Protection (ABP) license to enable biometric-based bot protection on FortiWeb?

Hello,            I downloaded FGT_VM64_KVM-v7.4.11.M-build2878-FORTINET.out.kvm from the Fortinet site but only thing in the extracted folder is the fortios.qcow2 file (103mb). Why doesn't admin or maintainer login work? I can't activate the free  license or activation via web on VPC in Eve-ng . I dont know the ip of the firewall to even try.  Could that be why I am not getting login info because wrapper.txt.is missing?  I am unable to login to get to the web gui to activate license.    Any help will be appreciated.

Hi Folks,Quick question currently running FortiSIEM 7.2.5 and planning to perform content updates via the GUI.Before I proceed, just wanted to double-check the best practices:Is taking a normal VM snapshot sufficient as a fallback?Or are there any specific prerequisites/recommended steps I should follow before doing content updates? Thanks in advance

Hi,my network has a fortinet fortigate 200F firewall and active directory with windows server 2019 (DHCP and DNS) and is connected to the Internet via two different ISPs (A and B) with their respective routers/modems configured for load balancing. There is also an external web server connected to ISP A with a static IP. The ISP A router/modem is a netgate pfsense configured so that the web server uses public IP 1 for external connections (from the Internet) and private IP 2 for internal connections (LAN). Connections to the web server work fine from the external network, but from the internal network I am experiencing a potential DNS Rebind attack issue. After some research, I think this is due to the fact that sometimes internal connections use ISP B, which is the one that does not manage the web server.So I wonder what is the best way to force the firewall to route all internal connections to the web server URL to ISP A (excluding ISP2). Where can I find a guide?Thank you.

Hello, Is it possible to customize the mail that will be sent to the user as soon as I provision a token to him? I didn't find an answer for that in the doc or this forum. Thanks in advance!

Hi everyone,I have a design question regarding connectivity between two FortiGate HA clusters.Currently, I have two FortiGate clusters configured in Active-Passive (A-P) mode. Instead of directly connecting the clusters, both are connected through a Cisco Core switch (Layer 2) using aggregated interfaces (port-channel). Under these aggregate interfaces, multiple VLAN subinterfaces are configured.Only one cluster (FG1101E) has a public IP address and is responsible for Internet access.The other cluster (FG100E) does not have a public IP and must route Internet-bound traffic through the FG1101E cluster.Additionally, some VLANs on both clusters need to communicate with each other (inter-VLAN/inter-cluster traffic).Given this setup, I am considering two design approaches:Assigning IP addresses from the same subnet on the aggregate interfaces of both clusters and using static routes.Running OSPF between the two clusters for dynamic routing.My main goal is to simplify routing, reduce the num

There is no EOS date for 601E equipment on the support site, is it still not decided?