Solved

I have 3 sites and 6 FAC vms  , 2 fac in HA(active-passive)  in each site is deployed.  one site will be primary and other two will be secondary. can we syn config of primary site with other two site in this setup?

Dears Appreciate your support to advise with the needed co to solve below issues:High121010TLS Version 1.1 Protocol DetectionHigh17367Fortinet FortiGate Web Console Management DetectionMedium157288TLS Version 1.1 Deprecated ProtocolMedium187315SSH Terrapin Prefix Truncation Weakness (CVE-2023-48795)Medium51192SSL Certificate Cannot Be TrustedMedium57582SSL Self-Signed CertificateLow153953SSH Weak Key Exchange Algorithms EnabledLow10114ICMP Timestamp Request Remote Date Disclosure 

Hello Team,i have configured VXLAN over VPN  with MP-BGP EVPNVLANs that are part of VXLAN have VRRP enabled .VXLAN  and VRRP are working as expectedThe problem is when traffic is traversing the DCs (From the Secondary DC to the Primary DC - VRRP-wise) ,At the destination DC, the traffic is not returning as there is no routing pointing to VXLAN for the return traffic.There is BGP between DC and the network that is trying to reach the VXLAN IP, which is advertised over the IPSEC.The strange thing is that when i runed POC on FG 7.4.7 it was working. attached the config:    

Hello,i'm stuck in creating an Ipsec dialup vpn ikev2 with cisco DUO.During the Phase1 negotiation i see errors on the EAP failing negotiation, following the screenshot directly from the firewall gui and the log taken from cli.I double checked all the settings, configured even the following for EAP:    set eap enable    set eap-identity send-request    set acct-verify enable But i'm still facing "FNBAM_DENIED" followed by the "connection expiring due to EAP failure", what am i missing and should do?My radius is DUO_MFA with ip 192.168.20.125105.94.83.72 is the remote ip and 25.36.47.58 is my public ipjohn.week is my userFw version is 7.4.7Forticlient version is 7.4.3 and 7.4.0.1658     VPNFWISDB (Vpn) # ike V=internet:accepts ike tcp-transport(vd=1, vrf=0, intf=0:55, 88.51.233.52:4500->157.245.243.118:36001 sock=0 refcnt=2 ph1=(nil)) (53).ike V=internet:Wrong IKETCP prefix(OPTION)ike V=Vpn:5: comes 25.36.47.58:500

Hello everyone, I have a FortiGate 400F and updated it from version 7.2.11 to version 7.4.8. I'm currently trying to access Zabbix via SNMP, but I'm getting errors. When I try manually using snmpwalk on my Ubuntu server, I get No Response From... and Timeout errors. I've tried SNMP v2 and SNMP v3, removed the AUTO settings, and still the same thing.The servers I am testing are added as trusted hosts, SNMP is active on the interface side, there is no Local in policy, and even if I manually add and allow them, timeout errors continue.Another server in the same src network was already accessing via SNMP before the update, so there is no problem with the firewall policies.diagnose debug application snmpd -1diagnose debug enable commands do not produce any logs. They are currently being tested.When I examine the issue at the kernel debug level (with the commands below)diagnose debug flow filter cleardiagnose debug flow filter saddr 192.168.1.212diagnose debug flow filter daddr 192

I build site to site vpn connection from fortigate in HQ and sophos xg in branch.In the tunnel interface in fortigate listen on port8 with ip address xx.xx.xx.230The vpn connection is established, the branch and hq can communicate but if i traceroute from branch to hq i feel strange why the traffic passing thru another ip in fortigate xx.xx.xx.246 and not to xx.xx.xx.230?Here my tracert resultTracing route to 10.7.208.52 over a maximum of 30 hops1 <1 ms <1 ms <1 ms 10.108.150.12 22 ms 16 ms 20 ms xx.xx.xx.2463 29 ms 20 ms 20 ms 10.7.101.24 21 ms 23 ms 18 ms 10.7.208.52

I have implemented IPsec with SAML on a fortigate and can connect fine to it from some machines but other machines are incredibly unstable. The forticlient (vpn only 7.4.3) will connect, the application will be unresponsive for a few seconds and then will say connected however no packets will flow. What is the best version of FortiClient to use with IPsec/SAML for stability? Also is there a way to download older versions?

Hello team!! I hope you are doing well!!We have 2 Fortigates 100F in HA with many IPsec VPNs for FortiClient users.Just one user has a problem to connect from his house.  When he use another internet connection in the same computer this works fine but with his own ISP sometime does it fails (Sometimes work also)When this fails, I can see the following logs on Fortigate: date=2025-09-11 time=12:38:58 eventtime=1757605138121774900 tz="-0300" logid="0101037134" type="event" subtype="vpn" level="notice" vd="root" logdesc="IPsec phase 1 SA deleted" msg="delete IPsec phase 1 SA" action="delete_phase1_sa" remip=RemoteIP locip=LocalIP remport=18052 locport=4500 outintf="port9" cookies="b77cf798b4edb960/b7f28e5eae0677b7" user="1011" group="N/A" useralt="N/A" xauthuser="N/A" xauthgroup="N/A" assignip=N/A vpntunnel="IPsec-IT-W3" fctuid="N/A" advpnsc=0date=2025-09-11 time=12:38:38 eventtime=1757605118948074500 tz="-0300" logid="0101037127" type="event" subtype="vpn" level="notice" v

Hi Folks, I upgraded from FortiClient (VPNOnly) 7.4.1 to 7.4.3 per instruction from my VPN provider last week, and where before SAML via External Browser worked fine with Firefox Developer Edition, it has stopped working on the newer version.It now shows an NS_ERROR_CONNECTION_REFUSED on reaching the 127.0.0.1:8020 part, yet when using Edge/Chrome as the browser it works as expected/previously.I hear anecdotally that others using regular Firefox are not experiencing this issue either.I've tried restarting the PC and reinstalling FortiClient three times (at least), as well as repeatedly retrying the connection. Zero successes.  Any thoughts? I'm at my wits end a bit here.I'm reticent to start bouncing around alternate versions, as I'm in a managed environment and it takes time to grab the version-specific downloads from the VPN provider and then have my own IT department manage the uninstall/reinstall process, so anything I can do without admin permissions is a good place

Hello,I am configuring FortiNAC to work with RADIUS authentication, but I haven’t been able to find anywhere a complete list of available RADIUS attributes.Additionally, when setting up devices for EAP-TLS authentication using certificates, I noticed that NAC allows the use of “pseudo-attributes” such as TLS-Client-Cert-Common-Name or TLS-Client-Cert-Subject-Alt-Name-UPN, and so on.Is there a full list of all available attributes?When I open the dropdown menu, it only shows the first 10 attributes starting with “A.”If I type “TLS” and open the dropdown, it doesn’t show these pseudo-attributes either. Any guidance on where to find a complete list of supported RADIUS and TLS pseudo-attributes would be greatly appreciated.Thank you!

I have deployed FortiNAC in HA mode. And use its radius server to authenticate users when they are login to the network devices. When the primary unit is active user can login using their name and password only. However when secondary unit become active users should include name@domin name to access it. Can someone explain wh

Hi,I need to configure policy-based routing and I'm testing it, but it doesn't work even though the configuration is correct.According to a veteran's advice, I temporarily enabled asymroute, and when I immediately disabled it, the routing started working.I'm reluctant to use this method. Is this a well-known workaround?Do you have any advice on a better way to handle this? Hardware: FortiGate 120G OS: 7.4.8Thanks,Kenji

If the Fortigate have multiple vdom, can we directly enter to the vdom global without issuing 'config global'?Currently when i ssh to the fortigate i must enter that command first before i can execute 'get system global'

I currently have two FortiGate 60F devices running in an active-passive HA pair. I am monitoring the active device in N-Central via the management IP, but I am wondering what is the recommended method to monitor the standby unit as there is not a management IP of the standby device. I was planning on monitoring fgHaSystemMode (OID: .1.3.6.1.4.1.12356.101.13.1.1) via SNMP and querying against the OID to ensure that the value of this 3 to match active-passive as I will know if the passive device is down if this value is either standalone or active-active. Currently we are only monitoring the active device so we would not be aware if the secondary goes down 

Hi,We are preparing to migrate from FortiClient EMS 7.2.10 to 7.4.4.We deployed EMS on a Hyper-V VM.Copy/Paste doesn't work in EMS CLI 7.4.4.How can I enable the clipboard functionality? 

Hello,We have an HA pair of FortiGate VM04s in our Azure development environment that we are using to test for a redesign. The FortiGates were built with the "ELB/ILB Sandwich", as Azure/Fortinet documentation outlines. We also have a GLB placed in front of the ELB, in order to gain the flexibility a global IP provides. The backend IP of the GLB is the single ELB public IP.We have tested the following successfully:- We can terminate an IPSec VPN to the ELB, directly connected to the two outside FortiGate vNICs- We can terminate an IPSec VPN to the GLB However, we have not been able to successfully terminate separate VPN tunnels to the GLB and ELB simultaneously. The ability to do so would greatly ease our cutover process, as we currently have a standalone FortiGate-VM in production with a regional IP and dozens of vendor IPSec tunnels terminating to it. If we can prove that it's possible to terminate to the GLB and ELB simultaneously, we can slide our production regional IP over t

Hi i have a problem to ativate double stack for  vpn ssl   config vpn ssl settings set dual-stack-mode enable end Response in cli mode   set dual-stack-mode enableTo enable dual-stack-mode, all SSL-VPN policies must be configured with IPv4 and IPv6.node_check_object fail! for dual-stack-mode enable    I have only one vpn policie. do you have an idea ? Regards

Hello, I’m looking for a 10G Single mode SFP module to connect a switch and Fortinet routers over a short distance (around 2–10 meters). Could you recommend the right option?Best regards,

Hi, I have a new deployment for FortiGate as an edge firewall. The latency design involved DC FW acting as both DC and Edge. Now I will implement Fortigate as Edge and do point-to-point with DC FW. The Q is. I do have:- one Internet link with 2 IPSec over the Internet link.- 2 MPLS links. One to Cloud servers with paloalto fw, second for my 10 Fortinet branches. For the internet, I will have only 1 link. And over that will build 2 IPsec (One to be a Load balance SDWAN with MPLS to my branches, Second to be a passive link with MPLS to my cloud service). What is the best practice to build that topology? Should I add all three 3 WAN interfaces under the SD-WAN Zone, and with that ZONE create 2 IPSec? Or I have to keep the 3 WAN interfaces without SDWAN zone as normal WAN interfaces, as there is no Load balancing except the connection with branches. Then create SDWAN for IPsec. Kindly for advice for the best practice solution.

Hello community,Since I have configured some mail alerts with the automation in our FortiGate-VM I noticed that the "High CPU" message gets triggerd every day exactly every 8 hours (0:00; 8:00; 16:00). But the cpu spikes only for a very short time, since I don't even see the spike in the CPU widget or GUI process monitor.I tried configuring the generation of the local reports to other times than those 3 times with the CPU spikes, but it still happens.I also looked at the times where IPS and AV database updates (setting is automatic), but it never was at those times from the CPU spikes in the last weeks.Also rotation of logfiles only happens at 0:00 so this does not explain the other times from the CPU spikes. I also run some CLI commands for monitoring the system performance, when a mail alarm is sent, here is the output from it:========== #1, 2025-08-14 08:00:07 ========== FW-SAAS config global FW-SAAS (global) get system performance status CPU states: 83% user 14% system 0% nice

hello, I need to restrict IPSEC VPN I need to connect only from UAEI Make this step but problem when I connect VPN (connection fine but no data send for example I cannot ping to any server or pc or login to FortiGate).

I'm preparing to migrate from FortiEMS 7.2.10 to 7.4.4 in a test HyperV environmentI've downloaded and configured version 7.4.4. I don't have any Linux knowledge.Now I want to perform the migration steps.But I'm getting the following error during the first command:Error: unknown command "sudo" for "emscli"How can I enable sudo? 

For about 4 weeks now i have started to see some gaps in the Logs for forward traffic.some logs with the gaps are matched to IP's of user machines, but they are getting deny all as it cannot validate a policy against a user.FSSO is setup and looks to be working correctly, the only thing that has changed was a change of certificate that we were using for SSL Inspection as we reconfigured our NPS server.I am at a bit of a loss at what else to look at.

Hi, while configuring Tier 1 (Core) and Tier 2 (Distribution )FortiSwitch. I want to test 2 device ping each other, with the same vlan (for example VLAN2). Let say I don't want to mind the FG, only the L2 first. Do I need to set the VLAN2 with IP address to the Tier 1 (Core) and Tier 2 (Distribution) or it will work even if I set only to Tier 2. Thanks

The upgrade order is 7.2.8 > 7.2.9 > 7.2.11, but I accidentally guided the upgrade to 7.2.11 right away. Is there anything that could be a problem? These are 101F and 61F. Thank you