Solved

Hi everyone,We recently ended our support contract with our previous vendor and decided to renew with a different support provider.Unfortunately, the previous vendor has refused to provide the FortiGate administrator credentials and has also refused to share the latest configuration backup.we tried using the maintainer account with the password format bcpb+<Serial Number>, but I received the following error:login: maintainerPassword:Verifying password...Login incorrectDevice Model: FortiGate 200FIs there any supported method to reset or recover the administrator password without performing a factory reset, so that the existing configuration is preserved?Any guidance or recommendations would be greatly appreciated.Thank you.

I enrolled my forticlient with the EMS, it shows “connected”.When I try to connect to the VPN (SAML Login), it’s stuck “connecting”.Two problems come to mind:* It doesn’t show the SAML popup (auth through azure) as it does on windows.* when looking at service log, last line says /opt/forticlient/iked: invalid option -- 'P'I tried a number of things, starting the session with X or Wayland, no change, setting the open in external browser setting flag … with no success.Help

Hi everyone,I'm trying to integrate FortiWLC 8.6-5 build-8 (FortiWLC-500D) with Aruba ClearPass Guest (ClearPass Policy Manager 6.12.7.308288 on C3010 platform) as an external captive portal.Current setupFortiWLC 8.6-5 build-8 External captive portal: Aruba ClearPass Guest Authentication type: RADIUS Captive Portal External Server Type: Fortinet-Presence External URL:  https://<clearpass fqdn>/guest/guest_register_3.phpThe captive portal profile is configured as:Authentication Type: radiusCaptive Portal External Server Type: Fortinet-PresenceSuccess Redirect URL: https://<default redirect url>Login flowClient connects to SSID.FortiWLC redirects the client to the ClearPass Guest portal.The login page receives all FortiWLC parameters correctly, including:magicusermacuseripserveripapmacapidapnodeidssidpost=https://<controllerip>:8081/vpn/loginUser? User enters username/password.ClearPass successfully authenticates the user against the authentication source.After successf

Hello team, I have interesting situation. there are 4xFg900G in cluster. there is FTP server in vlan 100.L3 DG address for that vlan 100 is on Fortigate.When secondary 900G FGs from cluster want to reach ftp they can not.We also have cluster of 4xFG 400F for additional services, and they can all reach ftp server , no matter primary or one of 3 secondary FGs How to solve this situation?My final aim is to upgrade one of secondary FGs regarding MVC (Multi-version cluster) option, set upgrade-mode local-only, and upgrade one of secondaries and then reset ha uptime so that upgraded one become primary. Reason for that is because we must not have any downtime, and we want to take test after upgrade if all services are ok

 EnvironmentPlatform: FortiGate (hardware appliance)HA mode: Active / PassiveFortiOS current version: 7.4.8Target version: 7.4.10HA priorities:Unit A (Master): priority 200Unit B (Slave): priority 100Expected upgrade behavior (normal case)Based on Fortinet documentation and past experience, the expected HA upgrade sequence is:Firmware upgrade starts on the slave unit (B).Slave reboots and temporarily disconnects from HA.Cluster fails over to the upgraded slave.Firmware upgrade is then applied to the former master (A) in background.Final failback occurs according to HA priority (unit A becomes master again).Observed behavior / Issue descriptionDuring the upgrade from 7.4.8 to 7.4.10 (firmware uploaded via GUI using .out file downloaded from fortinet official source):The upgrade process took more than 20 minutes, significantly longer than usual.HA became disconnected, and unit B (slave) was no longer visible from the cluster GUI.Accessing unit B directly via Console & Management

What can i do if endpoint ip address on the device inventory and on the adapter showing wrong ip?actually the endpoint get ip 10.100.50.168 

Hi everyone, I'm experiencing a strange issue with an IPsec Dial-up VPN after migrating users from SSL VPN. The environment is FortiGate 400F  with FortiClient VPN 7.4.3.4323 on macOS Sonoma 14.1. The problem only affects macOS clients; Windows clients using the same VPN configuration and user account work correctly. Split tunneling is enabled, and all firewall address objects are configured correctly as /24. However, after connecting from macOS, one of the split-tunnel routes is installed with an incorrect mask (for example, 10.10.10.0/24 becomes 10.10.10.0/31). If I remove that subnet from the split-tunnel group, the issue moves to the next subnet (10.10.11.0/24 becomes 10.10.11.0/31), so the problem follows the route order rather than a specific network. I also tested with a split-tunnel group containing only three networks, and everything works correctly on macOS. The production split-tunnel group contains around 190–200 routes. Has anyone encountered a similar issue or knows wheth

Hi,FortiGate 7.6.7, IKEv2 dialup with EAP, mode-cfg and IPv4 split tunnel enabled. internal-domain-list is configured, but split DNS never takes effect: every DNS query from the client reaches the FortiGate, not only the two internal domains.config vpn ipsec phase1-interface    edit "<tunnel>"        set type dynamic        set interface "<wan-if>"        set ike-version 2        set peertype one        set net-device disable        set mode-cfg enable        set ipv4-dns-server1 <internal-dns-ip>        set internal-domain-list "domain1.local" "domain2.local"        set eap enable        set eap-identity send-request        set ipv4-split-include "<split-group>"    nextendVerified with: diagnose sniffer packet any "port 53" 4 0 l — public domains such as google.com show up as well. Same result on FortiClient (Windows) 7.4.3 and FortiClient mobile 8.0.0. VPN was fully reconnected after each change.Questions:1. Anything else required in 7.6.7 for internal-domain-

What are these highlighted labels??? All testing passed???Seen after upgrading from 7.6.6 to 7.6.7 (Azure) 

Hi everyone,I wanted to know if it's possible to manually edit these parameters on the unlicenced FortiClient (VPN Only) version for MacOS ?See the image below:  In particular, I need to be sure whether the <eap_method>2</eap_method> parameter (which corresponds to EAP-TTLS/PAP) can actually be configured.I'd like to know if anyone on MacOS has managed to apply these settings, or if I'm forced to purchase the FortiClient Standalone Edition (the client doesn't have the option to buy an EMS server).For additional context regarding my question: currently, we have an IPsec Remote Access VPN setup using IKEv2 + LDAP + MFA (via SMS).Thank you all in advance.

Hello,I am trying to deploy the FortiFirewall-VM64-KVM v7.6.7 (build 3704) permanent evaluation on Proxmox VE (KVM).After the initial boot, the GUI always redirects to:/prompt/fortigate-setup?viewOnly=1&startup=1but the page remains completely white and the setup wizard never loads.The CLI shows:License Status: InvalidRunning:exec vm-licensereturns:This VM is using the evaluation license.Failed to download VM license.Output of:diagnose hardware sysinfo vm fullshows:valid: 0status: 3code: 0Things I have already tried: Deployed multiple fresh VMs. Factory reset. Tested with multiple browsers. Verified Internet connectivity and DNS. Successfully pinged update.fortiguard.net and support.fortinet.com. Followed the suggestions from this Community post:https://community.fortinet.com/support-forum-92/issue-installing-a-vm-fortigate-223043?postid=223128#post223128 The behavior remains exactly the same.I also found posts mentioning activation via TFTP using a .lic file, but since I

Dear Experts,I’m working with FortiWeb, which deployed 6-8 months ago and security policy in monitor mode. Now, customer decided to change security policy to Blocking Mode from Monitor mode.I have checked for Fortinet official document, but didn’t see any recommendation or workaround for such transition from Monitor mode to Blocking mode. Appreciate, if experts can advise on this.  Regards, Faridul

Based on below article, can i know if every group in fnac inventory should have L3 device for L3 polling? 

Hello everyone,I am running into an issue regarding a duplicate device in EMS , and I am unable to delete the stale record because of the Azure AD sync lock.Environment: FortiClient Version: 7.2.12 OS: Windows 11 Enterprise EMS Integration: Synced with Azure AD (Entra ID) The Current Issue: Telemetry is Connected: The clean reinstall fixed the WMI conflict. Forticlient Telemetry now successfully connects to EMS. Duplicate Device in EMS: Because of the clean reinstall, the endpoint generated a new UID. EMS now shows two records for the exact same Hostname/MAC Address. One is Offline (old UID) and one is Online (new UID). Cannot Delete the Stale Record , but the license was used twice on the same device My Questions:What is the best practice to remove or merge this stale duplicate device in EMS?Any insights or workarounds would be greatly appreciated. Thank you!

I want to test latest Fortigate VM image on Virtualbox. but I get error “Failed to start !”. Is there some way to start the VM locally?

How to Protect Fortigate from IPv6 Security Risks

Hi everyone,I have installed the following FortiGate VM image in EVE-NG:Image: FFW_VM64_KVM-v8.0.0.F-build0167-FORTINET.out.kvmAfter booting the VM, I don't see any option to add or upload an Evolution License during the initial setup.When I click Cancel on the Add License screen, it immediately returns me to the device login window, and I'm unable to proceed any further.Has anyone experienced this issue before?Could you please help me with the following questions:Is this VM image compatible with an Evolution License? How can I upload or activate the Evolution License on this image? Is there any additional configuration required for EVE-NG or the VM before licensing?I have attached a screenshot of the issue for reference.Any suggestions or guidance would be greatly appreciated. 

Hi all, This is my first post on these forums, so hello to everybody :) I'm going to start by asking a question i don't expect many people to be able to answer but i hope somebody who is familiar with BGP and ADVPN can crack this one.  I have labbed up the below scenario and its working great.  Hub/spoke topology with direct spoke to spoke connectivity on demand. http://cookbook.fortinet.com/configuring-advpn-in-fortios-5-4-dynamic-hub-and-spoke-vpns/ I have got abit more adventurous and added a secondary WAN connection to each firewall and added a second round of ADVPN config/VPN's to establish tunnels over the new WAN connection in a bid to achieve ADVPN redundancy should the primary VPN's fail. The interesting bit is that it does work (kind of) - If i shut the VPN's down on the hub it works, both spokes will speak to the hub via the second VPN tunnel and agree new spoke to spoke connectivity over the secondary connection.  However it does not

I am using console server to connect to all my network gears such as Aruba, Cisco, FortiAll Aruba can use micro usb console  and some usb-cAll new Cisco can use mini usb console and some usb-cFew Forti can use mini usb console SerialtoUSB converter already $8 (not including console cable)Good one generic micro usb cable only $2. 4x cheaper SUGGESTIONS:1. could you make all new Forti has microusb or usbc console tq  

The port switch connected to the ipphone and if i plug endpoint to the port of the ipphone then the port switch is shutdown even there are no port security in the port switch. Anyone know why?I can see the log from the switch Jul 20 14:30:13: %AUTHMGR-5-SECURITY_VIOLATION: Security violation on the interface GigabitEthernet2/0/1, new MAC address (f4a8.0d3d.5aeb) is seen.AuditSessionID  11C8640A000038317E6EAFB7  switchport access vlan 251 switchport mode access authentication host-mode multi-domain authentication order mab dot1x authentication priority dot1x mab authentication port-control auto authentication periodic authentication timer reauthenticate 180 mab snmp trap mac-notification change added snmp trap mac-notification change removed dot1x pae authenticator dot1x timeout quiet-period 10 dot1x timeout server-timeout 30 dot1x timeout tx-period 10 spanning-tree portfast 

Hello.First, I apologize for my imperfect English. Recently, I started learning about networking using FortiGate.When running FortiOS v7.6.6, I configured IKEv2/IPsec VPN on a FortiGate 60F.At that time, the VPN connection worked correctly.However, after upgrading the FortiGate to FortiOS v7.6.7, the VPN connection stopped working.No VPN configuration changes were made between the upgrade and the failure.Based on the FortiGate logs and packet captures taken with Wireshark,I suspect that during the certificate authentication process,the intermediate certificate that should be sent from the server to the client is no longer being transmitted. After rolling back to FortiOS v7.6.6, the VPN connection started working again.I also confirmed that the VPN connection works on FortiOS v7.6.7when the R12 intermediate certificate is manually imported into Windows.This seems to indicate that the client is not receiving the intermediate certificate from the FortiGate during authentication.The follow

There is an analyzer with version 7.0.13. When you search fortigate log for the last 7 days on Analyzer, pages of logs come up. However, there is no total log count for the last 7 days anywhere on the page. How can I see the total number of traffic logs in any interval I enter.

Hello all. Looking for anybody who has run into this issue and may be able to provide guidance.We have a pair of FGT 70Gs running 7.4.9 connected to a stack of 148F FSWs running 7.2.5. This is our standard stack and we run it at dozens of sites.We have NAC enabled via the built in managed FSW setting (not FortiNAC). We add devices via NAC policies individually and via wildcard filters such as Vendor name and device type (Example: IP Phone). Our switchports are configured in NAC mode and based on the device that plugs in, the dynamic VLAN will assign to what's configured in the NAC policy.Anywhere from a couple to a few times a day, users with devices plugged into these NAC-mode switchports say their devices are doing network hard down, and then coming back up moments to minutes later. I checked logs and am seeing that the entire NAC MAC address cache appears to be deleted out and then added back, all at once but separated by short periods of time. This aligns exactly with when the issu

Hi,We're reviewing our VPN authentication setup and would like to add MFA for remote users.At the moment, OpenVPN authenticates users against our on-premises Active Directory. Because some parts of our environment don't have reliable Internet access, we're trying to avoid cloud-based MFA platforms.I'd be interested to hear how others have approached this.Did you integrate MFA through RADIUS, LDAP, or another method? Which solution has been the most reliable in production? Any issues with OpenVPN authentication or user experience after enabling MFA? Anything you'd recommend before rolling it out?Thanks in advance for sharing your experience.

I’m using the 3-seat free FortiClient EMS Cloud offering that came with my FortiGate licensing and have run into a strange issue enrolling an iPhone.My Fedora 43 Linux laptop registers successfully to the same EMS Cloud tenant, so the tenant and license appear to be working, at least in general. However, my iPhone will not register and always gives:“Registration Failed, Error: The invitation code is invalid.”What makes this confusing is that the invitation code does not seem to be truly invalid, because every failed iPhone attempt still causes the invitation Use Count to increase in EMS Cloud. At the same time, the failed attempt does not consume a license seat.What I’ve already tried:confirmed I am using the full FortiClient iOS app, not VPN-onlytried multiple invitation typestried existing and newly generated invitation codestried bulk invitationstried QR code onboardingtemporarily disabled Enforce User Verificationsigned out and back into EMS Cloudconfirmed EMS now shows user v