Solved

Can we use wildcard certificate for persistent agent? I have this log from the client when the Persisten Agent using valid wildcard certificate.Wildcard cert!Peername “nac.mydomain.com” matches wilcard “*.mydomain.com”Refusing to connect to trust_DISTRUST nac.mydomain.com|*.mydomain.comConnection failed! 1SslStreamtransport::disconnect()SslStreamtransport::disconnect() NOT joined rxBoostThread because this IS the receive threadSslStreamtransport::disconnect() joined threads, free-ing the SSL State

I use FortiClient on Windows every day for VPN and other company resource access.When FortiClient opens in web browser, I type the one time password digit by digit and it works.When I connect to VPN with FortiClient, it opens from Windows system tray, and typing a digit doesn’t move to the next digit box, so I need to hit tab after each digit. I do this several times a day and it’s so annoying I felt I had to submit this. Please fix this!!!

Please help meI want to set it up like this: I have FortiGate, a Ruijie managed switch, and several APs. FortiGate port 3 will connect to the switch, and the APs will connect to the switch as well. I want mobile devices connected to the APs to be on the same IP subnet as the FortiGate and Ruijie.

Hi all,I can see lots of posts about dual wan connections on the Fortigate with lots of solutions for different scenarios, however I'd still like some advice with my situation.We have a Fortigate 81F (firmware 7.4.12) at the main office.  It currently has one internet link (wan1).  This is used for internet traffic, as well as ipsec vpn from 4 remote sites.  These remote sites also use the Fortigate wan1 as their internet connection.We are using ospf to advertise routes between the main office and remote sites.  The Fortigate's default route is via our isp.We wish to get a second internet connection to connect to wan2.  This will be solely for the ipsec vpn; no link redundancy or load balancing (at this stage, perhaps in the future).  All internet access will be via wan1.In what I hope is a simple situation like this, would setting static routes to both wan1 and wan2 but setting a higher priority on wan2 be enough to prevent atttempts to use wan2 as the internet link?I see other option

We use 600F and hosted switches and APs in the 7.2.13 system.After testing and TAC confirmation, the 600Fwith7.2 system will discard multicast of tunnel SSIDs.Users cannot use Airplay to discover Apple TV through tunnel SSID,even though I have already configured multicast and IPv4 policies according to KB.We have two suggestions, either use 'set capwap-offload disable' or try upgrading to 7.4 or higher for testing.But we currently do not plan to upgrade to 7.4 because it is not possible to directly configure switch ports such as "loop gurad" and "stp budp guard" on the web management page, and these features are precisely the reasons why we chose Fortinet.I would like to know if Fortinet will fix this bug in FortiiOS7.2?Thanks.

I have successfull sync my entra id group to the fortinac, however if i add someone to the group then why the user is not synced in fortinac?Example i add user1 to group IT then if i go to System-Groups-Remote Groups then the member still empty.

Hi, i tried to deploy FortiManager following this doc: https://docs.fortinet.com/document/fortimanager-private-cloud/8.0.0/microsoft-hyper-v-administration-guide/449452/creating-the-virtual-machineAdded a second Hard Disk in “IDE 0” Show me this error, i tried to create Fixed and Dynamically (in differents clear installations) but same error appears even when i have enough space.After this error i cant type in terminal. Any suggestion? 

Good day,I would like to verify that  whether the local network configuration, such as static route, traffic with security files,  will stop when deregister the device from Cloud managment, no not.BrgdsLiu Wei 

Hi, I would like to filter out all the IP from network 192.168.11.0.  Could you guide what is value should I input? I try type 192.168.11.* , or 192.168.11.0 or 192.168.11.1-192.168.11.100. no correct result.  BrgdsLiu Wei 

Hello Everyone, I see that  /api/declarative is desribed in fortinetweb.s3.amazonaws.com/docs.fortinet.com/v2/attachments/7a380719-1f54-11ed-9eba-fa163e15d75b/fortiadc-v7.1.0-handbook.pdf The example is for posting system configuration (Simmilar to F5 DO declarative onboarding) but what about Virtual Servers to be created declaratively ? Something like F5 AS3 way to deploy Virtual Servers. Also is there such options for the WAF?

Hello everyone, I just encountered issue while connected Access Switches (specifically 148F and 124G) to our core switch 2048F. In our enviroment we have FGT 120G as perimeter firewall which is connected to 400F that serves as segmentation firewall and also as switch controller. 2048F is main core switch from which I have connected few access switches (148F and 124G). For some strange reason out of 9 switches only 6 came online without issue. The other 3 did not show up. Strangely I can see the ports leds blinking and if I go to FortiSwitch Ports and roll out the ports of the 2048F I can see the ports online with the missing switches serial numbers shown. The 3 missing switches would show up for authorzation I have waited approx. 30+mins. I have tried to add the FortiSwitches manually but they are still shown as “Offline”.Attaching screenshot from FortiSwtich Controler → Managed SwitchesThis is how it looks from Fortiswitch Ports menu (I circled the switches which I added manually and

Hello everybody,I hope you all doing well,I have some question for Forti web a-a setup as this is my first time updating I did my research and found that both nodes will be updated at the same time and there will be down time so is there any way like splitting the HA connection and try to update one of them then swap the traffic or am taking to much risk ? the upgrade path will be from 7.4.8->7.6.2->7.6.7what is the best way to prepare for such kind of operations I have previously worked with FortiGate's but only in Active-Passive clusters.Please advise as this is my first time trying to prepare for this Forti Web updates.Also have anyone tried 7.6.7 in production env ? it seems for me the most stable one and has no CVEs or known issues.Thank you in advance.

Hello everyone,I am preparing to deploy a brand-new FortiGate appliance for a customer and I have a couple of questions regarding the initial setup process.When I connected to the management interface for the first time, I was presented with a screen requiring FortiCare registration before proceeding.My questions are:Should the FortiCare registration be performed using the customer's FortiCare account, or is it acceptable to use our company's FortiCare account as the implementation partner? What is considered best practice? Does the FortiGate license/support contract need to be activated before performing any configuration changes, or can the firewall be fully configured first and the license activated later? What is the recommended procedure for license activation on a new appliance? Where can the license be downloaded or claimed? Is there an official Fortinet process or best-practice guide for onboarding a new FortiGate? I would appreciate any recommendations based on real-world dep

Hi Everyone.  today we was encountered the Fortigate Dynamic DNS issue in firmware 7.4.11 and 7.4.12. Restart the firewall few time still unable to access even ping google.com also unable to resolve but when PING 8.8.8.8 from Fortigate is reachable.  In the Network → DNS → DNS server show Primary DNS and Secondary DNS server is unreachable.  Even the host name unable to resolve  

I'm trying to setup a POC to demo ZTP.....Using the Fortigate Cloud service, I was able to provision a Fortigate to it's proper On-Prem FMG. However I was unable to get the gate provisioned to the proper CLOUD FMG. (Even though it says it's supported). I then tried using FortiZTP service and was able to provision to the CLOUG FMG successfully.   Has anyone else run into this ? Should we be using the FortiZTP since it's still in beta ?   Tom

Hello FTNTI see in known issues of FortiOS 7.4.11 the following bug id. 1256278 Packet loss occurs when asic-offloading is enabled on FortiGate.  Can anyone explain in which models and/or circumstances this can happen?

Hello,Would really appreciate it if someone can point me to the right direction or help me with the following. Using DoS policy would like to know if its possible to create 2 polices with source like soPolicy#1 IPs from specific country. The limits are set higher or set to disable.Policy#2 All other IPs . The limits are set very low The questions are Does Fortigate support anything similar to the above? If both policies are enabled Will this lead to an increase in the resource usage of the Fortigate firewall? Thank you in advance.

Over the past month, the Fortinet Community has continued to flourish—and it’s all thanks to you. This month we relaunched the Community with a new look and feel, bringing the forums and knowledge base up to date, whilst keeping the familiar navigation and bringing you the latest articles and solutions. Whether you’ve been sharing expertise, asking thoughtful questions, or helping others solve complex challenges, your contributions are what make this space truly special. The Community remains one of the most vibrant hubs for collaboration, learning, and innovation across the Fortinet ecosystem.   Key Wins from the Past MonthWe’ve seen some fantastic momentum recently, with a number of highlights:  Growing Engagement and Collaboration Participation across forums has been stronger than ever. More members are joining conversations, offering solutions, and engaging with peers—creating richer discussions and faster problem-solving for everyone. In the past month, 1500 of you have posted rep

I login to this portal (Fortinet Community) and the vertification code sent to the email. How i can change the vertification code from email to authenticator app?

Hello Wi-Fi adminsThis tech tip explains how to allow a VPN user change his LDAP password when it expires.I tried do the same for my Wi-Fi (managed FortiAP), same described config on FGT and FAC, but when user with expired password tries to connect it just fails to connect, and FAC shows the following message.Windows AD user authentication from (null) (mschap) with no token failed: user password change requiredThe user password must be changed before logging on the first time. (0xc0000224)Any idea what I might have missed?

Hi everyone,We are troubleshooting a FortiGate-6000F running FortiOS 7.6.6 build3652 GA.Two FPC blades, slot 2 and slot 3, are stuck in Dead state with:Status Message: "Waiting for configuration sync."Heartbeat Data: FailedThe other FPCs are working normally.Current load-balance statusFortiGate-6000F (global) # diagnose load-balance status==========================================================================MBD SN: F6KF30T018900031  Primary FPC Blade: slot-1     Slot  1: FPC6KFT018900628       Status:Working   Function:Active       Link:      Base: Up          Fabric: Up       Heartbeat: Management: Good   Data: Good       Status Message:"Running"     Slot  2:       Status:Dead      Function:Active       Link:      Base: Up          Fabric: Up       Heartbeat: Management: Good   Data: Failed       Status Message:"Waiting for configuration sync."     Slot  3:       Status:Dead      Function:Active       Link:      Base: Up          Fabric: Up       Heartbeat: Management: Good   Data

Hello all, I am looking for some assistance regarding using AD groups in EMS policies. My scenario is as follows: I have created a security group for people allowed to use dropbox and configured the web filter and application filter appropriately. I have also created a security group to be allowed to use certain AI applications only and configured the filters appropriately. Based on what I have read is where I am hitting an issue: “Priority-Based Evaluation: EMS typically allows administrators to assign priority levels to different policies. If a user belongs to multiple groups (e.g., both "Standard Staff" and "Remote Workers"), EMS applies the configuration set by the policy with the highest priority.”If reading this correctly, if I am a member of both security groups, I will use the first policy I match with highest priority. So if I put the “allow dropbox” rule first that also blocks the AI Apps, I will not hit the “allow AI apps profile” that follows. Is there a way to control this

Hello,I have been trying to get into the FortiEDR Workflow, but I can’t seem to create or manage the Collector Groups in the FortiEDR Cloud with a FortiEndpoint license. I know that FortiEndpoint EDR is different from the normal FortiEDR, but I have not found a document which said you can’t manage Collector Groups with FortiEndpoint EDR. Even the Administrator Guide for FortiEndpoint does not mention that you can’t configure Collector Groups.

How to apply the Replacement Message in Security Profile in your Policy when accessing the blocked websites?

On FortiAnalyzer, the devices added under Device Manager show "Last Log Time: N/A". However, when checking the dashboard, logs appear to be arriving normally. At the same time, the Log Viewer cannot be opened, and the Reporting section is also inaccessible.The currently used version is 7.4.2, and it seems that there are known issues related to this behavior in this release. Could you please confirm whether this is a known bug and advise on any available workaround or recommended upgrade path?