Support Forum

I have a Role Access Matrix containing over 30 roles and 40 resources. I would like to use this matrix to monitor user activity and identify instances where a particular role accesses a resource that it is not authorized to access.Instead of creating separate rules for every role-resource combination, I would like to create a centralized repository or lookup table containing the authorized role-to-resource mappings. During rule evaluation, the SIEM rule should reference this repository and trigger an alert whenever the observed Role + Resource combination does not exist in the authorized access matrix.Example logic:Observed Role + Resource → Check Role Access Repository → Authorized = Allow / Unauthorized = Trigger IncidentHow can I create and maintain such a repository in FortiSIEM, and how can I reference it dynamically when creating the correlation rule?

This article describes a scenario where unexpected MAC address loops, MAC flapping, and improper MAC route advertisements occur when EVPN Multihoming and an MCLAG setup are configured simultaneously across leaf switches.  Scope:FortiSwitch Spine (3032E) and Leaf switches (1048E, 2048F)Feature: EVPN Multihoming / VXLAN  Symptoms:Observing unexpected MAC address loops, MAC flapping, or improper MAC route advertisements (endpoints connected to a single leaf being advertised or learned across multiple leaf interfaces unexpectedly).Configuration incorporates both an MCLAG setup between two leaf switches and an EVPN Multihoming design simultaneously. Cause:An architectural conflict arises when attempting to combine MCLAG between two leaf switches with EVPN Multihoming in the same topology. FortiSwitch architecture does not support MCLAG between two separate leaf switches in an EVPN multihoming design framework.If MCLAG is deployed between two leaf switches, local port aggregation handles red

We have been using IPsec VPN with a peer group and peers.The peers have the CA cert of the EMS server and the subject as part of the peer identifier. This has always worked fine until the upgrade to 7.4.13 where we get an “invalid certificate” error and no connection. If the Peer Option is set to Any Peer ID then the VPN connection works. I’ve looked through the “known issues” of 7.4.13 but nothing applies.Any ideas?Thanks.

 Product: FortiManager VM64-KVM, v7.4.12 build 2836 (GA.M), downloaded from the support portal (VM Images, KVM).Problem: On first login the GUI shows the license page. With “Free trial” selected and FortiCloud login (valid account, the credentials work on the FortiCloud portal), the activation fails.GUI message: “Unexpected error happened while processing your request, please refer to error section in response for more details.” HTTP: POST /gui/userauth returns 401. CLI debug (diagnose debug application gui 8 / curl 8): “Error when retrieving trial license from FortiCloud: Unexpected error happened while processing your req.”Environment: KVM/QEMU on Ubuntu (WSL2), user-mode NAT networking, outbound HTTPS works (forticloud.com reachable, DNS OK). Serial shown: FMG-VM0000000000, License Status: Valid in get system status but the GUI keeps forcing the license page. VM UUID is set and unique. System time is correct.Already tried: reboot, fresh disks, DNS fixed, different attempts; the same

Hello everyone, I have a few questions about how synchronization works at the HA group level.Virtual IPs (VIPs): Are VIPs synchronized across all the clusters/units that belong to the HA group, or must they be configured separately on each cluster? DKIM keys: Are DKIM keys synchronized across all the units/clusters in the HA group? Or do we need to generate or import them manually on each one? “Action on failure” in the HA group: When this option is set to “Wait for recovery and switch to configured role”, what happens when Site A comes back after being down while Site B was acting in its place? Does Site A resynchronize and apply the configuration changes made on Site B during the outage before switching back to its configured role? Or does it come back with its old configuration, potentially overwriting or ignoring the changes made on Site B? Thanks in advance,BR,

After upgrading to 7.4.13, many APs are no longer connecting to the firewall. A small number are connected, but most are not.What can be done, or is this a known issue?

After upgrading a FortiGate HA cluster to FortiOS 7.6.8, the HTTPS GUI was no longer accessible. Browsers returned ERR_SSL_PROTOCOL_ERROR, while curl reported SEC_E_DECRYPT_FAILURE.The GUI worked when TLS 1.2 was explicitly enforced. The issue was resolved with:config system global    set admin-https-ssl-versions tlsv1-2    set tls-session-cache disableendA reboot was required for the TLS session cache change to take effect. After the reboot, the GUI was accessible again.Is this a known issue in FortiOS 7.6.8?

How and more importantly when are we supposed to update the OS using emscli please?This is the EMS Ubuntu 22 appliance from Fortinet running EMS 7.4.8 not a DIY Ubuntu build with EMS installed on it.EMS is up to date but the documentation doesn't seem to cover the OS updates but you read things on here about not updating because it can break EMS and so on https://100001.onl/ .

Mostly AI Generated, but results of my own work. After considerable troubleshooting, I've successfully implemented Windows Native Always On VPN (AOVPN) Device Tunnel with FortiGate 7.4.13, using machine-certificate authentication, Microsoft Intune, and Active Directory authorization.First, credit where it's due: Richard Hicks (richardhicks.com) has published excellent documentation on Windows AOVPN that helped tremendously.Also, let's be clear: FortiClient already provides always-on, pre-logon VPN connectivity using machine certificates and, in my experience, does it better than Windows native AOVPN.However, if you're like me and have valid reasons not to use FortiClient VPN, this post is for you.Our EnvironmentWe're using: FortiGate running FortiOS 7.4.13 Windows native IKEv2 Device Tunnel Enterprise CA with machine certificates deployed through Intune SCEP Microsoft Entra hybrid-joined Windows computers Active Directory LDAP for computer authorization Intune-managed split-t

I’m using Fortianalyzer 1000F version 7.6.8. I have a myriad reports that run daily based on traffic logs. These reports get mailed to IT and Security staff. What I find though is that the reports get sent even if there are no results. Any other reporting tool I have seems to have an option to only send mail alerts/reports if there are results (Splunk etc.)Is this possible in Fortianalyzer? If not, are there alternatives ?

Hi All,I have fortigate firewall (OS 7.6.7) with two WAN interfaces (WAN1: 10.10.10.1 & WAN2: 20.10.10.1)And configured IPsec tunnel on WAN1 10.10.10.1), generally we can add another public IP as secondary IP to IPsec tunnel.But now I want to add WAN2 IP (20.10.10.1) as secondary IP to my existing tunnel, which is configured on WAN1 interface. Will it possible?, or in traditional way have to configure two IPSec tunnels?

I am trying to configure my Fortigate 60E using the Ansible ForiOS Galaxy plugins. Currently I am working on the vip configuration. For most of the vips it is working fine but I can't get the ssl vip to work.I would like to set up a ssl vip of type server-load-balancer like this:- name: "Configure {{ vdom }} vdom virtual IP for IPv4" fortios_firewall_vip: vdom: "{{ vdom }}" state: "{{ state }}" access_token: "{{ token }}" firewall_vip: name: "vip_ssl_placeholder" extintf: "management" extip: "10.10.10.1" extport: "6363" type: "server-load-balance" server_type: "ssl" monitor: - name: "tcp-6363-link-monitor" ldb_method: "least-rtt" persistence: "ssl-session-id" realservers: - id: "1" ip: "10.16.10.1" port: "6363" - id: "2" ip: "10.16.10.2" port: "6363" ssl_mode: "full" ssl_certificate: "Fortinet_Factory"However, when applying the script I get an error -56 from the Fortigat

Hi Everyone,We have a fortigate firewall with HA and FortiOS is 7.4. also laid few client based FortiGate SSL-VPNs accounts.Now we have to upgrade either 7.6 or 8.0, where as not support the client based FortiGate SSL-VPNs accounts. So, what is the best practice for moving to 7.6 or 8.0 version?.Before upgradation can we use any migration tool only for SSL-VPN accounts to IPsec or any other?.MY SSL-VPN purpose is providing the RDP access & Web based internal urls.  Anyone guide me for best practice for without any production impact?.Thanks in advance.  

Running FortiClient 7.4.8.2066 on Windows 11 25H2.What’s happening, Users can connect, everything works.  Next time they open laptop, unable to connect VPN Software.The Fortinet SSL VPN Virtual Ethernet Adapter is disabled.  Simple restart of laptop re-enables card, works again.    100 Users, at any one moment in time, 30 NICs are disabled on average.My best guess, and it is a guess, relates to Power Management on WiFi card.  Windows is disabling WiFi when you put laptop to sleep.  This event disables FortiClient NIC.  Wake laptop up, WiFi enables itself, FortiClient doesn’t.Has anyone seen this before ThanksBryan

Since yesterday morning a lot of websites give a 400 Bad Request ( see screenshot) when DeepInspection is enabled.Disabling DeepInspection fixed the problem.I also saw other issues relating DeepInspection(https://community.fortinet.com/support-forum-92/some-website-not-loading-with-deep-inspection-230891) But this seems to be other. We already have policy in Proxy mode en disabling AV is also not working.We use firmware level 7.4.13. More people have issues with this? 

Product: FortiGate-80F-POE, S/N FG80FPTK24000713 Firmware: FortiOS v7.6.8 build3744 (GA.M); IPS Engine 7.01200; AV Engine 7.00062 Severity: 3 (business impact, workaround available)SummarySince Windows clients started sending hybrid post-quantum key shares (OpenSSL 3.5+, Chrome/Edge), TLS 1.3 handshakes from Windows hosts through our FortiGate time out. The ClientHello (~1.5–2 KB) is split into two TCP segments. For sessions without the TCP timestamp option (Windows default timestamps=allowed), the FortiGate ACKs the second segment to the client on behalf of the server. It then retransmits that segment on wan1 about 6 times, and the server never acknowledges it. The handshake hangs until the client times out (FIN from server after ~15 s, or RST after ~35 s).macOS clients (TCP timestamps on) are unaffected through the same policy, with the same NAT IP and destination, and even with a byte-identical ClientHello split at the same offsets.This looks related to KB “ERR_SSL_PROTOCOL_ERROR wh

Hello team,I am using FortiAuthenticator Tacacs+ server. It is working with Cisco but not with Nvdia Cumulus switch. Because Nvidia cumulus switch uses Linux PAM module for Tacacs and it send authorization request first instead of Authentication. There is no setting in the forti Autheticator like”allow authorization before authentication”. But cisco it works because it uses authetication and then authorization. Any suggestion how to allow authorization first in forti Authenticator? Because other Tecacs servers have this option “authorize before authenticate”

Our 700G, running version 7.4.12, is not showing a notification that version 7.4.13 is available (I expect I’ll just update it manually soon). The licenses are valid, and the Fortinet servers are reachable. Do you know why this is happening? Is anyone else experiencing this? 

Hello everyone,I'm not sure if I'll get any help on this topic here, but I'll give it a try anyway.We primarily use FortiClient VPN to establish a VPN connection to our Fortigate via IPsec using SAML.Some employees who do not work in the company, but are mainly in the home office or work on the road, have the Microsoft Global Secure Access Client installed on their Windows devices.With the background of tunneling the Microsoft365 connections and web connections via the EntraID GSA without FortiClient VPN.https://learn.microsoft.com/en-us/entra/global-secure-access/overview-what-is-global-secure-accessIn exceptional cases, however, these employees may still require an IPsec VPN connection in order to access various VLANs behind the Fortigate.The problem is as follows. The employee can connect to the FortiClient VPN, but the connection is terminated after approx. 10 seconds. Nothing can be seen in the FortiClient VPN for incoming traffic.The FortiClient VPN log files there is nothing use

We have a few switches (124G) which are standalone, but daisy changed together in a loop, one switch per building. This all works. We have 3 ISPs, one in each building. We have two Fortigates, so two of the switches have links to a Fortigate port, one port per ISP. We do this for redundancy. My question is: Should I do any special commands on these standalone switches for hardening purposes? Since at least some of the ports are directly connected to the ISP.Thanks.

We are currently running FortiOS 7.4.12 on multiple FortiGate 200F and 400F HA clusters in a banking environment within the EU.Following Fortinet's recent recommendation to upgrade to FortiOS 7.4.13 or later, we are evaluating an accelerated upgrade plan and would like to gather feedback from engineers who have already completed this upgrade in production.Specifically, have you experienced any of the following after upgrading from 7.4.12 to 7.4.13 (or later 7.4.x releases)?HA synchronization issues Performance degradation Unexpected failovers or cluster instability GUI access problems Routing behavior changes (BGP/OSPF/static routing) IPSec VPN stability issues SSL-VPN related issues Policy installation or FortiManager interoperability issues FortiAnalyzer anomalies Any known bugs affecting FortiGate 200F or 400F platforms specificallyFor those who have already upgraded:What platform/model are you using? Standalone or HA? Any caveats observed during or after the upgrade? Would you cons

I recently encountered and resolved the following issue, and I am sharing the troubleshooting process because the FortiClient error did not immediately indicate the actual cause.EnvironmentFortiClient EMS: 7.4.8 FortiClient for Windows: 7.4.8 FortiAuthenticator: 6.6.9 FortiGate VM: FortiOS 7.4.13 VPN type: IKEv2 IPsec Authentication method: EAP-TTLS User source: LDAP/Active Directory Two-factor authentication: FortiToken managed through FortiAuthenticatorIssueWhen I tried to establish the VPN connection using a domain account, FortiClient returned the following error:EAPPasswordErrorThe authentication process failed, and the VPN connection could not be established.Since I was taking over an existing installation, I was not yet fully familiar with every step of the authentication flow between FortiClient, FortiGate, FortiAuthenticator, and the LDAP server.Troubleshooting performedI initially verified the following points: The FortiGate was reachable from the client’s public IP address.

Hi.We are trying to get all our firewalls upgrading to the latest urgent patches.Forticloud shows our firewalls running 7.6.7 there is a recommended upgrade to 7.6.8, however, when we do the upgrade button, there is only 8.x listed!!!7.2 and 7.4 branches seem fine!Please tell me we don't need to manually patch these 7.6.x boxes?

Hi,can someone explain to me what the FortiAuthenticator-VMS-DR license (HA/DR/Load Balancing node license for FortiAuthenticator VM Subscription, with FortiCare Elite Support) is used for?It is not listed in the Ordering guide. If I understand it correctly, does this license allow for the deployment of a cluster (a second unit)?Zhank you

Hi all,I've been building FortiSOAR playbooks for SOC work and turned the lessons I learned into a free, open-source skill for Claude AI.You describe the playbook in plain English, and Claude writes a complete FortiSOAR playbook JSON export that you can import directly. A bundled Python validator checks the export first for problems FortiSOAR would reject on import (broken step routes, Jinja syntax and similar).Example prompt:"Build a FortiSOAR playbook that runs on alert create, enriches every IP with FortiGuard and VirusTotal, and closes the alert as false positive if all are clean."What it covers:- Alert triage and incident response- IOC enrichment and phishing analysis- FortiSIEM / FortiAnalyzer queries (uses a reference of 7,000+ FortiSIEM event attributes)- Response actions with client approval (manual input) links- PDF / HTML reports generated inside FortiSOAR- Reviewing, debugging or adapting an existing playbook exportIt doesn't connect to your FortiSOAR instance. You import t