Support Forum

Hi,I want to understand what's the steps for configure a secret with domain credentials (a secret in my personal folder) and use it in other windows/ssh secrets and targets(shared in the public folder with others).Obviously every user needs to have its domain credentials. The users in fortipam must be local users. I'im trying to do this with smart associations but with some difficulties. Thanks in advance

I have a Fortigate Instance deployed on AWS with 4 ENIs.. instance type c5.xlarge Recently we reduced the license from 4vCPU to 2vCPU and now i am looking to change the instance type accordingly. But as i am using 4ENIs the only viable option i see with 2vCPU is r7i.large .. will it support the fortigate vm or are there any other checks i need to look into ? or a compatibility matrix Thanks

Hey everyone, hoping someone has run into this before because it's driving me crazy. Setup: Remote site FortiGate with two WAN links (wan1 and wan2), each with a separate IPsec tunnel (VPN1 and VPN2) connecting back to a data center. The data center side has a single WAN interface. Tunnels are configured as dialup on the hub/data center side because the remote site has dynamic IPs on both WANs.VPN1 on wan1 is the primary. VPN2 on wan2 is the backup. Static routes are configured with different distances so VPN1 is always preferred. The problem: When the tunnels first come up (after a reboot, or after clearing SAs), everything works perfectly. Traffic flows symmetrically through VPN1 as expected. This can last a week or even longer with no issues. Then at some random point, traffic becomes asymmetric. I'll notice the traffic counters on VPN2 start incrementing heavily on one direction — usually incoming data. Outbound traffic from the remote site is still going out VPN1 co

Hello Guys, I downloaded FortiGate Hyper-V version. after installing and activated port1 it. I try to login using Browser Interface it become blink and the URL went to: https://FortiGate IP /prompt/fortigate-setup?viewOnly=1anyone know how to solve this issue.Thanks in advance Mina Greas

So, I've got BIND9 running on Debian Trixie (which absolutely does DDNS updates because I can do them using the same key from other places on the network using `nsupdate`) and I've been trying to get a Fortigate (a 101F running 7.6.6)  that's handling DHCP for the local network to push DDNS updates over to the thing, and it appears to fail with a NotAuth- message every time.  This suggests rather strongly that there's something utterly undocumented with the way Fortigate handles the keys.Steps performed: 1. BIND9 server set up and tested (obvs) but the configuration snippet is effectively this:| key "test.key" { algorithm hmac-sha256; secret "P4Q4yPOnJXv/pithZ9wK/blCAFTo81oOSg5PtVzsOP8="; }; zone "test.company.tld" { type master; file "/var/lib/bind/test.company.tld.zone"; allow-update { key "test.key"; }; }; 2. Over in the console of the Fortigate:config system dhcp server edit 5 # because that's the one for the interface

Hello everyone,I am currently configuring administrator authentication on a FortiWeb appliance using RADIUS against FortiAuthenticator with FortiToken MFA, and I am experiencing a login loop after the OTP step.EnvironmentFortiWeb: admin authentication via RADIUSFortiAuthenticator: used as RADIUS serverAuthentication source: LDAP / Active DirectoryMFA: FortiToken MobileFortiWeb admin group configured with RADIUS serverLogin flowUser enters username and password on the FortiWeb login page.Authentication proceeds and FortiWeb prompts for Token Code (OTP).OTP is entered.Instead of logging in, FortiWeb redirects back to the login page.Relevant log from FortiAuthenticatorAuthentication Failed Bad TokenDescription: Authentication failed, bad token codeMessage:Remote LDAP administrator authentication with FortiToken failed: invalid tokenThings already verifiedUser exists in AD and can authenticate normally.FortiToken is assigned to the user and active.RADIUS client configured correctly on Fort

Hello all,I'm currently working with a FortiExtender (FEX-Extender) and noticed that by default it creates a static route:0.0.0.0/0 with distance 1 and priority 1.This route is affecting my traffic because it becomes the preferred default route. When I try to change the distance to 11 (or modify the priority) and push the configuration via FortiManager, I lose connectivity to the FortiGate and I'm unable to continue working remotely.I also noticed that on the FEX interface the option "Retrieve default gateway from server" is enabled.Should this option be disabled in this scenario?Thanks in advance.

Dears , Can i config mclag between two different models like FS-424E and FS-448E ? Thanks 

hi, we want to add blackhole route on fortigate to save the resource. we have one public subnet for example 192.1.0.0/24.Some IP addresses of this subnet are configured on internal servers behind the internet firewall. static routes are configured for this 2x IP on the firewall.    192.1.0.10 configured on internal server 1   192.1.0.11 configured on internal server 2And some IP addresses of the subnet 192.1.0.0/24 are configured on SNAT and DNAT rules.    192.1.0.101 is used as source NATTED IP for some internal hosts.   192.1.0.201 is used as Destination IP on DNAT rule. Now we want to drop the inbound access to the rest IP addresses of the subnet 192.1.0.0/24 on firewall. We plan to add a blackhole rule on the firewall to save the resource. Will this blackhole routing rule affect SNAT and DNAT? I think it should not affect, but not very sure. Can anyone please help to and advise and confirm? Thanks in advance! &nb

Hello, I'm trying to use Fortiauthenticator as IDP for Keycloak, but when keycloak send token request (/api/v1/oauth/token/) with Content-Type including charset=UTF-8 it doesn't work. I use Curl to test the request removing the charset and it worked. HTTP headers:"Content-Type: application/x-www-form-urlencoded; charset=UTF-8"  --> not working"Content-Type: application/x-www-form-urlencoded" --> works Is there any method/config to allow Fortiauthenticator accept charset at Content-Type header ? br,

I connected my fabric root FortiGate, which happen to be my edge firewall to the FortiClient EMS Cloud just fine via the fabric connector. My other fabric FortiGates show up in EMS Fabric soon after, so I authorized them there and attempted to finish the authorization at the fabric firewalls. When I click authorize on the fabric connector on the firewall, I am presented with the certificate to accept or deny. I accept and it goes back to the fabric connectivity window for EMS Cloud on the FortiGate in question, yet never "connects"... it's still in that pending state of showing the EMS Cloud information coming from my root, yet will not connect successfully like my fabric root edge firewall did.

Is it possible to add a second RADIUS cert for testing purposes? We're currently utilizing a public cert and want to test out a local PKI cert without affecting production.

Good morning, First of all, I introduce myself: I belong to IT service in MN8Energy. We use Forticlient to connect with external services since many years. Act  We have got installed many Forticlient version 7.4.2.1737, but this version will expire this summer. We have tried version 7.4.3.8758, but it doesn't work properly, and additionally, it suffers a vulnerability described at CVE-2025-62676. Is there any new version without that vulnerability and fully operational? Is there any other option? Thanks in advance, forum

Hi Is there a way to make a custom decoy with a Windows Server 2025? I have managed to get it installed, but is not booting... Any pointers?FortiDeceptor 

I’m trying to configure remote administrator access via SSH on a FortiGate using RADIUS (FortiAuthenticator), where the admin privileges on the FortiGate depend on the user’s Fortinet VSA (e.g. Attribute: Fortinet-Group-Name, value: ADMIN_FORTIGATE) and corresponding remote-group mapping.Goal: allow different remote admins to log in via SSH with different admin access profiles, for example a read-only admin using the built-in super_admin_readonly (or a custom read-only accprofile).I noticed that:If the admin entry is configured with set accprofile "super_admin", SSH login works and the FortiGate does send RADIUS Access-Request to FAC.If the same admin is configured with any other accprofile , SSH login fails with a generic Failed password, and no RADIUS traffic is generated at all.So, it looks like remote admin authentication via SSH is only triggered when the admin has&nb

I am trying to deploy an FNC-CA-500F.I changed the IP address of my network card to 192.168.1.10 so it matches the default address 192.168.1.99 of the NAC. I was able to access the device via PuTTY, and I configured allowaccess https-adminuiin port1.The ping to 192.168.1.99 is successful, but I am unable to access the graphical user interface (GUI).Do you know why this might be happening? 

We currently use the FW-40f firewall in some branches. Its licenses expire on April 5, 2026, and we need to review the licenses to renew them or replace it with a newer firewall, such as the FW-50G. Please provide your suggestions on this matter.

Dear Community  Please Guide How to access      

We are running into an issue with our Fortivoice system where when someone calls our auto-attendant, and they dial the extension of the party they would like to speak to, they get an invalid extension message. When looking back through the logs, it is appearing that they are dialing too many digits. For example, I call in, dial extension 1523. When I look at the log, Fortivoice shows that I dialed 155523. Sometimes just one extra digit is inserted, and I have seen as many as 20 extra digits get inserted. Other times it works perfectly fine and dials the correct digits.  Has anyone experienced this issue or know if any reason why this would be occurring? 

When launching an RDP session using a stored Secret through FortiPAM (via Proxy mode and NLA mode), the connection does not automatically inject the stored password.Instead:The RDP client pre-populates the username field with the currently logged-in Windows user from the client machine.The session then prompts for a password.The stored Secret credentials in FortiPAM are not injected.Authentication must be completed manually.

Hi,We are looking into a solution for machine to machine traffic with FortiProxy. We saw that there is an option for oidc in recent versions of FortiProxy and were wondering if that is something we can use. The IdP we would like to use is Entra ID. As said, this is machine to machine, so no browser popup or user interaction should be required. Is this setup possible with FortiProxy?

In the VPN we can select Peer Option to 'Peer ID from dialup group'. How we can create the dialup group?When we create the group then which type should i select (Firewall, FSSO, RSSO, or Guest)?Also we must have the user and this user should be as member for above group. When create the user which user type should i select (Local User Remote Radius, Remote TACACS, Remote LDAP, FSSO or FortiNAC user)? 

I have to deploy the Overlay Orch, the default ASN is 65000. The ASN should be private, or it can be public, this is because the customer is using the 65000. Thanks.

Hello,I wanted to replace our existing Aruba Core Switch with a FortiSwitch 148F.Currently the Aruba is connected to my Fortigate 100F via an LACP with different VLANS , the VLAN 1 is currently used by the network. Here's the screenshot of the existing conf with the Aruba switch connected to port1 and port2      I've tried to create a software switch with the Fortilink interface and the LACP but i can't use the LACP for the hd switch.So i attached the Fortiswitch to the Fortilink in order to preconfigure it but i can't create the same VLANS/Subnet on the Fortilink and the fortigate says that they are already used in the LACP.So i would like to know how to migrate this, i can't attach the fortiswitch directly to the LACP becouse it is a production environment and i have to minimize downtimes so i wanted to attach the Fortiswitch to the Fortlink, then preconfigure the Switch AND the Fortilink with the existing VLANS (but i can't create those networks...

Hello, Ive got  this situation with a fortilink lacp already working but only 1 physical connection.  I wan to add a new connection but I want to confirm if I can add the cable while hot-swapping without any disruption, and the business doesn't allow for a maintenance window, I'd like to know if adding a cable between the firewall and the switch would cause any problems. Additionally, I'd like to know if any further configuration is necessary, given that the firewall is already configured with the FortiLink LACP to use this new physical connection. Any suggestions or link would be really appreciated.