Support Forum

Hello Fortinet Community,I have installed FortiGate-VM64 FortiOS 8.0.0 in my EVE-NG lab environment.The FortiGate VM boots normally, and I am able to access the GUI login page.Current IssueI can successfully enter my credentials and the GUI appears to authenticate successfully. However, immediately after login, I am logged out and redirected back to the login page.In other words:Open FortiGate GUI. Enter username and password. Authentication appears successful. GUI starts to load. Immediately after that, the session is terminated and I am returned to the login screen.EnvironmentPlatform: EVE-NG Device: FortiGate-VM64 FortiOS: 8.0.0 Build: 0167 Image: FGT_VM64_KVM-v8.0.0.F-build0167-FORTINET.out.kvm.zip Deployment: KVM/EVE-NGLicense StatusThe FortiGate license is showing Up to Date / Active, so there does not appear to be an obvious licensing issue.What I have checkedFortiGate VM is booting normally. GUI is reachable. Username/password are accepted. License status shows up to date. The

FortiClient VPN 7.4.11.0198 on iPadOS 26.7.1 fails to establish an IKEv2 IPsec tunnel to FortiGate running FortiOS 7.4.12 build 2902 when Phase 1 uses AES256-GCM with PRF-SHA384 or PRF-SHA512.FortiGate accepts the Phase 1 proposal:ENCR: AES_GCM_16, 256 bitINTEGR: NONEPRF: PRF_HMAC_SHA2_384 or PRF_HMAC_SHA2_512DH: MODP2048 or MODP3072However, FortiClient does not send the subsequent IKE_AUTH request. FortiGate eventually reports:negotiation timeout, deletingconnection expiring due to phase1 downThese combinations were tested:AES256-GCM / PRF-SHA256 / DH15: worksAES256-GCM / PRF-SHA384 / DH14 or DH15: fails after IKE_SA_INITAES256-GCM / PRF-SHA512 / DH14 or DH15: fails after IKE_SA_INITAES256-CBC / SHA384 / DH15: worksPhase 2 with AES256-GCM works correctly when Phase 1 uses either AES256-GCM/PRF-SHA256 or AES256-CBC/SHA384. The problem occurs with both SAML SSO and local username/password authentication, although authentication is never reached in the failing cases.I reproduced the issu

How can i change the FSSO Connection Password between a FortiGate and the FSSO? I tried FSSO_Setup_5.0.0337_x64 and FSSO_Setup_5.0.0335_x64, no luck.In the FSSO Agent config i do thisrun as Administrator Change the Password in Authentication  Leave the Ceckmark for Require authentication Click on Apply Click on Save&Close i Restart the Fortinet Single Sign On Agent ServiceThe firewall will always connect to the FSSO agent, no matter what password i enter here.This works as long as i use the default password of the FSSO Agent (that came with the installation).this password is even writtenin cleartext inside the collectoragent.exe.you will find it even with notepad.any idea

Hello Everyone , I Hope Youre WellWe have several web services and APIs that are exposed via an FQDN (Fully Qualified Domain Name) rather than a pool of source server IP addresses. Could you help me understand how to configure a service in FortiWeb that uses an FQDN? Is it mandatory to configure a server pool?Thanks!!! 

Mostly AI Generated, but results of my own work. After considerable troubleshooting, I've successfully implemented Windows Native Always On VPN (AOVPN) Device Tunnel with FortiGate 7.4.13, using machine-certificate authentication, Microsoft Intune, and Active Directory authorization.First, credit where it's due: Richard Hicks (richardhicks.com) has published excellent documentation on Windows AOVPN that helped tremendously.Also, let's be clear: FortiClient already provides always-on, pre-logon VPN connectivity using machine certificates and, in my experience, does it better than Windows native AOVPN.However, if you're like me and have valid reasons not to use FortiClient VPN, this post is for you.Our EnvironmentWe're using: FortiGate running FortiOS 7.4.13 Windows native IKEv2 Device Tunnel Enterprise CA with machine certificates deployed through Intune SCEP Microsoft Entra hybrid-joined Windows computers Active Directory LDAP for computer authorization Intune-managed split-t

Hi! I´m looking for advice configuring an IPSec hub with FortiOS 8.0.1 for terminating IPSec site-to-site tunnels from multiple remote sites.We have a relatively high number of remote sites >50 with very low traffic (just remote management), but overlapping IP ranges.The IPsec tunnel interfaces (the inside of the tunnels) would need to connect to different VRFs. The tunnels would be initiated by the remote sites, which have different source IPs in the Internet,  but on the hub site all IPsec tunnels are terminated on a single public IP. Can I create a VRF instance per remote site?Having >50 VDOMs would not be feasible, as we are talking about maybe 10Mbps aggregate traffic and a relatively small firewall at the hub site, which can only support 10 VDOMs (like a an FG-120G).Some remote site will not have Fortigates, but most of them have. Is this doable at all? BR Peter 

Hi all,I am deploying FortiNAC-F v7.6.x using Local RADIUS with EAP-TLS authentication and Microsoft CA.The environment uses Active Directory (AD), where client devices are required to authenticate to the network exclusively using digital certificates, without requiring a username or password.When a client successfully authenticates using a valid certificate, how does FortiNAC identify the client and determine which Role or Network Access Policy to apply for VLAN assignment?What is the recommended configuration for this scenario?

Hello everyone,Since this morning, multiple clients across our network have simultaneously started receiving virus warnings from FortiClient. The legitimate Office component EUROTOOL.XLAM is being flagged as high risk.I have reviewed the hash (2C4AFE4AFEDE252158A732EDB0C3754B9CB984A7CC2EB6EEFAC47C1EF38C9753)  , file location and metadata on a number of devices and all comes back clear.Since the file is cryptographically clean and unmodified I strongly suspect this is a false positiveHas anyone else seen similar in their orgs? Thanks in advancePASMC

FortiAIGate on 8.0.2 without GPU on the node.Helm install method with values.yaml applied latest image tags. All pods are up. License applied in GUI. Workspace & model setup done but detectors for DLP, Regex & NL are missing, is GPU-enabled node a must to see/enable all the detectors?

We are currently running FortiOS 7.4.12 on multiple FortiGate 200F and 400F HA clusters in a banking environment within the EU.Following Fortinet's recent recommendation to upgrade to FortiOS 7.4.13 or later, we are evaluating an accelerated upgrade plan and would like to gather feedback from engineers who have already completed this upgrade in production.Specifically, have you experienced any of the following after upgrading from 7.4.12 to 7.4.13 (or later 7.4.x releases)?HA synchronization issues Performance degradation Unexpected failovers or cluster instability GUI access problems Routing behavior changes (BGP/OSPF/static routing) IPSec VPN stability issues SSL-VPN related issues Policy installation or FortiManager interoperability issues FortiAnalyzer anomalies Any known bugs affecting FortiGate 200F or 400F platforms specificallyFor those who have already upgraded:What platform/model are you using? Standalone or HA? Any caveats observed during or after the upgrade? Would you cons

Hello team,I am using FortiAuthenticator Tacacs+ server. It is working with Cisco but not with Nvdia Cumulus switch. Because Nvidia cumulus switch uses Linux PAM module for Tacacs and it send authorization request first instead of Authentication. There is no setting in the forti Autheticator like”allow authorization before authentication”. But cisco it works because it uses authetication and then authorization. Any suggestion how to allow authorization first in forti Authenticator? Because other Tecacs servers have this option “authorize before authenticate”

FortiAp 221e with firmware 7.4.6, connected to fortigate FG200e with firmware 8.0.2 in any physical interface, or fortiswitch vlan ,is unable to get online.It receives ip address, i can see it as an lldp neighbor ,but never goes online. Always OFFLINE.Any help ?  

HelloWe want to replace Ivanti Connect Secure with Fortigate Agentless ZTNA for RDP connections.So far everything works fine but our customer has a special configuration on Ivanti Gateway:In the Ivanti bookmark configuration, an application (mstsc) is set to start automatically.This means that after the first RDP connect, an mstsc window opens, allowing you to switch to the next RDP server.We are using a Fortigate 101F / OS: 7.6.7For ZTNA Bookmark on Fortigate I found these RDP options:# set *apptype                  Application type.verify-cert              Enable/disable certificate verification of the real server.*host                     Host name/IP parameter.description              Description.keyboard-layout          Keyboard layout.security                 Security mode for RDP connection (default = any).send-preconnection-id    Enable/disable sending of preconnection ID.load-balancing-info      The load balancing information or cookie which should be provided to the connectio

For all Cisco devices, I am getting the SNMP error below. Does anyone know how to fix it?SNMP failed for device SW01 with message SNMP getNext/getBulk Failed for device : 10.10.10.1All core functions, such as authentication and CoA, are working fine. Therefore, this issue has no impact on production services at the moment.

We have a user with the following admin profile that is not able to push Fortiswitch config from Fortimanager We first thought that maybe the firmware was an issue since the move to Fortigate 7.4.13, but my admin account and other’s works just fine. The error message from the non working user doensn’t tell much neither. We haven’t changed any config before it stopped working for them. The user does changes manually to switch ports and isn’t using any template for them.  Fortimanager is on 7.6.8 if that’s relevant. Any tips would be very appreciated!

Good Afternoon, Since upgrading Fortianalyzer VM to 7.4.12, within the Fortiview → Traffic → Top Source, I am no longer able to filter a SourceIP by CIDR notation in the GUI. In the past, I’ve been able to use e.g. 172.1.1.0/16, and will get results for traffic only for that specific subnet.  Since upgrading, I receive “no records found”, when the CIDR notation would align with individual IPs I can see in the traffic Fortiview. I am not seeing in the release notes that this was taken out or is a known issue.  Is anyone else experiencing this, or is there another method to filter by subnet within Fortiview on Fortianalyzer 7.4.12? Thank you!

After upgrading a FortiGate HA cluster to FortiOS 7.6.8, the HTTPS GUI was no longer accessible. Browsers returned ERR_SSL_PROTOCOL_ERROR, while curl reported SEC_E_DECRYPT_FAILURE.The GUI worked when TLS 1.2 was explicitly enforced. The issue was resolved with:config system global    set admin-https-ssl-versions tlsv1-2    set tls-session-cache disableendA reboot was required for the TLS session cache change to take effect. After the reboot, the GUI was accessible again.Is this a known issue in FortiOS 7.6.8?

Hi Everyone, I  am facing  issue to downaload an image of Forigate 200f. My license is expired.. Please guide or share me how can i download the image..?? 

We have been using IPsec VPN with a peer group and peers.The peers have the CA cert of the EMS server and the subject as part of the peer identifier. This has always worked fine until the upgrade to 7.4.13 where we get an “invalid certificate” error and no connection. If the Peer Option is set to Any Peer ID then the VPN connection works. I’ve looked through the “known issues” of 7.4.13 but nothing applies.Any ideas?Thanks.

When I login as the ems cli user to our Fortinet provided OVA Ubuntu instance, I see this message:5 updates could not be installed automatically. For more details,see /var/log/unattended-upgrades/unattended-upgrades.log These logs appear to be hardened and not accessible from the cli.  I can access “execute ls /var/log/forticlientems/*” but not the folder holding the logs mentioned above.  I’d like to confirm what isn’t being updated from a CVE standpoint.  Does anyone know how to access these logs?

Hi.We are trying to get all our firewalls upgrading to the latest urgent patches.Forticloud shows our firewalls running 7.6.7 there is a recommended upgrade to 7.6.8, however, when we do the upgrade button, there is only 8.x listed!!!7.2 and 7.4 branches seem fine!Please tell me we don't need to manually patch these 7.6.x boxes?

Hi there,on FG71G and FG60F, I need to create certain firewall policy, and monitor all log traffic.log need contain:1. device id2. mac address id3. destination (url, etc, also services if possible)4. duration (if possible)5. time stampneed help pls.FG60, use firmware 7.2.4FG71, use firmware 7.6.6than you

Per https://www.fortiguard.com/psirt/FG-IR-26-165 we’re supposed to upgrade FortiClient.exe to 7.4.8, but the download links at https://links.fortinet.com/forticlient/win/vpnagent are only for 7.4.7 or lower. What gives? How are we supposed to remediate this if the links don’t work?

We have two Fortigate 40F running FortiOS 7.6.8 in A/P HAno dedicated management interface. no ha-direct.Requirement is to poll individual cluster membersusing authenticated and encrypted SNMPv3.Polling cluster IP works.Now I used the “management-ip” feature and configured the LAN Interfaces witha cluster IP and different management-IPs.config system interface    edit "lan1"        ...        set ip 172.16.42.1 255.255.255.0        set management-ip 172.16.42.2 255.255.255.0                         ##  ( 172.16.42.3 on secondary machine)        set allowaccess ping https ssh snmp…With that setup I can accessthe currently active machine using 172.16.42.1 the primary     machine using 172.16.42.2 the secondary machine using 172.16.42.3with pings, https and ssh separately without issues.At the moment,only the snmpd on the active machine answer to queries to IP 172.16.42.1What is needed to make SNMPv3 polling to 172.16.42.2 and 172.16.42.3 work ? 

Hello,I found strange issue with FAC in Azure (from marketplace).When I am trying to do a rollback, using disks created from snapshots (OS and Date), FAC VM doesn’t start.There is an error:“Failed to start virtual machine 'fac-vm-azure'. Error: Creating a virtual machine from a non-Marketplace image does not need Plan information. Please remove the Plan information from VM”And there is no way to fix it (I tried many ways suggested by Copilot etc.).What is the solution for creating a backup (and successful rollback) for FAC in Azure ?Regards,Krzysztof