Recently active topics

I have two FortiWeb 400F units in Active-Passive HA mode. The management IP addresses on port 1 are x.x.x.180 (Primary) and x.x.x.181 (Secondary). When accessing the web interface, I can only log in to the active HA unit (x.x.x.181). I understand that access to the GUI is limited to the active unit because the "Reserved Management Interface" option is not enabled; however, when attempting to configure the reserved interface on port 1, the port does not appear as an available option for assignment.What configuration steps must I take to enable GUI access to the passive unit as well? 

Hello everyone! We are currently running FAZ (100 licenses and 50GB logs per day) and we only use it's log collector functions, all the SOAR and SIEM functionality is gathering dust atm.We are planning to also purchase FMG to manage configurations of the firewalls, and there's a question I would like to ask: as far as I can see, FortiManager is capable of performing as a FortiAnalyzer. Are there FortiManager licenses that can provide 50GB logs per day and around same 100 devices, so we don't buy FAZ anymore?Any help is appreciated. Thank you in advance!

DescriptionThis article describes how to configure and verify FortiWeb Site Publish with RADIUS authentication using FortiAuthenticator.ScopeFortiWeb, FortiAuthenticator.SolutionFortiWeb Site Publish can be configured to authenticate Users through a RADIUS server before allowing access to a protected web application.FortiAuthenticator can be used as the RADIUS authentication server, while FortiWeb provides the Site Publish functionality and controls access to the published application.Note: For detailed information about configuring FortiWeb Site Publishing, refer to the Site Publishing (Single sign-on). This article focuses on the RADIUS authentication integration with FortiAuthenticator and the verification of the authentication flow.The configuration includes the following components:User|| HTTPSvFortiWeb|| RADIUS AuthenticationvFortiAuthenticator|| Authentication ResultvFortiWeb|| Authenticated RequestvBackend Web ServerConfiguration:Configure FortiAuthenticator as the RADIUS serve

Hi everyone!On my FortiAuthenticator running version 6.6.10, I've connected a remote LDAP server and already imported the first batch of users. As a second step, I've set up a sync rule for it.I'd like to clear up a few doubts regarding the sync rule, and confirm whether the following understanding of the automatic enablement (for new users imported via the sync rule) is correct:Under Synchronization attributes → OTP method assignment priority: do I just need to move SMS to the top of the list and flag/enable it? Is that the only step required ? (see screenshot below)*   What sync interval would you recommend? Is every 30 minutes a reasonable value ?   Finally, if I understood correctly: for users that already exist on FAC (previously imported), the sync only updates already-mapped attributes (e.g. phone number, email) — is that correct ?* Thank you all in advance!"This is the way"

DescriptionThis article describes the benefits of selective acknowledgments.ScopeFortiGate.SolutionBenefits of Selective Acknowledgment (SACK).Selective Acknowledgment (SACK) helps TCP recover from TCP segment loss more efficiently by enabling the receiver to notify the sender of specific TCP segments received successfully.Without SACK, when TCP segments are lost (often referred to as packet loss), all subsequent successfully received segments will be re-transmitted.With SACK, when a system experiences TCP segment loss, the sender re-transmits only the missing TCP segments instead of re-sending all subsequent segments.Faster recovery from loss:When TCP segments are dropped, SACK improves TCP efficiency by identifying exactly which subsequent segments were successfully transmitted to the receiver, reducing unnecessary retransmissions, and speeding recovery from loss.Improved performance during loss:With SACK, when TCP segments experience a retransmission timeout the system experiences s

DescriptionThis article describes how to resolve the Unknown HA status for both devices in an HA Cluster making use of 200G devices.ScopeFortiGate 200G.SolutionBoth devices in the HA cluster have an 'Unknown' status:The secondary device is out of sync:FGT-FRA (global) # get sys ha status HA Health Status: OK Model: FortiGate-200G Mode: HA A-P Group Name: FGT-FRA Group ID: 6 Debug: 0 Cluster Uptime: 536 days 0h:52m:3s Cluster state change time: 2026-06-15 21:18:45 Primary selected using: <2026/06/15 21:18:45> vcluster-1: FG2H0GT924901111 is selected as the primary because its uptime is larger than peer member FG2H0GT9249022222. ses_pickup: enable, ses_pickup_delay=disable override: disable Configuration Status: FG2H0GT9249022222(updated 3 seconds ago): out-of-sync==========>>> FG2H0GT9249022222 chksum dump: 55 78 16 14 f9 cf 6b 2b 3a 97 79 17 76 fc ed 6a FG2H0GT924901111(updated 265502 seconds ago): in-sync FG2H0GT924901111chksum dump: 44 ae 83 dc 2d 6b cf c4 e7 54 fe 3

When my FortiSwitches reboot, they lose the FortiLink synchronization with the FortiGate. I have to manually set the date and time on the FortiSwitch for it to re-synchronize with the FortiGate. My FortiGate is running version v7.6.6 build3652, and the FortiSwitch is running version S148EP-v7.6.4-build1114. Please help me resolve this issue so it does not happen again.

Hi Everybody,We are running a Kubernetes cluster on Rocky Linux 10.2 VMs, with the FortiEDR Linux Collector installed on the host OS.When FortiEDR Communication Control was changed from Simulation to Prevention, the entire Kubernetes cluster became unavailable. After changing the policy back to Simulation, the cluster recovered and became operational again.I have allowed everything regarding the connections to the outside after checking with my Dev Ops Engineer and we see no new logs regarding the communication control. The affected nodes reported this kernel message:Failed to initialize the IGMP autojoin socket (err -1)FortiEDR Collector version: 6.2.0.1350I double-checked the FortiEDR Events and Communication Control logs, but there were zero events showing that anything was blocked or denied by FortiEDR.Has anyone experienced a similar issue with FortiEDR Communication Control and Kubernetes? If you have any ideas or troubleshooting recommendations, I would really appreciate your he

What would cause apple devices running ARD to disappear in network list when there are more devices connected and reappears when there are less devices? This is a FortiAPs/FortiSwitches environment. 

DescriptionThis article describes why FortiNAC-OS (FortiNAC-F) managed servers cannot be added to, or stop synchronizing with, a FortiNAC Manager that still runs on CentOS when the administrator is logged in to the Manager Admin UI as root, while CentOS-based managed servers in the same Server List work normally. It also clarifies whether a mixed CentOS / FortiNAC-OS environment is supported and what the ongoing Admin UI account requirement is.ScopeFortiNAC Manager on CentOS managing FortiNAC-OS servers (FortiNAC-CA-VM / FNC-CAX) on the same software version, such as FortiNAC-F v7.2.x. Typically seen during a phased CentOS to FortiNAC-OS migration where managed servers are migrated before the Manager.SolutionSymptoms:When adding a FortiNAC-OS server under Dashboard -> Servers -> Create New, the Manager returns the following error, while CentOS-based managed servers are listed and synchronize normally:Servers that were previously in the list may also disappear from the Server List

DescriptionThis article describes the TCP Maximum Segment Size (TCP MSS) handling changes introduced for IPsec tunnels beginning in FortiOS 7.6.1 and their impact on Path MTU Discovery (PMTUD).Scope FortiOS v7.6.1 through FortiOS v8.0.0.SolutionBeginning with FortiOS v7.6.1, FortiGate no longer automatically adjusts (clamps) the TCP MSS for traffic traversing an IPsec tunnel.In releases earlier than FortiOS v7.6.1, when packets exceeded the effective IPsec tunnel MTU, FortiGate automatically adjusted the TCP MSS and generated ICMP 'Fragmentation Needed' messages. This behavior helped prevent oversized TCP packets from being dropped.Starting with FortiOS v7.6.1, FortiGate relies on Path MTU Discovery (PMTUD). When an oversized packet is detected, FortiGate generates an ICMP 'Fragmentation Needed' message, allowing the sender to discover the path MTU and reduce the TCP MSS accordingly.As a result, successful transmission of oversized TCP packets depends on the successful operation of PMT

I haven’t been able to connect to my company network with Forticlient for the past two weeks. The latest versionof Forticlient vpn installed is 7.4.3 hotfix 1.8758. I keep getting a “connection timeout” error. I tried running it as an administrator, but that didn’t fix it. I uninstalled and reinstalled it, but that didn’t work either. I tried installing older versions, but that didn’t solve the problem either. The strange thing is that I can connect from some computers but not others. My Windows updates are also up to date. For example exact same windows uptade version and same forticlient vpn config but one computer can connect but other cannot.

Hi community,I am very familiar with configuring FortiGate Web Filter policies using traditional Active Directory via LDAP and FSSO for user and group-based rules. However, we are moving to a pure cloud environment with Microsoft Entra ID (Azure AD), and I want to achieve the same group-based web filtering capability.Environment Details: FortiGate Model: FG-120G FortiOS Version: 7.6.7 Identity Provider: Microsoft Entra ID (No local Domain Controller / No FortiClient EMS) Since Entra ID does not support native LDAP out of the box like traditional AD DS, I understand that integrating Entra ID with FortiGate for user-based policies relies on SAML 2.0.My Questions: What is the recommended workflow to map Entra ID User Groups (Object IDs/Claims) into FortiGate user groups for policy enforcement? How does FortiGate handle transparent user identification and policy matching for web traffic when using SAML instead of classic LDAP/FSSO queries? Are there any best practices or step-by-st

DescriptionThis article describes how to troubleshoot a FortiCam CD51 issue where motion detection is not triggered.ScopeFortiCamera.SolutionWhen motion detection events from the CD51 camera are not received or triggered on the FortiRecorder, follow these troubleshooting steps:Verify the motion detection configuration on the camera.Reduce the configured item size and test whether motion detection events are triggered.In the example below, the item size has been reduced from 10 to 5:Verify network connectivity between the CD51 camera and the FortiRecorder.Use the Verify button in the camera configuration settings.Confirm that TCP port 3011 is allowed through any firewall between the camera and the FortiRecorder.

I have spent the last few weeks parsing FortiGate syslog from two firewalls — one hosting edge and one branch unit — and ended up building a small dashboard around it. I am sharing both the findings and the tool, because the findings are useful even if you never touch the tool.Five things that quietly produce wrong results1. The syslog header time is not the event time. Use FTNTFGTeventtime, which is nanoseconds since the epoch (divide by 1,000,000 for milliseconds), together with FTNTFGTtz. Depending on your relay, the header can be the device's local time, and everything lands shifted by hours without any error being raised.2. app= is not the application. In CEF, app= is the service label; the application that application control actually detected is FTNTFGTapp. A filter written against app= matches something, so it looks like it works.3. Security-profile blocks never say act=deny. The app-control log carries act=block, while the matching traffic log shows a normal-looking client-rst

DescriptionThis article describes how to identify and resolve a synchronization failure from FortiNAC Manager to a FortiNAC CA caused by a local object on the CA that conflicts with a global object pushed from the Manager. This is commonly observed after an upgrade.ScopeFortiNAC-M, FortiNAC-F v7.6.x.SolutionSymptoms:After upgrading the FortiNAC Manager and CAs, manual and automatic synchronization to one or some CAs fails. The Manager GUI shows a sync status similar to the following:Sync Initiated with server: 192.168.10.20 by <admin> and the status is Profile-Cannot sync global object GUEST_DEVICES, conflicts with existing local object GUEST_DEVICES_ROLE with id = 123456789012345, please contact support.The global object name (GUEST_DEVICES) and the local object name (GUEST_DEVICES_ROLE) are different. For this reason, searching for the global object name on the CA returns no conflicting entry.Identify the error:On the FortiNAC Manager CLI, start the log tail:diagnose tail -F ou

I have below issue on FMG cloud , when importing / install cofiguration to fortigate I got below error :error user fsso polling , modifying ldap-server is not allowed

DescriptionThis article describes why the FortiNAC-F High Availability (HA) node that is not in control does not respond to SNMP queries, and why its GUI shows no SNMP settings.ScopeFortiNAC-F in a primary/secondary High Availability configuration.SolutionSymptoms:A network monitoring system (NMS) polling both FortiNAC-F nodes gets valid SNMP responses from the primary node. Queries to the secondary node time out or return an empty response.On the primary node, SNMP is configured under System -> Settings -> System Communication -> SNMP. This menu is not available on the secondary node.$ snmpwalk -v2c -c <community> 10.10.10.239 system SNMPv2-MIB::sysDescr.0 = STRING: ... $ snmpwalk -v2c -c <community> 10.10.10.232 system Timeout: No Response from 10.10.10.232SNMP settings on the primary node.GUI menu on the secondary node, without SNMP settings.Identify which node is in control:In the GUI, go to Dashboard -> Main -> System Summary. The node in control shows

We are experiencing persistent database replication failures across our HA cluster and are looking for advice on the most stable release train before we perform a clean rebuild.Timeline: v7.6.6: Initial deployment worked for several weeks, but we eventually started encountering internal database errors whenever we tried adding new network switches. v7.6.7: Upgraded to address the switch-addition errors. The upgrade broke High Availability database replication completely between the primary and secondary nodes. STS Release: TAC advised upgrading to the Short-Term Support (STS) release, but HA database replication remains broken.  Which version/release train is currently the most stable for FortiNAC-F running HA, 802.1X, and EDR? Is the 7.4.x train the recommended target for production HA stability right now?

DescriptionThis article describes how to recover the default IPSEC and BGP Templates in FortiManager when they are missing.ScopeFortiManager-VM, FortiManager appliances.SolutionThe following are the default IPSEC and BGP Templates within FortiManager:IPSEC Templates:BGP Templates:In Some Scenarios, the default templates might not be shown, as displayed in the following example:The following command can recover the default templates:diagnose cdb upgrade force-retry default-ipsec-bgp-templates Changes will be made to the database, however it is recommended to perform a backup first. Do you want to continue? (y/n)yOnce the command is executed, refresh the browser page to display the correct templates again, as below:

As discussed, while using FortiClient, we have observed an intermittent behavior when incorrect credentials are entered. In some instances, the expected incorrect credentials/error prompt is not displayed, whereas in other instances, the prompt appears as expected.To further investigate this behavior and identify a possible resolution, we have also posted the issue on the Fortinet Community for additional inputs and recommendations.We request you to kindly share any suggestions or recommendations from your end that may help us troubleshoot and resolve this intermittent behavior.We will continue to monitor the behavior and share any further observations or updates.

FortiMail is a cloud service while FortiAnalyzer is deployed on-premises .FortiMail need to send logs to FortiAnalyzer on-premises

DescriptionThis article describes a login problem that can occur following a change of a FortiCloud account's master email address to an existing IAM support portal user.ScopeFortiCloud.SolutionThe master email address assigned to a FortiCloud account can be changed due to a change of role or when a person leaves the company. If the new master email address does not exist in FortiCare, following the change, the account ID will remain the same.  However, a problem may occur when the new master email address and profile already exist in FortiCare. In this instance, the account ID will be changed to the ID that is already assigned to the existing profile. This means that if users attempt to log in to FortiCloud using the previous account ID, the login will fail.In instances where the new master email address is an existing profile, and the account ID changes, the customer master account holder must inform all FortiCloud portal users of the change so that they can use the new account ID wh

DescriptionThis article describes how to interpret and troubleshoot a SIM_CARD_ERROR status returned by the diagnose sys 5g-modem sim-info command on FortiGate models with an internal 5G modem.ScopeFortiGate models with an internal 5G modem (for example, FortiGate-51G-5G). FortiOS 7.4 and later.SolutionRun the following command to check SIM card status:diagnose sys 5g-modem sim-infoThe output returns one of the following SIM detection states for each slot:Present — A SIM card is physically detected and can be read.Absent — No SIM card is physically detected in the slot.SIM_CARD_ERROR — A SIM card is physically detected but cannot be read.A SIM_CARD_ERROR status is primarily caused by either a defective SIM card or a SIM card that does not make proper contact with the slot. When this status is returned, the ICCID, IMSI, and other SIM detail fields are typically blank.To troubleshoot a SIM_CARD_ERROR status, complete the following steps in order:Remove and reinsert the SIM card. Confirm

DescriptionThis article describes the effect of the 'set capability-dynamic' command.ScopeFortiGate.SolutionThe set capability-dynamic command configured on FortiGate under the BGP section for a specific neighbor enables or disables the advertisement of the BGP Dynamic Capability to a BGP neighbor.Enabling it allows routers to dynamically negotiate capabilities (like new address families or route filtering) or handle capability changes without fully tearing down the BGP session.Syntax:artemis-kvm83 # config router bgp artemis-kvm83 (bgp) # config neighbor artemis-kvm83 (neighbor) # edit 10.109.49.8 artemis-kvm83 (10.109.49.8) # set capability-dynamic enable Enable setting. disable Disable setting.Note: The default value is disabled.artemis-kvm83 # config router bgp artemis-kvm83 (bgp) # config neighbor artemis-kvm83 (neighbor) # edit 10.109.49.8 artemis-kvm83 (10.109.49.8) # sh full | grep dynamic set capability-dynamic disable