Welcome to the Fortinet Community!

Troubleshooting Tip: 'IKEv1 is insecure. Please use IKEv2.' - IKEv1 deprecation

DescriptionThis article describes the behavior of FortiOS when configuring an IPsec VPN via the CLI when choosing IKEv1.ScopeFortiOS 8.0.x.SolutionWhen configuring the IPsec VPN, setting the following command will result in a warning:config vpn ipsec

47 minutes ago

hamidrStaff

Technical Tip: BGP aggregate-address overrides learned routes and installs a summary Null route

DescriptionThis article describes how, when aggregate-address is configured on a FortiGate, the device may generate a locally originated summary route for a prefix that is also learned from a BGP neighbor. In this scenario, the locally generated aggr

montyadamsStaff

Technical Guide: A practical journey through FortiGate security profiles, from inspection to protection

DescriptionThis article provides a practical explanation of how to configure FortiGate Security Profiles to improve threat prevention, reduce false positives, and maintain firewall performance.Security Profiles inspect traffic for threats such as mal

montyadamsStaff

Technical Guide: Best practice when adding a new subnet to Phase 2 selectors on a site-to-site IPsec tunnel

Description This article describes best practices when adding a new subnet to Phase 2 selectors on a site-to-site IPsec tunnel between FortiGate devices or between FortiGate and a third-party peer. Scope FortiGate, FortiOS,

NofalNew Member

• FSSO- upgrade to 5.0.0330.

• FSSO- upgrade to 5.0.0330. whats the steps

N

ismailurek2New Member

NetScout Arbor Parser for FortiSIEM

Hello,I am looking for a NetScout Arbor parser for FortiSIEM.Could you please let me know if there is an official or community-supported parser available, or if you can provide guidance on how to obtain or develop one?Best regards,İsmail

renzanjopcaparasVisitor III

Migrating HA setup from 501E to 100F

Hi everyone!We current have a HA Setup for FG 501E. The physical HA ports are interconnected via switch in between. The switch ports are on the same vlan.The physical HA port also has an IP Address set with it. Assume 1.1.1.1 As I have checked, 100F

453

Technical Tip: How to allow newly created admin users to log in to FortiNAC-F via CLI

SheikhStaff

FortiNAC-F

DescriptionThis article describes how to enable newly created admin users to access the FortiNAC-F CLI/console.ScopeFortiNAC-F (all supported versions of NACOS).SolutionIn FortiNAC-F, GUI administrator accounts and CLI administrator accounts are sepa

ByteHavenExplorer II

FortiNAC RADIUS Configuration – Is Winbind Required?

Hello FNAC admins,Is it necessary to configure the Winbind part for RADIUS authentication to work properly? Or can RADIUS function normally without integrating Winbind.Thanks in advance,BR,

753

jstanStaff

Technical Tip: High memory usage of node process

Description This article describes the reason for high memory utilization in the node process. Scope FortiGate running v6.4.x, v7.0.x, v7.2.x and v7.4. Solution On v6.4, the node process is used for: Report management (which include

NofalNew Member

• FSSO- upgrade to 5.0.0330.

• FSSO- upgrade to 5.0.0330. whats the steps

N

ismailurek2New Member

NetScout Arbor Parser for FortiSIEM

Hello,I am looking for a NetScout Arbor parser for FortiSIEM.Could you please let me know if there is an official or community-supported parser available, or if you can provide guidance on how to obtain or develop one?Best regards,İsmail

renzanjopcaparasVisitor III

Migrating HA setup from 501E to 100F

Hi everyone!We current have a HA Setup for FG 501E. The physical HA ports are interconnected via switch in between. The switch ports are on the same vlan.The physical HA port also has an IP Address set with it. Assume 1.1.1.1 As I have checked, 100F

RosCorrNew Member

I need Forticlient VPN 7.0.8.0427

I know there are a million of these topics in here, but i dont have a support account with a product licence attached and I cant find the installer on my old laptop, I’m just moving device so i’ve lifted the config off my old laptop but it’s not work

meriemNew Member

Mismatch Between Source and Device Columns in FortiView (FortiOS 7.4.11)

After upgrading the firewall to FortiOS v7.4.11, I noticed inconsistencies in FortiView. For example, the information displayed in the Source column does not match what is shown in the Device column.As shown, the IP address in the Source column ends

160

4 hours ago

levabkomoNew Member

Reliably using IKEV2 (Forticlient)

With IPSEC being removed from the new Forticlient and SSL-VPN being removed from the Fortigates themselves, I've been migrating everyone to IKEV2 using EMS.For around 100 users I would say 80 of them are connecting fine using IKEV2, LDAP and 2FA (For

191

4 hours ago

renzanjopcaparasVisitor III

Different Route Path Active-Passive Setup

Hi! I tried to do an A-P 100F HA Setup where I have assigned the IP to ha1 interface. But there is no switch in between yet. Direct connection only.Everything is the same in Active and Standby firewall. But when I try to check the routing entry for t

161

6 hours ago

s_farazinNew Member

Issue with On/Off fabric detection

Hi, We’ve been using the On/Off Fabric feature for our FortiClient users without any issues. However, since updating the FortiClient app to version 7.2.12.1269, the app no longer correctly identifies devices that are on fabric—it now shows all d

9803

7 hours ago

OsamaFattohVisitor III

FORTISOAR - Active Directory connector dosen't support Kerberos authentication

FortiSIEM, Parsing

When sending logs to FortiSIEM using json over HTTP.if the sender can send with more than one IP, What I should use as reptIP in the API?also if I put for example one IP, if the sender send again with diff IP does the CMDB got affected?

121

8 hours ago

Ani1337New Member

FortiSOAR community

Hello,We are trying to use the SOAR Active Directory connector, but we are facing an issue. We have created a highly privileged account in the domain so that it can apply the necessary changes to various AD objects. However, accounts with such privil

50

9 hours ago

acardonaStaff

Troubleshooting Tip: 'IKEv1 is insecure. Please use IKEv2.' - IKEv1 deprecation

DescriptionThis article describes the behavior of FortiOS when configuring an IPsec VPN via the CLI when choosing IKEv1.ScopeFortiOS 8.0.x.SolutionWhen configuring the IPsec VPN, setting the following command will result in a warning:config vpn ipsec

47 minutes ago

hamidrStaff

Technical Tip: BGP aggregate-address overrides learned routes and installs a summary Null route

DescriptionThis article describes how, when aggregate-address is configured on a FortiGate, the device may generate a locally originated summary route for a prefix that is also learned from a BGP neighbor. In this scenario, the locally generated aggr

montyadamsStaff

Technical Guide: A practical journey through FortiGate security profiles, from inspection to protection

DescriptionThis article provides a practical explanation of how to configure FortiGate Security Profiles to improve threat prevention, reduce false positives, and maintain firewall performance.Security Profiles inspect traffic for threats such as mal

montyadamsStaff

Technical Guide: Best practice when adding a new subnet to Phase 2 selectors on a site-to-site IPsec tunnel

Description This article describes best practices when adding a new subnet to Phase 2 selectors on a site-to-site IPsec tunnel between FortiGate devices or between FortiGate and a third-party peer. Scope FortiGate, FortiOS,

30

Technical Tip: How to allow newly created admin users to log in to FortiNAC-F via CLI

SheikhStaff

FortiNAC-F

DescriptionThis article describes how to enable newly created admin users to access the FortiNAC-F CLI/console.ScopeFortiNAC-F (all supported versions of NACOS).SolutionIn FortiNAC-F, GUI administrator accounts and CLI administrator accounts are sepa

jstanStaff

Technical Tip: High memory usage of node process

Description This article describes the reason for high memory utilization in the node process. Scope FortiGate running v6.4.x, v7.0.x, v7.2.x and v7.4. Solution On v6.4, the node process is used for: Report management (which include

325691

3 hours ago

srubinStaff

FortiCNAPP

Technical Tip: How Lacework FortiCNAPP protects from CVE-2026-31431, Linux Kernel 'Copy Fail' Local Privilege Escalation Vulnerability

DescriptionThis article describes a Local Privilege Escalation (LPE) vulnerability in the Linux kernel (CVE-2026-31431), codenamed 'Copy Fail', that allows an unprivileged local user to gain full root access on virtually any Linux distribution shippe

20

4 hours ago

Koushik_IND_BangloreStaff

Troubleshooting Tip: 'Command fail. Return code -61 ' error while configuring source address under authentication rule for SSL VPN

DescriptionThis article describes a scenario where the error 'Command fail. Return code -61' is observed while attempting to configure a source address under the authentication rule for SSL VPN.ScopeFortiGate.SolutionA source address can be configure

150

5 hours ago

anikolovStaff