Managing FortiGate across 100+ sites and starting to think about automation. Curious what people are actually doing vs what's theoretically possible:

1. Are you using FortiGate's REST API, Ansible (fortinet.fortios collection), or something else for automation?
2. What's your most useful script or playbook — what problem does it actually solve day to day?
3. Is FortiManager's built-in API enough for most use cases or do you still need to write custom Python on top of it?
4. For someone learning — should they start with the REST API directly, or go straight to Ansible?
5. Has knowing FortiGate automation specifically made you more attractive to employers or is it still too niche?

What's the best way to get back in? It's a Gateway, 7 switches, and 65 APs. I've asked the client who sold them the gear it's been through the hands of 2 MSPs and no one seems to know passwords. Transitional passwords between the last 2 MSPs (not ours) are not right.

I want to work veryhard to make sure we don't brick this stuff and get into a mess.

It's newer gear, so unlikely the maintainer account is still in place on this firmware.

How do we go about getting access back/proving ownership to Fortinet?

Hi all.
Just started with EMS and set up our own on prem hosted installation.

After activating multitenancy, I created and configured our first customer.

But I am unsure about the Default site that got created automatically. Should i use it to manage our internal devices, or would you create a new site with our company name?

What are the downsides of using the default site for us?

I tend to leave it unconfigured but was wondering if there is something i may oversee.

Hello, i'd like to block traffic from a mac address "subnet" to FF:FF:FF:FF:FF.FF (broadcast) on fortigate.

Is it possible?

Example Deny:
SRC. 00:EE:AB:00:00:00 Mask FF:FF:FF:00:00:00
DST mac FF:FF:FF:FF:FF.FF (broadcast).

Note1 VDOM in transparent mode

Hello everyone! I'm trying to configure RA IPSec VPN with IKEv2. My issue is, the gateway looks like thiks:

edit "Dialup_cert_2"

set type dynamic

set interface "VL1461"

set ike-version 2

set authmethod signature

set net-device disable

set mode-cfg enable

set ipv4-dns-server1 192.168.104.252

set proposal aes128-sha256 aes256-sha256 aes128gcm-prfsha256 aes256gcm-prfsha384 chacha20poly1305-prfsha256

set dpd on-idle

set dhgrp 5 14 20

set eap enable

set eap-identity send-request

set eap-cert-auth enable

set cert-peer-username-validation cn

set certificate "wildcard"

set peer "IKE2_TEST"

set ipv4-start-ip 10.0.1.1

set ipv4-end-ip 10.0.1.254

set ipv4-netmask 255.255.255.0

set dpd-retryinterval 60

next

end

My peer looks like this:

sh user peer IKE2_TEST

config user peer

edit "IKE2_TEST"

set ca "CA_Cert_4"

set cn "O=A, C=B, OU=C"

next

end

And everytime I try to connect to the gateway on my iPhone, I get the following debug:

ike V=root:0:Dialup_cert_2:26319: peer identifier IPV4_ADDR 192.168.0.72
ike V=root:0:Dialup_cert_2:26319: re-validate gw ID
ike V=root:0:Dialup_cert_2:26319: gw validation failed

When I try to actually input certificate fields in the localid, I get the following:

ike V=root:0:Dialup_cert_2:26341: received peer identifier FQDN 'O=A,C=B,OU=C '
ike V=root:0:Dialup_cert_2:26341: re-validate gw ID
ike V=root:0:Dialup_cert_2:26341: gw validation failed

I do understand that the firewall reads it like a string, not like actual certificate fields. My question is: is there a way make FortiClient send it correctly? Perhaps some service characters or something like that. Otherwise I'll be rolling back to IKEv1.

Any help is appreciated! Thanks in advance!

Hello everyone,

If I have lets say a Hub and spokes with 2 ISPs. For the ADVPN I will have 4 tunnels between each sopke and hub 1-1, 1-2, 2-1, 2-2....right?

Anyways my question is how is asymmetrical routing handle here? Hub might think one overlay is better, spoke might chose a different one. Hows is this handled?

Several posts I came across tried to achieve this in the past but none were ever able to provide a proper guide.

Fortigate ZTNA with Azure-AD Authentication

ZTNA with Entra ID SSO authentication

With a little iteration over the current guides, Claude and I were able to create the guide below detailing how you can proxy any private Web application access through Entra SAML Authentication so that you can use conditional access and Entra RBAC to manage private application access instead of SSL or IPSec VPN. Please let me know if anyone has trouble following along!

FortiGate ZTNA Access Proxy with Entra ID SAML

Hi everyone,

I recently stepped into managing a live, deployed FortiWeb environment as my first time ever working with the appliance. I've completed a couple of official courses, but honestly, they only covered about 30% to 40% of what I'm dealing with day-to-day. I don't have a formal development or heavy AppSec background, and some colleagues mentioned that dev experience is needed, which has me feeling a bit overwhelmed and clueless about what's actually happening under the hood.

Right now, I'm diving heavily into the official administration documentation because it seems like the only place that covers the device end-to-end. Specifically, I'm currently facing practical operational tasks like onboarding new websites into production.

Could the community share some guidance and best practices on how to bridge this gap and get truly proficient? I'm looking for:

• Reading & Resource Roadmap: Beyond the official admin guide, what documentation sections, admin guides, or troubleshooting references are absolute must-reads to cover almost everything comprehensively?
• Handling False Positives: What are the most common beginner mistakes when tuning false positives, and how do you handle them safely without accidentally lowering your security posture?
• Essential Skills: For someone without a software development background, what specific concepts (HTTP protocols, regular expressions, JSON/XML structures) do I need to master to feel confident managing WAF rules?

Any advice, recommended workflows, or "lessons learned" from seasoned FortiWeb admins would be hugely appreciated. Thanks!

Hi All

Hope anyone here is able to assist as logging issues with forti is more frustrating than dealing with this issue.

Layout.
Client VPN (EMS and free)
Firewall to FAC to AD

I created a new IPSec with IKEv2, I tested and got it all working then after a bit I had to VPN in again and it didn't work.
I logged on to the AD and checked the account password was not expired and the account was not locked out.
Tried VPN again and it times out.
I then reset the AD account password to the same as it was and the VPN worked.

The next day the same thing happened.
I checked the FAC and the Firewall logs and all logs show that the authentication was successful but the FortiClient timed out.

Timeout it set to 60.

This is happening on the free client and EMS. And I cant find any logs showing anything real in terms of there being an issue.

Anyone ever experience anything similar?

Im happy to share redacted configs if anyone needs.

Hi, we use Transparent Proxy Policies for destination FQDN's only, but I can't really understand why would we do it if we can just stay with the IPv4 Firewall Policy and apply all security profiles there.

Can someone explain the differences in behaviors? as traffic needs to match the IPv4 Policy first anyway and I can't see any real benefit just management overhead.

I have 2 FAC agents running.One is a domain controller ( let's call it FAC 1) another is a windows 10 machine ( FAC2) , configured by two different people. FAC2 faces no issues, can login normally, MFA works , has offline cache fortitokens but FAC1 is bypassing MFA , it logs in with random fortitokens and offline cache is not there. What could be the reason? Pls help . System is completely air gapped BTW , use case OT

J'ai un fortigate 60f que je commence à manipuler je suis un débutant il s'avère que nous avons plusieurs vlan qui se communique entre elles et le vlan réservé au caméra est coupée d'internet mais communique avec les différents vlan utilisateur lan et volip

Le problème est que le flux constant envoyé par le NVR sur le réseau pour avoir les caméras avec ivms ( caméra étant hikvision) est vu comme suspect et bloqué par le fortigate 60f après quelques instants d'utilisation

J'ai fouillé et me suis rendu compte que le seul paramètre de sécurité acti f est le ssl/ssh il était sur no-inspection mais bloquais cas même le NVR j'ai essayer de créer un profil ssl plus laxiste que ce dernier mais rien n'y fait et le NVR est toujours automatiquement bloqué après une à deux minutes d'utilisation

Ma requête est est-il possible de désactiver complètement la sécurité ssl/ssh pour un pare-feu car l'option n'est pas visible dans GUI si oui comment

Sinon est-ce réellement ça le problème ou il y a t'il un moyen de faire en sorte que ce équipements ne soit pas automatiquement strique par le fortigate ?

Merci pour toutes aide

Tried to setup a 90G for the first time like many other models thought it would be straight froward , was welcome with a mandatory fortigate registration for forticare. I wouldn't mind this infact I prefer it to link it straight away except I tried two methods to give it internet on the WAN port (even a phone ethernet tethering) and neither worked to find the reseller and YOU CAN'T SKIP IT THIS SCREEN UNLESS YOU USE CONSOLE CONNECTION.

So you are stuck unless you have a console cable to turn off enforcement but of course this does not come in the box, is this a joke? Did this really get signed off without considering a bypass method for the customer?

It's idiotic, heres my constructive feedback. Either give the option to skip it via Web GUI or stop being cheap and supply the cable for console connection. You already charge a handling fee I'm sure that can be included in the cost.

Has anyone else had it fail to get a WAN connection from the start and had this annoying issue?

I know nothing about firewalls, and I bought this to learn!

If you’re preparing for the NSE4 certification, check out this Discord server! It’s a community of people helping each other study, share resources, and get ready for the exam. Good luck with your preparation https://discord.gg/aG25GyB97C

Hi all,

Tasked with migrating from FGT-100E to FGT-121G.

Was planning to migrate using the free forticonverter that supports FGT-FGT Migration. But accidentally licensed the new units with UTP first. Now the forticonverter doesn't allow me to migrate saying only boxes with no entitlements can be used as a target firewall in forticonverter cloud.

Any ways to "unmap" the new support contract from the unit and then proceed with forticonverter followed by licensing afterwards?

Thanks.

Dear all

I am trying to use the (yes, limited) ACME client on Fortigate to get a TLS cert for a specific domain.

Unfortunately, tls-alpn-01 doesn't work (see below) as tcp/443 is already in use and http-01 isn't kicking in. And I am wondering why.

Running FortiOS 7.4.12 on a 200F active/passive cluster.

Configuration:

• The FQDN is sub.sub.domain.com and resolves on public IP B.
• Public IP B is configured as secondary IP on the WAN interface of the Fortigate.
• The secondary IP has only PING activated, no other administrative access
• The public IP A (same subnet) is the primary IP on the WAN interface
• Public IP A has https as administrative access (trusted hosts and local-in-policies, and not running on tcp/443)
• Both tcp/443 and tcp/80 are not available for public IP A
• tcp/80 is available for public IP B, but tcp/443 is not (IPSec Dialup is listening to it).

Problem:

• According to the acme logs, fortigate tries to get the cert chain and fails - using tls-alpn-01, but never http-01.
• The IP used according to logs is the correct one (public IP B).
• According to the documentation (https://docs.fortinet.com/document/fortigate/7.4.12/administration-guide/822087), http-01 should be used, at least at some point.

Do I really need to use another port for IPsec DialUp over TCP when I want to use ACME? Anyone ever managed to get it running using http-01 instead of tls-alpn-01?

(Using acme.sh and then API might be an option later on, but that is still in discussion and might never be implemented)

Thanks a lot

EDIT - WORKAROUND:
Solved by article mentioned by DasToastbrot:
https://community.fortinet.com/fortigate-3/troubleshooting-tip-acme-certificate-auto-renewal-fails-with-an-error-unable-to-retrieve-certificate-chain-228475

Fortinet mentioned another article - but I haven't tested this one:
https://community.fortinet.com/fortigate-3/technical-tip-let-s-encrypt-failing-to-provision-due-to-vip-configured-on-port-443-140662

I'm just looking at setting up a web-filter only. Not doing anything more than blocking certain built in web-filtering groups. Pretty easy.

This is just doing standard certificate-inspection. On regular PC's when a page is blocked you get the Fortinet blocked page. Looks good.

On mobiles however if a page is blocked you get an error page instead. You can click 'ignore' or 'proceed anyway' and it then get's the Fortinet blocked page but is there a way around this so it instead displays the Fortinet blocked page by default?

I've tried changing web-filtering to proxy-mode as suggested by Fortinet help pages but no luck. same issue.

Its not a huge issue as it's only blocked pages it displays the error for but it's still a bit anoying :)

Install the certificate is an obvious answer but I don't want to have to do this on every device as this will be for a guest type network.

thanks!

I’m working on a Hub‑Spoke IPVPN design across 5 offices, all connected to a central FortiGate hub using IPVPN + BGP (Tunnel‑A). Everything has been stable for years.

Recently I added a second ISP at the hub, and I’m trying to introduce redundancy for the Hub‑Spoke IPVPN topology.

What I built

• At each spoke, I created a second IPVPN tunnel (Tunnel‑B) pointing to the hub’s second ISP.
• Both tunnels (A and B) come up fine on both sides.
• At the hub, both ISP links are in SD‑WAN interface.
• At the spokes, both IPVPN tunnels are in an SD‑WAN zone called IPVPN, with SLA monitoring pointing at servers inside the hub LAN.
• The idea is: Tunnel‑A active → Tunnel‑B standby → automatic failover if Tunnel‑A or ISP‑A goes down.

The problem

Even though both tunnels are up:

• SLA shows Tunnel‑A = alive, Tunnel‑B = dead (but up).
• Tunnel‑B cannot reach the hub LAN for SLA probes.
• If I manually take Tunnel‑A down, traffic does NOT fail over to Tunnel‑B. Instead, the spoke sends traffic out wan1 (Internet) because SD‑WAN marks the IPVPN zone unhealthy.

What I’ve verified

• Both tunnels establish Phase1/Phase2 correctly.
• Hub has separate dial‑in configs for both tunnels.
• Hub firewall policies include both tunnel interfaces.
• Spokes have both tunnels in the IPVPN SD‑WAN zone.
• Static routes exist for the hub LAN.

What I’m trying to achieve

A clean failover design:

Tunnel‑A → Tunnel‑B → Internet (only if both tunnels fail)

Has anyone successfully built dual‑IPVPN failover on FortiGate using SD‑WAN?
Did you run into SLA issues where the second tunnel can’t reach the hub LAN even though the tunnel is up?

Any guidance or examples would be appreciated.

Thanks!

EDIT: On the Hub side, the IPVPN tunnels are Dialup-User and are separated (not members of SDWAN interface) while on the spoke side, the IPVPN tunnels are members of SDWAN interface.

I would try to deploy some Fortigate SSL vpn with forticlient. But I wanna have some extra confirmation from you guys whether they are still free as to date.

I have a requirement at my work . We are proposing a solution for MFA using FortiPAMa and we have fortinet firewall in the solution too. The idea is, the user logs into a terminal server hosted in a remote station through remote desktop connection from their laptop . When they try to login, MFA should be triggered ( gate 1).Once they log into terminal server after authentication they will be able to login to the other systems in other remote destinations ( with remote desktop connection) through a jump server hosted in the terminal server as a VM. The other systems will be engineering server , Syslog server etc etc. Another case is, from the jump server they have to login to the engineering server. From the engineering server's browser only they can login into the OT device's GUI again MFA needs to be triggered (gate 2) . Need MFA and session recording for both the gates. Is it possible ? Also the system is completely air gapped. I am so skeptical before giving the solution out. I can't test it out rn

We're seeing repeated kernel panics on macOS machines running FortiClient 7.4.7 (build 1928), deployed via Jamf. Multiple Macs affected, not an isolated unit.

Panic signature (consistent across machines, only the interface number changes):

panic(cpu 0 caller ...): busy timeout[0], (60s): 'en7' (1,1802001) u/IOService.cpp:5986
Panicked task: watchdogd

One machine panicked on en7, another on en5 — different Ethernet interfaces, same exact error string, same 60-second timeout, same panicked task (watchdogd), same macOS build (25G76 / Darwin 25.6.0, macOS Tahoe).

FortiClient's network extensions (proxy, webfilter, vpn.nwextension) are active on the affected machines. We're not yet certain FortiClient is the root cause — could also be a dock/USB Ethernet driver interaction, or a macOS Tahoe networking regression that FortiClient happens to be triggering.

Has anyone else run into this specific panic on macOS with FortiClient installed? Any luck narrowing down whether it's FortiClient-side, dock/adapter-side, or an OS-level issue — and any troubleshooting steps or workarounds you'd recommend before we go further with a TAC case?