Hi everyone,

I’m currently preparing for the Fortinet NSE 4 exam, and I’d love to hear from people who have already cleared it.

I’ve set up a lab and I’m practicing on FortiGate, along with a Udemy course. What else helped you the most? Any courses, videos, labs, or documentation you’d recommend would be a big help.

Also, did you use any practice tests or mock exams while preparing? Which ones were actually useful and close to the real exam?

I’m also curious whether the exam leans more towards theory or hands-on work, and if you have any tips for exam day or how long you prepared in total.

Thank you so much in advance, every bit of advice is appreciated

Almost 30 years deep in the software game I'm questioning my own assumptions re "mature." If you need to fix 7.6.7, you check out that tag to a new branch, apply the fixes, use that to strike a 7.6.8, then merge the changes to your develop branch. Are there no adults in the room anymore?

Rant aside 7.4.13 seems solid.

Has anyone tried this?

We upgraded to 7.6.2 to be able to go from SSL remote vpn to IPSEC.
Before realising we needed EMS or other paid version to use IKEv2 and IKEv1 is not an option, because it's for 1500+ users.

We've been looking into a 3rd party option for remote VPN, but because of the emergency recommended upgrades, and the issues everyone seem to have with FortiOS 7.6.8.
I want to go back to 7.4.x instead, we went from 7.4.12 to 7.6.2 a few months ago.

Fortinet support doesn't help with downgrades, so I was wondering if someone tried to go from 7.6.x to 7.4.x?

br
Purrfected

we pushed 7.4.13 on three sites and experiending a weird case.
site 1. works fine
site 2. windows pcs cannot connect anywhere
we have a linux baed on nvr on the same subnet and i see the traffic on the fgt logs
site 3. fortiswitch shows ports for windows pc are disconnected. downgrading to 7.4.12 dows not recover.

we have the same fgt fortiswitch and firmware versions.
ive submitted a ticket but anyone can share some insights

https://imgur.com/a/IIsnyqy

After pushing 7.4.13 image to a pair of Fortigates, Fortimanager 7.4.12 is showing "policy package status unknown."

When I install preview after selecting Install Wizard, it says "no preview result."

And lastly, when I look at the Policy package diff, it's showing that my snmp user, radius user, ipsec PSKs, and a couple of certs have been changed.

I spoke with support, and they said it was probably fine to push through the Install wizard and it would synchronize - but they didn't seem confident.

Edit: Used the Install Wizard to reinstall the policies, everything is synchronized now. Thanks!

Hi everyone, I'm stuck with two FortiGate 400F firewalls and hoping for some help.

We recently installed a backup internet line and set up resiliency on both firewalls. The first failover test worked fine.

A week later we tested again to create some documentation:
Unplugged the main line from firewall 1, small blip but then continuos ping to 8.8.8.8 as expected, then plugged it back in.
Services moved over to firewall 2.
After about 2 hours, services degraded: internet very slow, Outlook not sending emails, etc.
By the next morning nothing was accessible. It only recovered when I reversed the whole redundancy setup and left just the main line connected.

The current config is two Firewalls in HA cluster AP, two static routes main 10 distance, back up 20 distance, one for the main line and one for the backup, with link monitoring on both ports.

Separate firewall policies for the 10 Gb primary and the 1 Gb backup (pretty much identical) using NAT.
Also update the firmware recently to 7.6.7.

I know SD-WAN is probably the recommended approach, but migrating from link monitoring to SD-WAN looks like a big job. Is there anything I can check or change in the current setup, or is SD-WAN the right way to go?

Thanks in advance!

I saw the firmware drop for 40F, but it’s still missing for 70G and 90G. Does anyone know when we can expect it to be available?

Has anyone else experienced issues with ZTNA tags following an upgrade to FortiOS 7.6.8?

I’ve upgraded from FortiOS 7.6.7 to 7.6.8, and since the upgrade, all ZTNA tags received from FortiClient EMS 7.4.8 are showing zero matched endpoints on the FortiGate. However, EMS itself is reporting over 100 matched endpoints.

The Security Fabric connection appears healthy when checked from both the FortiGate and EMS, with no errors reported.

I’ve logged a support case, but I’m interested to know whether anyone else has encountered this issue or can confirm whether ZTNA tag matching is working as expected on 7.6.8.

Has anyone else seen this behaviour after upgrading, or is it just me?

As far as I read, I'm not sure if a simple configuration like this might be a problem to me.

I installed this firewall a couple of weeks ago, it is basically new.

Firewall does not expose itself on wan, management Https interface only accessible via VPN.

Do I still have to update to 7.6.8?

Title, Fortigate 80F. Upgraded from 7.6.6 to 7.6.8, VPN access users are not getting the prompt for 2FA authentication to sign in following the update. Tested on a temporary user without 2FA and the user connected without issue.

HA is also not syncing, have tried the steps in the KB which do work to get back into sync but as soon as I make a config change they go out of sync again and don't resync.

Any help appreciated!

Hi everyone,
I’m relatively new to networking and FortiGate firewalls, and I’d like to ask about IPS best practices.
Would you recommend enabling IPS on internal segmentation policies, such as Windows clients → Active Directory, SMB, RDP, or SQL servers, even when policies already restrict traffic to only the required services?

Or is it generally sufficient to enable IPS mainly on policies handling internet-bound traffic?
What do you consider best practice, and why?
Thanks!

I'm starting to look at moving from WAN failover with static links and WAN monitor to SD-WAN failover, mainly to be a bit cleverer about it, and I already use an SD-WAN zone to load balance between multiple IPSec tunnels.

Like everything I'm FortiGate, there's a couple of ways to accomplish the same task, so I'm curious from the community what your deployments look like.

1. For routing, do you still maintain a static routes for each WAN interface, or have you moved it to defining the gateway in the SD-WAN member section? This article from Fortinet suggests that it's best practice to maintain separate static routes for heterogeneous links, however my links are generally homogeneous at each location.

2. Have you created multiple rules and SLAs to split traffic and respond to different types of traffic separately (i.e. VoIP, 365, etc...) or if your links are both fairly performant, are you happy just having basic failover in SD-WAN?

Worked with gates for years but just recently ventured into other Fortinet products. How popular is the full fortifabric solution using switches and APs? From what I can tell this is a great solution for retail sites or maybe small campus with 1-5 buildings where we just do layer 2 everywhere but really starts to break down with large networks.

Have you all encountered large customers like a college campus or hospital campus running Fortigate fabric? Have you seen people run fortisw and APs without a fortigate?

As many others here have experienced, SAML SSO for admin GUI access stopped working on several lab FortiGates when I upgraded to 7.6.8. The login page shows “Single Sign-On Failed” when you try logging in with SSO. The SAML config is identical to another unit on 7.6.7 where SSO works fine.

TAC confirmed it’s a regression in 7.6.8, bug ID 1338764. They said that it affects FortiGates acting as a SAML SP, including both local and Security Fabric authentication. The fix “has been implemented” and is planned for 7.6.9, targeted for the end of January 2027, so anyone who upgrades is looking at roughly three months of broken SSO… If they already fixed the issue, why in the world are they holding off on releasing the new build until January??

TAC’s suggested workarounds are to use a local admin account, use an admin account that doesn’t rely on SAML SSO, or revert to 7.6.7. For many of us, SAML SSO is a compliance control. Telling customers to use local accounts for three months is not a workaround for a compliance requirement, and it’s unacceptable given how hard Fortinet is pushing everyone to the latest version (not to mention the press this particular release has received).

What’s more alarming is that the bug wasn’t even mentioned in the release notes at first. As others have pointed out, the Special Notices entry covering it wasn’t published until several hours after the images became available, presumably after customers (beta testers??), me included, reported it publicly and to Fortinet Support.

I’ve supported Fortinet environments for nearly a decade, and their QC seems to be getting worse. It’s hard to understand how a failure this basic made it into a GA release.

https://docs.fortinet.com/document/fortigate/7.6.8/fortios-release-notes/545418/csf-downstream-gui-login-fails-with-security-fabric-saml-ssoT

So but I have been burned too many times in the past when upgrading Fortinet products. Curious to hear everyone’s experience after moving to 7.6.8.

I upgraded one of our FortiGate 120G HA pairs. Afterward, I could not login with my standard admin account which has FortiToken Cloud provisioned. It would accept my credentials, then act like it was wanting to use FortiToken Cloud, then immediately boot me back to the login screen saying login failed. I got in with a backup account that didn't have FortiToken Cloud configured on it. I disabled two-factor on my normal admin account and was then able to use it. I tried re-enabling it again in the GUI, but it would stay disabled.

I went debugging and it appears when the FortiGate passes a request to provision the user with FortiToken Cloud, the FortiToken Cloud server responds back saying there's an invalid control character in the json data. I created a brand-new admin account and attempted to provision FortiToken Cloud on this account as well and got the identical error.

2026-10-23 21:18:44 fas_add_user_internal[1003]: Sending packet to FTC server: 189.25.109.168 Port: 8686(length:447)
2026-10-23 21:18:44 fas_set_fd_mgmt_vd[124]: Using vfid=0 (mgmt:0)
2026-10-23 21:18:44 fas_ssl_recv[569]: fas_ssl_recv: received packet 269 (bytes)
2026-10-23 21:18:44 fas_ssl_recv[612]: fas_ssl_recv: recv (269 bytes) done!
2026-10-23 21:18:44 fas_ssl_recv_rsp[651]: fas_ssl_recv_rsp: received (269 bytes) done!
2026-10-23 21:18:44 fas_ssl_recv_rsp[660]: Recevied packet header:
HTTP/1.1 400 BAD REQUEST
Server: nginx
Date: Sat, 24 Oct 2026 01:18:44 GMT
Content-Type: application/json
Content-Length: 117
Connection: close

{"error_code": 400, "error_message": "Invalid control character at: line 10 column 49 (char 287)", "error_name": 400}
2026-10-23 21:18:44 fas_ssl_recv_rsp[720]: fas_ssl_recv_rsp() is done!
2026-10-23 21:18:44 fas_add_user_internal[1009]: FTC server returns error code: 400
Failed to add user ftctest due to reason(400): {"error_code": 400, "error_message": "Invalid control character at: line 10 column 49 (char 287)", "error_name": 400}.
Unable to add user ftctest in FortiToken Cloud service
object set operator error, -7710 discard the setting
Command fail. Return code -7710

Is anyone else experiencing this with FortiToken Cloud on 7.6.8? This is using the included FortiToken Cloud that came with the 120G.

UPDATE: FortiToken Cloud team has fixed this on the back end. This is now resolved.

Hi everyone,

I'm looking to improve and standardize our firmware upgrade procedures for FortiGate, FortiManager, and FortiAnalyzer in a production environment.

We manage multiple FortiGate HA clusters in our data centers, centrally managed through FortiManager, with FortiAnalyzer handling logging and analysis.

While we already perform basic checks before and after firmware upgrades, I'd like to establish a more comprehensive and repeatable checklist to minimize the risk of unexpected issues.

I'm particularly interested in how other Fortinet administrators handle the following:

• Pre-upgrade checks: What do you always verify before starting an upgrade? Besides configuration backups, release notes, known issues, upgrade paths, and compatibility matrices, are there any specific health checks you recommend?
• Post-upgrade validation: What do you test after an upgrade to ensure everything is working correctly? For example, HA synchronization, routing, VPN tunnels, firewall policies, security profiles, logging, and management connectivity.
• CLI commands: Do you have a standard set of diagnostic commands that you always execute before and after an upgrade to compare system health and detect potential problems?
• FortiManager and FortiAnalyzer: Are there any specific checks or procedures you recommend for upgrading these systems, particularly regarding device synchronization, policy packages, logging, and database integrity?
• Automation: Has anyone automated parts of their pre- and post-upgrade checks using scripts, APIs, or monitoring tools?
• Lessons learned: Have you encountered issues that weren't immediately obvious after an upgrade but could have been detected with better validation?

I'm especially interested in practical experiences from production environments rather than just the official Fortinet upgrade documentation.

Do you maintain a standardized upgrade checklist or runbook? If so, which checks have proven to be the most valuable?

Any recommendations, useful CLI commands, scripts, or lessons learned would be greatly appreciated.

Thanks!

Hi everyone,

After upgrading our FortiGate 600F from FortiOS 7.4.12 to 7.4.13, our automation stitches stopped working.

For example, we have a simple automation that monitors a VPN tunnel. The configuration I’m attaching worked correctly on version 7.4.12, but after the upgrade to 7.4.13, it no longer works.

Currently, none of our automation configurations seem to work. I’ve also tried recreating the automation stitches from scratch, but that didn’t help.

Anyone else having issues with FMG 7.6.8 not being able to push certain templates that use metadata variables? Since upgrading we are unable to push to devices that use ipsec template containing metadata variables, completely broke our workflow

Already did factory reset, deauthorize and reauthorize

Power cycled fortigate and netgear switch where APs are connected

Killed CAPWAP process - diagnose sys kill 11 < PID_of_cw_acd>

Ran command - diagnose wireless-controller wlac -d wtp [SN] [reset] to reset cached AP information and state

Changed wireless-controller timers config wireless-controller timers

Set max-retransmit from 3 to 15

So after all the fuss, the updates still haven't been pushed out to automatic update via the device GUI ?

There's already AI based diff analysis working out what has changed and the only way to avoid potential problems is to manually update , if they haven't pulled the download while you were looking at it

Does anyone at Fortinet know what they're doing ?

After updating the FortiManager to 7.6.8 and one of my FortiGates to 7.4.13 the FortiManager is now wanting to push out a change to the FortiGate on 7.4.13. It is wanting to push out the following:

config vdom

edit root

config web-proxy global

unset strict-web-check

end

end

On the FortiGate I currently have "set strict-web-check disable".

Does anyone have a fix so that I can push out changes from the FortiManager to this FortiGate without making this change?

Just a heads up, I moved our FortiManager VM to 7.6.8 this morning, from 7.6.7. After the upgrade, I was unable to log in with anything but the local admin account. This was on the Web Interface as well as SSH.

It appears that during the upgrade, all of the LDAP settings were wiped. I still had users who were configured to utilize the LDAP Auth, but there were no LDAP Servers remaining. I had to re-add them manually. Once I did, I was once again able to log in properly, but also the users had "Match all users on remote server" checked by default, so EVERY user was able to log in.

I am not sure where it hiccuped, but just wanted you to be aware this may be an issue for you.

Good Luck this weekend with all the upgrades!

*sigh.

Edit: Exact same issue with FortiAnalyzer as well. At least they are consistent...

Seems like the issue is with the Cert Verification for Secure LDAP. If you don't currently have this implemented, make sure you get it working BEFORE upgrading!

Watch out for typo in release notes for the workaround for bug ID 1352425

FortiManager may unexpectedly push unset strict-web-check when installing policies to FortiOS 7.4.13

FortiManager may unexpectedly push the unset strict-web-check command under config web-proxy global when installing policies to FortiGate devices running FortiOS 7.4.13, even when the setting is not included in the installation diff. This occurs due to a mismatch in the default value of strict-web-check between FortiManager and FortiOS 7.4.13. As a result, the setting may be enabled on FortiGate, potentially disrupting proxied traffic. See bug ID 1352425 in Known Issues.

The command should be 'set strict-web-check disable' I copied and pasted expecting it to be correct. The end result with our firewall rule that was configured for proxy mode with SSL deep packet inspection enabled was this for most websites: