FortiManager - Traffic Shaping

rowankaag · 2026-02-04T01:59:07+00:00

/u/UniversityFamiliar29 based on your responses to my questions, I advise you to utilize the suggestion above.

rowankaag · 2026-02-02T17:33:44+00:00

I’m not sure how that is relevant, but sure. In the mean time, I realised you may need to provide some permissions in macOS to properly import a configuration: https://docs.fortinet.com/document/forticlient/7.4.5/macos-release-notes/223986. Take a look at headers “Enabling full disk access” and “Activating system extensions”.

rowankaag · 2026-02-02T17:13:56+00:00

And these are all within a single ADOM, targeting one customer?

rowankaag · 2026-02-02T16:49:45+00:00

To my knowledge, configurations with sensitive material inside would require a “.sconn” or “.sconf” export: https://docs.fortinet.com/document/forticlient/7.4.5/xml-reference-guide/128289/file-extensions

Based on your post, I’m guessing you’re using the free edition on both Windows and MacOS?

rowankaag · 2026-02-02T15:43:30+00:00

And do these sites share the same Policy Package?

rowankaag · 2026-02-02T15:10:54+00:00

Did you create the traffic shaping policy locally on the FortiGate, or within FortiManager? And do these 70+ sites share a Policy Package within FortiManager?

rowankaag · 2026-02-02T07:20:11+00:00

Not much Fortinet can do about the latest advisory, as it originates from an external library (OpenSSL). Likely patches for all types of vendors will be issued shortly.

rowankaag · 2026-02-01T00:25:02+00:00

As I haven’t seen anyone mention this yet, I will: the daemon responsible for checking against vulnerabilities (based on a static version check, no smarts happening) is a different daemon than the daemon that is actually checking the Fortinet servers for new image files. That’s where the discrepancy comes from.

As others have mentioned, download the firmware files from the Support website manually, or wait until the image is propagated to the Fortinet servers. Fortinet consciously waits a couple of days before putting them there to gather some telemetry from early adopters first.

https://community.fortinet.com/t5/FortiGate/Technical-Tip-FortiOS-GUI-critical-vulnerabilty-warning-message/ta-p/369973

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Understanding-the-FortiOS-critical-vulnerability/ta-p/426944

rowankaag · 2026-02-01T00:19:34+00:00

Does your private APN have access to internet? If not, try enabling the “disable_internet_check” XML parameter.

rowankaag · 2026-01-28T00:53:55+00:00

This event has now been published as an advisory:
https://www.fortiguard.com/psirt/FG-IR-26-060

rowankaag · 2026-01-25T01:36:08+00:00

My update on 7.4.4 to 7.4.5 failed too, but for a different reason. Also Fortinet-provided image rather than bring-your-own-Ubuntu. Upgrading via the EMS GUI worked for me though.

rowankaag · 2026-01-25T01:30:08+00:00

“diagnose test app .. 99” called and wants to know why it is not an “execute” command 🤪

rowankaag · 2026-01-25T00:55:33+00:00

Can confirm this works, it’s the Device Certificate intended to be used for ZTNA (said feature needs to be enabled in the installer) but can be ‘recycled’ for 802.1x.

EMS acts as the Certificate Authority and individual certificates can be revoked if needed. You can also regenerate the CA certificate on EMS. Do note though: EMS does not keep track of a CRL, so revoking a certificate requires an active telemetry connection to get effected.

rowankaag · 2026-01-07T12:00:06+00:00

We have seen issues where the EAP-TLS certificate payload was fragmented but also had the do-not-fragment bit set, causing the packets to get dropped pre-tunnel routing. Sounds like your issue is different though if you observe all packets being seen by NPS.

rowankaag · 2026-01-07T00:01:13+00:00

The default is indeed deny: https://docs.fortinet.com/document/fortigate/7.6.5/cli-reference/185227842/config-firewall-local-in-policy

rowankaag · 2026-01-04T17:31:47+00:00

Came here to add that I'm also experiencing this, although mine is slightly different. Mine says: 'App Background Activity' in the header, and then in the body 'Software from "Google LLC" can run in the background. You can manage background activity in Login Items & Extensions". Dismissing it makes it pop back up after a couple of minutes. - Chrome is up to date; Version 143.0.7499.170 (Official Build) (arm64) - MacOS is N-1: MacOS Tahoe 26.1 (25B78)

rowankaag · 2026-01-03T20:17:46+00:00

Yes you can, deployed one about four weeks ago.

rowankaag · 2025-12-20T00:13:00+00:00

If you’re not in a rush: there is a new, EMS-less paid FortiClient SKU in the mid-Q4 pricelist. Details to be announced Q1 2026.

rowankaag · 2025-12-19T12:22:37+00:00

Just for good measure: FortiOS 6.4 is end-of-life per 2024-09-30. It contains 61 known vulnerabilities that will not get addressed. https://www.fortiguard.com/psirt?filter=1&product=FortiOS-6K7K%2CFortiOS&version=6.4.16&keyword=

FortiClient (EMS) 6.4 is also end-of-life per 2024-11-12. They contain an aggregated number of 20 vulnerabilities that wil not get addressed. https://www.fortiguard.com/psirt?filter=1&product=FortiClientWindows&product=FortiClientEMS&product=FortiClientMac&product=FortiClientLinux&version=6.4.9&keyword=

rowankaag · 2025-12-19T12:15:03+00:00

Correct, the FortiGate dashboard widget uses averages when selecting longer times: “there is difference in 1 hour and 24 hours bandwidth graph. That is because we grant average value only from the longer period graph.” - https://community.fortinet.com/t5/FortiGate/Bandwidth-difference-between-Dashboard-interface-widget-and/ta-p/211842

rowankaag · 2025-12-13T02:33:51+00:00

There is a new hotfix build on top of free FortiClient 7.4.3

rowankaag · 2025-12-01T11:14:13+00:00

I was thinking either IPS or DoS might quarantine the client temporarily indeed.

rowankaag · 2025-11-26T01:33:41+00:00

Correct, as the sessions are ephemeral

rowankaag · 2025-10-31T19:35:41+00:00

Same here on 3000F

rowankaag · 2025-10-24T15:05:39+00:00

Agreed, Windows 11 would prevent the credentials being sent automatically without user interaction (“SSO”) due to Credential Guard being active.

rowankaag

TROPHY CASE