u/mohammedalrawii

Hi everyone,

I recently stepped into managing a live, deployed FortiWeb environment as my first time ever working with the appliance. I've completed a couple of official courses, but honestly, they only covered about 30% to 40% of what I'm dealing with day-to-day. I don't have a formal development or heavy AppSec background, and some colleagues mentioned that dev experience is needed, which has me feeling a bit overwhelmed and clueless about what's actually happening under the hood.

Right now, I'm diving heavily into the official administration documentation because it seems like the only place that covers the device end-to-end. Specifically, I'm currently facing practical operational tasks like onboarding new websites into production.

Could the community share some guidance and best practices on how to bridge this gap and get truly proficient? I'm looking for:

• Reading & Resource Roadmap: Beyond the official admin guide, what documentation sections, admin guides, or troubleshooting references are absolute must-reads to cover almost everything comprehensively?
• Handling False Positives: What are the most common beginner mistakes when tuning false positives, and how do you handle them safely without accidentally lowering your security posture?
• Essential Skills: For someone without a software development background, what specific concepts (HTTP protocols, regular expressions, JSON/XML structures) do I need to master to feel confident managing WAF rules?

Any advice, recommended workflows, or "lessons learned" from seasoned FortiWeb admins would be hugely appreciated. Thanks!

Hi everybody

I’ve been a "Fortinet guy" for years. Worked with multiple firewall vendors across my career, but I always preferred FortiGates for their value and performance. Lately though? Man, I am losing my damn patience with them.

Between the constant stream of CVEs (FortiBleed, SSL VPN vulnerabilities every other month) and their hard push to kill off/deprecate SSL VPN entirely, we decided to finally do the responsible thing and migrate our remote access users over to IPsec IKEv2 tunnels.

I set up the IKEv2 tunnel on the FortiGate with Pre-Shared Key + User Authentication. I spent two full weeks testing it. I tested it across multiple mobile devices—specifically iOS / iPhones—and everything worked like a dream. Split tunneling was fine, authentication worked, performance was solid. I felt confident.

Then rollout day comes. A user pulls out an Android phone running the free FortiClient VPN app... and GUESS WHAT?

The Android version of free FortiClient configured with IKEv2 and a Pre-Shared Key does not prompt for the username and password at all. It just fails or tries to connect without authenticating the user.

After digging into it, turns out FortiClient on Android literally doesn't support combining PSK with EAP (username/password) authentication under IKEv2. If you want username/password prompts on Android IKEv2, Fortinet expects you to switch to X.509 Certificate authentication—yet iOS FortiClient handles PSK + user auth without blinking an eye!

How does this even make sense? How do you have feature disparity this broken between iOS and Android on your own client app for a core VPN protocol you’re actively forcing everyone to migrate to?

I know, shame on me for only testing on iOS during the initial trial period and assuming Android would behave identical to iOS on the exact same VPN protocol and client app. But seriously, is anyone else completely exhausted by this? Every time you try to implement a "standard" configuration or follow Fortinet's recommended path, you stumble into a bizarre platform-specific limitation or bug.

Hello everybody I hope you are all doing well,

I need to prepare for updating our Forti Web active active cluster this is my first time updating Forti web and I need to prepare well for it so I have the following questions :

1-what is the behavior of Active Active cluster as Fortinet Documentation doesn't clearly explain how it will update will both nodes reboot and update at the same time ?
Fortinet documentation " The primary appliance will transmit the firmware file to the standby appliance over its HA link. The standby appliance will upgrade its firmware first*... After the standby appliance reboots and indicates via the HA heartbeat that it is up again,* the primary appliance will begin to update its own firmware"
are they describing the active-stand by or active active cluster here ?

2- ok the for the second question I choose 7.6.7 which has no CVEs per PSIRT Advisories, as for the known issues they explicitly say there is known issue but when I checked 7.6.8 I saw multiple fixed issues isn't here a conflict or am getting something wrong here ?

3-the upgrade path from 7.4.8 will be 7.4.8 -> 7.6.2 -> 7.6.7 the update path tool for Fortinet doesn't show Forti Web only Forti OS , Forti Analyzer, Forti Manager so I will be relaying on Forti Web GUI is there another way to confirm the upgrade path ?
Also if anyone have tried these firmware's have you faced any issues in prod env?

Thank you in advance for your response.

Hello everybody I hope you are all doing well,

I need to prepare for updating our Forti Web active active cluster this is my first time updating Forti web and I need to prepare well for it so I have the following questions :

1-what is the behavior of Active Active cluster as Fortinet Documentation doesn't clearly explain how it will update will both nodes reboot and update at the same time ?
Fortinet documentation " The primary appliance will transmit the firmware file to the standby appliance over its HA link. The standby appliance will upgrade its firmware first... After the standby appliance reboots and indicates via the HA heartbeat that it is up again, the primary appliance will begin to update its own firmware"
are they describing the active-stand by or active active cluster here ?

2- ok the for the second question I choose 7.6.7 which has no CVEs per PSIRT Advisories, as for the known issues they explicitly say there is known issue but when I checked 7.6.8 I saw multiple fixed issues isn't here a conflict or am getting something wrong here ?

3-the upgrade path from 7.4.8 will be 7.4.8 -> 7.6.2 -> 7.6.7 the update path tool for Fortinet doesn't show Forti Web only Forti OS , Forti Analyzer, Forti Manager so I will be relaying on Forti Web GUI is there another way to confirm the upgrade path ?
Also if anyone have tried these firmware's have you faced any issues in prod env?

Thank you in advance for your response.