It is relatively easy to manage one device via its GUI or CLI. However, managing tens or even hundreds of devices is where efficiency comes into play or falters. FortiManager offers two main ways of automation in terms of object configuration, interface management, and setting up devices in bulk: Native CLI Scripts and Jinja2 Templates.… Read More »
If a FortiGate has a WAN interface that obtains an IP address via DHCP, it will renew the lease halfway through its duration (if the lease is for 2 hours, the FGT will automatically renew the lease every hour). This can result in session drops in applications (e.g., VPN RA). We first observed this issue… Read More »
The entire setup was done on FortiOS version 7.4.8. However, it should work on any 7.X build. The customer wanted to use local DNS servers instead of global DNS servers to point to the local IP address in replies rather than global, the public DNS is 8.8.8.8/1.1.1.1. Initially we settled this by configuring DNS servers… Read More »
Today I’d like to talk about the security switch that Fortigate has for us when we change its configuration and something goes wrong. Most vendors have that – Juniper has a commit confirmed , Cisco routers have a reload in, Aruba checkpoint auto and Fortinet has one too – cfg-save. cfg-save is global setting, to… Read More »
Hi, This one is to show how you can use automation stitches in your infratructure. Okay, imagine you have a case where you have a VPN to a 3rd party company over which you have no control. You also have two internet connections on your side. And now you want to take advantage of that… Read More »
As you might know SSL VPN on FortiGate soon will be depracated (SSLVPN server functionality is disabled by default on 2G RAM models and IMO it will be diabled for good in a few years). Due to recurring security bugs in SSL libraries, this is considered too much of a problem. To allow easier use,… Read More »
A few weeks ago I had the unpleasant necessity to start working with Stormshield firewalls. It began with the adoption of a client who had a network consisting of several locations that had stormshield or fortigate firewalls with full-mesh VPNs. To this architecture was to be added a new DC HUB with VM FGT. The… Read More »
So let’s assume that for some reason you want to check the speed from Fortigate to some host – it could be a server on the local network, it could also be a server in some public cloud. Fortigate has a built-in iperf3 client and a limited iperf3 server. You can access these functions from… Read More »
Tips on HA upgrades Follow the Upgrade Path. https://docs.fortinet.com/upgrade-tool/fortigate Review Release Notes, check Known issues to see if there may be a problem with your configuration. Back up full configuration with local super_admin level account. Review the crash logs for any firewall issues and generally look around to make sure Fortigate is working well before upgrading… Read More »