10

I haven't used a Fortigate FW for load balancing, so I will answer some of the questions more generally. First, as to your problem, the load balancer is doing exactly as it is supposed to do and I think your servers may not be configured correctly to respond to a request on their IP address. If you were to test this behind the load balancing, you could set ...


7

From Network Labs blog: "In case of a Fortinet firewall, its Policy Route: CLI version: config router policy edit 1 set input-device "port4" set src 172.18.0.0 255.255.0.0 set dst 192.168.3.0 255.255.255.0 set protocol 6 set start-port 443 set end-port 443 set gateway 1.1.1.1 set output-...


6

Try with: diagnose sys tcpsock | grep 0.0.0.0


6

What you can do is SSH to the Active unit, then run: execute ha manage <x> where x is the ID of the other unit. Then run config system interface edit "port1" set status down next edit "port1" set status up end You can then log on to the switch (assuming it is logging interface UP/DOWNS) and see which interface went down.


6

Hey you could have just googled that and the first link is your answer. Here. Do some research before asking please. Here's the steps in short: connect to the fgt with a com cable, if not com port then use USB cable with fortiexplorer. Start the console. reboot the device and wait for it to ask for the username Type in the username: maintainer The ...


5

The product datasheet for the Fortigate-60 specs out the Heat Dissipation at 40BTU/h and Operating Temperature at a max of 104F. This is typical for a fanless design. See these small HP office switches with similar power rating showing Fanless designation.


5

This is a bit of an out of the box answer, but depending on your wireless vendor, several of them offer a "remote AP" configuration that allows an AP to create a VPN tunnel back to the controller when it boots. Your remote (and temporary) users would then connect to the AP and back to the controller over VPN. You would have to come up with other solutions ...


5

Fortinet has an ALG (proxy) for SIP (a VoIP protocol) since this protocol uses dynamic ports (like FTP) and thus need to be handled in a specific way. Port 5060 is the default port for SIP. This means that you are connecting to the SIP ALG on the Fortinet Firewall. And, since this is an application level gateway and not only some packet filter rules it will ...


4

Yes, the Fortigate FG-60D and it's sibling FortiWifi FWF-60D are both fanless. I've seen and sold a lot of them.


4

You can do this in theory, but you will need a good client machine to do that and by good, I mean a good Windows installation. This is because the operating system on the machine you want to use SSL VPN client will have to deal with all the traffic, and that machine will have to somehow prove router&firewall capabilities. Step 1: you connect that ...


4

Since policy routes are evaluated top-down, you can work around this limit by placing a more specific entry matching traffic from internal subnet A to internal subnet B. However, this should be less than comfortable if you have many different networks attached to your internal interface. In this case, I would recommend you a trick I once used: since ...


4

First off, this behavior is as expected. The Fortigate (as a stateful firewall) will create a session from the information of the first packet arriving. It will determine the route to apply and whether forwarding is permitted or not. After these decisions, subsequent traffic belonging to the same session is forwarded without any further decisions to make. ...


4

The following should show you the snmp-index for each interface on the Fortigate. You can also modify this field if you so choose. # config system interface (interface) # show


4

You can check the MAC address table on the switch to see on what port you learned the MAC address of the Fortigate's management interface. It should be possible to enable LLDP on the Fortinet as of FortiOS 5.2 as well according to their documentation: config system interface edit <name> set lldp-transmission enable end end You can enable ...


3

I've used FortiGate in the past and you can do that with UTM like M4niac said. One thing to be careful with, maybe you've already experienced this, is Forti units are slow to process changes. In my experience, you do something in the configuration and it takes a couple of minutes before actually applying. Especially when speaking of UTM features. It looks ...


3

What version of fortios are you using? and what model de you have? FortiOs 5.0 and 5.2 (i think) have what are you looking for which includes an UTM options of client reputation (in other words, users rating) not just by traffic, by malware, network applications or IPS. Hope Helps!


3

After reading the HTTP host-based load balancing in the Fortigate Load Balancing doc, I can see how you can have an atypical load-balancing configuration that could result in what you describe. However, without part of your config, we cannot be certain if this is the case for you. Fortigate FortiOS allows a Virtual Server to be created that is tied to Real ...


3

The FortiGate doesn't care which protocol is running over the port 443, so you just need to create a policy and select the corresponding interfaces/addresses and as service you can select HTTPS. If it's a policy from internal network to WAN, be sure to select NAT also


3

Clustered Fortigate units become ONE unit in terms of L3 IP addresses, L2 MAC addresses, policies, objects etc. Only a few HA parameters along with the hostname are not mirrored from master to slave(s). The primary's IP addresses are used for the cluster; all slave addresses are overwritten. The real MAC addresses are hidden as well. Active management of a ...


3

We didn't want to take the risk of this design and STP compatibility issues between FG and Cisco and changed our design to something safer and more redundant. For our new design, we migrated all hosts (policies) from FG1 to FG2, once FG1 is idle, we enabled HA cluster on FG2 and made FG1 slave to it. FG1 and FG2 are no more trunked and we have full ...


3

This message means that all high ports (>1023) are used up for outbound NATted connections. This is very rare and signifies that your FGT is processing way too many sessions. Check the number of open sessions in the GUI or CLI (get sys perf stat), "average sessions" and "average sessions setup rate". Two main reasons may apply: either you've hit a ...


3

From the CLI you can issue the following command to restart the routing service. exec router restart To restart OSPF, you can use. exec router clear ospf process


3

Whether or not a VPN tunnel is used, network administrators cannot inspect SSL traffic unless they either have access to the server's private key or use SSL deep inspection. SSL deep inspection replaces the server certificate and requires an alternative CA root certificate to be installed on all clients. You can easily detect this by inspecting the ...


3

The speed 100 duplex full on GE1/0/8 & GE1/0/11 are most likely a problem. Setting a fixed speed/duplex mode disables autonegotiation. If the other side isn't set to exactly the same mode the link will buck. With autonegotation active on the other side, it'll detect the speed but fall back to half-duplex, creating a duplex mismatch - the link works ...


2

I think you need a hub-n-spoke VPN where one location acts as the main termination point for all of the other locations, and then routes between them for connectivity for them. Fortinet devices definitely support this. And I don't think they will have a problem with the same LAN topology on each local network; you're correct in that you will likely have to ...


2

Considering you have the IPSec tunnels up and running, that's half the battle, the other half is getting your Fortinet HQ to act as an Internet transport "between" hubs. With the Forinet you can use either the Policy-Based or Route-Based VPN to enable communication between the spokes. For a Policy-Based hub-and-spoke VPN, you define a concentrator to ...


2

For starters, they aren't identical: 1718.1, 1718.2, 1718.3 There will be one security association ("tunnel") per ACL rule.


2

(This question seems to be stale but might be found while searching anyway.) The debug message indicates that the Fortigate drops this traffic as being from an unknown source net. This is called the Reverse Path Check or anti-spoofing feature. The absence of other messages here signifies that a route to the source network for this packet is missing, which ...


2

You should run BGP on your Cisco routers connecting to ISP. If FW supports BGP, it should run iBGP with the routers. I would prefer doing NAT on the FW. All you have to do is make sure that the traffic leaving a FW comes back to the same. I think you would already be doing that. HTH.


Only top voted, non community-wiki answers of a minimum length are eligible