Fortigate: Disabling and enabling the SIP session helper

You can use the following steps to disable the SIP session helper. You might want to disable the SIP session helper if you don’t want the FortiGate to apply NAT or other SIP session help features to SIP traffic. With the SIP session helper disabled, the FortiGate can still accept SIP sessions if they are … Continue reading Fortigate: Disabling and enabling the SIP session helper

Fortigate: Best Practices Guide (per Topic)

This Best Practice Guideline for Fortigate is compiled from both FortiOS 5.2 and 5.4 for common issues encountered by myself and shared to everyone to ensure the most secure and reliable operation of our Fortigate units. This is updated periodically as I come across known issues and best practice recommendations. A. General Configurations  Below are … Continue reading Fortigate: Best Practices Guide (per Topic)

Fortigate: Installing SSL Certificate for SSL-VPN Guide

INSTALLING A NEW SSL-VPN CERTIFICATE (To Renew Certificate, see separate article here) Generate a new CSR  to be signed by the CA Under System -> Certificates -> GenerateCreate a new Certificate Name Populate OU, Organization, City, Country and Email Address  Download the .CSR file Go back to Certificates page, Highlight the new Certificate Name you … Continue reading Fortigate: Installing SSL Certificate for SSL-VPN Guide

Fortigate: Web Filtering is “Unreachable”

Came across this problem that I am unable to use "Web  Filtering" feature on my Fortigate 200B on Firmware 5.2.11 Web Filter error shows the following error before you can create a profile. Licensing information on Fortigate Portal shows I am licensed to use Web Filtering, but on my local firewall error shows "Unreachable" Things … Continue reading Fortigate: Web Filtering is “Unreachable”

Fortigate: How to allow (or deny) wildcard FQDN (Domains) in Policy

Note that this is bit buggy for Fortigate FortiOS 5.2 but works for later versions. Also note that there is an issue with Google Chrome, sometimes allowing google.com even if its supposed to be blocked.  Remember to add EXPLICIT DENY at the end of your list of wildcard sites == Does wildcard FQDNs work in … Continue reading Fortigate: How to allow (or deny) wildcard FQDN (Domains) in Policy

Fortigate: How to Source NAT traffic into a VPN Tunnel

Came across an issue on FortiOS 5.4 where a connection to remote peer via an IPSEC Tunnel suddenly stopped working. (My user told me it was working in the past atleast) Setup is the internal IP needs to be NAT'd to an IP that is known to the VPN peer. So for example, 10.5.0.5 (internal) … Continue reading Fortigate: How to Source NAT traffic into a VPN Tunnel

DNS resolution over IPsec/SSL VPN on Fortigate

Description This article provides basic troubleshooting to follow when you are not able to access hostname over IPSec VPN tunnel or SSLVPN connection Solution   If you are not able to access resources across VPN tunnel by hostname, check following steps: (1)  Make sure to set DNS server properly when configuring SSL or IPsec VPN.  … Continue reading DNS resolution over IPsec/SSL VPN on Fortigate

Important FortiGate CLI commands (HA and Sessions)

FortiGate High Availability Cluster CLI commands: Manage the specified FortiGate unit (X ist the unit number): execute ha manage X Set the current ForitGate Unit as master: diag sys ha set-as-master enable Get HA Status: get system ha status   FortiGate Session commands: Get all Sessions: diag sys session list Filter Sessions: diagnose sys session … Continue reading Important FortiGate CLI commands (HA and Sessions)

Gartner’s 2017 Magic Quadrant for Unified Threat Management (SMB Multifunction Firewalls) Released

  Here is an overview of the leaders in Unified Threat Management (UTM) for 2017. The quadrant is based on the vendor's ability to execute and the completeness of vision.  For 8th straight year, Fortinet is recognized as the market leader in UTMs. To learn more about Gartner's complete view of the UTM market, register for … Continue reading Gartner’s 2017 Magic Quadrant for Unified Threat Management (SMB Multifunction Firewalls) Released