ElderUsr's Blog

As with all mass deployment of products, make sure that there is no RMA equipment or DOA equipment from the vendor. Surprisingly enough it can happen but once that is confirmed use a simple checklist to provide standardization for your deployment. One would simply think why not use a common deployment script or copy the configuration but when deploying Fortigate's en-masse you cannot properly copy the full configuration as they are unique to the hardware, software version And also have unique identifiers within the codes. It is recommended if you are going to do this that you just use specific chunks. *Rant* I recently had an odd issue where Debit Machine would not function after a DNS change where 3 DNS options was provided through DHCP scope, come to find out that the Debit Machine's network stack does not support 3 DNS Servers which was causing it not to pick up the DHCP options at all. */rant*

Below is a set of Random Cisco & FortinetCommands that are common to be used and what it does: #[Cisco] Enabling Mac Filtering on Ports & auto-recovery for the port. switchport port-security switchport port-security mac-address switchport port-security maximum 1 errdisable recovery cause psecure-violation #[Cisco] Checking Hardware/CPU show module more crashinfo:data show processes cpu [history | sorted] show processes memory [sorted]   #[Fortinet] Showing information about Link-Monitoring in redundant links diag sys link-monitor status    

This document outlines how to setup a host-check for a Fortigate SSL VPN (Web only): config vpn ssl web portal edit "portalname" set web-mode enable set host-check custom set host-check-policy "Microsoft-Windows-Firewall" set os-check-enable set ip-pools "PoolName" set split-tunneling disable set page-layout double-column set theme orange config os-check-list "windows-7" set action check-up-to-date set latest-patch-level 1 end  config vpn ssl web host-check-software edit "Microsoft-Windows-Firewall" config check-item-list edit 1 set target "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\StandardProfile:EnableFirewall==1" set type registry next edit 2 set target "HKLM\\SYSTEM\\CurrentControlSet\\Services\\SharedAccess\\Parameters\\FirewallPolicy\\PublicProfile:EnableFirewall==1" set type registry next edit 3 set target "HKLM\\SYSTEM\\CurrentControlSet\\S...

Building Site-to-Site B2B from Unifi USG to Fortigate (500D or other models) Fortigate Configuration 1. Build a New VPN Tunnel using Custom VPN Tunnel (No Template) 2. Under Network, point to the Public Side IP of the USG (Public IP, not WAN interface) 3. Leave everything else default (NAT-T Enabled, DPD Disabled..ect) 4. Authentication, use PSK and IKEv1 with Main 5. Phase 1 Purposal, set algorithms to AES128 and SHA1, with DH 14. 6. Phase 2 Purposal, set Local Address and Remote address to 0.0.0.0/0.0.0.0 and 0.0.0.0/0.0.0.0 respectively. 7. Set Encryption to AES128/Sha1, Replay Detection and PFS enabled, along with DH14. Enable Autokey Keep Alive, and Auto-Negotiate, and save changes. 8. Build a Static Route pointing to the Far-End Destination/Segment you want to reach. 9. Build a Policy Stating which Segments can hit the Far-End Destination/B2B USG Configuration 1. This is assuming that USG is already registered to the Unifi Controller. 2. Go t...

Below is a few common commands that I have ran through when troubleshooting Fortigate 5.2.X and 5.4.X release products, along with their common explanation: #This tests the user's account against LDAP and shows which Group Membership gets passed back. diag test authserver ldap #These commands resets all settings before doing the other settings below: diag debug dis diag debug reset diag debug flow trace stop diag debug flow filter clear #These commands allow certain debugging within the Fortigate, ex. SSL VPN Troubleshooting: diag debug console timestamp enable diag debug application sslvpn -1 diag vpn ssl debug-filter src-addr4 diag debug en #Another common one is to follow a traffic flow: diagnose debug flow filter addr x.x.x.x diagnose debug flow show console enable diagnose debug flow show function-name enable diagnose debug console timestamp enable diagnose debug flow trace start 999 diagnose debug enable