u/Busbyuk

I'm just looking at setting up a web-filter only. Not doing anything more than blocking certain built in web-filtering groups. Pretty easy.

This is just doing standard certificate-inspection. On regular PC's when a page is blocked you get the Fortinet blocked page. Looks good.

On mobiles however if a page is blocked you get an error page instead. You can click 'ignore' or 'proceed anyway' and it then get's the Fortinet blocked page but is there a way around this so it instead displays the Fortinet blocked page by default?

I've tried changing web-filtering to proxy-mode as suggested by Fortinet help pages but no luck. same issue.

Its not a huge issue as it's only blocked pages it displays the error for but it's still a bit anoying :)

Install the certificate is an obvious answer but I don't want to have to do this on every device as this will be for a guest type network.

thanks!

I want to look at some traffic on a sub-interface but cannot get to the device to setup a span port.

It looks like I can run a tcpdump but I'm very nervous about running a tcp-dump on a production unit for obvious reasons.

The sub-interface in question only has minimal traffic, pretty much just protocol traffic so won't be much.

Anyone have much experience running a tcp dump on their production unit? Bad idea or is it okay as long as I take precautions with filtering traffic or making sure it's only running on the sub-interface I want?

thanks!

I have a customer who just needs the capability to use Start before logon on their Forticlient.

Traditionally they would need to license an EMS solution to unlock this but I'm wondering if the new VPN licensing will allow this without EMS?

I'm reading conflicting information where apparently an XML edit is needed where you would need EMS?

literally the only thing they need on top of the free client is the ability for 'start before logon' so EMS seems a waste of money.

thanks

I'm trying to setup a captive portal for a specific subnet which is reachable via the same LAN interface which should not have a captive portal.

For example the LAN is on 10.0.0.0/24 and via this there is a subnet 192.168.10.0/24 which is routed over 10.0.0.1

As such I can't do an interface captive portal. However you can do a firewall policy based captive portal which I've done as per the Fortinet instructions.

However when doing this and setting the source group/users it never get's a match. Source is 192.168.10.0/24 and group is 'WIFI USERS"

If i set this up then the firewall policy never get's a match as I think the firewall policy sees the 192.168.10.0/24 but as the captive portal hasn't initiated it doesn't see a match based on the Wifi user group?

How do I set it up so that users from 192.168.10.0/24 when accessing the internet it will trigger the capitive portal which then uses 'WIFI USER GROUP" for authentication and access to the internet?

interface based captive portal is fine.

thanks!

I'm looking to offer some customers just simple web-filtering and application control for their traffic.

All the NAT, Port forwards etc will be controlled on their own devices. The Fortigate is just going to act as a breakout where web-filtering and application control is done.

I was going to just setup a Fortigate with NAT disabled for this and then the appropriate routing but now I'm wondering if setting up the Fortigate in transparent mode would be better for this?

Is there an advantage or disadvantage to using transparrent mode in this setup? Using less resources for example?

Thanks

A few months ago I posted a thread where I was facing an issue with about 10% of users connecting using IPSEC IKEV2, with LDAP and 2FA (Fortitokens).

Those 10% of users were having to use SSL-VPN instead as when they tried to connect using IKEV2 they would get either token errors or just general IPSEC errors.

I tried various things from increasing timeouts for 2FA to forced nat traversal etc etc and nothing seemed to help.

Well today I finally pinpointed the issue and thought I should post it here as I'm sure some others will come across this issue as well.

As you know when you setup 2FA using Fortitokens and it's linked to LDAP you need to enable 'ignore case-sensitivity' via the CLI otherwise if the user is added to the Fortigate as JoeSmith but they type 'joesmith' then it won't match and will connect without having to use the 2FA.

Well what I found out is the 10% of users having the issue were all pulled from LDAP onto the Fortigate using capital names for example 'JoeSmith'

With 'case sensitivity' disabled it would allow those users to use 2FA but only via the SSL-VPN. Those users always failed on IKEV2.

What we had to do was retype those users into the Fortigate in all lowercase instead and as soon as we did so and asked those users to try again, all of them connected fine using IKEV2 and 2FA.

I have no idea what the deal is there but figured it might help someone :)

Thanks

If upgrading from a Version of Fortios which supports SSL-VPN to a version which doesn’t how does the Fortigate handle removing it?

Obviously the tidy way would be to migrate and disable all SSL-VPN features first but what if someone didn’t?

Does the Fortigate delete the firewall policies which referenced the SSL-VPN? And what about things like user groups, routes etc?

Or will the upgrade just fail due to the existence of the SSL-VPN config?

I wonder if anyone here is using Fortimanager to manage maybe 100 devices and could tell me how much ingress/egress data they see come into and out of their Fortimanager appliance?

Obviously this will differ depending on usage but I'm trying to get a rough idea. This is for pricing something into Azure where inbound is free but anything above 100Gb a month you pay for.

Logging will be on a a seperate device btw.

thanks!

With IKEV1 support being removed from the new Forticlient and SSL-VPN being removed from the Fortigates themselves, I've been migrating everyone to IKEV2 using EMS.

For around 100 users I would say 80 of them are connecting fine using IKEV2, LDAP and 2FA (Fortitokens) however around 20% are consistently having issues and end up reverting back to SSL-VPN.

I've created both an UDP and TCP (443) IKEV2 profile for people to try. The TCP did solve some issues but a lot of people just cannot use IKEV2. I'm pretty sure it's likely their ISP/Router blocking it but I'm just wondering if there are any other tips I could check for when setting up the client on the Fortigate?

I've forced NAT Traversal and setup IKE fragmention. Any one else had issues which changing any settings helped at all?

Thanks!