u/DeniedByPolicyZero

How are people handling web filtering on FortiGate for completely unmanaged/BYOD devices?

Our filtering works fine, but blocked HTTPS sites result in a certificate warning because the client doesn’t trust the FortiGate CA. Fortinet TAC says this is expected. Disabling the HTTPS replacement message avoids the certificate warning, but then users just get a generic connection failure.

What I really want is a human-readable “This website has been blocked by your organisation” page without needing to install a CA certificate on the byod endpoint.

Has anyone achieved this with FortiGate/DNS Filter, or are you using another filtering solution for BYOD?

I am upgrading EMS from 7.2 to 7.4, and it's throwing up all sorts of warnings about "user verification is not enforced" at the top of the UI - should I be concerned?

Our current settings are for user verification to be off, but "enforce invitation only registration" set to "all". This should stop random connections to the service.

Reaching out for what others are doing and what is best practice. The actual VPN connection still needs full authentication, just we don't require user based auth to just install and manage the client.

I know this is fairly generic, sorry, but I'm in a bit of a time pinch to come up with recommendations to management (not of my own doing).

We are currently using Fortinet fortiap 221e units, reliability has been fine, but they are showing their age and we have capacity issues. There is one other issue that I am being really pushed on, that although reliable, the fortiap stack has pretty poor logging of RF history, and although not a day to day issue I do sometimes get the request "did we have performance issues last Tuesday" etc.

The cheap and simple option would be a like for like swap to fortiap 231k, more radios, newer tech, cheap, little risk.

Management above me are sold on going to Meraki, we have had quotes and the cost is 3x that of the fortiap, to people who have the Meraki stack, is it all that good and eliminated all wifi performance issues, can you really look back a few weeks / months to see what happened to every clients rf and usage history to easily fix faults? Is it worth 3x the cost?

Are Meraki unique in the ability to resolve performance issues in the WiFi that make them so desirable?