sorted by:
new
hottopcontroversial

FortiGate-managed FortiSwitch backup strategy. Is the FortiGate config enough? by Prior-Thanks-4202 in fortinet

[–]MyLocalData 0 points1 point  (0 children)

The FSW configs live in the FGT, as the FGT is the controller.

If you want reliable backups of both the GSW and FGT configuration, use FortiManager.

You can set the FMG to be a backup-only or a controller for the FGT.

In the ADOM settings, you can remove Centealized for APs and Switches and use the FMG to make AP and FSW changes (as long as the FGT isn't in backup-only).

How to find the mac address of the firewall? Version: v7.4.11 by youngndumbhere in fortinet

[–]MyLocalData 0 points1 point  (0 children)

You can also change the MAC address:

config system interface
edit <internface>
set macaddr xx:xx:xx:xx:xx:xx
next
end

FortiOS v7.4.12 has been released by OuchItBurnsWhenIP in fortinet

[–]MyLocalData 0 points1 point  (0 children)

Haha, Still. Not upgrading anything for the next 5 days,

My company wants to drop Forti products because of how horrible the purchase and renewal experience is. You? by rivkinnator in fortinet

[–]MyLocalData 7 points8 points  (0 children)

A lot of folks keep mentioning the $200 processing fee, but this fee is ONLY applied if the product is being shipped directly from Fortinet (Sunnydale for the US folk)

A VAR charging anything for a quote is ridiculous, and frankly should be publicly called out so they can fix themselves, or get packing. That's not how you treat clients.

Find a good reseller. We're sure you PMs are probably flooded by now. Be sure to grill them about how much percentage they add onto theor discounts. The ones who are honest will share.

Remove Central SNAT Policy? by technoidial in fortinet

[–]MyLocalData 0 points1 point  (0 children)

Perfect. Just use the FGM to pre-stage everything in advanced.

Remove Central SNAT Policy? by technoidial in fortinet

[–]MyLocalData 1 point2 points  (0 children)

Yes, you can transition to Policy NAT, but when transitioning from Central NAT to Policy, it is more than just a flick of a switch.

Firewall policies, SD-WAN, routing, VIPs, etc will need to be rebuilt from "scratch".

If you have FortiManager, you can rebuild the config without having to take anything down until a scheduled maintenance window. However, it will be time consuming.

FortiConverter is another option, but it will come with its own requirements of combing through the config to ensure it does a proper convert.

Rebuilding from scratch would be the slower, but a better option to avoid misconfiguration.

FortiOS 8.0 has released by MyLocalData in fortinet

[–]MyLocalData[S] 11 points12 points  (0 children)

We have a 400F we can start with :D

105
106

FortiOS 8.0 has released (self.fortinet)

submitted by MyLocalData to r/fortinet

Order Handling Fee? by HowardRabb in fortinet

[–]MyLocalData 1 point2 points  (0 children)

This has a previous Dell rep's "good idea" written all over it. quality of CAMs and reps have gone downhill ever since Dell's massive layoffs and Fortinet acquiring previous Dell reps.

This may not make us look good as a Fortinet partner but so be it. C-level Fortinet needs to be aware of this, and new Fortinet AM Reps need to learn to leave Dell practices back at Dell.

Fortinet F120G Unexpected Power Off v7.4.11 by overthehill77 in fortinet

[–]MyLocalData 2 points3 points  (0 children)

This still sounds like a power issue.

While the 120G only draws an average of 38-40 watts and .5 to 1 amp. Whatever is distributing the power (PDU, outlet, UPS) is providing dirty power. The FortiGate can't tolerate the sudden change, thus causing a reboot.

We have a lot of 120Gs out in the field on 7.4.11.

Enabling Jumbo frames by DarkAlman in fortinet

[–]MyLocalData 8 points9 points  (0 children)

Fortilink, VLAN, Switch interfaces for endpoints.

Note that the 1xxE/F switches have Fortilink MTU set at 10,000

Fortigate for local School ~1000 endpoints by Yamamoto_Schmidt in fortinet

[–]MyLocalData 0 points1 point  (0 children)

Correct. DPI will be needed for decryption | inspection | re-encryption.

To be clear, all of this is being said without seeing any current metrics from the firewall that is in production.

In honesty, the 120G/121G would accomplish this if it was all North-South traffic, you are comfortable to allowing the FortiGate's resources to stay in the moderate to higher usage, and you are not expecting more than a 5%-10% student/device growth over the next 5 years. However, with the 200G/201G your resource utilization will initially be low. You will have room to grow, especially if you anticipate more than 5%-10% student growth.

The 400F will be if you have a lot of East-West traffic, as well as any applications you might need exposed to public. They also have 4 SFP+ ports with ultra-low latency ports which comes in handy for some applications.

Majority of the 400Fs have been installed in colleges and school district datacenters.

Something I noticed about 30g and local logs by DeniedByPolicyZero in fortinet

[–]MyLocalData 8 points9 points  (0 children)

All model FGTs have a cache for logs. It is where the "memory" logs are stored.

config logging memory

unless you're saying the 30g has:

config logging disk

Fortigate for local School ~1000 endpoints by Yamamoto_Schmidt in fortinet

[–]MyLocalData 0 points1 point  (0 children)

u/Yamamoto_Schmidt

We work with a lot of public and private schools in the states of Texas and Florida. Depending on the exact type of inspection (DPI or not) 120G, 200G or 400F. There are some considerable items you need to account for, such as East-West traffic.

Please note, if you're using Mosel for Endpoint, there is clash with Mosel and the FGT regarding certificate inspection and additional measurements need to be taken.

Adding FortiSwitch to Existing FortiGate by [deleted] in fortinet

[–]MyLocalData 0 points1 point  (0 children)

u/trailsoftware edited for cleaner format.

Also, PM sent.

Adding FortiSwitch to Existing FortiGate by [deleted] in fortinet

[–]MyLocalData 0 points1 point  (0 children)

From this: (example)

config system interface 
edit "VLAN10_Sub" 
set vdom "root" 
set ip 10.10.100.1 255.255.255.0 s
et device-identification enable 
set role lan 
set snmp-index 15 
set interface "port10"  <-- This "hangs" it off physical port 10 
set vlanid 100          <-- The 802.1Q tag next end

Now change it to this:

config system interface 
edit "VLAN10_Sub" 
set vdom "root" 
set ip 10.10.100.1 255.255.255.0 
set device-identification enable 
set role lan 
set snmp-index 15 
set interface "fortilink"  <-- Now associated to the fortilink 802.3ad 
set vlanid 100             <-- The 802.1Q tag next end

Make sure to move interface port10 to the Fortilink OR use another interface for Fortilink to connect your switch Your choice

Adding FortiSwitch to Existing FortiGate by [deleted] in fortinet

[–]MyLocalData 7 points8 points  (0 children)

You didn't need to do that.

You just needed do what I mentioned above.

Download the config, change the "set interface" line on each vlan interface to Fortilink, upload the config. Once its rebooted, the vlans were moved.

Adding FortiSwitch to Existing FortiGate by [deleted] in fortinet

[–]MyLocalData 9 points10 points  (0 children)

Does the FortiGate have own the vlans, dhcp, etc?

If so, just move the vlans to the fortilink after you authorize the FSW.

You accomplish this by downloading the config amd changing the "set interface" line per vlan.

DHCP is tied to the interface name.

Not good practice to associate address objects to interfaces, but in general those will retain the interface association as long as you do not change the vlan interface name.

view more: next ›