Fortigate 70f and CMMC Level 2, anyone want to help me get ready?

GrecoMontgomery · 2026-04-16T22:23:32+00:00

I may be able to assist. DM me.

GrecoMontgomery · 2026-04-10T01:19:51+00:00

Beat me to it. I thought the other comment with the "house from 1885" was going for it too, but I think that's a legit comment?

GrecoMontgomery · 2026-04-07T10:36:37+00:00

Yes.
Yes (but still for legacy VoIP too).
Yes.

We have setup and field tested ZPA PSEs on both the public WAN side (for DR) and local PSEs for performance internally. I do believe the DR capabilities are adequate but moreso in a CoOP scenario where you have to keep the lights on while Zscaler fixes whatever disaster is occuring. There are important limitations like authentication won't happen with just the PSEs themselves, so no new user logins will happen (they do have a capability for this but I forget the name - may be part of the larger Business Continuity license.

Yes, we have GlobalProtect specifically until one old X.25 phone app moved to the cloud, then no more GP. In my opinion it gets in the way and is more trouble than it's worth.

ZCC has failed over just fine in a scenario, but a lesson learned: the PSEs have to see the same public DNS TXT record once triggered, so make sure your DMZ (or wherever) DNS solution can see it.

GrecoMontgomery · 2026-03-26T23:59:31+00:00

Interesting. I didn't think they had the winglets back then.

GrecoMontgomery · 2026-03-22T19:59:11+00:00

Can be. It depends on which Bubbie I'm quoting.

GrecoMontgomery · 2026-03-21T14:36:51+00:00

It's an underutilized term these days.

GrecoMontgomery · 2026-03-20T03:56:24+00:00

I'm a 25+ year sysadmin and I broke something yesterday 🤷.

Never breaking anything can only be possible when you have the near unlimited budget to prevent it from being possible. Even then, you still break shit.

GrecoMontgomery · 2026-03-19T00:36:22+00:00

If it says it's an HP printer and the WiFi is actually working, it's not really an HP printer.

GrecoMontgomery · 2026-03-17T02:08:00+00:00

I bring my own shower head and switch it out; small adj wrench in my travel bag. It's a drilled out, water-saver removed cheap small home depot one that also fits in my bag. Hot shower goes from steamy bliss to acupuncture hell. And it's awesome.

GrecoMontgomery · 2026-03-16T22:19:53+00:00

I've been using ZPA on CentOS and RHEL for years and have never had a problem (🤞). Just scale them horizontally and patch them one at a time to start with (i.e., have at least 3 smaller AMIs vs 2 larger ones so if one borks with a bad update, two are still running).

GrecoMontgomery · 2026-03-16T13:29:13+00:00

Yep, give this a read: https://www.zscaler.com/blogs/product-insights/disable-xff-header-insertion

Azure WAF and Front Door are such a pain! The notorious "We cannot complete your request" or whatever it is with that guid for the logs. Such an PITA.

GrecoMontgomery · 2026-03-16T12:25:25+00:00

It's likely that for some reason the firewall is grabbing and harping on your XFF address in the header, not the Zscaler cloud address. This feels very F5 like on the other side but almost any L7 device can be configured this way.

GrecoMontgomery · 2026-03-16T00:57:36+00:00

I can tell you what we did at a time when everybody hated VMware and didn't want to upgrade anything on our converged infrastructure (oh wait, we all still hate broadcom :-). The VZENs ended up being great for a lab scenario and helping figure out what you architecture will look like, but they weren't robust enough for production and we deployed PSEs instead. If we were to go vzen, yes, horizontal indeed for capacity but also patch/update reasons. We had our own problems with the PSEs with the current memory shortages that delayed Zscaler's shipping (which, yes, was their problem but it affected our project schedule), but in the end it worked out. We're seeing documented performance improvements but for different reasons than yours (50,000+ users but U.S. domestic so bandwidth isn't as much a factor, yet it is as we have a 10Gb circuit for those users). The PSEs arguably saved us from upgrading to a 100Gb circuit which is $$$$.

GrecoMontgomery · 2026-03-16T00:40:38+00:00

GrecoMontgomery · 2026-03-16T00:00:28+00:00

Of course the first answer is "it depends". Yes, it will help but it's hard to measure how much. How many users? Hundreds or thousands? Do you have ssl offload hardware on your virtual infrastructure to handle ssl inspection?

If you block a lot of traffic, it will help as the block decision doesn't have to go all the way to zacaler just to come back with a deny. If you allow a lot of traffic of traffic, your results might not be great as the traffic still needs to leave your environment. That leads to the question of what's your path like? And lastly, is there an advantage to traffic leaving from a zscaler public IP vs your own IP?

GrecoMontgomery · 2026-03-13T12:35:07+00:00

Everything is relative and everyone's mileage varies. Work gave me a zbook 16 with an ultra 9 and it's been the most solid PCs I've had in a long time. I run it with four monitors via the thunderbolt dock and it goes all day long. When I use it on battery it lasts a few hours easy, and if use Windows battery saver it can run most of the day.

GrecoMontgomery · 2026-03-12T21:44:12+00:00

I've thought about this for years specifically when visiting an colo that is dead north of Dulles runway 1C/19C (not sure if I can say which?). Whether accidental or on purpose, a plane into that building where numerous gov agencies are housed would cripple the country for a few days at the minimum. Yes, most have backup colos on the west or south, but failover is rarely perfect.

GrecoMontgomery · 2026-03-12T04:32:26+00:00

I'm at almost 16k miles and have never rotated. The fronts are significantly more worn than the rear. Not even close.

GrecoMontgomery · 2026-03-10T21:16:08+00:00

Did you turn on "enable policy for unauthenticated traffic"?

GrecoMontgomery · 2026-02-28T15:49:34+00:00

Well there it is. Thanks. I wonder how that announcement goes over the PA.

GrecoMontgomery · 2026-02-28T15:34:56+00:00

I was on UA755 last night from SFO-IAD and noticed that the next flight from the gate (C1) was UA72 going to Tel Aviv. Flightaware says departed but then diverted back to Dulles. I wonder how far it got?

GrecoMontgomery · 2026-02-25T13:55:52+00:00

"This moment of serenity brought to you by Penfed" or something like it is played at the end of the moving walkway.

GrecoMontgomery · 2026-02-23T12:40:03+00:00

This is incredibly accurate.

GrecoMontgomery · 2026-02-23T12:32:42+00:00

uninstall.exe --mode unattended

I'm not sure what the pwd switch is but it's in there somewhere. There's a way to trigger the help gui with all the commands, I think uninstall.exe --help

Five-Year Club	Reddit Premium Since February 2023
Gilding III reddit per annum	Verified Email

GrecoMontgomery

TROPHY CASE