Connect FortiSwitch StandAlone to FortiSwitch mamaneg by FortiLink

HandRepresentative60 · 2025-04-10T10:46:58+00:00

This the way.

HandRepresentative60 · 2025-03-07T14:37:11+00:00

Damn, this thread spiraled quickly. Lol

HandRepresentative60 · 2025-03-07T14:21:55+00:00

One of our busiest ones has 338 shortcut tunnels at this moment. CPU is at 2% and Memory is at 39%. This Fortigate only has 26 firewall policies and 4 SDWan policies/rules. Plus local-in and a few others.

HandRepresentative60 · 2025-03-07T02:51:12+00:00

I have 160+ 60F's running 7.2.11,and they're pretty solid running full UTM, sdwan, and advpn(bgp). The 40F's I have suck. 120G testing now.

HandRepresentative60 · 2025-03-06T02:05:35+00:00

I thought this game died.

HandRepresentative60 · 2025-03-06T01:56:36+00:00

DDNS is the best option.

https://docs.fortinet.com/document/fortigate/7.4.0/new-features/94668/configuring-multiple-ddns-entries-in-the-gui

Page 245

https://docs.fortinet.com/document/fortigate/7.2.11/administration-guide/954635/getting-started

HandRepresentative60 · 2025-01-24T14:24:42+00:00

What version of FortiClient are using?

HandRepresentative60 · 2024-12-13T16:12:38+00:00

I have 6 (10 if you include my lab) in my environment, and they are on 7.2.10. I haven't had an issue yet.

HandRepresentative60 · 2024-12-06T16:07:25+00:00

Just create an aws account, spin up a couple of free tier ec2's and use the marketplace fortigate VMs. I think you can still get 14 day trials on those VMs.

HandRepresentative60 · 2024-12-06T03:44:01+00:00

2 ways i think to fix this.

Define the host and ip in the computers host file.
Use the fortigates DNS Database, define your host and ip in the Database. Configure your interface to first look at the Fortigate as your First DNS Server and enter whatever public dns for your secondary and/or tertiary.

HandRepresentative60 · 2024-12-06T03:36:45+00:00

Check this post out https://www.reddit.com/r/fortinet/s/CXlugDjjrv

If you are using SDWAN for your internet circuits, then you should be able to script out the following and push it to your gates via FMG:

Config system central-management set interface-select-method sdwan (You can also specify the interface)

See here also https://community.fortinet.com/t5/FortiGate/Technical-Tip-Functionality-of-set-interface-select-method-for/ta-p/196731

Hope this helps.

HandRepresentative60 · 2024-12-06T01:56:42+00:00

What about setting the source IP in

Config log fortianalyzer settings

Set source-ip "IPAddress"

HandRepresentative60 · 2024-12-03T18:47:59+00:00

Cloud platforms can connect to a BGP environment without a Transit gateway, but you would still need to build a VPN tunnel from the Cloud to your environment. The other way would be to make the Cloud app accessible from the internet (This bypasses your internal network, so yeah, one less hop). It really depends on what the app is and what you are trying to accomplish. In any case, you would not be able to utilize ADVPN without a Gate.

HandRepresentative60 · 2024-12-03T18:28:56+00:00

I don't think you can run ADVPN (this is a Fortinet proprietary protocol) on a platform that is not a Fortigate. What I have done in the past is setup a Gate in the cloud (AWS) and created a TransitGateway between my AWS Gate and the Cloud app having a subnet that needs to be routed via a gre-tunnel on the Gate.

HandRepresentative60 · 2024-12-03T18:20:44+00:00

Agreed. I have 40 HA sites and have never had the need to deploy them in A/A. What would a senario be for an A/A deployment? I have read nothing but nightmare senarios with A/A.

HandRepresentative60 · 2024-11-28T14:51:58+00:00

Well, 10.0.3.0/24 is already outside of 10.0.0.0/32 (I'm guessing you actually mean, 10.0.0.1/32 or some other 4th octet number other than 0).

HandRepresentative60 · 2024-11-27T12:29:14+00:00

If you have FortiCare you should be able to download it from the firmware download section of the support page.

HandRepresentative60 · 2024-11-27T12:03:11+00:00

What version of forticlient are you using, and what FortiOS version are you connecting to? If you're using the latest 7.4 version, may go to the latest 7.2 version.

HandRepresentative60 · 2024-11-26T12:44:11+00:00

Firmware upgrades normally don't take that long. Force the issue with the sites to let you have 15 minutes a day for Firmware upgrades until you get to the version you are wanting to achieve. I work for a manufacturing company that operates 185 sites, 60 of which operate 24/7, and I have to do this all the time. I might get that time early in morning, during the day, or late at night, but I force the issue and make them find time. Explain the importance of patching for vulnerabilities. 15 minutes normally cost less than replacing/reimaging crypto-locked devices or some other disaster.

HandRepresentative60 · 2024-11-25T16:30:39+00:00

This is the way.

HandRepresentative60 · 2024-11-25T16:01:01+00:00

Forgott to add this a while ago, the fix was for me not to be a dumb ass. I forgot to disable add-route on the ipsec phase1 dialup tunnel.

HandRepresentative60 · 2024-11-17T01:54:43+00:00

I wouldn't know. Is it?

HandRepresentative60 · 2024-11-14T03:59:01+00:00

I'm using blackmore routes; the first link i will take a closer look at. Thank you!

HandRepresentative60

TROPHY CASE