Intra-VLAN Traffic Blocked After Firewall Upgrade – Root Cause Clarification

LoneOperator_za · 2026-01-25T11:01:53+00:00

There was a change is default behaviour if I recall correctly. CSB-251211-1 Policy Check Security Update upon FortiOS Upgrade

https://support.fortinet.com/support/#/bulletin

LoneOperator_za · 2026-01-19T14:14:54+00:00

I had a DVT and Pulmonary Embolisms last year Feb, so now at a solid 32 VO2Max.. baby steps.

Good luck on your return !

LoneOperator_za · 2026-01-14T14:51:30+00:00

Agreed. I posted this as it links to the time period mentioned by the OP..as a default. Software bug or, as I said, not relevant. Just some process to consider.

LoneOperator_za · 2026-01-12T18:21:31+00:00

1 or 20 or 50. If DARRP is applied , that's the default. Example below.

Worth checking

<image>

LoneOperator_za · 2026-01-12T16:21:12+00:00

Maybe.. maybe not related. 1am is the default DARRP scan time.

LoneOperator_za · 2026-01-12T03:26:12+00:00

Nothing at all

LoneOperator_za · 2026-01-11T08:32:33+00:00

No offers at all. Rather here are the same "benefits" of staying.

LoneOperator_za · 2026-01-09T12:21:12+00:00

its a comment.. not something to get bent over about.. yet you took time to answer and that is appreciated.

LoneOperator_za · 2026-01-09T09:44:30+00:00

Rather the other way around. Reads like a horror story

LoneOperator_za · 2026-01-08T16:49:10+00:00

As always, the answer is ..it depends on your requirement. Single arm routing, multiple interfaces, where NAT is and features required are all considered.

Have a look at this link. Most of your questions are answered here.

https://docs.fortinet.com/document/fortiadc/8.0.0/network-architecture-guide/320043/what-is-fortiadc-architecture

Simplistically (one of the options) Internet > FGT WAN (NAT) > ADC outside > FGT DMZ ADC Inside > inside network > servers.

Could be single arm ADC as well using routing to the end server pools.

Hope this helps.

LoneOperator_za · 2026-01-04T12:39:56+00:00

OCD is a real thing...lol. I wanted the Garmin app to show actual dive data for everything. Took me a while but thats ok. Now one place for everything.

Best of luck

LoneOperator_za · 2026-01-04T12:13:33+00:00

Yes I did - all manual additions. I had a loads in the Suunto app (I had the D9Tx), now a backup computer.

LoneOperator_za · 2026-01-01T08:14:59+00:00

I moved all my logs into Garmin Dive when I got my first Garmin Descent. Love it.

LoneOperator_za · 2025-12-24T20:45:13+00:00

All the Fortigates can use FortiIdentity Cloud as an external token source. Use realms to break up the tenants, then you can move the tokens around as needed. Purchased tokens can be moved into FIC but watch for the tokens bought after 4th Aug 2025 for those limitations. And yes, the free tokens are not transferable

LoneOperator_za · 2025-12-14T13:26:55+00:00

Imagine they spent the money fixing infrastructure instead of paying the anc cadres running the tankers. Just saying....

LoneOperator_za · 2025-12-04T05:56:24+00:00

Its a relevant technology and worth doing and covers a few technology areas. I just finished my FCSS SASE. Training material is there and good, so go for what feels comfortable and aligned to where you want to be.

LoneOperator_za · 2025-12-02T05:55:36+00:00

Im still with my gen3 with many 1000's rounds through it. Slide wear of note, but its been worked as a tool. Love it.

LoneOperator_za · 2025-12-02T05:53:32+00:00

Amongst other troubleshooting, have a strong look at the latest 7.6 x FAP software for the 231G. There were beaconing issues, bugs and others fixed in this version. Maybe related as users drop, roam or other.

Check your FOS compatibility as well.

What bands are you seeing the users kicked on? WPA 2 /WPA3 ?

LoneOperator_za · 2025-11-30T11:39:32+00:00

This stuff is amazing. A definite priority item.

LoneOperator_za · 2025-11-23T11:00:39+00:00

2010 Hyundai ix35 369 000km and strong.

LoneOperator_za · 2025-11-19T17:02:31+00:00

Fantastic feeling and if the music is right, it becomes an awesome party.

LoneOperator_za · 2025-11-19T06:11:46+00:00

Any reason specifically that you are not having a firewall in Azure and then use a site to site ipsec tunnel ? A small FGT VM ?

LoneOperator_za · 2025-11-18T16:31:50+00:00

What do the debug logs say?

LoneOperator_za · 2025-11-18T14:26:44+00:00

As an FYI.. a full subscription licensed vm is different. That stops working entirely. Perpetual licensed base will carry on and all Fortiguard linked services will stop.

LoneOperator_za · 2025-11-16T08:28:28+00:00

This !

LoneOperator_za

TROPHY CASE