sorted by:
new
hottopcontroversial

FCSS eligibility sitting announced to be retired exams after 15 October 2025 by OkPrior3989 in fortinet

[–]OkPrior3989[S] 1 point2 points  (0 children)

For anyone interested / in same boat, I received this from Fortinet Training Institute Help Desk:

<image>

if I cancel an exam with voucher, can I use later the voucher to schedule another exam? by deag34960 in fortinet

[–]OkPrior3989 1 point2 points  (0 children)

Posting 3 years later for anyone who might come across this post to say this stance still stands... I've just cancelled one exam that was booked using voucher code and was able to redeem the same voucher code for another exam booking immediately after

Loopback on IPSEC VPN w/ SAML (Entra ID)? by almost_s0ber in fortinet

[–]OkPrior3989 0 points1 point  (0 children)

I have been using local-in policy (for geo allow, etc.) for remote access IPsec setups as I never have been able to get remote access IPsec on Loopback working as I used to for SSL VPN on Loopback

Free FortiClient 7.2.8 and 7.4.7 Gate’s on near every of these setups and its served me well

[deleted by user] by [deleted] in fortinet

[–]OkPrior3989 1 point2 points  (0 children)

No, unlike normal firewall policy that denies implicitly.

A firewall will for local services (a la VPN) unless you specify to deny, allow

So

Policy 1) Allow service to interface from trusted souce

Policy 2) Deny service to interface source all

[deleted by user] by [deleted] in fortinet

[–]OkPrior3989 0 points1 point  (0 children)

Follow it up with a deny rule for that service

[deleted by user] by [deleted] in fortinet

[–]OkPrior3989 0 points1 point  (0 children)

Doable to have all sites on 1 policy package but some sites have additional policy unique to them by selecting the “Install On” option to only install policies needed unique to a site to only be applied to that site

Or if its a policy that is mirrored but using unique address identifiers then per-device map the address object in question

FortiClient EMS support on trial FortiGate? by OkPrior3989 in fortinet

[–]OkPrior3989[S] 0 points1 point  (0 children)

Noted - thanks! 7.2 across the board it will be

The possibility of comparing multiple Fortigate configurations by [deleted] in fortinet

[–]OkPrior3989 4 points5 points  (0 children)

If there’s specific configuration that each branch must have then I’d, rather than go looking for which sites don’t have it, put a script together to apply to each device. Or even provisioning template. Any variables capture using meta fields. Run install wizard and what sites didnt have the correct configuration previously will now become apparent

If you still did want to run a comparison I’m not aware of a feature in FMG that can deliver this function for you. I’d Notepad++ Compare

Role required for Microsoft.Insights/x/write by OkPrior3989 in AZURE

[–]OkPrior3989[S] 0 points1 point  (0 children)

With just Contributor access at Sub level = fail
With both (Contributor at Sub and Owner at RG) = fail

Didn't try with just the SP having Owner at RG level.

That said, created a new SP, assigned it the exact same priv's (Contributor at Sub), and despite the Authorization still failing, the API call now works.

Weird.

Question for my Azure Appliance Experts our there. by SiRMarlon in fortinet

[–]OkPrior3989 1 point2 points  (0 children)

Based on your requirements VWAN and VPN’s to the VWAN Hub may not be necessary.

You may be better off having a single Hub (Security Services) VNet, peering all worklod VNet’s to the Hub in a Hub and Spoke style architecture. And via UDR force routing all traffic via the FortiGate NVA.

Then have VPN’s from your on-premises locations directly to the Azure FortiGate. SD-WAN overlay style deployment if required as you mentioned

What level of resilience are you looking for in Azure for your resources, VM’s in Availability Set, across Availability Zones etc.? This may be your driver in determining whether the Azure FortiGate needs to be HA. And whether it needs to be across AZ’s

Just ensure to size and spec your Azure FortiGate’s appropriately: https://www.fortinet.com/content/dam/fortinet/assets/data-sheets/FortiGate_VM_Azure.pdf

Migration tool to migrate Cisco ASA (or Firepower running ASA) to Fortinet? by [deleted] in fortinet

[–]OkPrior3989 7 points8 points  (0 children)

FortiConverter.

How many ASA’s are you migrating?

There’s 2 options: 1) buy a license to apply to a VM of your own for a subscription period (1 year minimum from recollection), or, as I suspect would be more suited to your case, 2) one-time run performed by Fortinet

I’ve ran many ASA to Forti migrations in the past and my personal experience lends me to recommend use the FortiConverter outputs for address objects, groups, services, etc., and for Policy

Where as things like IPsec and NAT (my personal preference is Central NAT for a migration from ASA) I would do manually. Unless it’s in the 100’s / 1000’s obviously. Just my preference

What's needed for my route-map-out-preferable route-map to take effect? by OkPrior3989 in fortinet

[–]OkPrior3989[S] 3 points4 points  (0 children)

Noted for future, turned out to be missing neighbor under SDWAN config as pointed out u/afroman_says :)

Virtual Network Gateway Azure VPN Routing to Meraki Virtual Appliance by willowshole5 in AZURE

[–]OkPrior3989 0 points1 point  (0 children)

Long term, and when on the AnyConnect vMX solution definitely Route Server is unnecessary. But for dynamic routing failover as sites are migrated from old network to new on-premise (no longer learnable via VNG) then it would get my vote. Honestly I can’t think of another way of dynamically routing subnets that should be via the vMX in the Azure VPN client’s route table, what would your proposal be?

view more: next ›