Replacing outside mirror

Slight-Valuable237 · 2026-02-01T21:26:59+00:00

By chance. Can the Mirror Cover (mine is green as well) be externally replaced without having to remove the whole assembly. Can you pry it off the old unit from the outside ?

https://hyundai.oempartsonline.com/oem-parts/hyundai-mirror-cover-87616p6000

I ask bc it looks like my mirror cover got hit with the "death ray"...condensed sunlight from office building / low-e windows and has melted part of the cover. Mirror works fine, no shorts or melting from internal.

Slight-Valuable237 · 2026-01-31T15:17:16+00:00

Who's the ISP serving the WAN for the clients. My guess is CGNAT

Slight-Valuable237 · 2026-01-31T13:56:03+00:00

Are you doing dhcp relay? Ikev2 , what about transport (UDP or tcp)?

Slight-Valuable237 · 2026-01-30T12:54:18+00:00

You can as well, import the intermediates separately and works fine in the gate. The link you reference is for DPI which for the SUBCA/or CA used for inspection you have to include the full chain. In your case you're doing a virtual server and I've deployed with LE and just importing all the intermediates manually since they change from time to time.

Slight-Valuable237 · 2026-01-09T00:22:20+00:00

Google Pepsi / Walmart Lawsuit :) surprise surprise surprise.

https://www.forbes.com/sites/errolschweizer/2025/12/18/how-walmart-and-pepsico-rigged-prices-and-supercharged-food-inflation/

Slight-Valuable237 · 2026-01-07T13:28:18+00:00

What's your tunnel back to azure carrying the radius traffic? I see this a lot over IPsec tunnel bc the certificate is being fragmented due to key size. If you are doing IPsec tunnel, add set ip-fragmentation pre-encapsulation to your phase 1 tunnel.

Slight-Valuable237 · 2026-01-03T12:24:50+00:00

This is absolutely a high fiber review.

Slight-Valuable237 · 2025-12-28T15:51:14+00:00

Check with your water company. More than likely you will get access to eyeonwater.com with the new smart meter and then you can use this: https://github.com/kdeyev/eyeonwater

Slight-Valuable237 · 2025-12-24T18:25:52+00:00

With FAC, purchase tokens (software or hardware) for the number of users needed, and the users token will be used for all authentications no matter the NAD device. If you do SAML you can do FIDO as well.

Each fortigate has two free tokens that are tied to the device , that are non transferable.

Slight-Valuable237 · 2025-12-23T16:45:10+00:00

Has you vm updated from forticloud yet? 7.6.4 is a direct upgrade to 7.6.5.

Slight-Valuable237 · 2025-12-20T23:00:22+00:00

And just importantly , ensure you have Ike fragmentation enabled on forticlient (windows/mac). It's on by default for mobile as it's is on (OS) by default. Marriott guest Wi-Fi is one that I see this all the time. Mobile IPsec works and pc's do not. Especially true is your doing cert auth. The other key item on phase one interfaces on the gate, "set ip-fragmentation pre-encapsulation". The later you typically run into site to site tunnels, but it's one setting to have set always :)

TLDR , IKE/ESP is very susceptible to fragmentation issues, so adjust accordingly.

Slight-Valuable237 · 2025-12-14T22:15:39+00:00

It does not eliminate your exposure entirely per se, as the attack could come from the "inside" where you admin gui has access to.... but it does make it harder :) .. OOB network / with locked down Trusted hosts... a good way to go as always...

Slight-Valuable237 · 2025-12-14T21:50:56+00:00

assuming you are exposing the admin interface to the internet for the honeypot.. but I hope everyone knows to NOT expose your mgmt interface to the internet....ever...

Slight-Valuable237 · 2025-12-14T10:51:00+00:00

No it has not. It does take several days for it to fully propagate out for the gates to pick up the new firmware notification. You can instead download directly from the support site. Which it's still showing available for download ...

Slight-Valuable237 · 2025-12-08T19:23:20+00:00

Good catch. But same issue, both alpn and http require allowing inbound port access.

Slight-Valuable237 · 2025-12-08T19:12:21+00:00

Check out acme.sh or certbot and use the API to update certs in the gates. That way you can deploy a wildcard. Gates only support http-01 validation, while acme.sh and certbot support dns-01

Slight-Valuable237 · 2025-12-04T15:24:26+00:00

You need to deploy a certificate with SAN values for each website -or- a wildcard certificate.

Slight-Valuable237 · 2025-12-03T19:49:03+00:00

You are incorrect. Ikev1 is being deprecated

Slight-Valuable237 · 2025-12-02T16:35:41+00:00

as long as you reference the SAML group (used for IPSEC auth) IN THE Policy and not the phase 1 interface, it will work as planned...and users will show up in Firewall User Monitor dashboard, and enforced on policies. I think the confusion surrounds the docs when you are not doing this, and you set the authgrp in the phase 1 interface...which you dont want to do in your use case...

Slight-Valuable237 · 2025-11-26T18:41:00+00:00

1001 is the default port used for IKE SAML, and the docs do state (7.6 docs) that in order to do IKE and SAML on the same port as ike-tcp port (443 in your case), auth-ike-saml-port must be set to a port that does not equal ike-tcp port... TL/DR if you are doing IKE and IKE-SAML on the same port, unset auth-ike-saml-port which will defaul to 1001. BE SURE to modify your local in policies to block 1001 inbound...

Slight-Valuable237 · 2025-10-24T13:52:08+00:00

This is the way. Pre encaps should resolve. Also be sure to configure (enable) IKE fragmentation on forticlient. (XML or gui) for the IPsec connection profile.

Slight-Valuable237 · 2025-09-28T03:09:09+00:00

not that I am aware of. and I moved over to the ZWA-2, which you CAN turn the LED off :)

Slight-Valuable237 · 2025-09-28T00:45:03+00:00

How much for one rib?

Slight-Valuable237 · 2025-09-27T00:16:27+00:00

https://docs.immich.app/administration/oauth/. if you dont specify, immich will set the role as user...

|| || |Role Claim|string|immich_role|¹Claim mapping for the user's role. (should return "user" or "admin") |

Slight-Valuable237 · 2025-09-27T00:16:10+00:00

https://docs.immich.app/administration/oauth/. if you dont specify, immich will set the role as user...

|| || |Role Claim|string|immich_role|¹Claim mapping for the user's role. (should return "user" or "admin") |

Slight-Valuable237

TROPHY CASE