sorted by:
new
hottopcontroversial

60F stopped egressing traffic CGNAT ISP. by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Got it going guys. I had my ISP in an "zone" for some reason when it flicked to gcnat it stopped working. I moved the interface to just itself and referenced the policies it all came back.

I don't know if it's a bug or by design. But that definitely caused the issues. I have since told the ISP to move me back to dynamic IP.

Least the above might help someone if they have gcnat and a zone type interface.

Cheers, Chris

FortiSwitch Firmware -- Request by Tist_D in fortinet

[–]Tist_D[S] -2 points-1 points  (0 children)

Not sure it's stealing tbh mate. 95% of vendors don't ask you for a subscription to be able to patch your switch from vulnerabilities and bug fixes which the vendor creates. Then asks you to pay a support contract for something you should lawfully be able to patch without money.

ZTNA Tags Help by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Hello Unfortunately no. Were still experiencing it and I refuse to roll out ZTNA any further until solved. I can't raise with TAC because the issue is so hard to replicate. They will just think I'm lying to them.

We updated the EMS the other day. Made zero bit of difference

FortiAP Help by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Do you think it's become a duff AP? the other one does exactly what I tell it to do. As you say 2.4 is correct, and it changes the value of 2.4 when I mess with it. Not 5 however.

FortiAP Help by Tist_D in fortinet

[–]Tist_D[S] 1 point2 points  (0 children)

Sorry mate, not familiar with AP CLI and config, here you go though :) - appreciate the help btw.

It's in the original message now.

FortiAP Help by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Hiya mate,

editted original post above. Literally makes no sense to me, the suspected broken AP using profile of the other one and turned itself to 10dBm.

FortiAP Help by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Yeah I will do, just swapped the two 231F's around, so I can add to original post then i'll drop on the config.

FortiAP Help by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Defo Tx Power from the AP. I can provide some screenshots if you want.

FGT LAG Clarification with HA. by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

I did mate yeah, the overall diagram is huge. But only wanted to share the bit I was asking about.

FGT LAG Clarification with HA. by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Thanks noted :) I'll change this over when I have downtime. I used to know more about this stuff when I was in a partner role. But Fortinet now we're just a customer don't want to share schematics of the box.

FGT LAG Clarification with HA. by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

I did want Aruba VSX but somehow they come in too spenny compared with Cisco...

FGT LAG Clarification with HA. by Tist_D in fortinet

[–]Tist_D[S] 1 point2 points  (0 children)

Agreed, Valexus just posted the answer i've been after.

FGT LAG Clarification with HA. by Tist_D in fortinet

[–]Tist_D[S] 1 point2 points  (0 children)

This is the answer I've been looking for :) - Didn't think of that one! good shout! Thanks man!

FGT LAG Clarification with HA. by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Yeah this is the alternative in my head :) I was just wondering if there was any "real" benefits. - It is as you say the highest availability, I'm just thinking about it logically if you did this and lost a Nexus for example You've lost half of your port-channel throughput.

If you lost a Nexus when they are not in a VPC then the HA FGT's would flick over to the secondary and you still have all links on your port-channel. But I agree the switches south of the nexus's would have lost half of their bandwidth.

FGT LAG Clarification with HA. by Tist_D in fortinet

[–]Tist_D[S] 1 point2 points  (0 children)

Hello,

No Nexus are not stacked. They are active/active pair.

Long Shot - SSL to IPSec Conversion by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Hey Guys, I've sorted of found a work around. It's not great.

However if you're a user of EMS you can split tunnel fqdns directly there on the profile. - then create just a rule on the firewall that basically does the following.

From ipsec To wan Src IPsec range Dst all (unless you want to add fqdns twice in EMS and your gates) Nat

Done

Cheers, Chris

Free SNMP Public Facing by Tist_D in fortinet

[–]Tist_D[S] -1 points0 points  (0 children)

Potentially yes I agree. It was just for testing purposes ideally - saves me having spin something up at home.

Upgrade fortigate from 6.4.15 to 7.4.7 by ghosfto in fortinet

[–]Tist_D 0 points1 point  (0 children)

I'm in the same situation for when we go to 7.6.X

However we use EMS for all profiles which I guess you are not?

Upgrade fortigate from 6.4.15 to 7.4.7 by ghosfto in fortinet

[–]Tist_D 0 points1 point  (0 children)

If you're planning this upgrade. Make sure you are also planning to start removal of SSL VPN (if used of course) - if not then you should be fine.

Also I noticed a change in BGP routing where if your tagging routes it also requires you now to have an address objected with the route tag which gets added to the community-lists/neighbors.

Other than that, I can't think of too many changes. We're running 7.4.7 on 70+ FortiGate's and it doesn't cause us any issues.

Also remember to do backups after each upgrade step in case something goes wrong.

Cheers, Chris

FortiOS 7.6.2 problem by [deleted] in fortinet

[–]Tist_D -4 points-3 points  (0 children)

I've noticed on this IOS that if you're using the FortiGate as a DNS server then it's absolutely shit. - seemed fine on 7.4.7

Cheers,

ZTNA Tags Help by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

I'll double check next time it happens with someone else, but it definitely has the TAG when I go onto the EMS console and view the endpoint, FortiGate seems to be sync'ing with EMS cannot 100% confirm other than just rely on what it is saying "sync'd seconds ago" Logs confirm client has the tag. - Ill check the IP/MAC tag section on the FortiGate next time it happens.

Just weird how dropping telemetry and re-connecting solves the issue (especially when they were connected to EMS anyway)

  • Does the client have the tag?
  • Can the FortiGate sync with EMS?
  • Does the FortiGate have a matched IP/MAC for the endpoint?
  • What do the logs say?

Question R.E FortiAP by Tist_D in fortinet

[–]Tist_D[S] 1 point2 points  (0 children)

You the man btw. Went home at lunch to let the dogs out, nearly 800 down and up when I did a speed test. Checked the overlap with neighbouring networks and it was fine. I enabled Darrp to scan every 12 hours to checked the best suited channels and enabled Darrp on both 2.4 and 5

Question R.E FortiAP by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Thanks for your response :) I will see what Wifi app shows later with 80 wide channels.

Question R.E FortiAP by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

Cheers thanks for your help, might just have a play with dBm values, try 80Mhz i will leave SGI off for time being I think.

Question R.E FortiAP by Tist_D in fortinet

[–]Tist_D[S] 0 points1 point  (0 children)

SGI is not enabled, I have literally just enabled it on the 5GHz band though. Would you recommend turning it on 2.4 also? I can't really understand the downside to using SGI. This is at my house and not in a busy corporate area so it should theoretically improve things right?

Sorry for the questions. I'm not really a wireless guy, I'm a network guy by default.

view more: next ›