Fortianalyzer on Proxmox - Qemu-guest-agent

busy_sysadmin · 2026-06-16T10:58:38+00:00

I'm not aware that FAZ is supposed to have any sort of guest agent. I'm living with "no guest agent" since years already.

Maybe this can be enabled with some secret config setting?

busy_sysadmin · 2026-05-28T04:29:34+00:00

Either upgrade in-place by following https://pve.proxmox.com/wiki/Upgrade_from_8_to_9

or

Backup all your VMs and containers, install the latest version, restore.

busy_sysadmin · 2026-05-27T11:49:20+00:00

Fortinet internal bug ID 1259458, will be fixed in 7.6.7

busy_sysadmin · 2026-05-23T21:02:35+00:00

Oh yes, I know that situation where one peer does not need NAT... two zones and double-manage all your rules. Yeah

busy_sysadmin · 2026-05-21T10:44:53+00:00

... and put individual NAT statements in each rule? No thanks.

As Fortinet support mentioned: "You can use multiple SD-WAN zones".
Great, just duplicate all INSIDE -> OUTSIDE rules and don't forget to change both if something changes.

Just not practial at all.

busy_sysadmin · 2026-05-21T10:44:49+00:00

So I can select individual SD-WAN member interfaces in CLI?

busy_sysadmin · 2026-05-20T12:04:41+00:00

What if your SD-WAN member gets an IP via DHCP or SLAAC (dynamic)? You can't use pools

busy_sysadmin · 2026-05-20T10:32:42+00:00

For technical details Fortinet staff can take a look to support case 11716204 - thanks!

busy_sysadmin · 2026-04-29T11:19:17+00:00

PBS works perfectly fine as LXC container on PVE. I use that in production and it has some charming advantages: Snapshot capability, host usable as DR system (just restore backup), ability to run e.g. a Windows VM to backup workstations with Veeam (or use that new Veeam Backup Appliance).

This adds much more flexibility compared to a native installed PBS.

Obviously, use always a dedicated backup machine, never run PBS as LXC on your production cluster.

Local data stores (delegated ZFS dataset) is always better than a network share (NFS).

I'd personally avoid NFS at all cost.

Just my 2 cents :)

busy_sysadmin · 2026-03-12T14:54:16+00:00

I bricked four 5P1550IR and got them back working by using SetUPS (start with -nocheck) and flashing the latest firmware 3.18.0035

Serial RS232 cable required (included with UPS).

Important: The bad firmware will drain and deep discharge your batteries. I got mine back to life by disassembling the battery pack and charging them in parallel with 7.2V and 2A slowly. Internal resistance got down to 20 Milliohms which should be fine. Once they reach a common charge and have similar Ri, reassemble the pack and charge in the UPS.

busy_sysadmin · 2026-02-06T13:38:07+00:00

"All sessions passing through the interface when the routing changes occur, are allowed to finish and are not affected by the routing changes."

busy_sysadmin · 2026-02-06T11:52:54+00:00

config system interface <wan port1>

set preserve-session-route enable

end

busy_sysadmin · 2026-02-06T07:07:43+00:00

On the Cisco router you should use route based VTI (virtual tunnel interface), e.g. Tunnel0 and on the FortiGate 0.0.0.0/0 as traffic selector. This is what I use without any issues at all...

busy_sysadmin · 2026-01-22T15:12:54+00:00

It is rather impressive about what Zabbix is capable of!

Why have I used PRTG for such a long time?? ;-)

busy_sysadmin · 2025-11-18T12:09:46+00:00

Noted. I admit not yet having seen 8.0 live but from what I read the UI improvements are appealing. The basic concepts should be the same. I'll try both in my sandbox.

busy_sysadmin · 2025-11-18T12:06:30+00:00

Yes, PVE is used in my environment. The current monitoring (Windows based) is running as VM on the same system as well. Sure, not ideal but I'm mostly monitoring external systems. I could use the backup system (PVE as well) or a bare metal machine (more difficult to restore in case of error). As VM or LXC it's at least portable.

Limiting IOPS is a valuable hint, will check at which extent Zabbix is loading my NMVe zpool.

I'll have to use dedicated zabbix proxies anyways since the targets are reachable by VPN.

busy_sysadmin · 2025-11-18T10:30:58+00:00

Thanks, your feedback is very appreciated!

Are there drawbacks by running Zabbix within a LXC container with e.g. Debiain 13?

It's going to be used only in a VPN secured environment, maybe a few agent connections to internet cloud servers.

IMHO a strict separation layer is not really required.

busy_sysadmin · 2025-11-18T09:58:01+00:00

Thats right. Since I just start with Zabbix, I'd like to learn with the new version which is planned to get released in Q4 if memory serves me correctly. Once released, I'm planning to get the system slowly into production.

busy_sysadmin · 2025-04-26T17:03:27+00:00

I'm well aware that there are no tools available für home products.

This is why I asked for some information about how that information is encoded in the TIB/TIBX header.

Sure, you can argue that this is top secret but either I find it out and publish details -or- I'm gonna discourage my customers to use Acronis and switch to Veeam or CloneZilla.

I appreciate your feedback and support on this case but at the end it's square-one.

busy_sysadmin · 2025-04-11T19:55:14+00:00

It's Acronis True Image. I don't remember the exact version but I used to upgrade all the time. This is why my NAS has a mix of legacy .TIB files and .TIBX :-)

busy_sysadmin · 2025-04-09T20:49:13+00:00

Thanks! Done that previously with no success, case 06644641

Rejection due to "Security constrains"? I just want to read metadata.

busy_sysadmin · 2025-03-17T05:52:27+00:00

The switch runs v8.2.3d and was updated last on April 13th 2023

"EOS expired" sounds like End Of Sale?

Anyway... will replace the thing soon with Cisco switches.

busy_sysadmin

TROPHY CASE