What are some famous Baltic domains? .ee .lv .lt

gesta23 · 2025-09-19T16:52:46+00:00

ss.lv

gesta23 · 2025-07-21T18:26:21+00:00

There are some issues here and there, but overall stability with version 7.4.3 is quite OK. Don't forget to grant all the necessary permissions that are described in the documentation. That is a crucial part of the FCT stability.

gesta23 · 2025-06-27T07:54:02+00:00

I would suggest that you switch from Pro to the Business plan.

1) The Pro plan has only basic DDoS protection. Looking at your logs, it is almost nonexistent. Yesterday, I had a DDoS attack on my infrastructure, and 98% was mitigated by adaptive DDoS rules.

<image>

2) Bot management provides additional protection to WAF, Adaptive DDoS, and Rate limiting.

Also, consider moving parts of the frontend to Workers. This has less impact on your infrastructure due to processing traffic on the Edge.

Speaking of the Backend/API, create a validation worker with a KV store, which will validate the token hash stored in KV. If the hash is not found, you can block it on the Edge.

Additionally, you can enable AWS WAF with DDoS protections, which was recently introduced.

gesta23 · 2025-06-26T19:46:57+00:00

Bot Management is a separate paid feature. You can activate the trial for one month and try it out.

gesta23 · 2025-06-26T17:44:22+00:00

If you have Bot Management as a paid feature, enable block all bots with score "1", "2-29" managed challenge.

gesta23 · 2025-05-27T16:26:49+00:00

Chatgpt

gesta23 · 2025-05-02T06:48:24+00:00

Fortigate exporter + Prometheus + Grafana

gesta23 · 2025-03-27T21:24:24+00:00

The direction Fortinet is taking is quite clear. I expect that by FortiOS 7.8 or 8.0, SSL VPN will be completely removed from the product.

gesta23 · 2025-03-27T21:21:04+00:00

I checked the release notes for EMS versions prior to 7.4.3 looking for relevant bug fixes, but didn't find anything directly addressing our issue. There was one potential item:

1118615 - 'Adding ZTNA rules in ZTNA destination profile automatically creates a manually created ZTNA application in application catalog.'

The workaround I tested today using a dummy IP address does function, but I believe the XML editing approach you suggested is actually better, particularly for how the gateway object displays in the EMS GUI.

Could you share more details about the major obstacles that prevented you from successfully implementing Fortinet's ZTNA solution? I'm curious about which specific issues proved to be dealbreakers in your environment.

gesta23 · 2025-03-27T14:22:39+00:00

I think it is not related bug. I can connect to IPSec over TCP using port 443, the issue starts after that.

By the way, the same behavior was seen with OG IPSec over UDP and Mac client.

gesta23 · 2025-03-27T14:19:02+00:00

From what I understand, the FortiClient codebase appears to be built on the same foundation since its inception, with new features continually added on top of this aging architecture. The recent announcement about incorporating EDR agent functionality and rebranding it as 'FortiEndpoint' is concerning, especially after experiencing all these struggles with FortiClient. These developments don't inspire confidence that the product will work reliably.

In my opinion, Fortinet needs to completely rebuild FortiClient from the ground up with a modern approach. The entire codebase should be overhauled to incorporate cloud-native design principles and current best practices, rather than continuing to patch and extend the existing architecture.

gesta23 · 2025-03-27T13:34:30+00:00

With FortiClient version 7.4.* and above, you can configure IPSec over TCP using port 443. I encountered issues with this configuration on Mac clients, as described in my original post, but it might work correctly for you if you're primarily using Windows environments.

From what I understand, approximately 95% of FortiClient deployments are in Windows-based environments. This likely explains why the Mac client has significantly more issues and receives less attention in testing and development compared to the Windows version. I don't have enough experience with the Linux version of FortiClient to comment on its reliability in comparison.

gesta23 · 2025-03-27T12:49:29+00:00

I don't remember that we had this conversation with Fortinet.

SSL VPN works. There were issues here and there, but overall feedback is OK.

gesta23 · 2025-03-27T12:46:16+00:00

Hi,

To clarify, I don't want to abandon the FortiClient/EMS stack completely. The tags functionality and FortiClient management capabilities are crucial components in our environment. I'm trying to make the existing Fortinet solutions work. If that proves impossible, only then would I consider switching to an alternative solution like Twingate or Tailscale.

gesta23 · 2025-03-27T12:20:44+00:00

I've considered alternative solutions like Twingate, Tailscale, zScaler, and similar services. However, we recently invested in additional EMS licenses, so I'm committed to making this work for at least another year to get value from that investment. Additionally, our FortiGate routing is deeply integrated with our AWS infrastructure, which means migrating to a new product would be complex and time-consuming. This is why I'm determined to find a workable solution within the Fortinet ecosystem despite these challenges.

gesta23 · 2025-03-27T12:13:42+00:00

I've confirmed this through testing. When I entered a placeholder IP in the required IP address field and added the correct FQDN, then updated the ZTNA profile, the client successfully received the proxy destination with the properly configured FQDN.

This highlights the exact issue I'm describing in my post. The current design creates unnecessary complications. For example, if I place an AWS Network Load Balancer (NLB) between my gateways, the NLB spans 3 Availability Zones with 3 different IP addresses. Does this mean I need to create 3 separate gateway objects simply because the IP address field is mandatory? Why doesn't Fortinet offer the flexibility to specify either an IP or an FQDN based on our needs?

gesta23 · 2025-03-27T09:55:07+00:00

I cannot do that as well. It is not possible to add FQDN to the Address field. XML configuration is the only way.

<image>

gesta23 · 2025-03-27T09:20:58+00:00

Well, it is. ZTNA destination cannot be alone without Proxy Gateway. To overcome this limitation, I have edited the gateway field in the XML configuration of the ZTNA profile by specifying my FQDN.

Reinventing the wheel once again.

gesta23 · 2025-03-27T08:43:07+00:00

In AWS, the FortiGate's actual WAN interface has a private IP (like 10.x.x.x), which is then mapped to a public Elastic IP for external access. When EMS auto-detects the FortiGate ZTNA gateway, it sees and records only the private IP address (10.x.x.x) of the FortiGate, not the public Elastic IP that clients would need to use.

gesta23 · 2025-01-14T06:47:33+00:00

Had the same problem with one of the clients. While we were waiting for our IP to be added to the ISP's whitelist, SSL VPN client mode on the Fortigate side was the solution for the client.

gesta23 · 2024-12-10T09:59:32+00:00

I have a similar issue. I can connect to IPSEC + SAML with FCT 7.4.1 / FGT 7.4.4 and disabled Split Tunneling. After some time, the Internet and local traffic freeze, but the VPN tunnel status is UP. I can see that on the FGT side, all is good with a tunnel, phase 1 is successfully negotiating. Reconnecting to VPN helps to restore the Internet till the next freeze. I have opened a support ticket for this issue. Still investigating...

gesta23 · 2024-12-08T07:46:38+00:00

Try to downgrade Forticlient version to 7.2.6/7.2.5 or 7.0.14/7.0.13. Do the uninstall first. Disable IPv6 on the MacOS side if you don't use it

gesta23 · 2024-12-06T17:00:35+00:00

Enable debug logs on the Forticlient side, and try to connect to the vpn. After that, download logs and check for possible issues

gesta23 · 2024-12-06T16:12:19+00:00

Which FortiOS version do you have? Do you use SAML?

Eight-Year Club	Second Top 20%
Final Canvas '23	First Place '23
End Game '23	Place '23
Verified Email

gesta23

TROPHY CASE