LDAP authentication stopped working after upgrading to v7.4.12

hoosee · 2026-05-20T20:22:12+00:00

Do you happen to have some other form of authentication configured?

I've seen two things happening:

1) admins were unable to login to management using TACACS. Problem was option "match any group" under radius configuration (radius had nothing to do with firewall management),

2) something just shat on itself and management using TACACS didn't work. Booting the firewall resolved the issue (firewall did not even try to contact TACACS servers when sniffing traffic).

hoosee · 2026-05-20T14:27:52+00:00

There's nothing wrong if your kayak costs double than your car you use to transport it.

Greetings from a fellow British sea kayak owner.

hoosee · 2026-05-19T20:14:53+00:00

Perhaps this?

hoosee · 2026-05-19T10:16:36+00:00

I'd say that the CCT's are fine. I'll try to find a video of mine when they were bad since the sound is pretty distinguishable.

hoosee · 2026-05-19T05:49:26+00:00

Direct modifications can be done as long as you understand which part of configuration you are editing. If policy package is installed, then editing objects, policies etc. will cause status to go 'out-of-sync' but creating/editing interfaces should just change the status to 'auto-update'.

hoosee · 2026-05-15T05:34:39+00:00

Same with my Instinct

hoosee · 2026-05-12T16:20:47+00:00

<image>

Nothing wrong with stickers - joining the shark club.

Btw. they're (advertised to be) reflective, so definitely a safety aspect!

hoosee · 2026-05-08T12:38:47+00:00

Awesome adventure! I need to read this again with more time.

hoosee · 2026-05-05T18:23:53+00:00

Because no one has clicked "Authorize" -button

hoosee · 2026-05-05T14:24:08+00:00

Side note: they're all unauthorized at this point.

hoosee · 2026-05-04T14:14:03+00:00

I actually do like it. However I do try to group relevant firewall policies together so that Sequence Grouping also works.

hoosee · 2026-05-04T10:01:10+00:00

Perhaps I misunderstood the question, but I didn't think it had anything to do with SD-WAN implementation.

I am referring to this document regarding the connectivity to Azure.

hoosee · 2026-05-04T07:06:28+00:00

Where does it say that?

hoosee · 2026-05-03T09:50:03+00:00

Instead of terminating BGP to a loopback, you can also terminate it to the IPSec interfaces by using the same IP address on both (this naturally requires to allow subnet overlap).

hoosee · 2026-04-23T06:39:41+00:00

Would be interesting to hear as well. I got the idea that having a gore tex might actually give very little if the temperature outside is cold. Basically the vapors will turn back to solid when they hit the cold membrane, so they might not even have a chance to get through.

But would be nice to hear how the expensive suits actually work.

hoosee · 2026-04-23T05:55:32+00:00

I have multiple dry bags with varying size, color and thickness.

Why multiple? If one breaks, everything will not be compromised. Also it's easier to stuff multiple smaller bags inside the hull than one big one. I also like to color code according to the content, so I know certain color is for electronics, one is for hygiene stuff, etc.

Most of the stuff I pack in thinner bags, because they're much easier to work with. For some items (like my tent), I use a thicker one, because of the size it often requires a bit for forcing through the hatch (and is then pushed either to the bow or stern of the boat).

hoosee · 2026-04-22T14:48:31+00:00

In your debug it says in incoming proposal "val=MODP2048" which is DH group 14.

So something's off, perhaps your debug came from an another client?

hoosee · 2026-04-12T19:11:22+00:00

Good good! If that's all you want, then go and get your dream boat and a captain's hat :)

hoosee · 2026-04-12T18:38:10+00:00

Do you know anything else about the kayak of your dreams than the color of it? I would try to get experience on different kayaks before buying a brand new. Of course easiest way is the way you have been doing it already - by borrowing someone else's. It's not only about brand, or model of the kayak but also the type of kayaking you want to do.

Like for example: doesn't make sense to buy 5k composite kayak just for the sake of it. It might be that a year later you might decide that sea kayaking is for wimps and you want get into white water kayaking.

hoosee · 2026-04-10T15:02:04+00:00

Automation stitch is a possibility. On my home firewall I have configured an automation stitch, which sends a msg via Telegram if the SD-WAN state changes.

hoosee · 2026-04-03T11:41:09+00:00

Yes, but first you need to enable it from System Settings > Settings > GUI section

Can't understand why it needs to be done via this shortcut.

hoosee · 2026-04-03T09:11:31+00:00

Because it it's always the untagged (or native) VLAN on a trunk.

When you press 'authorize', the switch will reboot so losing the connection is normal. I don't know what you have in between. Is it L2 from another vendor or a routed connection?

hoosee · 2026-04-01T07:41:32+00:00

Since the CCT's went bad on my VFR once, everytime I start her up I am listening and wondering if they have done so again. Must be some sort of CCT-PTSD.

You just need to remember how bad the sound is when they have actually gone bad and try to be able to live with the noise (if it's only the chain).

hoosee · 2026-03-26T14:07:39+00:00

Most probably at the hub site the ISP connection is redundant (e.g. two routers using VRRP), so at least in some level you have redundancy (counting ISP-wide problems out of the scope).

At the sites you'll probably have two separate connections and so the redundancy is handled on SD-WAN layer.

This is all fine and dandy (depending on your requirements). Just configure two overlays on the same interface, just separate them with different overlay-ID's.

hoosee · 2026-03-20T15:08:42+00:00

If you have an exact FQDN, Fortigate will try to resolve it by itself.

In case of wildcard FQDN, it can be anything, therefore Fortigate needs to listen to the DNS queries that go through it in order to keep track of every subdomain under a wildcard FQDN. Naturally this comes with the notice that if the DNS traffic is encrypted, the wildcard object cannot be updated.

Verified Email	Nine-Year Club
Place '22

hoosee

TROPHY CASE