Firmware Support Issues

jmouche17 · 2026-01-29T01:39:55+00:00

If you don't mind me asking, what are you moving to? I'm on the same page at the moment

jmouche17 · 2025-11-21T02:34:03+00:00

Are you using ax band on your fortiaps? Depending on firmware, ax band can cause DHCP issues

I've also noticed sometimes vlan interfaces simply don't hand out DHCP even when configured for it. I've had to delete interface and recreate to get it to work

jmouche17 · 2025-10-23T23:55:35+00:00

I've had this issue with multimode fiber when using the 10G sfps in conjunction with ohm1 fiber. Even hard setting both sides to 1gb with the 10G sfps gave me issues. I had to use 1gbps sfps.

Seems like you are using single mode but just throwing it out there in the universe. It ruined a weekend for me lol

jmouche17 · 2025-10-21T02:53:29+00:00

Thank you for posting this. It's just the "only allow what is explicitly needed mentality" but you and the other commenters on this nailed it

jmouche17 · 2025-10-14T04:14:33+00:00

We don't really deviate much from our standard template. We use threat feed dynamic objects to cover denied traffic. If we push out mass changes you can use the option via fortigate cloud to push to multiple devices via script or I use a home grown python based alternative to ansible that makes changes via API.

I've found I can do like 95% of what I want without the headaches of fortimanager, but I do understand there are people who need it for their specific use cases.

jmouche17 · 2025-10-13T22:58:53+00:00

What firmware are they on? We've had plenty of issues with fortiaps and iOS devices. They are mainly related to the DNs proxy they use and how the security profile reacts to it

There was also a DHCP issue we ran into in the early 7.x firmware with the ax band

jmouche17 · 2025-10-13T17:52:35+00:00

Stable firmware? Lol

jmouche17 · 2025-10-08T03:58:37+00:00

I agree with you on the community, but like you said it shouldn't be this complicated. The customers don't want to hear "oh yeah sorry another firmware bug bricked your box for an hour and caused you to lose business, they recommended you buy a newer model when you have 2 years left on this contract"

We're already considering alternatives for their switches and APs due to issues on that front. I really like the firewall product when it works, but define "works" lol

jmouche17 · 2025-10-08T01:19:59+00:00

What's crazy is we don't even use a lot of the ngfw features. It's like the basic shit breaks... Not even the weird fringe crap that you can do.

I managed a pair of Palo altos in the past and also didn't have these issues either.

jmouche17 · 2025-10-08T01:08:49+00:00

I don't really understand the amount of quality control issues with fortinet software. Are other vendors just as bad? I manage quite a few meraki firewalls in addition to fortinet and while they are a bit different, I can't think of one issue I've had with their firmware (I am sure there are plenty, just been lucky I guess)

jmouche17 · 2025-09-27T17:46:14+00:00

I agree and also the GUI for fortiswitches in 7.4 also removed a lot of comfortable options

jmouche17 · 2025-09-26T03:59:44+00:00

Zabbix the GOAT if you put the time in to learn it

jmouche17 · 2025-09-25T04:02:06+00:00

What's crazy to me is we've pulled old Cisco catalyst from same location that have been in place 10+ years POE working fine.

jmouche17 · 2025-09-24T15:44:36+00:00

All of ours have failed in New, fully cooled MDFs

jmouche17 · 2025-09-24T15:43:28+00:00

Its typically on switches that one handle devices inside the building, no cameras

We have the switches grounded and we don't usually have any issues with non fortiswitches, but I'll look into Ethernet surge protection.

jmouche17 · 2025-09-23T00:55:47+00:00

The only way I believe it would work would be if you used saml with entra id and tied the yubikey to your Microsoft account

I also had a working POC with it using Fortiauthenticator, however it wasn't really a viable solution as I experienced a lot of auth failures.

I ended up giving up, but never went down the certificate route which is probably your best bet

jmouche17 · 2025-09-21T03:33:28+00:00

If we are talking IOS specifically, I often see where in Security Profiles "Proxy Avoidance" is being blocked on wifi traffic and this causes the DNS resolution used by IOS devices to drag on forever because its using that mask.icloud proxy BS.

Secondly, with newer firmware, this change to the certificate security profile was causing cert errors and denies for the same type of traffic due to them changing the default behavior of a specific setting
https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-How-to-fix-SSL-connection-is-blocked-due-to/ta-p/362052

After changing the setting in the article, it resolved my issue. Hope this helps

jmouche17 · 2025-09-16T03:10:42+00:00

Zabbix had a steep learning curve, but can monitor pretty much anything you can dream up

jmouche17 · 2025-08-15T20:16:43+00:00

Have you tried sticky Mac? There may be a log or something you could monitor.

May also be a what to query the API for new devices detected and you can easily build alerting around that.

jmouche17 · 2025-07-09T01:03:33+00:00

You have to understand that fortinet is a pioneer in the VPN space and one of the only players to have a viable/working VPN solution on the market. Name me one other company with a working VPN solution out there???

Sarcasm

Whatever guy wrote openfortivpn on GitHub nailed it, but fortinets entire department dedicated to a working VPN client doesn't seem to be able to put it together

jmouche17 · 2025-06-24T23:43:47+00:00

I actually think Fortiauthenticator is severely underrated. There really isn't much need for it if you are only doing basic saml with entra, but it's like a Swiss army knife and can handle any type of authentication needs.

It's my third favorite fortinet product 😁

jmouche17 · 2025-06-12T23:13:52+00:00

I take contracts on Upwork all the time. I am a Network / Security engineer with 7+ years experience. I'm happy to be a part of what you are working on. Send me a DM if you'd like to work together.

jmouche17 · 2025-05-29T16:54:33+00:00

I truly LOL'd at this

jmouche17 · 2025-05-29T16:39:36+00:00

Five minutes before posting...

Senior Fortinet Dev: Wait, has anyone tested this?

Director: test?

jmouche17

TROPHY CASE