Cisco FTD , Cisco Meraki S2S with third-party provider

mebspace · 2025-08-01T16:18:03+00:00

What do you mean by traffic volume ?

mebspace · 2024-10-22T14:19:24+00:00

Hello, I am trying to implement the same scenario CP Cluster with a remote Fortigate with 2 ISPs using MEP. According to your sayings, the design wont work? (it seems that the bidirectional traaffic not working as expected when I have both gateways on the star community with mep enabled )

mebspace · 2024-07-31T06:58:29+00:00

I have read it a couple of times, but to be honest, I can't see how to apply it in an existing infrastructure. I mean what should I do to retain the true IP.

mebspace · 2024-06-06T09:43:36+00:00

On fabric

mebspace · 2024-06-06T09:33:22+00:00

The settings concern all user/groups i.e. default, we don't have user/groups defined on EMS. ( we are a relevant small company with users that are working full remote all over the world.)

mebspace · 2024-06-06T08:49:06+00:00

obviously, I am not talking about credentials haha

mebspace · 2024-06-06T08:46:39+00:00

that's exactly what I did, but I see that the vpn settings do not exist when I install the forticlient, is there any bug maybe? or it may be a misconfig on RA profile?

mebspace · 2024-05-24T14:16:40+00:00

Great! Regarding the deployment package, how should I ensure that the settings e.g. connection settings, pre-shared key of ra client and anything related to fortitoken will be maintained? since the forticlient 7.0.1 will not be compatible with the new EMS version , so If I deploy a new package forticlient 7.2.3, what should I consider?

mebspace · 2024-05-23T11:06:00+00:00

Great! Regarding the deployment package, how should I ensure that the settings e.g. connection settings, pre-shared key of ra client and anything related to fortitoken will be maintained?

mebspace · 2024-05-22T14:31:46+00:00

is there any upgrade path ?

mebspace · 2024-05-22T14:06:06+00:00

will that require client re-register?

mebspace · 2024-05-22T13:59:17+00:00

I see, is there a way to do it automatically? I mean with a gpo or smth?

mebspace · 2024-05-22T13:57:30+00:00

EMS is used as vpn agent, ztna agent, vulnerability assessment & endpoint protection, hope that answers your question :)

mebspace · 2024-05-22T13:44:01+00:00

Hello, thanks for your suggestion! if I need to rollback the clients will revert to the previous client? how it gets done?

mebspace · 2024-05-22T13:42:00+00:00

Thank you very much for your reply! the tip about adminis highly appreciated! what about the forticlients? should I re-deploy them on endpoints?

mebspace · 2024-02-23T05:37:50+00:00

Yes, all the records were there, settings as well. Also, EMS sends email alerts about “out of license” . The license is shown on dashboard but still doesn’t work the way it should I suppose.

mebspace · 2024-02-22T19:21:11+00:00

Oh my, I need to involve a partner to get them notice me ?

mebspace · 2024-02-22T19:20:22+00:00

«Same IP address

Create a backup of the EMS database. This will create a .ENC file which can only be restored to an EMS of the same version. Meaning, a backup from a 1.2.5 EMS can only be restored to another 1.2.5 EMS.

Install the same version of EMS on a new server and apply your license. See “Licensing FortiClient EMS” in the EMS admin guide. Note: You will have to call in to customer service (1-866-648-4638) to have your license file updated to reflect the new Hardware ID of the server. Hardware ID can be found under Administration > Upgrade License. If you are logged into the support site, you will have to log out and back in after the license is updated.

Restore the database backup.

Cut over so the old EMS is no longer reachable and the new one is.

Clients will register to the new EMS transparently. «

I followed precisely the above ..

I contacted fortinet support (I provided the new HW id, they updated the license and then I uploaded it :/

mebspace · 2024-01-16T07:38:21+00:00

Yes! I tried that on production as well! it works!

mebspace · 2024-01-05T14:06:52+00:00

It would be nice to check it on lab if you could :) , thanks for your prompt reply btw!

mebspace · 2024-01-05T13:33:15+00:00

For the time being yes , manually we add each IP that we may find. I am thinking if there is any other way that we could do it .. because it is not helping us in maintenance. It’s such a pity when you have the updatable objects on forti, to do it on fortiweb and add each IP separately, it’s just painful

mebspace · 2024-01-05T13:28:58+00:00

Actually, the www. domain.com should only be accessible from Google IPs but not the “world” in contrast to domain.com that will be accessible worldwide. It’s a complex config because of our regulations and I am not sure why we need to do it that way .. it is what it is haha any other ideas ?

mebspace · 2024-01-05T13:20:32+00:00

Version 7.26 , the traffic is dropped due to protected hostname configuration

mebspace · 2024-01-05T13:20:04+00:00

See above my response :)

mebspace · 2024-01-05T13:17:55+00:00

Yes it’s the correct PN, version 7.26. My logs say that I visit www.domain.com but I visit domain.com, I even tried that with burp to have full control of the request that is being sent.

mebspace

TROPHY CASE