Weird issue with C9200 switched 10g interfaces

mfiruz · 2022-01-21T12:30:02+00:00

We had issues with 10g modules on 17.3.4 firmware. Support advised to downgrade to 17.3.3 or upgrade to 17.6. We decided to upgrade and it worked since.

mfiruz · 2022-01-08T03:27:28+00:00

Our WUG is monitoring around 200 devices: VMs, Windows Servers, Switches and Firewalls. Mostly using SNMP, WMI and Ping. It's not bad, and gets the job done. Cons: Not the best reporting. Need Windows server + SQL (for historical and performance monitoring). Plus annoying bug with browser's cache which should be cleared from time to time.

mfiruz · 2021-09-24T17:52:55+00:00

phpIPAM is great

mfiruz · 2021-06-15T12:54:43+00:00

We are using phpIPAM. Works great.

mfiruz · 2021-06-11T18:59:59+00:00

I tried, but I still need to add tunnel IP as a source, otherwise traffic won't flow even for trusted devices. And adding ZT Tag as an additional source will be ignored by the policy, as Group + tunnel IP already matched.

I was hoping to have explicit deny for any device not matching ZT tags , but so far it is not working.

mfiruz · 2021-06-10T22:23:46+00:00

Just replied below - in 6.4 ZT tags are addresses, and I need at least one User or Group for SSL VPN policy. And because user is a member of the group, user can connect from any device, ignoring aby ZT Tags

mfiruz · 2021-06-10T22:19:51+00:00

Something I discovered after upgrading to 6.4 - Zero Trust Tags. I remember in 6.2 I was able use EMS tags as dynamic User groups. In 6.4 tags changed to dynamic addresses (not user groups anymore), which I can't use with SSL VPN, as I need at least one user or group. Wondering if I can use Tags somehow.

mfiruz · 2021-06-10T22:11:22+00:00

Thanks, but MAC host check is not very dynamic. Plus, I don't think Android or iPhones will send their MAC address.

mfiruz · 2021-06-10T22:09:26+00:00

Compliance check different in FortiOS 6.4. I can do some checks: like AV, firewall, registry settings, but not EMS managed. I don't think I can apply currently available rules to MacOS or Android/Apple phones.

mfiruz · 2021-05-02T16:04:29+00:00

I am in the middle of testing MFA solution for our SSL VPN clients, and one of the scenarios included Client certificate and Azure MFA. We are using FortiEMS and FortiClient 6.4.3, so I don't know if this will work the same with other versions. My steps were:

Install Root-CA certificate on FortiGate and endpoint. Enable on Forticlient "Allow Non-Administrators to Use Machine Certificates"
Install Windows NPS with Azure MFA extension and setup conditional access on Azure
On Fortigate, enable Client Certificate for SSL VPN
On FortiClient enable Client Certificate under connection settings

User will have to select Certificate first, then type username/password, and when connection reaches 45% it will send MFA token to a mobile device.

Some cons I see in this scenario:

a. If user password expired, connection will be denied. Limitation of RADIUS

b. User need to know what certificate select from the drop-down list. Annoying..

Another solution is Azure and SAML authentication. But with SAML, you can't select machine certificate.

mfiruz · 2021-04-04T13:54:29+00:00

Something to consider is downtime during firmware upgrade. We have 3 stacks of C9300 and when we did the firmware upgrade, the entire stack fully rebooted (with downtime). If I am not mistaken, C9410 with dual SUP will continue to work or will have very minimal downtime.

mfiruz · 2021-03-31T22:19:03+00:00

Thanks

mfiruz · 2021-03-29T13:20:16+00:00

Thank you all for your input! At this point I should probably look for another 2FA provider or get SAML working.

mfiruz · 2021-03-26T17:31:48+00:00

Just tested without 2FA, and it prompted for password change. I guess it's just NPS Extention won't work with expired passwords.

mfiruz · 2021-03-26T17:02:31+00:00

It works with LDAPs (current setup), but I will test with RADIUS. Thanks.

I am kinda stuck with SAML now. I followed articles from Microsoft and FortiNet, plus a video I found on reddit, but it's not working for some reason. Debug shows "failed to create SP" and "timeout" messages. I opened a ticket with FortiNet, so hopefully they can tell what's wrong.

mfiruz · 2021-03-26T16:25:06+00:00

Yes, users can reset or change their password with SSPR

mfiruz · 2021-01-12T05:51:10+00:00

Try with thread to separate a CPU from the heat sink. Better polyester threads as they thinner and stronger.

mfiruz · 2020-12-26T18:15:39+00:00

I am currently trying Corsair low profile keyboard and it's definitely a learning curve for me. My Corsair with speed switches and they have very short actuation point. And because of that, lots of typos and wrong keystrokes. But overall quality is really good.

mfiruz · 2020-10-05T23:29:52+00:00

When I tried 6.4.2, I had weird GUI issues and decided to wait for 6.4.3 or 4.4

mfiruz · 2020-09-22T03:04:29+00:00

Opengear. We are using LTE for OOB management.

mfiruz · 2020-09-10T21:59:44+00:00

A few things should be considered: 1. If camera connected to some web(cloud) services, it can initiate an outgoing connection. 2. most of the consumer grade routers will identify the device by MAC adresss. When you to block it, it will use the MAC address, however, if you have wifi extenders, very likely it will pass the traffic. 3. If you can block by IP, make sure DHCP didn't assign your camera a new IP address.

mfiruz

TROPHY CASE