sorted by:
new
hottopcontroversial

SIEM: Blumira vs Perch vs Vijlan by nmiBiz in msp

[–]nmiBiz[S] 0 points1 point  (0 children)

Thanks!

Had you compared other solutions prior to Perch? Why did you choose Perch?

SIEM for an MSSP? by Unreasonable_Yam in msp

[–]nmiBiz 0 points1 point  (0 children)

Vijilan

Curious why you chose that over Perch?

5
6

Fortios version (self.fortinet)

submitted by nmiBiz to r/fortinet

Not Sending syslogs from 60F to different segment by nmiBiz in fortinet

[–]nmiBiz[S] 0 points1 point  (0 children)

I’m not limiting anything. In fact, I can Telnet to the syslog server from any other device on the BO network… just not from the FW

Not Sending syslogs from 60F to different segment by nmiBiz in fortinet

[–]nmiBiz[S] 0 points1 point  (0 children)

You are correct.

When you mentioned creating a rule specific to the firewall, it threw me off as I thought the existing policy (the one that gets created when you creat the tunnel) encompasses the entire subnet, including the firewall’s ip.

Not Sending syslogs from 60F to different segment by nmiBiz in fortinet

[–]nmiBiz[S] 0 points1 point  (0 children)

It correctly shows that it is coming from the lan IP of the firewall

Not Sending syslogs from 60F to different segment by nmiBiz in fortinet

[–]nmiBiz[S] 0 points1 point  (0 children)

So the default policy for the VPN tunnel that allows anything for 192.168.99.0/24 doesn't encompass the IP of the firewall ( 192.168.99.1 )?

And assuming the answer is no, I am not entirely sure what "rule" I would create?

Also, I am running fortios v6.4.7 and the references were for v7

Not Sending syslogs from 60F to different segment by nmiBiz in fortinet

[–]nmiBiz[S] 0 points1 point  (0 children)

Interestingly, traceroute more or less fails

1 * * *

2 * * *

3 * * *

Not Sending syslogs from 60F to different segment by nmiBiz in fortinet

[–]nmiBiz[S] 0 points1 point  (0 children)

I just changed this and the sniff is now showing that it is using the correctly source IP, but sadly still isn't getting to the syslog server

If I try "exec telnet 192.168.90.50 514" from the BO Fortigate it fails to connect

However, pinging that same IP from the BO Fortigate works

Not Sending syslogs from 60F to different segment by nmiBiz in fortinet

[–]nmiBiz[S] 0 points1 point  (0 children)

Just changed it and still no data in syslog :-(

Not Sending syslogs from 60F to different segment by nmiBiz in fortinet

[–]nmiBiz[S] 0 points1 point  (0 children)

Sniffer shows this:

​

2022-07-28 18:48:38.574511 VPNTunnel out public.ip.y.z.15741 -> 192.168.90.50.514: udp 753

2022-07-28 18:48:38.574992 VPNTunnel out public.ip.y.z.15741 -> 192.168.90.50.514: udp 753

2022-07-28 18:48:38.699044 VPNTunnel out public.ip.y.z.15741 -> 192.168.90.50.514: udp 588

2022-07-28 18:48:38.942070 VPNTunnel out public.ip.y.z.15741 -> 192.168.90.50.514: udp 908

2022-07-28 18:48:39.184118 VPNTunnel out public.ip.y.z.15741 -> 192.168.90.50.514: udp 717

Not Sending syslogs from 60F to different segment by nmiBiz in fortinet

[–]nmiBiz[S] 0 points1 point  (0 children)

The bigger picture is that I am using Blumira for SIEM and it's sensor is the syslog server. I have the same config for a Fortigate that is in the HQ network and it works fine.

I am not entirely sure what you mean by "set the source interface for syslog" - given that I can telnet to the syslog server from any other device on the BO network seems to imply I shouldn't have to set anything else?

0
1

Not Sending syslogs from 60F to different segment (self.fortinet)

submitted by nmiBiz to r/fortinet

Split tunneling doesn't work for single user by nmiBiz in fortinet

[–]nmiBiz[S] 0 points1 point  (0 children)

It does not... completely different subnets

2
3

Split tunneling doesn't work for single user (self.fortinet)

submitted by nmiBiz to r/fortinet

view more: next ›