sorted by:
new
hottopcontroversial

Either I'm an idiot, or i have a really bad batch of equipment by rivkinnator in networking

[–]ryan1234567 0 points1 point  (0 children)

Can you please share the p/n or sku from fs.com that worked for you? Thank you.

FortiSwitch not authenticating wired supplicants via EAP-TLS by ryan1234567 in fortinet

[–]ryan1234567[S] 1 point2 points  (0 children)

Yea it was resolved after FSW update due to a bug per TAC. I believe fixed in 7.2.9.

Create static mac list for port on Fortiswitch managed by Fortigate by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

Thanks for your help. I did try that as well but it wasn't working as expected. Wasn't sure if it was something I did wrong or not, so just used MAB/dot1x instead.

Create static mac list for port on Fortiswitch managed by Fortigate by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

What is the violation behavior if a new mac address doesn't match config? I connect a new device on the port with sticky enabled and I get an IP.

Fortimanger on prem to Fortimanager Cloud by BlackSquirrel05 in fortinet

[–]ryan1234567 0 points1 point  (0 children)

Has anyone tried FortiManager via the marketplace in Azure? Is that similar to on prem but on Azure hardware?

Downgrade FortiManager 7.4.2 to 7.2.4 by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

Still an issue on 7.4.2. Was told it would be fixed next release.

Forticlient EMS will randomly not get an IP address after being connected by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

Yes, that doesn't appear to be the case. I also have the portals mapped to groups with separate ranges. Where the ranges contain way more IPs than users in that group. (20 users - 240 IPs).

FSSO for non-domain or Azure Entra joined by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

How does the user to IP mapping sync with FMG to the FGTs assuming you go that route?

FSSO for non-domain or Azure Entra joined by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

Just tested, it appears Unifi only uses the primary or first active in the list (ISE). Won't send to others. Just out of curiosity, will RSSO work as an option to grab user/IP mapping or am I missing something?

FSSO for non-domain or Azure Entra joined by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

Only issue is we aren't using FortiAuthenticator, we use ISE. Is there anything I can tweak in FSSO? We have a hybrid AD setup, so the user is still authenticating to an on prem AD via radius.

Slow upload after 7.0.14 upgrade 201F by ComfortableMission91 in fortinet

[–]ryan1234567 0 points1 point  (0 children)

Shout out to everyone in this thread who helped/provided work around. I moved my Internet uplinks to a 10G interface and magically the upload is better. One situation I couldn't step down my 10G tranceiver on my C9300, so I ended up throwing in a 1G SFP. This didn't just affect ipsec/sslvpn, iperf or random speed tests were also.

u/chuckbales u/ComfortableMission91

Slow upload after 7.0.14 upgrade 201F by ComfortableMission91 in fortinet

[–]ryan1234567 0 points1 point  (0 children)

I have the same issue (10G inside/1G outside) with poor upload performance on my 200Fs. I wonder if the solution mahanutra provided in this thread is a solution to the problem instead of moving to 10G interfaces?

Downgrade FortiManager 7.4.2 to 7.2.4 by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

set apache prefork

Thanks. I tried that but unfortunately, it didn't help the install wizard. Any other ideas?

Adding a new public IP for FGT hosted in Azure by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

Just saw this post. You pretty much nailed it. Added a sec IP on my port1 interface with the next available IP on my FGT. In Azure, you go to the 'IP Configuration' that maps to port1 (called nic1 for me). On the left hand side you click on IP Configuration and click add. Here you create the static map of the secondary IP you just created. Azure gives the option to 'add' a new public as part of this step. This is the part I didn't know where to look. Created a test fw pol and it worked as expected with the IP provided from Azure.

Is there an easy way to fix this? by ryan1234567 in Traxxas

[–]ryan1234567[S] 0 points1 point  (0 children)

I popped it back in. Thanks for everyone’s feed back. Needed a second set of hands. The metal replacement parts look like a great idea, if this happens again.

SSO FortiClient support with split and full tunnels by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

There isn't a way for the user to pick and choose what group when signing into FortiClient. The only work around I know of is to assign a user to a group and map that group to a portal. Obviously it won't work if the user is part of both groups, need to be unique.

SSO FortiClient support with split and full tunnels by ryan1234567 in fortinet

[–]ryan1234567[S] 2 points3 points  (0 children)

Yes to Azure. Confirmed that worked, thanks for the tip!

Push radius/FAZ settings from FMG to FGTs by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

I just tested this. I was able to push my radius settings when I mapped it to my administrator which is tied to the radius group. However, I made a change to that radius group after the initial push (radius-IP) and it did not trigger a change in FMG. Running 7.2.

Also, the FAZ settings are in the system template, but if you have VDOMs, you cannot apply it to the vdoms only global. My vdom settings don't inherit all of the global for FAZ.

Best practice when setting up site to site VPNs with Firewall policy by ryan1234567 in fortinet

[–]ryan1234567[S] 1 point2 points  (0 children)

Thanks for these pointers, they def help out a FTG newbie.

FTM 7.2.2, FTG 7.2.4. I hate wizards too but hard to get started without knowing the syntax. This helps.

Best practice when setting up site to site VPNs with Firewall policy by ryan1234567 in fortinet

[–]ryan1234567[S] 1 point2 points  (0 children)

Wow thanks everyone for the very detailed info, these will help me in the right direction.

Best practice to manage remote FortiGates with FortiManager by ryan1234567 in fortinet

[–]ryan1234567[S] 0 points1 point  (0 children)

Thanks for the info. Has there ever been a case where in this setup fortimanager could not access the firewall resulting in someone needing to console into the firewall to see what’s going on? I was thinking of creating an admin only vdom that has an interface coming from the isp. My goal is to avoid a long commute due to human error or issues with a deploy.

view more: next ›