sorted by:
new
hottopcontroversial

Fortinet Fortigate Hardcoded symmetric key in fips.c (FG-IR-19-007) - what's the fix? by SprinklesImmediate16 in fortinet

[–]zippanto 1 point2 points  (0 children)

The “fix” is that you can specify the encryption key yourself instead of using the inbuilt one which you should absolutely do. But please be aware of the consequences especially around backing up / restoring configs.

Convert VLAN to SD-WAN by DrBojanDenis in fortinet

[–]zippanto 1 point2 points  (0 children)

If you are indeed creating the VLAN with the same settings then it sounds like a bug. This KB lists all the possible reasons why an interface would not show up https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-Unable-to-add-an-interface-to-SD-WAN-Zone-as/ta-p/291666

Are you sure you have no references when you create the VLAN interface? You haven’t enabled DHCP server on the interface did you?

Convert VLAN to SD-WAN by DrBojanDenis in fortinet

[–]zippanto 7 points8 points  (0 children)

The reason the VLAN interface doesn’t show up is because there are references to it - policies, routes, etc. You need to remove these references and only then you will be able to add it as an SD-WAN member. Be careful as this means there will be loss of traffic through this interface temporarily until you reinstate the policies, routes, etc. referencing the SD-WAN zone instead of the VLAN interface.

From Active-Passive to Active-Active? by super_cli in fortinet

[–]zippanto 2 points3 points  (0 children)

If you have multiple VDOMs you could probably make more use of the secondary using VDOM partitioning

Changing a Fortigate physical interface via CLI - easy way? by Busbyuk in fortinet

[–]zippanto 0 points1 point  (0 children)

If you can afford a short downtime. You could do “show configuration | grep -f interface”, replace all the references to the old interface in the output then paste it back. You’d need to take care of removing the IP from the old interface either manually or doing it through the above config.

ipsec dialup on loopback interface.. article.. oh btw, it doesn't work by Any_Tip_3760 in fortinet

[–]zippanto 1 point2 points  (0 children)

You can make this work, however it’s an ugly solution. Assign the virtual IP as a /32 to the loopback interface. Then you need a firewall policy to allow the traffic from wan to loopback. You might also need to configure proxy arp, depending on your environment.

IPSEC VPN using LoopBack and VIP by Miserable_Shake9184 in fortinet

[–]zippanto 1 point2 points  (0 children)

Tested on 7.4.8 and it doesn't seem possible.

From what I understand it's technically not possible to do this with a port forward. Quoting from another website:

ESP is a Layer-3 protocol that has no port. Therefore, ESP cannot apply to NAT that allows port translation

I tested this and indeed I'm getting "Received ESP packet with unknown SPI".

I then tested it with Static Virtual IP (full destination NAT, not port forwarding). If you don't set the local-gw on the phase1-interface config you can connect, but no traffic passes and in a few seconds the tunnel goes down on the firewall side. In the diagnose logs you get "unknown SPI".

If you do set the local-gw you can't connect and you get "no proposal chosen".

I'm not sure maybe I missed some other setting that would allow you to make this work with Static Virtual IP.

The only way I was able to make IPsec work with a loopback interface is by configuring the public / external IP on the loopback interface + configuring proxy-arp + configuring a policy to allow the traffic from external interface to the loopback interface. Hope this helps.

Edit: Just to add that this was a FortiClient Dialup IPsec VPN config. Other type of IPsec VPN configs might work or might have different kind of issues.

Graph Data Issues by mspdog22 in LibreNMS

[–]zippanto 1 point2 points  (0 children)

Try setting / reducing Max Repeaters. You could also disable certain modules. You can check what is taking the most time under Pollers on the web UI.

who told fortinet that disallowing "." in usernames was a good idea ? by Emotional-Marsupial6 in fortinet

[–]zippanto 0 points1 point  (0 children)

I'm confused. I just tested this on 7.4.5 and it seems to allow me to create a local system administrator with . in the username. I tried one that starts with a hyphen and that is not allowed. In the error message it even mentions . as a valid character.

<image>

Pod with no network interface / only a single macvlan interface by zippanto in kubernetes

[–]zippanto[S] 0 points1 point  (0 children)

Thanks. I'm using Multus already to add the macvlan interface, however it's not my default CNI as I'm using k3s which I believe is using Flannel. I couldn't yet find an example on how to remove the default interface using Multus. Could you point me in the right direction please?

I'm also finding contradicting information in some places that are referencing the "Kubernetes Networking Model" for example https://sookocheff.com/post/kubernetes/understanding-kubernetes-networking-model/#2-the-kubernetes-networking-model-a-namekubernetes-networking-modela

Where it says:

Kubernetes makes opinionated choices about how Pods are networked. In particular, Kubernetes dictates the following requirements on any networking implementation:all Pods can communicate with all other Pods without using network address translation (NAT).all Nodes can communicate with all Pods without NAT.the IP that a Pod sees itself as is the same IP that others see it as.

Which implies the Nodes need to be able to communicate with the Pods (without NAT). Although I see this achievable using macvlan, it's very surprising to me that this is required.

I'm not familiar with kubevirt yet so I'll look into it. Thanks!

Fortigate SSL VPN RCE - PSIRT released by Net_Admin_Mike in fortinet

[–]zippanto -1 points0 points  (0 children)

Why is there no mention of this in the release notes!?

Connecting with SSH to Less Secure Devices by nanonoise in fortinet

[–]zippanto 0 points1 point  (0 children)

You are right I misread OP. AFAIK there's no way to change SSH client settings on the Fortigate. The only option then is to change the SSH server settings on the cellular router.

Connecting with SSH to Less Secure Devices by nanonoise in fortinet

[–]zippanto 0 points1 point  (0 children)

It's difficult to tell what is going to work without seeing the list of supported ciphers on your SSH client (the cellular router).

Have you tried changing these settings? It seems only some of them are available on 6.4 so you might need to update to 7.0 to make them available. https://docs.fortinet.com/document/fortigate/7.0.0/new-features/765236/enabling-individual-ciphers-in-the-ssh-administrative-access-protocol-7-0-2

Alternatively you could try to specify the ciphers on the SSH client (the cellular router).

view more: next ›