Blog - Page 2 of 2 -

FortiGate Inbound Port Forwarding using VIP’s v5.4

October 1, 2017 ggleason Comments 0 Comment

This article goes over creating an inbound port forward NAT rule on a FortiGate device. This allows inbound access to a resource behind your firewall using your public IP address. For this example we’ll create a rule that allows HTTP (port 80) and SMTP (port 25) pointed at one internal server resource. The external IP address (WAN interface side) for this example is 1.1.1.1 The internal IP address (inside interface side) for this example is 2.2.2.2 First we’re going to…

Read More Read More

FortiGate AD Authentication for SSL VPN v5.4

October 1, 2017 ggleason Comments 0 Comment

Active Directory is a great authentication system, already in use on your network if you have a Windows Server based infrastructure so it makes sense to leverage for authenticating your SSL VPN users rather then creating separate, local login accounts. Before you set this up on the FortiGate you first need to setup a service account on your windows server. Yes, you could use an already existing account but it’s advisable to use something separate so if/when you need to…

Read More Read More

Figuring out an Active Directory Objects DN Path

October 1, 2017 ggleason Comments 0 Comment

There are times when you will need to figure out an object’d distinguished name path in Active Directory. For example, you want to configure AD authentication. There are a few different ways to do this, I’m going to show you two of them. I’m doing this on Microsoft Windows Server 2012 R2 but the idea is the same for 2008/2008R2. Method One: Attribute Editor On a domain controller, open up Active Directory Users and Computers Click View and select Advanced…

Read More Read More

FortiGate Dual ISP Failover both active v5.4

September 26, 2017 ggleason Comments 0 Comment

The premise. You have a FortiGate and you have two ISP connections. Maybe the speeds aren’t that close together and one of them is really just for failover so load balancing is out but you want BOTH WAN connections to respond from the outside. It’s pretty straight forward. Configure your IP addressing on both WAN interfaces. Let’s assume WAN1 is going to be the primary connection. The secret sauce is in the Distance and Priority for your static routes. You…

Read More Read More

Cisco FirePOWER Management Center Alerting – v6

September 24, 2017 ggleason Comments 0 Comment

If you want to be notified of system alerts without having to stare at the dashboard then you need to configure an email server and external alerting. Configure Email Notification Navigate to System > Configuration > Email Notification Enter the Mail Relay Host, the port number, the encryption method, the from address and the authentication settings and click Save. Make sure to click Test Mail Server Settings to make sure they are working properly before proceeding.

Cisco ASA5500-X FirePOWER Preparation v6

September 24, 2017 ggleason Comments 0 Comment

To upgrade an ASA’s FirePOWER module to version 6 and get it ready to be integrated into FirePOWER Management Center is a bit of a process but thankfully most of it isn’t production impacting. First a few prerequisites. The ASA must have a SSD drive installed and functional. Do a show inventory from the CLI to make sure one is found before you get started, if you have a drive installed but it’s not showing up try rebooting the ASA….

Read More Read More

Cisco FirePOWER Management Center v6 – Adding Licenses

September 24, 2017 ggleason Comments 2 comments

This will cover Classic Licensing, not Smart Licensing for FirePOWER features. You’ll receive your PAK code from Cisco either electronically or on a paper card. From there you can goto https://cisco.com/go/license to register it and get the actual .LIC file. If you haven’t purchased a license yet, you can get a demo license from Cisco by working with your sales engineer. Before you head over there you will need the License Key from the FirePOWER Management Center since that’s where…

Read More Read More

Cisco FirePOWER Management Center AD Integration v6

September 24, 2017 ggleason Comments 0 Comment

You have FirePOWER Management Center all fired up and configured and you are getting lots of information but rather then seeing what user is doing what, you are just getting source computer IP addresses. You can tie FirePOWER into Active Directory to report on actual users as well as being able to create policies based on AD users. This lets you get much more granular with your approach. There are two ways to accomplish this, active authentication and passive authentication….

Read More Read More

Cisco FirePOWER Management Center v6 – Initial Installation

September 24, 2017 ggleason Comments 0 Comment

This will review deploying the Cisco FirePOWER Management Center on ESXi. The Management Center makes it possible to manage multiple FirePOWER devices from a central server, allowing you to scale up more efficiently. Before we get started, a few prerequisites. Make sure you have a VMware host (ESXi or ESX). You will need capacity on this host for 8GB RAM, 4 vCPU’s and 250GB storage (thick provisioned) for the FirePOWER Management Center VM. You can deploy this thin provisioned if…

Read More Read More

FortiGate SSL VPN v5.4

September 19, 2017 ggleason Comments 1 comment

This will review setting up remote users to access your network using a SSL VPN connection, either by tunnel mode (FortiClient) or with a web browser. For this example we’re using tunnel mode instead of split tunnel. This means all traffic (including Internet traffic) will go through the firewall, allowing the client to be protected by the firewalls security features. This example will authenticate with local user accounts. Step 1: Create a local user On your FortiGate go to User…

Read More Read More

FortiGate VPN – SSL Certificate Installation

August 19, 2017 ggleason Comments 0 Comment

Why should you get a certificate for SSL-VPN? When you setup your FortiGate to let users connect into your network via SSL-VPN you will notice they receive a certificate warning. This is because the certificate being used is the self signed certificate that’s on the firewall. This certificate isn’t “trusted” by clients trying to connect in so they warn you on connection attempts. You can eliminate this problem and potential support call by purchasing a SSL certificate from a reputable…

Read More Read More