Fortinet GURU

My other theme was getting compromised quite frequently so I have temporarily moved to this one. This one, however, does not support the version of PHP I need to go to so I’m still hunting for the final one.

You absolutely MUST harden administrative access on your FortiGate if you want to remain secure and prepared. There are a lot of ways to help reduce the attack surface and make things as secure as possible. Remove Administrative Access from any interface that absolutely is NOT necessary. Remove the default admin account and create non-standard ones Add Trusted Hosts to your administrative…

7.4.1 has brought us the means of having a managed Fortiswitch operate and do inter-vlan routing. Check out the discussion below:

So, you guys have been following me for a while and watching my YouTube videos. I am forever thankful and would like to let you know that I am currently on schedule to have a new Fortinet GURU video go live every Monday. I have also, while dealing with my grief started something called Packet Llama. Think “Fortinet GURU” but with a more broad brush stroke. I have found that keeping myself busy is…

What Features Do You Want In FortiOS?

We all have ideas and use cases that make new features very much worth our while. What are some ideas of new features you would like to see added to FortiOS?  

FortiOS 7 Features I am Excited About

FortiOS 7.0 has hit GA and I am happy surprised / impressed with some of the features. The video below discusses the features I am most excited about and what we can expect from them!  

FortiOS 6.6 Brings LTS and Mike Got Fat!

It has been a lonnnnng time since I have posted. That is my fault. Sometimes you need to relax. I relaxed, a LOT and got fat in the process. I am back now! and FortiOS 6.6 which is upcoming in the next few months will have LTS (long term support) with a renewed focus on security and stability. If that doesn’t make your worm wiggle I dunno what will.

Collectors and Analyzers – FortiAnalyzer – FortiOS 6.2.3

Collectors and Analyzers

This topic describes how to configure two FortiAnalyzer units as the Analyzer and Collector and make them work together. In the scenario shown in the diagram below, Company A has a remote branch network with a FortiGate unit and a FortiAnalyzer 400E in Collector mode. In its head office, Company A has another FortiGate unit and a

FortiAnalyzer 3000D in Analyzer mode. The…

High Availability – FortiAnalyzer – FortiOS 6.2.3

High Availability

A FortiAnalyzer high availability (HA) cluster provides the following features:

Provide real-time redundancy in case a FortiAnalyzer primary unit fails. If the primary unit fails, another unit in the cluster is selected as the primary unit. See If the primary unit fails on page 254.

Synchronize logs and data securely among multiple FortiAnalyzer units. Some system and…

Two-factor authentication – FortiAnalyzer – FortiOS 6.2.3

Two-factor authentication

To configure two-factor authentication for administrators you will need the following:

l FortiAnalyzer l FortiAuthenticator l FortiToken

Configuring FortiAuthenticator

On the FortiAuthenticator, you must create a local user and a RADIUS client.

Before proceeding, ensure you have configured your FortiAuthenticator, created a NAS entry for your FortiAnalyzer, and created…

Global Admin – GUI Language – Idle Timeout – FortiAnalyzer – FortiOS 6.2.3

GUI language

The GUI supports multiple languages, including:

l English l Simplified Chinese l Spanish l Traditional Chinese l Japanese l Korean

By default, the GUI language is set to Auto Detect, which automatically uses the language used by the management computer. If that language is not supported, the GUI defaults to English. For best results, you should select the language used by the…

Global Admin – Password Policy – FortiAnalyzer – FortiOS 6.2.3

Password policy

You can enable and configure password policy for the FortiAnalyzer.

To configure the password policy:

Go to System Settings > Admin > Admin Settings.

Click to enable Password Policy.

Configure the following settings, then click Apply to apply to password policy.

Minimum Length Specify the minimum number of characters that a password must be, from 8 to 32. Default: 8. Must Contain

Global administration settings – FortiAnalyzer – FortiOS 6.2.3

Global administration settings

The administration settings page provides options for configuring global settings for administrator access to the FortiAnalyzer device. Settings include:

Ports for HTTPS and HTTP administrative access

To improve security, you can change the default port configurations for administrative connections to the FortiAnalyzer. When connecting to the FortiAnalyzer unit when…

SAML admin authentication – FortiAnalyzer – FortiOS 6.2.3

SAML admin authentication

SAML can be enabled across all Security Fabric devices, enabling smooth movement between devices for the administrator. FortiAnalyzer can play the role of the identity provider (IdP) or the service provider (SP) when an external identity provider is available.

Devices configured to the IdP can be accessed through the Quick Access menu which appears in the top-right…

Remote authentication server groups – FortiAnalyzer – FortiOS 6.2.3

Remote authentication server groups

Remote authentication server groups can be used to extend wildcard administrator access. Normally, a wildcard administrator can only be created for a single server. If multiple servers of different types are grouped, a wildcard administrator can be applied to all of the servers in the group.

Multiple servers of the same type can be grouped to act as backups –…

TACACS+ servers – FortiAnalyzer – FortiOS 6.2.3

TACACS+ servers

Terminal Access Controller Access-Control System (TACACS+) is a remote authentication protocol that provides access control for routers, network access servers, and other network computing devices via one or more centralized servers. It allows a client to accept a user name and password and send a query to a TACACS authentication server. The server host determines whether to…