This article describes using the Internet Services Database on a FortiGate firewall. The Internet Services Database is a comprehensive public IP address database that combines IP address range, IP owner, service port number and IP security credibility. The data comes from the FortiGuard service system and is regularly updated by Fortinet. This database can be used as either source or destination for policies. A few prerequisites, you have to have a valid FortiGuard subscription and the service Domain & IP…

Read More Read More

This article describes an option for managing a FortiGate HA cluster. Why is this important? Ideally, you want to make sure you have IP access to both the Active and Standby FortiGate firewalls separately from the combined management IP address. This gets important when you have to do things like a remote upgrade. This method will give you a separate management IP address on both the primary and standby FortiGate firewall. These IP addresses will be on the same network…

Read More Read More

If you want to report on user Internet usage and possibly even define access rules based on your Active Directory groups this document is for you.  We’ll install the FSSO Collector Agent in basic mode, identify the groups we are interested in and setup the FortiGate. The FSSO Collector will monitor the Windows security logs on your domain controller for log on and log off events, these events contain the IP address of the computer that logged on or off…

Read More Read More

I’m frequently asked to block users from accessing certain countries and it can help prevent exploits if your users have no business connecting to some of these countries.  This is called Geo Blocking and it’s pretty easy to setup. Setup address object for the country you want to block Navigate to Policy & Objects > Addresses and click Create New Address Enter the name of the country in question Change the Type to Geography Change the Country to the country…

Read More Read More

This post shows you how to block an individual website with a static URL filter. Navigate to Security Profiles > Web Filter Scroll down to Static URL filter and enable URL Filter (if it’s not already) Click Create Enter the url you want to block.  I’m using facebook.com for this example and since I want to block all things facebook.com I’m making this a Wildcard block and using *facebook.com for the entry.  Click OK Make sure you have an outbound…

Read More Read More

The premise.  You have a FortiGate and you have two ISP connections.  Maybe the speeds aren’t that close together and one of them is really just for failover so load balancing is out but you want BOTH WAN connections to respond from the outside. It’s pretty straight forward.  Configure your IP addressing on both WAN interfaces.  Let’s assume WAN1 is going to be the primary connection. The secret sauce is in the Distance and Priority for your static routes.  You…

Read More Read More