Fortinet

config system interface
edit "WAN-VLAN4"
        set vdom "root"
        set mode dhcp
        config client-options
            edit 1
                set code 60
                set type string
                set value "IPTV_RG"
            next
            edit 2
                set code 55
                set value "79"
            next
            edit 3
                set code 121
                set type string
                set value "classless-static-routes"
            next
        end
        set distance 6
        set alias "KPN IPTV VLAN"
        set device-identification enable
        set monitor-bandwidth enable
        set role lan
        set snmp-index 15
        set defaultgw disable
        set dns-server-override disable
        set interface "wan"
        set vlanid 4
        next
        end

 config router static
     edit 0
        set dst 213.75.112.0 255.255.248.0
        set distance 1
        set device "WAN-VLAN4"
        set dynamic-gateway enable
    next
    end

config firewall multicast-policy
    edit 1
        set uuid 7f5446ce-6a80-51ee-f08f-1714fb5ee2bc
        set name "Upstream IPTV"
        set logtraffic enable
        set srcintf "WAN-VLAN4"
        set dstintf "LAN"
        set srcaddr "all"
        set dstaddr "all"
        set snat enable
    next
    edit 2
        set uuid 7f585a98-6a80-51ee-aae4-234969492bac
        set name "Downstream IPTV"
        set logtraffic enable
        set srcintf "LAN"
        set dstintf "WAN-VLAN4"
        set srcaddr "all"
        set dstaddr "all"
        set snat enable
    next
end

config firewall address
    edit "G-IPTV-213.75.112.0/21"
        set subnet 213.75.112.0 255.255.248.0
    next
end

config firewall policy
    edit 0
        set name "IPTV"
        set srcintf "LAN"
        set dstintf "WAN-VLAN4"
        set action accept
        set srcaddr "all"
        set dstaddr "G-IPTV-213.75.112.0/21"
        set schedule "always"
        set service "ALL"
        set nat enable
    next
end

https://forum.kpn.com/thuisnetwerk-72/instellen-eigen-router-fortigate-60f-met-iptv-options-499669

Dynamische blocklists

Met deze config kun je dynamische lijsten met IPs inladen in de fortigate om vervolgens op basis van deze lijsten verkeer te blokkeren.

config system external-resource
    edit "Threadfeed Domains Generic"
        set type domain
        set category 192
        set resource "https://raw.githubusercontent.com/emberstack/threat-feed/main/Feed/List/ThreatFeed.Domains.Generic.txt"
        set refresh-rate 1
    next
    edit "Threadfeed Domains Advertising"
        set type domain
        set category 193
        set resource "https://raw.githubusercontent.com/emberstack/threat-feed/main/Feed/List/ThreatFeed.Domains.Advertising.txt"
        set refresh-rate 1
    next
    edit "Russia IP list"
        set type address
        set resource "https://filestore.fortinet.com/fortiguard/russia_reg_ip.list"
        set refresh-rate 1
    next
    edit "Donetsk IP list"
        set type address
        set resource "https://filestore.fortinet.com/fortiguard/dnr_lnr_ip.list"
        set refresh-rate 1
    next
    edit "Iran IP list"
        set type address
        set resource "https://filestore.fortinet.com/fortiguard/iran_reg_ip.list"
        set refresh-rate 1
    next
    edit "Krim IP list"
        set type address
        set resource "https://filestore.fortinet.com/fortiguard/crimea_ip.list"
        set refresh-rate 1
    next
    edit "Emerging Block List"
        set type address
        set resource "https://rules.emergingthreats.net/fwrules/emerging-Block-IPs.txt"
    next
    edit "Compromised IPs"
        set type address
        set resource "https://rules.emergingthreats.net/blockrules/compromised-ips.txt"
    next
    edit "Threatfox IOC"
        set type address
        set resource "https://raw.githubusercontent.com/elliotwutingfeng/ThreatFox-IOC-IPs/10fab10d6bf5a8996a0eeb01a840307d6884f554/ips.txt"
end

KPN

01 | KPN PPPoE - IPv4

Deze instructie neemt je stap voor stap mee door de configuratie van KPN PPPoE op je FortiGate.

Stap 1 - VLAN 6 aanmaken

Bij onderstaand voorbeeld word wan1 gebruikt, let er op dat je het juiste interface koppelt.

config system interface
    edit "KPN-INET-VL6" 
        set vdom "root"
        set role wan
        set interface "wan1"
        set mtu-override enable
        set mtu 1506
        set vlanid 6
    next
end

Stap 2 - PPPoE interface aanmaken

config system pppoe-interface
    edit "KPN-PPPoE"
        set device "KPN-INET-VL6"
        set username "internet"
        set password "internet"
    next
end

Stap 3 - PPPoE interface configureren

config system interface
    edit "KPN-PPPoE" 
        set vdom "root"
        set mode pppoe
        set type tunnel
        set external enable
        set role wan
        set dns-server-override disable
        set interface "KPN-INET-VL6" 
    next
end

Stap 4 - Statische route aanmaken

config router static
  edit 0
    set device KPN-PPPoE
  next
end

Stap 5 - Policy aanmaken

config firewall policy
    edit 0
        set name "any to internet - IPv4"
        set srcintf "any"
        set dstintf "KPN-PPPoE"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
end

Stap 6 - Internet connectiviteit testen

execute ping google.com

KPN

02 | KPN PPPoE - IPv6

Deze instructie gaat er vanuit dat je 01 | KPN PPPoE - IPv4 al gevolgd hebt.

Stap 1 - PPPoE interface voorzien van IPv6 flag

config system pppoe-interface
    edit "KPN-PPPoE"
        set ipv6 enable
    next
end

Stap 2 - PPPoE interface configureren met IPv6 adres

config system interface
    edit "KPN-PPPoE"
        config ipv6
            set ip6-address 2a02:xxxx:yyyy::ffff/128 ## Controleer je IPv6 prefix in de KPN app
        end
    next
end

Stap 3 - Statische route aanmaken

config router static6
    edit 0
        set device "KPN-PPPoE"
    next
end

Stap 4 - LAN interface configureren met IPv6 adres

config system interface
    edit "VLAN2001"
        config ipv6
            set ip6-address 2a02:xxxx:yyyy:2001::1/64
            set ip6-send-adv enable ## Verstuurd router advertisements
            set ip6-manage-flag enable ## Geeft aan dat je DHCP wil gebruiken in plaats van SLAAC
            set ip6-other-flag enable ## Geeft aan dat je middels DHCP de DNS servers mee wil geven
        end
    next
end

Stap 5 - DHCP server aanmaken

config system dhcp6 server
    edit 0
        set lease-time 86400
        set dns-service default
        set domain "domain.local"
        set subnet 2a02:xxxx:yyyy:2001::/64
        set interface "VLAN2001"
        config ip-range
            edit 1
                set start-ip 2a02:xxxx:yyyy:2001::1000
                set end-ip 2a02:xxxx:yyyy:2001::2000
            next
        end
    next
end

Stap 6 - Policy aanmaken

config firewall policy
    edit 0
        set name "any to internet - IPv6"
        set srcintf "any"
        set dstintf "KPN-PPPoE"
        set action accept
        set srcaddr6 "all"
        set dstaddr6 "all"
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
end

Stap 7 - Internet connectiviteit testen

execute ping6 google.com

KPN

03 | KPN - IPTV

In deze instructie maken we gebruik van VLAN1003 als IPTV VLAN

Stap 1 - VLAN 4 aanmaken

config system interface
    edit "KPN-IPTV-VL4"
        set vdom "root"
        set mode dhcp
        config client-options
            edit 1
                set code 60
                set type string
                set value "IPTV_RG"
            next
            edit 2
                set code 55
                set value "79"
            next
        end
        set distance 10
        set role wan
        set dns-server-override disable
        set interface "wan1"
        set vlanid 4
    next
end

Stap 2 - Statische route aanmaken

config router static
    edit 0
        set dst 213.75.112.0 255.255.248.0
        set device "KPN-IPTV-VL4"
        set dynamic-gateway enable
    next
end

Stap 3 - IPTV VLAN aanmaken

config system interface
    edit VLAN1003
        set vdom "root"
        set ip 10.10.3.6 255.255.255.248
        set role lan
        set interface "LACP" ## Replace with physical interface
        set vlanid 1003
    next
end

Stap 4 - DHCP server aanmaken

config system dhcp server
    edit 0
        set ntp-service local
        set default-gateway 10.10.3.6
        set netmask 255.255.255.248
        set interface "VLAN1003"
        config ip-range
            edit 1
                set start-ip 10.10.3.1
                set end-ip 10.10.3.5
            next
        end
        set dns-server1 195.121.1.34
        set dns-server2 195.121.1.66
    next
end

Stap 5 - Multicast policies aanmaken

config firewall multicast-policy
    edit 0
        set name "iTV > KPN"
        set logtraffic enable
        set srcintf "VLAN1003" ## Replace with IPTV VLAN
        set dstintf "KPN-IPTV-VL4"
        set srcaddr "all"
        set dstaddr "all"
        set snat enable
    next
    edit 0
        set name "KPN > iTV"
        set logtraffic enable
        set srcintf "KPN-IPTV-VL4"
        set dstintf "VLAN1003" ## Replace with IPTV VLAN
        set srcaddr "all"
        set dstaddr "all"
    next
end

Stap 6 - IPTV policy maken richting KPN

config firewall policy
    edit 0
        set name "IPTV to KPN"
        set srcintf "VLAN1003" ## Replace with IPTV VLAN
        set dstintf "KPN-IPTV-VL4"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
end

Stap 7 - Internet policy maken voor TV ontvanger

Deze stap is bedoeld om streamingsdiensten zoals Netflix of Spotify te laten werken

config firewall policy
    edit 0
        set name "IPTV to internet"
        set srcintf "VLAN1003" ## Replace with IPTV VLAN
        set dstintf "KPN-INET-VL6"
        set srcaddr "all"
        set dstaddr "all"
        set action accept
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
end

Ziggo

01 | Ziggo - IPv4

Ziggo is in tegenstelling tot KPN heel simpel op te zetten gezien je bij Ziggo direct een IP krijgt op je WAN ipv op een PPPoE tunnel.

Stap 1 - WAN interface configureren

config system interface
    edit "wan1"
        set vdom "root"
        set mode dhcp
        set type physical
        set role wan
        set dns-server-override disable
    next
end

Stap 2 - Statische route aanmaken

config router static
  edit 0
    set device wan1
  next
end

Stap 3 - Policy aanmaken

config firewall policy
    edit 0
        set name "any to internet - IPv4"
        set srcintf "any"
        set dstintf "wan1"
        set action accept
        set srcaddr "all"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
    next
end

Stap 4 - Internet connectiviteit testen

execute ping google.com

Ziggo

02 | Ziggo - IPv6

Stap 1 - WAN interface configureren

config system interface
    edit "wan1"
        set vdom "root"
        set mode dhcp
        set type physical
        set role wan
        config ipv6
            set ip6-mode dhcp
        end
        set dns-server-override disable
    next
end

Stap 2 - Statische route aanmaken

config router static6
    edit 0
        set device "wan1"
    next
end

Stap 3 - LAN interface configureren met IPv6 adres

IP adressen in het netwerk worden uitgedeeld met SLAAC in deze instructie, hierdoor is er geen DHCP server configuratie nodig.

config system interface
    edit "VL2001"
        config ipv6
            set ip6-mode delegated
            set ip6-send-adv enable
            config ip6-delegated-prefix-list
                edit 1
                    set upstream-interface "wan1"
                    set subnet 2001:xxxx:yyyyy:2001::/56
                next
            end
        end
        set interface "LACP" ## Change to physical interface
        set vlanid 2001
    next
end

Stap 4 - Policy aanmaken

config firewall policy
    edit 0
        set name "any to internet - IPv6"
        set srcintf "any"
        set dstintf "wan1"
        set action accept
        set srcaddr6 "all"
        set dstaddr6 "all"
        set schedule "always"
        set service "ALL"
        set logtraffic all
    next
end

Stap 5 - Internet connectiviteit testen

execute ping6 google.com

SSL-VPN

01 | SSL-VPN Loopback interface

Als je je SSL-VPN interface veranderd naar een Loopback interface dan kan je L7 firewalling toepassen middels reguliere firewall policies in plaats van enkel L3 en L4 middels local-in policies.

Stap 1 - Loopback interface aanmaken

config system interface
    edit "SSL-VPN-LO"
        set vdom "root"
        set ip 172.25.100.1 255.255.255.255
        set allowaccess ftm
        set type loopback
        set role dmz
    next
end

Stap 2 - DNAT aanmaken middels VIP

config firewall vip
    edit "SSL-VPN-LO-IP4"
        set extip <external IP> ## Check with myip.nl for example
        set mappedip "172.25.100.1"
        set extintf "any"
        set portforward enable
        set extport 8443 ## Change to a different port if SSL-VPN is running on a different port
        set mappedport 8443 ## Change to a different port if SSL-VPN is running on a different port
    next

Stap 3 - Policy aanmaken

config firewall policy
    edit 0
        set name "INET to Loopback SSL-VPN"
        set srcintf "KPN-INET-VL6"
        set dstintf "SSL-VPN-LO"
        set action accept
        set srcaddr "all"
        set dstaddr "SSL-VPN-LO-IP4"
        set schedule "always"
        set service "T8443"
        set logtraffic all
    next
end

Stap 4 - SSL-VPN configuratie aanpassen met loopback interface

config vpn ssl settings
    set port 8443
    set source-interface "SSL-VPN-LO"
end

SSL-VPN

02 | SSL-VPN FortiToken Push melding

Er zijn meerdere manieren om MFA authenticatie aan te zetten voor je gebruikers om te verbinden met de SSL-VPN, hieronder behandelen we de FortiToken. Standaard krijg je er twee gratis.

Stap 1 - FortiToken toekennen aan gebruiker

config user local
    edit "joshua.bergman"
        set type password
        set two-factor fortitoken
        set fortitoken "XXXXXXXXXXXXXX"
        set email-to "josh.bergman@xxxxxxxx.com"
    next
end

Stap 2 - FortiToken Push activeren

Ik ga er hier van uit dat je 01 | SSL-VPN Loopback interface gevolgd hebt

config system interface
    edit "SSL-VPN-LO"
        set allowaccess ftm
    next
end

Stap 3 - FortiToken Mobile App installeren

Gebruiker krijgt een mailtje om de FortiToken te activeren.
Gebruiker dient hiervoor de FortiToken Mobile App te hebben geinstalleerd op een mobiel apparaat

Stap 4 - DNAT aanmaken middels VIP

config firewall vip
    edit "SSL-VPN-LO-IP4-FTM"
        set extip <external IP>
        set mappedip "172.25.100.1"
        set extintf "any"
        set portforward enable
        set extport 4433
        set mappedport 4433
    next
end

Stap 5 - Service aanmaken

config firewall service custom
    edit "FTM"
        set category "Remote Access"
        set tcp-portrange 4433
    next
end

Stap 6 - Policy aanmaken

config firewall policy
    edit 0
        set name "INET to Loopback SSL-VPN - FTM"
        set srcintf "KPN-INET-VL6"
        set dstintf "SSL-VPN-LO"
        set action accept
        set srcaddr "all"
        set dstaddr "SSL-VPN-LO-IP4-FTM"
        set schedule "always"
        set service "FTM"
        set logtraffic all
    next
end

SSL-VPN

03 | SSL-VPN E-Mail MFA

Ik ga er in deze instructie van uit dat de gebruiker al bestond en al toegang had tot de SSL-VPN tunnel

Stap 1 - E-Mail MFA toekennen aan gebruiker

config user local
    edit "joshua.bergman"
        set type password
        set two-factor email
        set email-to "josh.bergman@outlook.com"
    next
end

ADVPN

DNS

01 | DDNS

config system ddns
    edit 1
        set ddns-server FortiGuardDDNS
        set ddns-domain "<fqdn>.fortiddns.com"
        set use-public-ip enable
        set monitor-interface "KPN-PPPoE"
    next
end

Policies

01 | Local-in policy

Met de functie Local in Policy op een FortiGate apparaat kun je de toegang tot de administratieve interfaces van de firewall beheren. Deze policy maakt het mogelijk om specifieke toegangspaden voor beheerders te configureren, zodat je kunt bepalen welke IP-adressen of netwerken wel of niet toegang krijgen tot de beheermogelijkheden van het apparaat. Dit is een belangrijk hulpmiddel voor het versterken van de beveiliging, aangezien het het risico op ongeautoriseerde toegang tot de device instellingen vermindert.

config firewall local-in-policy
    edit 1
        set intf "<WAN interface>"
        set srcaddr "<Firewall address>"
        set dstaddr "all"
        set action accept
        set service "ALL_ICMP" "SNMP"
        set schedule "always"
    next
    edit 2
        set intf "<WAN interface>"
        set srcaddr "all"
        set dstaddr "all"
        set service "ALL"
        set schedule "always"
    next
end

Deze regels zorgen ervoor dat alleen verkeer voor ICMP (ping) en SNMP (voor netwerkbeheer) wordt toegestaan naar de firewall via de opgegeven WAN-interface, terwijl al het andere verkeer wordt geblokkeerd. De eerste regel staat specifiek ICMP en SNMP toe vanaf een bepaald IP-adres, terwijl de tweede regel alle andere diensten voor elke bron blokkeert.

Policies

02 | Negate Policy

Negate kun je gebruiken als omgekeerd policy object.
Geef je bijvoorbeeld aan dat je RFC1918 als destination Negate, dan word alles toegestaan behalve RFC1918.

Deze functie gebruik je bijvoorbeeld als je al het internet verkeer wil toestaan behalve bepaalde URL's, hiermee heb je dan maar 1 policy in plaats van 2.

In het voorbeeld hieronder kun je naar alle internet adressen toe, behalve 1.1.1.1

config firewall policy
    edit 0
        set srcintf "VLAN2001"
        set dstintf "wan1"
        set action accept
        set srcaddr "N-10.20.1.0/24"
        set dstaddr "H-1.1.1.1"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
        set dstaddr-negate enable
    next
end

Fortimanager

Bulk retrieve config

Create a script in FortiManager -> Device Manager -> Scripts -> Create New.

Type: CLI Script.
Run script on: Remote ForitGate Directly (via CLI):

diagnose fdsm cfg-upload 'comment' <----- Any comment can be set, it will be used to identify the retrieve in the revision history.

Select OK to save.

Note:

For FortiGates with VDOMs enabled, the script should be modified to this:

config global

diagnose fdsm cfg-upload 'comment'

Running the script on all FortiGates:

Select the FortiGates and select the right arrow:

Select Run:

Select OK:

<span class='highlight' style='background-color:yellow'>click</span>_ok.png

The script will start running:

Go to Device Manager and the configuration status of FortiGates should show synchronized. If any FortiGate is not showing synchronized, 'right-click' on the device and select 'Refresh Device'.

In the Total Revisions for each FortiGate, there will be a 'Retrieve' entry with the 'comment' in the comments section.

Note 1:

Script Status/logs can also be checked from: System Settings -> Task Monitor:

Note 2:

Bulk retrieval can also be done by selecting the notification icon on the top, but it only works if the devices are either in a 'conflict' or 'out-of-sync' state.

Dynamische routering

01 | BGP (Draft)

Security Fabric

01 | External Connectors

GEO

Je kan onder Security Fabric -> External Connectors allerlei lijsten toevoegen die niet afhankelijk zijn van een FortiGuard licentie.
Zo kan je bijvoorbeeld een IP lijst opvoeren met alle IP reeksen uit een bepaald land, hieronder staan er een aantal gespecificeerd.

Stel dat je de IP lijst van Nederland importeert, dan kan je deze bijvoorbeeld aan je SSL-VPN hangen zodat je alleen mag verbinden vanuit Nederland.

Hier kan je alle landen vinden: rir-ip/country at master · ipverse/rir-ip
Let op, de lijsten zijn niet van Fortinet, er is geen garantie dat deze lijsten actief bij worden gehouden.

config system external-resource
    edit "BE - IPs"
        set uuid 65632f48-e71e-51ef-b723-04eddcdc6642
        set type address
        set resource "https://raw.githubusercontent.com/ipverse/rir-ip/refs/heads/master/country/be/ipv4-aggregated.txt"
    next
    edit "BE - IPv6"
        set uuid 50cd53fa-f14c-51ef-c9ad-c1f65978f354
        set type address
        set resource "https://raw.githubusercontent.com/ipverse/rir-ip/refs/heads/master/country/be/ipv6-aggregated.txt"
    next
    edit "DE - IPs"
        set uuid a2eb10a6-e71e-51ef-7c05-a2a8d9ffd6d9
        set type address
        set resource "https://raw.githubusercontent.com/ipverse/rir-ip/refs/heads/master/country/de/ipv4-aggregated.txt"
    next
    edit "DE - IPv6"
        set uuid 5f5cdeea-f14c-51ef-1691-3ea3b4749926
        set type address
        set resource "https://raw.githubusercontent.com/ipverse/rir-ip/refs/heads/master/country/de/ipv6-aggregated.txt"
    next
    edit "NL - IPs"
        set uuid 272a92d4-e71e-51ef-932d-7c06156001c2
        set type address
        set resource "https://raw.githubusercontent.com/ipverse/rir-ip/refs/heads/master/country/nl/ipv4-aggregated.txt"
    next
    edit "NL - IPv6"
        set uuid 3ee5463e-f14c-51ef-1367-705307682e46
        set type address
        set resource "https://raw.githubusercontent.com/ipverse/rir-ip/refs/heads/master/country/nl/ipv6-aggregated.txt"
    next
end

APR - Apple Private Relay

Als je een iCloud abbonement hebt dan kan je gebruik maken van APR, dit houd in dat al je internetverkeer via proxies van Apple geleid word, hierdoor ben je minder zichtbaar op het internet. Er is echter wel een nadeel, namelijk dat die servers niet opgenomen zijn in de lijsten van hierboven. Om APR toe te staan op je FortiGate zijn hieronder de lijsten voor IPv4 en IPv6

Apple heeft hiervoor een CSV gedeeld: mask-api.icloud.com/egress-ip-ranges.csv

Github gebruiker hroost heeft hiervoor een script gemaakt om dit om te zetten naar lijsten die door de FortiGate gelezen kunnen worden: hroost/icloud-private-relay-iplist: List of iCloud Private Relay egress IP addresses in various formats for easy integration into your network infrastructure

config system external-resource
    edit "Apple Private Relay - IPs"
        set uuid 9848b88a-e721-51ef-aaed-c07a4bdf73ca
        set type address
        set resource "https://raw.githubusercontent.com/hroost/icloud-private-relay-iplist/refs/heads/main/ipv4/ipv4-ranges.txt"
    next
    edit "Apple Private Relay - IPv6"
        set uuid 1e638452-f14c-51ef-2e76-18c2765d2308
        set type address
        set resource "https://raw.githubusercontent.com/hroost/icloud-private-relay-iplist/refs/heads/main/ipv6/ipv6-ranges.txt"
    next
end

SNMP settings

Fortigate

To gather Port IP info & routing info for Fortigates, disable the append-index feature. This feature appends VDOM to the index, breaking standard MIBs.

config system snmp sysinfo
    set append-index disable
end

https://docs.fortinet.com/document/fortigate/7.2.0/new-features/742119/enabling-the-index-extension-7-2-8

Wireless-controller

Hitless Rolling AP upgrade

This release introduces Hitless Rolling upgrades for FortiAPs. When upgrading FortiAPs, an algorithm considers the reach of neighboring APs and their locations. The APs are then upgraded in staggered process with some APs being immediately upgraded while others continue to provide Wi-Fi service to clients and are placed in a standby queue. Once the SSIDs on the initial upgraded APs are able to serve clients, the APs in the standby queue begin upgrading.

CLI changes

The following CLI commands for configuring Hitless Rolling AP upgrades have been added to both global settings and per-VDOM settings:

Enabling Hitless Rolling Upgrade at the global level

config wireless-controller global
  set rolling-wtp-upgrade {Enable | disable}
  set rolling-wtp-upgrade-threshold <integer>
end

rolling-wtp-upgrade

Enable/disable rolling WTP upgrade (default = disable).

Note: Enabling this at the global-level will enforce all managed FortiAPs in all VDOMs to implement the rolling upgrade, regardless of the VDOM-level settings.

rolling-wtp-upgrade-threshold

Minimum signal level/threshold in dBm required for the managed WTP to be included in rolling WTP upgrade (-95 to -20, default = -80).

Enabling Hitless Rolling Upgrade at the per-VDOM level

config wireless-controller setting
  set rolling-wtp-upgrade {Enable | disable}
end

rolling-wtp-upgrade

Enable/disable rolling WTP upgrade (default = disable).

Note: Enabling this at the VDOM-level will let managed FortiAPs in the current VDOM to implement the rolling upgrade, regardless of the global-level setting.

Executing Hitless Rolling Upgrade

exec wireless-controller rolling-wtp-upgrade <all>|<SN>|<wtp-group>

rolling-wtp-upgrade

Select which APs you want to upgrade with the Hitless Rolling upgrade. You can select all APs, by their WTP serial number, or WTP group.

To configure Hitless Rolling AP upgrade - GUI

Before you can run Hitless Rolling AP upgrade from the GUI, you must first enable rolling-wtp-upgrade and configure the rolling-wtp-upgrade-threshold level in the CLI.

config wireless-controller global
  set rolling-wtp-upgrade enable
  set rolling-wtp-upgrade-threshold -70
end

config wireless-controller setting
  set rolling-wtp-upgrade enable
end

From the FortiGate GUI, go to WiFi & Switch Controller > Managed FortiAPs.
Select multiple FortiAPs of the same model, and then right-click and select Upgrade.

The Upgrade FortiAPs window loads.
Upload the FortiAP image file and click Upgrade.

The FortiAPs are automatically upgraded using the Hitless Rolling upgrade method.
Some FortiAPs immediately begin upgrading while others are marked with "ISSU queued". In-Service Software Upgrade (ISSU) indicates that these are the standby APs that continue to provide Wi-Fi service to clients and are queued to be upgraded later.
Once the first batch of FortiAPs are upgraded and can provide service, the ISSU queued FortiAPs will begin upgrading.

To configure Hitless Rolling AP upgrade - CLI

Enable rolling-wtp-upgrade at either the global or VDOM level and configure the rolling-wtp-upgrade-threshold level.

config wireless-controller global
  set rolling-wtp-upgrade enable
  set rolling-wtp-upgrade-threshold -70
end

config wireless-controller setting
  set rolling-wtp-upgrade enable
end

Upload FortiAP images to FortiGate and check the image list. In this example, FAP231F is uploaded:

execute wireless-controller upload-wtp-image tftp /FortiAP/v7.00/images/build0626/FAP_231F-v7-build0626-FORTINET.out 172.18.52.254

Verify the uploaded FortiAP images:

execute wireless-controller list-wtp-image
WTP Images on AC:
ImageName                              ImageSize(B)   ImageInfo             ImageMTime
…
FP231F-v7.4.2-build0626-IMG.wtp        37605058       FP231F-v7.4-build0626  Mon Nov 27 10:39:53 2023

Run the Rolling WTP Upgrade and prepare to check the FortiAP upgrade status.
```
exec wireless-controller rolling-wtp-upgrade all
```

Promptly check the FortiAP upgrade status to verify that the APs are upgrading:

diagnose wireless-controller wlac -c ap-upd

1,50,66 0-FP231FTF23037012 FP231F-v7.4-build0591 ==> FP231F-v7.4-build0626 ws (0-10.233.10.7:5246) upd-download,3 5%           <- The image download has started (may still be blocked by concurrent AP image downloading limit)
2,50,66 0-FP231FTF23037026 FP231F-v7.4-build0591 ==> FP231F-v7.4-build0626 ws (0-10.233.10.3:5246) upd-download,3 6%
3,50,66 0-FP231FTF23037047 FP231F-v7.4-build0591 ==> FP231F-v7.4-build0626 ws (0-10.233.10.24:5246) upd-download,3 6%
…
15,50,66 0-FP431FTF23000559 FP431F-v7.4-build0591 ==> FP431F-v7.4-build0626 ws (0-10.233.30.40:5246) upd-enqueue-issu,4 0%      <- In queue for rolling AP upgrade to avoid Wi-Fi service drop
16,50,66 0-FP431FTF23021146 FP431F-v7.4-build0591 ==> FP431F-v7.4-build0626 ws (0-10.233.30.42:5246) upd-enqueue-issu,4 0%
…
19,50,66 0-FP433FTF21001215 FP433F-v7.4-build0591 ==> FP433F-v7.4-build0626 ws (0-10.233.30.41:5246) upd-enqueue-issu,4 0%
…

After a few minutes, check the FortiAP upgrade status again to see any changes:

diagnose wireless-controller wlac -c ap-upd

1,44,66 0-FP231FTF23037012 FP231F-v7.4-build0626 ws (0-10.233.10.7:5246) upd-ap-up,58      <- The AP has reconnected after image upgrade
…
7,44,66 0-FP231FTF23037232 FP231F-v7.4-build0626 ws (0-10.233.10.36:5246) upd-ssid-up,5    <- The AP's SSIDs are UP after image upgrade
…
15,44,66 0-FP431FTF23000559 FP431F-v7.4-build0591 ==> FP431F-v7.4-build0626 ws (0-10.233.30.40:5246) upd-enqueue-issu,404 0%      <- Still in queue for rolling AP upgrade to avoid Wi-Fi service drop
16,44,66 0-FP431FTF23021146 FP431F-v7.4-build0591 ==> FP431F-v7.4-build0626 ws (0-10.233.30.42:5246) upd-enqueue-issu,404 0%
…
19,44,66 0-FP433FTF21001215 FP433F-v7.4-build0591 ==> FP433F-v7.4-build0626 ws (0-10.233.30.41:5246) upd-enqueue-issu,404 0%
…

After a few more minutes, check the FortiAP upgrade status again to see APs in the queue begin upgrading:

diagnose wireless-controller wlac -c ap-upd

1,48,66 0-FP231FTF23037012 FP231F-v7.4-build0626 ws (0-10.233.10.7:5246) upd-ssid-up,6
…
15,48,66 0-FP431FTF23000559 FP431F-v7.4-build0591 ==> FP431F-v7.4-build0626 ws (0-10.233.30.40:5246) upd-download,12 48%      <- Previously queued APs have begun the upgrade process since enough SSIDs from other APs are up to provide service
16,48,66 0-FP431FTF23021146 FP431F-v7.4-build0591 ==> FP431F-v7.4-build0626 ws (0-10.233.30.42:5246) upd-download,12 49%
…
19,48,66 0-FP433FTF21001215 FP433F-v7.4-build0591 ==> FP433F-v7.4-build0626 ws (0-10.233.30.41:5246) upd-download,12 47%

Troubleshooting

01 | GREP

De FortiGate CLI biedt een ingebouwde versie van het grep-commando waarmee je output efficiënt kunt filteren.

GREP | Opties

Usage: grep [-invfcABC] PATTERN
Options:
        -i      Ignore case distinctions
        -n      Print line number with output lines
        -v      Select non-matching lines
        -f      Print fortinet config context
        -c      Only print count of matching lines
        -A      Print NUM lines of trailing context
        -B      Print NUM lines of leading context
        -C      Print NUM lines of output context

GREP | Simpele query

Met een simpele GREP query kan je zien of de waarde voor komt in de config

LNNLROSEBFW001 (JP) # show sys int | grep VLAN2001
    edit "VLAN2001"

GREP | Configuratie blok query

Door middel van de -f flag kan je de volledige config zien van waar de waarde in voor komt

LNNLROSEBFW001 (JP) # show sys int | grep -f VLAN2001
config system interface
    edit "VLAN2001" <---
        set vdom "JP"
        set ip 10.20.1.254 255.255.255.0
        set alias "Intern VLAN"
        set device-identification enable
        set monitor-bandwidth enable
        set role lan
        set interface "ae1"
        set vlanid 2001
    next
end

GREP | Meerdere waardes

Door middel van '<waarde1>\|<waarde2>' kan je meerdere waardes opvragen, hierbij kan je uiteraard ook weer de -f flag gebruiken

LNNLROSEBFW001 (JP) # show sys int | grep 'VLAN2001\|VLAN2002'
    edit "VLAN2001"
    edit "VLAN2002"

Issues

BUG 1164092 NP7 FortiGates v7.2.11 may stop sending traffic out on certain interfaces

https://community.fortinet.com/t5/FortiGate/Troubleshooting-Tip-NP7-FortiGates-on-v7-2-11-may-stop-sending/ta-p/396301

1128652, 1164092

On NP7 platforms, a change in the destination MAC address or fib change may cause traffic to stop on certain interfaces.

Workaround: Disable offload on policy rules.

Issues

BUG 1128662 BGP peering fails

1128662

BGP peering fails to establish when a race condition occurs between FortiGate OS and NPU driver during IPsec SA updates for dynamic hub-to-static spoke VPNs.

FIX

Restart vpn tunnel

IPsec VPN

01 | IPsec Dial Up VPN (Vervanger voor SSL-VPN)

SSL-VPN is voortaan niet meer beschikbaar op de entry level modellen van Fortinet.
Tevens is het gebruik van SSL-VPN ook niet altijd even veilig gebleken in het verleden.
Hieronder staan een aantal stappen om de IPsec Dial Up VPN te configureren op basis van lokale gebruikers.

Stap 1 - Phase 1 interface aanmaken

config vpn ipsec phase1-interface    
    edit "DU-VPN"
        set type dynamic                    ## Dynamic allows multiple clients to connect
        set interface "wan1"                ## Bind to the incomming interface
        set ike-version 2                   ## use IKEv2 for negotiation
        set peertype one                    ## Only allow one specific peer ID
        set net-device disable              
        set mode-cfg enable                 ## Mode cfg, allow clients to dynamically get an IP and DNS settings
        set proposal aes256-sha256          ## Encryption/authentication proposal
        set localid <redacted>>             ## Local ID (remote ID on client)
        set dhgrp 16                        ## Diffie-Hellman group
        set eap enable                      ## Enable EAP (Username / Password authentication)
        set eap-identity send-request       ## how to handle EAP identity requests from the client
        set fec-egress enable               ## Forward Error Correction (FEC), for noisy links such as 4G/5G
        set fec-codec rs
        set fec-ingress enable
        set peerid <redacted>               ## Peer ID (local ID on client)
        set ipv4-start-ip 10.32.250.10 
        set ipv4-end-ip 10.32.250.30
        set ipv4-netmask 255.255.255.224    ## Subnet mask for mode cfg
        set dns-mode auto                   ## Add DNS to mode cfg
        set save-password enable            ## Allow user to store password on client
        set client-auto-negotiate enable    ## Allow client to auto-negotiate the tunnel at startup
        set client-keep-alive enable        ## Keepalive to maintain idle tunnel
        set psksecret <redacted>            ## Pre-shared key
        set dpd-retryinterval 60            ## Dead Peer Detection
    next
end

Stap 2 - Phase 2 configureren

config vpn ipsec phase2-interface
    edit "DU-VPN-IPv4"
        set phase1name "DU-VPN"             ## link back to the phase1 interface defined earlier
        set proposal aes256-sha256          ## ESP proposal for the IPsec tunnel (AES-256 + SHA-256)
        set dhgrp 16                        ## DH group for PFS (set to match policy requirements)
        set replay disable                  
        set keepalive enable                ## keepalive will try to maintain the tunnel association
    next
end

Stap 3 - Phase 1 interface configureren

config system interface
    edit "DU-VPN"
        set vdom "root"                             ## VDOM the interface belongs to (single VDOM named root here)
        set ip 10.32.250.1 255.255.255.255          ## Local IP assigned to the firewall side of the tunnel (/32 common)
        set type tunnel                             ## mark as a tunnel interface
        set remote-ip 10.32.250.1 255.255.255.224   ## define the remote subnet that clients will be in (pool/netmask)
        set interface "wan1"                        
    next
end

Stap 4 - Zone aanmaken (optioneel)

config system zone                          ## Zone to group the VPN interface for easier firewall policy management
    edit "Z-VPN-DU"
        set interface "DU-VPN"              ## add the virtual DU-VPN interface to this zone
    next
end

Stap 5 - Lokale gebruiker aanmaken

config user local
    edit "firstname.lastname"
        set type password
        set email-to "firstname.lastname@example.com"
        set passwd <redacted>
    next
end

Stap 6 - Firewall groep aanmaken

config user group
    edit "DU-VPN-USERS"
        set member "firstname.lastname"
    next
end

Stap 7 - Policy aanmaken

config firewall policy
    edit 48
        set name "Dial-up VPN user -> INET"
        set srcintf "Z-VPN-DU"
        set dstintf "wan1"
        set action accept
        set srcaddr "N-10.32.250.0/27"
        set dstaddr "all"
        set schedule "always"
        set service "ALL"
        set logtraffic all
        set nat enable
        set groups "DU-VPN-USERS"
    next

Public Cloud - Azure

01 | MGMT interface HA cluster

Inleiding

Standaard heeft een FortiGate in Azure 4 netwerk poorten, namelijk;

Port1 - Extern
Port2 - Intern
Port3 - HA
Port4 - MGMT

Middels een UDR laat je al het verkeer binnen komen op het IP van Port2.
Internetverkeer gaat naar buiten via Port1

De HA koppeling maakt gebruik van Port3 en MGMT gaat via Port4

Wanneer een FortiGate (Azure) in HA geplaatst word dan worden alle instellingen gesynct, waaronder dus de interfaces.
Dit is voor het MGMT interface niet wenselijk wanneer je beide nodes apart wil monitoren.

Hier is een trucje voor :)

Stap 1 - Log in op de FortiGate (via de Azure console)

Stap 2 - Controleer de VDOM's

diag sys vd list

Hier zou je het volgende VDOM moeten zien: vsys_ha, dit is het "hidden HA" VDOM

Stap 3 - Navigeer naar het HA VDOM

diag sys vd set vsys_ha

Stap 4 - Conigureer het MGMT interface

config system ha
  set ha-mgmt-status enable
  config ha-mgmt-interfaces
    edit 1
      set interface port4
      set gateway x.x.x.x
    next
  end
  set ha-direct enable
end

Stap 5 - Navigeer terug naar het root VDOM

diag sys vd set root

Tip: ha-direct zorgt ervoor dat onder andere je FortiAnalyzer en FortiManager verkeer via het MGMT interface lopen.