1. Configuring the site-to-site IPsec VPN on FGT_1

Go to VPN > IPSec Wizard.

Name the VPN connection and select Site to Site.

Set IP Address to the Internet-facing interface.

Select Pre-shared Key for Authentication Method and enter the pre-shared key.

Set Local Interface to the internal interface and set Local Subnets to include the internal and SSL VPN subnets for FGT_1.

Set Remote Subnets to include the internal subnet for FGT_2.

2. Configuring SSL VPN settings

Go to VPN > SSL-VPN Settings and set Listen on Interface(s) to wan1.

To avoid port conflicts, set Listen on Port to 10443.

Set Restrict Access to Allow access from any host.

Under Tunnel Mode Client Settings, enable Specify custom IP ranges and include the SSL VPN subnet range created by the IPsec VPN wizard.

Under Authentication/Portal Mapping, add the VPN user group to the tunnel-access portal. Set All Other Users/Groups to the web-access portal.

3. Configuring the SSL VPN portal

Go to VPN > SSL-VPN Portals and edit the tunnel-access portal.

Turn on Enable Split Tunneling so that only traffic intended for the local or remote networks will flow through FGT_1 and be subject to the corporate security profiles.

Next to Routing Address, add the local and remote IPsec VPN subnets created by the IPsec VPN wizard.

Next to Source IP Pools, add the SSL VPN subnet range created by the IPsec VPN wizard.

4. Adding policies on FGT_1

Go to Policy & Objects > IPv4 Policy and create a new policy that allows SSL VPN users access to the internal network.

Set Incoming Interface to ssl.root and set Outgoing Interface to internal.

Set Source to the SSL VPN subnet created by the IPsec VPN wizard and add the VPN user group.

Set Destination to the local IPsec VPN subnet (which represents the internal subnet).

Set the Schedule and set Service to all.

Enable NAT.

Create another policy that allows SSL VPN users access to the IPsec VPN tunnel.

Set Incoming Interface to ssl.root and set Outgoing Interface to the IPsec tunnel interface (in this case, Site1).

Set Source to the SSL VPN subnet created by the IPsec VPN wizard and add the VPN user group.

Set Destination to the remote IPsec VPN subnet.

Set the Schedule and set Service to all.

Do NOT enable NAT.

5. Configuring the site-to-site IPsec VPN on FGT_2

Go to VPN > IPSec Wizard.

Name the VPN connection and select Site to Site.

Set IP Address to the Internet-facing interface.

Select Pre-shared Key for Authentication Method and enter the pre-shared key that matches the FGT_1 configuration.

Set Local Interface to the internal interface and set Local Subnets to include the internal network subnet for FGT_2.

Set Remote Subnets to include the internal and SSL VPN subnets for FGT_1.

6. Results

7. Debug

In order to diagnose potential issues, run the following debug commands on FGT_1 using the CLI Console:

diag debug reset
diag debug flow show function-name enable
diag debug flow show iprope enable
diag debug flow filter addr 192.168.177.99
diag debug flow filter proto 1
diag debug flow trace start 2
diag debug enable

Send a PING through the SSL VPN tunnel to 192.168.177.99 and analyze the output of the debug. Disable the debug output with the following command:

diag debug disable

If the traffic is entering the correct VPN tunnel on FGT_1, then run the same commands on FGT_2 to check whether the traffic is reaching the correct tunnel. If it is reaching the correct tunnel, confirm that the SSL VPN tunnel range is configured in the remote side quick mode selectors.

You can also run a sniffer command on FGT_1 as follows:

diag sniff packet any "host 192.168.177.99 and icmp" 4

If you suspect an IPsec VPN issue, run the following commands on either FortiGate:

diag debug reset
diag vpn ike gateway clear
diag debug application ike -1
diag debug enable

When you are satisfied with the debug output, disable the debug as follows:

diag debug disable

For more troubleshooting information for SSL VPN and IPsec VPN, refer to the following:

• SSL VPN Troubleshooting
• IPsec VPN Troubleshooting

1. Configuring the IPsec VPN on HQ

On HQ, go to VPN > IPsec Wizard and create a new tunnel.

In the VPN Setup step, set Template Type to Site to Site and Remote Device Type to FortiGate.

In the Authentication step, set IP Address to the public IP address of the Branch FortiGate (in the example, 172.25.177.46).

After you enter the IP address, an available interface will be assigned as the Outgoing Interface. If you want to use a different interface, select it from the drop-down menu.

Set a secure Pre-shared Key.

In the Policy & Routing step, set Local Interface to LAN. The local subnet is added automatically. Set Remote Subnets to Branch’s local subnet (in the example, 192.168.13.0/24).

A summary page shows the configuration created by the wizard, including firewall addresses, static routes, and security policies.

2. Configuring the IPsec VPN on Branch

On Branch, go to VPN > IPsec Wizard and create a new tunnel.

In the VPN Setup step, set Template Type to Site to Site and Remote Device Type to FortiGate.

In the Authentication step, set IP Address to the public IP address of the HQ FortiGate (in the example, 172.25.176.142).

After you enter the IP address, an available interface will be assigned as the Outgoing Interface. If you want to use a different interface, select it from the drop-down menu.

Set a secure Pre-shared Key that was used for the VPN on HQ.

In the Policy & Routing step, set Local Interface to LAN. The local subnet is added automatically. Set Remote Subnets to HQ’s local subnet (in the example, 192.168.37.0/24).

A summary page shows the configuration created by the wizard, including firewall addresses, static routes, and security policies.

3. Results

On either FortiGate, go to Monitor > IPsec Monitor to verify the status of the VPN tunnel. Right-click under Status and select Bring Up.

A user on either of the office networks should be able to connect to any address on the other office network transparently.

If you need to generate traffic to test the connection, ping Branch’s LAN interface from a device on HQ’s internal network.

The rack must be stabilized before sliding the unit out for servicing. Failure to stabilize may cause the rack to tip over.

Electrostatic discharge (ESD) can damage your Fortinet equipment.
To avoid personal injury or damage to the unit, it is recommended that two or more people install the unit into the rack.

Do not place heavy objects on the unit.

1. Enabling certificate management

2. Obtaining necessary certificates

This recipe requires the following files:

• Client certificate for HQ and its matching private key
• Client certificate for Branch and its matching private key
• CA certificate that issued HQ’s certificate
• CA certificate that issued Branch’s certificate

3. Installing the client certificates

The client certificate is used for authentication and represents the individual identity of each FortiGate.

On HQ, go to System > Certificates and select Import > Local Certificate.

Set Type to Certificate, choose the Certificate file and the Key file for HQ, and enter the Password for the key file, if applicable. You can also change the Certificate Name.

HQ’s client certificate now appears in the list of Certificates on HQ.

On Branch, go to System > Certificates and select Import > Local Certificate.

Set Type to Certificate, choose the Certificate file and the Key file for Branch, and enter the Password for the key file, if applicable. You can also change the Certificate Name.

Branch’s client certificate now appears in the list of Certificates on Branch.

4. Installing the CA certificates

The CA certificate is used for verifying the identity of the remote FortiGate’s client certificate, which we imported in step 3.

On HQ, go to System > Certificates and select Import > CA Certificate.

Set Type to File, and upload the CA certificate that issued HQ’s certificate.

On HQ, go to System > Certificates and select Import > CA Certificate.

Set Type to File, and upload the CA certificate that issued Branch’s certificate.

.

The CA certificates now appear in HQ’s list of External CA Certificates with the automatically generated names CA_Cert_1 and CA_Cert_2. 

Repeat this step exactly the same way on Branch.

5. Configuring the IPsec VPN on HQ

On HQ, go to VPN > IPsec Wizard and create a new tunnel.

In the VPN Setup step, set Template Type to Site to Site and Remote Device Type to FortiGate.

In the Authentication step, set IP Address to the public IP address of the Branch FortiGate (in the example, 172.25.177.46).

After you enter the IP address, an available interface will be assigned as the Outgoing Interface. If you want to use a different interface, select it from the drop-down menu.

Select Signature for the Authentication Method.

For the Certificate Name, we select the client certificate we imported in step 3 (in the example, FortiGate-HQ).

For the Peer Certificate CA, we select the CA certificate for Branch that we imported in step 4 (in the example, CA_Cert_2).

In the Policy & Routing step, set Local Interface to LAN. The local subnet is added automatically. Set Remote Subnets to Branch’s local subnet (in the example, 192.168.13.0/24).

A summary page shows the configuration created by the wizard, including firewall addresses, static routes, and security policies.

6. Configuring the IPsec VPN on Branch

On Branch, go to VPN > IPsec Wizard and create a new tunnel.

In the VPN Setup step, set Template Type to Site to Site and Remote Device Type to FortiGate.

In the Authentication step, set IP Address to the public IP address of the HQ FortiGate (in the example, 172.25.176.142).

After you enter the IP address, an available interface will be assigned as the Outgoing Interface. If you want to use a different interface, select it from the drop-down menu.

Select Signature for the Authentication Method.

For the Certificate Name, we select the client certificate we imported in step 3 (in the example, FortiGate-Branch).

For the Peer Certificate CA, we select the CA certificate for HQ that we imported in step 4 (in the example, CA_Cert_1).

In the Policy & Routing step, set Local Interface to LAN. The local subnet is added automatically. Set Remote Subnets to HQ’s local subnet (in the example, 192.168.37.0/24).

A summary page shows the configuration created by the wizard, including firewall addresses, static routes, and security policies.

Results

On either FortiGate, go to Monitor > IPsec Monitor to verify the status of the VPN tunnel. If the tunnel is showing down, right-click under Status and select Bring Up.

A user on either of the office networks should be able to connect to any address on the other office network transparently.

If you need to generate traffic to test the connection, ping Branch’s LAN interface from a device on HQ’s internal network.

 Configuring an LDAP Profile and Domain

First we’ll need to configure an LDAP Profile if not already created and then create a domain.

1. Go to Profile > LDAP > LDAP.
2. Select New.
3. Enter the required information and then select Create.
4. Go to Domain & User > Domain > Domain. 
5. Select New.
6. Enter the necessary information and select the previously created LDAP profile from the User profile dropdown menu.
7. Select Create.

 Configuring Webmail

Next we’ll need to configure the Webmail and save important FortiMail metadata. You must be in Advanced Mode to continue with the following steps.

1. Go to System > Customization > Appearance.
2. Expand the Web Portal section.
3. Select “3rd Party/Single Sign on” from the Login page dropdown menu.
4. Select Edit.
5. Copy the FortiMail Service Provider Metadata URL and download the FortiMail metadata using the URL. You’ll need this file for the next section.
6. Select OK and then Apply.

 Configuring FortiAuthenticator

Now we’ll need to configure FortiAuthenticator. 

1. Go to Authentication > SAML IdP > General.
2. Enable SAML IDP.
3. Select OK.
4. Go to Authentication > SAML IdP > Service Provider
5. Select Create New.
6. Copy the IDP entity id
7. Select Import SP metadata and select the metadata you downloaded in the previous section.
8. Select Create New in the SAML Attribute section and enter “urn:oid:0.9.2342.19200300.100.1.3” and set the User Attribute to “Email”.

 Configuring an LDAP Profile and Domain

First we’ll need to configure an LDAP Profile if not already created and then create a domain.

1. Go to Profile > LDAP > LDAP.
2. Select New.
3. Enter the required information and then select Create.
4. Go to Domain & User > Domain > Domain. 
5. Select New.
6. Enter the necessary information and select the previously created LDAP profile from the User profile dropdown menu.
7. Select Create.

 Configuring Webmail

Next we’ll need to configure the Webmail and save important FortiMail metadata. You must be in Advanced Mode to continue with the following steps.

1. Go to System > Customization > Appearance.
2. Expand the Web Portal section.
3. Select “3rd Party/Single Sign on” from the Login page dropdown menu.
4. Select Edit.
5. Copy the FortiMail Service Provider Metadata URL and download the FortiMail metadata using the URL. You’ll need this file for the next section.
6. Select OK and then Apply.

 Configuring FortiAuthenticator

Now we’ll need to configure FortiAuthenticator. 

1. Go to Authentication > SAML IdP > General.
2. Enable SAML IDP.
3. Select OK.
4. Go to Authentication > SAML IdP > Service Provider
5. Select Create New.
6. Copy the IDP entity id
7. Select Import SP metadata and select the metadata you downloaded in the previous section.
8. Select Create New in the SAML Attribute section and enter “urn:oid:0.9.2342.19200300.100.1.3” and set the User Attribute to “Email”.

 Enabling SMTP Authentication

First we’ll need to enable SMTP authentication.

1. Go to Dashboard > Console. Enter the following commands to enable the feature. And if there is a gateway before the mail server, add the gateway to the exempt list.
   config system security authserver
  set status enable
      config exempt-list
    edit 1
      set sender-ip-mask 172.20.140.232/32
    next
  end
end


Checking SMTP Authorization Score and Record

With SMTP authentication enabled, we can now look at a few things you can perform in the CLI:

1. You can display and delete automatically added IP addresses:
   #diagnose system authserver auto-exempt display
   and to delete the IP address, enter
   #diagnose system authserver auto-exempt delete xxxx
2. You can display the iptables statistics for currently blocked IP addresses: #diagnose system authserver iptables ipv4
3. You can get the authentication records for a specific IP address:
#diagnose system authserver records 172.20.140.230
4. You can get the authentication status of a specific IP address, showing you if it’s safe or if it’s blocked: 
   #diagnose system authserver status 172.20.140.231

1. Configuring External

In the Security Fabric, External is the root FortiGate. This FortiGate receives information from the other FortiGates in the Security Fabric and is used to run the Security Fabric Audit.

In the example, the following interfaces on External are used to connect to other network devices:

• Port 9 connects to the Internet (this interface was configured when External was initially installed)
• Port 10 connects to Accounting (IP address: 192.168.10.2)
• Port 11 connects to Marketing (IP address: 192.168.200.2)
• Port 16 connects to the FortiAnalyzer (IP address: 192.168.55.2)

On External, go to Network > Interfaces and edit port 10. Set an IP/Network Mask for the interface (in the example, 192.168.10.2/255.255.255.0).

Set Administrative Access to allow FortiTelemetry, which is required for communication between FortiGates in the Security Fabric.

Repeat this step to configure the other interfaces with the appropriate IP addresses, as listed above.

Go to Policy & Objects > IPv4 Policy and create a policy for traffic from Accounting to the Internet.

Enable NAT.

Go to Policy & Objects > IPv4 Policy and create a policy allowing Accounting and Marketing to access the FortiAnalyzer.

To enable communication between the FortiGates in the Security Fabric, go to Security Fabric > Settings and enable FortiGate Telemetry. Set a Group name and Group password.

FortiAnalyzer Logging is now enabled by default. Set IP address to an internal address that will later be assigned to port 1 on the FortiAnalyzer (in the example, 192.168.55.10).

2. Installing Accounting and Marketing

On Accounting, go to Network > Interfaces and edit WAN1.

Set an IP/Network Mask for the interface that is on the same subnet as port 10 on External (in the example, 192.168.10.10/255.255.255.0).

Edit the internal interface.

Set Addressing mode to Manual and set the IP/Network Mask to a private IP address (in the example, 10.10.10.1/255.255.255.0).

Set Administrative Access to allow FortiTelemetry.

If you require the FortiGate to provide IP addresses using DHCP to devices that connect to this interface, enable DHCP Server.

Under Networked Devices, enable Device Detection.

Go to Network > Static Routes and add a static route. Set Gateway to the IP address of port 10 on External.

Go to Policy & Objects > IPv4 Policy and create a policy to allow users on the Accounting network to access External.

Go to Security Fabric > Settings to add Accounting to the Security Fabric. Enable FortiGate Telemetry, then enter the same Group name and Group password that you set previously on External.

Enable Connect to upstream FortiGate and enter the IP address of port 10 on External.

FortiAnalyzer Logging is enabled by default. Settings for the FortiAnalyzer will be retrieved when Accounting connects to External.

If you have not already done so, connect WAN1 on Accounting to port 10 on External.

Connect and configure Marketing, using the same method you used to configure Accounting. Make sure to complete the following steps:

• Configure WAN1 to connect to External (IP address: 192.168.200.10/255.255.255.0)
• Configure the LAN interface for the Marketing network (IP address: 10.10.200.2/255.255.255.0)
• Create a static route pointing traffic to port 11 on External
• Create a policy to allow users on the Marketing network to access External
• Add Marketing to the Security Fabric

3. Installing Sales

On Marketing, go to Network > Interfaces and edit the interface that Sales will connect to (in the example, internal14).

Set an IP/Network Mask for the interface (in the example, 192.168.135.2/255.255.255.0).

Set Administrative Access to allow FortiTelemetry.

Go to Policy & Objects > IPv4 Policy and create a policy for traffic from Sales to External.

Enable NAT.

On Sales, go to Network > Interfaces and edit WAN2.

Set an IP/Network Mask for the interface that is on the same subnet as the internal 14 interface on Marketing (in the example, 192.168.135.10/255.255.255.0).

Edit the LAN interface.

Set Addressing Mode to Manual, and set the IP/Network Mask to a private IP address (in the example, 10.10.135.1/255.255.255.0).

Set Administrative Access to allow FortiTelemetry.

If you require the FortiGate to provide IP addresses, using DHCP, to devices that connect to this interface, enable DHCP Server.

Under Networked Devices, enable Device Detection.

Go to Network > Static Routes and add a route. Set Gateway to the IP address of the internal 14 interface on Marketing.

Go to Security Fabric > Settings to add Sales to the Security Fabric. Enable FortiGate Telemetry, then enter the same Group name and Group password that you set previously.

Enable Connect to upstream FortiGate and enter the IP address of the internal 14 interface on Marketing.

FortiAnalyzer Logging is enabled by default. Settings for the FortiAnalyzer will be retrieved when Accounting connects to External.

4. Configuring the FortiAnalyzer

On the FortiAnalyzer, go to System Settings > Network, select All Interfaces, and edit port 1. Set IP Address/Netmask to the IP address used for the Security Fabric configuration on External (192.168.55.10/255.255.255.0).

Add a Default Gateway, using the IP address of port 16 on External.

Go to Device Manager. The FortiGates are listed as Unregistered.

Select the FortiGates, then select +Add.

After a moment, a warning icon appears beside External because the FortiAnalyzer needs administrative access to the root FortiGate in the Security Fabric.

Select the FortiGate, then enter the administrative authentication information.

5. Running a Security Fabric Audit

You can use the Security Fabric Audit to analyze your Security Fabric deployment, identify potential vulnerabilities, and highlight best practices. Using the Security Audit helps you improve your network configuration, deploy new hardware and software, and gain more visibility and control over your network.

By regularly checking your network’s Security Score, which is determined by how many checks your network passes or fails during the Security Audit, and making the recommended improvements, you can have confidence that your network is getting more secure over time.

You must run the Security Fabric Audit on the root FortiGate in the Security Fabric.

On External, go to Security Fabric > Audit.

All the FortiGates in the Security Fabric are shown. Select Next.

At the top of the page, you can see your network’s Security Score, as well as the overall count of how many checks were passed or failed, with the failed checks divided by severity.

Further down, you can see information about each failed check, including which FortiGate failed the check, the effect on your network’s score, and the recommendation for fixing the issue.

Easy Apply recommendations may be automatically applied by the wizard in the next stage.

By using Easy Apply, you can change the configuration of any FortiGate in the Security Fabric, not just the root FortiGate.

Select all the changes you want to make, then select Apply Recommendations.

6. Results

On External, go to Dashboard > Main. The Security Fabric widget displays the names of the FortiGates in the Security Fabric.

The icons on the top indicate which other Fortinet devices can be used in a Security Fabric. Devices in blue are detected in your network, devices in gray are not detected in your network, and devices in red are also not detected in your network but are recommended for a Security Fabric.

Also located on the Dashboard is the Security Fabric Score widget, which displays your network’s current score.

If either of these widgets do not appear on your dashboard, they can be added using the settings button in the bottom right corner. This button appears when your mouse hovers over any part of the dashboard.

Go to Security Fabric > Physical Topology. This page shows a visualization of access layer devices in the Security Fabric.

Security Fabric Audit recommendations are also shown in the topology, next to the icon of the device the recommendations apply to.

Go to Security Fabric > Logical Topology. This dashboard displays information about the interface (logical or physical) that each device in the Security Fabric is connected to.

On the FortiAnalyzer, go to Device Manager. The FortiGates are now shown as part of a Security Fabric group. The * beside External indicates that it is the root FortiGate in the Security Fabric.

Right-click on the Security Fabric group and select Fabric Topology. The topology of the Security Fabric is displayed.

7. (Optional) Adding security profiles to the Security Fabric

The Security Fabric allows you to distribute security profiles to different FortiGates in your network, which can lessen the workload of each device and avoid creating bottlenecks. For example, you can implement antivirus scanning on External while the ISFW FortiGates apply application control and web filtering.

This results in distributed processing between the FortiGates in the Security Fabric, which reduces the load on each one. It also allows you to customize the web filtering and application control for the specific needs of the Accounting network as other internal networks may have different application control and web filtering requirements.

This configuration may result in threats getting through External, which means you should very closely limit access to the network connections between the FortiGates in the network.

On External, go to Policy & Objects > IPv4 Policy and edit the policy allowing traffic from Accounting to the Internet.

Under Security Profiles, enable AntiVirus and select the default profile.

Do the same for the policy allowing traffic from Marketing to the Internet.

On Accounting, go to Policy & Objects > IPv4 Policy and edit the policy allowing traffic from the Accounting network to the Internet.

Under Security Profiles, enable Web Filter and Application Control. Select the default profiles for both.

Repeat this step for both Marketing and Sales.

1. Connecting your ISPs to the FortiGate

Connect your ISP devices to your FortiGate so that the ISP you wish to use for most traffic is connected to WAN1 and the other connects to WAN2.

2. Creating redundant firewall policies

Go to Policy & Objects > IPv4 and create a firewall policy that allows traffic from your primary ISP (WAN1) to your internal network.

Set Incoming Interface to the interface of your internal network and set Outgoing Interface to the internet facing interface of the primary ISP.

Enable NAT and apply Security Profiles as required.

Enable Log Allowed Traffic for All Sessions so that you can verify the results later.

Go to Policy & Objects > IPv4 and create a firewall policy that allows traffic from your secondary ISP (WAN2) to your internal network.

Repeat the steps listed above.

3. Creating redundant routes

Go to Network > Static Routes and create a static route for each ISP. The primary ISP should have a higher route priority than the secondary ISP.

Create a new static route for the primary ISP, and set Gateway IP to the subnet of the WAN1 interface.

Set Interface to the WAN1 interface.

Under Advanced Options, set the Priority to a low number. In this example, 5. The route with a smaller value will have a higher priority. This route will be preferred over the route you will configure for your secondary backup ISP.

Create a static route for the secondary ISP.

Set Gateway IP to the subnet of the WAN2 interface.

Set Interface to wan2.

Under Advanced Options, set the Priority to a higher number. In this example, 10. Make sure the priority is set to a larger number than your previous route to ensure it is lower priority.

Make sure both static routes are set to an equal distance. In this example, the Distance is set to the default of 10 on both routes. This ensures that both default routes will remain in the routing table.

4. Configuring the link-monitor

You can use the CLI to configure the link-monitor. Go to Dashboard > CLI and enter the following commands to configure the link monitor for the WAN1 interface:

config system link-monitor
 edit wan1
         (wan1) #get
                  set name wan1
                  set server 8.8.4.4
                  set protocol ping
                  set gateway-ip 172.25.176.1 
                  set interval 5
                  set timeout 1
                  set failtime 5
                  set recoverytime 5
                  set update-cascade-interface enable
                  set update-static-route enable
                  set status enable
                end

Set the server to a reliable IP address to test your connection to the Internet with the WAN1 interface. In this example, the Google public DNS IP address, 8.8.4.4, is used (since the other Google IPv4 address, 8.8.8.8, is commonly used for other ping tests).

The gateway-ip uses the same gateway IP addresses configured in Step 3.

Configure the link monitor for the WAN2 interface:

config system link-monitor
 edit wan1
         (wan1) #get
                  set name wan2
                  set server 8.8.4.4
                  set protocol ping
                  set gateway-ip 192.168.13.1
                  set interval 5
                  set timeout 1
                  set failtime 5
                  set recoverytime 5
                  set update-cascade-interface enable
                  set update-static-route enable
                  set status enable
                end

5. Results

To test failover of the redundant Internet configuration, you must simulate a failed Internet connection.

First, verify that users still have Internet access by navigating to Policy & Objects > IPv4 Policy. Right-click on the primary Internet access policy and select Show in FortiView to see verify where traffic is flowing.

Physically disconnect the Ethernet cable from the Internet side of the ISP modem or device to simulate failover. Then, make sure that all traffic automatically goes through the WAN2 port, until WAN1 is available again. 

Go to Log & Report > System Events to confirm that the Link Monitor has changed state and that the static route for your primary ISP has been removed.

Go to Monitor > Routing Monitor to view the static routes in the routing table.

When the primary ISP connection is active, you will see an active route for WAN1 and WAN2. 

When the primary ISP connection fails, only the default route for WAN2 will appear.

Enter the following CLI command to view the routing table:

get router info routing-table all 

When the primary ISP connection is active, you will see an asterisk, *, with the routes for both WAN1 and WAN2 shown as active.

When the primary ISP connection fails, the route for WAN1 is automatically removed from the routing table.

Reconnect the cable when you have verified successful failover and you should find that traffic flows through only the primary ISP again.

 Hardening FortiMail

• Be sure to install your FortiMail unit in a secure location, such as a locked room with restricted access. Prohibiting access to your unit increases the security of the device, since unauthorized users could potentially disrupt your entire network through both unintentional and intentional interventions.
• Always remember to upgrade your firmware to the latest version
• Avoid generic administrator account names such as “admin”. If an attacker guesses your admin name they will only need to guess your password.
• Do not allow administration access on the external interface. Use internal access methods such as IPsec VPN or SSL VPN. If you have to use remote access, only allow HTTPS and SSH and be sure to use secure access methods.
• Be sure to establish trusted hosts for administrators to limit what computers administrators can use to access the unit. Identifying a trusted house forces the unit to only accept the administrator’s login from the configured IP address or subnet.
• Change the default administrator pot to a non-standard port.
• Register with support services to activate the warranty on your device.
• To avoid the possibility of an administrator walking away from the management computer and leaving it exposed, you can add an automatic idle time-out. If the web-based manager is not used for a specified amount of time, the unit automatically logs the administrator out.
• Enable automatic clock synchronization to facilitate auditing and consistency between expiry dates used in expiration of certificates and security protocols.
• Brute force password software can launch more than just dictionary attacks. It can discover common passwords where a letter is replaced by a number. For example, if “p4ssw0rd” is used as a password, it can be cracked. Create a safer password policy that administrators must follow to facilitate a safer connection.
• Set a lockout duration for when someone enters an incorrect password a specified number of times.

1. Creating the VLAN interfaces

Go to Network > Interfaces and select Create New > Interface.

Create the VLAN interface for VLAN ID 10 and enable the DHCP server option.

2. Creating the zone

Under Network > Interfaces, select Create New > Zone, name the zone LAN Zone, and add the newly created VLANs to the zone.

Leave Block intra-zone traffic enabled to prevent communication between the VLAN interfaces.

3. Creating a firewall policy for the zone

Navigate to Policy & Objects > IPv4 Policy and create a firewall policy allowing any VLAN in the “LAN Zone” permission to access the Internet.

Select any security profiles desired with best practices and business requirements in mind.

Results

Users from VLAN10, VLAN20, or VLAN30 will now have Internet access.

As new VLANs are added in the future, they can be added to “LAN Zone” without having to modify the firewall policy we created in Step 3.