githubfoam

#=====================================================================
diagnose sniffer packet vs diag debug flow filter

# diagnose sniffer packet checks if the packet reaches fortigate
# diag debug flow filter checks packet's traffic within fortigate internally

diagnose debug flow #trace per-packet operations for flow tracing
diagnose sniffer packet #trace per-Ethernet frame
#=====================================================================
#WEB GUI v7.2.3

githubfoam

----------------------------------------------------------------------------------------------------
#detect rogue dhcp server

nmap -sU -p67,68 --script dhcp-discover <network_range>
sudo nmap --script broadcast-dhcp-discover
sudo nmap --script broadcast-dhcp-discover -e eth0 
----------------------------------------------------------------------------------------------------
Wireshark Output for nmap IP Fragment Scan (Sample):
Filter: ip.flags.mf == 1
No. Time Source Destination Protocol Length Info

Torxsmind

<# 
https://community.fortinet.com/t5/FortiGate/Technical-Tip-List-of-TCP-and-UDP-ports-used-by-the-FSSO/ta-p/194130
UDP/8002 – DC Agent keepalive and push logon info to Collector Agent
TCP/8001 – FortiGate to FSSO Collector Agent connection (SSL)
TCP/8000 – FortiGate to FSSO Collector Agent connection
TCP/8000 – NTLM
#>

$fgtIP = '192.168.0.1'
$DCs = @('192.168.0.51', '192.168.0.52', '192.168.0.61', '192.168.0.62')

githubfoam

#=====================================================================
#how to power off fortigate cluster
#unplug the power cables as there is no power buttons

shut down first the secondary(backup unit)
Unit-1 # execute ha manage 1                 {To switch to the backup unit}
Unit-2 $                                     {Now on the backup unit}
Unit-2 $ execute shutdown                    {To shut down the backup unit}
This operation will shutdown the system !
Do you want to continue? (y/n)y

githubfoam

#=================================================================================================================================
#ChatGPT

how to debug IPSengine in 6.4 or later:

# diagnose ips debug enable 
init              init
packet            packet
packet_detail     packet_detail
error             error

githubfoam

#=====================================================================
# Log&Report - Security Events - Web Filter, filter a specific URL. v7.2.3

#launch CLI from fortigate GUI
config webfilter profile #Configure Web filter profiles
get #list all profiles
edit profile-name
show # see current setting
set log-all-url enable
set extended-log enable

githubfoam

---------------------------------------------------------------------------------------------------------------------------
#exempting websites from deep inspection like github.com etc

method

#create group
Security Profiles > SSL/SSH Inspection > Profile1 > Addresses > + > Wildcard FQDN Group
#create members
Security Profiles > SSL/SSH Inspection > Profile1 > Addresses > + > Wildcard  "*.github.com

githubfoam

==========================================================================================================
#Gemini
==========================================================================================================
#ChatGPT
==========================================================================================================
#Gemini

Ensuring PowerShell DSC and Chocolatey are Installed

PowerShell DSC is a feature of PowerShell. If you have PowerShell installed on your Windows 10 system, DSC is likely already available.

githubfoam

#=====================================================================
#Bard

#configure an email alert on each successful VPN SSL connection on FortiGate 7.2:

Go to Security Fabric > Automation.
Click Create New.
In the Name field, enter a name for the automation stitch.
In the Trigger field, select FortiOS Event Log.
In the Event field, select SSL VPN Tunnel Up.

githubfoam

#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
only for "local" user account, no fortinet support on ms store

#====================================================================================================================================
# microsoft built-in vpn client on windows 11 , not working
# ChatGPT

let's explore examples to illustrate the differences between L2TP/IPsec and SSL VPN in practical scenarios: