DOCUMENT LIBRARY

FortiGate / FortiOS

FortiManager

FortiAnalyzer

Cookbook

What's New
802.1X with VLAN Switch interfaces on a FortiGate
- 1. Configuring a CA
- 2. Configuring RADIUS authentication
- 3. Configure the supplicant and test
- 4. Results
Adding Endpoint Control to the Security Fabric
- 1. Enabling endpoint control on the FortiGate
- 2. Enforcing FortiClient registration on the internal interface
- 3. Configuring the FortiClient Profile
- 4. Setting up a compliant FortiClient device
- 5. Results
Assigning WiFi users to VLANs dynamically
- 1. Configure the FortiAuthenticator
- 2. Add the RADIUS server to the FortiGate configuration
- 3. Create an SSID with dynamic VLAN assignment
- 4. Create the VLAN interfaces
- 5. Create security policies
- 6. Create the FortiAP Profile
- 7. Connect and authorize the FortiAP
- Results
Blocking Facebook with Web Filtering
- 1. Enabling Web Filtering
- 2. Editing the default Web Filter profile
- 3. Creating the Web filtering security policy
- 4. Results
Blocking social media websites using FortiGuard categories
- 1. Enabling the Web Filter feature
- 2. Editing the default Web Filter profile
- 3. Adding the Web Filter profile to the Internet access policy
- 4. Results
Blocking Tor traffic
- 1. Enabling Application Control
- 2. Blocking Tor traffic in Application Control using the default profile
- 3. Adding application control to your security policy
- 4. Results
Blocking Windows XP traffic
- 1. Enabling Application Control
- 2. Creating a custom application signature
- 3. Adding the signature to the default Application Control profile
- 4. Adding the default profile to a security policy
- 5. Results
Bootstrapping a FortiGate-AWS
- 1. Storing configuration and license information
- 2. Setting up IAM roles
- 3. Creating S3 buckets with license and firewall configurations
- 4. Launching the instance using roles and user data
- 5. Result
Captive Portal bypass for Apple updates and Chromebook authentication
- 1. Creating a user account and user group
- 2. Creating firewall addresses
- 3. Creating the SSID
- 4. Creating the security policy
- 5. Connecting and authorizing the FortiAP
- 6. Results
Captive portal two-factor authentication with FortiToken Mobile
- 1. Enabling FortiToken for elainemarley
- 2. Adding a user account to FortiToken Mobile
- 3. Editing the internal interface
- 4. Customizing the captive portal login page
- 5. Results
Captive portal WiFi access control
- 1. Enabling HTTPS authentication
- 2. Creating the user
- 3. Creating the user group
- 4. Creating the SSID
- 5. Creating the security policy
- 6. Connecting and authorizing the FortiAP
- 7. Results
Captive portal WiFi access with a FortiToken-200
- 1. Adding the FortiToken
- 2. Editing the user and assigning the FortiToken
- 3. Results
Configuring ADVPN in FortiOS 5.4 - Redundant hubs (Expert)
- 1. Configure HUB1
- 2. Configure HUB2
- 3. Configure the Spoke FortiGates
- Results
Configuring ADVPN in FortiOS 5.4 (Expert)
- 1. Configure the Hub FortiGate
- 2. Configure the Spoke FortiGates
- Results
Configuring Hair-pinning on a FortiGate
- Scenario:
- 1. Create a VIP
- 2. Create a policy
- 3. Results
Configuring LDAP over SSL with Windows Active Directory
- 1. Exporting the LDAPS Certificate in Active Directory (AD)
- 2. Importing the LDAPS Certificate into the FortiGate
- 3. Creating the LDAPS Server object in the FortiGate
- 4. Results
Cooperative Security Fabric
- 1. Installing a FortiGate in NAT/Route mode
- 2. Installing internal FortiGates and enabling a Security Fabric
- 3. Adding FortiAnalyzer to a Security Fabric
- 4. High Availability with two FortiGates
- 5. Setting up an internal network with a managed FortiSwitch
- 6. Adding endpoint control to a Security Fabric
- 7. Adding FortiManager to a Security Fabric
Creating a virtual wire pair
- 1. Adding a virtual wire pair
- 2. Adding virtual wire pair firewall policies
- 3. Results
Creating security policies
- 1. Configuring the Internet policy
- 2. Creating the Mobile policy
- 3. Defining SysAdminPC
- 4. Creating the Admin policy
- 5. Ordering the policy table
- 6. Results
Enforcing network security using a FortiClient Profile
- 1. Enabling endpoint control on the FortiGate
- 2. Enforcing FortiClient registration on the internal interface
- 3. Configuring the FortiClient Profile
- 4. Results
Extending WiFi range with mesh topology
- 1. Creating the backhaul SSID
- 2. Creating the client SSID
- 3. Creating the FortiAP Profile
- 4. Configuring the security policy
- 5. Configuring an interface dedicated to FortiAP
- 6. Preauthorizing FortiAP-1
- 7. Configuring FortiAP-2 for mesh operation
- 8. Connecting and authorizing the FortiAPs
- 9. Results
Fixed Port Range IP Pools algorithm
- Determining the IP address from the pool
- TCP ports
FortiAuthenticator as a Certificate Authority
- 1. Creating a new CA on the FortiAuthenticator
- 2. Installing the CA on the network
- 3. Creating a CSR on the FortiGate
- 4. Importing and signing the CSR on the FortiAuthenticator
- 5. Importing the local certificate to the FortiGate
- 6. Configuring the certificate for the GUI
- 7. Results
FortiGate installation troubleshooting
- 1. Check your equipment and cables
- 2. Check the FortiGate LEDs
- 3. Ping the FortiGate
- 4. Check the FortiGate interface configurations (NAT/Route mode only)
- 5. Verify the security policy configuration
- 6. Verify the static routing configuration (NAT/Route mode only)
- 7. Verify that you can connect to the Internet-facing interface’s IP address (NAT/Route mode only)
- 8. Verify that you can connect to the gateway provided by your ISP
- 9. Ping an IP on the Internet
- 10. Verify the DNS configuration
- 11. Resetting the FortiGate
- 12. Contacting Fortinet Support
FortiGate logging troubleshooting
- No log messages appear in the GUI.
- Logs from a FortiAnalyzer, FortiManager, or from FortiCloud do not appear in the GUI.
- The FortiGate unit’s performance level has decreased since enabling disk logging.
- Logging to a FortiAnalyzer unit is not working as expected.
FortiGate registration and basic settings
- 1. Registering your FortiGate
- 2. Setting the system time
- 3. Changing the default admin password
- 4. Results
- 5. (Optional) Restricting administrative access to a trusted host
FortiToken two-factor authentication with RADIUS on a FortiAuthenticator
- 1. Adding the FortiToken to FortiAuthenticator
- 2. Adding the FortiToken user to FortiAuthenticator
- 3. Creating the RADIUS Client on FortiAuthenticator
- 4. Connecting the FortiGate to the RADIUS Server
- 5. Configuring the SSL VPN on FortiGate
- 6. Results
Guest WiFi accounts
- 1. Creating a WiFi guest user group
- 2. Creating a guest SSID that uses Captive Portal
- 3. Creating a security policy for WiFi guests
- 4. Creating a restricted admin account for guest user management
- 5. Creating a guest user account
- 6. Results
High Availability with FGCP (Expert)
- 1. Configuring the primary FortiGate
- 2. Configuring the backup FortiGate
- 3. Connecting the cluster
- 4. Checking cluster operation and disabling override
- 5. Results
High Availability with two FortiGates
- 1. Setting up registration and licensing
- 2. Configuring the Primary FortiGate for HA
- 3. Connecting the backup FortiGate
- 4. Configuring the backup FortiGate for HA
- 5. Viewing the cluster status
- 6. Results
- 7. (Optional) Upgrading the firmware for the HA cluster
Inspecting traffic content using flow-based inspection
- 1. Changing from proxy to flow mode
- 2. Configuring the AntiVirus profile
- 3. Enabling AntiVirus in a policy
- 4. Results
Installing a FortiGate in NAT/Route mode
- 1. Connecting the network devices and logging onto the FortiGate
- 2. Configuring the FortiGate's interfaces
- 3. Adding a default route
- 4. (Optional) Setting the FortiGate's DNS servers
- 5. Creating a policy to allow traffic from the internal network to the Internet
- 5. Results
Installing a FortiGate in Transparent mode
- 1. Changing the FortiGate's operation mode
- 2. (Optional) Setting the FortiGate's DNS servers
- 3. Creating a policy to allow traffic from the internal network to the Internet
- 4. Connecting the network devices
- 5. Results
Installing internal FortiGates and enabling Security Fabric
- 1. Configuring External to connect to Accounting
- 2. Configuring the Accounting FortiGate
- 3. Installing and configuring the Marketing FortiGate
- 4. Configuring OSPF routing between the FortiGates
- 5. Enabling the Cooperative Security Fabric
- 6. Results
- 7. (Optional) Adding security profiles to the fabric
Integrating a FortiGate with FortiClient EMS
- 1. Configuring FortiClient EMS
- 2. (Optional) Importing Endpoint Profiles into FortiClient EMS
- 3. Enabling and enforcing FortiHeartBeat on the FortiGate
- 4. (Optional) FortiClient installer configuration
- 5. Results
IPsec VPN for iOS 9
- 1. Configuring the IPsec VPN using the IPsec VPN Wizard
- 2. Connecting to the IPsec VPN from iPhone
- 3. Results
IPsec VPN for Windows Phone 10
- 1. Configuring the IPsec VPN using the IPsec VPN Wizard
- 2. Connecting to the IPsec VPN from the Windows Phone 10
- 3. Results
IPsec VPN to Microsoft Azure
- 1. Configuring the Microsoft Azure virtual network
- 2. Specifying the Microsoft Azure DNS server
- 3. Creating the Microsoft Azure virtual network gateway
- 4. Creating the Microsoft Azure local network gateway
- 5. Configuring the FortiGate tunnel
- 6. Creating the Azure firewall object
- 7. Creating the FortiGate firewall policies
- 8. Creating the FortiGate static route
- 9. Creating a Microsoft Azure Site-to-Site VPN connection
- 10. Results
IPsec VPN troubleshooting
- The options to configure policy-based IPsec VPN are unavailable.
- The VPN tunnel goes down frequently.
- The pre-shared key does not match (PSK mismatch error).
- The SA proposals do not match (SA proposal mismatch).
- Pre-existing IPsec VPN tunnels need to be cleared.
- LAN interface connection
- Dialup connection
- Troubleshooting VPN connections
- VPN troubleshooting tips
- General troubleshooting tips
- A word about NAT devices
IPsec VPN two-factor authentication with FortiToken-200
- 1. Adding the FortiToken
- 2. Editing the user and assigning the FortiToken
- 3. Configuring the IPsec VPN using the IPsec VPN Wizard
- 4. Connecting to the IPsec VPN
- 5. Results
IPsec VPN with FortiClient
- 1. Creating a user group for remote users
- 2. Adding a firewall address for the local network
- 3. Configuring the IPsec VPN using the IPsec VPN Wizard
- 4. Creating a security policy for access to the Internet
- 5. Configuring FortiClient
- 6. Results
IPsec VPN with native Mac OS X client
- 1. Configuring the IPsec VPN using the Wizard
- 2. Creating a security policy for remote access to the Internet
- 3. Results
L2TP IPsec VPN on FortiGate
- 1. Creating an L2TP user and user group
- 2. Enabling L2TP in the CLI Console
- 3. Configuring the L2TP/IPsec phases
- 4. Creating a firewall address for L2TP clients
- 5. Creating Security Policy for access to the internal network and the Internet
- 6. Configuring a remote Windows 7 L2TP client
- 7. Results
Limiting bandwidth with traffic shaping
- 1. Enabling Traffic Shaping
- 2. Creating a firewall address
- 3. Configuring a traffic shaper to limit bandwidth
- 4. Verifying your Internet access security policy
- 5. Create two Traffic Shaping Policies
- 6. Results
Logging FortiGate traffic and using FortiView
- 1. Configuring log settings
- 2. Enabling logging in security policies
- 3. Results
Logging traffic with FortiGate Cloud
- 1. Activating FortiGate Cloud
- 2. Sending logs to FortiGate Cloud
- 3. Enabling logging in your Internet access security policy
- 4. Results
MAC access control with a WiFi network
- 1. Finding the MAC address of a device
- 2. Defining a device using its MAC address
- 3. Creating a device group
- 4. Reserving an IP address for the device
- 5. Creating a security policy for wireless traffic
- 6. Results
Make it a policy to learn before configuring policies
- The scenario
- The profiles
- Logging and Reporting
- Why do you want to know this information?
- Maintenance
- The obligatory warning
Monitoring and blocking P2P traffic
- 1. Enabling Application Control and Multiple Security Profiles
- 2. Using the default Application Control profile to monitor network traffic
- 3. Editing the security policy for outgoing traffic
- 4. Reviewing the FortiView dashboards
- 5. Creating an application profile to block P2P applications
- 6. Adding the blocking profile to a security policy
- 7. Results
Netflow Templates
- Listing of Netflow Templates for FortiOS 5.4.x or later
- Field Type Definitions
Overriding a web filter profile
- 1. Enabling web filtering and multiple profiles
- 2. Creating a user group and two users
- 3. Creating a web filter profile and an override
- 4. Adding the new web filter profile to a security policy
- 5. Results
Preventing certificate warnings
- Using the default certificate
- Using a self-signed certificate
Preventing data leaks
- 1. Enabling DLP and Multiple Security Profiles
- 2. Creating a DLP profile
- 3. Adding the profile to a security policy
- 4. Results
Protecting a server running web applications
- 1. Enabling Web Application Firewall
- 2. Editing the default Web Application Firewall profile
- 3. Applying the profile to a security policy
- 4. Results
- 5. Offloading to a FortiWeb
Protecting a web server with DMZ
- 1. Configuring the FortiGate's DMZ interface
- 2. Creating virtual IPs (VIPs)
- 3. Creating firewall policies
- 4. Results
Protection from Botnet C&C attacks
- 1. Enabling the DNS Filter Security Feature
- 2. Creating the DNS Filter Profile and enabling Botnet C&C database
- 3. Configuring Static Domain Filter in DNS Filter Profile
- 4. Creating a DNS Filtering firewall policy
- 5. Results
Redundant internet connections
- 1. Connecting your ISPs to the FortiGate
- 2. Deleting security policies and routes that use WAN1 or WAN2
- 3. Creating a WAN link interface
- 4. Configuring Health Check (optional)
- 5. Creating a default route for the WAN link interface
- 6. Allowing traffic from the internal network to the WAN link interface
- 7. Results
Sandboxing with FortiSandbox and FortiClient
- 1. Connecting the FortiSandbox
- 2. Enabling Sandbox Inspection
- 3. Configuring sandboxing in the default AntiVirus profile
- 4. Configuring sandboxing in the default Web Filter profile
- 5. Configuring sandboxing in the default FortiClient profile
- 6. Applying AntiVirus and Web Filter scanning to network traffic
- 7. Results
Setting up a WiFi Bridge with a FortiAP
- 1. Connecting and authorizing the FortiAP unit
- 2. Creating an SSID
- 3. Creating a custom FortiAP profile
- 4. Results
Setting up FortiGuard services
- 1. Verifying the connection
- 2. Troubleshooting communication errors
- 3. Results
Setting up WiFi with a FortiAP
- 1. Connecting and authorizing the FortiAP unit
- 2. Creating an SSID
- 3. Creating a custom FortiAP profile
- 4. Allowing wireless access to the Internet
- 5. Results
Site-to-site IPsec VPN with two FortiGates
- 1. Configuring the HQ IPsec VPN
- 2. Configuring the Branch IPsec VPN
- 3. Results
SSL VPN for users with passwords that expire
- 1. Creating the SSL VPN user and user group
- 2. Configuring and assigning the password policy
- 3. Configuring the SSL VPN web portal and settings
- 4. Adding security policies for access to the internal network and the Internet
- 5. Results
SSL VPN single sign-on using LDAP-integrated certificates
- 1. Windows 10 certificate
- 2. Requesting and installing a server certificate for FortiOS
- 3. Configuring LDAP, PKI and a group
- 4. Configuring a group
- 5. Configuring the SSL VPN settings
- 6. Configuring the policy
- 7. Results
- 8. Logs
- 9. Summary
SSL VPN troubleshooting
- Diagnose commands
- Common issues
SSL VPN using web and tunnel mode
- 1. Creating a user and a user group
- 2. Creating an SSL VPN portal for remote users
- 3. Configuring the SSL VPN tunnel
- 4. Adding an address for the local network
- 5. Adding security policies for access to the internal network and Internet
- 6. Setting the FortiGate unit to verify users have current AntiVirus software
- 7. Results
SSL VPN with certificate authentication
- 1. Enabling certificate management
- 2. Installing the server certificate
- 3. Installing the CA certificate
- 4. Creating PKI users and a user group
- 5. Creating an SSL VPN portal
- 6. Configuring the SSL VPN tunnel
- 7. Adding security policies for access to the Internet and internal network
- 8. Installing the user certificate
- 9. Results
SSO using a FortiGate, FortiAuthenticator, and DC Polling (Expert)
- 1. Configuring the FortiAuthenticator
- 2. Configuring SSO on the FortiGate
- 3. Creating a user group on the FortiGate
- 4. Adding a policy on the FortiGate
- 5. Results from the FortiAuthenticator
- 6. Results from the FortiGate
Single Sign-On using FSSO agent in advanced mode and FortiAuthenticator (Expert)
- 1. Configuring an LDAP directory on the FortiAuthenticator
- 2. Integrating the FortiGate with the FortiAuthenticator
- 3. Installing FSSO agent on the Windows DC
- 4. Configuring Single Sign-On on the FortiGate
- 5. Adding a user group to the FortiGate
- 6. Adding a policy to the FortiGate
- 7. Results
Single Sign-On using LDAP and FSSO agent in advanced mode (Expert)
- 1. Integrating the FortiGate with the Windows DC LDAP server
- 2. Installing FSSO agent on the Windows DC server
- 3. Configuring Single Sign-On on the FortiGate
- 4. Adding a user group to the FortiGate
- 5. Adding a policy to the FortiGate
- Results
Traffic Shaping Priority Queueing (PRIQ)
- How traffic shaping really works
- Traffic shaping methods
- Types of priority
- How do these priorities affect each other?
- Resources
Updating your FortiGate's firmware
- 1. Checking the current FortiOS firmware
- 2. Reviewing the Release Notes
- 3. Updating to the latest firmware
- 4. Results
User and device authentication
- 1. Creating two users groups and adding users
- 2. Creating a schedule for part-time staff
- 3. Creating a policy for full-time staff
- 4. Creating a policy for part-time staff that enforces the schedule
- 5. Creating a policy that denies mobile traffic
- 6. Results
Using Hairpinning in a Network
- What do hair pins have to do with networking?
Using virtual IPs to configure port forwarding
- 1. Creating three VIPs
- 2. Adding VIPs to a VIP group
- 3. Creating a security policy
- 4. Results
VDOM configuration
- 1. Switching to VDOM mode and creating two VDOMs
- 2. Configuring the root VDOM for FortiGate management
- 3. Adding interfaces to VDOM-A
- 4. Adding interfaces to VDOM-B
- 5. Adding administrators to each VDOM
- 6. Configuring VDOM-A
- 7. Configuring VDOM-B
- 8. Results
Web and DNS filter troubleshooting
- The Web Filter menu is missing
- You cannot create new web filter profiles
- You configured web filtering, but it is not working
- You configured DNS Filtering, but it is not working
- FortiGuard has the wrong categorization for a website
- The website categorization on your FortiGate does not match the FortiGuard categorization
- An active FortiGuard web filter license displays as expired/unreachable
- Using URL Filters in conjunction with FortiGuard Categories is not working
Web filtering using quotas
- 1. Enabling web filtering
- 2. Creating a web filter profile that uses quotas
- 3. Adding web filtering to a security policy
- 4. Results
WiFi network on a schedule
- 1. Create the schedule
- 2. Create the SSID
- 3. Create the security policy
- Results
WiFi Network troubleshooting
- Signal strength issues
- Throughput issues
- Connection issues
- General problems
- Packet sniffer
- Useful debugging commands
WiFi RADIUS authentication with FortiAuthenticator
- 1. Create the user accounts and user group on the FortiAuthenticator
- 2. Register the FortiGate as a RADIUS client on the FortiAuthenticator
- 3. Configure FortiGate to use the RADIUS server
- 4. Create the SSID and set up authentication
- 5. Connect and authorize the FortiAP
- 6. Create the security policy
- Results
WiFi using FortiAuthenticator RADIUS with Certificates
- 1. Creating a local CA on FortiAuthenticator
- 2. Creating a local service certificate on FortiAuthenticator
- 3. Configuring RADIUS EAP on FortiAuthenticator
- 4. Configuring RADIUS client on FortiAuthenticator
- 5. Configuring local user on FortiAuthenticator
- 6. Configuring local user certificate on FortiAuthenticator
- 7. Creating RADIUS server on FortiGate
- 8. Creating WiFi SSID on FortiGate
- 9. Exporting user certificate from FortiAuthenticator
- 9. Importing user certificate into Windows 7
- 10. Configuring Windows 7 wireless profile to use certificate
- 11. Results on FortiAuthenticator
- 12. Results on FortiGate
WiFi with WSSO using FortiAuthenticator RADIUS and Attributes
- 1. Registering the FortiGate as a RADIUS client on the FortiAuthenticator
- 2. Creating users on the FortiAuthenticator
- 3. Creating user groups on the FortiAuthenticator
- 4. Configuring FortiGate to use FortiAuthenticator as the RADIUS server
- 5. Configuring user groups on the FortiGate
- 6. Creating security policies
- 7. Configuring the SSID to RADIUS authentication
- 8. Results
WiFi with WSSO using Windows NPS and Attributes
- 1. Registering the FortiGate as a RADIUS client on NPS
- 2. Creating a Connection Request Policy
- 3. Creating a Network Policy
- 4. Configuring FortiGate to use the RADIUS server
- 5. Configuring a user group on the FortiGate
- 6. Creating an SSID with RADIUS authentication
- 7. Creating a security policy
- 8. Results
WiFi with WSSO using Windows NPS and FortiGate Groups
- 1. Registering the FortiGate as a RADIUS client on NPS
- 2. Creating a Connection Request Policy
- 3. Creating a Network Policy
- 4. Configuring FortiGate to use the RADIUS server
- 5. Configuring a user group on the FortiGate
- 6. Creating an SSID with RADIUS authentication
- 7. Creating a security policy
- 8. Results
Change Log

Home FortiGate / FortiOS 5.4.0 Cookbook

5.4.0

Change Log

Date	Change Description
2019-10-08	Initial release.
2020-12-09	Topic removed.

Change Log

Date	Change Description
2019-10-08	Initial release.
2020-12-09	Topic removed.

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

Web Application / API Protection

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

All Products

Cookbook

Change Log

Change Log

Change Log

Change Log