Cookbook

• Getting started
  • Using the GUI
    • Connecting using a web browser
    • Menus
    • Tables
    • Entering values
      • Text strings
      • Numbers
  • Using the CLI
    • Connecting to the CLI
    • CLI basics
    • Command syntax
    • Subcommands
    • Permissions
  • FortiExplorer for iOS
    • Getting started with FortiExplorer
    • Connecting FortiExplorer to a FortiGate via WiFi
    • Running a security rating
    • Upgrading to FortiExplorer Pro
  • Basic administration
    • Registration
    • Unified FortiCare and FortiGate Cloud login
  • FortiGate Cloud
  • Troubleshooting your installation
  • Zero touch provisioning
    • Zero touch provisioning with FortiDeploy
    • Zero touch provisioning with FortiManager
• Dashboard
  • Dashboard CLI
  • Configuration backups
• Fortinet Security Fabric
  • Components
  • Security Fabric device configuration
    • FortiGate
    • FortiAnalyzer
    • FortiSandbox
    • FortiManager
    • FortiClient EMS
    • FortiAP and FortiSwitch
    • Additional devices
  • Deploying Security Fabric
  • Using the Security Fabric
    • Dashboard widgets
    • Topology
    • Security rating
    • Topology view — consolidated risk
  • Fabric connectors
    • SDN connectors
      • AliCloud SDN connector
      • AWS SDN connector with IAM credentials
      • Azure Stack SDN connector
      • Cisco pxGrid fabric connector
      • OpenStack (Horizon) SDN connector with domain filter
      • VMware ESXi SDN connector
      • Multiple concurrent SDN connectors
      • Filter lookup in SDN connectors
    • Kubernetes (K8s) SDN connectors
      • Private Cloud K8s SDN connector
      • AWS Kubernetes (EKS) SDN connector
      • GCP Kubernetes (GKE) SDN connector
      • Azure Kubernetes (AKS) SDN connector
      • Oracle Kubernetes (OKE) SDN connector
    • SSO/Identity connectors
      • FortiClient EMS connector
      • Endpoint connector - FortiNAC
      • RADIUS single sign-on (RSSO) agent
    • Threat feeds
      • External Block List (Threat Feed) – Policy
      • External Block List (Threat Feed) - Authentication
      • External Block List (Threat Feed) - File Hashes
  • Automation stitches
    • Creating automation stitches
      • Chaining and delaying actions
    • Triggers
      • FortiAnalyzer event handler trigger
    • Actions
      • CLI script action
      • NSX Quarantine action
      • AWS Lambda action
      • Azure Function action
      • Google Cloud Function action
      • AliCloud Function action
      • Webhook action
      • Slack integration webhook
    • Diagnostics
  • Security Fabric over IPsec VPN
  • Viewing and controlling network risks via topology view
  • Leveraging LLDP to simplify security fabric negotiation
  • Leveraging SAML to switch between Security Fabric FortiGates
  • FortiManager Cloud service
  • FortiAnalyzer Cloud service
• FortiView
  • FortiView interface
  • FortiView from disk
  • FortiView from FortiAnalyzer
  • Cloud application view
  • FortiView Sources usability
  • FortiView from FortiGate Cloud
  • Supported views for different log sources
  • FortiGate Cloud-based IOC
  • FortiView — subnet filters
  • FortiView dashboards and widgets
  • FortiView object names
• Network
  • Interfaces
    • Interface settings
    • Aggregation and redundancy
    • VLANs
    • Enhanced MAC VLANs
    • Inter-VDOM routing
    • Software switch
    • Zone
    • Virtual Wire Pair
    • Virtual switch
    • Failure detection for aggregate and redundant interfaces
    • VLAN inside VXLAN
    • Virtual Wire Pair with VXLAN
  • DNS
    • Important DNS CLI commands
    • DNS domain list
    • FortiGate DNS server
    • DDNS
    • DNS latency information
    • DNS over TLS
    • DNS troubleshooting
  • Explicit and transparent proxies
    • Explicit web proxy
    • FTP proxy
    • Transparent proxy
    • Proxy policy addresses
    • Proxy policy security profiles
    • Explicit proxy authentication
    • Transparent web proxy forwarding
    • Multiple dynamic header count
    • Restricted SaaS access (Office 365, G Suite, Dropbox)
    • Explicit proxy and FortiSandbox Cloud
  • SD-WAN
    • Basic SD-WAN setup
      • Creating the SD-WAN interface
      • Using DHCP interface
      • Implicit rule
      • Factory default health checks
    • WAN path control
      • Performace SLA - link monitoring
      • Performace SLA - SLA targets
      • SD-WAN rules - best quality
      • SD-WAN rules - lowest cost (SLA)
      • SD-WAN rules - maximize bandwidth (SLA)
      • MPLS (SIP and backup) + DIA (cloud apps)
      • SD-WAN traffic shaping and QoS with SD-WAN
      • Per-link controls for policies and SLA checks
    • Advanced configuration
      • Self-originating traffic
      • SDN dynamic connector addresses in SD-WAN rules
      • Forward error correction on VPN overlay networks
      • Using BGP tags with SD-WAN rules
      • BGP multiple path support
      • Controlling traffic with BGP route mapping and service rules
      • DSCP matching (shaping)
      • Dual VPN tunnel wizard
      • Internet service customization
    • Troubleshooting SD-WAN
      • Tracking SD-WAN sessions
      • Understanding SD-WAN related logs
      • SD-WAN related diagnose commands
      • SLA logging
      • SLA monitoring using the REST API
      • SD-WAN bandwidth monitoring service
    • Enable dynamic connector addresses in SD-WAN policies
  • DHCP server
  • DHCP relay agent information option
  • Direct IP support for LTE/4G
  • LLDP reception
• System
  • Administrators
    • Administrator profiles
    • Add a local administrator
    • Remote authentication for administrators
    • Password policy
  • Firmware
    • Downloading a firmware image
    • Testing a firmware version
    • Upgrading the firmware
    • Downgrading to a previous firmware version
    • Installing firmware from system reboot
    • Restoring from a USB drive
    • Controlled upgrade
  • Settings
    • Default administrator password
    • Changing the host name
    • Setting the system time
      • SHA-1 authentication support (for NTPv4)
      • PTPv2 (slave mode)
    • Configuring ports
      • Custom default service port range
    • Setting the idle timeout time
    • Setting the password policy
    • Changing the view settings
    • Setting the administrator password retries and lockout time
  • Virtual Domains
    • Split-task VDOM mode
      • Assign interfaces to a VDOM
      • Create per-VDOM administrators
    • Multi VDOM mode
      • Multi VDOM configuration examples
        • NAT mode
        • NAT and transparent mode
  • High Availability
    • Failover protection
    • FGSP (session-sync) peer setup
    • Troubleshoot an HA formation
    • Check HA sync status
    • Disabling stateful SCTP inspection
    • HA cluster setup examples
      • HA active-passive cluster setup
      • HA active-active cluster setup
      • HA virtual cluster setup
      • HA using a hardware switch to replace a physical switch
  • SNMP
    • Interface access
    • MIB files
    • SNMP agent
    • SNMP v1/v2c communities
    • SNMP v3 users
    • Important SNMP traps
  • Replacement messages
  • Replacement message groups
  • FortiGuard
    • Configuring antivirus and IPS options
    • Manual updates
    • Automatic updates
    • Sending malware statistics to FortiGuard
    • Update server location
    • Filtering
    • Override FortiGuard servers
    • Online security tools
  • Advanced configurations
    • Workspace mode
  • Feature visibility
  • Certificates
    • Microsoft CA deep packet inspection
• Policy and Objects
  • Policies
    • Firewall policy parameters
    • Profile-based NGFW vs policy-based NGFW
    • NGFW policy mode application default service
    • Policy views and policy lookup
    • Policy with source NAT
      • Static SNAT
      • Dynamic SNAT
      • Central SNAT
    • Policy with destination NAT
      • Static virtual IPs
      • Virtual IP with services
      • Virtual IPs with port forwarding
      • Virtual server
    • Policy with Internet Service
      • Using Internet Service in policy
      • Using custom Internet Service in policy
      • Using extension Internet Service in policy
      • Global IP address information database
      • IP reputation filtering
      • Internet service groups in policies
    • NAT64 policy and DNS64 (DNS proxy)
    • NAT46 policy
    • Multicast processing and basic Multicast policy
    • Local-in policies
    • IPv4/IPv6 access control lists
    • Mirroring SSL traffic in policies
    • Inspection mode per policy
    • Combined IPv4 and IPv6 policy
    • FortiGuard DNS filter for IPv6 policies
    • OSPFv3 neighbor authentication
    • Firewall anti-replay option per policy
    • Recognize anycast addresses in geo-IP blocking
    • Authentication policy extensions
    • NTLM extensions
    • HTTP to HTTPS redirect for load balancing
    • GTPv2 in policies
    • Use active directory objects directly in policies
    • FortiCloud/FDN communication through an explicit proxy
  • Objects
    • Address group exclusions
    • MAC addressed-based policies
    • Dynamic policy — fabric devices
  • Traffic shaping
    • Determining your QoS requirements
    • Packet rates
    • Interface bandwidth limit
    • Changing traffic shaper bandwidth unit of measurement
    • Shared traffic shaper
    • Per-IP traffic shaper
    • Type of Service-based prioritization and policy-based traffic shaping
    • Interface-based traffic shaping profile
    • Classifying traffic by source interface
    • Traffic shaping schedules
    • QoS assignment and rate limiting for quarantined VLANs
    • Weighted random early detection queuing
• Security Profiles
  • Antivirus
    • Content disarm and reconstruction for antivirus
    • FortiGuard Outbreak Prevention for antivirus
    • External malware blocklist for antivirus
    • Checking flow antivirus statistics
    • CIFS support
    • Using FortiSandbox appliance with antivirus
    • Using FortiSandbox Cloud with antivirus
  • Web filter
    • URL filter
    • FortiGuard filter
    • Usage quota
    • Web content filter
    • File filter
    • Advanced filters 1
    • Advanced filters 2
    • External resources for web filter
    • Reliable web filter statistics
    • Flow-based web filtering
    • URL certificate blacklist
  • DNS filter
    • How to configure and apply a DNS filter profile
    • FortiGuard category-based DNS domain filtering
    • Botnet C&C domain blocking
    • External resources for DNS filter
    • DNS safe search
    • Local domain filter
    • DNS translation
    • Using a FortiGate as a DNS server
    • Troubleshooting for DNS filter
  • Application control
    • Basic category filters and overrides
    • Port enforcement check
    • Protocol enforcement
  • Intrusion prevention
    • Botnet C&C IP blocking
  • Email filter
    • Local-based filters
    • FortiGuard-based filters
    • File type-based filters
    • Protocols and actions
    • Configuring webmail filtering
  • Data leak prevention
    • Basic DLP filter types
    • DLP fingerprinting
    • DLP watermarking
  • VoIP solutions
    • General use cases
    • SIP message inspection and filtering
    • SIP pinholes
    • SIP over TLS
    • Custom SIP RTP port range support
    • Voice VLAN auto-assignment
  • Web application firewall
    • Protecting a server running web applications
  • Inspection modes
    • About inspection modes
      • Flow mode inspection (default mode)
      • Proxy mode inspection
      • Inspection mode feature comparison
      • Inspection mode differences for antivirus
      • Inspection mode differences for data leak prevention
      • Inspection mode differences for email filter
      • Inspection mode differences for web filter
    • SSL Inspection
      • Certificate inspection
      • Deep inspection
      • Protecting an SSL server
  • Overrides
    • Web rating override
    • Web profile override
  • Custom signatures
    • Application groups in policies
• VPN
  • IPsec VPNs
    • Overlay Controller VPN (OCVPN)
      • Full mesh OCVPN
      • Hub-spoke OCVPN with ADVPN shortcut
      • Hub-spoke OCVPN with inter-overlay source NAT
      • OCVPN portal
      • Troubleshooting OCVPN
    • IPsec Tunnels
      • Represent multiple IPsec tunnels as a single interface
      • OSPF with IPsec VPN for network redundancy
      • GRE over IPsec
      • LT2P over IPsec
      • Policy-based IPsec tunnel
      • Per packet distribution and tunnel aggregation
    • Site-to-site VPN
      • IPsec VPN in an HA environment
      • IPsec aggregate for redundancy and traffic load-balancing
      • Redundant hub and spoke VPN
      • IKEv2 IPsec site-to-site VPN to an Azure VPN gateway
      • IKEv2 IPsec site-to-site VPN to an AWS VPN gateway
    • Dialup VPN
      • FortiGate as dialup client
      • FortiClient as dialup client
      • iOS device as dialup client
    • ADVPN
      • ADVPN with BGP as the routing protocol
      • ADVPN with OSPF as the routing protocol
      • ADVPN with RIP as the routing protocol
    • Authentication in VPN
      • IPsec VPN authenticating a remote FortiGate peer with a pre-shared key
      • IPsec VPN authenticating a remote FortiGate peer with a certificate
    • VXLAN over IPsec
      • VXLAN over IPsec tunnel
      • VXLAN over IPsec using a VTEP
    • Other VPN topics
      • Tunneled Internet browsing
      • VPN and ASIC offload
      • Encryption algorithms
      • Fragmenting IP packets before IPsec encapsulation
      • VPN IPsec troubleshooting
        • Understanding VPN related logs
        • IPsec related diagnose command
  • SSL VPN
    • SSL VPN web mode for remote user
    • SSL VPN tunnel mode
      • SSL VPN full tunnel for remote user
      • SSL VPN split tunnel for remote user
      • SSL VPN tunnel mode host check
    • SSL VPN multi-realm
    • SSL VPN authentication
      • SSL VPN with certificate authentication
      • SSL VPN with LDAP-integrated certificate authentication
      • SSL VPN with FortiToken mobile push authentication
      • SSL VPN with RADIUS on FortiAuthenticator
      • SSL VPN with RADIUS and FortiToken mobile push on FortiAuthenticator
      • SSL VPN with local user password policy
      • SSL VPN with RADIUS password renew on FortiAuthenticator
      • SSL VPN with LDAP user password renew
    • SSL VPN protocols
      • TLS 1.3 support
      • SMBv2 support
    • SSL VPN to IPsec VPN
    • SSL VPN troubleshooting
• User & Device
  • Endpoint control and compliance
    • Per-policy disclaimer messages
    • Compliance
      • FortiSandbox Cloud region selection
      • FortiGate — VM unique certificate
      • Running a file system check automatically
    • FortiGuard distribution of updated Apple certificates
  • User Definition
    • User types
    • Removing a user
  • User Groups
    • Configuring POP3 authentication
    • Dynamic policies - FortiClient EMS
  • Guest Management
    • Configuring guest access
    • Retail environment guest access
  • Device Inventory
    • Device summary and filtering
    • Adding MAC-based addresses to devices
  • Custom Devices & Groups
    • Creating a custom device
    • Creating a custom device group
    • Configuring an avatar for a custom device
  • LDAP Servers
    • FSSO polling connector agent installation
    • Enabling Active Directory recursive search
    • Configuring LDAP dial-in using a member attribute
    • Configuring wildcard admin accounts
  • RADIUS Servers
    • Configuring RADIUS SSO authentication
  • TACACS+ Servers
  • Authentication Settings
  • FortiTokens
    • Configuring FortiTokens
    • FortiToken Cloud
    • Configuring FortiToken Mobile
  • SAML
    • SAML SSO overview
      • Configuring FGT_A as the IdP
      • Configuring FGT_B as an SP
      • Creating a new system administrator on the IdP (FGT_A)
      • Logging in to FGT_B using SSO
      • Granting permissions to new SSO administrator accounts
      • Logging in to FGT_B again using SSO
      • CLI commands for SAML SSO
    • SAML SSO with pre-authorized FortiGates
    • Manual SAML SSO configuration
    • Navigating between Security Fabric members with SSO
    • Logging in to a FortiGate SP from root FortiGate IdP
    • Logging in to a downstream FortiGate SP in another Security Fabric
    • Certificates for SAML SSO
    • Unique SAML attribute types
    • FortiGate SP changes
  • Configuring maximum login attempts and blackout period
• Wireless configuration
  • FortiAP management
    • Configuring the FortiGate interface to manage FortiAP units
    • Discovering, authorizing, and deauthorizing FortiAP units
    • Extended details on FortiAP drill down
    • Setting up a mesh connection between FortiAP units
    • Data channel security: clear-text, DTLS, and IPsec VPN
  • SSID authentication
    • Replacing WiFi certificate
    • Deploying WPA2-Personal SSID to FortiAP units
    • Deploying WPA2-Enterprise SSID to FortiAP units
    • Deploying captive portal SSID to FortiAP units
    • Configuring quarantine on SSID
    • Configuring MAC filter on SSID
    • WPA3 on FortiAP
    • Monitoring and suppressing phishing SSID
    • Changing SSID to VDOM only
    • WiFi with WSSO using Windows NPS and user groups
  • Statistics
    • WiFi maps
    • Fortinet Security Fabric
    • Direct SNMP monitor
  • Wireless security
    • Enabling rogue AP scan
    • Enabling rogue AP suppression
    • Wireless Intrusion Detection System
    • WiFi QoS WMM marking
    • WPA3 support
  • Other
    • UTM security profile groups on FortiAP-S
    • 1+1 fast failover between FortiGate WiFi controllers
    • CAPWAP Offloading (NP6 only)
    • Airtime fairness
    • Extended logging
• Switch Controller
  • FortiLink setup
  • FortiLink auto network configuration policy
  • FortiLink network sniffer extension
  • FortiLink MCLAG configuration
  • Standalone FortiGate as switch controller
    • Standalone FortiGate as switch controller
    • Multiple FortiSwitches managed via hardware/software switch
    • Multiple FortiSwitches in tiers via aggregate interface with redundant link enabled
    • Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled only on distribution
  • HA (A-P) mode FortiGate pairs as switch controller
    • Multiple FortiSwitches managed via hardware/software switch
    • Multiple FortiSwitches in tiers via aggregate interface with redundant link enabled
    • Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled only on distribution
    • Multiple FortiSwitches in tiers via aggregate interface with MCLAG enabled on all tiers
  • Authentication and security
    • MAC-based 802.1X authentication
    • Port-based 802.1X authentication
    • MAC layer control - Sticky MAC and MAC Learning-limit
    • Quarantine
  • Flow and Device Detection
    • Data statistic
    • Security Fabric showing
  • Persistent MAC learning
  • Split port mode (for QSFP / QSFP28)
  • Dynamic VLAN name assignment from RADIUS attribute
  • MSTI support
  • Netflow and IPFIX support
• Log and Report
  • Sample logs by log type
  • Checking the email filter log
  • Supported log types to FortiAnalyzer, syslog, and FortiAnalyzer Cloud
  • Configuring multiple FortiAnalyzers on a multi-VDOM FortiGate
  • Configuring multiple FortiAnalyzers (or syslog servers) per VDOM
  • Source and destination UUID logging
  • Troubleshooting
    • Log-related diagnose commands
    • Backing up log files or dumping log messages
    • SNMP OID for logs that failed to send
• Monitor
  • WiFi client monitor
  • WiFi health monitor
  • Policy and route checks
• VM
  • Amazon Web Services
  • Microsoft Azure
  • Google Cloud Platform
  • Oracle OCI
  • AliCloud
  • Private cloud
  • FortiGate multiple connector support
  • Adding VDOMs with FortiGate v-series
  • Terraform: Fortinet as a provider
  • PF SR-IOV driver support
• Change Log