Administration Guide

Getting started
- Summary of steps
- Using the GUI
- Using the CLI
- Configuration and management
- Product registration with FortiCare
- FortiGate models
Dashboards and Monitors
- Using dashboards
- Using widgets
- Viewing device dashboards in the Security Fabric
- Creating a fabric system and license dashboard
- Dashboards
- Monitors
Network
- Interfaces
- DNS
- Explicit and transparent proxies
- DHCP servers and relays
- Static routing
- Dynamic routing
- Multicast
  - Multicast routing and PIM support
  - Configuring multicast forwarding
- FortiExtender
  - Adding a FortiExtender
- Direct IP support for LTE/4G
- LLDP reception
- Virtual routing and forwarding
- NetFlow
- sFlow
- Link monitor
- IPv6
- FortiGate LAN extension
- SCTP packets with zero checksum on the NP7 platform
- Diagnostics
  - Using the packet capture tool
  - Using the debug flow tool
SD-WAN
- SD-WAN overview
  - SD-WAN components and design principles
  - SD-WAN designs and architectures
- SD-WAN quick start
- SD-WAN members and zones
  - Specify an SD-WAN zone in static routes and SD-WAN rules
- Performance SLA
- SD-WAN rules
- Advanced routing
- VPN overlay
- Advanced configuration
- SD-WAN cloud on-ramp
- SD-WAN Network Monitor service
- Troubleshooting SD-WAN
Zero Trust Network Access
- Zero Trust Network Access introduction
- ZTNA advanced configurations
  - Access control of unmanageable and unknown devices
  - HTTP2 connection coalescing and concurrent multiplexing for ZTNA
- ZTNA configuration examples
- ZTNA troubleshooting and debugging commands
- ZTNA troubleshooting scenarios
Policy and Objects
- Policies
- Address objects
- Protocol options
- Traffic shaping
- Internet Services
Security Profiles
- Inspection modes
- Antivirus
- Web filter
- Video filter
- DNS filter
- Application control
- Intrusion prevention
- File filter
  - Supported file types
- Email filter
- Data leak prevention
- VoIP solutions
- ICAP
- Web application firewall
  - Protecting a server running web applications
- SSL & SSH Inspection
- Custom signatures
- Overrides
- IP ban
- Profile groups
IPsec VPN
- General IPsec VPN configuration
- Site-to-site VPN
  - FortiGate-to-FortiGate
  - FortiGate-to-third-party
- Remote access
- Aggregate and redundant VPN
- Overlay Controller VPN (OCVPN)
- ADVPN
- Fabric Overlay Orchestrator
- Other VPN topics
- VPN IPsec troubleshooting
  - Understanding VPN related logs
  - IPsec related diagnose commands
SSL VPN
- SSL VPN best practices
- SSL VPN security best practices
- SSL VPN quick start
- SSL VPN tunnel mode
- SSL VPN web mode
- SSL VPN authentication
- SSL VPN to IPsec VPN
- SSL VPN protocols
- Configuring OS and host check
- FortiGate as SSL VPN Client
- Dual stack IPv4 and IPv6 support for SSL VPN
- Disable the clipboard in SSL VPN web mode RDP connections
- SSL VPN IP address assignments
- Using SSL VPN interfaces in zones
- SSL VPN troubleshooting
  - Debug commands
  - Troubleshooting common issues
User & Authentication
- User definition, groups, and settings
- LDAP servers
- RADIUS servers
- SAML
- TACACS+ servers
- FortiTokens
- PKI
  - Configuring a PKI user
  - Using the SAN field for LDAP-integrated certificate authentication
- FSSO
- Include usernames in logs
Wireless configuration
Switch Controller
System
- Administrators
  - Local authentication
  - Remote authentication for administrators
  - Administrator account options
  - REST API administrator
  - SSO administrators
  - FortiCloud SSO
  - Allowing the FortiGate to override FortiCloud SSO administrator user permissions
  - Password policy
  - Public key SSH access
  - Restricting SSH and Telnet jump host capabilities
  - Remote administrators with TACACS VSA attributes
- Administrator profiles
- Fabric Management
  - About firmware installations
  - Firmware maturity levels
  - Upgrading individual devices
  - Upgrading Fabric or managed devices
  - Enabling automatic firmware updates
  - Authorizing devices
  - Firmware upgrade notifications
  - Downloading a firmware image
  - Testing a firmware version
  - Installing firmware from system reboot
  - Restoring from a USB drive
  - Using controlled upgrades
  - Downgrading individual device firmware
  - Downloading the EOS support package for supported Fabric devices
- Settings
  - Default administrator password
  - Changing the host name
  - Setting the system time
    - SHA-1 authentication support (for NTPv4)
    - PTPv2
  - Configuring ports
    - Custom default service port range
  - Setting the idle timeout time
  - Setting the password policy
  - Changing the view settings
  - Setting the administrator password retries and lockout time
  - TLS configuration
  - Controlling return path with auxiliary session
  - Email alerts
  - Using configuration save mode
  - Trusted platform module support
  - Using the default certificate for HTTPS administrative access
- Virtual Domains
  - VDOM overview
  - General configurations
  - Configuring global profiles
  - Backing up and restoring configurations in multi-VDOM mode
  - Inter-VDOM routing configuration example: Internet access
  - Inter-VDOM routing configuration example: Partial-mesh VDOMs
- High Availability
  - FGCP
  - FGSP
  - Standalone configuration synchronization
    - Layer 3 unicast standalone configuration synchronization
  - VRRP
  - Session failover
- SNMP
  - Basic configuration
  - MIB files
  - Access control for SNMP
  - Important SNMP traps
  - SNMP examples
- Replacement messages
- Replacement message groups
- FortiGuard
  - Anycast
  - Configuring FortiGuard updates
  - Using a proxy server to connect to the FortiGuard Distribution Network
  - Manual updates
  - Automatic updates
  - Scheduled updates
  - Sending malware statistics to FortiGuard
  - Update server location
  - Filtering
  - Online security tools
  - Anycast and unicast services
  - Using FortiManager as a local FortiGuard server
  - Cloud service communication statistics
  - IoT detection service
  - FortiAP query to FortiGuard IoT service to determine device details
  - FortiGate Cloud / FDN communication through an explicit proxy
  - FDS-only ISDB package in firmware images
  - Licensing in air-gap environments
  - License expiration
- Feature visibility
- Certificates
  - Automatically provision a certificate
  - Generate a new certificate
  - Regenerate default certificates
  - Import a certificate
  - Generate a CSR
  - CA certificate
  - Remote certificate
  - Certificate revocation list
  - Export a certificate
  - Uploading certificates using an API
  - Procuring and importing a signed SSL certificate
  - Microsoft CA deep packet inspection
  - Administrative access using certificates
  - Creating certificates with XCA
- Security
  - BIOS-level signature and file integrity checking
  - Real-time file system integrity checking
  - Running a file system check automatically
  - Built-in entropy source
  - FortiGate VM unique certificate
- Configuration scripts
- Workspace mode
- Custom languages
- RAID
- FortiGate encryption algorithm cipher suites
- Conserve mode
- Using APIs
- Configuration backups and reset
Fortinet Security Fabric
- Components
- Security Fabric connectors
- Using the Security Fabric
- Configuring the Security Fabric with SAML
- Security rating
  - Security Fabric score
- Automation stitches
- Public and private SDN connectors
- Endpoint/Identity connectors
- Threat feeds
- Monitoring the Security Fabric using FortiExplorer for Apple TV
  - NOC and SOC example
- Troubleshooting
  - Viewing a summary of all connected FortiGates in a Security Fabric
  - Diagnosing automation stitches
Log and Report
- Viewing event logs
- System Events log page
- Security Events log page
- Reports page
- Log settings and targets
- Logging to FortiAnalyzer
- Advanced and specialized logging
- Sample logs by log type
- Troubleshooting
WAN optimization
- Overview
- Example topologies
- Configuration examples
VM
- Amazon Web Services
- Microsoft Azure
- Google Cloud Platform
- OCI
- AliCloud
- Private cloud
- VM license
- Permanent trial mode for FortiGate-VM
- Adding VDOMs with FortiGate v-series
- PF and VF SR-IOV driver and virtual SPU support
- Using OCI IMDSv2
- FIPS cipher mode for AWS, Azure, OCI, and GCP FortiGate-VMs
- Cloud-init
- TPM support for FortiGate-VM
Hyperscale firewall
Troubleshooting
- Troubleshooting methodologies
- Troubleshooting scenarios
- CLI troubleshooting cheat sheet
- CLI error codes
- Additional resources
Change Log

Home FortiGate / FortiOS 7.2.9 Administration Guide

7.2.9

SSL VPN with Microsoft Entra SSO integration

You can use SAML single sign-on to authenticate against Microsoft Entra ID with SSL VPN SAML users who are using tunnel and web modes. See:

SSL VPN with Microsoft Entra SSO integration

You can use SAML single sign-on to authenticate against Microsoft Entra ID with SSL VPN SAML users who are using tunnel and web modes. See:

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Unified SASE

Single Vendor SASE

Cloud Network Security

Secure Endpoint Connectivity

Web Application / API Protection

Security Operations

Security Operations Automation

Identity

Early Detection & Prevention

Secure Networking

Hybrid Mesh Firewall

NOC Management

LAN

WAN

Communication & Surveillance

Unified SASE

Single Vendor SASE

Secure Endpoint Connectivity

Cloud Network Security

Cloud-Native Security

Web Application / API Protection

Security Operations

Security Operations Automation

Endpoint

Data Protection

Identity

Email

Early Detection & Prevention

Expert Services

Edge Firewall

Orchestration & management

SD Branch

Application Delivery

Single Vendor SASE

Secure Endpoint Connectivity

Secure Private Access

Thin Edge

Identity

Application Gateway

Enterprise Asset Management

Endpoint Agent

Agentless Security Posture

Identity

Wireless

Switching

Identity

Privilege Acccess Management

Next Generation Firewall

Orchestration & management

Expert Services

All

All

Account Management

SAAS Management

SAAS Application Security

Managed Services

Platform as a service (PAAS)

Other SAAS Services

4D Pillars

Cloud

Popular Solutions

Administration Guide

SSL VPN with Microsoft Entra SSO integration

SSL VPN with Microsoft Entra SSO integration

SSL VPN with Microsoft Entra SSO integration

SSL VPN with Microsoft Entra SSO integration