how do I point to the sso address in dns and point to the ssl-vpn portal
@mattsherif9141Ай бұрын
Can you please clarify the question? I am not sure I follow.
@hali13372 ай бұрын
Will the NPS Extension for Azure MFA overtake the complete RADIUS-Server or how controll it?
@larryyundelson19453 ай бұрын
They definitely didn’t know about that in Ironman . Great video thank you
@0xAMBIENT4 ай бұрын
Great video, thanks Matt. Was struggling a little to understand the topology of MCLAG and the split interface setting and this helped a lot. Cheers.
@ITGuyGary4 ай бұрын
FYI - at 10:46, your Public IP is visible at the bottom of the "Your connections is not private" page
@danimoosakhan4 ай бұрын
I see u enabling mc-lag via FortiSwitch CLI, but according to Fortinet documentation, they want us to do it this way: Assign the LLDP profile “default-auto-mclag-icl” to the ports that should form the MCLAG ICL in FortiSwitch unit 1. For example: FGT_Switch_Controller # config switch-controller managed-switch FGT_Switch_Controller (managed-switch) # edit FS1E48T419000051 FGT_Switch_Controller (FS1E48T419000051) # config ports FGT_Switch_Controller (ports) # edit port49 FGT_Switch_Controller (port49) # set lldp-profile default-auto-mclag-icl FGT_Switch_Controller (port49) # end FGT_Switch_Controller (FS1E48T419000051) # end I don’t know what is the difference, because in above example I don’t see them enabling mc-lag on a switch port which is connected to Fortigate. They only doing the ICL part, but not the fortilink part where the switch connects to the Fortigate. I am little confused here.
@hummer-k1k4 ай бұрын
Also me, this made me confused. And there is a thrid way, through the fabric rating recommendation...
@stevca19955 ай бұрын
In environment where I have windows servers with 4 NIC teamed in one Team, and 2 of them are connected to first switch, and other 2 are connected to the second switch where switches are mclaged correctly, how mac tables should look like on both switches?
@yawnyame9816 ай бұрын
I have followed the process where but it is not working. Connecting stuck at 10% with vpn unreachable gateway
@JustinHoMi6 ай бұрын
FYI, ya forgot to censor your public IP one time.
@nielstaildeman7 ай бұрын
When is part 2 coming?
@alexsigcho30987 ай бұрын
"Hello! Great video. I have a question: if you have multiple VPN connections, is it necessary to create a separate enterprise application for each IP address? Also, should I upload a different certificate for each one, depending on the VPN that the client chooses to connect with?
@mattsherif91417 ай бұрын
This is where DNS is going to be your friend, if you have some sort of service like AWS route 53, or Azure DNS, that point vpn.mydomain.local (fictional - .local isn't a usable TLD) you could have them monitor both IPs, and either load balance or assign primary and secondary. In this case you could just use the dns record as the base URL. So if one of your links goes down, your DNS service detects it and just "resolves" all new queries to the valid IP
@EverythingEvo8 ай бұрын
Let's go a new video! #first
@praveenraj47879 ай бұрын
Hi that was great video. But we are trying the same using Azure AD DS and configured Fortigate using ADDS Ldap. We need to configure same mfa using azure ad ds Please help
@capricornnnn10 ай бұрын
Thanks. How do you deny the bad IP addresses from reaching to SSL VPN?
@mattsherif914110 ай бұрын
Great question! You can pin the SSL vpn instance to a loopback. Allowing you to use threat feeds and other handy features. Thats explained here: kzbin.info/www/bejne/ipDPXpellNSWn5osi=eskibN__w7Wsp1zx
@capricornnnn10 ай бұрын
@@mattsherif9141 Thanks. I think its the same video but I just heard you saying that you can use ISDB but not much explanation. Sorry if I have missed it. "You can pin the SSL vpn instance to a loopback": can you explain this more? I have followed your instruction and SSL VPN works on Loopback interface but If I try to use ISDB of malicious IP addresses and put a Deny that it doesn't work.
@mattsherif914110 ай бұрын
@@capricornnnn You don't want the ISDB in this case, you want to either come up with your own threat feed and use that a source and deny anything coming from that. You could also use GEO IP adddress objects and block those as well. ISDB doesn't apply in this scenario.
@capricornnnn10 ай бұрын
@@mattsherif9141 So what you are saying is that its not possible to use ISDB with SSL VPN terminating to loopback interface? I am testing because what my understanding is that in order to use ISDB then I have to use Loopback interface and its not possible to use ISDB with local in policy. Threat feed can be used with local in policy. If Threat feed is the only way then I am thinking to stick with my current setup and use threat feed using local in policy. Do you have some doc or youtube video how to setup external threat feed. I heard that Talos is free but not sure how to use it.
@mattsherif914110 ай бұрын
@@capricornnnn I am not saying that, I am saying your best bet is a threat feed. Here's the doc on configuring a threat feed docs.fortinet.com/document/fortigate/7.2.6/administration-guide/379433/configuring-a-threat-feed
@jusdesireable322410 ай бұрын
Great vid. Question for authentication, do you have to use the authentication app or is there a way to setup user's to use calling or text as an option as well?
@mattsherif914110 ай бұрын
Yes - thats up to you how you set that in Entra (Azure AD).
@superscribd Жыл бұрын
So as of now if someone wishes to roll out Fortigate SD-WAN with ZTP, template builds and the ability to monitor their Fortigate SDWAN overlay, what are the core components required? Obviously each site requires a Fortigate FW to act as an edge device. Do they also need Fortigate Orchestrator licensing to add Orchestrator functionality to Fortimanager? Do they require Fortianalyzer as an additional license to be accessed via Fortimanager?
@randada1 Жыл бұрын
there's something we aint seeing here. this configuration doesnt work as the SSL Loopback interface is unreachable even after doing the VIPs and fw policies. i went thru the community forum and folks pointed out this video too but ultimately is missing a few configurations
@BAccountGrandMafia Жыл бұрын
When will part 2 be ready? this is really interesting
@user-iu2nc5pj3m Жыл бұрын
Hey Matt, I've had a go at setting this up... It's working and I'm getting lots of hit on the FW policy. But no logs are showing up when I look for matching logs? Any ideas?
@mattsherif9141 Жыл бұрын
Yes - check under the local traffic logs instead of forward traffic logs. Despite the policy being for "forwarded traffic" FGT is smart enough to know this traffic will actually terminate on it.
@eerd2449 Жыл бұрын
I think its better to first enable MCLAG ICL on both switches, and as second step enable MCLAG, then you wont lose your connection. Still very useful video!
@JoeyGarcia11 ай бұрын
You do this via lldp? I mean by setting the lldp profile on the ports bing used as the mclag icl?
@scatpack1017 Жыл бұрын
Awesome video and super helpful. You can actually use external threat feeds with local-in policies. They can be used with a negate source option like any other address object.
@capricornnnn10 ай бұрын
any implementation doc with some example?
@talmars Жыл бұрын
We are looking at a full network refresh at my organization. I have many closets that are 3 or more traditional switch stacks. Each closet has redundant fiber to it running back to the data center. Like others have posted, how would I setup a closet with 6 switches in a FortiSwitch architecture. What about 7 switches?
@mattsherif9141 Жыл бұрын
That's going to depend on your requirements, and the number of fiber strands you have running back to the datacenter. You could set up an MCLAG pair in each closet, and have the remaining switches connect to those. You need to take the following into consideration: docs.fortinet.com/document/fortiswitch/7.2.4/fortilink-guide/801194/deploying-mclag-topologies You could have home runs back to the datacenter for each switch to go into your MCLAG Pair at the datacenter. Frankly I don't have enough information to give you a good recommendation.
@EverythingEvo Жыл бұрын
Great video!
@bytes86 Жыл бұрын
wow...very interesting, didn't know that and other features, thanks Matt! How you create your own CA certificate and install it on the FortiGate? Do you have any guides or videos for the EMS? I really like your content!
@mattsherif9141 Жыл бұрын
Thank you for watching! Creating your own CA and installing on the FortiGate is going to depend on what Certificate/PKI infrastructure you have. I may make a video that covers that at a later date.
@bytes86 Жыл бұрын
@@mattsherif9141 thanks Matt! even for lab environment, for different use cases (ems,ssl inspections,etc)
@mattsherif9141 Жыл бұрын
@@bytes86 I may do a FortiAuthenticator video that helps.
@bytes86 Жыл бұрын
@@mattsherif9141 Thanks! any video will assist, i want to learn and deep dive the Fortinet devices
@oinkersable Жыл бұрын
Nice work Matt, so you are keeping vpn establishment auth to un and cert based only but with limited access by fw policy until the user saml auths (captive portal?) and gets associated with a saml group that has more access?
@EverythingEvo Жыл бұрын
Sweet!
@bytes86 Жыл бұрын
Nicely done! looks very interesting.
@666nosss Жыл бұрын
I dont think you can have 4 switches in mclag, i am looking like crazy to find a solution for 4 switches
@vidmooreda Жыл бұрын
If I am correct, you can only have two per MCLAG peer group. So, in my mind, you would gave two MCLAG groups. Have you found a solution? I am needing to do this with 12, which means I would need 6 MCLAG peer groups... but I may be wrong. @matt can you confirm?
@mattsherif9141 Жыл бұрын
@@vidmooreda - That would be accurate, MCLAG groups aren't meant as an analog for a switch stack. The whole FortiOS controlled switch architecture is meant to be a distributed "Stack" if that terminology can apply. More info here: docs.fortinet.com/document/fortiswitch/7.2.4/fortilink-guide/801194/deploying-mclag-topologies
@oinkersable Жыл бұрын
Great job Matt, nice to see it in action and for your other 2 vids on the subject. I had an SE tell me ipsec tunnels to connect to corp locations were not possible on SASE, which I couldn't accept as true :D , nice to know its not the case and is a usable solution. How do you find the speeds from the endpoints, was it 10Mb p/s per user bandwidth limitations on the basic SKU?
@osmanardanan86 Жыл бұрын
Hey Matt, aren't the security profiles on the vip policy useless? I mean the traffic is not inspected bei virtual server and is completely encrypted anyway, isn't it?
@mattsherif9141 Жыл бұрын
Hey Osman, not necessarily. This is to mitigate against known SSL VPN attacks, it also allows you to specify more inspection types vs. local in policy.
@bytes86 Жыл бұрын
Thanks Matt, love your videos, learning from you a lot!🙏
@oinkersable Жыл бұрын
Cheers Matt, any cpu performance concerns when using the virtual interface, does offloading still happen for loopbacks, sslvpn isnt offloadad afaik but in general like ipsec on a loopback?
@blakman1984 Жыл бұрын
Top tier as always! Thank you for the enlightening video!
@bytes86 Жыл бұрын
Thanks Matt! learn a lot from you! please share more video of Fortinet solutions, Happy X-Mas!
@bytes86 Жыл бұрын
@@mattsherif9141 Thank you for the interesting video, i love to learn and deep dive for other stuff
@bytes86 Жыл бұрын
Thanks, Matt!
@mattsherif9141 Жыл бұрын
Thank you for watching!
@bytes86 Жыл бұрын
Thanks, Matt! very interesting!
@burtmianus Жыл бұрын
If like me you skipped ahead to the iphone part, it's worth noting that iPhone Shortcuts needs the SSL connection to be valid so certificate etc. required (using IP doesn't seem to work)
@runninl8 Жыл бұрын
Awesome video, really helped out a lot. thank you!
@bytes86 Жыл бұрын
Great video, ty very much Matt! please share more videos!
@mattsherif9141 Жыл бұрын
Thank you for watching! Anything you'd like to see?
@bentiberius21772 жыл бұрын
That's exactly what I was looking for this morning! No more texting folks to see if they've got a specific model of FortiGate to grab the default config from. One thing on this video, your audio level is really low so I had to crank the speakers.
@EverythingEvo2 жыл бұрын
Nice method of getting that config, thanks!
@bytes862 жыл бұрын
Thanks Matt!
@guihiagoafonso89372 жыл бұрын
Can you help me with this setup?
@HETASHPATEL2 жыл бұрын
Great Video ! we were getting token codes before but since the implementation of 2MFA when I connected with forticlient for the first time it asked me for approval on MS authenticator but everytime after that it connects to Forti without any kind of approval because I am selecting check box"do not ask me for 30 days" unless I clear cookies from CMD .Though the script we have requires it to clear cookies automatically on every disconnct but this has not helped me with my user name specifically . any ideas on that ?
@aleks.lambreca2 жыл бұрын
Great content, i would only suggest to increase the sound's volume!
@bytes862 жыл бұрын
Thank you very much! love your videos! learning a lot!
@bytes862 жыл бұрын
Hey Mate, please add move advanced configuration on the Fortigate, Forti Analyzer,Manager (integration between them maybe)
@bytes862 жыл бұрын
really interesting, ty very much!
@jeffpelletier3672 жыл бұрын
Ignore the video, that just shows it working. The link is where the real instructions are.
@mattsherif91412 жыл бұрын
Thank you for reading. Yes, the video is posted for the tail end of the instructions to show the result of the work.
@daniellee58652 жыл бұрын
Hi sir, I following the article, it work! Thanks a lot. But I need more help please. After that I tried OTP, NPS extension err code:Request_MISSING_CODE err msg: Request is missing OTP I didn't know what else I have to do.