How to configure LAN, VLAN, DHCP & DNS on FortiGate Firewall (Part 3)

[@ThonAllan]

very informative galing nag pagkakadali😊

[@ALLYOUNEEDTOKNOW90]

Amazing content, This is what exactly i was looking for.. Thank you very much.

[@IgoroTech-Official]

Glad it was helpful!

[@freeza0023]

Thank you so much for your content.

[@nishikant705]

you explained very well.Thanks

[@eduardoeller1231]

Me tira uma duvida sobre o DHCP Server? Eu tenho um servidor onde as VM's dele apontam para meu servidor de ADDS, porém não achei nos reservados a opção de setar o dns para aquela máquina, como eu faço? Obs: No PfSense eu conseguia fazer isso, por máquina, no Fortigate não achei como.

[@muddssarkazi306]

Very very helpful i subscriber you channel. Thanks yo so much

[@IgoroTech-Official]

Thanks and welcome

[@muthudiamond]

Nice Explanation

[@mukeshdhawan1237]

hey when i going to extend the IP pool it is asking for VLAN id that should be 2 or greater than 2. However i want to configure only native VLAN so how i can resolve it

[@reucame]

I have a question regarding the IP/Netmask section under Address, I have the 60F as well but in my case the destination reads as 192.168.1.0/24 and not 192.168.1.99/255.255.255.0, and my IP/Netmask is exatcly as 192.168.1.99/255.255.255.0, does anyone know why?

[@IgoroTech-Official]

hi there, 192.168.1.99 is the gateway while 192.168.1.0/24 is the network address. For the interface, you need to enter the IP/netmask (gateway). If your question is about the NAT policy, the network address should be the source.

[@stevanusertito5810]

I have created a vlan like you did, but how do I access the "Guess" and "Server" vlans? do I have to use a trunk?

[@IgoroTech-Official]

hi, if your question is the inter VLAN (Guest VLAN to access Server VLAN vv) then you just need to create a firewall policy, source is the guest VLAN interface and destination is the server VLAN interface

[@Akash-jo6bm]

about the administrative access in which case we should check the https,ssh and Ping etc option and which case we should not check need explaination

[@IgoroTech-Official]

hi there; 1. You can enable HTTPS and ping only on the internet facing interface (WAN Interface). Best practice not to enable/allow SSH & Telnet on WAN Interfaces. HTTPS for management and ping for troubleshooting purposes. 2. For better security, you can disable HTTPS on WAN Interfaces and if you want to access the device from the internet then use SSL VPN. You want more security? enable 2FA (two factor authentication), by default, each FortiGate have 2 free Forti tokens. 3. For LAN interfaces, you can enable HTTPS & SSH if you prefer but don't ever enable telnet or HTTP.

[@Akash-jo6bm]

@@IgoroTech-Official thank you but can you explain it to me with simple word? its still not clear to me

[@IgoroTech-Official]

HTTPS is for you to manage the FortiGate through web/browser. If you have no plan to access the fortigate from the internet then no need for you to enable the HTTPS. SSH is for you to manage the FortiGate through CLI using putty or other terminal emulator, its not recommended to enable on WAN interfaces for security purposes. For you to manage the Fortigate you need to enable SSH or HTTPS. you can enable it on LAN interface but not on WAN interfaces for better security.

[@DomesthiccViolence]

Thank you so much for the effort. Nice content.

[@IgoroTech-Official]

My pleasure!

[@technologychanenel]

is there software can i use as fortigate

[@IgoroTech-Official]

hi there, yes you can use VMware, you can follow this video if you're interested. kzbin.info/www/bejne/mKunhXl3rpKHl8U

[@NorbertoAndradaPadiernos]

Hi what if my DHCP is from our Access Controllers how will I do that?

[@IgoroTech-Official]

hi there, in that case, you need to configure the IP address statically but make sure to use an unused IP address and remember to configure the default static route as well.

[@norbertopadiernos8240]

@@IgoroTech-Official thank you by the way what should I aggregated or lan then will add the vlan

[@IgoroTech-Official]

@@norbertopadiernos8240 it depends on the requirements or what you want to achieve. If you are planning to configure multiple LANs and as long as you have enough LAN ports then no need to configure VLANS, you can simply configure different subnets for each port (diff port = diff switch) and then manage it thru the policies. In this way, you can have 1GB output for each network. However, if you plan to connect to 1 switch (distri/CS) then you need to configure the VLAN's. Additionally, you can configure link aggregate, or 1 port for each VLAN. Again, it depends on the requirements and each net admin has each different technique.

[@frncscbñz]

✅

[@matthewchristoforou5324]

So i literally cant do any of this on the evaluation license ....

[@IgoroTech-Official]

hi, for the versions 7.2 and above yes, but for the older versions you can. however, the older versions only valid for 30 days.

[@freeza0023]

yeah same problem here. it sucks to work on evaluation license and its hard to learn anything.

[@xlv600tr]

Really clear. Thank you