Tagged: Fortinet
127 posts · browse all tags
-
PEERSTITCH: What a FortiManager Compromise Leaves Behind After You Patch It
Unit 42 describes a memory-only FortiGate implant, PEERSTITCH, deployed after a FortiManager breach and a CVE-2025-61624 privilege escalation. The patch closes the doors. It does not revoke what was already stolen.
-
Arista SD-Branch Part 11: Arista vs Fortinet, Cisco and Juniper for the Branch
A closing comparison of Arista CloudVision and AGNI against Fortinet, Cisco and Juniper branch stacks, with the trade-offs, a design checklist, and where the Arista approach fits.
-
FortiBleed Update: the FBI and Secret Service Advisory, and the FortiMail Zero-Day CVE-2026-104286
The FBI and Secret Service now put FortiBleed at 86,644 compromised FortiGates and say attackers are locking admins out. Separately, FortiMail CVE-2026-104286 (CVSS 9.8) was exploited before a patch existed. What changed, what is unrelated, and what to check.
-
FortiGate BGP Cookbook Part 1: Dual-ISP Edge Recipes
Six FortiGate BGP recipes for a dual-homed internet edge: stop being a transit AS, accept only a default route, steer traffic in both directions, advertise a prefix with no connected route, originate a default, and authenticate the session with TCP-AO.
-
FortiGate BGP Cookbook Part 2: Verify and Debug
The commands I run after every FortiGate BGP change: read the session, compare received and advertised routes before and after policy, soft-clear safely, triage a session that will not establish, and run BGP debug without leaving it on.
-
FortiClient EMS 7.4.5: The Fix for One Critical Bug, the First Version Hit by the Next
FortiClient EMS 7.4.5 fixed CVE-2026-21643 and was the first version affected by CVE-2026-35616. Both are critical and unauthenticated. Affected versions, fixed builds and the 7.4.7 upgrade traps, from Fortinet's own advisories.
-
The Chain Nobody's Advisory Describes: FortiSandbox's Three CVEs, Read Together
A follow-up to this site's CVE-2026-25089 post: a threat intel firm reports that bug chained with two more FortiSandbox CVEs (file-read plus privesc) for unauthenticated root in practice. What's confirmed by Fortinet's own advisories versus what's one firm's account, held carefully apart.
-
Start VNC, Start a Shell: Inside CVE-2026-25089 on FortiSandbox
CVE-2026-25089 is a CVSS 9.8 unauthenticated OS command injection in FortiSandbox's Web UI, actively exploited since mid-June and on CISA's KEV list since July. No password, no CVE chaining, just a crafted request to a device that already sits inline reading everything suspicious you feed it.
-
Where Security Fabric Ends and FortiSASE Begins: One Fabric, One Agent
Security Fabric is the automation and visibility layer tying Fortinet devices together. FortiSASE is a cloud-delivered PoP that speaks the same fabric language. Neither is a bolt-on to the other, and the FortiClient agent is the thing that makes the seam disappear.
-
Threat Intelligence and FortiGuard Tuning: Making IPS Signatures Actually Work for You
FortiGuard ships new IPS signatures constantly and most of them arrive with a default action nobody chose deliberately. The difference between a tuned IPS deployment and a noisy one isn't the signature database, it's what you do with the defaults.
-
A Backdoor Named forticloud-sync: Inside the Gunra Ransomware Advisory and Two Fortinet CVEs From Early 2025
Six agencies, one ransomware gang, and two Fortinet CVEs that have been patchable since early 2025 and are still getting exploited. The most interesting detail in the advisory isn't the encryption — it's an MFA bypass that leaves the identity provider's own logs looking completely clean.
-
Five Minutes and an Empty Port Part 10: The Closing Checklist and a Vendor Comparison
Closing the series: a practical checklist pulling Parts 7 through 9 together, and a straight comparison of how Cisco, Fortinet, Juniper, and Arista actually implement each control.
-
Five Minutes and an Empty Port Part 7: Port Security and the Layer 2 Hygiene Most Networks Already Own
The defensive turn starts at the layer that would have stopped Part 6's persistent dropbox outright: port security, DHCP snooping, Dynamic ARP Inspection, and the rest of the Layer 2 hygiene most switches can already do without buying anything new.
-
Five Minutes and an Empty Port Part 8: 802.1X, MAB, and the NAC Platforms Behind the Curtain
Port security answers whether a device is the one already learned on a port. 802.1X and the NAC platforms behind it answer the harder question: whether this specific identity, on this specific device, should be on the network at all.
-
NSE7 Part 1: Exam Blueprint and Study Roadmap
What the NSE 7 - Secure Networking Architect exam actually tests, how the blueprint's five domains break down by weight, the prerequisites, and the roadmap for the 13 parts that follow.
-
NSE7 Part 10: Designing SD-WAN Rules and Routing
The SD-WAN rule lookup process, application steering and learning, ISDB as a matching criterion, and the routing-table mechanics underneath it all: policy routes, the route lookup process, session tables, and what happens to routing mid-session under SNAT.
-
NSE7 Part 11: Advanced IPsec: Multihub, Multiregion, and Large Deployments
DPD modes, outbound NAT against interfaces with no IP, MTU and fragmentation, hardware offload and the NPU-Flag field, dual-hub topologies with BGP self-healing, and VRF-aware overlays for MSSP-scale deployments.
-
NSE7 Part 12: ADVPN: On-Demand Shortcuts and BGP on Loopback
Shortcut negotiation mechanics, IBGP and EBGP hub-and-spoke designs, shortcut timeout and dependent shortcuts, and what ADVPN 2.0 actually changes about a problem ADVPN 1.0 never fully solved.
-
NSE7 Part 13: A Full Design Walkthrough, and Exam Day
A two-region, dual-hub, ADVPN, VDOM-segmented MSSP design tying every domain in this series together, the diagnostic commands that confirm each layer is working, and the logistics of the exam itself.
-
NSE7 Part 2: Security Fabric at Enterprise Scale
Fabric Connectors versus external connectors, Automation Stitches, and the four integration use cases the NSE 7 blueprint names by name: SAML SSO, automated IoC quarantine, FortiNAC dynamic addressing, and FortiNDR.
-
NSE7 Part 3: High Availability, FGCP, FGSP, and Where VRRP Still Fits
Active-active load balancing, virtual clustering for VDOM partitioning, FGSP standalone session sync across asymmetric and cloud topologies, and the honest case for still reaching for VRRP.
-
NSE7 Part 4: VLANs and VDOMs at Enterprise Scale
The virtual LAN switch, the three VDOM types, and the segmentation and inter-VDOM-routing use cases that separate a lab VDOM demo from a real enterprise design.
-
NSE7 Part 5: Enterprise SD-WAN Fundamentals: DIA and Monitoring
SD-WAN's basic components at the architecture level, direct internet access topologies and best practices, and the monitoring surface (widgets, traffic logs, and events) that a live deployment actually gets judged on.
-
NSE7 Part 6: Central Management, ZTP and SD-WAN Manager on FortiManager
Zero-touch provisioning of SD-WAN branches, device blueprints and CSV import, and how FortiManager's SD-WAN-specific tooling (metadata variables, IPsec templates, and the overlay template) turns one hub-and-spoke design into hundreds of devices.
-
NSE7 Part 7: Security Profiles at Scale: SSL/SSH Inspection and UTM Performance
Certificate inspection versus full inspection as a design decision, the SNI check, false positives, and the honest performance cost of stacking web filtering, application control, IPS, and ISDB.
-
NSE7 Part 8: OSPF for Enterprise Routing
The FortiOS-specific pieces the blueprint actually tests: access lists, prefix lists, route maps, redistribution, running OSPF over an IPsec interface, and ECMP with OSPF routes.
-
NSE7 Part 9: BGP for Enterprise Routing
Loopback interfaces as BGP sources, the neighbor-group command for scaling peer configuration, and optimizing for rapid convergence: route reflectors, the BFD parameter, and graceful-restart on FortiOS.
-
Two Ways to Lose a VPN Gateway: FortiBleed's Credential Harvest and PAN-OS's Forged Auth Cookie
Two 2026 VPN gateway incidents, same attack surface, opposite root causes. FortiBleed has no CVE and no patch: a hashing migration that never finished, cracked at scale. CVE-2026-0257 is a real code defect: a certificate reused for two trust purposes that led straight to Qilin ransomware.
-
The Wildcard That Wasn't: CVE-2026-26035 and FortiWeb's RADIUS Admin Login Bypass
A non-default setting meant to make RADIUS group matching more flexible turns into a way to log into FortiWeb's GUI and CLI with a username and password that don't need to be correct. CVE-2026-26035, and why "wildcard" is a word worth treating with suspicion in any auth config.
-
Wearing Someone Else's Certificate: CVE-2026-70468 and FortiManager's FGFM Trust Model
A specific CLI option, a valid certificate, and a crafted FGFM request are enough to let one managed FortiGate impersonate any other in the eyes of its FortiManager. CVE-2026-70468, and what it says about certificate trust in a one-to-many management protocol.
-
CVE-2026-45504 Part 4: Detection, Hardening, and Patching Priority
Patch first. After that, EWS activity logging and outbound-traffic baselining are the two layers that catch this kind of abuse, closing the loop this series opened with a six-year-old cracked password.
-
SSL/TLS Deep Inspection Internals on FortiGate: What UTM Actually Costs You
Certificate inspection reads the SNI and moves on. Deep inspection terminates the TLS session and re-signs the server's certificate with your own CA. What that costs in CPU, what it breaks in pinned apps, and why TLS 1.3 made the choice less optional.
-
Route Leaking Between VRFs on FortiGate: What Happens When You Actually Build It
I set out to build the BGP leak-target VRF route-leaking mechanism from my own earlier post, on a real FortiGate 70G. It hit three undocumented platform quirks in a row. The real answer turned out to be a static route over a VDOM-link — no BGP required.
-
OSPF Deep Dive Part 10: A Vendor-Neutral Troubleshooting Methodology
A structured way to diagnose OSPF problems that works on any vendor, because it's built on the neighbor state machine from Part 1, not on any platform's specific commands: what state is it stuck at, and what does that state rule in or out.
-
OSPF Deep Dive Part 11: Show Commands and the LSDB, Side by Side
The same neighbor table, interface state, and LSDB, read through three different command sets: Cisco IOS/IOS-XE, FortiOS, and Junos, mapped side by side against the CORE-CSR/BRANCH-FGT/EDGE-MX lab from this series.
-
OSPF Deep Dive Part 12: A Multi-Vendor Outage, Start to Finish
A closing walkthrough on the CORE-CSR/BRANCH-FGT/EDGE-MX lab: a complaint with no down interfaces and no failed adjacencies anywhere, a red herring that turns out to be real but irrelevant, and a root cause that traces straight back to Part 3's reference-bandwidth warning.
-
OSPF Deep Dive Part 4: Virtual Links, Summarization, and Redistribution
Fixing the lab's missing backbone connection with a virtual link, then summarizing at the ABR and redistributing a static route at the NSSA's ASBR, with working syntax on Cisco, FortiOS, and Junos for each.
-
OSPF Deep Dive Part 5: OSPFv3 and Running OSPF Over IPv6
OSPFv3 isn't OSPFv2 with bigger addresses. It separates topology from addressing, drops built-in authentication in favor of IPsec, and runs over link-local addresses by default, plus the per-vendor syntax to bring it up on Cisco, FortiOS, and Junos.
-
OSPF Deep Dive Part 6: Authentication and Security Hardening
What an unauthenticated OSPF segment actually exposes, why plaintext and MD5 authentication are both weaker than they look, and how to configure HMAC-SHA key chains on Cisco, FortiOS, and Junos.
-
OSPF Deep Dive Part 8: FortiOS Implementation and Gotchas
BRANCH-FGT's configuration: why FortiOS has no passive-interface-default equivalent, how OSPF scopes to a VDOM, the router-id selection rule that actually differs from Cisco's, and how OSPF interacts with SD-WAN policy routes.
-
Juniper Session Smart SD-WAN Deep Dive Part 8: Failure Modes, Scale Limits, and a Five-Way Vendor Comparison
Series finale. What happens to the data plane when Conductor or Mist goes dark, where SSR's scale story sits, and Session Smart Routing lined up against Fortinet, Cisco/Viptela, Arista/VeloCloud, and Palo Alto/Prisma — five philosophies, one underlying question.
-
Palo Alto Prisma SDWAN Deep Dive Part 8: Failure Modes, Scale Limits, and a Vendor Comparison Checklist
Series finale. What actually happens when Strata Cloud Manager goes dark, where Prisma SDWAN's scale limits sit, and an honest, direct comparison against Fortinet's collapsed model and Cisco's fully decoupled one — the fourth philosophy, lined up against the three already covered on this site.
-
Pivoting and Tunneling Part 6: Defense in Depth — Segmentation, Egress Filtering, and Catching a Pivot on a Fortinet Fabric
The full chain from Impacket foothold to FIN-DB01 told end to end, followed by a concrete hardening checklist — internal segmentation firewalling, default-deny egress, TLS inspection, and the flow-based indicators from this series mapped onto real Fortinet configuration.
-
Ansible Deep Dive Part 10 Lab: Automating a Cisco and FortiGate Fleet With Ansible
Part 10, the second lab: network-specific Ansible modules against a mixed Cisco IOS and FortiGate fleet — cisco.ios facts and config, fortinet.fortios firewall policy objects, connection: network_cli vs httpapi, and a config-drift check playbook.
-
SDWAN Control Plane Showdown: Three Philosophies for Solving the Same Problem
Fortinet collapses control onto the data-plane device. Arista/VeloCloud collocates it on a multi-tenant Gateway. Cisco/Viptela decouples it fully into vSmart and OMP. Three architectures covered on this site, lined up side by side, right before the Cisco series picks up the third one.
-
Building an Enterprise-Grade NTP Service with chrony and Integrating it with FortiGate: Chronos Keeps Time
Why we chose chrony over ntpd and timesyncd, what CIS and Fortinet hardening guides say about NTP, a full build walkthrough, the deny-all ordering mistake every network engineer will make, and how to generate NTP keys that FortiOS will actually accept.
-
One Box, Many Firewalls: A Practical Guide to FortiGate VDOMs
Virtual domains let a single FortiGate behave as several independent firewalls — separate routing tables, policies, and administrative boundaries on shared hardware. When that's the right tool, when a VRF is the better one, and how inter-VDOM routing actually moves a packet between them.
-
FortiAnalyzer and FortiMonitor for SDWAN SLA Observability: Watching the Fabric
The operational bookend to the SDWAN design series — how FortiAnalyzer and FortiMonitor turn the performance-SLA assumptions baked into your hub placement and resilience design into something you can actually alert on, trend, and defend with data months later.
-
Migrating from MPLS to SDWAN Without a Bad Weekend: The Cutover Playbook
A phased, dual-running migration plan for moving a branch off MPLS and onto SDWAN — route-map-based preference during transition, what to validate before each cutover step, and the rollback triggers that keep a bad change from becoming an outage.
-
IPsec Deep Dive Part 1: ESP, AH, and How IKE Phase 1 Actually Brings a Tunnel Up
IPsec underpins every Fortinet SDWAN overlay this blog has built, and it's never had its own deep dive. Part 1 fixes that: the SA model, ESP vs AH, tunnel vs transport, and a message-by-message walk through IKEv1 main mode, aggressive mode, and IKEv2.
-
IPsec Deep Dive Part 2: Phase 2, Child SAs, and the Anatomy of an ESP Packet
Phase 1 built a control channel and protected nothing. Part 2 covers the negotiation that actually moves data: quick mode and child SAs, traffic selectors, PFS, rekeying, and anti-replay — then dissects an ESP packet field by field, down to the MTU math.
-
IPsec Deep Dive Part 3: NAT vs IPsec — NAT-T, Port Forwarding, and the Fortinet SDWAN Reality
NAT breaks IPsec three distinct ways — AH's ICV, ESP's missing ports, and IKE's rewritten source port. Part 3 covers each break, how NAT-D detects it and NAT-T's UDP 4500 encapsulation repairs it, when port forwarding is still required, and what it all means for SDWAN spokes behind CPE NAT.
-
Traffic Shaping and QoS Internals on Fortinet SDWAN: Policed, Not Just Routed
Application-aware routing decides which path a flow takes. Shaping decides what happens to it once it's there — shaping profiles, per-IP and per-policy shapers, queue assignment, and how it all interacts with NP7 hardware offload.
-
NSE6 Part 1: Stream Overview, Exam Structure, and the Secure Networking Stack
What the NSE6 Secure Networking specialist stream covers, how the four product exam tracks fit together, and how FortiAuthenticator, FortiSwitch, FortiAP, and FortiNAC form a joined-up access-layer security story.
-
NSE6 Part 10: FortiAP Rogue Detection, Wireless IDS, Mesh, and Troubleshooting
WIDS rogue AP classification and containment, wireless IDS signature types, FortiAP mesh topology with root and leaf APs, OfficeExtender remote AP split-tunnel deployment, and the diagnostic commands and common failure patterns for the FCA-FAP exam troubleshooting section.
-
NSE6 Part 11: FortiNAC Architecture, Network Discovery, and Device Profiling
NAC concepts and where FortiNAC sits in the Security Fabric, Control and Application server roles, HA architecture, how FortiNAC discovers network devices via SNMP and SSH, passive and active endpoint discovery, and the fingerprinting methods that determine what type of device is on each port.
-
NSE6 Part 12: FortiNAC Access Policies, CoA, and VLAN Enforcement
The FortiNAC policy model — groups, access values, and network access policies — how RADIUS and CoA enforce VLAN assignment on FortiSwitch and third-party switches, logical networks for VLAN abstraction, and the end-to-end 802.1X enforcement flow from endpoint connect to VLAN assignment.
-
NSE6 Part 13: FortiNAC Endpoint Compliance, Agents, and Host Isolation
Persistent, dissolvable, and agentless posture assessment methods, compliance rules and remediation actions, quarantine VLAN and isolation workflow, guest self-registration and sponsor approval, BYOD certificate onboarding, and MDM integration with Intune, Jamf, and FortiClient EMS.
-
NSE6 Part 14: FortiNAC HA, Reporting, and End-to-End Troubleshooting
FortiNAC HA failover mechanics, MySQL replication, syslog/FAZ integration, alarm framework, built-in and custom reports, and a systematic troubleshooting guide for discovery failures, enforcement problems, and 802.1X issues — with a complete end-to-end trace of a new endpoint joining.
-
NSE6 Part 2: FortiAuthenticator Architecture and Local Authentication
FortiAuthenticator deployment modes, hardware vs VM sizing, initial setup, local user and group management, password policies, account lockout, and the admin interfaces you use to build out a working identity store before you plug in LDAP or RADIUS.
-
NSE6 Part 3: FortiAuthenticator RADIUS Service, LDAP Integration, and Remote Auth
How FortiAuthenticator acts as a RADIUS server for FortiGate, FortiSwitch, and other NAS devices; configuring realms and routing; integrating with Active Directory via LDAP; and the diagnostic commands that expose exactly where an authentication flow breaks.
-
NSE6 Part 4: FortiToken 2FA, Certificate Management, and the Self-Service Portal
Adding a second factor with FortiToken hardware and mobile tokens, certificate authority configuration and SCEP enrollment, and setting up the self-service portal for password reset, token activation, and guest account management with sponsor approval.
-
NSE6 Part 5: FortiSwitch Hardware, FortiLink Managed Mode, and Initial Provisioning
FortiSwitch hardware families and PoE considerations, how FortiLink turns a FortiGate into a wired switching controller, the discovery and authorisation process for bringing a switch under management, and firmware management from the FortiGate GUI.
-
NSE6 Part 6: FortiSwitch VLANs, RSTP, Link Aggregation, and Stacking Design
VLAN trunking and access port configuration under FortiLink, RSTP bridge priority and port roles, static and LACP link aggregation, MCLAG dual-homing for access-layer resilience, and QoS trust modes for DSCP/CoS remarking at the network edge.
-
NSE6 Part 7: FortiSwitch 802.1X, MAC Authentication Bypass, and Port Security
Port-level 802.1X authentication with FortiAuthenticator as the RADIUS backend, EAP method selection, dynamic VLAN assignment from RADIUS attributes, MAC Authentication Bypass for non-supplicant devices, sticky MAC port security, and CoA-triggered VLAN changes mid-session.
-
NSE6 Part 8: FortiAP Hardware, CAPWAP Discovery, and AP Provisioning
Wi-Fi 6 fundamentals and the key 802.11 standards, FortiAP hardware families and PoE requirements, how CAPWAP connects APs to the FortiGate wireless controller, the four AP discovery methods, WTP profile configuration, and the authorisation and firmware management workflow.
-
NSE6 Part 9: FortiAP SSIDs, Wireless Security Modes, and RF Management
SSID and VAP configuration options, every wireless security mode from Open to WPA3-Enterprise, dynamic VLAN assignment via RADIUS for wireless, captive portal integration with FortiAuthenticator, band steering, and the RF management tools that keep channels clean in dense deployments.
-
Zero Trust Meets the Overlay: Converging ZTNA and SDWAN on Fortinet
The capstone to the SDWAN series: how Fortinet's ZTNA tags and access proxy let you fold per-application, identity-aware access control directly into the SDWAN fabric — built on the RADIUS/TACACS AAA backend and the PKI you already stood up for IPsec.
-
Pairing a FortiGate and FortiSwitch the Right Way, Part 1: Get the Firmware Right First
Before a FortiGate and FortiSwitch will even talk to each other over FortiLink, both need to be on compatible, fully-patched firmware — and NTP/DNS need to be solid. Part 1 covers the upgrade plan we should have run before touching FortiLink at all.
-
Pairing a FortiGate and FortiSwitch the Right Way, Part 2: FortiLink, and Where We Actually Went Wrong
The FortiLink handshake looks trivial in the docs: cable it in, authorize, done. Ours didn't go that way. Part 2 walks the correct pairing process, then dissects exactly where — and why — our first attempt stalled, with the redo plan for when we factory-reset both boxes.
-
Beyond PSK: PKI for Fortinet SDWAN IPsec, Part 1 — The Architecture Decision
FortiManager-as-CA vs. a dedicated external CA for certificate-based IPsec on Fortinet SDWAN: the honest trade-offs, SCEP vs EST, CRL vs OCSP, certificate lifetime philosophy, and why "who is your CA" is the real question hiding inside "switch to certificates."
-
Beyond PSK: PKI for Fortinet SDWAN IPsec, Part 2 — Standing Up the PKI
Standing up a real PKI for Fortinet SDWAN IPsec: offline root, online issuing CA, a certificate role scoped to IPsec end entities, an EST front-end, CRL/OCSP placed where the chicken-and-egg overlay problem can't reach it, and FortiManager's much smaller supporting role.
-
Beyond PSK: PKI for Fortinet SDWAN IPsec, Part 3 — Enrollment, Automation, and the Cutover
Closing the series: solving EST's bootstrap-credential problem on purpose, monitoring certificate renewal at scale before it becomes an outage, and executing the PSK-to-certificate cutover — explicitly diffed against the FMG-as-CA migration path.
-
Cloud On-Ramp Part 1: The Architecture Decision and AWS Transit Gateway
Hub Placement Part 3 said the hub goes where the VPC is. This post answers the question that raises immediately: how does it actually get there? BGP-over-IPsec to AWS Transit Gateway, ASN selection, and mapping on-prem VRFs onto TGW route tables.
-
Cloud On-Ramp Part 2: Azure Virtual WAN and a Dual-Cloud Resilience Design
Azure Virtual WAN looks like AWS Transit Gateway from a distance — a managed hub that attachments plug into. Up close, the BGP mechanics, the route-propagation model, and the failure modes all differ in ways that decide whether a dual-cloud on-ramp actually survives a bad day.
-
Local Internet Breakout in Practice: SDWAN Zones, Rules, and a Multi-VRF Guest Wi-Fi Walkthrough
How SDWAN zones, members, and performance-SLA rules actually decide where a session breaks out — and a full walkthrough of giving Guest Wi-Fi its own VRF, its own zone, and a local internet path that never touches the corporate tunnel.
-
Fortinet SDWAN Hub Placement Part 1: The Traditional Model — Hubs in the DC
Why hubs traditionally sit in the DC, the job they actually do there, how they protect FMG/FAZ, and how BGP on loopback ties it together. Part 1 of a series that goes on to challenge the assumption that the hub belongs in the DC at all.
-
Fortinet SDWAN Hub Placement Part 2: The MSSP Shift — When the Hub Becomes Customer-Centric
What changes when one FMG/FAZ pair manages many customers through ADOMs: the hub stops being "the DC's hub" and becomes a per-customer design decision, with its own routing domain, AS plan, and placement logic.
-
Fortinet SDWAN Hub Placement Part 3: Cloud, SASE, and the Death of "The DC" as the Default
Closing out the hub-placement series: what changes about hub design when the destination is Azure, AWS, or GCP rather than a DC, and what changes again for customers migrating from a DC-centric WAN to a SASE-centric one.
-
From DSCP to Deep Packet Inspection: Why SDWAN Application-Aware Routing Killed Traditional QoS
A deep technical comparison of legacy QoS (DSCP/CoS, static priority queues, box-by-box CLI) against SDWAN Application-Aware Routing — plus a vendor-by-vendor breakdown of how Cisco Catalyst SDWAN, Fortinet, Juniper Mist (128T), and VeloCloud actually identify and steer application traffic.
-
Advanced tcpdump Recipes for the Enterprise Engineer: The Packet Never Lies
Bitwise BPF masking, enterprise recipes for asymmetric routing and retransmission hunting, a safe SSH-to-Wireshark live-streaming setup that won't loop your own session, and a cross-vendor capture map spanning Debian, Cisco IOS, FortiOS, Junos, and VeloCloud.
-
Why Deep Packet Inspection (DPI) Breaks Guest Wi-Fi (And How to Fix It on Fortinet FortiGate)
Full SSL Inspection looks like the obvious way to secure a guest or BYOD network on FortiGate — until certificate warnings, crashed apps, and "No Internet" errors flood the helpdesk. Here's why DPI breaks guest Wi-Fi, and the certificate-inspection-plus-ISDB architecture that actually works.
-
The Ultimate FortiOS CLI Reference for the NSE 4 Exam – Part 1: System Health & Routing
Part 1 of a 3-part deep-dive CLI reference for the NSE 4 exam. Covers get system status, get system performance status, interface and NIC diagnostics, the routing table RIB vs FIB, ARP, and ping-options — with live output breakdowns and exam-pressure indicators for every command.
-
The Ultimate FortiOS CLI Reference for the NSE 4 Exam – Part 2: Session Table & Packet Flow
Part 2 of 3 in the NSE 4 CLI reference series. Deep-dives into FortiOS session table internals — filtering, reading, and clearing sessions — then covers the packet sniffer verbosity levels 1–6 and the full debug flow chain with line-by-line breakdown of successful vs. dropped traces.
-
The Ultimate FortiOS CLI Reference for the NSE 4 Exam – Part 3: VPN & HA
Part 3 of 3 in the NSE 4 CLI reference series. Covers IPsec VPN diagnostics (IKE gateway state, tunnel SAs, SPI counter discrepancies), SSL-VPN authentication traces, and HA cluster mechanics — election criteria, heartbeat state, and configuration synchronisation verification via checksum hashes.
-
Fortinet SDWAN Jinja Orchestrator — Part 1: The Two Template Engines
Part 1 of three. FortiManager hosts two distinct template engines — classic CLI templates and Jinja CLI templates — and they aren't interchangeable. Thesis: Jinja for shape-varying network plumbing, CLI templates for shape-fixed system config, and a real deployment uses both.
-
Fortinet SDWAN Jinja Orchestrator — Part 2: Anatomy and Patterns
Part 2 of three. We open Fortinet's sdwan-advpn-reference repo and read it end-to-end: the dynamic-bgp-on-lo directory, the four reference Project Templates, the inventory contract that feeds them, and the three Jinja patterns the templates lean on heaviest — loops, ipaddr derivation, and imports.
-
Fortinet SDWAN Jinja Orchestrator — Part 3: PSK to Cert With FMG as CA
Part 3 of three. We take the single-hub PSK example from the reference repo and migrate it to certificate-based IPSec, with FortiManager as the CA. FMG CA setup, per-device enrolment, Project Template flag flip, what changes in the rendered config and what doesn't.
-
pmtud-sweeper: Finding the Hop That's Eating Your Packets
A per-hop Path-MTU sweeper that binary-searches the largest DF-set packet each hop will pass, then names the router that's clamping your tunnel. ICMP, UDP, TCP-SYN, end-to-end TCP MSS — pick the probe your network actually lets through.
-
Who Sent That RST? Forensic Classification of TCP Resets with rst-forensics
A pure-Python classifier that takes a TCP RST and tells you whether the server, a mid-path firewall, or the client actually sent it. Six independent scorers — TTL, IP-ID, window, options, sequence, and timing — vote on the origin so the verdict is reproducible instead of tribal.
-
Diffing FortiGate configs the way an admin reads them — fgt-config-diff
A small Python tool that parses FortiGate configs into a tree, aligns nodes by section path and edit key, and reports what was added, removed, or modified — in the language of policies and objects, not unified-diff line numbers. CLI plus a Flask web UI.
-
SDWAN Resilience Part 1: Design and Assumptions
A multi-part deep dive into building a resilient Fortinet SDWAN on a real, slightly unfashionable topology — HA FortiManager, dual hubs in active/standby, no DCI, and an independent DCE. Part 1 lays out the topology, the AS plan, and challenges the design choices up front.
-
SDWAN Resilience Part 2: BGP on Loopback
Why we peer BGP on loopbacks instead of tunnel-interface IPs, the FortiOS dynamic-IPsec config that makes it work, the spoke-side reciprocal config, and why hub-to-hub iBGP is the wrong answer in a no-DCI active/standby topology.
-
SDWAN Resilience Part 3: DC to DCE Routing — Static, OSPF, and BGP
The hub FortiGate has to glue the spoke overlay to the data-centre environment that hosts the services. Static, OSPF, and eBGP each work — but only two of them fail correctly when the DCE peering goes down on one DC and not the other.
-
SDWAN Resilience Part 4: BFD and Convergence Tuning
Default BGP timers detect failure in three minutes. That's unacceptable for active/standby SDWAN. This post is the timer-math: DPD vs BFD on tunnels, BFD-for-BGP, holdtime ratios, the Graceful Restart trade-off, and what convergence numbers each combination actually delivers.
-
SDWAN Resilience Part 5: Performance SLAs and Service Steering
BGP and BFD catch every failure that takes a tunnel or session with it. They don't catch the failure where everything looks healthy at the network layer but the application is gone. That's the gap SDWAN Performance SLAs fill — and the place where careful health-check design earns its keep.
-
SDWAN Resilience Part 6: Building It Right — Full DCI and Dual-Active ADVPN
The first five parts defended a topology with real constraints. This final post is the version without those constraints — Fortinet's reference design: full DCI, dual-active ADVPN, iBGP between hubs, symmetric routing, ECMP across both paths. The full shebang.
-
Configuring RADIUS Admin Auth on FortiGate SDWAN: RBAC and Three User Profiles (Part 2 of 2)
Part 2 of 2 on RADIUS for FortiGate SDWAN. Walks through the FortiOS config end-to-end — RADIUS server entry, group-to-profile mapping via VSA, three worked RBAC examples (senior engineer, NOC operator, compliance auditor), and the verification commands you'll need.
-
NSE5 Exam Syllabus: Study Roadmap (Part 1 of 10)
Part 1 of a 10-part study series for the Fortinet NSE 5 / FCP FortiManager Administrator certification. Covers the exam logistics, the official curriculum grouped into topic buckets, and the roadmap for the rest of the series.
-
NSE5 Part 10: Advanced Features and Integrations
Part 10 — the final post in the NSE5 study series. Covers the advanced features that make FortiManager more than a config pusher: FortiGuard distribution, scripting, the JSON-RPC API, SSO, and FortiAnalyzer integration.
-
NSE5 Part 2: Initial Configuration and System Settings
Part 2 of the NSE5 study series — covers the day-one FortiManager configuration: network, admin access, system time, DNS, FortiGuard, OFTP, the on-disk file structure, and the diagnostic commands worth memorising before anything else.
-
NSE5 Part 3: High Availability
Part 3 of the NSE5 study series — covers the FortiManager HA cluster: primary and secondary roles, the sync mechanics, monitor IPs, manual vs automatic failover, and what to do when the cluster splits.
-
NSE5 Part 4: Administrative Domains (ADOMs)
Part 4 of the NSE5 study series — covers Administrative Domains: normal vs advanced ADOMs, version locking, ADOM modes, RBAC scope, and the per-ADOM revision history that underpins the rest of the FortiManager workflow.
-
NSE5 Part 5: Device Registration and Provisioning
Part 5 of the NSE5 study series — covers device registration: the FGFM tunnel, manual vs automatic registration, model devices, zero-touch provisioning, and the install operations that turn a registered device into a managed device.
-
NSE5 Part 6: Device-Level Configuration and Templates
Part 6 of the NSE5 study series — covers the FortiManager template engine: provisioning templates, CLI templates, SDWAN, IPsec, and certificate templates, and how they compose into a single per-device install.
-
NSE5 Part 7: Policy and Objects
Part 7 of the NSE5 study series — covers ADOM-level policy management: policy packages, the object database, dynamic objects, install previews, install logs, and the cleanup workflows that keep the database lean.
-
NSE5 Part 8: Workflow, Workspace Mode and Revision Control
Part 8 of the NSE5 study series — covers workspace mode and the workflow approval engine: ADOM locking, read/write sessions, the workflow state machine, and how to recover an ADOM that two admins are fighting over.
-
NSE5 Part 9: Diagnostics and Troubleshooting
Part 9 of the NSE5 study series — covers the FortiManager diagnostic toolbox: device-manager diagnostics, the FGFM tunnel, install-failure forensics, oftpd, packet capture, and the debug commands worth knowing under exam pressure.
-
RADIUS vs TACACS+ on FortiGate SDWAN: Choosing the Right AAA Backend (Part 1 of 2)
Part 1 of 2 on RADIUS for FortiGate SDWAN. Covers the protocol differences vs TACACS+, the RADIUS server options worth knowing (NPS, FortiAuthenticator, FreeRADIUS, ISE, Okta, Duo, Entra), and when each protocol is the right call for FortiOS.
-
Building a FortiManager Lab on Proxmox — Part 1: Lab Goals, Compute Sizing and Proxmox Host Preparation
Part 1 of a five-part series on building a FortiManager lab on Proxmox. Covers lab goals, compute sizing for FMG and FGT VMs, host prerequisites, and a clean Proxmox 8.x baseline before the qcow2 build in Part 2.
-
Building a FortiManager Lab on Proxmox — Part 2: Obtaining the Image, qcow2 Conversion and First Boot
Part 2 of the FortiManager-on-Proxmox series. Walks through obtaining the KVM image from the Fortinet portal, validating the qcow2 files, building the VM shell with the right machine type and SCSI controller, importing both disks, and first-boot verification.
-
Building a FortiManager Lab on Proxmox — Part 3: Proxmox Networking, Linux Bridges, VLAN-Aware Bridges and SDN for the Lab
Part 3 of the FortiManager-on-Proxmox series. Designs the four-segment lab network, compares Linux bridges, VLAN-aware bridges and Proxmox SDN, walks through the /etc/network/interfaces shape, and explains why the lab bridges should never have an IP on the host.
-
Building a FortiManager Lab on Proxmox — Part 4: A Lab Edge FortiGate VM in Front of FortiManager
Part 4 of the FortiManager-on-Proxmox series. Builds a FortiGate-VM as the lab edge in front of FortiManager, with four NICs mapped to the lab bridges, a scoped policy set, FortiGuard pinhole, local-in policy hardening, and the deny-with-log rule that proves the boundary works.
-
Building a FortiManager Lab on Proxmox — Part 5: Registering Managed FortiGates, ADOMs and Policy Package Installs
Part 5 of the FortiManager-on-Proxmox series. Builds two managed FortiGate VMs, registers them via FGFM through the lab edge, splits them across two ADOMs, deploys a shared policy package with FMG, exercises revision history and rollback, and turns the lab into a snapshotted training platform.
-
FortiOS 7.6.6 SDWAN: VRF1 Transport and Loopback Design
A refined VRF reference design for FortiOS 7.6.6 — transport in VRF 1, separate transport and management loopbacks, complete management-plane pinning, and NPU-VLINK guidance for inter-VRF acceleration.
-
MP-BGP and VRFs on FortiGate SDWAN
A practical reference design using MP-BGP (VPNv4) and VRFs on FortiOS to keep management (VRF20), customer SDWAN (VRF30), and Guest Wi-Fi DIA (VRF99) isolated end-to-end. Includes config, traffic flows, and the gotchas that bite people in production.
-
NSE4 Exam Syllabus: Study Roadmap (Part 1 of 10)
Part 1 of a study series for the Fortinet NSE 4 / FCP FortiGate Administrator certification. Covers exam logistics, the official 16-lesson curriculum grouped into topic buckets, and the roadmap for the rest of the series.
-
NSE4 Part 10: High Availability
Part 10 — the final post in the NSE4 study series. Covers FGCP, active-passive vs active-active, heartbeat and monitor interfaces, session synchronisation, failover behaviour, and the diagnostic output you'll be asked to interpret.
-
NSE4 Part 2: Initial Configuration & the Security Fabric
Part 2 of the NSE4 study series — covers the day-one FortiGate configuration (interfaces, operation modes, admin access, DHCP, FortiGuard) and how the Security Fabric stitches multiple FortiGates and Fortinet products together.
-
NSE4 Part 3: Firewall Policies & NAT
Part 3 of the NSE4 study series — firewall policy structure, lookup order, NGFW modes, central vs policy NAT, source NAT pools, virtual IPs, and the session helpers behind protocol fixups.
-
NSE4 Part 4: Authentication, FSSO & Certificates
Part 4 of the NSE4 study series — local and remote authentication (LDAP, RADIUS), captive portal, Fortinet Single Sign-On (FSSO) modes, and certificate operations including SSL deep inspection.
-
NSE4 Part 5: Logging, Monitoring & Diagnostics
Part 5 of the NSE4 study series — log categories and severity, local vs remote storage, FortiAnalyzer and syslog forwarding, threat weight scoring, and the diagnostic commands you actually reach for under pressure.
-
NSE4 Part 6: Security Profiles — Web, App Control, AV, IPS, DoS
Part 6 of the NSE4 study series — the five security profiles you attach to firewall policies: web filter, application control, antivirus, intrusion prevention, and denial-of-service.
-
NSE4 Part 7: SSL VPN
Part 7 of the NSE4 study series — SSL VPN modes (web, tunnel, full), portals, realms, MFA, split tunnelling and the diagnostic commands for tracking down a stuck client.
-
NSE4 Part 8: IPsec VPN
Part 8 of the NSE4 study series — IKEv1 vs IKEv2, route-based vs policy-based, site-to-site and dial-up, NAT traversal, dead peer detection, and the two diagnostic commands that separate a Phase 1 problem from a Phase 2 problem.
-
NSE4 Part 9: Routing & SDWAN
Part 9 of the NSE4 study series — static and policy routing, distance vs priority, RPF, OSPF and BGP basics, and how SDWAN turns a pile of WAN links into a single steered zone with performance SLAs.
-
Route Leaking Between VRFs on FortiGate: Why It's Trickier Than You Think
VRF route leaking is a daily reality in any multi-tenant or shared-services network design. On FortiGate it's harder to find — and harder to get right — than the equivalent on Cisco or Juniper. Here's how to do it, why it's easy to miss, and the practical pitfalls.