El conocimiento al alcance de todos.

 Thank to: https://fortixpert.blogspot.com/ Este artículo describe cómo configurar FortiGate para Hairpin con el uso de set match-vip y match-vip-only. En este escenario, tanto el PC como el Servidor están detrás de FortiGate y el PC quiere conectarse al Servidor apuntando a su dirección externa (92.0.2.10) en lugar de la real (10.10.10.10). Esto se llama Hairpin NAT. Solución : La solución dependerá de cómo sea el objeto IP Virtual (VIP). Solución 1 : La interfaz externa en el VIP está configurada a una interfaz particular (en este caso a wan1) #config firewall vip     edit "VIP"         set extip 92.0.2.10         set extintf 'wan1'         set mappedip 10.10.10.10     next end Nota: En este escenario, la IP externa VIP puede ser la misma que la IP de la interfaz (es decir, 92.0.2.2) Se necesitan dos políticas: 1) Una política de entrada con ...

 Thank to: https://docs.fortinet.com Automation stitches can be created to run a CLI script and send an email message when CPU or memory usage exceeds specified thresholds. In this example, two automation stitches are created that run a CLI script to collect debug information, and then email the results of the script to a specified email address when CPU usage threshold is exceeded or memory usage causes the FortiGate to enter conserve mode. Automation stitches that use  High CPU  and  Conserve Mode  triggers can only be created in the CLI. Once create, they can be edited in the GUI. To define CPU and memory usage thresholds: config system global set cpu-use-threshold <percent> set memory-use-threshold-extreme <percent> set memory-use-threshold-green <percent> set memory-use-threshold-red <percent> end Where: cpu-use-threshold Threshold at which CPU usage is reported, in percent of total possible CPU utilization (defa...

 Thank to: https://docs.fortinet.com Alert emails are used to notify administrators about events on the FortiGate device, allowing a quick response to any issues. There are two methods that can be used to configure email alerts: Automation stitches Alert emails The FortiGate has a default SMTP server, notification.fortinet.net, that provides secure mail service with SMTPS. It is used for all emails that are sent by the FortiGate, including alert emails, automation stitch emails, and FortiToken Mobile activations. You can also configure a custom email service. To configure a custom email service in the GUI: Go to  System > Settings . In the  Email Service  section, enable  Use custom settings . Configure the following settings: SMTP Server Enter the address or name of the SMTP server, such as  smtp.example.com . Port If required, select  Specify  and enter a specific port number. The default is port 465. Authentication If required by the em...

 Thank to: https://docs.fortinet.com Description This article describes how to configure the automation stitch settings to get an e-mail alert when the WAN link goes down. Scope FortiGate v6.4.x, v7.0.x, v7.2.x.,7.4.x Solution Configuration . Automation Trigger : Specify log event ID and it is possible to filter for specific interfaces here for example: WAN1. Automation Action : Specify the Action taken by the FortiGate in the event of a specific event trigger. Automation stitch : Bind automation trigger and stitch.   CLI configuration.   Note: Event ID 22922 is for the link monitor configured here we can change it as per the requirement.     Note: The email server config is not mentioned here, refer to docs.fortinet.com for the email server config.   GUI configuration -    Navigate to  Security Fabric -> Automation -> Action  and select 'Create New'.     Select 'Email':     Enter the Email address where to...

 Thank to: https://docs.fortinet.com/ This topic shows a special virtual IP type: virtual server. Use this type of VIP to implement server load balancing. The FortiOS server load balancing contains all the features of a server load balancing solution. You can balance traffic across multiple backend servers based on multiple load balancing schedules including: Static (failover) Round robin Weighted (to account for different sized servers or based on the health and performance of the server including round trip time and number of connections) The load balancer supports HTTP, HTTPS, IMAPS, POP3S, SMTPS, SSL/TLS, and generic TCP/UDP and IP protocols. Session persistence is supported based on the SSL session ID based on an injected HTTP cookie, or based on the HTTP or HTTPS host. SSL/...