El conocimiento al alcance de todos.

 Thanks to: https://community.fortinet.com/ Technical Note: How to allow the flow of transit DHCP traffic in transparent mode Description By default, when the FortiGate firewall is in the transparent mode, it drops all broadcast traffic except ARP. This will result in the dropping of the DHCP broadcast traffic by default with the following entries being seen in the debugs: (DMZ-MOBILE) # id=20085 trace_id=1738 func=print_pkt_detail line=4373 msg="vd-DMZ-MOBILE received a packet(proto=17, 0.0.0.0:68->255.255.255.255:67) from port3." id=20085 trace_id=1738 func=init_ip_session_common line=4522 msg="allocate a new session-000476b2" id=20085 trace_id=1738 func=__br_forward_check line=166  msg="drop broadcast: in: port3, out: port2 "      Solution Diagram Clients ---->---- Switch ---->---- port3 - FortiGate - port2 ---->---- DHCP server To enable the flow of transit DHCP traffic in transparent mode it is necessary to: 1)  Enable broadcast-forwar...

 Thanks to: https://community.fortinet.com/ Technical Tip: Configuring Hairpin NAT (VIP) Description This article describes how to configure FortiGate for Hairpin with the use of set match-vip and match-vip-only.     In this scenario, both PC and Server are behind FortiGate and PC wants to connect to Server by pointing to its external address (92.0.2.10) instead of its real one (10.10.10.10). This is called Hairpin NAT. Scope Fortigate   Solution The solution will depend on how the Virtual IP (VIP) object. Solution 1: External interface in the VIP is configured to particular interface (in this case to wan1) External interface set to a particular interface, for instance wan1: #config firewall vip     edit "VIP"         set extip 92.0.2.10         set extintf 'wan1'         set mappedip 10.10.10.10     next end Note : In this scena...

 Thank to: https://community.fortinet.com/ Description This article describes how to configure SD-WAN in combination with IPSEC VPN tunnels.  From FortiOS 6.0 the SD-WAN feature is more granular and allows the combination of IPSEC tunnel interfaces with regular interfaces. Scope The scope of this article considers that HQ has 2 Internet connections called ISP1 and ISP2 shown in the diagram with  Blue  and  Green  lines describing the different paths     - ISP1 is connected to port1.     - ISP2 is connected to port2.     - Branch has 1 internet connection with 2 IPSEC tunnels toward HQ ISP1 and HQ ISP2.     - All traffic from the Branch has to go through HQ, i.e. Branch users connect to the internet through HQ.     - Internet security policies are applied to HQ. The routing preferences are :     - Branch to HQ : 1  Blue  VPN, 2  Green  VPN ...