Forti

• fortinet notes

general

• if something doesn't work in the gui, try cli
• A session is a communication channel between two devices or applications across the network.

interfaces

• device detection - passively collects network info such as MAC address, IP address, OS, hostname, when it was detected, on which interface...
• interface role - hides/reveals parts of the configuration in the GUI based on what is appropriate for the role; { LAN | WAN | DMZ | Undefined }
  • LAN - interfaces that are used for local networks and internal endpoints
  • WAN - interfaces that connect to the Internet
  • DMZ = DeMilitarized Zone - interfaces that are hosting servers, especially those that are exposing services to the Internet (i.e. separating publicly reachable servers from the rest of the corporate network/LAN)
  • Undefined - all options in the GUI are shown and configurable unless noted otherwise
• zone - a group of one or more physical or virtual interfaces that you can apply security policies to, to simplify the config; apply 1 policy to 1 zone, instead 3 policies to 3 different interfaces; individual interfaces must not be referenced in the existing policy config if they are to be assigned to a zone
• redundant interface - traffic goes only over one interface at a time; differs from an aggregated interface where traffic goes over all interfaces for increased bandwidth; this difference means redundant interfaces can have more robust configurations with fewer possible points of failure
  • priority-override - priority is the order in which the interfaces are configured (the first one frome the left is the highest priority); if it's enabled, the primary interface takes over the traffic from the secondary when it becomes available again
• software switch - virtual switch that is implemented at the software or firmware level and not at the hardware level; e.g. interface with wired internal network on the same subnet as wireless interfaces, or the use wan1/2 or DMZ as additional LAN ports
• virtual wire pair - two interfaces that do not have IP addressing and are treated like a transparent mode VDOM; all traffic received by one interface in the virtual wire pair can only be forwarded to the other interface, provided a virtual wire pair firewall policy allows this traffic; e.g. to protect a server without changing the network topology

services

• fortigate can be used as a DNS server in small deployments

routing

• precedence: PBR, SD-WAN, RIB/FIB
• ECMP by default sends the same src IP to the same gateway; config system settings, at the VDOM level: set v4-ecmp-mode { source-ip-based* | weight-based | usage-based | source-dest-ip-based } -
• get router info routing-table details _IP_ - route lookup in the CLI
• get router info kernel - FIB

policies

• traffic flow initiated from each direction requires a policy, that is, if sessions can be initiated from both directions, each direction requires a policy
• FortiOS does not perform a reverse-path check on reply traffic that matches an allowed session based on the IP tuple. The request traffic can be sent on one interface and the reply traffic could return on another interface.
• fuckin match-vip - Policies with VIPs applied have priority over typical firewall policies; Therefore, to block specific source traffic destined for a firewall policy specified with an action of accept and with a VIP applied, you should configure set match-vip enable on the firewall policy with a deny action that has been configured to match traffic before the firewall policy with the VIP applied. By default, new deny action firewall policies have match-vip enabled.; there's also src-filter _RANGE_ that can be used as a workaround
• config firewall policy; edit 1; set auto-asic-offload disable - disable hardware acceleration
• Profile-based next-generation firewall (NGFW) mode is the traditional mode where you create a profile (antivirus, web filter, and so on) and then apply the profile to a policy.
• In policy-based NGFW mode, you allow applications and URL categories to be used directly in security policies, without requiring web filter or application control profiles. However, it is possible to select and apply web filter URL categories and groups.; central SNAT is always enabled; only flow-based inspection is supported
• Quarantine is used to block any further traffic from a source IP address that is considered a malicious actor or a source of traffic that is dangerous to the network. ; diagnose user banned-ip list

tcp-session-without-syn

• The tcp-session-without-syn setting controls how a FortiGate handles TCP packets that arrive without a prior SYN-based handshake. This is relevant in asymmetric routing scenarios where a FortiGate sees only part of a TCP flow, for example, mid-session packets arriving without the FortiGate ever having seen the initiating SYN, or in environments where TCP sessions are established outside the FortiGate's visibility.
• By default, a FortiGate enforces stateful TCP inspection and drops any TCP packet that does not match an existing session table entry. The setting operates at two levels: globally in config system settings and per-policy in config firewall policy. Both levels must be configured to allow non-SYN packets to create sessions
• When a TCP packet arrives, the FortiGate checks its session table. If a matching session exists, the packet is forwarded. If no session exists: 1. Default (disable globally or no per-policy override): All non-SYN packets are dropped. Only a SYN packet can create a new session. 2. Global enable + per-policy data-only or all: The FortiGate creates a session for any TCP packet regardless of flags and forwards it.
• config system settings; set tcp-session-without-syn { enable | disable }; config firewall policy; edit _POLICY_ID_; set tcp-session-without-syn { none | data-only | all }

nat

• get system session list - show list of sessions
• fixed-port range snat - carrier-grade NAT (CGN/CGNAT) or large-scale SNAT deployments where regulators require the ability to identify a subscriber from an external IP:port at a point in time, but full per-connection logging would be too heavy on storage/performance
• hairpin nat - nat loopback, u-turn nat, devices on the same internal network communicate using their external IP addresses