Fortigate 登出自動備份

參考原廠KB
http://kb.fortinet.com/kb/viewContent.do?externalId=FD38725&sliceId=1

# config system global
# set revision-backup-on-logout enable
# end

 可以登出自動本機備份設定，設定比對

不懂為什麼預設是關閉的~"~

DMVPN

最近似乎有DMVPN的需求，網路找的資料記錄一下~

https://www.jannet.hk/zh-Hant/post/dynamic-multipoint-virtual-private-network-dmvpn/

http://www.china-ccie.com/doc/vpn/vpn.html#37

https://ccie.lol/knowledge-base/lab-dmvpn-ipsec-multicast/

Cisco IOS命名-Denali, Everest, Fuji

最近來了兩台4321，想說上cisco建議版本。

到cisco download看，發現改成好幾個版本號。

找到這篇文章留存紀錄一下

https://learningnetwork.cisco.com/thread/128311

Indeed you now have 4 code type visible
Denali / Everest / Fuji and 3.6.8E
So 3.6.8E is the original or OLD type of code that was on the 3850, that has a parallel in the 16.X.X
You kinda need to get off that and onto 16.X.X
Denali (16.3.X) is the supported / tried and tested version, denali is where you should be
Everest (16.6.X) is the latest version of denali code - still not fully tested (I have heard bad reports)
Fuji (16.8.X) is like the T image of old - new versions of code and extra / new features.
You should be on Denali unless there is a specific feature that you need that isnt on Denali -
Notice the 'STAR' next to denali ?? that is the recommended version - only Denali and 3.6.X version have this recommendation.

總之就是上Denali 星號版本就對了，如果要的特殊功能沒有在Denali 版本上，才轉向Everest或是Fuji。

順帶一提，Denali, Everest, Fuji都是山的名名稱喔~XD

Asymmetric routing 非對稱路由

config system settings

set asymroute enable

end

有vdom狀況下

config vdom

edit <vdom_name>

config system settings

set asymroute enable

end

end

If you enable asymmetric routing, antivirus and intrusion prevention systems will not be effective. Your FortiGate unit will be unaware of connections and treat each packet individually. It will become a stateless firewall.

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-networking-54/Interfaces/VLANs/Asymmetric%20routing.htm

Fortigate Application control

signature檢查流量時，Port也是其中的選項之一。





所以當程式改變預設使用的Port的時候，Fortiguard提供的signature就會無法識別出來。

http://help.fortinet.com/fos50hlp/54/Content/FortiOS/fortigate-security-profiles-54/IPS/Custom%20signature%20keywords.htm

cisco switch or router記錄登入登出

archive
log config
logging enable
notify syslog contenttype plaintext
hidekeys
logging on
logging 192.168.1.1
login block-for 60 attempts 3 within 60
login on-failure log every 1
login on-success log every 1

注意：如果在2960X的15.0(2a)EX5上使用，然後telnet進去，設備會直接重開!!!!!
15.2(2)E3就沒這問題!!!!

Fortigate interface ping不到

服務都正常，但是從core switch去ping對點的fortigate interface，就是ping不到。
不管我core switch帶哪個source ip都一樣。

fortigate抓封包看有接收到，但fortigate就是沒回。

後來爬文爬到下面這篇KB。

http://kb.fortinet.com/kb/documentLink.do?externalID=10876


原來是有啟用thrust host，導致thrust IP以外的IP都沒辦法ping到......。

解決方式就是額外創建一個帳號，不設定thrust IP(或是設定成可以ping過去的網段)。
再將使用者權限調整成最低。