Recently upon upgrading to 5.0.5 I've noticed that none of the applications are showing up correctly in the 'Top Applications' dashboard. Instead they are all showing up as 'Unknown'.
We'll go through the quick steps to re-enable Application logging so that this dashboard shows us the correct applications.
Another feature that's been disabled by default on FortiOS 5 is the UTM Monitors. These are great monitors that quickly show you a snapshot of your AntiVirus, WebFiltering, IPS, Application Control, Email and Dataleak Prevention profiles. We'll go through how-to quickly re-enable these monitors below.
By default disk logging has been disabled on FortiOS v5.0. One of the reasons this was done is because the flash memory on some devices are not designed for constant read/writes, so saving logs to it can degrade the disk (resulting in corrupted sectors). Having said that, we've got a few FortiGates that have been logging to disk for a few years now with no problems.
Sometimes you will need to re-image a Fortigate device if you suspect that there is a corruption with the image, or if you get CRC errors upon bootup. All you need is a computer with a network card, a console cable, a TFTP program and a network cable.
SSL Deep Packet Inspection (DPI) allows the FortiGate to decrypt and scan all HTTPS, SMTPS, POPS, IMAPS and FTPS sessions. It then re-encrypts and sends the packets off on their merry way (essentially a man in the middle attack).
I've recently enabled it in my lab and noticed that my DropBox kept on disconnecting. I suspect it's something to do with FortiGate certificate not being trusted in DropBox which would give an error.
The way I got around this is to enable the web site filter and excempt the dropbox.com domain from the webfilter (and DPI).
To set this up goto Security Policies > Web Filter > Profiles and edit the webfilter profile used in your web policy.
Next enable " and add the dropbox.com domain (simple, exempt & enabled). Click 'Apply' to save.
Now try to log back into DropBox and you should see the status come up as connected!
Recently I've had a customer ask how they can block FTP PUT's on their FTP server for all anonymous (unauthenticated) users, but allow FTP GET's for any user (ie: only let authenticated users upload files, but let anyone download them). They control this access via the FTP server's account credentials, but wanted to see if the FortiGate could add another level of protection (incase their FTP server got hacked).
This was accomplished by creating some custom IPS signatures.
Recently I've been doing some tests with the FortiAuthenticator using FortiMobile tokens. I decided to test out the SMS Gateway feature for sending two-factor one time passwords (OTP) straight to mobiles via SMS (something I generally don't recommend but thought it would be cool to test).
Below is the config I used to setup the FortiAuthenticator to send an OTP via SMS to my moblie for SSL VPN logins.
