Unable to see any applications in 'Top Applications' on a FortiGate

Recently upon upgrading to 5.0.5 I've noticed that none of the applications are showing up correctly in the 'Top Applications' dashboard. Instead they are all showing up as 'Unknown'.

We'll go through the quick steps to re-enable Application logging so that this dashboard shows us the correct applications.

How-to: Send email alerts from a FortiGate

Sending alert emails is a useful way of keeping track of security events within your firewall without having to log into it several times a day.

With FortiOS version 5, the Alert E-Mail option has been removed from the GUI by default unless a messaging server has been configured.

How-to: Enable UTM Monitor on a FortiGate running FortiOS 5

Another feature that's been disabled by default on FortiOS 5 is the UTM Monitors. These are great monitors that quickly show you a snapshot of your AntiVirus, WebFiltering, IPS, Application Control, Email and Dataleak Prevention profiles. We'll go through how-to quickly re-enable these monitors below.

How-to: Enable disk logging on a FortiGate running FortiOS 5

By default disk logging has been disabled on FortiOS v5.0. One of the reasons this was done is because the flash memory on some devices are not designed for constant read/writes, so saving logs to it can degrade the disk (resulting in corrupted sectors). Having said that, we've got a few FortiGates that have been logging to disk for a few years now with no problems.

How-to: Re-image a Fortigate device

Sometimes you will need to re-image a Fortigate device if you suspect that there is a corruption with the image, or if you get CRC errors upon bootup. All you need is a computer with a network card, a console cable, a TFTP program and a network cable.

How-to: Get DropBox working on a FortiGate with SSL Deep Packet Inspection enabled

SSL Deep Packet Inspection (DPI) allows the FortiGate to decrypt and scan all HTTPS, SMTPS, POPS, IMAPS and FTPS sessions. It then re-encrypts and sends the packets off on their merry way (essentially a man in the middle attack).

I've recently enabled it in my lab and noticed that my DropBox kept on disconnecting. I suspect it's something to do with FortiGate certificate not being trusted in DropBox which would give an error.

The way I got around this is to enable the web site filter and excempt the dropbox.com domain from the webfilter (and DPI).

To set this up goto Security Policies > Web Filter > Profiles and edit the webfilter profile used in your web policy.

Next enable "Enable Web Site Filter" and add the dropbox.com domain (simple, exempt & enabled). Click 'Apply' to save.

Now try to log back into DropBox and you should see the status come up as connected!

How-to: Block anonymous FTP uploads on a FortiGate

Recently I've had a customer ask how they can block FTP PUT's on their FTP server for all anonymous (unauthenticated) users, but allow FTP GET's for any user (ie: only let authenticated users upload files, but let anyone download them).

They control this access via the FTP server's account credentials, but wanted to see if the FortiGate could add another level of protection (incase their FTP server got hacked).

This was accomplished by creating some custom IPS signatures.

Q&A: How many FortiManager licenses do you require for a FortiGate in a HA pair?

A: You'll only need to license for one device, including any VDOMs.

For example, we have 2x FG1000C's with 100 VDOMs in a HA pair.

The FortiManager will only need to be licensed for 100 devices as the HA pair count as one.

How-to: Configure SMS Two Factor Authentication with FortiAuthenticator and FortiGate SSL VPN

Recently I've been doing some tests with the FortiAuthenticator using FortiMobile tokens. I decided to test out the SMS Gateway feature for sending two-factor one time passwords (OTP) straight to mobiles via SMS (something I generally don't recommend but thought it would be cool to test).

Below is the config I used to setup the FortiAuthenticator to send an OTP via SMS to my moblie for SSL VPN logins.

FortiGate EAL4/CC Certification

CC have released a Maintenance Report to update the hardware list that is EAL4 certified with FortiOS 4.0MR3.

This means that the current devices CC/EAL4 certified are as follows: