Advice on resolving - possible factory reset?

Question

I don't have a lot of specifics here, but looking for some advice on things to check and how to proceed. Disclosure: I don't have much history with Fortinet.

A friend who is a small business owner asked me to take a look at their Fortigate Firewall. The backstory is that everything was running smoothly and had been cleanly configured, but while upgrading a camera security system for their business the installer, while trying to replace their existing camera system with the new one basically lost all the existing settings. Their Fortinet appliance is a Fortigate 30e. This isn't an exotic set up -it's a local bar, so it's a case of making sure critical LAN stuff is operating freely, the cameras are accessible remotely, and the customer wifi stuff is properly blocked off from the main LAN.

It's not clear what this installer did, but there are no VIPs, no Groups, a single policy to allow LAN/WAN traffic and only a single static route. No traffic shaping, no VPNs, no QoS etc. This thing almost looks like it's been freshly spun up. Unfortunately no backups of the old settings were saved :(

As far as things currently stand, I haven't been able to configure a VIP to open a port, and while browsing the internet on a PC hard-wired to the switch behind the Fortigate 30e it's random as to whether I can navigate to sites. I couldn't, for instance, browse these forums from their LAN.

It sounds as though whoever did the original config and set up was a local re-seller who isn't responsive, hence why the owner reached out to me, to see if I could help.

My question as best as I can distill it right now; Is there perhaps some obscured settings that would account for basic things like NAT via VIP etc not working at all? Any idea why half the web would be accessible and half not?

Or given how little is actually configured do you think we should factory reset, upgrade firmware and re-build from the ground up? Apologies, there's not a lot of specifics here, I've just had a bit of time to kick the tires and poke around a bit but not dig a lot of detail out. I didn't grab the current version of firmware, but I'm sure it's not been updated in a while. This was definitely a "not broke, don't fix it" set up, and now it's broke there's no bread crumbs left.

humblePie · Answer

Surely, you've moved on after 6 days of this post and no answer from anyone. I am not an expert myself, but figure I'd throw my 2 cents (ok, maybe less than 1 cent) out here for some future reference. Hopefully someone else will fill in some blanks or make corrections. Here's what I'd do:

1) Attach a PC to the maintenance port and run a backup of the config.

2) Get a printed copy (to a PDF or text file) of the config.

3) Read Fortigate Cookbooks and map out a strategy of how to configure this from scratch

4) Factory reset

5) Upgrade to the latest stable version of firmware

6) Configure the thing from scratch and document along the way so as not to leave the next person (which could be yourself) behind you completely in the dark. Documentation should include WHY you did things (the person behind you might be a newbie to Fortigate or if it's you, you might forget).

7) Backup your config onsite and offsite.

8) Provide a copy of your documentation to your friend in a sealed envelope to be stored with their Will, with a handwritten copy of the admin ids/passwords.

There's about a penny's worth of something. Might even prompt someone else to throw in 2 actual cents. :)

Best of luck to anyone in this situation.

Sign up

Login with SSO

Login to the community

Login with SSO