Fortinet Forum
The Forums are a place to find answers on a range of Fortinet products from peers and product experts.
FG1kc
New Contributor

Features that you would like to see

Why limit to Authentication-based routing,can' t fortinet have Address-based and Device Identity routing on the policy tab itself rahter than putting it on the policy route tab would be very nice to have when your using/have multiple gateways
114 REPLIES 114
TheJaeene
Contributor

Virtual Routers would be nice too... the C.E.O. should know this Feature Assigning a " Next Hop" Router via FW-Policy (like WGuard does) would save a lot of PBR Entries...
Antonio_Milanese

Hi All, +1 for PBR within firewall policy I would like to be able to see more routes state aware PBR to track availbility (DGD) of next hop gw..or even better IP SLA echo and track rtr as in CISCO gears..this should be great for PDR against redundant ipsec tunnels! Best regards, Antonio
Phill_Proud
New Contributor

Byte-based quotas for users, applied to firewall policies.
Adrian_Lewis
Contributor

Decouple both the server load balancing health checks and the dead gateway detection tests into their own ' section' so that they could be used to control not only gateway detection or server pools but also individual routes, firewall policies, or a number of other functions within FortiOS that could be turned on or off depending on the results of one or more checks. Adding things like latency as a metric for the tests could also enable things like performance based routing.
FortiRack_Eric
New Contributor III

I would like to be able to nat with different IP address (ip-pool) depending on the chosen outbound interface. So you can use IP-pool with 2 internet connections.

Rackmount your Fortinet --> http://www.rackmount.it/fortirack

 

RH2
New Contributor

ban ip from DOS Policy We get many alerts for icmp sweeps etc, and they are blocked from the DOS Policy, but I can' t ban an IP that keeps triggering the rule!
Omar_Hermannsson

ORIGINAL: RH ban ip from DOS Policy We get many alerts for icmp sweeps etc, and they are blocked from the DOS Policy, but I can' t ban an IP that keeps triggering the rule!
You can do this from CLI. See set quarantine here: http://docs.fortinet.com/fgt/handbook/cli_html/index.html#page/FortiOS%25205.0%2520CLI/config_firewall.10.10.html
Uwe_Sommerfeld
New Contributor

a) Support for 6rd sit-tunnels with DHCP wan IPv4 addresses b) DNS autoupdates of DNS database zones (for client DNS updates - IPv6 without names is no fun). c) serial port on 60D ;) d) Implementation of a " good" and " bad" CA certificate for UTM SSL filtering (usage: sign with " good" certificate if external page cert is valid, sign with " bad" certificate when external page cert is invalid).
Sean_Toomey_FTNT

Newer versions of 60D and 90D come with serial port on the front. See the datasheet for 60D http://www.fortinet.com/sites/default/files/productdatasheets/FortiGate-60D.pdf That was something I immediately noticed about some of the newer desktop models and I am happy to say it' s back for most (if not all) of those units. For those that do not have serial console, you can use FortiExplorer and a USB cable to get to the boot menu where you can interrupt boot. In fact, if you have a few of the older revisions of 60D without console port deployed remotely at a location, one possible solution is just to plug the USB into a server or even a dedicated device like a Mac Mini.
-- Sean Toomey, CISSP FCNSP Consulting Security Engineer (CSE) FORTINET— High Performance Network Security