Communication to fortigate

[sonydarrel]

Please find the attached diagram,

I have 2 issues mentioned below.

[ol]

Sometime while adding  a policies it gives me an error "entry not found"

 syslog server is not receiving syslog from fortinet and also unsable to ping the server ip add 192.168.13.10 though i have a route to internal LAN for syslog server.

I have a active passive HA configured and it shows me in dashboard but when i remove the link from the  master fortigate connecting to internet switch the internet stops completely for the lan users it is not failing to slave, i am thinkinig the Cisco technology that whenever a link fails it shld failover to the healthy firewall which is slave in our situation please correct me if i m wrong.[/ol]

Thanks

[sonydarrel]

Dears,

anybody can help me to solve the below issues

Thanks

[mac]

hi

Refer to the troubleshooting procedures to debug.

mac

[vjoshi_FTNT]

Hello,

1) What is the browser and its version. Does it happen with all the GUI options or specific?

2) You should be able ping the IP of the Syslog server at first place. If the Fortigate interface and the syslog server belong to two different interfaces, then make sure there is a Firewall policy allowing the traffic between the Fortigate and the syslog server

3) Under the HA settings, make sure that WAN interface is selected for PORT MONITORING

sonydarrel wrote:

Please find the attached diagram,

I have 2 issues mentioned below.

[ol]

Sometime while adding  a policies it gives me an error "entry not found"

 syslog server is not receiving syslog from fortinet and also unsable to ping the server ip add 192.168.13.10 though i have a route to internal LAN for syslog server.

I have a active passive HA configured and it shows me in dashboard but when i remove the link from the  master fortigate connecting to internet switch the internet stops completely for the lan users it is not failing to slave, i am thinkinig the Cisco technology that whenever a link fails it shld failover to the healthy firewall which is slave in our situation please correct me if i m wrong.[/ol]

Thanks

[sonydarrel]

Dear Thanks for the reply,

for my question 2:  Please correct me if i am understanding is wrong for policy definition " we need a policy when traffic is passing through a firewall means" entering on interface 1 and exiting interface 2, but in my case traffic is destined to fortinet it is not exiting from interface 2, It is entering on interface 1 and on the same interface the reply should back to the syslog server.

Please help replies will be appreciated.

Thanks

[emnoc]

Okay let's start 1-by-1

1:  Are you adding a new policy or editing an existing ( what happens from the cli assuming your using  webgui )

2: yes your correct, if nothing is blocking icmp, you should be able to ping the syslog-server, have you ran diag sniffer packet <interface name> " port 514 or icmp"  to see if syslog is being sent to the syslog-server or icmp when  you ping? For generation of syslog, fail login a few times  & that should rise a syslog event, but I bet you don't have syslog or logging actually "enabled status on"

e.g assuing your outbound interface is named port1 and the syslog server is at  1.1.1.1

diag sniffer packet port1 " dst host 1.1.1.1 and port 514 "

diag sniffer packet port1 " dst host 1.1.1.1 and icmp "

3: for this item#3, you assumption are correct. If the healthy firewall fails, and you have heartbeat monitor enabled on, than it will fail to the slave ( it's technically NOT called a secondary like in cisco ASA lingo )

So can you share the HA cfg on both systems and what/how did you configure the 2 unit ( the same code, firmware, model-type, etc........)

[sonydarrel]

[ol]

When I am editing the existing policy at that situation it displays the error, i didn't tried by cli but i will try and update soon, but i have a question for policies if suppose i specify " any " for incoming and outgoing interface and if i  control by source and destination address only then is it a less secure from the security perspective,, i do understand that we are restricting to specific source and destiantion interface for the address but still need to confirm that  will it be according to the best practice if we  use " any " in interface selection  ???? ,, becz in asa firewall we don't have to specify any incoming and outgoing interface except source and destination address and port number.

I will collect the logs and post it tomorrow

attached are the configs for the fortinet.[/ol]

[vjoshi_FTNT]

1.

a) Which firewall policy to be used is decided on the routing decision > Firewall policy check is done from top to bottom order > When you select interface, first thing that gets changed is view. View changes from Section to Global view > In my understanding, if there is a Firewall policy on top with source interface 'any' Firewall has to do another check for the source/destination also to confirm if the policy allows or not. And then move to the other which is an overhead

b) Security will be a concern if the policies are not properly configured > Say, you there are servers on DMZ and you have allowed only from LAN > DMZ. - When you have a policy from ANY to DMZ, anyone can attempt a connection from WAN or any interface if they are routable > Also, spoofing is possible if the default settings for anti-replay is changed > If the source and destination addresses can be restricted as required, security wise, it should be all the same. So, you must be very careful and consider the above before using interface ANY. 2) .. 3) Could you please confirm if the WAN interface is port17 or port 18 ?

sonydarrel wrote:
[ol]

When I am editing the existing policy at that situation it displays the error, i didn't tried by cli but i will try and update soon, but i have a question for policies if suppose i specify " any " for incoming and outgoing interface and if i  control by source and destination address only then is it a less secure from the security perspective,, i do understand that we are restricting to specific source and destiantion interface for the address but still need to confirm that  will it be according to the best practice if we  use " any " in interface selection  ???? ,, becz in asa firewall we don't have to specify any incoming and outgoing interface except source and destination address and port number.

I will collect the logs and post it tomorrow

attached are the configs for the fortinet.[/ol]

[sonydarrel]

Dears,

Anybody can confirm to me by policy i am doing something wrong.

I have a  policy with multiple interfaces and multiple subnets from each interface as a source and destination is Internet with NAT enabled, all subnets are able to go on the internet except interface D subnet 10.10.13.0/24. Anybody can explain me where i doing things wrong.

Thanks

for Example:

Source Interfaces

interface-A

interface-B

Interface-C

Interface-D

Destination Interface

Port 12 ------Connecting to internet

Source Address

10.10.10.0/24

10.10.11.0/24

10.10.12.0/24

10.10.13.0/24

Destination Address

ANY

Services

HTTP

HTTPS

DNS

FTP