FortiManager with WAN OPT

[Carl_Wallmark]

Hi,

I´m deploying wan opt on a few sites and I miss some things in the FortiManager.

1. I cannot set "Local Host ID" on each firewall.

2. I cannot find the advanced features in the WAN Opt profile like:

config wanopt profile

edit default

config cifs

    status              : enable     secure-tunnel       : disable     byte-caching        : enable     prefer-chunking     : dynamic     tunnel-sharing      : express-shared     log-traffic         : enable     port                : 445

So everytime I push out new changes to the firewall it wants to revert to default.

[scao_FTNT]

1. I cannot set "Local Host ID" on each firewall.

   -- this is supported in device level, per device config menu - system - local host ID page (for "conf wanopt settings"), you may need to enable GUI display for this config since by default it is hidden

2. I cannot find the advanced features in the WAN Opt profile like

   -- not all below CLIs supported on GUI for "wan opt profile" config page, for not supported ones, you may need to use run script on package db, to generate the config

Thanks

Simon

[Carl_Wallmark]

Thanks Simon, found the "Local Host ID", I was looking in the wrong place ;)

For the script, do I simply create a script with the commands I want and run the script once or do I have to do it everytime I need to push a config change ?

[scao_FTNT]

you only need to run once for policy package db and later, if you want to change GUI supported config (like status enable/disable, port # etc), you still can edit/change from GUI, and GUI save config down should keep those CLI only settings (like " set prefer-chunking dynamic" etc)

I did a quick check on FMG 5.2.4 0738 which looks OK, and if there has any issue, pls let me know

Thanks

Simon

[Carl_Wallmark]

Perfect!

I will check this tomorrow morning.

Thanks!

[Carl_Wallmark]

Hi Simon,

It worked just as you said, thank you for you help!

[Carl_Wallmark]

ok, one strange thing happend to one of the firewalls,

I had to run the script on both "Device databse" and "Policy Package",

First I ran it on the "Device database", and installed device settings, no problem there, but the policy package was then set to "unknown" , so I went for an update on the policy package, and in the preview I saw that it wanted to revert to default again in the wan opt settings, so i ran the script on policy package as well, then it changed to "modified", and I pushed the settings without issues this time.

in what database should the wan opt settings be in ? device or policy package ?

[scao_FTNT]

on FMG side, some config are controlled in device db like admin, admin settings, routes etc, the config you can see in device config menu list

some config are controlled in ADOM db, normally for policy and policy used object, like this wan opt profile

and for config controlled in ADOM db, although you can do changes in device db like run script or retrieve from FGT, but next time policy package install, will remove all changes in device db and only copy/install what ADOM db has

so you need to do config change in ADOM db, thus policy install will always install the config from ADOM level

Thanks

Simon

[Carl_Wallmark]

ok thanks for clarifying.