Suggestions for user interface improvement

[levicki]

In the odd case that people from Fortinet read this forum here are a few serious shortcomings in the user interface I stumbled upon as a new user of FortiGate 60F with previous experience in Linux iptables, Cisco ISR, Cisco ASA, Vyatta, and pfSense.

1. Log & Report > Forward Traffic -- it is not possible to create new Allow/Deny firewall rule from blocked traffic list, only Ban IP.

2. Log & Report > Web Filter -- it is not possible to create URL override directly from there, and it's a hassle even to copy the URL from the table.

3. Policy & Objects > Virtual IPs -- it is not possible to use IP address names for either external or mapped IP.

4. Policy & Objects > Virtual IPs -- it is not possible to use service entries for port forwarding, it is ridiculous that you must create 16 separate virtual IP entries to forward 8 ports for both TCP and UDP traffic.

5. Policy & Objects -> Services -- it is not possible to create a new service with a destination port type TCP/UDP, you have to enter same port two times. Many services use both, and even default service entry for RDP protocol is incorrect because RDP also uses UDP by default unless disabled by AD policy.

6. It is totally ridiculous that you cannot create a single encryption/authentication policy proposal by name and then reference it from multiple phase2 (and phase1) IPsec VPN entries.

7. On Cisco ASA, setting up an IPsec VPN tunnel with redundant/backup peer is as simple as:

crypto map ExampleMap 10 set peer 10.0.0.1 172.16.0.1

As far as I know, on FortiGate you must create two phase1 entries (one for each peer), then create duplicate phase2 entries (one for each phase1 entry), the tediousness and error-proneness of the task being exaggerated with having to specify encryption proposal for each phase2 entry, then finally setup two static routes and two policy routes.

From the above it appears to me that people who designed the user interface and CLI never worked with larger / more complex networks, because the interface simply doesn't scale for many of the tasks that are trivial to accomplish on other manufacturers' equipment.

Finally, how do you get all the way up to software version 6.4.4 without being able to edit NTP servers in the GUI?