Category: Fortinet

This is a repost of a post from an old blog, made on December 28, 2011, that used to be on:

http://adminramble.com/fortigate-port-forwarding/

Original post:

On FortiGate devices Static NAT or Port Forwarding is made through the Virtual IP feature.

To map a port on an outside address to a internal ip you need to do two things:

• Create a Virtual IP entry
• Create a firewall policy for the virtual ip to allow traffic inside the network

HOW TO CREATE A VIRTUAL IP ENTRY THROUGH WEB INTERFACE ON FORTIGATE:

• Go to Firewall > Virtual IP > Virtual IP
• Click on Create New and make a new vip e.g. 10.10.10.10_rdp
• select external interface on which you will be receiving traffic, e.g. wan1
• if not set, set type to Static NAT, and put an external address (you can either put one of the public addresses you have by you ISP or, if you have dynamic or a single IP address, you can leave 0.0.0.0 as external address)
• set mapped ip address, in this case it’s 10.10.10.10, and tick port forwarding
• select TCP and on external service port put the port on which you are listening, e.g. 3389 for Remote Desktop access
• on Map to Port put the service port on the inside address, e.g. 3389 if you’re using standard RDP access, and press OK to make the Virtual IP

HOW TO CREATE FIREWALL POLICY FOR VIRTUAL IP ON FORTIGATE:

• Go to Firewall > Policy > Policy and select Create New
• Set Source Interface/Zone to listening interface, e.g. wan1
• set source address to all, and Destination interface to interface connected to the mapped ip network, e.g. internal
• set destination address to the Virtual IP name, e.g. 10.10.10.10_rdp
• leave schedule always (unless you only wanted to be accessible at certain times), service ANY and action ACCEPT
• click OK to make the firewall policy

This is a repost of a post from an old blog, made on December 27, 2011, that used to be on:

http://adminramble.com/fortigate-useful-commands/

Original post:

I been using FortiGate devices for a few months now, and I have mostly been doing the administration through the web interface, but even that will require you to do some stuff through CLI.

Here are some of the commands you might need.

(If you don’t have a CLI on your dashboard, you can add it by clicking on plus sign on a Widget button on top of your dashboard and selecting a CLI Console from it.)

To execute all of this commands you need to click with your mouse inside the CLI Console widget so you can type in it.

 HOW TO PING OR TRACEROUTE AN ADRESS FROM A FORTIGATE UNIT:

• type “execute ping” or “execute traceroute” followed by an address you want to ping e.g.“execute ping 10.10.10.10″

HOW TO SHUTDOWN OR REBOOT A FORTIGATE UNIT FROM A CLI:

• type “execute shutdown” or “execute reboot”

HOW TO CHANGE AN ADMIN USER PASSWORD:

• type “config system admin”
• type “edit” followed by a user you want to reset the password for, e.g. “edit Joe”
• type “set password” followed by a new password, e.g. “set password NewPass1“
• type “end” to finish the procedure

HOW TO RESET A LOST PASSWORD ON A FORTIGATE UNIT:

• start some terminal emulator and connect to the device using a a console cable. Depending on which device you use it will be a RJ-45 to Serial or Serial to Serial cable
• Reboot the device and immediately it starts up login with user “maintainer” and password “bcpb%deviceserialnumber%” e.g. “bcpbFGT60C1A01102345″ (This should be done inside 14 seconds i think, i took me a few tries before i managed to do it, also the serial number is case sensitive)
• change the user password as described above
  config system admin
  edit %user%
  set password %password%
  end

HOW TO RESET FORTIGATE TO FACTORY DEFAULTS:

• type “execute factoryreset”