FortiSASE onboard - On going

FortiSASE Cloud Security tunnel advanced settings

- turn on will cause reconnect all Endpoint

IPAM IP allocation
- I tried tune till /24 it doesnt work
- At least require /20



For Azure Group, even my id doesnt belong more then 150 group FortiSASE unable match my group object ID

FortiSASE azure group id object doesnt match

herewith the document

https://community.fortinet.com/fortigate-3/technical-tip-understanding-the-limitation-of-150-assertions-from-microsoft-azure-as-saml-idp-that-may-cause-group-mismatch-in-fortigate-138837



Even selected security group doesnt help, only method 3 work well for me



Click on group

rename any name

then change name on SSO at FortiSASE

QR Code Generator with logo

A simple utility to generate QR codes that do not expire. One-time purchase. No subscriptions.

One-time purchase: USD 0.99

Download after purchase • Use forever • Works offline

Buy Now (USD 0.99)

Opens Payhip checkout in a new tab.

What you get

• One-time purchase, use forever
• No expiration on generated QR codes
• No account required
• No personal data stored or collected
• Works offline after download

Demo

Watch how it works:

Privacy

This tool does not require sign-in and does not store or collect personal data. Generated QR codes are created from the input you provide.

FAQ

Do the QR codes expire?
No. The QR codes generated by this tool do not expire.

Do I need internet to use it?
No. After download, the tool works offline.

Is it a subscription?
No. This is a one-time purchase (USD 0.99).

Refund policy

Due to the digital nature of this product, all sales are final. Refunds are only provided if the file is defective or cannot be downloaded.

Support

Support is provided on a best-effort basis and is limited to download or launch issues. Please include your order ID when contacting support.

---

Disclaimer: This software is provided “AS IS”, without warranty of any kind. You are responsible for verifying outputs before use. By downloading or using this software, you agree to these terms.

Buy Now (USD 0.99)

Things to know before migrate from SSLVPN to IPSec for FortiGate

Since FortiOS  going to obsolete SSLVPN from 7.6 onward,

Information

1. Ditch away the idea user group, it unable support user grouping like SSL VPN did. 
2. FSSO is a must for user grouping except local database, but FSSO has some restriction 
3. FSSO deploy with DC agent mode for better performance
4. Please test with your own mobile data, example I connect my office wifi and the office WAN IP  is use to peer with DC via IPSec, when test this remote access I always matched with the office IPSec profile.
5. If you have multiple IPSec dailup profile,  it could be matched to other IPsec profile that contain same phase-1 variable, especially the NAT-T option. Example, your Remote Access profile name F, FortiGate will try match the proposed variable from top to bottom (Profile A-F), let say the proposed proposal profile match variable at Profile C, firewall will take the NAT-T value at Profile C and negotiated based on it, but your remote user Profile F is without NAT-T but FortiGate will keep communicate with NAT-T 4500, so configure the propose profile wisely else will keep troubleshoot here and there. 
6. Pray to god for mobile phone setup, going be a nightmare, wrong pre-sharekey key in by user, wrong proposal selected and more. 
7. Azure Group object wont work for BYOD.

*note
mobile phone - iOS 

ikev1

1. If you have mobile user unable set the phase 1 and phase 2, herewith the phase 1 proposed by mobile phone
   
2. Phase 2

ikev2

1. FortiGate Config

 

          Mobile Phone config

 

Local User Database

1. Grouping user only option is to configure multiple dailup profile with different peer id and different profile has different assigned ip to group the user.

LDAP information

1. Support ikev1, stick to ikev1 if you have mobile phone user.
2. I will say partially support ikev2 , you can amended the xml and restore the amended xml file on desktop but mobile phone setup there is no option to select EAP TLS, not sure it support ot not (EAP-TTLS support for IPsec VPN)

Radius

1. Didn't test lazy to setup, more or less the same

SAML  information

1. No object group id is allow, else will face EAP error issue (Technical Tip: Error 'EAP failure' with IPsec Dial-Up VPN using remote groups)
2. Object Group ID wont work for Azure
3. Even integrated with FSSO DC agent, it need user to lock and relogin to trigger the netlogon update quite troublesome.
4. Saly

Related document for SAML
Technical Tip: Configuring IPsec VPN client-to-site with Azure SAML authentication

BYOD

1. Bye, if a domain environment, netlogon details doesn't send to AD so FSSO wont work.

Other site information

Forti VM with FortiOS 7.4.8

diagnose debug application authd -1 when turn on this debug the SAML wont work till disable debug 

To conclude, migrating from SSL VPN to IPsec VPN is PAIN and takes time for users to adapt. There are many restrictions and challenges along the way. It feels like Fortinet is trying to push users toward SASE, but not everyone can afford it—especially SME business.

Update 17 July 2025,

FSSO

Due to AD behavior, FSSO also has some limitation on user identification, BYOD doesnt work and RDP with domain user,  example IPSEC success with limvuihan (IP 192.168.10.1) but I remote desktop with domain admin pbbadmin to another server  due to AD behavior, the logon event id will be update that pbbadmin IP address as your IPSEC IP which is 192.168.10.1. So all the defined rules based on your grouping wont work and unable access. Alternative is to ignore the pbbadmin user list  at collector agent.

Update 1st August 2025

So when there is user connect the FortiClient IPsec, cant change the Split Tunnel Parameter as shown here in use, is not flexible as SSL VPN Tunnel request user to reconnect the VPN to get the new route. 

Palo Alto Self Signed Certificated ERR_SSL_KEY_USAGE_INCOMPATIBLE

 if you found my page seem that Palo Alto KB doesnt help, dont keep regenerate self signed it doesnt help herewith the steps

For Windows user

Setup Open SSL 

1. download and install open ssl from Shining Light Production (please donate if it helps)

Then Generate CSR Palo Alto KB

1. Complete the Generate the CSR steps

Back to your laptop/pc start to signed the certificate

1. Open CMD with administrator go to the openssl folder example C:\Program Files\OpenSSL-Win64\bin

2.  Type in command -

openssl.exe genrsa -out rootCA.key 2048

3. Type in command -
openssl.exe req -x509 -new -nodes -key rootCA.key -sha256 -days 3650 -out rootCA.crt -subj "/C=MY/ST=State/L=City/O=Org/OU=Dept/CN=RootCA"

4. Create an Extensions File. example on the C:\Program Files\OpenSSL-Win64\bin, create a text file name v3_req.txt content as below

[ v3_req ]
keyUsage = critical, digitalSignature, keyEncipherment, dataEncipherment extendedKeyUsage = serverAuth

save it

5. Download the CSR from Palo Alto and save it to directory openssl bin directory, example C:\Program Files\OpenSSL-Win64\bin

6. type in command just to replace the server.csr to the downloaded CSR name  
openssl.exe x509 -req -in server.csr -CA rootCA.crt -CAkey rootCA.key -CAcreateserial -out server.crt -days 365 -sha256 -extfile v3_req.txt

7. Upload the signed certificate to Palo Alto, make sure the certificated name must exactly same as the generated CSR file name.

Able to solve the issue

Ping Test Tool

Although there're lots of free ping test tool, I develop my own version ping test tool that suit my troubleshooting purpose. Feel free to download it and feedback to me.

My own version ping test tool with time log on each ping result, this time logging can be disable too. 

herewith the tools

ping test tools

Let start NSE8 !

Let start NSE 8 journey, wondering able to achieve within a year or might not or drag another decade XD.

After going through CCIE - Sec exam roughly understand how the exam going to look like.

Hope my company sponsoring me for this exam as I moved away from Network Security into cloud Security. ahemm FortiSaSe also cloud sec what.

I'm still struggling should release alpha version of Cisco Lina/ASA firewall policy convert tool develop by using company resource (laptop) to public. 

Cisco FTD route-map metric

 If you tried search the information even with chatgpt still cant locate the information. Yup, Cisco FTD replace the metric value with bandwidth:

Cli output

Palo Alto Power Cycle or power outage cause HA down

After done power cycle or power outage for PA 5220 (Active / Active or Active / Passive), once it boot up but the data plane failed

with error dataplane down : path monitor failure or Policy push to dataplane failed

Just physical power cycle it 2 ~ 3 times  

herewith  KB

https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCcXCAW 

Palo Alto Failed to find begining of certificate. Make sure certificate starts with BEGIN CERTIFICATE tag.

Don't hesitate just use another browser, problem resolved

Environment
1. PANOS 10.2
2. Panorama
3. Firefox
4. Trying to upload certificate
5. Panicking when migration
6.Engineer ego suspect bug issue

Is a sad TAC case and wasted my company case token is due to silly browser issue.

Yes, you cant find any solution on public KB about this error, according to TAC is from their internal KB. 

And, I tried to reproduce next day but miracle happen it success upload.

So conclude, just switch to another browser or using ultimate weapon RESTART YOUR PC.

Update 05 April 2023

TAC feedback

Palo Alto PPPoE with vlan tag, it's stupid setup but it's working !!

Palo Alto is not allow L3 subinterface with PPPoE, but certain ISP require to perform PPPoE with VLAN tagging


at 2018, update from reaper


So I come out this setup. Yes, it is stupid but it work !

Basically, ethernet1/3 setup as Layer 3 with PPPoE

Select interface as Layer 3, virtual router and security zone

Go to IPV4 tab, check PPPoE then configure as request

ethernet 1/4

Create VLAN profile , security zone I left it blank and interface type as L2

Ethernet 1/5, edit select ethernet1/5 at bottom create sub-interface

subinterface configure as TAG (VLAN ID), as Malaysia ISP unifi is using VLAN ID 500, at VLAN must select the previous create VLAN profile at ethernet1/4

p/s by missing VLAN profile at ethernet1/4 and ethernet1/5.500 the packet unable unable reach to modem (laptop as my testing environment)


Tadahhh..................................................

My laptop receive PPPoE discovery broadcast packet with VLAN ID 500 tagged

Although is stupid setup but it work, LOL


alternative setup if with extra switch with VLAN feature

Summary, well Palo Alto is very common implementation via L3 sub-interface PPPoE, okay !

Note for myself (ignore it)

ISE disable AD encryption for query tshoot

TROUBLESHOOTING.EncryptionOffPeriod
30
test

ProxySG

Enable full coredump
https://support.symantec.com/en_US/article.TECH244735.html

Force Coredump
https://support.symantec.com/en_US/article.TECH241718.html

SSLVPN - timestamp formula

(((A1/60)/60)/24)+DATE(1970,1,1), 

Note - Fortianlyzer generate top sent byte

This topic is for my own reference/note only

Dataset to generate report which top user

select srcip, dstip, dstport, action, service, sum(sentbyte/1048576) as sent_MBps,sum(rcvdbyte/1048576) as receive_MBps, count(*) as sessions from $log where logid_to_int(logid) not in (4, 7, 14) GROUP BY srcip, dstip, dstport, action, service ORDER BY sent_MBps DESC

Note - Forti Analyzer Report

This topic is for my own reference/note only

Dataset to generate report which hit policy id xxxx

select srcip, dstip, dstport, policyid, action, service, count(*) as sessions from $log where policyid = xxxx GROUP BY srcip, dstip, dstport,policyid, action, service

Fortianalyzer with gmail setup

If you tried to setup Fortianalyzer sending alert via gmail but kept fail

p/s  if you tried setup with 3th party apps for send notification via gmail, this guide might suit too.

Current my analyzer running 5.2.5

Herewith the steps

1. Setup on Fortianalyzer mail server setup

for information about gmail setting
https://support.google.com/a/answer/176600?hl=en


2. SSH to Fortianalyzer , configure the secure option, this command make sure using starttls.

Example

config system mail
    edit "Gmail"
        set secure-option starttls
   next
end

below is the wireshark capture  using starttls, as the red arrow indicate the SSL handshake start

3. Login into your gmail account

4. Access the url https://www.google.com/settings/security/lesssecureapps , turn it on

You can skip steps 5 and 6 if you 1st time setup gmail smtp server, else continue

5. Access the url https://accounts.google.com/DisplayUnlockCaptcha, click continue

6. You will come to this page below

6. Let test the email setup, right click the email setup and key in the recipient email

7. You should successfully send the email

Windows 7 administrator

if you wish to reset password, you may skip this topic.


if you wish to gain *Ahem*  local administrator role for c**p*** laptop/pc *Ahem*

*Ahem* bypass G** and doing without 3th party software

yup you come to right place.

prerequisite

1 x same windows version CD/USB bootup image

1 x working CD room/ USB port

Follow the steps as below link until reset password

http://www.howtogeek.com/96630/how-to-reset-your-forgotten-windows-password-the-easy-way/

p/s if you unable to locate the windows/system32 directory, it might store at other drive, please try d,e,f,g drive and etc.

hit the shift key 5 times till pop out the command prompt.

1. Type net user

2. You will get a list of user

3. type net user <username> , example net user Administrator

4. Scroll till end, it will list local group memberships as per below

5. type net localgroup <local group membership> <username> /add , example net localgroup Administrator limvuihan /add (local group membership is key sensitive)

6. verify the username you had modify, type net user <username>, if success add should listed as below

Then recover back the file that overwrite as per link listed earlier or below

http://www.howtogeek.com/96630/how-to-reset-your-forgotten-windows-password-the-easy-way/

So, you has the administrator role.

Finally certify

Officially certify CCNA :)

CAUTION : reload stack switch

最阴Cisco :D

Sometimes habit/dependent lead to mistakes.

When reload 2960x stack switch (maybe apply to all stack switch), you might reload entire stack

Sometimes is too confident when execute command but shit happen

Normally reload member by execute reload slot x, 

So, when execute reload , less/missing 1 alphabet (reload slo 1) ; it still working fine, reload the member switch 

But when execute reload, example reload slor 2 !! It should prompt error as usual, but this time cisco prompt confirm, so just press enter ; 

Surprise !!!

It reload entire stack switch 

What if the switch is in production and design as below

At that moment,

Engineer

5 min downtime is not fun at all , my career is on chopping board or ban access to customer data center

Customer might lost  million dollars (trading) , or someone lost his life (if Hospital failed to authenticate patient medical card and missed the golden rescue period)

Lucky was in post migration environment

So, I posted something in community

herewith my post at Cisco community

https://supportforums.cisco.com/discussion/12732176/2960x-reload-command-issue

community member post it proper document about reload command, Cisco treat it as reason when execute wrong command LOL

herewith document 

http://www.cisco.com/c/en/us/td/docs/switches/lan/catalyst2960x/software/15-0_2_EX/stack_manager/command_reference/b_stck_152ex_2960-x_cr/b_stck_152ex_2960-x_cr_chapter_01.html#wp3486313748

But I look at it as defect coding. Confusing engineers/administrator and mislead engineer.

Although it proper document but doesn't make sense to me or any engineer because  used to it prompt error when execute wrong command, sadly in this case it doesn't 

Be caution when reload stack switches

Thanks

Han

Palo Alto PBF (policy based forward, aka PBR) in shared gateway

If you found my page seeking solution for Palo Alto setup PBF in shared gateway and have same design as I did, picture as below

my answer to you is NO.

This had confirm by Palo Alto TAC

Any document shared gateway not support PBF ? Is NO ~~~

Any solution for this ? I still working on possible workaround to load balance 2 telco line, but solution in my mind is so complicated and hard to operate/tshoot in future

Will update my solution if it is working :P

During my case lodge, the latest version  PA-OS  is 6.1.8, 7.0.3, 6.0.12;

I'm not too sure will Palo Alto include this feature in future, might require refer to release note.

Thanks
Han

Checkpoint IPSO unable reset password

Not much information about this error except a blog I shown as below

The original ipso IPSO-6.2-GA039-04.14.2010-225515-1 unable to reset the local password, herewith the error I get when try to reset

Enter full pathname of shell or RETURN for /bin/sh: # /etc/overpw     This program is used to set a temporary admin password when you have     lost the configured password.  You must have booted the machine into     single user mode to run it.  The configured password will be changed.     Please change the temporary password as soon as you log on to your     system through voyager. Please enter password for user admin: Please re-enter password for confirmation: Continue? [n] y Running fsck... /dev/ad0s4f: FILE SYSTEM CLEAN; SKIPPING CHECKS /dev/ad0s4f: clean, 177550 free (1182 frags, 22046 blocks, 0.5% fragmentation) /dev/ad0s4a: 12 files, 416 used, 31359 free (23 frags, 3917 blocks, 0.1% fragmentation) /dev/ad0s4h: 1638 files, 391770 used, 245341 free (333 frags, 30626 blocks, 0.1% fragmentation) mount_v9fs: not found mkdir: /var/tmp2: Read-only file system /etc/overpw: cannot create /tmp/forget.XX: No such file or directory /etc/overpw: cannot create /tmp/forget.XX: No such file or directory mv: /tmp/forget.XX: No such file or directory     Admin password changed.  You may enter ^D to continue booting.      THIS IS A TEMPORARY PASSWORD CHANGE.     PLEASE USE VOYAGER TO CREATE A PERMENANT PASSWORD FOR THE USER ADMIN. umount: /var: not a file system root directory # ^DLoading configuration files. kernel dumps on /dev/ad0s4b

There is a blog http://adrianoherberth.blogspot.my/2013/08/reseting-checkpoint-firewall-smart-1.html mention how to “hack” it but during the fsck, result were different from what he post

Blog

Mine

# fsck ** /dev/ad0s4f (NO WRITE) ** Last Mounted on / ** Root file system ** Phase 1 - Check Blocks and Sizes ** Phase 2 - Check Pathnames ** Phase 3 - Check Connectivity ** Phase 4 - Check Reference Counts ** Phase 5 - Check Cyl groups 1762 files, 39170 used, 199233 free (29 frags, 49801 blocks, 0.0% fragmentation) ** /dev/ad0s4a ** Last Mounted on /config ** Phase 1 - Check Blocks and Sizes ** Phase 2 - Check Pathnames ** Phase 3 - Check Connectivity ** Phase 4 - Check Reference Counts ** Phase 5 - Check Cyl groups 6 files, 45 used, 15990 free (10 frags, 3995 blocks, 0.1% fragmentation) ** /dev/ad0s4h  ** Last Mounted on /preserve ** Phase 1 - Check Blocks and Sizes ** Phase 2 - Check Pathnames ** Phase 3 - Check Connectivity ** Phase 4 - Check Reference Counts ** Phase 5 - Check Cyl groups 2905 files, 397072 used, 198435 free (163 frags, 49568 blocks, 0.0% fragmentation)

# fsck ** /dev/ad0s4f (NO WRITE) ** Last Mounted on / ** Root file system ** Phase 1 - Check Blocks and Sizes ** Phase 2 - Check Pathnames ** Phase 3 - Check Connectivity ** Phase 4 - Check Reference Counts ** Phase 5 - Check Cyl groups 1762 files, 77241 used, 177550 free (1182 frags, 22046 blocks, 0.5% fragmentation) ** /dev/ad0s4a (NO WRITE) ** Last Mounted on /config ** Phase 1 - Check Blocks and Sizes ** Phase 2 - Check Pathnames ** Phase 3 - Check Connectivity ** Phase 4 - Check Reference Counts ** Phase 5 - Check Cyl groups 12 files, 416 used, 31359 free (23 frags, 3917 blocks, 0.1% fragmentation) ** /dev/ad0s4h (NO WRITE) ** Last Mounted on /preserve ** Phase 1 - Check Blocks and Sizes ** Phase 2 - Check Pathnames ** Phase 3 - Check Connectivity ** Phase 4 - Check Reference Counts ** Phase 5 - Check Cyl groups 1638 files, 391770 used, 245341 free (341 frags, 30625 blocks, 0.1% fragmentation)

Ultimate , fresh install a latest IPSO 6.2 to solve the issue 

Thanks
Han

Free packet analysis

To Anyone reading this post, I'm provide free packet analysis.

Just upload your packet file to cloudshark.org  and email me the link.

Thanks
Han