very good video, Currently I have configured 2 IPsec between Fortigate, the tunnel is up but when I try to ping from Fortigate A to the LAN network on Fortigate B it can't. is this ping test mandatory from hosts under fortigate a?
THANK YOU! I spent 5 hours troubleshooting a site-to-site VPN between two Fortigates and had almost given up. The Phase 1 would come up but Phase 2 would not. I paused your video at the 9 minute mark when you suggested using IKE v2. My tunnel was on IKE v1 but I never considered this in my troubleshooting because I thought it was a Phase 1 setting. I switched the IKE version and everything came up! Now to watch the rest of your video :)
Hiho, nice video, sad is Fortigate out of my budget. But you know what could be a "fun" video when you have this nice Lab anyways? Push OSPF to a different area over the IPSEC tunnel just because you can and it's fun. :D
Can you please upload about the security basic configuration for fortinet devices? Something like the policy that all the router at least should be use. Thanks a lot for all your videos
Tell me as a professional what we should use fortigate for? I am a person who likes to do everything with mikrotik and I don't like UTMs. I want to know your opinion on this.
Hi Sohaib, from a professional stance FortiGate allows you to integrate firewall policy rules with user groups, besides being able to do stuff like UTM. You also have added security of MFA when it comes to accessing the network via a VPN. What makes FortiGate also very useful is the fact that you can create VDOMs and VRFs within VDOMs. In a nutshell a VDOM is just another instance of of the firewall so you can think of it as a virtual firewall running inside your actual firewall. This allows for great expansion especially in the ISP space where you may not want all policies to reside on a single plane. Last thing that makes it VERY good is true SD-WAN functionality when used with a FortiManager product as you can orchestrate SD-WAN configurations and policies from a single point separating the management plane from a single device. Which is a lot more scalable than traditional networking. MikroTik is an AWESOME router, but it does not do these functions a FortiGate firewall can do. I will still prefer using a MikroTik as my actual router though :) And if it comes to firewalling and SD-WAN then I will prefer putting down a FortiGate.
Yes it is possible to just setup encryption and routing for a single host as /32. You can also use natted addresses if that is some security requirement for your company. Usually done in instances with a subnet is potentially shared on both ends.
