- Видео 6
- Просмотров 133 735
GraniteDan
Канада
Добавлен 20 май 2014
This channel is used to provide helpful content about Networking and Cyber Security. Generally How-To videos for practical solutions that I will help the IT community. I hope to drive conversations in the comments that will build communities and allow people to ask the questions that will help to customize any solutions to solve their problems.
Fortgate Security Profile Groups
Security profile groups are a bit of a hidden gem in FortiOS 6.x. This is a quick video that provides a bit of a description of the feature, and a walk through on enabling it on your FortiGate and how to put it to work for you.
The best way to describe the benefits of security profile groups is that they provide and easy way to bundle the same set of security profiles and apply them in a standard and uniform way across similar firewall policies.
I hope that this tutorial helps to make your lives a little easier!
The best way to describe the benefits of security profile groups is that they provide and easy way to bundle the same set of security profiles and apply them in a standard and uniform way across similar firewall policies.
I hope that this tutorial helps to make your lives a little easier!
Просмотров: 3 406
Видео
YouTube Therapy: Why is AAD Blocking Users who report Fraud on their account by default
Просмотров 2803 года назад
Sometimes I come across default settings in enterprise applications that frustrate me. Choices thrust upon us by vendors that do not make a lot of sense. In this case Azure AD has a setting to block MFA for users who report fraud in their Microsoft Authenticator App. This Block is Immediate and lasts for a default of 90 days unless acted upon by... you guessed it a GLOBAL ADMIN... Microsoft I t...
Configure and use 3rd Party threat feeds on a Fortigate Firewall
Просмотров 22 тыс.3 года назад
Short Video to go over setting up external threat feeds on a Fortigate firewall, using security fabric external connectors. How these are configured and used within the system to extend the capabilities of the Fortigate. There is also some discussion around various use cases etc. Documentation: docs.fortinet.com/document/fortigate/7.0.1/administration-guide/9463/threat-feeds
Free Enterprise Grade Information Security For your Home/Family with CIRA Canadian Shield
Просмотров 2753 года назад
As Part of a Community Series of Videos This tutorial goes over CIRA Canadian Shield and how it can be used to protect systems connected to the internet in your home, and protect children from inappropriate Content on the internet as well. CIRA Canadian Shield: www.cira.ca/cybersecurity-services/canadian-shield Canadian Shield is a DNS firewall. CIRA's servers replace the DNS servers your compu...
Configure Fortigate SSL VPN to use Azure AD as SAML IDP (MFA / Conditional Access)
Просмотров 108 тыс.3 года назад
Welcome to this tutorial video on Using Azure AD and SAML to authenticate Foritgate SSL VPN Users. Traditionally to authenticate VPN users you would use LDAP or Radius. Radius was required if you needed to provided different levels of access to different groups of users. And would be handled by having the Radius server return a Vendor-specific attribute that matched the name of a group defined ...
Update AutoCorrect Entries in Word Via PowerShell Script
Просмотров 39210 лет назад
This Script is based on One posted on the Microsoft Scripting Guy Blog, however it allows for both fully Automated and fully interactive operation. The Script Code is available from my Github repo: github.com/GraniteDan/Update-AutoCorrect
Anybody else have the issue when using the FQDN instead of the IP, that the reply response from the FortiGate is empty? DNS seems to resolve to the right IP. Entra succeeds when using the IP in the application config, but when using a DNS address, it seems to fail after authenticating due to a empty response.
When I was notice a 48 mins video about this theme, I said "sure it is so boring this video", but when I finish, I immediately pushed that suscribe and "I like" button. Thanks a lot for your video and explanation "una joyita de video"
Thank you very much for this video. I had an issue with the step where I had to setup the custom "username" claim attribute on the Azure side and the documentation and other tutorials don't clearly state what to do there.
thanks bro
Where did you get gateway address to put in browser and Forticlient
Dude thank you! One thing to note, is that you dont need the quotes anymore on 7.2.8 firmware.
Highly recommend 1.5x playback speed on this video.
Hi. I have a problem with the client . Log show a problem with connect to server error 6500
Thank you for this video it was extremely informative
Very nice explanation
Thank you for sharing this tip Dan, this makes policy configuration clear & clutter-free.
Thank you for the video
Thank you Dan! I was able to setup the same within 1.5 hours thanks to your vid. If anyone cares: If using FIDO2 key (passwordless), you have to select the option in the Forticlient VPN profile to authenticate using the browser.
can i use self signed certificate for azure saml ?
Great Content...
Is this websites and urlsis trusted?
Is this websites and url is trusted
what should be the format if we are uploading ips from a notepad file , i have uploaded it to my drive and connected , its connected but on show entries its showing errors !!
Thanks. How you can implement this with SSLVPN? Now that so much vulnerabilities with SSL VPN and people scanning the internet, with port 443 opened from outside. A use case will be to use this for SSL VPN. It will be nice to have some information about it :). Talos link doesnt work. I dont find any IP block list. May be they have changed it.
It's great tutorial. by the way, I found an error "Invalid HTTP request" when I tested. Could you advise, Dan? Thank you!
At about ruclips.net/video/nDH2wvveLrI/видео.html, you copied the FQDN but where should I get the FQDN in Fortigate from? Ive been trying to set up this configuration form yesterday but still stutcked on the way. Please help!! Kento from Japan.
Great Video! Thanks for sharing!
Well done video tutorial, Kudos. You didnt mention url haus, does it not need a firewall policy?
Thank you very much for your video. Regards
Thank you for creating this content Dan. Great video and instructions. It was incredibly helpful.
Do you need separate fortigate ssl vpn enterprise apps for separate fortigate firewalls?
Great vid. My free Azure account would not allow me to add groups to the FortigateSSL enterprise app thingy in Azure, only users. But, you could kick it a bit on the login and could evenutally get to the SSL portal. Thanks for the useful video and info. Make more vids!
Thanks
I'm studying for my SC-900 exam and I came across this setting and it just confused me as to why it's default... I'm glad I got this video, now I know it's weird as I thought.
Fantastic! one question: There seems to be a limitation on 7.0.9 to add multiple saml server to a group. Is there a way around this without recreating the same firewall policies for different saml servers
Add multiple groups to the firewall policy.
@@GraniteDan Tried this, the issue is the same. Not able to add 2 different user groups(referencing two different saml server) to a firewall policy
Best content in the subject for months in the subject I have come across. Thank you
Fantastic video thank you! Great note about being able to leverage this to examine and compare malware hash for internal traffic across VLANs. I've always wondered if my network would slow if I routed VLANs on the firewall rather than our core switch...
great sharing.
Good morning Dan, really nice video and well explained. I was just wondering, in the ssl settings in the Authentication/ Portal Mapping if i create a mapping to a new portal for azure and I also have a mapping for a group of local user of fw to connect to the portal full-access for example. When my users with local account will connect to the fw via forticlient, will they get the azure windows also ? I would like to keep these users connecting without the azure portal but also that some groups gets azure windows.
thank you so much! I have an End of Sale / End of support Fortigate in my home network and fortunately with this video I could take advantage filtering malicious traffic withous official fortinet license, thats great! thanks and regards from Costa Rica!
noice!
Hey bro. Since fortigate use FortiGuard to provide realtime "security blocks" while using ISDBs for example, WHY we should use an IP address Threat Feed Integration?
Lots of reasons. 1st would probably be that no one security vendor catches everything. No matter how good their sales pitches are. 3rd Party feeds can complement Fortiguard services. Second might be in-house or industry maintained feeds. I used to work in higher education and lots of institutions across Canada pooled threat intel into a common misp database and those feeds could be ingested into member firewalls regardless of vendor. Or like the example in the video if you are running a dual stack internet connection and you want to block all traffic from TOR exit nodes both ipv4 and ipv6 (fortiguard ISDBs are ipv4 only). You may want to use a feed as an allowlist rather than a blocklist and you can do that using a feed because it just acts like an address object in a firewall policy. There are a lot of possibilities for this.
@@GraniteDan great... Thanks for the answer... Do we haver a risk tô block falar positives? How would we deal with that?
Great video. Really enjoyed how you showed the whole process including the small issues you ran into.
I've been pouring over the config documents from both Azure and Fortigate side for about a week preparing to get it done this week. Always helpful to see someone actually do it though and I'm really happy you left the troubleshooting in there. Invaluable! Liked and subscribed sir, thank you!
not working here, my vpn portal do not redirect do microsoft, if a access the saml address I have remote/saml/login invalid http request
great video. really informative .well organized and detailed. thanks for sharing. would like to see more upload from you.
Hi Dan, this video is very helpful, but I missed the MFA part. If I am not wrong, you didn't configure it. I can see that the systen asked username and password, but not a second factor (multi-factor or two-factor) authentication. No token or OTP of any sort.
Rob, thanks I didn’t get into MFA other than maybe mentioning it. Azure AD handles the MFA side of things if you have MFA enabled either per user for via conditional access you will get prompted for MFA just like you would when logging into M365 or any other app.
Dan, Do you provide consulting services?
Thank You for sharing. It was informative.
Hi Dan, My forinet is running in AWS and I want to connect with Azure same like this video, Do I need to allow any ports in Azure and AWS vice versa?
Can this be done without running a domain for our SSL Cert? I.e, running a cert to our public IP? We have no internal DNS so setting this up would be difficult for FQDN.
Thanks Dan. Good explanation. This helps.
Hi, does anyone know if you can apply Azure 2FA like this to authenticate against FG SSL VPN?
That is exactly what the video shows you how to do.
@@GraniteDan I only see azure authentication with username/password. But I'm new to azure, I probably don't fully understand the 2FA process of azure. Afaik you need to accept the 2FA f.e. on your phone. The login procedure on SSL VPN doesn't show a page where it is waiting for acceptance of the 2FA.
@@Heineken1712 MFA is wholly managed by Azure AD. When it is enabled either per user or by conditional access and you are authenticating with Azure AD via SAML the user will receive the MFA prompts just as they do when logging into Any Office 365 cloud apps etc.
Great content Dan. For my understanding, I wonder could someone give me the highlevel sequence of events here, in terms if the token / authentication flow mechanism?
How can I have redundancy with SAML?
What sort of redundancy are you looking for?
@@GraniteDan we have multiple interfaces configured on SSL VPN, the question really is, should I create two multiple instances in Azure AD as well?
@@wascarreyes01 I don't believe this would be required. If all of the users exist in the same Azure AD. Should be able to setup a Single server and then allow specific groups.
@@GraniteDan What if my firewall’s public IP goes down?
@@wascarreyes01 If your public IP goes down then your users probably won’t be able to connect to the SSL VPN. For that level of redundancy you could look at multiple connections, SDWAN, and some load balancing for the FQDN that users are connecting to.