GraniteDan
GraniteDan
  • Видео 6
  • Просмотров 133 735
Fortgate Security Profile Groups
Security profile groups are a bit of a hidden gem in FortiOS 6.x. This is a quick video that provides a bit of a description of the feature, and a walk through on enabling it on your FortiGate and how to put it to work for you.
The best way to describe the benefits of security profile groups is that they provide and easy way to bundle the same set of security profiles and apply them in a standard and uniform way across similar firewall policies.
I hope that this tutorial helps to make your lives a little easier!
Просмотров: 3 406

Видео

YouTube Therapy: Why is AAD Blocking Users who report Fraud on their account by default
Просмотров 2803 года назад
Sometimes I come across default settings in enterprise applications that frustrate me. Choices thrust upon us by vendors that do not make a lot of sense. In this case Azure AD has a setting to block MFA for users who report fraud in their Microsoft Authenticator App. This Block is Immediate and lasts for a default of 90 days unless acted upon by... you guessed it a GLOBAL ADMIN... Microsoft I t...
Configure and use 3rd Party threat feeds on a Fortigate Firewall
Просмотров 22 тыс.3 года назад
Short Video to go over setting up external threat feeds on a Fortigate firewall, using security fabric external connectors. How these are configured and used within the system to extend the capabilities of the Fortigate. There is also some discussion around various use cases etc. Documentation: docs.fortinet.com/document/fortigate/7.0.1/administration-guide/9463/threat-feeds
Free Enterprise Grade Information Security For your Home/Family with CIRA Canadian Shield
Просмотров 2753 года назад
As Part of a Community Series of Videos This tutorial goes over CIRA Canadian Shield and how it can be used to protect systems connected to the internet in your home, and protect children from inappropriate Content on the internet as well. CIRA Canadian Shield: www.cira.ca/cybersecurity-services/canadian-shield Canadian Shield is a DNS firewall. CIRA's servers replace the DNS servers your compu...
Configure Fortigate SSL VPN to use Azure AD as SAML IDP (MFA / Conditional Access)
Просмотров 108 тыс.3 года назад
Welcome to this tutorial video on Using Azure AD and SAML to authenticate Foritgate SSL VPN Users. Traditionally to authenticate VPN users you would use LDAP or Radius. Radius was required if you needed to provided different levels of access to different groups of users. And would be handled by having the Radius server return a Vendor-specific attribute that matched the name of a group defined ...
Update AutoCorrect Entries in Word Via PowerShell Script
Просмотров 39210 лет назад
This Script is based on One posted on the Microsoft Scripting Guy Blog, however it allows for both fully Automated and fully interactive operation. The Script Code is available from my Github repo: github.com/GraniteDan/Update-AutoCorrect

Комментарии

  • @forestbirdoriginals4917
    @forestbirdoriginals4917 13 дней назад

    Anybody else have the issue when using the FQDN instead of the IP, that the reply response from the FortiGate is empty? DNS seems to resolve to the right IP. Entra succeeds when using the IP in the application config, but when using a DNS address, it seems to fail after authenticating due to a empty response.

  • @gustavovillanueva5306
    @gustavovillanueva5306 Месяц назад

    When I was notice a 48 mins video about this theme, I said "sure it is so boring this video", but when I finish, I immediately pushed that suscribe and "I like" button. Thanks a lot for your video and explanation "una joyita de video"

  • @kwm1985
    @kwm1985 3 месяца назад

    Thank you very much for this video. I had an issue with the step where I had to setup the custom "username" claim attribute on the Azure side and the documentation and other tutorials don't clearly state what to do there.

  • @sokocul
    @sokocul 3 месяца назад

    thanks bro

  • @gdhomy2009
    @gdhomy2009 4 месяца назад

    Where did you get gateway address to put in browser and Forticlient

  • @JamesNationMusic
    @JamesNationMusic 5 месяцев назад

    Dude thank you! One thing to note, is that you dont need the quotes anymore on 7.2.8 firmware.

  • @JasonMilczek
    @JasonMilczek 5 месяцев назад

    Highly recommend 1.5x playback speed on this video.

  • @ludapebe
    @ludapebe 6 месяцев назад

    Hi. I have a problem with the client . Log show a problem with connect to server error 6500

  • @taza1411
    @taza1411 8 месяцев назад

    Thank you for this video it was extremely informative

  • @decosion5498
    @decosion5498 9 месяцев назад

    Very nice explanation

  • @nil1377
    @nil1377 10 месяцев назад

    Thank you for sharing this tip Dan, this makes policy configuration clear & clutter-free.

  • @nature0893
    @nature0893 11 месяцев назад

    Thank you for the video

  • @thom12345100
    @thom12345100 Год назад

    Thank you Dan! I was able to setup the same within 1.5 hours thanks to your vid. If anyone cares: If using FIDO2 key (passwordless), you have to select the option in the Forticlient VPN profile to authenticate using the browser.

  • @tommaor2094
    @tommaor2094 Год назад

    can i use self signed certificate for azure saml ?

  • @lalitjoshi8032
    @lalitjoshi8032 Год назад

    Great Content...

  • @hafezelashry2275
    @hafezelashry2275 Год назад

    Is this websites and urlsis trusted?

  • @hafezelashry2275
    @hafezelashry2275 Год назад

    Is this websites and url is trusted

  • @fransishummel
    @fransishummel Год назад

    what should be the format if we are uploading ips from a notepad file , i have uploaded it to my drive and connected , its connected but on show entries its showing errors !!

  • @capricornnnn
    @capricornnnn Год назад

    Thanks. How you can implement this with SSLVPN? Now that so much vulnerabilities with SSL VPN and people scanning the internet, with port 443 opened from outside. A use case will be to use this for SSL VPN. It will be nice to have some information about it :). Talos link doesnt work. I dont find any IP block list. May be they have changed it.

  • @d4nielcui
    @d4nielcui Год назад

    It's great tutorial. by the way, I found an error "Invalid HTTP request" when I tested. Could you advise, Dan? Thank you!

  • @kento6909
    @kento6909 Год назад

    At about ruclips.net/video/nDH2wvveLrI/видео.html, you copied the FQDN but where should I get the FQDN in Fortigate from? Ive been trying to set up this configuration form yesterday but still stutcked on the way. Please help!! Kento from Japan.

  • @MaxKulik
    @MaxKulik Год назад

    Great Video! Thanks for sharing!

  • @deejayboziah9800
    @deejayboziah9800 Год назад

    Well done video tutorial, Kudos. You didnt mention url haus, does it not need a firewall policy?

  • @anto5741
    @anto5741 Год назад

    Thank you very much for your video. Regards

  • @michaelramirez9378
    @michaelramirez9378 Год назад

    Thank you for creating this content Dan. Great video and instructions. It was incredibly helpful.

  • @n2sport1
    @n2sport1 Год назад

    Do you need separate fortigate ssl vpn enterprise apps for separate fortigate firewalls?

  • @WReaume
    @WReaume Год назад

    Great vid. My free Azure account would not allow me to add groups to the FortigateSSL enterprise app thingy in Azure, only users. But, you could kick it a bit on the login and could evenutally get to the SSL portal. Thanks for the useful video and info. Make more vids!

  • @IMRAN-AHMED-TECH-TALKS
    @IMRAN-AHMED-TECH-TALKS Год назад

    Thanks

  • @BenjaminBox
    @BenjaminBox Год назад

    I'm studying for my SC-900 exam and I came across this setting and it just confused me as to why it's default... I'm glad I got this video, now I know it's weird as I thought.

  • @la08
    @la08 Год назад

    Fantastic! one question: There seems to be a limitation on 7.0.9 to add multiple saml server to a group. Is there a way around this without recreating the same firewall policies for different saml servers

    • @GraniteDan
      @GraniteDan Год назад

      Add multiple groups to the firewall policy.

    • @la08
      @la08 Год назад

      @@GraniteDan Tried this, the issue is the same. Not able to add 2 different user groups(referencing two different saml server) to a firewall policy

  • @attiland56
    @attiland56 Год назад

    Best content in the subject for months in the subject I have come across. Thank you

  • @ryanprosser1823
    @ryanprosser1823 Год назад

    Fantastic video thank you! Great note about being able to leverage this to examine and compare malware hash for internal traffic across VLANs. I've always wondered if my network would slow if I routed VLANs on the firewall rather than our core switch...

  • @abdallahezat8604
    @abdallahezat8604 Год назад

    great sharing.

  • @franckymetal
    @franckymetal Год назад

    Good morning Dan, really nice video and well explained. I was just wondering, in the ssl settings in the Authentication/ Portal Mapping if i create a mapping to a new portal for azure and I also have a mapping for a group of local user of fw to connect to the portal full-access for example. When my users with local account will connect to the fw via forticlient, will they get the azure windows also ? I would like to keep these users connecting without the azure portal but also that some groups gets azure windows.

  • @johnnyfernandez994
    @johnnyfernandez994 Год назад

    thank you so much! I have an End of Sale / End of support Fortigate in my home network and fortunately with this video I could take advantage filtering malicious traffic withous official fortinet license, thats great! thanks and regards from Costa Rica!

  • @JanisJaunosans
    @JanisJaunosans Год назад

    noice!

  • @rafaelaraujo7384
    @rafaelaraujo7384 Год назад

    Hey bro. Since fortigate use FortiGuard to provide realtime "security blocks" while using ISDBs for example, WHY we should use an IP address Threat Feed Integration?

    • @GraniteDan
      @GraniteDan Год назад

      Lots of reasons. 1st would probably be that no one security vendor catches everything. No matter how good their sales pitches are. 3rd Party feeds can complement Fortiguard services. Second might be in-house or industry maintained feeds. I used to work in higher education and lots of institutions across Canada pooled threat intel into a common misp database and those feeds could be ingested into member firewalls regardless of vendor. Or like the example in the video if you are running a dual stack internet connection and you want to block all traffic from TOR exit nodes both ipv4 and ipv6 (fortiguard ISDBs are ipv4 only). You may want to use a feed as an allowlist rather than a blocklist and you can do that using a feed because it just acts like an address object in a firewall policy. There are a lot of possibilities for this.

    • @rafaelaraujo7384
      @rafaelaraujo7384 Год назад

      @@GraniteDan great... Thanks for the answer... Do we haver a risk tô block falar positives? How would we deal with that?

  • @denmanfite3156
    @denmanfite3156 Год назад

    Great video. Really enjoyed how you showed the whole process including the small issues you ran into.

  • @joshpark1
    @joshpark1 2 года назад

    I've been pouring over the config documents from both Azure and Fortigate side for about a week preparing to get it done this week. Always helpful to see someone actually do it though and I'm really happy you left the troubleshooting in there. Invaluable! Liked and subscribed sir, thank you!

  • @elcioluizjunior
    @elcioluizjunior 2 года назад

    not working here, my vpn portal do not redirect do microsoft, if a access the saml address I have remote/saml/login invalid http request

  • @peterliu5296
    @peterliu5296 2 года назад

    great video. really informative .well organized and detailed. thanks for sharing. would like to see more upload from you.

  • @robdax3122
    @robdax3122 2 года назад

    Hi Dan, this video is very helpful, but I missed the MFA part. If I am not wrong, you didn't configure it. I can see that the systen asked username and password, but not a second factor (multi-factor or two-factor) authentication. No token or OTP of any sort.

    • @GraniteDan
      @GraniteDan 2 года назад

      Rob, thanks I didn’t get into MFA other than maybe mentioning it. Azure AD handles the MFA side of things if you have MFA enabled either per user for via conditional access you will get prompted for MFA just like you would when logging into M365 or any other app.

  • @KK-po5hm
    @KK-po5hm 2 года назад

    Dan, Do you provide consulting services?

  • @cloudmasterlive
    @cloudmasterlive 2 года назад

    Thank You for sharing. It was informative.

  • @nimesis124
    @nimesis124 2 года назад

    Hi Dan, My forinet is running in AWS and I want to connect with Azure same like this video, Do I need to allow any ports in Azure and AWS vice versa?

  • @em7yn
    @em7yn 2 года назад

    Can this be done without running a domain for our SSL Cert? I.e, running a cert to our public IP? We have no internal DNS so setting this up would be difficult for FQDN.

  • @philiponstwedder1868
    @philiponstwedder1868 2 года назад

    Thanks Dan. Good explanation. This helps.

  • @Heineken1712
    @Heineken1712 2 года назад

    Hi, does anyone know if you can apply Azure 2FA like this to authenticate against FG SSL VPN?

    • @GraniteDan
      @GraniteDan 2 года назад

      That is exactly what the video shows you how to do.

    • @Heineken1712
      @Heineken1712 2 года назад

      @@GraniteDan I only see azure authentication with username/password. But I'm new to azure, I probably don't fully understand the 2FA process of azure. Afaik you need to accept the 2FA f.e. on your phone. The login procedure on SSL VPN doesn't show a page where it is waiting for acceptance of the 2FA.

    • @GraniteDan
      @GraniteDan 2 года назад

      @@Heineken1712 MFA is wholly managed by Azure AD. When it is enabled either per user or by conditional access and you are authenticating with Azure AD via SAML the user will receive the MFA prompts just as they do when logging into Any Office 365 cloud apps etc.

  • @dodonohoe30
    @dodonohoe30 2 года назад

    Great content Dan. For my understanding, I wonder could someone give me the highlevel sequence of events here, in terms if the token / authentication flow mechanism?

  • @wascarreyes01
    @wascarreyes01 2 года назад

    How can I have redundancy with SAML?

    • @GraniteDan
      @GraniteDan 2 года назад

      What sort of redundancy are you looking for?

    • @wascarreyes01
      @wascarreyes01 2 года назад

      @@GraniteDan we have multiple interfaces configured on SSL VPN, the question really is, should I create two multiple instances in Azure AD as well?

    • @GraniteDan
      @GraniteDan 2 года назад

      @@wascarreyes01 I don't believe this would be required. If all of the users exist in the same Azure AD. Should be able to setup a Single server and then allow specific groups.

    • @wascarreyes01
      @wascarreyes01 2 года назад

      @@GraniteDan What if my firewall’s public IP goes down?

    • @GraniteDan
      @GraniteDan 2 года назад

      @@wascarreyes01 If your public IP goes down then your users probably won’t be able to connect to the SSL VPN. For that level of redundancy you could look at multiple connections, SDWAN, and some load balancing for the FQDN that users are connecting to.