I had an issue with a firewall that showed three blades, TP-blades, licensed as “evaluation” and furthermore the license was expired. The firewall itself, showed the licenses to be alright as shown in the picture below: Various things were tried in order to solve the issue, but none of them made any difference. cplic eval_disable […]
Just a quick note on how to lookup and search in the FortiGate Internet Service Database(ISDB) for later reference. Search for a service: FortiGate80D # get system status | grep Version Version: FortiGate-80D v6.2.2,build1010,191008 (GA) FortiGate80D # diagnose internet-service id | grep -i microsoft ID: 327681 name: “Microsoft-Web” ID: 327682 name: “Microsoft-ICMP” ID: 327683 name: […]
Didn’t find alot of information on how to view the FortiNet approved CA-store, so I thought I’d make a post about it.This is the command to check the store (details can be omitted). Note there is a difference between an unit running VDOM – With VDOM: get certificate ca details – Without VDOM: get vpn […]
Most are probably familiar with the command diag sys top, to find processes that consume too high CPU/memory. To find a specific PID of a processes, a command was introduced in v6 (I think), that allows you to search for PIDs for a given process.Under follows an example of finding the PIDs for httpsd and […]
In a freshly installed Windows Server 2016-environment, there was feedback that Windows Update failed when HTTPS-inspection was enabled. Even though “Bypass HTTPS inspection of traffic to well known software update services” was ticked off. The servers was stuck with this error message: Some update files aren’t signed correctly.Error code: (0x800b0109) In the tracker I could […]
I came across some important information. Although I did not find any useful information (at first), so hopefully this post will help speed up someone elses troubleshooting. Problem statement: Passive VS on VSX ARPs for default GW using physical interface IP instead of cluster IP and no traffic flows from passive Virtual System. If ARP […]
In order to enable DHCP-relaying for interfaces belonging to Virtual Systems on a VSX-cluster, you have to set the context to the specific virtual system the interface belongs to. List all Virtual Systems on the VSX-cluster show virtual-system all
I encountered a problem with a firewall blocking traffic even though it was supposed to let traffic through. This particular policy used nested object grouping (Main group > Sub-group > NetworkAdr-member). The odd thing was, it seemed to only affect one vDom. What was happening: The traffic did not match the configured policy and was […]
Scope and disclaimer This blog post is primarily to explain and show the process of upgrading a Quad-sup 6807 VSS-cluster using the In Service Software Upgrade (ISSU) feature, also known as Enchanged Fast Software Upgrade(EFSU) in VSS terminology. The entire process is very painless as long as the cabling is done right. Requirements Dual homed […]
In order to read the Check Point firewall logs in plaintext, you need to use the fwm logexport command. The export takes a great deal of time, especially if you are converting loads of them. Therefor you should set the SSH timeout to a greater value than usual and run a script along the lines […]