Get the current session count of a Fortigate policy with Zabbix.

VPN setup between Fortinet and Meraki - Part 2

Fortigate CLI on 5.6.12

config vpn ipsec phase1-interface
edit meraki1
        set interface "port1"
        set keylife 28800
        set peertype any
        set proposal 3des-sha1
        set dpd disable
        set dhgrp 2
        set nattraversal disable
        set remote-gw 64.65.66.67
        set psksecret
end

config vpn ipsec phase2-interface
edit meraki1
        set phase1name meraki1
        set proposal aes256-sha1
        set pfs disable
        set keylifeseconds 28800
        set src-subnet 10.111.0.0 255.255.255.0
        set dst-subnet 10.222.0.0 255.255.255.0
end

config router static
edit 0
      set dst 10.222.0.0 255.255.0.0
      set device meraki1
end

Fortigate SNMP to get sessions with specific IP address

I have a need to keep a count of sessions from the Internet to a specific IP address.

snmpwalk -c mycommunity 10.1.2.3 1.3.6.1.4.1.12356.101.11.2.1.1.5 | grep 64.65.66.67 | wc

This one liner does the trick for now. 64.65.66.67 is the destination IP address on my network.

***

The example below will list all the session on the Fortigate and took about two minutes to complete with 1628 sessions.

snmpwalk -c mycommunity 10.1.2.3 1.3.6.1.4.1.12356.101.11.2.1.1.5

SNMPv2-SMI::enterprises.12356.101.11.2.1.1.5.1624 = IpAddress: 10.1.2.3

SNMPv2-SMI::enterprises.12356.101.11.2.1.1.5.1625 = IpAddress: 10.1.3.1

SNMPv2-SMI::enterprises.12356.101.11.2.1.1.5.1626 = IpAddress: 10.1.4.2

SNMPv2-SMI::enterprises.12356.101.11.2.1.1.5.1627 = IpAddress: 10.1.5.5

SNMPv2-SMI::enterprises.12356.101.11.2.1.1.5.1628 = IpAddress: 199.232.32.21

VPN setup between Fortinet and Meraki

I have this working with several Fortigate models and Meraki MX.

Fortigate setup on 5.2. It also worked on 4.0 but the screens are different.

Ipsec Tunnels
Create New
Custom VPN Tunnel
Name xxx
IP Address from Meraki dashboard
select Interface
Uncheck Nat Traveral and Dead Peer
Enter Pre-Shared key
Remove all Phase 1 Proposals except "3DES SHA1"
Check only DH group 2
Change key life to 28800
Enter name for Phase 2
Enter local and remote subnets for Phase 2
Click Advanced
Remove all Phase 2 proposals except "3DES SHA1"
Uncheck PFS
Add static route for remote subnet
Add two firewall policies two allow traffic to and from tunnel.

The Meraki side is simple.
Site-to-site VPN.
Add non-peer.

Cable modem setup
(This was required on one Meraki unit but I have several working with no change to the cable modem.)
Forward ports 500 and 4500 to Meraki.

Update: VPN setup between Fortinet and Meraki - Part 2

Fortigate units get "Input value is invalid" in the GUI.

I get this message on some Fortinet routers when editing the network interface. Even if I do not make any changes. Now we have to use the command line to make any changes

It takes too many steps to change the secondary IP from the CLI.

test # config sys int

test (interface) # edit internal

test (internal) # config secondaryip 

test (secondaryip) # edit 1

test (1) # show

config secondaryip

    edit 1

        set ip 10.122.1.11 255.255.255.0

    next

end

test (1) # set ip 10.122.1.1 255.255.0.0

test (1) # end

end

Fortinet "diag vpn tunnel reset" command. Yikes!

While working on a Fortigate that is the central hub for a vpn network, I typed "diag vpn tunnel reset". I intended to type "diag vpn tunnel reset tunnel-name". Most of the vpns dropped and would not come back online. The equipment had to be rebooted at all the remote sites to bring up the vpn tunnels.

Dont do this!!!

Quick script to backup Fortinet hardware on Windows.

bkup.bat

echo execute backup config ftp /fortiwifi-1 ftp.example.com  user pass >bkup.tmp

u:\putty 10.111.1.1 -l admin -pw admin-pass -m bkup.tmp

Repeat for next unit...

You need Putty and an ftp server. Now I type "bkup" and six devices are backed up in 30 seconds. I will make this a scheduled task later.