Install Fortinet Forticlient VPN on Deepin 23.1 (For SSL cert is self-signed cert)

1. echo -n | openssl s_client -showcerts -connect registry.example.com:port 2>/dev/null | sed -ne '/-BEGIN CERTIFICATE-/,/-END CERTIFICATE-/p' > xxca.crt

Replace the "registry.example.com:port"  to your SSL VPN gateway URL and port.

2. Go to the file "xxca.crt", use a editor like "notepadqq" to open the file

3. Copy all the text in the xxca.crt

4. sudo vi /usr/local/share/ca-certificates/xxca.crt

5. Paste all text into this file and :wq (To save those text)

6. sudo update-ca-certificates

7. Reboot your machine

8. Then you can use the Forticlient to connect your VPN gateway. 

Reference:

https://blog.keepchen.com/a/configure-forticlient-vpn-on-deepin-25.html

Install Fortinet Forticlient VPN on Deepin 23.1 (For SSL cert is self-signed cert)

Fortinet SSL VPN customers need to be aware - Gradually transition to ZTNA while maintaining operational stability

Background on SSL VPN Deprecation in FortiOS 7.6.3

Fortinet has been advancing its Zero Trust Architecture (ZTA) strategy since 2022, introducing key Zero Trust Network Access (ZTNA) features in FortiOS 7.0. Recent versions like 7.6.3 may further prioritize ZTNA over SSL VPN. Fortinet has experienced numerous critical vulnerabilities in its SSL VPN functionality, most notably CVE-2024-21762, which allows unauthenticated remote code execution. These vulnerabilities, including older ones like CVE-2022-42475 and CVE-2023-27997, have been exploited by threat actors, leading to device compromise.

In FortiOS 7.6.3, Fortinet has deprecated and removed SSL VPN tunnel mode on all FortiGate models. This means that SSL VPN tunnel mode is no longer supported in the GUI or CLI, and existing SSL VPN configurations will not be upgraded. Users must migrate to IPsec VPN to maintain secure remote connectivity or change to use ZTNA.

If you decided to stay at FortiOS 7.4.x, it will reach end of support (EOS) on 11 May 2026. In the meantime, if you are E-series Fortigate users, you may also plan for replace your hardware to G-series when you plan for your FortiOS 7.6 journey with ZTNA.

Strategic Need to Migrate to Zero Trust (ZTNA)

Fortinet's Zero Trust Direction

• FortiOS 7.0+ integrates ZTNA with FortiClient agents, FortiAuthenticator, and FortiOS application gateways for granular access control.
• ZTNA aligns with hybrid cloud and SaaS environments, reducing attack surfaces compared to SSL VPN's "trusted perimeter" (Trust, but verify) model.

Technical Rationale for Transition

• Enhanced Security : ZTNA enforces "never trust, always verify," mitigating lateral movement risks from compromised endpoints or outdated SSL configurations.
• Performance Gains : ZTNA leverages SASE architecture, enabling low-latency, distributed access without complex tunnel management.

Options:

Short Term:

1. Stay on 7.4.x (Please make sure you have hardening your SSL VPN) (Reference: https://community.fortinet.com/t5/FortiGate/Technical-Tip-Hardening-FortiGate-SSL-VPN-Best-Practices-for/ta-p/349193 and https://www.andrewtravis.com/blog/2024/09/30/fortigate-ssl-vpn-hardening)
   
   
2. Switch to IPSec VPN if go for 7.6

Long Term:

1. ZTNA
2. Stay on IPSec VPN (There may hit operational issue since some public Internet may block IPSec)

Reference:

https://www.mirazon.com/read-this-before-upgrading-to-fortios-7-6/

https://community.fortinet.com/t5/Customer-Service/Technical-Tip-Product-Life-Cycle-Information-on-Fortinet/ta-p/194438

For v7.6 until v7.6.2, models with 2GB or less RAM, SSL VPN web and tunnel mode are removed from the GUI and CLI. See SSL VPN to dial-up VPN migration - FortiGate 7.4.6 administration guide.

For v7.6.3 and later, tunnel mode will be removed, and web mode only works for other devices, see Migration from SSL VPN tunnel mode to IPsec VPN 7.6.3 - FortiGate 7.6.0 new features.

Fortinet SSL VPN customers need to be aware - Gradually transition to ZTNA while maintaining operational stability

Fortigate DNS and Server DNS different case connection rejected on firewall

When the destination URL on CDN e.g. AWS. 

If your Fortigate DNS and Server DNS different case connection denied on firewall

Solution:

To align with those device DNS is same.

Fortigate DNS and Server DNS different case connection rejected on firewall

Fortinet CVE-2024-26015 (FG-IR-23-446) and CVE-2024-26006 (FG-IR-23-485)

https://www.fortiguard.com/psirt/FG-IR-23-446

Upgrade to 7.4.4

https://www.fortiguard.com/psirt/FG-IR-23-485

Either disable "Web Mode" under SSL-VPN Portal or/and upgrade to 7.4.4

Fortinet CVE-2024-26015 (FG-IR-23-446) and CVE-2024-26006 (FG-IR-23-485)

Fortinet SSL VPN - SSL Certificate expired and you need to bypass tempoarilty

Configure SSL VPN to Not Require Certificates

Go to VPN > SSL > Settings > and un-check Require Client Certificate.

Fortinet SSL VPN - SSL Certificate expired and you need to bypass tempoarilty

Fortinet Fortigate Firewall Enable IPS

Under Security Profile -> Intrusion Prevention 

After the profile setting, you need to add into relative firewall rule to use this profile.

Reference:

https://greenclouddefense.com/knowledge-base/fortigate-enable-ips-cc-blocking/

Fortinet Fortigate Firewall Enable IPS

Tencent Cloud using 3rd parties firewall for Internet edge firewall solution - Fortinet

Instead of using Tencent Cloud Firewall Service - Internet Edge Firewall, Fortinet Firewall can use for Internet edge firewall solution.

Reference:

FortiGate基于腾讯云平台部署文档

https://market-10039692.file.myqcloud.com/document/9/fb498bad684d923955af09d4a5eb067c.pdf

https://www.fortinet.com/products/private-cloud-security/fortigate-virtual-appliances

Tencent Cloud using 3rd parties firewall for Internet edge firewall solution - Fortinet

FG-IR-24-029 (Affected version: 7.x) (CVE-2024-23113) - (CVSS 9.8) - Fortinet Fortigate

FG-IR-24-029: FortiOS - Format String Bug in fgfmdA use of externally-controlled format string vulnerability [CWE-134] in FortiOS fgfmd daemon may allow a remote unauthentified attacker to execute arbitrary code or commands via specially crafted requests.


Solution reference Link: https://www.fortiguard.com/psirt/FG-IR-24-029  

Follow the recommended upgrade path using our tool at: https://docs.fortinet.com/upgrade-tool 

This one need to patch ASAP if your firewall is Internet facing and also running on 7.x

Workarounds:  

For each interface, remove the fgfm access, 

for example change :

config system interface

    edit "portX"

         set allowaccess ping https ssh fgfm

    next

end

to :

config system interface

    edit "portX"

         set allowaccess ping https ssh

    next

end

Note that this will prevent FortiGate discovery from FortiManager. Connections from the FortiGate will still work.

Please also note that a local-in policy that only allows FGFM connections from a specific IP will reduce the attack surface but it won't prevent the vulnerability from being exploited from this IP. As a consequence, this should be used as a mitigation and not as a complete workaround.

Reference:

https://www.bleepingcomputer.com/news/security/new-fortinet-rce-flaw-in-ssl-vpn-likely-exploited-in-attacks/

FG-IR-24-029 (Affected version: 7.x) (CVE-2024-23113) - (CVSS 9.8) - Fortinet Fortigate

FG-IR-24-015 (CVE-2024-21762) (CVSS 9.6) - Fortinet Fortigate firewall

Product Security Incident Response Team (PSIRT) advisory regarding our FortiOS. 

FG-IR-24-015: FortiOS - Out-of-bound Write in sslvpnd An out-of-bounds write vulnerability (CWE-787) in FortiOS could potentially allow a remote unauthenticated attacker to execute arbitrary code or commands through specially crafted HTTP requests.


Solution reference Link: https://www.fortiguard.com/psirt/FG-IR-24-015 

Workaround: Disable SSLVPN: https://community.fortinet.com/t5/FortiGate/Technical-Tip-nbsp-How-to-disable-SSL-VPN-functionality-on/ta-p/230801 

And also, the local in policy to enhance the SSL security should be considered:

Config firewall local-in-policy

Edit 4

Set intf "portx" (x is the port number for Public Internet)

Set srcaddr "trusted source IP"

Ste dstaddr "all"

Set action accept

Set service "SSLVPN_10443"

Set schedule "always"

Set status enable

Next

Edit 3

Set intf "portx" (x is the port number for Public Internet)

Set srcaddr "all"

Set dstaddr "all"

Set service "SSLVPN_10443"

Set action deny

Set schedule "always"

Set status enable

Next

end

There are several SSL VPN enhancements consideration:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Optional-security-considerations-for-FortiOS-SSL/ta-p/257561

For long term, you should plan for replace your SSL VPN to ZTNA:

https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/78050/migrating-from-ssl-vpn-to-ztna

Reference:

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Restricting-Allowing-access-to-the-FortiGate-SSL/ta-p/222845

https://community.fortinet.com/t5/FortiGate/Technical-Tip-Optional-security-considerations-for-FortiOS-SSL/ta-p/257561

https://docs.fortinet.com/document/fortigate/6.4.1/administration-guide/726241/matching-geoip-by-registered-and-physical-location

https://docs.fortinet.com/document/fortigate/7.2.4/administration-guide/78050/migrating-from-ssl-vpn-to-ztna

FG-IR-24-015 (CVE-2024-21762) (CVSS 9.6) - Fortinet Fortigate firewall

Fortinet Fortigate enable virtual patch to protect the firewall itself

Under Vdom > .root command prompt:

Virtual patching on the local-in management interface
https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/393161

Fortinet Fortigate enable virtual patch to protect the firewall itself

Fortinet Fortigate Trusted host 10 entry limitation

Fortinet Fortigate Trusted host 10 entry limitation

Workaround:

Create another admin account to get additional 10 entry of trusted host 10 IP addresses / IP range

Fortinet Fortigate Trusted host 10 entry limitation

Fortinet Firewall Feature - Security Rating

Fortinet Security Rating required "Attack Surface Security Rating License" which is included in "Enterprise Protection Bundle" (FortiGuard Bundles)

Reference:

https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/292634/security-rating

Fortinet Firewall Feature - Security Rating

Fortinet Fortigate Firewall on Public Cloud

On Alicloud:

4 vCPU license is minimum requirement since the setup on alicloud is required 2vCPU per 1 network port. Since firewall is required 2 network port, you need to have 4 vCPU license. 

On Tencent Cloud:

No such requirement, you can start from 2 vCPU license.

Fortinet Fortigate Firewall on Public Cloud

Fortinet Fortigate add external Threat Feed

 Under global vdom, security fabric, external connectors:

Add TWO external Connector:

opendbl.net/lists/talos.list

opendbl.net/lists/tor-exit.list

Create TWO firewall rule, one is incoming and one is outgoing:

Reference:

https://docs.fortinet.com/document/fortigate/7.4.2/administration-guide/9463/threat-feeds

https://www.youtube.com/watch?v=CarI6_URN90

Fortinet Fortigate add external Threat Feed

Fortinet Fortigate - Virtual patching on the local-in management interface

Under Vdom > .root command prompt:

How to check the configuration is running?

Under global command promote:

reference:

Virtual patching on the local-in management interface

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/393161

Fortinet Fortigate - Virtual patching on the local-in management interface

A very good security feature on Fortinet Fortigate you should enable to protect your firewall against vulnerability

Virtual patching on the local-in management interface

Virtual patching is a method of mitigating vulnerability exploits by using the FortiGate's IPS engine to block known vulnerabilities. Virtual patching can be applied to traffic destined to the FortiGate by applying the FMWP (Firmware Virtual Patch) database to the local-in interface using local-in policies. Attacks geared towards GUI and SSH management access, for example, can be mitigated using the FMWP database pushed from FortiGuard, thereby virtually patching these vulnerabilities.

https://docs.fortinet.com/document/fortigate/7.4.1/administration-guide/393161/virtual-patching-on-the-local-in-management-interface

A very good security feature on Fortinet Fortigate you should enable to protect your firewall against vulnerability

Fortinet Fortigate Firewall and H3C Switch OSPF network type

In 6.x OS, Fortigate Firewall OSPF in GUI running on "broadcast" network type. You need to check your H3C OSPF is running which network type.

Network type:

broadcast: Broadcast.
non-broadcast: Non-broadcast.
point-to-point: Point-to-point.
point-to-multipoint: Point-to-multipoint.

point-to-multipoint-non-broadcast: Point-to-multipoint and non-broadcast.

If the network type is mis-match between Fortigate and H3C switches, you will see the neighbour but cannot update route in the routing table.

Fortinet Fortigate Firewall and H3C Switch OSPF network type

Tencent Cloud Direct Connect routing constrain

Limitations: 

1. Cannot accept over 100 route via BGP
   
2. Support Statics Route and BGP only

Solution:

Fortinet Fortigate to do OSPF route summarisation and then redistribute to BGP to Tencent cloud

Remark: H3C switch OSPF limitations is cannot summarise route to next hop.

Tencent Cloud Direct Connect routing constrain

Cybersechub announced several threat intelligence (TI) feeds provided by HKCERT, FortiGuard Labs and TrendLabs

 

Cybersechub announced several threat intelligence (TI) feeds provided by HKCERT, FortiGuard Labs and TrendLabs today (20/7/2022). For members, who is able to subscribe it to put into your firewall and SIEM to automate security and respond. It is for free.

 

You can automate the integration with your systems via the machine-to-machine (M2M) threat intelligence application programming interface (API) feature.  By subscribing the M2M sharing service, you can collect the latest indicators of compromise (IoCs) data in machine readable formats (CSV / JSON / STIX) from multiple sources in one go and correlate the IoCs with the system logs of your organisation in order to react promptly to potential cyber attacks.

 

 

https://www.hkcert.org/blog/hkcert-and-cybersec-infohub-fully-support-open-threat-intelligence-campaign

 

Cybersechub announced several threat intelligence (TI) feeds provided by HKCERT, FortiGuard Labs and TrendLabs

FortiOS with External Threat Feed

FortiOS with External Threat Feed with NSFocus. The Build – 6.4.9 build 8978 beta buildis already support NsFocus Threat Feeds Integration by External Connectors.

FortiOS with External Threat Feed with Cisco Talos. https://opendbl.net/lists/talos.list

FortiOS did not support AlienVault TI.  Since the AlienVault TI API is unsupported.

But FortiSOAR is support AlienVault's for TI integration.

 

There are several free Open Dynamic Block Lists able to enhance your security:

https://opendbl.net/

FortiOS with External Threat Feed