Questions[fortinet](server)

this is my first time asking a question here, and I was wondering is it possible to have two different ISP public IPs connected to a single system for high availability?

for example, if our ISP 1 became offline the 2nd ISP will be available, just like google and youtube have different Public addresses, I am just at a loss where to config this.

we are currently using fortinet 300D.

I would like to know if there is not Fortigates an equivalent of the packet-tracer command that we can find on the ASA.

Here is an example of execution for those who don't know it:

NAT and pass :

lev5505# packet-tracer input inside tcp 192.168.3.20 9876 8.8.8.8 80

Phase: 1
Type: ACCESS-LIST
Subtype: 
Result: ALLOW
Config:
Implicit Rule
Additional Information:
MAC Access list

Phase: 2
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside

Phase: 3
Type: ACCESS-LIST
Subtype: log
Result: ALLOW
Config:
access-group inside-in in interface inside
access-list inside-in extended permit tcp any any eq www 
access-list inside-in remark Allows DNS
Additional Information:

Phase: 4
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 5
Type: VPN
Subtype: ipsec-tunnel-flow
Result: ALLOW
Config:
Additional Information:

Phase: 6
Type: NAT
Subtype: 
Result: ALLOW
Config:
object network inside-network
 nat (inside,outside) dynamic interface
Additional Information:
Dynamic translate 192.168.3.20/9876 to 81.56.15.183/9876

Phase: 7
Type: IP-OPTIONS
Subtype: 
Result: ALLOW
Config:
Additional Information:

Phase: 8
Type: FLOW-CREATION
Subtype: 
Result: ALLOW
Config:
Additional Information:
New flow created with id 94755, packet dispatched to next module

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: allow

Blocked by ACL:

lev5505# packet-tracer input inside tcp 192.168.3.20 9876 8.8.8.8 81

Phase: 1
Type: ROUTE-LOOKUP
Subtype: input
Result: ALLOW
Config:
Additional Information:
in   0.0.0.0         0.0.0.0         outside

Phase: 2
Type: ACCESS-LIST
Subtype: 
Result: DROP
Config:
Implicit Rule
Additional Information:

Result:
input-interface: inside
input-status: up
input-line-status: up
output-interface: outside
output-status: up
output-line-status: up
Action: drop
Drop-reason: (acl-drop) Flow is denied by configured rule

Is there any equivalent on the Fortigates ?

I have a Fortigate 80C that allows remote administration via https.

I access the URL and all fine but the one thing that really bugs me is that is brings up "untrusted connection" in chrome with the whole "click to proceed" thing.

At the moment the cert is self-signed by the Fortigate unit.

On the unit there are 5 CA signed certs for use but I cannot figure out how to assign these certs to the routers interfaces.

Does anyone know how to assign the CA signed certs to the WAN interface on port 443 so it wont ask me to confirm the cert all the time?

(I know the traffic is still encrypted but it is still nice to have)

I have configured my Fortigate with a new VPN IPSec tunnel to allow the iOS Cisco client to connect. That works fine. I can RDP to my servers, browse to my servers via IP address, etc.

But, the iPhone does not resolve my internal IP addresses. I have added the DNS servers that serve addresses for my internal users, as well as the WINS servers, but the iPhone acts like it doesn't see them at all.

config vpn ipsec phase1-interface
    edit "iPhone_VPN"
        set type dynamic
        set interface "wan1"
        set dhgrp 2
        set proposal 3des-sha1 3des-md5
        set xauthtype auto
        set mode-cfg enable
        set authusrgrp "iPhone_VPN_Users"
        set ipv4-start-ip 10.10.99.100
        set ipv4-end-ip 10.10.99.199
        set ipv4-netmask 255.255.0.0
        set ipv4-dns-server1 10.10.2.1
        set ipv4-dns-server2 10.22.1.80
        set ipv4-wins-server1 10.10.2.1
        set ipv4-wins-server2 10.22.1.80
        set ipv4-split-include "Dialup_VPN_Networks"
        set psksecret ENC xxxxx
    next
end

For whatever reason, as far as I can tell, the iPhone does not 'see' the DNS or WINS entries. I don't know how to check it...

I don't know a lot about VPNs but I'd like to connect to a Fortinet VPN with Ubuntu.

I can connect on Windows using Forticlient just by entering the policy server (vpn.theserver.com) and then it asks for a user/password. I use IPSec.